# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Jun 3 2020 08:38:37 # Log Creation Date: 21.08.2020 23:37:13.423 Process: id = "1" image_name = "virus.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\virus.exe" page_root = "0x401ec000" os_pid = "0xad8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x454" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\virus.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xadc [0045.965] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76d30000 [0045.966] GetProcAddress (hModule=0x76d30000, lpProcName="lstrlenA") returned 0x76d45a4b [0045.966] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410 [0045.966] GetProcAddress (hModule=0x76d30000, lpProcName="CopyFileA") returned 0x76d658e5 [0045.966] GetProcAddress (hModule=0x76d30000, lpProcName="CreateFileA") returned 0x76d453c6 [0045.966] GetProcAddress (hModule=0x76d30000, lpProcName="ExitProcess") returned 0x76d47a10 [0045.966] GetProcAddress (hModule=0x76d30000, lpProcName="FindClose") returned 0x76d44442 [0045.966] GetProcAddress (hModule=0x76d30000, lpProcName="FindFirstFileA") returned 0x76d4e2ce [0045.966] GetProcAddress (hModule=0x76d30000, lpProcName="FindNextFileA") returned 0x76d6d53e [0045.966] GetProcAddress (hModule=0x76d30000, lpProcName="FindResourceA") returned 0x76d5e9bb [0045.966] GetProcAddress (hModule=0x76d30000, lpProcName="FreeResource") returned 0x76d5d3db [0045.966] GetProcAddress (hModule=0x76d30000, lpProcName="GetCommandLineA") returned 0x76d451a1 [0045.966] GetProcAddress (hModule=0x76d30000, lpProcName="GetEnvironmentVariableA") returned 0x76d433a0 [0045.966] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileAttributesA") returned 0x76d45414 [0045.967] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileSize") returned 0x76d4196e [0045.967] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileTime") returned 0x76d44407 [0045.967] GetProcAddress (hModule=0x76d30000, lpProcName="GetLogicalDrives") returned 0x76d45371 [0045.967] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleFileNameA") returned 0x76d414b1 [0045.967] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleHandleA") returned 0x76d41245 [0045.967] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcessHeap") returned 0x76d414e9 [0045.967] GetProcAddress (hModule=0x76d30000, lpProcName="GetTempPathA") returned 0x76d6276c [0045.967] GetProcAddress (hModule=0x76d30000, lpProcName="GetWindowsDirectoryA") returned 0x76d62b0a [0045.967] GetProcAddress (hModule=0x76d30000, lpProcName="GlobalFree") returned 0x76d45558 [0045.967] GetProcAddress (hModule=0x76d30000, lpProcName="HeapAlloc") returned 0x77c6e026 [0045.967] GetProcAddress (hModule=0x76d30000, lpProcName="LoadResource") returned 0x76d4594c [0045.967] GetProcAddress (hModule=0x76d30000, lpProcName="LockResource") returned 0x76d45959 [0045.967] GetProcAddress (hModule=0x76d30000, lpProcName="MoveFileA") returned 0x76dbd911 [0045.967] GetProcAddress (hModule=0x76d30000, lpProcName="ReadFile") returned 0x76d43ed3 [0045.968] GetProcAddress (hModule=0x76d30000, lpProcName="RtlMoveMemory") returned 0x77ca3c40 [0045.968] GetProcAddress (hModule=0x76d30000, lpProcName="SetErrorMode") returned 0x76d41b00 [0045.968] GetProcAddress (hModule=0x76d30000, lpProcName="SetFilePointer") returned 0x76d417d1 [0045.968] GetProcAddress (hModule=0x76d30000, lpProcName="SetFileTime") returned 0x76d5ecbb [0045.968] GetProcAddress (hModule=0x76d30000, lpProcName="SizeofResource") returned 0x76d45ac9 [0045.968] GetProcAddress (hModule=0x76d30000, lpProcName="WriteFile") returned 0x76d41282 [0045.968] GetProcAddress (hModule=0x76d30000, lpProcName="lstrcatA") returned 0x76d62b7a [0045.969] GetProcAddress (hModule=0x76d30000, lpProcName="lstrcmpA") returned 0x76d5eceb [0045.969] GetProcAddress (hModule=0x76d30000, lpProcName="lstrcmpiA") returned 0x76d43e8e [0045.969] GetProcAddress (hModule=0x76d30000, lpProcName="lstrcpyA") returned 0x76d62a9d [0045.969] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77710000 [0045.969] GetProcAddress (hModule=0x77710000, lpProcName="RegCreateKeyExA") returned 0x77721469 [0045.969] GetProcAddress (hModule=0x77710000, lpProcName="CryptCreateHash") returned 0x7771df4e [0045.969] GetProcAddress (hModule=0x77710000, lpProcName="CryptDestroyHash") returned 0x7771df66 [0045.969] GetProcAddress (hModule=0x77710000, lpProcName="CryptGetHashParam") returned 0x7771df7e [0045.969] GetProcAddress (hModule=0x77710000, lpProcName="RegSetValueExA") returned 0x777214b3 [0045.969] GetProcAddress (hModule=0x77710000, lpProcName="RegDeleteKeyA") returned 0x7773a8b7 [0045.969] GetProcAddress (hModule=0x77710000, lpProcName="CryptAcquireContextA") returned 0x777191dd [0045.969] GetProcAddress (hModule=0x77710000, lpProcName="RegCloseKey") returned 0x7772469d [0045.970] GetProcAddress (hModule=0x77710000, lpProcName="CryptReleaseContext") returned 0x7771e124 [0045.970] GetProcAddress (hModule=0x77710000, lpProcName="CryptHashData") returned 0x7771df36 [0045.970] LoadLibraryA (lpLibFileName="comctl32.dll") returned 0x755f0000 [0045.970] GetProcAddress (hModule=0x755f0000, lpProcName="InitCommonControls") returned 0x755f1739 [0045.970] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x770a0000 [0045.970] GetProcAddress (hModule=0x770a0000, lpProcName="CreateFontIndirectA") returned 0x770bcffd [0045.970] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x759d0000 [0045.970] GetProcAddress (hModule=0x759d0000, lpProcName="ShellExecuteA") returned 0x75c17078 [0045.970] GetProcAddress (hModule=0x759d0000, lpProcName="SHGetSpecialFolderPathA") returned 0x75c1fb26 [0045.970] LoadLibraryA (lpLibFileName="shlwapi.dll") returned 0x772f0000 [0045.970] GetProcAddress (hModule=0x772f0000, lpProcName="PathFindFileNameA") returned 0x773000aa [0045.970] GetProcAddress (hModule=0x772f0000, lpProcName="PathFindExtensionA") returned 0x7731eced [0045.970] GetProcAddress (hModule=0x772f0000, lpProcName="PathAddBackslashA") returned 0x772fcf33 [0045.971] GetProcAddress (hModule=0x772f0000, lpProcName="PathMatchSpecA") returned 0x7732af13 [0045.971] LoadLibraryA (lpLibFileName="user32.dll") returned 0x77130000 [0045.971] GetProcAddress (hModule=0x77130000, lpProcName="RegisterClassExA") returned 0x7714db98 [0045.971] GetProcAddress (hModule=0x77130000, lpProcName="PeekMessageA") returned 0x77155f74 [0045.971] GetProcAddress (hModule=0x77130000, lpProcName="SendMessageA") returned 0x7715612e [0045.971] GetProcAddress (hModule=0x77130000, lpProcName="LoadCursorA") returned 0x7714dad5 [0045.971] GetProcAddress (hModule=0x77130000, lpProcName="GetSystemMetrics") returned 0x77147d2f [0045.971] GetProcAddress (hModule=0x77130000, lpProcName="GetMessageA") returned 0x77147bd3 [0045.971] GetProcAddress (hModule=0x77130000, lpProcName="GetDlgItemTextA") returned 0x771a6b36 [0045.971] GetProcAddress (hModule=0x77130000, lpProcName="EndPaint") returned 0x77151341 [0045.971] GetProcAddress (hModule=0x77130000, lpProcName="SystemParametersInfoA") returned 0x77156c30 [0045.971] GetProcAddress (hModule=0x77130000, lpProcName="TranslateMessage") returned 0x77147809 [0045.971] GetProcAddress (hModule=0x77130000, lpProcName="UpdateWindow") returned 0x77153559 [0045.972] GetProcAddress (hModule=0x77130000, lpProcName="MessageBoxA") returned 0x7719fd1e [0045.972] GetProcAddress (hModule=0x77130000, lpProcName="DispatchMessageA") returned 0x77147bbb [0045.972] GetProcAddress (hModule=0x77130000, lpProcName="DefWindowProcA") returned 0x77c824e0 [0045.972] GetProcAddress (hModule=0x77130000, lpProcName="CreateWindowExA") returned 0x7714d22e [0045.972] GetProcAddress (hModule=0x77130000, lpProcName="BeginPaint") returned 0x77151361 [0045.972] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0046.125] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0046.148] GetProcessHeap () returned 0x2c0000 [0046.175] FindResourceA (hModule=0x0, lpName=0xe, lpType=0x2) returned 0x87e0c0 [0046.175] SizeofResource (hModule=0x0, hResInfo=0x87e0c0) returned 0x4a2 [0046.175] LoadResource (hModule=0x0, hResInfo=0x87e0c0) returned 0x87b270 [0046.175] LockResource (hResData=0x87b270) returned 0x87b270 [0046.175] RtlMoveMemory (in: Destination=0x406db9, Source=0x87b270, Length=0x10 | out: Destination=0x406db9) [0046.175] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0xd7) returned 0x2d48c0 [0046.175] RtlMoveMemory (in: Destination=0x2d48c0, Source=0x87b284, Length=0xd7 | out: Destination=0x2d48c0) [0046.175] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x361) returned 0x2d49a0 [0046.175] RtlMoveMemory (in: Destination=0x2d49a0, Source=0x87b35f, Length=0x361 | out: Destination=0x2d49a0) [0046.175] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x9) returned 0x2cf0b0 [0046.175] RtlMoveMemory (in: Destination=0x2cf0b0, Source=0x87b6c4, Length=0x9 | out: Destination=0x2cf0b0) [0046.175] RtlMoveMemory (in: Destination=0x406dc9, Source=0x87b6cd, Length=0x10 | out: Destination=0x406dc9) [0046.175] RtlMoveMemory (in: Destination=0x407529, Source=0x87b6dd, Length=0x5 | out: Destination=0x407529) [0046.175] RtlMoveMemory (in: Destination=0x406dd9, Source=0x87b6e2, Length=0x10 | out: Destination=0x406dd9) [0046.175] RtlMoveMemory (in: Destination=0x406de9, Source=0x87b6f2, Length=0x10 | out: Destination=0x406de9) [0046.175] RtlMoveMemory (in: Destination=0x407525, Source=0x87b702, Length=0x4 | out: Destination=0x407525) [0046.175] RtlMoveMemory (in: Destination=0x4065a5, Source=0x87b706, Length=0x4 | out: Destination=0x4065a5) [0046.175] RtlMoveMemory (in: Destination=0x4065a9, Source=0x87b70a, Length=0x4 | out: Destination=0x4065a9) [0046.175] RtlMoveMemory (in: Destination=0x4065ad, Source=0x87b70e, Length=0x4 | out: Destination=0x4065ad) [0046.175] FreeResource (hResData=0x87b270) returned 0 [0046.175] GetTempPathA (in: nBufferLength=0x200, lpBuffer=0x404e50 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0046.314] lstrcpyA (in: lpString1=0x405950, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" [0046.314] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x405450, nSize=0x500 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\virus.exe")) returned 0x2f [0046.314] RtlAllocateHeap (HeapHandle=0x2c0000, Flags=0x8, Size=0x1e3f6d) returned 0x2260020 [0046.314] GetWindowsDirectoryA (in: lpBuffer=0x40755e, uSize=0x200 | out: lpBuffer="C:\\Windows") returned 0xa [0046.314] PathAddBackslashA (in: pszPath="C:\\Windows" | out: pszPath="C:\\Windows\\") returned="" [0046.315] lstrcatA (in: lpString1="C:\\Windows\\", lpString2="explorer.exe" | out: lpString1="C:\\Windows\\explorer.exe") returned="C:\\Windows\\explorer.exe" [0046.315] CreateFileA (lpFileName="C:\\Windows\\explorer.exe" (normalized: "c:\\windows\\explorer.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x74 [0046.315] GetFileTime (in: hFile=0x74, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556 | out: lpCreationTime=0x407546*(dwLowDateTime=0x90cd4312, dwHighDateTime=0x1cb892b), lpLastAccessTime=0x40754e*(dwLowDateTime=0x90cd4312, dwHighDateTime=0x1cb892b), lpLastWriteTime=0x407556*(dwLowDateTime=0x90d6c893, dwHighDateTime=0x1cb892b)) returned 1 [0046.315] CloseHandle (hObject=0x74) returned 1 [0046.315] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", lpString2="ywIUhorNZQUsNoQ" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\ywIUhorNZQUsNoQ") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\ywIUhorNZQUsNoQ" [0046.315] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\ywIUhorNZQUsNoQ", lpString2=".exe" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\ywIUhorNZQUsNoQ.exe") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\ywIUhorNZQUsNoQ.exe" [0046.315] CopyFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\virus.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\virus.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\ywIUhorNZQUsNoQ.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ywiuhornzqusnoq.exe"), bFailIfExists=1) returned 1 [0046.375] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\ywIUhorNZQUsNoQ.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ywiuhornzqusnoq.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x78 [0046.375] SetFileTime (hFile=0x78, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.375] CloseHandle (hObject=0x78) returned 1 [0046.375] RegCreateKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x18ff6c, lpdwDisposition=0x18ff70 | out: phkResult=0x18ff6c*=0x78, lpdwDisposition=0x18ff70*=0x2) returned 0x0 [0046.375] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\ywIUhorNZQUsNoQ.exe") returned 56 [0046.375] RegSetValueExA (in: hKey=0x78, lpValueName="Alcmeter", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\ywIUhorNZQUsNoQ.exe", cbData=0x38 | out: lpData="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\ywIUhorNZQUsNoQ.exe") returned 0x0 [0046.376] RegCloseKey (hKey=0x78) returned 0x0 [0046.376] lstrcpyA (in: lpString1=0x4065b9, lpString2="." | out: lpString1=".") returned="." [0046.376] lstrcatA (in: lpString1=".", lpString2="wannacry" | out: lpString1=".wannacry") returned=".wannacry" [0046.376] RegCreateKeyExA (in: hKey=0x80000000, lpSubKey=".wannacry", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x18ff68, lpdwDisposition=0x18ff6c | out: phkResult=0x18ff68*=0x7e, lpdwDisposition=0x18ff6c*=0x1) returned 0x0 [0046.379] lstrlenA (lpString="ZZMVTONZLYHGTOX") returned 15 [0046.379] RegSetValueExA (in: hKey=0x7e, lpValueName="", Reserved=0x0, dwType=0x1, lpData="ZZMVTONZLYHGTOX", cbData=0xf | out: lpData="ZZMVTONZLYHGTOX") returned 0x0 [0046.380] RegCloseKey (hKey=0x7e) returned 0x0 [0046.380] RegCreateKeyExA (in: hKey=0x80000000, lpSubKey="ZZMVTONZLYHGTOX", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x18ff68, lpdwDisposition=0x18ff6c | out: phkResult=0x18ff68*=0x76, lpdwDisposition=0x18ff6c*=0x1) returned 0x0 [0046.381] lstrlenA (lpString="CRYPTED!") returned 8 [0046.381] RegSetValueExA (in: hKey=0x76, lpValueName="", Reserved=0x0, dwType=0x1, lpData="CRYPTED!", cbData=0x8 | out: lpData="CRYPTED!") returned 0x0 [0046.381] RegCloseKey (hKey=0x76) returned 0x0 [0046.381] lstrcpyA (in: lpString1=0x4065b9, lpString2="ZZMVTONZLYHGTOX" | out: lpString1="ZZMVTONZLYHGTOX") returned="ZZMVTONZLYHGTOX" [0046.381] lstrcatA (in: lpString1="ZZMVTONZLYHGTOX", lpString2="\\DefaultIcon" | out: lpString1="ZZMVTONZLYHGTOX\\DefaultIcon") returned="ZZMVTONZLYHGTOX\\DefaultIcon" [0046.381] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\ywIUhorNZQUsNoQ.exe", lpString2=",0" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\ywIUhorNZQUsNoQ.exe,0") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\ywIUhorNZQUsNoQ.exe,0" [0046.381] RegCreateKeyExA (in: hKey=0x80000000, lpSubKey="ZZMVTONZLYHGTOX\\DefaultIcon", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x18ff68, lpdwDisposition=0x18ff6c | out: phkResult=0x18ff68*=0x7e, lpdwDisposition=0x18ff6c*=0x1) returned 0x0 [0046.382] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\ywIUhorNZQUsNoQ.exe,0") returned 58 [0046.382] RegSetValueExA (in: hKey=0x7e, lpValueName="", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\ywIUhorNZQUsNoQ.exe,0", cbData=0x3a | out: lpData="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\ywIUhorNZQUsNoQ.exe,0") returned 0x0 [0046.382] RegCloseKey (hKey=0x7e) returned 0x0 [0046.382] lstrcpyA (in: lpString1=0x4065b9, lpString2="ZZMVTONZLYHGTOX" | out: lpString1="ZZMVTONZLYHGTOX") returned="ZZMVTONZLYHGTOX" [0046.382] lstrcatA (in: lpString1="ZZMVTONZLYHGTOX", lpString2="\\shell\\open\\command" | out: lpString1="ZZMVTONZLYHGTOX\\shell\\open\\command") returned="ZZMVTONZLYHGTOX\\shell\\open\\command" [0046.382] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\ywIUhorNZQUsNoQ.exe,0") returned 58 [0046.382] RegCreateKeyExA (in: hKey=0x80000000, lpSubKey="ZZMVTONZLYHGTOX\\shell\\open\\command", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x18ff68, lpdwDisposition=0x18ff6c | out: phkResult=0x18ff68*=0x82, lpdwDisposition=0x18ff6c*=0x1) returned 0x0 [0046.383] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\ywIUhorNZQUsNoQ.exe") returned 56 [0046.383] RegSetValueExA (in: hKey=0x82, lpValueName="", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\ywIUhorNZQUsNoQ.exe", cbData=0x38 | out: lpData="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\ywIUhorNZQUsNoQ.exe") returned 0x0 [0046.384] RegCloseKey (hKey=0x82) returned 0x0 [0046.384] SetErrorMode (uMode=0x1) returned 0x0 [0046.384] GetLogicalDrives () returned 0x4 [0046.384] FindFirstFileA (in: lpFileName="C:\\*.*", lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x76d62728, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x2d4d10 [0046.384] lstrcmpA (lpString1=".", lpString2="$Recycle.Bin") returned 1 [0046.386] lstrcmpA (lpString1="..", lpString2="$Recycle.Bin") returned 1 [0046.386] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0046.386] lstrcatA (in: lpString1="C:\\", lpString2="$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0046.386] lstrlenA (lpString="C:\\$Recycle.Bin") returned 15 [0046.386] FindFirstFileA (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76e101a0, dwReserved1=0x18fad0, cFileName=".", cAlternateFileName="")) returned 0x2d4f00 [0046.386] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.386] FindNextFileA (in: hFindFile=0x2d4f00, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x180000, cFileName="..", cAlternateFileName="")) returned 1 [0046.387] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.387] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.387] FindNextFileA (in: hFindFile=0x2d4f00, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0046.387] lstrcmpA (lpString1=".", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0046.387] lstrcmpA (lpString1="..", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0046.387] PathFindFileNameA (pszPath="C:\\$Recycle.Bin\\*.*") returned="*.*" [0046.387] lstrcatA (in: lpString1="C:\\$Recycle.Bin\\", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000" [0046.387] lstrlenA (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0046.387] FindFirstFileA (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d4f40, dwReserved1=0x2d4f3b, cFileName=".", cAlternateFileName="")) returned 0x2d5fd8 [0046.387] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.387] FindNextFileA (in: hFindFile=0x2d5fd8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.387] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.387] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.387] FindNextFileA (in: hFindFile=0x2d5fd8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0046.387] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.388] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="desktop.ini") returned 1 [0046.388] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0046.388] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0046.388] PathFindFileNameA (pszPath="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*") returned="*.*" [0046.388] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" [0046.388] PathAddBackslashA (in: pszPath="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" | out: pszPath="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="" [0046.388] lstrcatA (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" [0046.388] GetFileAttributesA (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\how to decrypt files.txt")) returned 0xffffffff [0046.388] CreateFileA (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0046.389] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.390] WriteFile (in: hFile=0x84, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.391] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.391] CloseHandle (hObject=0x84) returned 1 [0046.395] lstrcatA (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="desktop.ini" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" [0046.395] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.zip") returned 0 [0046.397] lstrlenA (lpString="*.zip") returned 5 [0046.397] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.rar") returned 0 [0046.397] lstrlenA (lpString="*.rar") returned 5 [0046.397] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.7z") returned 0 [0046.397] lstrlenA (lpString="*.7z") returned 4 [0046.397] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.tar") returned 0 [0046.397] lstrlenA (lpString="*.tar") returned 5 [0046.397] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.gzip") returned 0 [0046.397] lstrlenA (lpString="*.gzip") returned 6 [0046.397] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.jpg") returned 0 [0046.397] lstrlenA (lpString="*.jpg") returned 5 [0046.397] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.jpeg") returned 0 [0046.397] lstrlenA (lpString="*.jpeg") returned 6 [0046.397] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.psd") returned 0 [0046.397] lstrlenA (lpString="*.psd") returned 5 [0046.398] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.gif") returned 0 [0046.398] lstrlenA (lpString="*.gif") returned 5 [0046.398] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.doc") returned 0 [0046.398] lstrlenA (lpString="*.doc") returned 5 [0046.398] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.docx") returned 0 [0046.398] lstrlenA (lpString="*.docx") returned 6 [0046.398] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.xls") returned 0 [0046.398] lstrlenA (lpString="*.xls") returned 5 [0046.398] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.xlsx") returned 0 [0046.398] lstrlenA (lpString="*.xlsx") returned 6 [0046.398] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.ppt") returned 0 [0046.398] lstrlenA (lpString="*.ppt") returned 5 [0046.398] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.pptx") returned 0 [0046.398] lstrlenA (lpString="*.pptx") returned 6 [0046.398] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.pdf") returned 0 [0046.398] lstrlenA (lpString="*.pdf") returned 5 [0046.398] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mov") returned 0 [0046.398] lstrlenA (lpString="*.mov") returned 5 [0046.398] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.m2v") returned 0 [0046.398] lstrlenA (lpString="*.m2v") returned 5 [0046.398] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.3gp") returned 0 [0046.398] lstrlenA (lpString="*.3gp") returned 5 [0046.398] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mpeg") returned 0 [0046.398] lstrlenA (lpString="*.mpeg") returned 6 [0046.398] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mpg") returned 0 [0046.398] lstrlenA (lpString="*.mpg") returned 5 [0046.398] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.flv") returned 0 [0046.398] lstrlenA (lpString="*.flv") returned 5 [0046.402] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.avi") returned 0 [0046.402] lstrlenA (lpString="*.avi") returned 5 [0046.402] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mp4") returned 0 [0046.402] lstrlenA (lpString="*.mp4") returned 5 [0046.402] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.wmv") returned 0 [0046.402] lstrlenA (lpString="*.wmv") returned 5 [0046.402] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.divx") returned 0 [0046.402] lstrlenA (lpString="*.divx") returned 6 [0046.402] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mkv") returned 0 [0046.402] lstrlenA (lpString="*.mkv") returned 5 [0046.402] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mp3") returned 0 [0046.402] lstrlenA (lpString="*.mp3") returned 5 [0046.402] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.wav") returned 0 [0046.402] lstrlenA (lpString="*.wav") returned 5 [0046.402] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.flac") returned 0 [0046.402] lstrlenA (lpString="*.flac") returned 6 [0046.402] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.ape") returned 0 [0046.402] lstrlenA (lpString="*.ape") returned 5 [0046.402] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.wma") returned 0 [0046.402] lstrlenA (lpString="*.wma") returned 5 [0046.402] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.ac3") returned 0 [0046.402] lstrlenA (lpString="*.ac3") returned 5 [0046.402] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mxf") returned 0 [0046.402] lstrlenA (lpString="*.mxf") returned 5 [0046.402] FindNextFileA (in: hFindFile=0x2d5fd8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0046.403] FindClose (in: hFindFile=0x2d5fd8 | out: hFindFile=0x2d5fd8) returned 1 [0046.403] FindNextFileA (in: hFindFile=0x2d4f00, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0046.403] FindClose (in: hFindFile=0x2d4f00 | out: hFindFile=0x2d4f00) returned 1 [0046.403] FindNextFileA (in: hFindFile=0x2d4d10, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520024, dwReserved1=0x3, cFileName="Boot", cAlternateFileName="")) returned 1 [0046.403] lstrcmpA (lpString1=".", lpString2="Boot") returned -1 [0046.403] lstrcmpA (lpString1="..", lpString2="Boot") returned -1 [0046.403] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0046.403] lstrcatA (in: lpString1="C:\\", lpString2="Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0046.403] lstrlenA (lpString="C:\\Boot") returned 7 [0046.403] FindFirstFileA (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d4ed0, dwReserved1=0x2d4ecb, cFileName=".", cAlternateFileName="")) returned 0x2d5ef8 [0046.403] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.403] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.404] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.404] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.404] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0046.404] PeekMessageA (in: lpMsg=0x18fcc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcc4) returned 0 [0046.404] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BCD") returned 1 [0046.404] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCD") returned 1 [0046.404] lstrcmpiA (lpString1="", lpString2="BCD") returned -1 [0046.404] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0046.404] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0046.404] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned="" [0046.404] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt" [0046.404] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0xffffffff [0046.404] CreateFileA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x74 [0046.405] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.405] WriteFile (in: hFile=0x74, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.406] SetFileTime (hFile=0x74, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.407] CloseHandle (hObject=0x74) returned 1 [0046.407] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BCD" | out: lpString1="C:\\Boot\\BCD") returned="C:\\Boot\\BCD" [0046.407] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.zip") returned 0 [0046.407] lstrlenA (lpString="*.zip") returned 5 [0046.407] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.rar") returned 0 [0046.407] lstrlenA (lpString="*.rar") returned 5 [0046.407] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.7z") returned 0 [0046.407] lstrlenA (lpString="*.7z") returned 4 [0046.407] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.tar") returned 0 [0046.407] lstrlenA (lpString="*.tar") returned 5 [0046.407] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.gzip") returned 0 [0046.407] lstrlenA (lpString="*.gzip") returned 6 [0046.407] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.jpg") returned 0 [0046.407] lstrlenA (lpString="*.jpg") returned 5 [0046.407] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.jpeg") returned 0 [0046.407] lstrlenA (lpString="*.jpeg") returned 6 [0046.407] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.psd") returned 0 [0046.407] lstrlenA (lpString="*.psd") returned 5 [0046.408] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.gif") returned 0 [0046.408] lstrlenA (lpString="*.gif") returned 5 [0046.408] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.doc") returned 0 [0046.408] lstrlenA (lpString="*.doc") returned 5 [0046.408] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.docx") returned 0 [0046.408] lstrlenA (lpString="*.docx") returned 6 [0046.408] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.xls") returned 0 [0046.408] lstrlenA (lpString="*.xls") returned 5 [0046.408] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.xlsx") returned 0 [0046.408] lstrlenA (lpString="*.xlsx") returned 6 [0046.408] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.ppt") returned 0 [0046.408] lstrlenA (lpString="*.ppt") returned 5 [0046.408] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.pptx") returned 0 [0046.408] lstrlenA (lpString="*.pptx") returned 6 [0046.408] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.pdf") returned 0 [0046.408] lstrlenA (lpString="*.pdf") returned 5 [0046.408] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mov") returned 0 [0046.408] lstrlenA (lpString="*.mov") returned 5 [0046.408] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.m2v") returned 0 [0046.408] lstrlenA (lpString="*.m2v") returned 5 [0046.408] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.3gp") returned 0 [0046.408] lstrlenA (lpString="*.3gp") returned 5 [0046.408] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mpeg") returned 0 [0046.408] lstrlenA (lpString="*.mpeg") returned 6 [0046.408] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mpg") returned 0 [0046.408] lstrlenA (lpString="*.mpg") returned 5 [0046.408] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.flv") returned 0 [0046.408] lstrlenA (lpString="*.flv") returned 5 [0046.409] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.avi") returned 0 [0046.409] lstrlenA (lpString="*.avi") returned 5 [0046.409] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mp4") returned 0 [0046.409] lstrlenA (lpString="*.mp4") returned 5 [0046.409] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.wmv") returned 0 [0046.409] lstrlenA (lpString="*.wmv") returned 5 [0046.409] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.divx") returned 0 [0046.409] lstrlenA (lpString="*.divx") returned 6 [0046.409] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mkv") returned 0 [0046.409] lstrlenA (lpString="*.mkv") returned 5 [0046.409] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mp3") returned 0 [0046.409] lstrlenA (lpString="*.mp3") returned 5 [0046.409] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.wav") returned 0 [0046.409] lstrlenA (lpString="*.wav") returned 5 [0046.409] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.flac") returned 0 [0046.409] lstrlenA (lpString="*.flac") returned 6 [0046.409] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.ape") returned 0 [0046.409] lstrlenA (lpString="*.ape") returned 5 [0046.409] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.wma") returned 0 [0046.409] lstrlenA (lpString="*.wma") returned 5 [0046.409] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.ac3") returned 0 [0046.409] lstrlenA (lpString="*.ac3") returned 5 [0046.409] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mxf") returned 0 [0046.409] lstrlenA (lpString="*.mxf") returned 5 [0046.409] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x9098e7a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x2d71b8, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0046.409] PeekMessageA (in: lpMsg=0x18fcc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcc4) returned 0 [0046.409] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BCD.LOG") returned 1 [0046.410] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCD.LOG") returned 1 [0046.410] lstrcmpiA (lpString1="", lpString2="BCD.LOG") returned -1 [0046.410] PathFindFileNameA (pszPath="C:\\Boot\\BCD") returned="BCD" [0046.410] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0046.410] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned="" [0046.410] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt" [0046.410] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0x20 [0046.410] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG" | out: lpString1="C:\\Boot\\BCD.LOG") returned="C:\\Boot\\BCD.LOG" [0046.410] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.zip") returned 0 [0046.410] lstrlenA (lpString="*.zip") returned 5 [0046.410] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.rar") returned 0 [0046.410] lstrlenA (lpString="*.rar") returned 5 [0046.410] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.7z") returned 0 [0046.410] lstrlenA (lpString="*.7z") returned 4 [0046.410] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.tar") returned 0 [0046.410] lstrlenA (lpString="*.tar") returned 5 [0046.410] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.gzip") returned 0 [0046.410] lstrlenA (lpString="*.gzip") returned 6 [0046.410] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.jpg") returned 0 [0046.410] lstrlenA (lpString="*.jpg") returned 5 [0046.410] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.jpeg") returned 0 [0046.410] lstrlenA (lpString="*.jpeg") returned 6 [0046.410] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.psd") returned 0 [0046.410] lstrlenA (lpString="*.psd") returned 5 [0046.411] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.gif") returned 0 [0046.411] lstrlenA (lpString="*.gif") returned 5 [0046.411] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.doc") returned 0 [0046.411] lstrlenA (lpString="*.doc") returned 5 [0046.411] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.docx") returned 0 [0046.411] lstrlenA (lpString="*.docx") returned 6 [0046.411] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.xls") returned 0 [0046.411] lstrlenA (lpString="*.xls") returned 5 [0046.411] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.xlsx") returned 0 [0046.411] lstrlenA (lpString="*.xlsx") returned 6 [0046.411] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.ppt") returned 0 [0046.411] lstrlenA (lpString="*.ppt") returned 5 [0046.411] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.pptx") returned 0 [0046.411] lstrlenA (lpString="*.pptx") returned 6 [0046.411] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.pdf") returned 0 [0046.411] lstrlenA (lpString="*.pdf") returned 5 [0046.411] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mov") returned 0 [0046.411] lstrlenA (lpString="*.mov") returned 5 [0046.411] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.m2v") returned 0 [0046.411] lstrlenA (lpString="*.m2v") returned 5 [0046.411] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.3gp") returned 0 [0046.411] lstrlenA (lpString="*.3gp") returned 5 [0046.411] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mpeg") returned 0 [0046.411] lstrlenA (lpString="*.mpeg") returned 6 [0046.411] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mpg") returned 0 [0046.411] lstrlenA (lpString="*.mpg") returned 5 [0046.411] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.flv") returned 0 [0046.411] lstrlenA (lpString="*.flv") returned 5 [0046.412] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.avi") returned 0 [0046.412] lstrlenA (lpString="*.avi") returned 5 [0046.412] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mp4") returned 0 [0046.412] lstrlenA (lpString="*.mp4") returned 5 [0046.412] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.wmv") returned 0 [0046.412] lstrlenA (lpString="*.wmv") returned 5 [0046.412] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.divx") returned 0 [0046.412] lstrlenA (lpString="*.divx") returned 6 [0046.412] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mkv") returned 0 [0046.412] lstrlenA (lpString="*.mkv") returned 5 [0046.412] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mp3") returned 0 [0046.412] lstrlenA (lpString="*.mp3") returned 5 [0046.412] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.wav") returned 0 [0046.412] lstrlenA (lpString="*.wav") returned 5 [0046.412] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.flac") returned 0 [0046.412] lstrlenA (lpString="*.flac") returned 6 [0046.412] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.ape") returned 0 [0046.412] lstrlenA (lpString="*.ape") returned 5 [0046.412] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.wma") returned 0 [0046.412] lstrlenA (lpString="*.wma") returned 5 [0046.412] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.ac3") returned 0 [0046.412] lstrlenA (lpString="*.ac3") returned 5 [0046.412] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mxf") returned 0 [0046.412] lstrlenA (lpString="*.mxf") returned 5 [0046.412] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0046.412] PeekMessageA (in: lpMsg=0x18fcc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcc4) returned 0 [0046.412] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BCD.LOG1") returned 1 [0046.413] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCD.LOG1") returned 1 [0046.413] lstrcmpiA (lpString1="", lpString2="BCD.LOG1") returned -1 [0046.413] PathFindFileNameA (pszPath="C:\\Boot\\BCD.LOG") returned="BCD.LOG" [0046.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0046.413] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned="" [0046.413] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt" [0046.413] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0x20 [0046.413] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG1" | out: lpString1="C:\\Boot\\BCD.LOG1") returned="C:\\Boot\\BCD.LOG1" [0046.413] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.zip") returned 0 [0046.413] lstrlenA (lpString="*.zip") returned 5 [0046.413] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.rar") returned 0 [0046.413] lstrlenA (lpString="*.rar") returned 5 [0046.413] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.7z") returned 0 [0046.413] lstrlenA (lpString="*.7z") returned 4 [0046.413] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.tar") returned 0 [0046.413] lstrlenA (lpString="*.tar") returned 5 [0046.413] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.gzip") returned 0 [0046.413] lstrlenA (lpString="*.gzip") returned 6 [0046.413] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.jpg") returned 0 [0046.413] lstrlenA (lpString="*.jpg") returned 5 [0046.413] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.jpeg") returned 0 [0046.413] lstrlenA (lpString="*.jpeg") returned 6 [0046.413] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.psd") returned 0 [0046.413] lstrlenA (lpString="*.psd") returned 5 [0046.414] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.gif") returned 0 [0046.414] lstrlenA (lpString="*.gif") returned 5 [0046.414] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.doc") returned 0 [0046.414] lstrlenA (lpString="*.doc") returned 5 [0046.414] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.docx") returned 0 [0046.414] lstrlenA (lpString="*.docx") returned 6 [0046.414] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.xls") returned 0 [0046.414] lstrlenA (lpString="*.xls") returned 5 [0046.414] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.xlsx") returned 0 [0046.414] lstrlenA (lpString="*.xlsx") returned 6 [0046.414] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.ppt") returned 0 [0046.414] lstrlenA (lpString="*.ppt") returned 5 [0046.414] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.pptx") returned 0 [0046.414] lstrlenA (lpString="*.pptx") returned 6 [0046.414] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.pdf") returned 0 [0046.414] lstrlenA (lpString="*.pdf") returned 5 [0046.414] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mov") returned 0 [0046.414] lstrlenA (lpString="*.mov") returned 5 [0046.414] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.m2v") returned 0 [0046.414] lstrlenA (lpString="*.m2v") returned 5 [0046.414] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.3gp") returned 0 [0046.414] lstrlenA (lpString="*.3gp") returned 5 [0046.414] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mpeg") returned 0 [0046.414] lstrlenA (lpString="*.mpeg") returned 6 [0046.414] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mpg") returned 0 [0046.414] lstrlenA (lpString="*.mpg") returned 5 [0046.414] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.flv") returned 0 [0046.414] lstrlenA (lpString="*.flv") returned 5 [0046.415] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.avi") returned 0 [0046.415] lstrlenA (lpString="*.avi") returned 5 [0046.415] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mp4") returned 0 [0046.415] lstrlenA (lpString="*.mp4") returned 5 [0046.415] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.wmv") returned 0 [0046.415] lstrlenA (lpString="*.wmv") returned 5 [0046.415] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.divx") returned 0 [0046.415] lstrlenA (lpString="*.divx") returned 6 [0046.415] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mkv") returned 0 [0046.415] lstrlenA (lpString="*.mkv") returned 5 [0046.415] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mp3") returned 0 [0046.415] lstrlenA (lpString="*.mp3") returned 5 [0046.415] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.wav") returned 0 [0046.415] lstrlenA (lpString="*.wav") returned 5 [0046.415] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.flac") returned 0 [0046.415] lstrlenA (lpString="*.flac") returned 6 [0046.415] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.ape") returned 0 [0046.415] lstrlenA (lpString="*.ape") returned 5 [0046.415] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.wma") returned 0 [0046.415] lstrlenA (lpString="*.wma") returned 5 [0046.415] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.ac3") returned 0 [0046.415] lstrlenA (lpString="*.ac3") returned 5 [0046.415] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mxf") returned 0 [0046.415] lstrlenA (lpString="*.mxf") returned 5 [0046.415] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0046.415] PeekMessageA (in: lpMsg=0x18fcc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcc4) returned 0 [0046.416] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BCD.LOG2") returned 1 [0046.416] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCD.LOG2") returned 1 [0046.416] lstrcmpiA (lpString1="", lpString2="BCD.LOG2") returned -1 [0046.416] PathFindFileNameA (pszPath="C:\\Boot\\BCD.LOG1") returned="BCD.LOG1" [0046.416] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0046.416] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned="" [0046.416] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt" [0046.416] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0x20 [0046.416] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG2" | out: lpString1="C:\\Boot\\BCD.LOG2") returned="C:\\Boot\\BCD.LOG2" [0046.416] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.zip") returned 0 [0046.416] lstrlenA (lpString="*.zip") returned 5 [0046.416] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.rar") returned 0 [0046.416] lstrlenA (lpString="*.rar") returned 5 [0046.416] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.7z") returned 0 [0046.416] lstrlenA (lpString="*.7z") returned 4 [0046.416] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.tar") returned 0 [0046.416] lstrlenA (lpString="*.tar") returned 5 [0046.416] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.gzip") returned 0 [0046.416] lstrlenA (lpString="*.gzip") returned 6 [0046.416] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.jpg") returned 0 [0046.416] lstrlenA (lpString="*.jpg") returned 5 [0046.416] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.jpeg") returned 0 [0046.416] lstrlenA (lpString="*.jpeg") returned 6 [0046.416] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.psd") returned 0 [0046.416] lstrlenA (lpString="*.psd") returned 5 [0046.417] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.gif") returned 0 [0046.417] lstrlenA (lpString="*.gif") returned 5 [0046.417] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.doc") returned 0 [0046.417] lstrlenA (lpString="*.doc") returned 5 [0046.417] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.docx") returned 0 [0046.417] lstrlenA (lpString="*.docx") returned 6 [0046.417] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.xls") returned 0 [0046.417] lstrlenA (lpString="*.xls") returned 5 [0046.417] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.xlsx") returned 0 [0046.417] lstrlenA (lpString="*.xlsx") returned 6 [0046.417] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.ppt") returned 0 [0046.417] lstrlenA (lpString="*.ppt") returned 5 [0046.417] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.pptx") returned 0 [0046.417] lstrlenA (lpString="*.pptx") returned 6 [0046.417] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.pdf") returned 0 [0046.417] lstrlenA (lpString="*.pdf") returned 5 [0046.417] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mov") returned 0 [0046.417] lstrlenA (lpString="*.mov") returned 5 [0046.418] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.m2v") returned 0 [0046.418] lstrlenA (lpString="*.m2v") returned 5 [0046.418] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.3gp") returned 0 [0046.418] lstrlenA (lpString="*.3gp") returned 5 [0046.418] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mpeg") returned 0 [0046.418] lstrlenA (lpString="*.mpeg") returned 6 [0046.418] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mpg") returned 0 [0046.418] lstrlenA (lpString="*.mpg") returned 5 [0046.418] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.flv") returned 0 [0046.418] lstrlenA (lpString="*.flv") returned 5 [0046.418] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.avi") returned 0 [0046.418] lstrlenA (lpString="*.avi") returned 5 [0046.418] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mp4") returned 0 [0046.418] lstrlenA (lpString="*.mp4") returned 5 [0046.418] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.wmv") returned 0 [0046.418] lstrlenA (lpString="*.wmv") returned 5 [0046.418] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.divx") returned 0 [0046.418] lstrlenA (lpString="*.divx") returned 6 [0046.418] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mkv") returned 0 [0046.418] lstrlenA (lpString="*.mkv") returned 5 [0046.418] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mp3") returned 0 [0046.418] lstrlenA (lpString="*.mp3") returned 5 [0046.418] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.wav") returned 0 [0046.418] lstrlenA (lpString="*.wav") returned 5 [0046.418] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.flac") returned 0 [0046.418] lstrlenA (lpString="*.flac") returned 6 [0046.419] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.ape") returned 0 [0046.419] lstrlenA (lpString="*.ape") returned 5 [0046.419] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.wma") returned 0 [0046.419] lstrlenA (lpString="*.wma") returned 5 [0046.419] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.ac3") returned 0 [0046.419] lstrlenA (lpString="*.ac3") returned 5 [0046.419] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mxf") returned 0 [0046.419] lstrlenA (lpString="*.mxf") returned 5 [0046.419] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0046.419] PeekMessageA (in: lpMsg=0x18fcc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcc4) returned 0 [0046.419] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BOOTSTAT.DAT") returned 1 [0046.419] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BOOTSTAT.DAT") returned 1 [0046.419] lstrcmpiA (lpString1="", lpString2="BOOTSTAT.DAT") returned -1 [0046.419] PathFindFileNameA (pszPath="C:\\Boot\\BCD.LOG2") returned="BCD.LOG2" [0046.419] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0046.419] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned="" [0046.419] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt" [0046.419] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0x20 [0046.419] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BOOTSTAT.DAT" | out: lpString1="C:\\Boot\\BOOTSTAT.DAT") returned="C:\\Boot\\BOOTSTAT.DAT" [0046.419] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.zip") returned 0 [0046.419] lstrlenA (lpString="*.zip") returned 5 [0046.419] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.rar") returned 0 [0046.419] lstrlenA (lpString="*.rar") returned 5 [0046.420] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.7z") returned 0 [0046.420] lstrlenA (lpString="*.7z") returned 4 [0046.420] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.tar") returned 0 [0046.420] lstrlenA (lpString="*.tar") returned 5 [0046.420] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.gzip") returned 0 [0046.420] lstrlenA (lpString="*.gzip") returned 6 [0046.420] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.jpg") returned 0 [0046.420] lstrlenA (lpString="*.jpg") returned 5 [0046.420] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.jpeg") returned 0 [0046.420] lstrlenA (lpString="*.jpeg") returned 6 [0046.420] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.psd") returned 0 [0046.420] lstrlenA (lpString="*.psd") returned 5 [0046.422] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.gif") returned 0 [0046.422] lstrlenA (lpString="*.gif") returned 5 [0046.422] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.doc") returned 0 [0046.422] lstrlenA (lpString="*.doc") returned 5 [0046.422] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.docx") returned 0 [0046.422] lstrlenA (lpString="*.docx") returned 6 [0046.422] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.xls") returned 0 [0046.422] lstrlenA (lpString="*.xls") returned 5 [0046.422] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.xlsx") returned 0 [0046.422] lstrlenA (lpString="*.xlsx") returned 6 [0046.422] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.ppt") returned 0 [0046.422] lstrlenA (lpString="*.ppt") returned 5 [0046.422] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.pptx") returned 0 [0046.422] lstrlenA (lpString="*.pptx") returned 6 [0046.422] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.pdf") returned 0 [0046.423] lstrlenA (lpString="*.pdf") returned 5 [0046.423] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mov") returned 0 [0046.423] lstrlenA (lpString="*.mov") returned 5 [0046.423] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.m2v") returned 0 [0046.423] lstrlenA (lpString="*.m2v") returned 5 [0046.423] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.3gp") returned 0 [0046.423] lstrlenA (lpString="*.3gp") returned 5 [0046.423] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mpeg") returned 0 [0046.423] lstrlenA (lpString="*.mpeg") returned 6 [0046.423] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mpg") returned 0 [0046.423] lstrlenA (lpString="*.mpg") returned 5 [0046.423] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.flv") returned 0 [0046.423] lstrlenA (lpString="*.flv") returned 5 [0046.423] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.avi") returned 0 [0046.423] lstrlenA (lpString="*.avi") returned 5 [0046.423] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mp4") returned 0 [0046.423] lstrlenA (lpString="*.mp4") returned 5 [0046.423] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.wmv") returned 0 [0046.423] lstrlenA (lpString="*.wmv") returned 5 [0046.423] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.divx") returned 0 [0046.423] lstrlenA (lpString="*.divx") returned 6 [0046.423] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mkv") returned 0 [0046.423] lstrlenA (lpString="*.mkv") returned 5 [0046.423] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mp3") returned 0 [0046.423] lstrlenA (lpString="*.mp3") returned 5 [0046.423] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.wav") returned 0 [0046.423] lstrlenA (lpString="*.wav") returned 5 [0046.423] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.flac") returned 0 [0046.424] lstrlenA (lpString="*.flac") returned 6 [0046.424] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.ape") returned 0 [0046.424] lstrlenA (lpString="*.ape") returned 5 [0046.424] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.wma") returned 0 [0046.424] lstrlenA (lpString="*.wma") returned 5 [0046.424] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.ac3") returned 0 [0046.424] lstrlenA (lpString="*.ac3") returned 5 [0046.424] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.mxf") returned 0 [0046.424] lstrlenA (lpString="*.mxf") returned 5 [0046.424] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0046.424] lstrcmpA (lpString1=".", lpString2="cs-CZ") returned -1 [0046.424] lstrcmpA (lpString1="..", lpString2="cs-CZ") returned -1 [0046.424] PathFindFileNameA (pszPath="C:\\Boot\\BOOTSTAT.DAT") returned="BOOTSTAT.DAT" [0046.424] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="cs-CZ" | out: lpString1="C:\\Boot\\cs-CZ") returned="C:\\Boot\\cs-CZ" [0046.424] lstrlenA (lpString="C:\\Boot\\cs-CZ") returned 13 [0046.424] FindFirstFileA (in: lpFileName="C:\\Boot\\cs-CZ\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18fa00, dwReserved1=0x2d6f80, cFileName=".", cAlternateFileName="")) returned 0x2d6f70 [0046.427] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.427] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.427] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.427] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.427] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0046.427] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.427] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.427] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.427] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0046.427] PathFindFileNameA (pszPath="C:\\Boot\\cs-CZ\\*.*") returned="*.*" [0046.427] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\cs-CZ\\" | out: lpString1="C:\\Boot\\cs-CZ\\") returned="C:\\Boot\\cs-CZ\\" [0046.427] PathAddBackslashA (in: pszPath="C:\\Boot\\cs-CZ\\" | out: pszPath="C:\\Boot\\cs-CZ\\") returned="" [0046.427] lstrcatA (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\cs-CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\cs-CZ\\HOW TO DECRYPT FILES.txt" [0046.428] GetFileAttributesA (lpFileName="C:\\Boot\\cs-CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\cs-cz\\how to decrypt files.txt")) returned 0xffffffff [0046.428] CreateFileA (lpFileName="C:\\Boot\\cs-CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\cs-cz\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0046.428] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.428] WriteFile (in: hFile=0x84, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.429] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.429] CloseHandle (hObject=0x84) returned 1 [0046.429] lstrcatA (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" [0046.429] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0046.429] lstrlenA (lpString="*.zip") returned 5 [0046.429] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0046.429] lstrlenA (lpString="*.rar") returned 5 [0046.430] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0046.430] lstrlenA (lpString="*.7z") returned 4 [0046.430] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0046.430] lstrlenA (lpString="*.tar") returned 5 [0046.430] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0046.430] lstrlenA (lpString="*.gzip") returned 6 [0046.430] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0046.430] lstrlenA (lpString="*.jpg") returned 5 [0046.430] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0046.430] lstrlenA (lpString="*.jpeg") returned 6 [0046.430] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0046.430] lstrlenA (lpString="*.psd") returned 5 [0046.430] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0046.430] lstrlenA (lpString="*.gif") returned 5 [0046.430] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0046.430] lstrlenA (lpString="*.doc") returned 5 [0046.430] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0046.430] lstrlenA (lpString="*.docx") returned 6 [0046.430] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0046.430] lstrlenA (lpString="*.xls") returned 5 [0046.430] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0046.430] lstrlenA (lpString="*.xlsx") returned 6 [0046.430] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0046.430] lstrlenA (lpString="*.ppt") returned 5 [0046.430] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0046.430] lstrlenA (lpString="*.pptx") returned 6 [0046.430] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0046.430] lstrlenA (lpString="*.pdf") returned 5 [0046.430] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0046.430] lstrlenA (lpString="*.mov") returned 5 [0046.430] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0046.430] lstrlenA (lpString="*.m2v") returned 5 [0046.430] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0046.431] lstrlenA (lpString="*.3gp") returned 5 [0046.431] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0046.431] lstrlenA (lpString="*.mpeg") returned 6 [0046.431] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0046.431] lstrlenA (lpString="*.mpg") returned 5 [0046.431] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0046.431] lstrlenA (lpString="*.flv") returned 5 [0046.431] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0046.431] lstrlenA (lpString="*.avi") returned 5 [0046.431] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0046.431] lstrlenA (lpString="*.mp4") returned 5 [0046.431] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0046.431] lstrlenA (lpString="*.wmv") returned 5 [0046.431] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0046.431] lstrlenA (lpString="*.divx") returned 6 [0046.431] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0046.431] lstrlenA (lpString="*.mkv") returned 5 [0046.431] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0046.431] lstrlenA (lpString="*.mp3") returned 5 [0046.431] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0046.431] lstrlenA (lpString="*.wav") returned 5 [0046.431] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0046.431] lstrlenA (lpString="*.flac") returned 6 [0046.431] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0046.431] lstrlenA (lpString="*.ape") returned 5 [0046.431] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0046.431] lstrlenA (lpString="*.wma") returned 5 [0046.431] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0046.431] lstrlenA (lpString="*.ac3") returned 5 [0046.431] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mxf") returned 0 [0046.431] lstrlenA (lpString="*.mxf") returned 5 [0046.431] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0046.432] FindClose (in: hFindFile=0x2d6f70 | out: hFindFile=0x2d6f70) returned 1 [0046.432] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="da-DK", cAlternateFileName="")) returned 1 [0046.432] lstrcmpA (lpString1=".", lpString2="da-DK") returned -1 [0046.432] lstrcmpA (lpString1="..", lpString2="da-DK") returned -1 [0046.432] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0046.432] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="da-DK" | out: lpString1="C:\\Boot\\da-DK") returned="C:\\Boot\\da-DK" [0046.432] lstrlenA (lpString="C:\\Boot\\da-DK") returned 13 [0046.432] FindFirstFileA (in: lpFileName="C:\\Boot\\da-DK\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8238, cFileName=".", cAlternateFileName="")) returned 0x2d6f70 [0046.432] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.432] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.432] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.432] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.432] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0046.432] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.432] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.432] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.432] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0046.432] PathFindFileNameA (pszPath="C:\\Boot\\da-DK\\*.*") returned="*.*" [0046.432] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\da-DK\\" | out: lpString1="C:\\Boot\\da-DK\\") returned="C:\\Boot\\da-DK\\" [0046.432] PathAddBackslashA (in: pszPath="C:\\Boot\\da-DK\\" | out: pszPath="C:\\Boot\\da-DK\\") returned="" [0046.433] lstrcatA (in: lpString1="C:\\Boot\\da-DK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\da-DK\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\da-DK\\HOW TO DECRYPT FILES.txt" [0046.433] GetFileAttributesA (lpFileName="C:\\Boot\\da-DK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\da-dk\\how to decrypt files.txt")) returned 0xffffffff [0046.433] CreateFileA (lpFileName="C:\\Boot\\da-DK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\da-dk\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0046.433] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.433] WriteFile (in: hFile=0x84, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.434] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.434] CloseHandle (hObject=0x84) returned 1 [0046.434] lstrcatA (in: lpString1="C:\\Boot\\da-DK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned="C:\\Boot\\da-DK\\bootmgr.exe.mui" [0046.434] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0046.434] lstrlenA (lpString="*.zip") returned 5 [0046.434] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0046.434] lstrlenA (lpString="*.rar") returned 5 [0046.435] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0046.435] lstrlenA (lpString="*.7z") returned 4 [0046.435] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0046.435] lstrlenA (lpString="*.tar") returned 5 [0046.435] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0046.435] lstrlenA (lpString="*.gzip") returned 6 [0046.435] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0046.435] lstrlenA (lpString="*.jpg") returned 5 [0046.435] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0046.435] lstrlenA (lpString="*.jpeg") returned 6 [0046.435] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0046.435] lstrlenA (lpString="*.psd") returned 5 [0046.435] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0046.435] lstrlenA (lpString="*.gif") returned 5 [0046.435] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0046.435] lstrlenA (lpString="*.doc") returned 5 [0046.435] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0046.435] lstrlenA (lpString="*.docx") returned 6 [0046.435] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0046.435] lstrlenA (lpString="*.xls") returned 5 [0046.435] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0046.435] lstrlenA (lpString="*.xlsx") returned 6 [0046.435] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0046.435] lstrlenA (lpString="*.ppt") returned 5 [0046.435] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0046.435] lstrlenA (lpString="*.pptx") returned 6 [0046.435] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0046.435] lstrlenA (lpString="*.pdf") returned 5 [0046.435] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0046.435] lstrlenA (lpString="*.mov") returned 5 [0046.436] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0046.436] lstrlenA (lpString="*.m2v") returned 5 [0046.437] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0046.437] lstrlenA (lpString="*.3gp") returned 5 [0046.437] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0046.437] lstrlenA (lpString="*.mpeg") returned 6 [0046.437] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0046.438] lstrlenA (lpString="*.mpg") returned 5 [0046.438] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0046.438] lstrlenA (lpString="*.flv") returned 5 [0046.438] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0046.438] lstrlenA (lpString="*.avi") returned 5 [0046.438] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0046.438] lstrlenA (lpString="*.mp4") returned 5 [0046.438] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0046.438] lstrlenA (lpString="*.wmv") returned 5 [0046.438] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0046.438] lstrlenA (lpString="*.divx") returned 6 [0046.438] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0046.438] lstrlenA (lpString="*.mkv") returned 5 [0046.438] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0046.438] lstrlenA (lpString="*.mp3") returned 5 [0046.438] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0046.438] lstrlenA (lpString="*.wav") returned 5 [0046.438] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0046.438] lstrlenA (lpString="*.flac") returned 6 [0046.438] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0046.438] lstrlenA (lpString="*.ape") returned 5 [0046.438] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0046.438] lstrlenA (lpString="*.wma") returned 5 [0046.438] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0046.438] lstrlenA (lpString="*.ac3") returned 5 [0046.438] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mxf") returned 0 [0046.438] lstrlenA (lpString="*.mxf") returned 5 [0046.438] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0046.438] FindClose (in: hFindFile=0x2d6f70 | out: hFindFile=0x2d6f70) returned 1 [0046.438] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="de-DE", cAlternateFileName="")) returned 1 [0046.439] lstrcmpA (lpString1=".", lpString2="de-DE") returned -1 [0046.439] lstrcmpA (lpString1="..", lpString2="de-DE") returned -1 [0046.439] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0046.439] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="de-DE" | out: lpString1="C:\\Boot\\de-DE") returned="C:\\Boot\\de-DE" [0046.439] lstrlenA (lpString="C:\\Boot\\de-DE") returned 13 [0046.439] FindFirstFileA (in: lpFileName="C:\\Boot\\de-DE\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8238, cFileName=".", cAlternateFileName="")) returned 0x2d6f70 [0046.440] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.440] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.440] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.440] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.440] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0046.440] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.440] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.440] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.440] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0046.440] PathFindFileNameA (pszPath="C:\\Boot\\de-DE\\*.*") returned="*.*" [0046.440] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\de-DE\\" | out: lpString1="C:\\Boot\\de-DE\\") returned="C:\\Boot\\de-DE\\" [0046.440] PathAddBackslashA (in: pszPath="C:\\Boot\\de-DE\\" | out: pszPath="C:\\Boot\\de-DE\\") returned="" [0046.440] lstrcatA (in: lpString1="C:\\Boot\\de-DE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\de-DE\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\de-DE\\HOW TO DECRYPT FILES.txt" [0046.440] GetFileAttributesA (lpFileName="C:\\Boot\\de-DE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\de-de\\how to decrypt files.txt")) returned 0xffffffff [0046.440] CreateFileA (lpFileName="C:\\Boot\\de-DE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\de-de\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0046.440] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.440] WriteFile (in: hFile=0x84, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.441] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.441] CloseHandle (hObject=0x84) returned 1 [0046.442] lstrcatA (in: lpString1="C:\\Boot\\de-DE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned="C:\\Boot\\de-DE\\bootmgr.exe.mui" [0046.442] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0046.442] lstrlenA (lpString="*.zip") returned 5 [0046.442] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0046.442] lstrlenA (lpString="*.rar") returned 5 [0046.442] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0046.442] lstrlenA (lpString="*.7z") returned 4 [0046.442] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0046.442] lstrlenA (lpString="*.tar") returned 5 [0046.442] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0046.442] lstrlenA (lpString="*.gzip") returned 6 [0046.442] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0046.442] lstrlenA (lpString="*.jpg") returned 5 [0046.442] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0046.442] lstrlenA (lpString="*.jpeg") returned 6 [0046.442] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0046.442] lstrlenA (lpString="*.psd") returned 5 [0046.442] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0046.442] lstrlenA (lpString="*.gif") returned 5 [0046.442] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0046.442] lstrlenA (lpString="*.doc") returned 5 [0046.442] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0046.442] lstrlenA (lpString="*.docx") returned 6 [0046.442] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0046.442] lstrlenA (lpString="*.xls") returned 5 [0046.442] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0046.442] lstrlenA (lpString="*.xlsx") returned 6 [0046.443] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0046.443] lstrlenA (lpString="*.ppt") returned 5 [0046.443] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0046.443] lstrlenA (lpString="*.pptx") returned 6 [0046.443] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0046.443] lstrlenA (lpString="*.pdf") returned 5 [0046.443] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0046.443] lstrlenA (lpString="*.mov") returned 5 [0046.443] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0046.443] lstrlenA (lpString="*.m2v") returned 5 [0046.443] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0046.443] lstrlenA (lpString="*.3gp") returned 5 [0046.443] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0046.443] lstrlenA (lpString="*.mpeg") returned 6 [0046.443] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0046.443] lstrlenA (lpString="*.mpg") returned 5 [0046.443] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0046.443] lstrlenA (lpString="*.flv") returned 5 [0046.443] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0046.443] lstrlenA (lpString="*.avi") returned 5 [0046.443] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0046.443] lstrlenA (lpString="*.mp4") returned 5 [0046.443] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0046.443] lstrlenA (lpString="*.wmv") returned 5 [0046.443] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0046.443] lstrlenA (lpString="*.divx") returned 6 [0046.443] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0046.443] lstrlenA (lpString="*.mkv") returned 5 [0046.443] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0046.443] lstrlenA (lpString="*.mp3") returned 5 [0046.443] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0046.443] lstrlenA (lpString="*.wav") returned 5 [0046.443] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0046.443] lstrlenA (lpString="*.flac") returned 6 [0046.443] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0046.444] lstrlenA (lpString="*.ape") returned 5 [0046.444] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0046.444] lstrlenA (lpString="*.wma") returned 5 [0046.444] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0046.444] lstrlenA (lpString="*.ac3") returned 5 [0046.444] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mxf") returned 0 [0046.444] lstrlenA (lpString="*.mxf") returned 5 [0046.444] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0046.444] FindClose (in: hFindFile=0x2d6f70 | out: hFindFile=0x2d6f70) returned 1 [0046.444] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="el-GR", cAlternateFileName="")) returned 1 [0046.444] lstrcmpA (lpString1=".", lpString2="el-GR") returned -1 [0046.444] lstrcmpA (lpString1="..", lpString2="el-GR") returned -1 [0046.444] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0046.444] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="el-GR" | out: lpString1="C:\\Boot\\el-GR") returned="C:\\Boot\\el-GR" [0046.444] lstrlenA (lpString="C:\\Boot\\el-GR") returned 13 [0046.444] FindFirstFileA (in: lpFileName="C:\\Boot\\el-GR\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8238, cFileName=".", cAlternateFileName="")) returned 0x2d6f70 [0046.444] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.444] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.444] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.444] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.444] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0046.444] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.444] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.445] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.445] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0046.445] PathFindFileNameA (pszPath="C:\\Boot\\el-GR\\*.*") returned="*.*" [0046.445] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\el-GR\\" | out: lpString1="C:\\Boot\\el-GR\\") returned="C:\\Boot\\el-GR\\" [0046.445] PathAddBackslashA (in: pszPath="C:\\Boot\\el-GR\\" | out: pszPath="C:\\Boot\\el-GR\\") returned="" [0046.445] lstrcatA (in: lpString1="C:\\Boot\\el-GR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\el-GR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\el-GR\\HOW TO DECRYPT FILES.txt" [0046.445] GetFileAttributesA (lpFileName="C:\\Boot\\el-GR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\el-gr\\how to decrypt files.txt")) returned 0xffffffff [0046.445] CreateFileA (lpFileName="C:\\Boot\\el-GR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\el-gr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0046.445] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.445] WriteFile (in: hFile=0x84, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.446] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.446] CloseHandle (hObject=0x84) returned 1 [0046.446] lstrcatA (in: lpString1="C:\\Boot\\el-GR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned="C:\\Boot\\el-GR\\bootmgr.exe.mui" [0046.446] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0046.446] lstrlenA (lpString="*.zip") returned 5 [0046.446] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0046.446] lstrlenA (lpString="*.rar") returned 5 [0046.447] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0046.447] lstrlenA (lpString="*.7z") returned 4 [0046.447] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0046.447] lstrlenA (lpString="*.tar") returned 5 [0046.447] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0046.447] lstrlenA (lpString="*.gzip") returned 6 [0046.447] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0046.447] lstrlenA (lpString="*.jpg") returned 5 [0046.447] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0046.447] lstrlenA (lpString="*.jpeg") returned 6 [0046.447] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0046.447] lstrlenA (lpString="*.psd") returned 5 [0046.447] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0046.447] lstrlenA (lpString="*.gif") returned 5 [0046.447] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0046.447] lstrlenA (lpString="*.doc") returned 5 [0046.447] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0046.447] lstrlenA (lpString="*.docx") returned 6 [0046.447] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0046.447] lstrlenA (lpString="*.xls") returned 5 [0046.447] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0046.447] lstrlenA (lpString="*.xlsx") returned 6 [0046.447] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0046.447] lstrlenA (lpString="*.ppt") returned 5 [0046.447] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0046.447] lstrlenA (lpString="*.pptx") returned 6 [0046.447] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0046.447] lstrlenA (lpString="*.pdf") returned 5 [0046.447] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0046.447] lstrlenA (lpString="*.mov") returned 5 [0046.447] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0046.447] lstrlenA (lpString="*.m2v") returned 5 [0046.447] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0046.447] lstrlenA (lpString="*.3gp") returned 5 [0046.447] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0046.448] lstrlenA (lpString="*.mpeg") returned 6 [0046.448] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0046.448] lstrlenA (lpString="*.mpg") returned 5 [0046.448] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0046.448] lstrlenA (lpString="*.flv") returned 5 [0046.448] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0046.448] lstrlenA (lpString="*.avi") returned 5 [0046.448] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0046.448] lstrlenA (lpString="*.mp4") returned 5 [0046.448] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0046.448] lstrlenA (lpString="*.wmv") returned 5 [0046.448] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0046.448] lstrlenA (lpString="*.divx") returned 6 [0046.448] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0046.448] lstrlenA (lpString="*.mkv") returned 5 [0046.448] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0046.448] lstrlenA (lpString="*.mp3") returned 5 [0046.448] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0046.448] lstrlenA (lpString="*.wav") returned 5 [0046.448] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0046.448] lstrlenA (lpString="*.flac") returned 6 [0046.448] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0046.448] lstrlenA (lpString="*.ape") returned 5 [0046.448] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0046.448] lstrlenA (lpString="*.wma") returned 5 [0046.448] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0046.448] lstrlenA (lpString="*.ac3") returned 5 [0046.448] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mxf") returned 0 [0046.448] lstrlenA (lpString="*.mxf") returned 5 [0046.448] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0046.448] FindClose (in: hFindFile=0x2d6f70 | out: hFindFile=0x2d6f70) returned 1 [0046.448] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="en-US", cAlternateFileName="")) returned 1 [0046.448] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0046.448] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0046.449] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0046.449] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="en-US" | out: lpString1="C:\\Boot\\en-US") returned="C:\\Boot\\en-US" [0046.449] lstrlenA (lpString="C:\\Boot\\en-US") returned 13 [0046.449] FindFirstFileA (in: lpFileName="C:\\Boot\\en-US\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8238, cFileName=".", cAlternateFileName="")) returned 0x2d6f70 [0046.450] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.450] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.450] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.450] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.450] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0046.450] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.450] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.450] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.450] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0046.450] PathFindFileNameA (pszPath="C:\\Boot\\en-US\\*.*") returned="*.*" [0046.450] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\en-US\\" | out: lpString1="C:\\Boot\\en-US\\") returned="C:\\Boot\\en-US\\" [0046.450] PathAddBackslashA (in: pszPath="C:\\Boot\\en-US\\" | out: pszPath="C:\\Boot\\en-US\\") returned="" [0046.450] lstrcatA (in: lpString1="C:\\Boot\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt" [0046.450] GetFileAttributesA (lpFileName="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0046.450] CreateFileA (lpFileName="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0046.453] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.453] WriteFile (in: hFile=0x84, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.454] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.454] CloseHandle (hObject=0x84) returned 1 [0046.454] lstrcatA (in: lpString1="C:\\Boot\\en-US\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\en-US\\bootmgr.exe.mui") returned="C:\\Boot\\en-US\\bootmgr.exe.mui" [0046.454] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0046.454] lstrlenA (lpString="*.zip") returned 5 [0046.454] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0046.454] lstrlenA (lpString="*.rar") returned 5 [0046.454] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0046.454] lstrlenA (lpString="*.7z") returned 4 [0046.454] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0046.454] lstrlenA (lpString="*.tar") returned 5 [0046.454] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0046.454] lstrlenA (lpString="*.gzip") returned 6 [0046.454] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0046.454] lstrlenA (lpString="*.jpg") returned 5 [0046.454] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0046.454] lstrlenA (lpString="*.jpeg") returned 6 [0046.454] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0046.454] lstrlenA (lpString="*.psd") returned 5 [0046.454] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0046.454] lstrlenA (lpString="*.gif") returned 5 [0046.455] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0046.455] lstrlenA (lpString="*.doc") returned 5 [0046.455] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0046.455] lstrlenA (lpString="*.docx") returned 6 [0046.455] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0046.455] lstrlenA (lpString="*.xls") returned 5 [0046.455] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0046.455] lstrlenA (lpString="*.xlsx") returned 6 [0046.455] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0046.455] lstrlenA (lpString="*.ppt") returned 5 [0046.455] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0046.455] lstrlenA (lpString="*.pptx") returned 6 [0046.455] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0046.455] lstrlenA (lpString="*.pdf") returned 5 [0046.455] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0046.455] lstrlenA (lpString="*.mov") returned 5 [0046.455] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0046.455] lstrlenA (lpString="*.m2v") returned 5 [0046.455] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0046.455] lstrlenA (lpString="*.3gp") returned 5 [0046.455] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0046.455] lstrlenA (lpString="*.mpeg") returned 6 [0046.455] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0046.455] lstrlenA (lpString="*.mpg") returned 5 [0046.455] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0046.455] lstrlenA (lpString="*.flv") returned 5 [0046.455] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0046.455] lstrlenA (lpString="*.avi") returned 5 [0046.455] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0046.455] lstrlenA (lpString="*.mp4") returned 5 [0046.455] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0046.455] lstrlenA (lpString="*.wmv") returned 5 [0046.455] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0046.456] lstrlenA (lpString="*.divx") returned 6 [0046.456] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0046.456] lstrlenA (lpString="*.mkv") returned 5 [0046.456] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0046.456] lstrlenA (lpString="*.mp3") returned 5 [0046.456] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0046.456] lstrlenA (lpString="*.wav") returned 5 [0046.456] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0046.456] lstrlenA (lpString="*.flac") returned 6 [0046.456] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0046.456] lstrlenA (lpString="*.ape") returned 5 [0046.456] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0046.456] lstrlenA (lpString="*.wma") returned 5 [0046.456] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0046.456] lstrlenA (lpString="*.ac3") returned 5 [0046.456] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mxf") returned 0 [0046.456] lstrlenA (lpString="*.mxf") returned 5 [0046.456] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x2d8238, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0046.456] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.456] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe.mui") returned -1 [0046.456] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0046.456] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0046.456] PathFindFileNameA (pszPath="C:\\Boot\\en-US\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0046.456] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\en-US\\" | out: lpString1="C:\\Boot\\en-US\\") returned="C:\\Boot\\en-US\\" [0046.456] PathAddBackslashA (in: pszPath="C:\\Boot\\en-US\\" | out: pszPath="C:\\Boot\\en-US\\") returned="" [0046.456] lstrcatA (in: lpString1="C:\\Boot\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt" [0046.456] GetFileAttributesA (lpFileName="C:\\Boot\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\en-us\\how to decrypt files.txt")) returned 0x20 [0046.456] lstrcatA (in: lpString1="C:\\Boot\\en-US\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\en-US\\memtest.exe.mui") returned="C:\\Boot\\en-US\\memtest.exe.mui" [0046.456] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0046.456] lstrlenA (lpString="*.zip") returned 5 [0046.457] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0046.457] lstrlenA (lpString="*.rar") returned 5 [0046.457] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0046.457] lstrlenA (lpString="*.7z") returned 4 [0046.457] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0046.457] lstrlenA (lpString="*.tar") returned 5 [0046.457] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0046.457] lstrlenA (lpString="*.gzip") returned 6 [0046.457] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0046.457] lstrlenA (lpString="*.jpg") returned 5 [0046.457] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0046.457] lstrlenA (lpString="*.jpeg") returned 6 [0046.457] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0046.457] lstrlenA (lpString="*.psd") returned 5 [0046.457] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0046.457] lstrlenA (lpString="*.gif") returned 5 [0046.457] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0046.457] lstrlenA (lpString="*.doc") returned 5 [0046.457] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0046.457] lstrlenA (lpString="*.docx") returned 6 [0046.457] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0046.457] lstrlenA (lpString="*.xls") returned 5 [0046.457] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0046.457] lstrlenA (lpString="*.xlsx") returned 6 [0046.457] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0046.457] lstrlenA (lpString="*.ppt") returned 5 [0046.457] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0046.457] lstrlenA (lpString="*.pptx") returned 6 [0046.457] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0046.457] lstrlenA (lpString="*.pdf") returned 5 [0046.457] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0046.457] lstrlenA (lpString="*.mov") returned 5 [0046.457] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0046.457] lstrlenA (lpString="*.m2v") returned 5 [0046.457] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0046.457] lstrlenA (lpString="*.3gp") returned 5 [0046.458] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0046.458] lstrlenA (lpString="*.mpeg") returned 6 [0046.458] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0046.458] lstrlenA (lpString="*.mpg") returned 5 [0046.458] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0046.458] lstrlenA (lpString="*.flv") returned 5 [0046.458] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0046.458] lstrlenA (lpString="*.avi") returned 5 [0046.458] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0046.458] lstrlenA (lpString="*.mp4") returned 5 [0046.458] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0046.458] lstrlenA (lpString="*.wmv") returned 5 [0046.458] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0046.458] lstrlenA (lpString="*.divx") returned 6 [0046.458] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0046.458] lstrlenA (lpString="*.mkv") returned 5 [0046.458] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0046.458] lstrlenA (lpString="*.mp3") returned 5 [0046.458] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0046.458] lstrlenA (lpString="*.wav") returned 5 [0046.458] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0046.458] lstrlenA (lpString="*.flac") returned 6 [0046.458] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0046.458] lstrlenA (lpString="*.ape") returned 5 [0046.458] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0046.458] lstrlenA (lpString="*.wma") returned 5 [0046.458] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0046.458] lstrlenA (lpString="*.ac3") returned 5 [0046.458] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mxf") returned 0 [0046.458] lstrlenA (lpString="*.mxf") returned 5 [0046.458] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x2d8238, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0046.458] FindClose (in: hFindFile=0x2d6f70 | out: hFindFile=0x2d6f70) returned 1 [0046.459] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="es-ES", cAlternateFileName="")) returned 1 [0046.459] lstrcmpA (lpString1=".", lpString2="es-ES") returned -1 [0046.459] lstrcmpA (lpString1="..", lpString2="es-ES") returned -1 [0046.459] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0046.459] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="es-ES" | out: lpString1="C:\\Boot\\es-ES") returned="C:\\Boot\\es-ES" [0046.459] lstrlenA (lpString="C:\\Boot\\es-ES") returned 13 [0046.459] FindFirstFileA (in: lpFileName="C:\\Boot\\es-ES\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d6f70 [0046.460] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.460] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.460] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.460] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.460] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0046.460] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.460] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.460] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.460] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0046.460] PathFindFileNameA (pszPath="C:\\Boot\\es-ES\\*.*") returned="*.*" [0046.460] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\es-ES\\" | out: lpString1="C:\\Boot\\es-ES\\") returned="C:\\Boot\\es-ES\\" [0046.460] PathAddBackslashA (in: pszPath="C:\\Boot\\es-ES\\" | out: pszPath="C:\\Boot\\es-ES\\") returned="" [0046.460] lstrcatA (in: lpString1="C:\\Boot\\es-ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\es-ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\es-ES\\HOW TO DECRYPT FILES.txt" [0046.460] GetFileAttributesA (lpFileName="C:\\Boot\\es-ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\es-es\\how to decrypt files.txt")) returned 0xffffffff [0046.460] CreateFileA (lpFileName="C:\\Boot\\es-ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\es-es\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0046.461] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.461] WriteFile (in: hFile=0x84, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.462] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.462] CloseHandle (hObject=0x84) returned 1 [0046.462] lstrcatA (in: lpString1="C:\\Boot\\es-ES\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned="C:\\Boot\\es-ES\\bootmgr.exe.mui" [0046.462] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0046.462] lstrlenA (lpString="*.zip") returned 5 [0046.462] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0046.462] lstrlenA (lpString="*.rar") returned 5 [0046.462] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0046.462] lstrlenA (lpString="*.7z") returned 4 [0046.462] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0046.462] lstrlenA (lpString="*.tar") returned 5 [0046.462] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0046.462] lstrlenA (lpString="*.gzip") returned 6 [0046.462] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0046.462] lstrlenA (lpString="*.jpg") returned 5 [0046.462] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0046.462] lstrlenA (lpString="*.jpeg") returned 6 [0046.462] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0046.462] lstrlenA (lpString="*.psd") returned 5 [0046.463] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0046.463] lstrlenA (lpString="*.gif") returned 5 [0046.463] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0046.463] lstrlenA (lpString="*.doc") returned 5 [0046.463] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0046.463] lstrlenA (lpString="*.docx") returned 6 [0046.463] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0046.463] lstrlenA (lpString="*.xls") returned 5 [0046.463] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0046.463] lstrlenA (lpString="*.xlsx") returned 6 [0046.463] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0046.463] lstrlenA (lpString="*.ppt") returned 5 [0046.463] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0046.463] lstrlenA (lpString="*.pptx") returned 6 [0046.463] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0046.463] lstrlenA (lpString="*.pdf") returned 5 [0046.463] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0046.463] lstrlenA (lpString="*.mov") returned 5 [0046.463] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0046.463] lstrlenA (lpString="*.m2v") returned 5 [0046.463] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0046.463] lstrlenA (lpString="*.3gp") returned 5 [0046.463] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0046.463] lstrlenA (lpString="*.mpeg") returned 6 [0046.463] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0046.463] lstrlenA (lpString="*.mpg") returned 5 [0046.463] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0046.463] lstrlenA (lpString="*.flv") returned 5 [0046.463] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0046.463] lstrlenA (lpString="*.avi") returned 5 [0046.464] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0046.464] lstrlenA (lpString="*.mp4") returned 5 [0046.464] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0046.464] lstrlenA (lpString="*.wmv") returned 5 [0046.464] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0046.464] lstrlenA (lpString="*.divx") returned 6 [0046.464] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0046.464] lstrlenA (lpString="*.mkv") returned 5 [0046.464] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0046.464] lstrlenA (lpString="*.mp3") returned 5 [0046.464] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0046.464] lstrlenA (lpString="*.wav") returned 5 [0046.464] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0046.464] lstrlenA (lpString="*.flac") returned 6 [0046.464] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0046.464] lstrlenA (lpString="*.ape") returned 5 [0046.464] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0046.464] lstrlenA (lpString="*.wma") returned 5 [0046.464] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0046.464] lstrlenA (lpString="*.ac3") returned 5 [0046.464] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mxf") returned 0 [0046.464] lstrlenA (lpString="*.mxf") returned 5 [0046.464] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0046.464] FindClose (in: hFindFile=0x2d6f70 | out: hFindFile=0x2d6f70) returned 1 [0046.464] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0046.464] lstrcmpA (lpString1=".", lpString2="fi-FI") returned -1 [0046.464] lstrcmpA (lpString1="..", lpString2="fi-FI") returned -1 [0046.464] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0046.464] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="fi-FI" | out: lpString1="C:\\Boot\\fi-FI") returned="C:\\Boot\\fi-FI" [0046.465] lstrlenA (lpString="C:\\Boot\\fi-FI") returned 13 [0046.465] FindFirstFileA (in: lpFileName="C:\\Boot\\fi-FI\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8238, cFileName=".", cAlternateFileName="")) returned 0x2d6f70 [0046.465] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.465] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.465] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.465] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.465] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0046.465] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.465] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.465] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.465] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0046.465] PathFindFileNameA (pszPath="C:\\Boot\\fi-FI\\*.*") returned="*.*" [0046.465] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\fi-FI\\" | out: lpString1="C:\\Boot\\fi-FI\\") returned="C:\\Boot\\fi-FI\\" [0046.465] PathAddBackslashA (in: pszPath="C:\\Boot\\fi-FI\\" | out: pszPath="C:\\Boot\\fi-FI\\") returned="" [0046.465] lstrcatA (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\fi-FI\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\fi-FI\\HOW TO DECRYPT FILES.txt" [0046.465] GetFileAttributesA (lpFileName="C:\\Boot\\fi-FI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fi-fi\\how to decrypt files.txt")) returned 0xffffffff [0046.465] CreateFileA (lpFileName="C:\\Boot\\fi-FI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fi-fi\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0046.466] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.466] WriteFile (in: hFile=0x84, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.467] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.467] CloseHandle (hObject=0x84) returned 1 [0046.467] lstrcatA (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned="C:\\Boot\\fi-FI\\bootmgr.exe.mui" [0046.467] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0046.467] lstrlenA (lpString="*.zip") returned 5 [0046.467] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0046.467] lstrlenA (lpString="*.rar") returned 5 [0046.467] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0046.467] lstrlenA (lpString="*.7z") returned 4 [0046.467] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0046.468] lstrlenA (lpString="*.tar") returned 5 [0046.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0046.468] lstrlenA (lpString="*.gzip") returned 6 [0046.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0046.468] lstrlenA (lpString="*.jpg") returned 5 [0046.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0046.468] lstrlenA (lpString="*.jpeg") returned 6 [0046.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0046.468] lstrlenA (lpString="*.psd") returned 5 [0046.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0046.468] lstrlenA (lpString="*.gif") returned 5 [0046.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0046.468] lstrlenA (lpString="*.doc") returned 5 [0046.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0046.468] lstrlenA (lpString="*.docx") returned 6 [0046.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0046.468] lstrlenA (lpString="*.xls") returned 5 [0046.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0046.468] lstrlenA (lpString="*.xlsx") returned 6 [0046.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0046.468] lstrlenA (lpString="*.ppt") returned 5 [0046.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0046.468] lstrlenA (lpString="*.pptx") returned 6 [0046.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0046.468] lstrlenA (lpString="*.pdf") returned 5 [0046.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0046.468] lstrlenA (lpString="*.mov") returned 5 [0046.468] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0046.469] lstrlenA (lpString="*.m2v") returned 5 [0046.469] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0046.469] lstrlenA (lpString="*.3gp") returned 5 [0046.469] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0046.469] lstrlenA (lpString="*.mpeg") returned 6 [0046.469] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0046.469] lstrlenA (lpString="*.mpg") returned 5 [0046.469] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0046.469] lstrlenA (lpString="*.flv") returned 5 [0046.469] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0046.469] lstrlenA (lpString="*.avi") returned 5 [0046.469] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0046.469] lstrlenA (lpString="*.mp4") returned 5 [0046.469] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0046.469] lstrlenA (lpString="*.wmv") returned 5 [0046.469] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0046.469] lstrlenA (lpString="*.divx") returned 6 [0046.469] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0046.469] lstrlenA (lpString="*.mkv") returned 5 [0046.469] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0046.469] lstrlenA (lpString="*.mp3") returned 5 [0046.469] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0046.469] lstrlenA (lpString="*.wav") returned 5 [0046.469] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0046.469] lstrlenA (lpString="*.flac") returned 6 [0046.469] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0046.469] lstrlenA (lpString="*.ape") returned 5 [0046.470] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0046.470] lstrlenA (lpString="*.wma") returned 5 [0046.470] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0046.470] lstrlenA (lpString="*.ac3") returned 5 [0046.470] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mxf") returned 0 [0046.470] lstrlenA (lpString="*.mxf") returned 5 [0046.470] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0046.470] FindClose (in: hFindFile=0x2d6f70 | out: hFindFile=0x2d6f70) returned 1 [0046.470] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Fonts", cAlternateFileName="")) returned 1 [0046.470] lstrcmpA (lpString1=".", lpString2="Fonts") returned -1 [0046.470] lstrcmpA (lpString1="..", lpString2="Fonts") returned -1 [0046.470] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0046.470] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="Fonts" | out: lpString1="C:\\Boot\\Fonts") returned="C:\\Boot\\Fonts" [0046.470] lstrlenA (lpString="C:\\Boot\\Fonts") returned 13 [0046.470] FindFirstFileA (in: lpFileName="C:\\Boot\\Fonts\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8238, cFileName=".", cAlternateFileName="")) returned 0x2d6f70 [0046.471] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.471] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.471] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.471] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.471] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0046.471] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.471] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="chs_boot.ttf") returned 1 [0046.472] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chs_boot.ttf") returned 1 [0046.472] lstrcmpiA (lpString1="", lpString2="chs_boot.ttf") returned -1 [0046.472] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\*.*") returned="*.*" [0046.472] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0046.472] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0046.472] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0046.472] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0xffffffff [0046.472] CreateFileA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0046.474] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.474] WriteFile (in: hFile=0x84, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.475] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.475] CloseHandle (hObject=0x84) returned 1 [0046.475] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="chs_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\chs_boot.ttf") returned="C:\\Boot\\Fonts\\chs_boot.ttf" [0046.475] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.zip") returned 0 [0046.475] lstrlenA (lpString="*.zip") returned 5 [0046.475] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.rar") returned 0 [0046.475] lstrlenA (lpString="*.rar") returned 5 [0046.475] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.7z") returned 0 [0046.475] lstrlenA (lpString="*.7z") returned 4 [0046.475] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.tar") returned 0 [0046.475] lstrlenA (lpString="*.tar") returned 5 [0046.475] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.gzip") returned 0 [0046.475] lstrlenA (lpString="*.gzip") returned 6 [0046.475] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.jpg") returned 0 [0046.475] lstrlenA (lpString="*.jpg") returned 5 [0046.475] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.jpeg") returned 0 [0046.475] lstrlenA (lpString="*.jpeg") returned 6 [0046.475] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.psd") returned 0 [0046.475] lstrlenA (lpString="*.psd") returned 5 [0046.475] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.gif") returned 0 [0046.475] lstrlenA (lpString="*.gif") returned 5 [0046.475] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.doc") returned 0 [0046.475] lstrlenA (lpString="*.doc") returned 5 [0046.476] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.docx") returned 0 [0046.476] lstrlenA (lpString="*.docx") returned 6 [0046.476] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.xls") returned 0 [0046.476] lstrlenA (lpString="*.xls") returned 5 [0046.476] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.xlsx") returned 0 [0046.476] lstrlenA (lpString="*.xlsx") returned 6 [0046.476] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.ppt") returned 0 [0046.476] lstrlenA (lpString="*.ppt") returned 5 [0046.476] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.pptx") returned 0 [0046.476] lstrlenA (lpString="*.pptx") returned 6 [0046.476] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.pdf") returned 0 [0046.476] lstrlenA (lpString="*.pdf") returned 5 [0046.476] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mov") returned 0 [0046.476] lstrlenA (lpString="*.mov") returned 5 [0046.476] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.m2v") returned 0 [0046.476] lstrlenA (lpString="*.m2v") returned 5 [0046.476] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.3gp") returned 0 [0046.476] lstrlenA (lpString="*.3gp") returned 5 [0046.476] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mpeg") returned 0 [0046.476] lstrlenA (lpString="*.mpeg") returned 6 [0046.476] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mpg") returned 0 [0046.476] lstrlenA (lpString="*.mpg") returned 5 [0046.476] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.flv") returned 0 [0046.476] lstrlenA (lpString="*.flv") returned 5 [0046.476] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.avi") returned 0 [0046.476] lstrlenA (lpString="*.avi") returned 5 [0046.476] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mp4") returned 0 [0046.476] lstrlenA (lpString="*.mp4") returned 5 [0046.476] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.wmv") returned 0 [0046.476] lstrlenA (lpString="*.wmv") returned 5 [0046.476] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.divx") returned 0 [0046.476] lstrlenA (lpString="*.divx") returned 6 [0046.476] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mkv") returned 0 [0046.476] lstrlenA (lpString="*.mkv") returned 5 [0046.476] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mp3") returned 0 [0046.477] lstrlenA (lpString="*.mp3") returned 5 [0046.477] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.wav") returned 0 [0046.477] lstrlenA (lpString="*.wav") returned 5 [0046.477] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.flac") returned 0 [0046.477] lstrlenA (lpString="*.flac") returned 6 [0046.477] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.ape") returned 0 [0046.477] lstrlenA (lpString="*.ape") returned 5 [0046.477] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.wma") returned 0 [0046.477] lstrlenA (lpString="*.wma") returned 5 [0046.477] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.ac3") returned 0 [0046.477] lstrlenA (lpString="*.ac3") returned 5 [0046.477] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mxf") returned 0 [0046.477] lstrlenA (lpString="*.mxf") returned 5 [0046.477] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x2d8238, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0046.477] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.477] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cht_boot.ttf") returned 1 [0046.477] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cht_boot.ttf") returned 1 [0046.477] lstrcmpiA (lpString1="", lpString2="cht_boot.ttf") returned -1 [0046.477] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\chs_boot.ttf") returned="chs_boot.ttf" [0046.477] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0046.477] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0046.477] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0046.477] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0046.477] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="cht_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\cht_boot.ttf") returned="C:\\Boot\\Fonts\\cht_boot.ttf" [0046.477] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.zip") returned 0 [0046.477] lstrlenA (lpString="*.zip") returned 5 [0046.477] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.rar") returned 0 [0046.477] lstrlenA (lpString="*.rar") returned 5 [0046.477] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.7z") returned 0 [0046.477] lstrlenA (lpString="*.7z") returned 4 [0046.477] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.tar") returned 0 [0046.478] lstrlenA (lpString="*.tar") returned 5 [0046.478] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.gzip") returned 0 [0046.478] lstrlenA (lpString="*.gzip") returned 6 [0046.478] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.jpg") returned 0 [0046.478] lstrlenA (lpString="*.jpg") returned 5 [0046.478] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.jpeg") returned 0 [0046.478] lstrlenA (lpString="*.jpeg") returned 6 [0046.478] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.psd") returned 0 [0046.478] lstrlenA (lpString="*.psd") returned 5 [0046.478] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.gif") returned 0 [0046.478] lstrlenA (lpString="*.gif") returned 5 [0046.478] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.doc") returned 0 [0046.478] lstrlenA (lpString="*.doc") returned 5 [0046.478] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.docx") returned 0 [0046.478] lstrlenA (lpString="*.docx") returned 6 [0046.478] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.xls") returned 0 [0046.478] lstrlenA (lpString="*.xls") returned 5 [0046.478] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.xlsx") returned 0 [0046.478] lstrlenA (lpString="*.xlsx") returned 6 [0046.478] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.ppt") returned 0 [0046.478] lstrlenA (lpString="*.ppt") returned 5 [0046.478] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.pptx") returned 0 [0046.478] lstrlenA (lpString="*.pptx") returned 6 [0046.478] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.pdf") returned 0 [0046.478] lstrlenA (lpString="*.pdf") returned 5 [0046.478] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mov") returned 0 [0046.478] lstrlenA (lpString="*.mov") returned 5 [0046.478] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.m2v") returned 0 [0046.478] lstrlenA (lpString="*.m2v") returned 5 [0046.478] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.3gp") returned 0 [0046.478] lstrlenA (lpString="*.3gp") returned 5 [0046.478] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mpeg") returned 0 [0046.478] lstrlenA (lpString="*.mpeg") returned 6 [0046.478] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mpg") returned 0 [0046.478] lstrlenA (lpString="*.mpg") returned 5 [0046.478] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.flv") returned 0 [0046.479] lstrlenA (lpString="*.flv") returned 5 [0046.479] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.avi") returned 0 [0046.479] lstrlenA (lpString="*.avi") returned 5 [0046.479] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mp4") returned 0 [0046.479] lstrlenA (lpString="*.mp4") returned 5 [0046.479] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.wmv") returned 0 [0046.479] lstrlenA (lpString="*.wmv") returned 5 [0046.479] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.divx") returned 0 [0046.479] lstrlenA (lpString="*.divx") returned 6 [0046.479] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mkv") returned 0 [0046.479] lstrlenA (lpString="*.mkv") returned 5 [0046.479] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mp3") returned 0 [0046.479] lstrlenA (lpString="*.mp3") returned 5 [0046.479] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.wav") returned 0 [0046.479] lstrlenA (lpString="*.wav") returned 5 [0046.479] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.flac") returned 0 [0046.479] lstrlenA (lpString="*.flac") returned 6 [0046.479] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.ape") returned 0 [0046.479] lstrlenA (lpString="*.ape") returned 5 [0046.479] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.wma") returned 0 [0046.479] lstrlenA (lpString="*.wma") returned 5 [0046.479] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.ac3") returned 0 [0046.479] lstrlenA (lpString="*.ac3") returned 5 [0046.479] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mxf") returned 0 [0046.479] lstrlenA (lpString="*.mxf") returned 5 [0046.479] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0046.479] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.479] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="jpn_boot.ttf") returned -1 [0046.479] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jpn_boot.ttf") returned -1 [0046.479] lstrcmpiA (lpString1="", lpString2="jpn_boot.ttf") returned -1 [0046.479] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\cht_boot.ttf") returned="cht_boot.ttf" [0046.479] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0046.479] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0046.479] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0046.480] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0046.480] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="jpn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\jpn_boot.ttf") returned="C:\\Boot\\Fonts\\jpn_boot.ttf" [0046.480] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.zip") returned 0 [0046.480] lstrlenA (lpString="*.zip") returned 5 [0046.480] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.rar") returned 0 [0046.480] lstrlenA (lpString="*.rar") returned 5 [0046.480] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.7z") returned 0 [0046.480] lstrlenA (lpString="*.7z") returned 4 [0046.480] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.tar") returned 0 [0046.480] lstrlenA (lpString="*.tar") returned 5 [0046.480] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.gzip") returned 0 [0046.480] lstrlenA (lpString="*.gzip") returned 6 [0046.480] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.jpg") returned 0 [0046.480] lstrlenA (lpString="*.jpg") returned 5 [0046.480] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.jpeg") returned 0 [0046.480] lstrlenA (lpString="*.jpeg") returned 6 [0046.480] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.psd") returned 0 [0046.480] lstrlenA (lpString="*.psd") returned 5 [0046.480] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.gif") returned 0 [0046.480] lstrlenA (lpString="*.gif") returned 5 [0046.480] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.doc") returned 0 [0046.480] lstrlenA (lpString="*.doc") returned 5 [0046.480] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.docx") returned 0 [0046.480] lstrlenA (lpString="*.docx") returned 6 [0046.480] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.xls") returned 0 [0046.480] lstrlenA (lpString="*.xls") returned 5 [0046.480] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.xlsx") returned 0 [0046.480] lstrlenA (lpString="*.xlsx") returned 6 [0046.480] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.ppt") returned 0 [0046.480] lstrlenA (lpString="*.ppt") returned 5 [0046.480] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.pptx") returned 0 [0046.480] lstrlenA (lpString="*.pptx") returned 6 [0046.480] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.pdf") returned 0 [0046.480] lstrlenA (lpString="*.pdf") returned 5 [0046.481] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mov") returned 0 [0046.481] lstrlenA (lpString="*.mov") returned 5 [0046.481] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.m2v") returned 0 [0046.481] lstrlenA (lpString="*.m2v") returned 5 [0046.481] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.3gp") returned 0 [0046.481] lstrlenA (lpString="*.3gp") returned 5 [0046.481] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mpeg") returned 0 [0046.481] lstrlenA (lpString="*.mpeg") returned 6 [0046.481] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mpg") returned 0 [0046.481] lstrlenA (lpString="*.mpg") returned 5 [0046.481] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.flv") returned 0 [0046.481] lstrlenA (lpString="*.flv") returned 5 [0046.481] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.avi") returned 0 [0046.481] lstrlenA (lpString="*.avi") returned 5 [0046.481] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mp4") returned 0 [0046.481] lstrlenA (lpString="*.mp4") returned 5 [0046.481] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.wmv") returned 0 [0046.481] lstrlenA (lpString="*.wmv") returned 5 [0046.481] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.divx") returned 0 [0046.481] lstrlenA (lpString="*.divx") returned 6 [0046.481] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mkv") returned 0 [0046.481] lstrlenA (lpString="*.mkv") returned 5 [0046.481] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mp3") returned 0 [0046.481] lstrlenA (lpString="*.mp3") returned 5 [0046.481] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.wav") returned 0 [0046.481] lstrlenA (lpString="*.wav") returned 5 [0046.481] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.flac") returned 0 [0046.481] lstrlenA (lpString="*.flac") returned 6 [0046.481] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.ape") returned 0 [0046.481] lstrlenA (lpString="*.ape") returned 5 [0046.481] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.wma") returned 0 [0046.481] lstrlenA (lpString="*.wma") returned 5 [0046.481] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.ac3") returned 0 [0046.481] lstrlenA (lpString="*.ac3") returned 5 [0046.481] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mxf") returned 0 [0046.481] lstrlenA (lpString="*.mxf") returned 5 [0046.481] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0046.482] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.482] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="kor_boot.ttf") returned -1 [0046.482] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="kor_boot.ttf") returned -1 [0046.482] lstrcmpiA (lpString1="", lpString2="kor_boot.ttf") returned -1 [0046.482] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\jpn_boot.ttf") returned="jpn_boot.ttf" [0046.482] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0046.482] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0046.482] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0046.482] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0046.482] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="kor_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\kor_boot.ttf") returned="C:\\Boot\\Fonts\\kor_boot.ttf" [0046.482] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.zip") returned 0 [0046.482] lstrlenA (lpString="*.zip") returned 5 [0046.482] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.rar") returned 0 [0046.482] lstrlenA (lpString="*.rar") returned 5 [0046.482] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.7z") returned 0 [0046.482] lstrlenA (lpString="*.7z") returned 4 [0046.482] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.tar") returned 0 [0046.482] lstrlenA (lpString="*.tar") returned 5 [0046.482] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.gzip") returned 0 [0046.482] lstrlenA (lpString="*.gzip") returned 6 [0046.482] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.jpg") returned 0 [0046.482] lstrlenA (lpString="*.jpg") returned 5 [0046.482] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.jpeg") returned 0 [0046.482] lstrlenA (lpString="*.jpeg") returned 6 [0046.482] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.psd") returned 0 [0046.482] lstrlenA (lpString="*.psd") returned 5 [0046.483] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.gif") returned 0 [0046.483] lstrlenA (lpString="*.gif") returned 5 [0046.483] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.doc") returned 0 [0046.483] lstrlenA (lpString="*.doc") returned 5 [0046.483] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.docx") returned 0 [0046.483] lstrlenA (lpString="*.docx") returned 6 [0046.483] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.xls") returned 0 [0046.483] lstrlenA (lpString="*.xls") returned 5 [0046.483] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.xlsx") returned 0 [0046.483] lstrlenA (lpString="*.xlsx") returned 6 [0046.483] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.ppt") returned 0 [0046.483] lstrlenA (lpString="*.ppt") returned 5 [0046.483] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.pptx") returned 0 [0046.483] lstrlenA (lpString="*.pptx") returned 6 [0046.483] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.pdf") returned 0 [0046.483] lstrlenA (lpString="*.pdf") returned 5 [0046.483] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mov") returned 0 [0046.483] lstrlenA (lpString="*.mov") returned 5 [0046.483] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.m2v") returned 0 [0046.483] lstrlenA (lpString="*.m2v") returned 5 [0046.483] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.3gp") returned 0 [0046.484] lstrlenA (lpString="*.3gp") returned 5 [0046.484] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mpeg") returned 0 [0046.484] lstrlenA (lpString="*.mpeg") returned 6 [0046.484] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mpg") returned 0 [0046.484] lstrlenA (lpString="*.mpg") returned 5 [0046.484] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.flv") returned 0 [0046.484] lstrlenA (lpString="*.flv") returned 5 [0046.484] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.avi") returned 0 [0046.484] lstrlenA (lpString="*.avi") returned 5 [0046.484] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mp4") returned 0 [0046.484] lstrlenA (lpString="*.mp4") returned 5 [0046.484] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.wmv") returned 0 [0046.484] lstrlenA (lpString="*.wmv") returned 5 [0046.484] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.divx") returned 0 [0046.484] lstrlenA (lpString="*.divx") returned 6 [0046.484] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mkv") returned 0 [0046.484] lstrlenA (lpString="*.mkv") returned 5 [0046.484] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mp3") returned 0 [0046.484] lstrlenA (lpString="*.mp3") returned 5 [0046.484] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.wav") returned 0 [0046.484] lstrlenA (lpString="*.wav") returned 5 [0046.484] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.flac") returned 0 [0046.484] lstrlenA (lpString="*.flac") returned 6 [0046.484] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.ape") returned 0 [0046.484] lstrlenA (lpString="*.ape") returned 5 [0046.484] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.wma") returned 0 [0046.484] lstrlenA (lpString="*.wma") returned 5 [0046.484] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.ac3") returned 0 [0046.484] lstrlenA (lpString="*.ac3") returned 5 [0046.485] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mxf") returned 0 [0046.485] lstrlenA (lpString="*.mxf") returned 5 [0046.485] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0046.485] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.485] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="wgl4_boot.ttf") returned -1 [0046.485] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wgl4_boot.ttf") returned -1 [0046.485] lstrcmpiA (lpString1="", lpString2="wgl4_boot.ttf") returned -1 [0046.485] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\kor_boot.ttf") returned="kor_boot.ttf" [0046.485] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\Fonts\\" | out: lpString1="C:\\Boot\\Fonts\\") returned="C:\\Boot\\Fonts\\" [0046.485] PathAddBackslashA (in: pszPath="C:\\Boot\\Fonts\\" | out: pszPath="C:\\Boot\\Fonts\\") returned="" [0046.485] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" [0046.485] GetFileAttributesA (lpFileName="C:\\Boot\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fonts\\how to decrypt files.txt")) returned 0x20 [0046.485] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="wgl4_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned="C:\\Boot\\Fonts\\wgl4_boot.ttf" [0046.485] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.zip") returned 0 [0046.485] lstrlenA (lpString="*.zip") returned 5 [0046.485] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.rar") returned 0 [0046.485] lstrlenA (lpString="*.rar") returned 5 [0046.485] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.7z") returned 0 [0046.485] lstrlenA (lpString="*.7z") returned 4 [0046.485] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.tar") returned 0 [0046.485] lstrlenA (lpString="*.tar") returned 5 [0046.485] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.gzip") returned 0 [0046.485] lstrlenA (lpString="*.gzip") returned 6 [0046.485] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.jpg") returned 0 [0046.485] lstrlenA (lpString="*.jpg") returned 5 [0046.485] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.jpeg") returned 0 [0046.485] lstrlenA (lpString="*.jpeg") returned 6 [0046.485] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.psd") returned 0 [0046.485] lstrlenA (lpString="*.psd") returned 5 [0046.486] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.gif") returned 0 [0046.486] lstrlenA (lpString="*.gif") returned 5 [0046.486] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.doc") returned 0 [0046.486] lstrlenA (lpString="*.doc") returned 5 [0046.486] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.docx") returned 0 [0046.486] lstrlenA (lpString="*.docx") returned 6 [0046.486] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.xls") returned 0 [0046.486] lstrlenA (lpString="*.xls") returned 5 [0046.486] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.xlsx") returned 0 [0046.486] lstrlenA (lpString="*.xlsx") returned 6 [0046.486] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.ppt") returned 0 [0046.486] lstrlenA (lpString="*.ppt") returned 5 [0046.486] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.pptx") returned 0 [0046.486] lstrlenA (lpString="*.pptx") returned 6 [0046.486] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.pdf") returned 0 [0046.486] lstrlenA (lpString="*.pdf") returned 5 [0046.486] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mov") returned 0 [0046.486] lstrlenA (lpString="*.mov") returned 5 [0046.486] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.m2v") returned 0 [0046.486] lstrlenA (lpString="*.m2v") returned 5 [0046.486] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.3gp") returned 0 [0046.486] lstrlenA (lpString="*.3gp") returned 5 [0046.486] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mpeg") returned 0 [0046.486] lstrlenA (lpString="*.mpeg") returned 6 [0046.486] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mpg") returned 0 [0046.486] lstrlenA (lpString="*.mpg") returned 5 [0046.486] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.flv") returned 0 [0046.486] lstrlenA (lpString="*.flv") returned 5 [0046.486] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.avi") returned 0 [0046.486] lstrlenA (lpString="*.avi") returned 5 [0046.486] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mp4") returned 0 [0046.487] lstrlenA (lpString="*.mp4") returned 5 [0046.487] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.wmv") returned 0 [0046.487] lstrlenA (lpString="*.wmv") returned 5 [0046.487] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.divx") returned 0 [0046.487] lstrlenA (lpString="*.divx") returned 6 [0046.487] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mkv") returned 0 [0046.487] lstrlenA (lpString="*.mkv") returned 5 [0046.487] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mp3") returned 0 [0046.487] lstrlenA (lpString="*.mp3") returned 5 [0046.487] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.wav") returned 0 [0046.487] lstrlenA (lpString="*.wav") returned 5 [0046.487] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.flac") returned 0 [0046.487] lstrlenA (lpString="*.flac") returned 6 [0046.487] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.ape") returned 0 [0046.487] lstrlenA (lpString="*.ape") returned 5 [0046.487] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.wma") returned 0 [0046.487] lstrlenA (lpString="*.wma") returned 5 [0046.487] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.ac3") returned 0 [0046.487] lstrlenA (lpString="*.ac3") returned 5 [0046.487] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.mxf") returned 0 [0046.487] lstrlenA (lpString="*.mxf") returned 5 [0046.487] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0046.487] FindClose (in: hFindFile=0x2d6f70 | out: hFindFile=0x2d6f70) returned 1 [0046.487] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0046.488] lstrcmpA (lpString1=".", lpString2="fr-FR") returned -1 [0046.488] lstrcmpA (lpString1="..", lpString2="fr-FR") returned -1 [0046.488] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0046.488] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="fr-FR" | out: lpString1="C:\\Boot\\fr-FR") returned="C:\\Boot\\fr-FR" [0046.488] lstrlenA (lpString="C:\\Boot\\fr-FR") returned 13 [0046.488] FindFirstFileA (in: lpFileName="C:\\Boot\\fr-FR\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d6f70 [0046.489] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.489] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.489] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.489] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.489] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0046.489] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.489] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.489] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.489] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0046.489] PathFindFileNameA (pszPath="C:\\Boot\\fr-FR\\*.*") returned="*.*" [0046.489] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\fr-FR\\" | out: lpString1="C:\\Boot\\fr-FR\\") returned="C:\\Boot\\fr-FR\\" [0046.489] PathAddBackslashA (in: pszPath="C:\\Boot\\fr-FR\\" | out: pszPath="C:\\Boot\\fr-FR\\") returned="" [0046.489] lstrcatA (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\fr-FR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\fr-FR\\HOW TO DECRYPT FILES.txt" [0046.489] GetFileAttributesA (lpFileName="C:\\Boot\\fr-FR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fr-fr\\how to decrypt files.txt")) returned 0xffffffff [0046.490] CreateFileA (lpFileName="C:\\Boot\\fr-FR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\fr-fr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0046.490] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.490] WriteFile (in: hFile=0x84, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.491] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.491] CloseHandle (hObject=0x84) returned 1 [0046.491] lstrcatA (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned="C:\\Boot\\fr-FR\\bootmgr.exe.mui" [0046.491] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0046.491] lstrlenA (lpString="*.zip") returned 5 [0046.491] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0046.491] lstrlenA (lpString="*.rar") returned 5 [0046.492] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0046.492] lstrlenA (lpString="*.7z") returned 4 [0046.492] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0046.492] lstrlenA (lpString="*.tar") returned 5 [0046.492] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0046.492] lstrlenA (lpString="*.gzip") returned 6 [0046.492] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0046.492] lstrlenA (lpString="*.jpg") returned 5 [0046.492] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0046.492] lstrlenA (lpString="*.jpeg") returned 6 [0046.492] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0046.492] lstrlenA (lpString="*.psd") returned 5 [0046.492] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0046.492] lstrlenA (lpString="*.gif") returned 5 [0046.492] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0046.492] lstrlenA (lpString="*.doc") returned 5 [0046.492] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0046.492] lstrlenA (lpString="*.docx") returned 6 [0046.492] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0046.492] lstrlenA (lpString="*.xls") returned 5 [0046.492] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0046.492] lstrlenA (lpString="*.xlsx") returned 6 [0046.492] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0046.492] lstrlenA (lpString="*.ppt") returned 5 [0046.492] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0046.492] lstrlenA (lpString="*.pptx") returned 6 [0046.492] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0046.492] lstrlenA (lpString="*.pdf") returned 5 [0046.492] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0046.492] lstrlenA (lpString="*.mov") returned 5 [0046.492] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0046.492] lstrlenA (lpString="*.m2v") returned 5 [0046.493] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0046.493] lstrlenA (lpString="*.3gp") returned 5 [0046.493] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0046.493] lstrlenA (lpString="*.mpeg") returned 6 [0046.493] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0046.493] lstrlenA (lpString="*.mpg") returned 5 [0046.493] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0046.493] lstrlenA (lpString="*.flv") returned 5 [0046.493] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0046.493] lstrlenA (lpString="*.avi") returned 5 [0046.493] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0046.493] lstrlenA (lpString="*.mp4") returned 5 [0046.493] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0046.493] lstrlenA (lpString="*.wmv") returned 5 [0046.493] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0046.493] lstrlenA (lpString="*.divx") returned 6 [0046.493] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0046.493] lstrlenA (lpString="*.mkv") returned 5 [0046.493] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0046.493] lstrlenA (lpString="*.mp3") returned 5 [0046.493] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0046.493] lstrlenA (lpString="*.wav") returned 5 [0046.493] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0046.493] lstrlenA (lpString="*.flac") returned 6 [0046.493] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0046.493] lstrlenA (lpString="*.ape") returned 5 [0046.493] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0046.493] lstrlenA (lpString="*.wma") returned 5 [0046.493] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0046.493] lstrlenA (lpString="*.ac3") returned 5 [0046.493] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mxf") returned 0 [0046.493] lstrlenA (lpString="*.mxf") returned 5 [0046.494] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0046.494] FindClose (in: hFindFile=0x2d6f70 | out: hFindFile=0x2d6f70) returned 1 [0046.494] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0046.494] lstrcmpA (lpString1=".", lpString2="hu-HU") returned -1 [0046.494] lstrcmpA (lpString1="..", lpString2="hu-HU") returned -1 [0046.494] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0046.494] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="hu-HU" | out: lpString1="C:\\Boot\\hu-HU") returned="C:\\Boot\\hu-HU" [0046.494] lstrlenA (lpString="C:\\Boot\\hu-HU") returned 13 [0046.494] FindFirstFileA (in: lpFileName="C:\\Boot\\hu-HU\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8238, cFileName=".", cAlternateFileName="")) returned 0x2d6f70 [0046.494] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.494] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.494] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.494] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.494] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0046.494] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.494] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.495] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.495] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0046.495] PathFindFileNameA (pszPath="C:\\Boot\\hu-HU\\*.*") returned="*.*" [0046.495] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\hu-HU\\" | out: lpString1="C:\\Boot\\hu-HU\\") returned="C:\\Boot\\hu-HU\\" [0046.495] PathAddBackslashA (in: pszPath="C:\\Boot\\hu-HU\\" | out: pszPath="C:\\Boot\\hu-HU\\") returned="" [0046.495] lstrcatA (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\hu-HU\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\hu-HU\\HOW TO DECRYPT FILES.txt" [0046.495] GetFileAttributesA (lpFileName="C:\\Boot\\hu-HU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\hu-hu\\how to decrypt files.txt")) returned 0xffffffff [0046.495] CreateFileA (lpFileName="C:\\Boot\\hu-HU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\hu-hu\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0046.495] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.495] WriteFile (in: hFile=0x84, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.496] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.496] CloseHandle (hObject=0x84) returned 1 [0046.496] lstrcatA (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned="C:\\Boot\\hu-HU\\bootmgr.exe.mui" [0046.497] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0046.497] lstrlenA (lpString="*.zip") returned 5 [0046.497] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0046.497] lstrlenA (lpString="*.rar") returned 5 [0046.497] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0046.497] lstrlenA (lpString="*.7z") returned 4 [0046.497] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0046.497] lstrlenA (lpString="*.tar") returned 5 [0046.497] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0046.497] lstrlenA (lpString="*.gzip") returned 6 [0046.497] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0046.497] lstrlenA (lpString="*.jpg") returned 5 [0046.497] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0046.497] lstrlenA (lpString="*.jpeg") returned 6 [0046.497] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0046.497] lstrlenA (lpString="*.psd") returned 5 [0046.497] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0046.497] lstrlenA (lpString="*.gif") returned 5 [0046.497] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0046.497] lstrlenA (lpString="*.doc") returned 5 [0046.497] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0046.497] lstrlenA (lpString="*.docx") returned 6 [0046.497] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0046.497] lstrlenA (lpString="*.xls") returned 5 [0046.497] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0046.497] lstrlenA (lpString="*.xlsx") returned 6 [0046.497] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0046.497] lstrlenA (lpString="*.ppt") returned 5 [0046.497] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0046.497] lstrlenA (lpString="*.pptx") returned 6 [0046.497] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0046.497] lstrlenA (lpString="*.pdf") returned 5 [0046.497] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0046.497] lstrlenA (lpString="*.mov") returned 5 [0046.498] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0046.498] lstrlenA (lpString="*.m2v") returned 5 [0046.498] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0046.498] lstrlenA (lpString="*.3gp") returned 5 [0046.498] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0046.498] lstrlenA (lpString="*.mpeg") returned 6 [0046.498] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0046.498] lstrlenA (lpString="*.mpg") returned 5 [0046.498] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0046.498] lstrlenA (lpString="*.flv") returned 5 [0046.498] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0046.498] lstrlenA (lpString="*.avi") returned 5 [0046.498] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0046.498] lstrlenA (lpString="*.mp4") returned 5 [0046.499] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0046.499] lstrlenA (lpString="*.wmv") returned 5 [0046.499] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0046.499] lstrlenA (lpString="*.divx") returned 6 [0046.499] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0046.499] lstrlenA (lpString="*.mkv") returned 5 [0046.499] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0046.499] lstrlenA (lpString="*.mp3") returned 5 [0046.499] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0046.499] lstrlenA (lpString="*.wav") returned 5 [0046.499] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0046.499] lstrlenA (lpString="*.flac") returned 6 [0046.499] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0046.499] lstrlenA (lpString="*.ape") returned 5 [0046.499] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0046.499] lstrlenA (lpString="*.wma") returned 5 [0046.499] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0046.499] lstrlenA (lpString="*.ac3") returned 5 [0046.499] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mxf") returned 0 [0046.499] lstrlenA (lpString="*.mxf") returned 5 [0046.499] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0046.499] FindClose (in: hFindFile=0x2d6f70 | out: hFindFile=0x2d6f70) returned 1 [0046.499] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="it-IT", cAlternateFileName="")) returned 1 [0046.499] lstrcmpA (lpString1=".", lpString2="it-IT") returned -1 [0046.499] lstrcmpA (lpString1="..", lpString2="it-IT") returned -1 [0046.499] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0046.500] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="it-IT" | out: lpString1="C:\\Boot\\it-IT") returned="C:\\Boot\\it-IT" [0046.500] lstrlenA (lpString="C:\\Boot\\it-IT") returned 13 [0046.500] FindFirstFileA (in: lpFileName="C:\\Boot\\it-IT\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8238, cFileName=".", cAlternateFileName="")) returned 0x2d6f70 [0046.501] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.501] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.501] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.501] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.501] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0046.501] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.501] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.501] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.501] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0046.501] PathFindFileNameA (pszPath="C:\\Boot\\it-IT\\*.*") returned="*.*" [0046.501] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\it-IT\\" | out: lpString1="C:\\Boot\\it-IT\\") returned="C:\\Boot\\it-IT\\" [0046.501] PathAddBackslashA (in: pszPath="C:\\Boot\\it-IT\\" | out: pszPath="C:\\Boot\\it-IT\\") returned="" [0046.501] lstrcatA (in: lpString1="C:\\Boot\\it-IT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\it-IT\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\it-IT\\HOW TO DECRYPT FILES.txt" [0046.501] GetFileAttributesA (lpFileName="C:\\Boot\\it-IT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\it-it\\how to decrypt files.txt")) returned 0xffffffff [0046.502] CreateFileA (lpFileName="C:\\Boot\\it-IT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\it-it\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0046.502] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.502] WriteFile (in: hFile=0x84, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.503] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.503] CloseHandle (hObject=0x84) returned 1 [0046.504] lstrcatA (in: lpString1="C:\\Boot\\it-IT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned="C:\\Boot\\it-IT\\bootmgr.exe.mui" [0046.504] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0046.504] lstrlenA (lpString="*.zip") returned 5 [0046.504] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0046.504] lstrlenA (lpString="*.rar") returned 5 [0046.504] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0046.504] lstrlenA (lpString="*.7z") returned 4 [0046.504] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0046.504] lstrlenA (lpString="*.tar") returned 5 [0046.504] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0046.504] lstrlenA (lpString="*.gzip") returned 6 [0046.504] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0046.504] lstrlenA (lpString="*.jpg") returned 5 [0046.504] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0046.504] lstrlenA (lpString="*.jpeg") returned 6 [0046.504] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0046.504] lstrlenA (lpString="*.psd") returned 5 [0046.504] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0046.504] lstrlenA (lpString="*.gif") returned 5 [0046.504] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0046.504] lstrlenA (lpString="*.doc") returned 5 [0046.504] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0046.504] lstrlenA (lpString="*.docx") returned 6 [0046.504] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0046.505] lstrlenA (lpString="*.xls") returned 5 [0046.505] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0046.505] lstrlenA (lpString="*.xlsx") returned 6 [0046.505] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0046.505] lstrlenA (lpString="*.ppt") returned 5 [0046.505] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0046.505] lstrlenA (lpString="*.pptx") returned 6 [0046.505] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0046.505] lstrlenA (lpString="*.pdf") returned 5 [0046.505] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0046.505] lstrlenA (lpString="*.mov") returned 5 [0046.505] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0046.505] lstrlenA (lpString="*.m2v") returned 5 [0046.505] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0046.505] lstrlenA (lpString="*.3gp") returned 5 [0046.505] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0046.505] lstrlenA (lpString="*.mpeg") returned 6 [0046.505] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0046.505] lstrlenA (lpString="*.mpg") returned 5 [0046.505] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0046.505] lstrlenA (lpString="*.flv") returned 5 [0046.505] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0046.505] lstrlenA (lpString="*.avi") returned 5 [0046.505] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0046.505] lstrlenA (lpString="*.mp4") returned 5 [0046.505] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0046.505] lstrlenA (lpString="*.wmv") returned 5 [0046.505] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0046.506] lstrlenA (lpString="*.divx") returned 6 [0046.506] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0046.506] lstrlenA (lpString="*.mkv") returned 5 [0046.506] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0046.506] lstrlenA (lpString="*.mp3") returned 5 [0046.506] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0046.506] lstrlenA (lpString="*.wav") returned 5 [0046.506] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0046.506] lstrlenA (lpString="*.flac") returned 6 [0046.506] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0046.506] lstrlenA (lpString="*.ape") returned 5 [0046.506] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0046.506] lstrlenA (lpString="*.wma") returned 5 [0046.506] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0046.506] lstrlenA (lpString="*.ac3") returned 5 [0046.506] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mxf") returned 0 [0046.506] lstrlenA (lpString="*.mxf") returned 5 [0046.506] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0046.506] FindClose (in: hFindFile=0x2d6f70 | out: hFindFile=0x2d6f70) returned 1 [0046.506] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0046.506] lstrcmpA (lpString1=".", lpString2="ja-JP") returned -1 [0046.506] lstrcmpA (lpString1="..", lpString2="ja-JP") returned -1 [0046.506] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0046.506] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="ja-JP" | out: lpString1="C:\\Boot\\ja-JP") returned="C:\\Boot\\ja-JP" [0046.507] lstrlenA (lpString="C:\\Boot\\ja-JP") returned 13 [0046.507] FindFirstFileA (in: lpFileName="C:\\Boot\\ja-JP\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8238, cFileName=".", cAlternateFileName="")) returned 0x2d6f70 [0046.507] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.507] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.507] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.507] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.507] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0046.507] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.507] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.507] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.507] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0046.507] PathFindFileNameA (pszPath="C:\\Boot\\ja-JP\\*.*") returned="*.*" [0046.507] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ja-JP\\" | out: lpString1="C:\\Boot\\ja-JP\\") returned="C:\\Boot\\ja-JP\\" [0046.507] PathAddBackslashA (in: pszPath="C:\\Boot\\ja-JP\\" | out: pszPath="C:\\Boot\\ja-JP\\") returned="" [0046.507] lstrcatA (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\ja-JP\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\ja-JP\\HOW TO DECRYPT FILES.txt" [0046.508] GetFileAttributesA (lpFileName="C:\\Boot\\ja-JP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ja-jp\\how to decrypt files.txt")) returned 0xffffffff [0046.508] CreateFileA (lpFileName="C:\\Boot\\ja-JP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ja-jp\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0046.508] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.508] WriteFile (in: hFile=0x84, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.512] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.513] CloseHandle (hObject=0x84) returned 1 [0046.513] lstrcatA (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned="C:\\Boot\\ja-JP\\bootmgr.exe.mui" [0046.513] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0046.513] lstrlenA (lpString="*.zip") returned 5 [0046.513] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0046.513] lstrlenA (lpString="*.rar") returned 5 [0046.513] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0046.513] lstrlenA (lpString="*.7z") returned 4 [0046.513] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0046.513] lstrlenA (lpString="*.tar") returned 5 [0046.513] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0046.513] lstrlenA (lpString="*.gzip") returned 6 [0046.513] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0046.513] lstrlenA (lpString="*.jpg") returned 5 [0046.513] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0046.513] lstrlenA (lpString="*.jpeg") returned 6 [0046.513] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0046.513] lstrlenA (lpString="*.psd") returned 5 [0046.513] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0046.513] lstrlenA (lpString="*.gif") returned 5 [0046.513] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0046.514] lstrlenA (lpString="*.doc") returned 5 [0046.514] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0046.514] lstrlenA (lpString="*.docx") returned 6 [0046.514] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0046.514] lstrlenA (lpString="*.xls") returned 5 [0046.514] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0046.514] lstrlenA (lpString="*.xlsx") returned 6 [0046.514] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0046.515] lstrlenA (lpString="*.ppt") returned 5 [0046.515] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0046.515] lstrlenA (lpString="*.pptx") returned 6 [0046.515] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0046.515] lstrlenA (lpString="*.pdf") returned 5 [0046.515] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0046.515] lstrlenA (lpString="*.mov") returned 5 [0046.515] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0046.515] lstrlenA (lpString="*.m2v") returned 5 [0046.515] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0046.515] lstrlenA (lpString="*.3gp") returned 5 [0046.515] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0046.515] lstrlenA (lpString="*.mpeg") returned 6 [0046.515] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0046.515] lstrlenA (lpString="*.mpg") returned 5 [0046.515] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0046.515] lstrlenA (lpString="*.flv") returned 5 [0046.515] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0046.515] lstrlenA (lpString="*.avi") returned 5 [0046.515] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0046.515] lstrlenA (lpString="*.mp4") returned 5 [0046.515] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0046.515] lstrlenA (lpString="*.wmv") returned 5 [0046.515] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0046.515] lstrlenA (lpString="*.divx") returned 6 [0046.515] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0046.515] lstrlenA (lpString="*.mkv") returned 5 [0046.515] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0046.516] lstrlenA (lpString="*.mp3") returned 5 [0046.516] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0046.516] lstrlenA (lpString="*.wav") returned 5 [0046.516] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0046.516] lstrlenA (lpString="*.flac") returned 6 [0046.516] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0046.516] lstrlenA (lpString="*.ape") returned 5 [0046.516] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0046.516] lstrlenA (lpString="*.wma") returned 5 [0046.516] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0046.516] lstrlenA (lpString="*.ac3") returned 5 [0046.516] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mxf") returned 0 [0046.516] lstrlenA (lpString="*.mxf") returned 5 [0046.516] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0046.516] FindClose (in: hFindFile=0x2d6f70 | out: hFindFile=0x2d6f70) returned 1 [0046.516] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0046.516] lstrcmpA (lpString1=".", lpString2="ko-KR") returned -1 [0046.516] lstrcmpA (lpString1="..", lpString2="ko-KR") returned -1 [0046.516] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0046.516] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="ko-KR" | out: lpString1="C:\\Boot\\ko-KR") returned="C:\\Boot\\ko-KR" [0046.516] lstrlenA (lpString="C:\\Boot\\ko-KR") returned 13 [0046.516] FindFirstFileA (in: lpFileName="C:\\Boot\\ko-KR\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8238, cFileName=".", cAlternateFileName="")) returned 0x2d6f70 [0046.518] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.518] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.518] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.518] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.518] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0046.518] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.518] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.518] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.518] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0046.518] PathFindFileNameA (pszPath="C:\\Boot\\ko-KR\\*.*") returned="*.*" [0046.518] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ko-KR\\" | out: lpString1="C:\\Boot\\ko-KR\\") returned="C:\\Boot\\ko-KR\\" [0046.518] PathAddBackslashA (in: pszPath="C:\\Boot\\ko-KR\\" | out: pszPath="C:\\Boot\\ko-KR\\") returned="" [0046.518] lstrcatA (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\ko-KR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\ko-KR\\HOW TO DECRYPT FILES.txt" [0046.518] GetFileAttributesA (lpFileName="C:\\Boot\\ko-KR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ko-kr\\how to decrypt files.txt")) returned 0xffffffff [0046.518] CreateFileA (lpFileName="C:\\Boot\\ko-KR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ko-kr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0046.519] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.519] WriteFile (in: hFile=0x84, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.520] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.520] CloseHandle (hObject=0x84) returned 1 [0046.520] lstrcatA (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned="C:\\Boot\\ko-KR\\bootmgr.exe.mui" [0046.520] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0046.521] lstrlenA (lpString="*.zip") returned 5 [0046.521] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0046.521] lstrlenA (lpString="*.rar") returned 5 [0046.521] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0046.521] lstrlenA (lpString="*.7z") returned 4 [0046.521] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0046.521] lstrlenA (lpString="*.tar") returned 5 [0046.521] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0046.521] lstrlenA (lpString="*.gzip") returned 6 [0046.521] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0046.521] lstrlenA (lpString="*.jpg") returned 5 [0046.521] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0046.521] lstrlenA (lpString="*.jpeg") returned 6 [0046.521] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0046.521] lstrlenA (lpString="*.psd") returned 5 [0046.521] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0046.521] lstrlenA (lpString="*.gif") returned 5 [0046.521] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0046.521] lstrlenA (lpString="*.doc") returned 5 [0046.521] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0046.521] lstrlenA (lpString="*.docx") returned 6 [0046.521] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0046.521] lstrlenA (lpString="*.xls") returned 5 [0046.521] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0046.521] lstrlenA (lpString="*.xlsx") returned 6 [0046.521] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0046.521] lstrlenA (lpString="*.ppt") returned 5 [0046.522] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0046.522] lstrlenA (lpString="*.pptx") returned 6 [0046.522] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0046.522] lstrlenA (lpString="*.pdf") returned 5 [0046.522] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0046.522] lstrlenA (lpString="*.mov") returned 5 [0046.522] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0046.522] lstrlenA (lpString="*.m2v") returned 5 [0046.522] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0046.522] lstrlenA (lpString="*.3gp") returned 5 [0046.522] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0046.522] lstrlenA (lpString="*.mpeg") returned 6 [0046.522] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0046.522] lstrlenA (lpString="*.mpg") returned 5 [0046.522] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0046.522] lstrlenA (lpString="*.flv") returned 5 [0046.522] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0046.522] lstrlenA (lpString="*.avi") returned 5 [0046.522] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0046.522] lstrlenA (lpString="*.mp4") returned 5 [0046.522] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0046.522] lstrlenA (lpString="*.wmv") returned 5 [0046.522] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0046.522] lstrlenA (lpString="*.divx") returned 6 [0046.522] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0046.522] lstrlenA (lpString="*.mkv") returned 5 [0046.522] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0046.522] lstrlenA (lpString="*.mp3") returned 5 [0046.522] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0046.523] lstrlenA (lpString="*.wav") returned 5 [0046.523] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0046.523] lstrlenA (lpString="*.flac") returned 6 [0046.523] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0046.523] lstrlenA (lpString="*.ape") returned 5 [0046.523] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0046.523] lstrlenA (lpString="*.wma") returned 5 [0046.523] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0046.523] lstrlenA (lpString="*.ac3") returned 5 [0046.523] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mxf") returned 0 [0046.523] lstrlenA (lpString="*.mxf") returned 5 [0046.523] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0046.523] FindClose (in: hFindFile=0x2d6f70 | out: hFindFile=0x2d6f70) returned 1 [0046.523] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0046.523] PeekMessageA (in: lpMsg=0x18fcc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcc4) returned 0 [0046.523] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="memtest.exe") returned -1 [0046.523] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe") returned -1 [0046.523] lstrcmpiA (lpString1="", lpString2="memtest.exe") returned -1 [0046.523] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0046.523] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0046.523] PathAddBackslashA (in: pszPath="C:\\Boot\\" | out: pszPath="C:\\Boot\\") returned="" [0046.523] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\HOW TO DECRYPT FILES.txt" [0046.523] GetFileAttributesA (lpFileName="C:\\Boot\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\how to decrypt files.txt")) returned 0x20 [0046.523] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="memtest.exe" | out: lpString1="C:\\Boot\\memtest.exe") returned="C:\\Boot\\memtest.exe" [0046.523] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.zip") returned 0 [0046.523] lstrlenA (lpString="*.zip") returned 5 [0046.523] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.rar") returned 0 [0046.523] lstrlenA (lpString="*.rar") returned 5 [0046.523] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.7z") returned 0 [0046.524] lstrlenA (lpString="*.7z") returned 4 [0046.524] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.tar") returned 0 [0046.524] lstrlenA (lpString="*.tar") returned 5 [0046.524] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.gzip") returned 0 [0046.524] lstrlenA (lpString="*.gzip") returned 6 [0046.524] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.jpg") returned 0 [0046.524] lstrlenA (lpString="*.jpg") returned 5 [0046.524] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.jpeg") returned 0 [0046.524] lstrlenA (lpString="*.jpeg") returned 6 [0046.524] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.psd") returned 0 [0046.524] lstrlenA (lpString="*.psd") returned 5 [0046.524] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.gif") returned 0 [0046.524] lstrlenA (lpString="*.gif") returned 5 [0046.524] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.doc") returned 0 [0046.524] lstrlenA (lpString="*.doc") returned 5 [0046.524] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.docx") returned 0 [0046.524] lstrlenA (lpString="*.docx") returned 6 [0046.524] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.xls") returned 0 [0046.524] lstrlenA (lpString="*.xls") returned 5 [0046.524] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.xlsx") returned 0 [0046.524] lstrlenA (lpString="*.xlsx") returned 6 [0046.524] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.ppt") returned 0 [0046.524] lstrlenA (lpString="*.ppt") returned 5 [0046.524] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.pptx") returned 0 [0046.524] lstrlenA (lpString="*.pptx") returned 6 [0046.524] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.pdf") returned 0 [0046.524] lstrlenA (lpString="*.pdf") returned 5 [0046.524] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mov") returned 0 [0046.524] lstrlenA (lpString="*.mov") returned 5 [0046.524] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.m2v") returned 0 [0046.524] lstrlenA (lpString="*.m2v") returned 5 [0046.524] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.3gp") returned 0 [0046.524] lstrlenA (lpString="*.3gp") returned 5 [0046.524] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mpeg") returned 0 [0046.524] lstrlenA (lpString="*.mpeg") returned 6 [0046.525] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mpg") returned 0 [0046.525] lstrlenA (lpString="*.mpg") returned 5 [0046.525] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.flv") returned 0 [0046.525] lstrlenA (lpString="*.flv") returned 5 [0046.525] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.avi") returned 0 [0046.525] lstrlenA (lpString="*.avi") returned 5 [0046.525] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mp4") returned 0 [0046.525] lstrlenA (lpString="*.mp4") returned 5 [0046.525] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.wmv") returned 0 [0046.525] lstrlenA (lpString="*.wmv") returned 5 [0046.525] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.divx") returned 0 [0046.525] lstrlenA (lpString="*.divx") returned 6 [0046.525] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mkv") returned 0 [0046.525] lstrlenA (lpString="*.mkv") returned 5 [0046.525] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mp3") returned 0 [0046.525] lstrlenA (lpString="*.mp3") returned 5 [0046.525] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.wav") returned 0 [0046.525] lstrlenA (lpString="*.wav") returned 5 [0046.525] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.flac") returned 0 [0046.525] lstrlenA (lpString="*.flac") returned 6 [0046.525] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.ape") returned 0 [0046.525] lstrlenA (lpString="*.ape") returned 5 [0046.525] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.wma") returned 0 [0046.525] lstrlenA (lpString="*.wma") returned 5 [0046.525] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.ac3") returned 0 [0046.525] lstrlenA (lpString="*.ac3") returned 5 [0046.525] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mxf") returned 0 [0046.525] lstrlenA (lpString="*.mxf") returned 5 [0046.525] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0046.525] lstrcmpA (lpString1=".", lpString2="nb-NO") returned -1 [0046.525] lstrcmpA (lpString1="..", lpString2="nb-NO") returned -1 [0046.525] PathFindFileNameA (pszPath="C:\\Boot\\memtest.exe") returned="memtest.exe" [0046.525] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="nb-NO" | out: lpString1="C:\\Boot\\nb-NO") returned="C:\\Boot\\nb-NO" [0046.525] lstrlenA (lpString="C:\\Boot\\nb-NO") returned 13 [0046.526] FindFirstFileA (in: lpFileName="C:\\Boot\\nb-NO\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18fa00, dwReserved1=0x2d6f80, cFileName=".", cAlternateFileName="")) returned 0x2d6f70 [0046.526] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.526] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.526] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.526] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.526] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0046.526] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.526] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.526] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.526] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0046.526] PathFindFileNameA (pszPath="C:\\Boot\\nb-NO\\*.*") returned="*.*" [0046.526] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\nb-NO\\" | out: lpString1="C:\\Boot\\nb-NO\\") returned="C:\\Boot\\nb-NO\\" [0046.526] PathAddBackslashA (in: pszPath="C:\\Boot\\nb-NO\\" | out: pszPath="C:\\Boot\\nb-NO\\") returned="" [0046.526] lstrcatA (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\nb-NO\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\nb-NO\\HOW TO DECRYPT FILES.txt" [0046.526] GetFileAttributesA (lpFileName="C:\\Boot\\nb-NO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\nb-no\\how to decrypt files.txt")) returned 0xffffffff [0046.526] CreateFileA (lpFileName="C:\\Boot\\nb-NO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\nb-no\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0046.527] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.527] WriteFile (in: hFile=0x84, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.528] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.528] CloseHandle (hObject=0x84) returned 1 [0046.528] lstrcatA (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned="C:\\Boot\\nb-NO\\bootmgr.exe.mui" [0046.528] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0046.528] lstrlenA (lpString="*.zip") returned 5 [0046.528] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0046.528] lstrlenA (lpString="*.rar") returned 5 [0046.528] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0046.528] lstrlenA (lpString="*.7z") returned 4 [0046.528] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0046.529] lstrlenA (lpString="*.tar") returned 5 [0046.529] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0046.529] lstrlenA (lpString="*.gzip") returned 6 [0046.529] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0046.529] lstrlenA (lpString="*.jpg") returned 5 [0046.529] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0046.529] lstrlenA (lpString="*.jpeg") returned 6 [0046.529] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0046.529] lstrlenA (lpString="*.psd") returned 5 [0046.529] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0046.529] lstrlenA (lpString="*.gif") returned 5 [0046.529] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0046.529] lstrlenA (lpString="*.doc") returned 5 [0046.529] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0046.529] lstrlenA (lpString="*.docx") returned 6 [0046.529] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0046.529] lstrlenA (lpString="*.xls") returned 5 [0046.529] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0046.529] lstrlenA (lpString="*.xlsx") returned 6 [0046.529] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0046.529] lstrlenA (lpString="*.ppt") returned 5 [0046.529] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0046.529] lstrlenA (lpString="*.pptx") returned 6 [0046.529] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0046.529] lstrlenA (lpString="*.pdf") returned 5 [0046.529] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0046.529] lstrlenA (lpString="*.mov") returned 5 [0046.529] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0046.529] lstrlenA (lpString="*.m2v") returned 5 [0046.529] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0046.529] lstrlenA (lpString="*.3gp") returned 5 [0046.529] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0046.529] lstrlenA (lpString="*.mpeg") returned 6 [0046.529] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0046.529] lstrlenA (lpString="*.mpg") returned 5 [0046.530] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0046.530] lstrlenA (lpString="*.flv") returned 5 [0046.530] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0046.530] lstrlenA (lpString="*.avi") returned 5 [0046.530] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0046.530] lstrlenA (lpString="*.mp4") returned 5 [0046.530] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0046.530] lstrlenA (lpString="*.wmv") returned 5 [0046.530] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0046.530] lstrlenA (lpString="*.divx") returned 6 [0046.530] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0046.530] lstrlenA (lpString="*.mkv") returned 5 [0046.530] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0046.530] lstrlenA (lpString="*.mp3") returned 5 [0046.530] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0046.530] lstrlenA (lpString="*.wav") returned 5 [0046.530] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0046.530] lstrlenA (lpString="*.flac") returned 6 [0046.530] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0046.530] lstrlenA (lpString="*.ape") returned 5 [0046.530] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0046.530] lstrlenA (lpString="*.wma") returned 5 [0046.530] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0046.530] lstrlenA (lpString="*.ac3") returned 5 [0046.530] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mxf") returned 0 [0046.530] lstrlenA (lpString="*.mxf") returned 5 [0046.530] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0046.530] FindClose (in: hFindFile=0x2d6f70 | out: hFindFile=0x2d6f70) returned 1 [0046.530] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0046.530] lstrcmpA (lpString1=".", lpString2="nl-NL") returned -1 [0046.530] lstrcmpA (lpString1="..", lpString2="nl-NL") returned -1 [0046.530] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0046.531] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="nl-NL" | out: lpString1="C:\\Boot\\nl-NL") returned="C:\\Boot\\nl-NL" [0046.531] lstrlenA (lpString="C:\\Boot\\nl-NL") returned 13 [0046.531] FindFirstFileA (in: lpFileName="C:\\Boot\\nl-NL\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8238, cFileName=".", cAlternateFileName="")) returned 0x2d6f70 [0046.534] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.534] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.534] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.534] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.534] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0046.534] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.534] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.534] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.534] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0046.534] PathFindFileNameA (pszPath="C:\\Boot\\nl-NL\\*.*") returned="*.*" [0046.534] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\nl-NL\\" | out: lpString1="C:\\Boot\\nl-NL\\") returned="C:\\Boot\\nl-NL\\" [0046.534] PathAddBackslashA (in: pszPath="C:\\Boot\\nl-NL\\" | out: pszPath="C:\\Boot\\nl-NL\\") returned="" [0046.534] lstrcatA (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\nl-NL\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\nl-NL\\HOW TO DECRYPT FILES.txt" [0046.535] GetFileAttributesA (lpFileName="C:\\Boot\\nl-NL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\nl-nl\\how to decrypt files.txt")) returned 0xffffffff [0046.535] CreateFileA (lpFileName="C:\\Boot\\nl-NL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\nl-nl\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0046.535] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.535] WriteFile (in: hFile=0x84, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.536] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.536] CloseHandle (hObject=0x84) returned 1 [0046.536] lstrcatA (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned="C:\\Boot\\nl-NL\\bootmgr.exe.mui" [0046.536] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0046.536] lstrlenA (lpString="*.zip") returned 5 [0046.536] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0046.536] lstrlenA (lpString="*.rar") returned 5 [0046.536] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0046.536] lstrlenA (lpString="*.7z") returned 4 [0046.537] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0046.537] lstrlenA (lpString="*.tar") returned 5 [0046.537] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0046.537] lstrlenA (lpString="*.gzip") returned 6 [0046.537] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0046.537] lstrlenA (lpString="*.jpg") returned 5 [0046.537] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0046.537] lstrlenA (lpString="*.jpeg") returned 6 [0046.537] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0046.537] lstrlenA (lpString="*.psd") returned 5 [0046.537] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0046.537] lstrlenA (lpString="*.gif") returned 5 [0046.537] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0046.537] lstrlenA (lpString="*.doc") returned 5 [0046.537] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0046.537] lstrlenA (lpString="*.docx") returned 6 [0046.537] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0046.537] lstrlenA (lpString="*.xls") returned 5 [0046.537] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0046.537] lstrlenA (lpString="*.xlsx") returned 6 [0046.537] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0046.537] lstrlenA (lpString="*.ppt") returned 5 [0046.537] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0046.537] lstrlenA (lpString="*.pptx") returned 6 [0046.537] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0046.537] lstrlenA (lpString="*.pdf") returned 5 [0046.537] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0046.537] lstrlenA (lpString="*.mov") returned 5 [0046.537] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0046.537] lstrlenA (lpString="*.m2v") returned 5 [0046.537] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0046.537] lstrlenA (lpString="*.3gp") returned 5 [0046.537] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0046.537] lstrlenA (lpString="*.mpeg") returned 6 [0046.537] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0046.538] lstrlenA (lpString="*.mpg") returned 5 [0046.538] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0046.538] lstrlenA (lpString="*.flv") returned 5 [0046.538] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0046.538] lstrlenA (lpString="*.avi") returned 5 [0046.538] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0046.538] lstrlenA (lpString="*.mp4") returned 5 [0046.538] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0046.538] lstrlenA (lpString="*.wmv") returned 5 [0046.538] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0046.538] lstrlenA (lpString="*.divx") returned 6 [0046.538] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0046.538] lstrlenA (lpString="*.mkv") returned 5 [0046.538] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0046.538] lstrlenA (lpString="*.mp3") returned 5 [0046.538] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0046.538] lstrlenA (lpString="*.wav") returned 5 [0046.538] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0046.538] lstrlenA (lpString="*.flac") returned 6 [0046.538] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0046.538] lstrlenA (lpString="*.ape") returned 5 [0046.538] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0046.538] lstrlenA (lpString="*.wma") returned 5 [0046.538] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0046.538] lstrlenA (lpString="*.ac3") returned 5 [0046.538] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mxf") returned 0 [0046.538] lstrlenA (lpString="*.mxf") returned 5 [0046.538] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0046.538] FindClose (in: hFindFile=0x2d6f70 | out: hFindFile=0x2d6f70) returned 1 [0046.541] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0046.541] lstrcmpA (lpString1=".", lpString2="pl-PL") returned -1 [0046.541] lstrcmpA (lpString1="..", lpString2="pl-PL") returned -1 [0046.541] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0046.541] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="pl-PL" | out: lpString1="C:\\Boot\\pl-PL") returned="C:\\Boot\\pl-PL" [0046.541] lstrlenA (lpString="C:\\Boot\\pl-PL") returned 13 [0046.541] FindFirstFileA (in: lpFileName="C:\\Boot\\pl-PL\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8238, cFileName=".", cAlternateFileName="")) returned 0x2d6f70 [0046.541] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.541] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.542] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.542] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.542] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0046.542] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.542] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.542] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.542] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0046.542] PathFindFileNameA (pszPath="C:\\Boot\\pl-PL\\*.*") returned="*.*" [0046.542] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\pl-PL\\" | out: lpString1="C:\\Boot\\pl-PL\\") returned="C:\\Boot\\pl-PL\\" [0046.542] PathAddBackslashA (in: pszPath="C:\\Boot\\pl-PL\\" | out: pszPath="C:\\Boot\\pl-PL\\") returned="" [0046.542] lstrcatA (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\pl-PL\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\pl-PL\\HOW TO DECRYPT FILES.txt" [0046.542] GetFileAttributesA (lpFileName="C:\\Boot\\pl-PL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pl-pl\\how to decrypt files.txt")) returned 0xffffffff [0046.542] CreateFileA (lpFileName="C:\\Boot\\pl-PL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pl-pl\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0046.542] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.542] WriteFile (in: hFile=0x84, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.543] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.543] CloseHandle (hObject=0x84) returned 1 [0046.543] lstrcatA (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned="C:\\Boot\\pl-PL\\bootmgr.exe.mui" [0046.543] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0046.543] lstrlenA (lpString="*.zip") returned 5 [0046.544] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0046.544] lstrlenA (lpString="*.rar") returned 5 [0046.544] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0046.544] lstrlenA (lpString="*.7z") returned 4 [0046.544] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0046.544] lstrlenA (lpString="*.tar") returned 5 [0046.544] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0046.544] lstrlenA (lpString="*.gzip") returned 6 [0046.544] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0046.544] lstrlenA (lpString="*.jpg") returned 5 [0046.544] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0046.544] lstrlenA (lpString="*.jpeg") returned 6 [0046.544] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0046.544] lstrlenA (lpString="*.psd") returned 5 [0046.544] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0046.544] lstrlenA (lpString="*.gif") returned 5 [0046.544] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0046.544] lstrlenA (lpString="*.doc") returned 5 [0046.544] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0046.544] lstrlenA (lpString="*.docx") returned 6 [0046.544] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0046.544] lstrlenA (lpString="*.xls") returned 5 [0046.544] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0046.544] lstrlenA (lpString="*.xlsx") returned 6 [0046.544] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0046.544] lstrlenA (lpString="*.ppt") returned 5 [0046.544] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0046.544] lstrlenA (lpString="*.pptx") returned 6 [0046.544] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0046.544] lstrlenA (lpString="*.pdf") returned 5 [0046.544] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0046.544] lstrlenA (lpString="*.mov") returned 5 [0046.544] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0046.544] lstrlenA (lpString="*.m2v") returned 5 [0046.544] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0046.545] lstrlenA (lpString="*.3gp") returned 5 [0046.545] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0046.545] lstrlenA (lpString="*.mpeg") returned 6 [0046.545] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0046.545] lstrlenA (lpString="*.mpg") returned 5 [0046.545] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0046.545] lstrlenA (lpString="*.flv") returned 5 [0046.545] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0046.545] lstrlenA (lpString="*.avi") returned 5 [0046.545] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0046.545] lstrlenA (lpString="*.mp4") returned 5 [0046.545] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0046.545] lstrlenA (lpString="*.wmv") returned 5 [0046.545] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0046.545] lstrlenA (lpString="*.divx") returned 6 [0046.545] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0046.545] lstrlenA (lpString="*.mkv") returned 5 [0046.545] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0046.545] lstrlenA (lpString="*.mp3") returned 5 [0046.545] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0046.545] lstrlenA (lpString="*.wav") returned 5 [0046.545] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0046.545] lstrlenA (lpString="*.flac") returned 6 [0046.546] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0046.546] lstrlenA (lpString="*.ape") returned 5 [0046.546] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0046.546] lstrlenA (lpString="*.wma") returned 5 [0046.546] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0046.546] lstrlenA (lpString="*.ac3") returned 5 [0046.546] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mxf") returned 0 [0046.546] lstrlenA (lpString="*.mxf") returned 5 [0046.546] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0046.546] FindClose (in: hFindFile=0x2d6f70 | out: hFindFile=0x2d6f70) returned 1 [0046.546] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0046.546] lstrcmpA (lpString1=".", lpString2="pt-BR") returned -1 [0046.546] lstrcmpA (lpString1="..", lpString2="pt-BR") returned -1 [0046.546] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0046.546] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="pt-BR" | out: lpString1="C:\\Boot\\pt-BR") returned="C:\\Boot\\pt-BR" [0046.546] lstrlenA (lpString="C:\\Boot\\pt-BR") returned 13 [0046.546] FindFirstFileA (in: lpFileName="C:\\Boot\\pt-BR\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8238, cFileName=".", cAlternateFileName="")) returned 0x2d6f70 [0046.547] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.547] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.547] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.547] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.547] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0046.547] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.547] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.547] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.547] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0046.547] PathFindFileNameA (pszPath="C:\\Boot\\pt-BR\\*.*") returned="*.*" [0046.547] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\pt-BR\\" | out: lpString1="C:\\Boot\\pt-BR\\") returned="C:\\Boot\\pt-BR\\" [0046.547] PathAddBackslashA (in: pszPath="C:\\Boot\\pt-BR\\" | out: pszPath="C:\\Boot\\pt-BR\\") returned="" [0046.547] lstrcatA (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\pt-BR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\pt-BR\\HOW TO DECRYPT FILES.txt" [0046.547] GetFileAttributesA (lpFileName="C:\\Boot\\pt-BR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pt-br\\how to decrypt files.txt")) returned 0xffffffff [0046.548] CreateFileA (lpFileName="C:\\Boot\\pt-BR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pt-br\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0046.548] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.548] WriteFile (in: hFile=0x84, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.549] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.549] CloseHandle (hObject=0x84) returned 1 [0046.549] lstrcatA (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned="C:\\Boot\\pt-BR\\bootmgr.exe.mui" [0046.549] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0046.549] lstrlenA (lpString="*.zip") returned 5 [0046.549] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0046.549] lstrlenA (lpString="*.rar") returned 5 [0046.549] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0046.549] lstrlenA (lpString="*.7z") returned 4 [0046.549] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0046.549] lstrlenA (lpString="*.tar") returned 5 [0046.549] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0046.549] lstrlenA (lpString="*.gzip") returned 6 [0046.549] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0046.549] lstrlenA (lpString="*.jpg") returned 5 [0046.549] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0046.549] lstrlenA (lpString="*.jpeg") returned 6 [0046.549] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0046.550] lstrlenA (lpString="*.psd") returned 5 [0046.550] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0046.550] lstrlenA (lpString="*.gif") returned 5 [0046.550] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0046.550] lstrlenA (lpString="*.doc") returned 5 [0046.550] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0046.550] lstrlenA (lpString="*.docx") returned 6 [0046.550] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0046.550] lstrlenA (lpString="*.xls") returned 5 [0046.550] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0046.550] lstrlenA (lpString="*.xlsx") returned 6 [0046.550] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0046.550] lstrlenA (lpString="*.ppt") returned 5 [0046.550] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0046.550] lstrlenA (lpString="*.pptx") returned 6 [0046.550] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0046.550] lstrlenA (lpString="*.pdf") returned 5 [0046.550] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0046.550] lstrlenA (lpString="*.mov") returned 5 [0046.550] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0046.550] lstrlenA (lpString="*.m2v") returned 5 [0046.550] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0046.550] lstrlenA (lpString="*.3gp") returned 5 [0046.550] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0046.550] lstrlenA (lpString="*.mpeg") returned 6 [0046.550] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0046.550] lstrlenA (lpString="*.mpg") returned 5 [0046.550] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0046.550] lstrlenA (lpString="*.flv") returned 5 [0046.550] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0046.550] lstrlenA (lpString="*.avi") returned 5 [0046.550] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0046.550] lstrlenA (lpString="*.mp4") returned 5 [0046.551] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0046.551] lstrlenA (lpString="*.wmv") returned 5 [0046.551] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0046.551] lstrlenA (lpString="*.divx") returned 6 [0046.551] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0046.551] lstrlenA (lpString="*.mkv") returned 5 [0046.551] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0046.551] lstrlenA (lpString="*.mp3") returned 5 [0046.551] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0046.551] lstrlenA (lpString="*.wav") returned 5 [0046.551] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0046.551] lstrlenA (lpString="*.flac") returned 6 [0046.551] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0046.551] lstrlenA (lpString="*.ape") returned 5 [0046.551] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0046.551] lstrlenA (lpString="*.wma") returned 5 [0046.551] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0046.551] lstrlenA (lpString="*.ac3") returned 5 [0046.551] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mxf") returned 0 [0046.551] lstrlenA (lpString="*.mxf") returned 5 [0046.551] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0046.551] FindClose (in: hFindFile=0x2d6f70 | out: hFindFile=0x2d6f70) returned 1 [0046.551] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0046.551] lstrcmpA (lpString1=".", lpString2="pt-PT") returned -1 [0046.551] lstrcmpA (lpString1="..", lpString2="pt-PT") returned -1 [0046.551] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0046.551] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="pt-PT" | out: lpString1="C:\\Boot\\pt-PT") returned="C:\\Boot\\pt-PT" [0046.551] lstrlenA (lpString="C:\\Boot\\pt-PT") returned 13 [0046.551] FindFirstFileA (in: lpFileName="C:\\Boot\\pt-PT\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8238, cFileName=".", cAlternateFileName="")) returned 0x2d6f70 [0046.552] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.552] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.552] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.552] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.552] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0046.552] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.552] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.552] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.552] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0046.552] PathFindFileNameA (pszPath="C:\\Boot\\pt-PT\\*.*") returned="*.*" [0046.552] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\pt-PT\\" | out: lpString1="C:\\Boot\\pt-PT\\") returned="C:\\Boot\\pt-PT\\" [0046.552] PathAddBackslashA (in: pszPath="C:\\Boot\\pt-PT\\" | out: pszPath="C:\\Boot\\pt-PT\\") returned="" [0046.552] lstrcatA (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\pt-PT\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\pt-PT\\HOW TO DECRYPT FILES.txt" [0046.552] GetFileAttributesA (lpFileName="C:\\Boot\\pt-PT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pt-pt\\how to decrypt files.txt")) returned 0xffffffff [0046.552] CreateFileA (lpFileName="C:\\Boot\\pt-PT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\pt-pt\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0046.552] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.553] WriteFile (in: hFile=0x84, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.553] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.554] CloseHandle (hObject=0x84) returned 1 [0046.554] lstrcatA (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned="C:\\Boot\\pt-PT\\bootmgr.exe.mui" [0046.554] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0046.554] lstrlenA (lpString="*.zip") returned 5 [0046.554] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0046.554] lstrlenA (lpString="*.rar") returned 5 [0046.554] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0046.554] lstrlenA (lpString="*.7z") returned 4 [0046.554] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0046.554] lstrlenA (lpString="*.tar") returned 5 [0046.554] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0046.554] lstrlenA (lpString="*.gzip") returned 6 [0046.554] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0046.554] lstrlenA (lpString="*.jpg") returned 5 [0046.554] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0046.554] lstrlenA (lpString="*.jpeg") returned 6 [0046.554] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0046.554] lstrlenA (lpString="*.psd") returned 5 [0046.554] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0046.554] lstrlenA (lpString="*.gif") returned 5 [0046.554] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0046.554] lstrlenA (lpString="*.doc") returned 5 [0046.554] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0046.554] lstrlenA (lpString="*.docx") returned 6 [0046.554] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0046.554] lstrlenA (lpString="*.xls") returned 5 [0046.554] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0046.554] lstrlenA (lpString="*.xlsx") returned 6 [0046.554] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0046.555] lstrlenA (lpString="*.ppt") returned 5 [0046.555] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0046.555] lstrlenA (lpString="*.pptx") returned 6 [0046.555] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0046.555] lstrlenA (lpString="*.pdf") returned 5 [0046.555] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0046.555] lstrlenA (lpString="*.mov") returned 5 [0046.555] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0046.555] lstrlenA (lpString="*.m2v") returned 5 [0046.555] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0046.555] lstrlenA (lpString="*.3gp") returned 5 [0046.555] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0046.555] lstrlenA (lpString="*.mpeg") returned 6 [0046.555] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0046.555] lstrlenA (lpString="*.mpg") returned 5 [0046.555] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0046.555] lstrlenA (lpString="*.flv") returned 5 [0046.555] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0046.555] lstrlenA (lpString="*.avi") returned 5 [0046.555] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0046.555] lstrlenA (lpString="*.mp4") returned 5 [0046.555] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0046.555] lstrlenA (lpString="*.wmv") returned 5 [0046.555] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0046.555] lstrlenA (lpString="*.divx") returned 6 [0046.555] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0046.555] lstrlenA (lpString="*.mkv") returned 5 [0046.555] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0046.555] lstrlenA (lpString="*.mp3") returned 5 [0046.555] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0046.555] lstrlenA (lpString="*.wav") returned 5 [0046.555] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0046.555] lstrlenA (lpString="*.flac") returned 6 [0046.555] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0046.555] lstrlenA (lpString="*.ape") returned 5 [0046.556] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0046.556] lstrlenA (lpString="*.wma") returned 5 [0046.556] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0046.556] lstrlenA (lpString="*.ac3") returned 5 [0046.556] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mxf") returned 0 [0046.556] lstrlenA (lpString="*.mxf") returned 5 [0046.556] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0046.556] FindClose (in: hFindFile=0x2d6f70 | out: hFindFile=0x2d6f70) returned 1 [0046.556] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0046.556] lstrcmpA (lpString1=".", lpString2="ru-RU") returned -1 [0046.556] lstrcmpA (lpString1="..", lpString2="ru-RU") returned -1 [0046.556] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0046.556] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="ru-RU" | out: lpString1="C:\\Boot\\ru-RU") returned="C:\\Boot\\ru-RU" [0046.556] lstrlenA (lpString="C:\\Boot\\ru-RU") returned 13 [0046.556] FindFirstFileA (in: lpFileName="C:\\Boot\\ru-RU\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8238, cFileName=".", cAlternateFileName="")) returned 0x2d6f70 [0046.557] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.557] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.557] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.557] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.557] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0046.557] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.557] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.557] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.557] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0046.557] PathFindFileNameA (pszPath="C:\\Boot\\ru-RU\\*.*") returned="*.*" [0046.557] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\ru-RU\\" | out: lpString1="C:\\Boot\\ru-RU\\") returned="C:\\Boot\\ru-RU\\" [0046.558] PathAddBackslashA (in: pszPath="C:\\Boot\\ru-RU\\" | out: pszPath="C:\\Boot\\ru-RU\\") returned="" [0046.558] lstrcatA (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\ru-RU\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\ru-RU\\HOW TO DECRYPT FILES.txt" [0046.558] GetFileAttributesA (lpFileName="C:\\Boot\\ru-RU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ru-ru\\how to decrypt files.txt")) returned 0xffffffff [0046.558] CreateFileA (lpFileName="C:\\Boot\\ru-RU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\ru-ru\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0046.558] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.558] WriteFile (in: hFile=0x84, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.559] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.559] CloseHandle (hObject=0x84) returned 1 [0046.560] lstrcatA (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned="C:\\Boot\\ru-RU\\bootmgr.exe.mui" [0046.560] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0046.560] lstrlenA (lpString="*.zip") returned 5 [0046.560] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0046.560] lstrlenA (lpString="*.rar") returned 5 [0046.560] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0046.560] lstrlenA (lpString="*.7z") returned 4 [0046.560] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0046.560] lstrlenA (lpString="*.tar") returned 5 [0046.560] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0046.560] lstrlenA (lpString="*.gzip") returned 6 [0046.560] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0046.560] lstrlenA (lpString="*.jpg") returned 5 [0046.560] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0046.560] lstrlenA (lpString="*.jpeg") returned 6 [0046.560] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0046.560] lstrlenA (lpString="*.psd") returned 5 [0046.560] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0046.560] lstrlenA (lpString="*.gif") returned 5 [0046.560] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0046.560] lstrlenA (lpString="*.doc") returned 5 [0046.560] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0046.560] lstrlenA (lpString="*.docx") returned 6 [0046.560] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0046.560] lstrlenA (lpString="*.xls") returned 5 [0046.561] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0046.561] lstrlenA (lpString="*.xlsx") returned 6 [0046.561] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0046.561] lstrlenA (lpString="*.ppt") returned 5 [0046.561] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0046.561] lstrlenA (lpString="*.pptx") returned 6 [0046.561] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0046.561] lstrlenA (lpString="*.pdf") returned 5 [0046.561] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0046.561] lstrlenA (lpString="*.mov") returned 5 [0046.561] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0046.561] lstrlenA (lpString="*.m2v") returned 5 [0046.561] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0046.561] lstrlenA (lpString="*.3gp") returned 5 [0046.561] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0046.561] lstrlenA (lpString="*.mpeg") returned 6 [0046.561] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0046.561] lstrlenA (lpString="*.mpg") returned 5 [0046.561] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0046.561] lstrlenA (lpString="*.flv") returned 5 [0046.561] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0046.561] lstrlenA (lpString="*.avi") returned 5 [0046.561] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0046.561] lstrlenA (lpString="*.mp4") returned 5 [0046.561] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0046.561] lstrlenA (lpString="*.wmv") returned 5 [0046.561] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0046.561] lstrlenA (lpString="*.divx") returned 6 [0046.561] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0046.562] lstrlenA (lpString="*.mkv") returned 5 [0046.562] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0046.562] lstrlenA (lpString="*.mp3") returned 5 [0046.562] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0046.562] lstrlenA (lpString="*.wav") returned 5 [0046.562] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0046.562] lstrlenA (lpString="*.flac") returned 6 [0046.562] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0046.562] lstrlenA (lpString="*.ape") returned 5 [0046.562] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0046.562] lstrlenA (lpString="*.wma") returned 5 [0046.562] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0046.562] lstrlenA (lpString="*.ac3") returned 5 [0046.562] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mxf") returned 0 [0046.562] lstrlenA (lpString="*.mxf") returned 5 [0046.562] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0046.562] FindClose (in: hFindFile=0x2d6f70 | out: hFindFile=0x2d6f70) returned 1 [0046.562] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0046.562] lstrcmpA (lpString1=".", lpString2="sv-SE") returned -1 [0046.562] lstrcmpA (lpString1="..", lpString2="sv-SE") returned -1 [0046.562] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0046.562] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="sv-SE" | out: lpString1="C:\\Boot\\sv-SE") returned="C:\\Boot\\sv-SE" [0046.562] lstrlenA (lpString="C:\\Boot\\sv-SE") returned 13 [0046.562] FindFirstFileA (in: lpFileName="C:\\Boot\\sv-SE\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8238, cFileName=".", cAlternateFileName="")) returned 0x2d6f70 [0046.563] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.563] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.563] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.563] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.563] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0046.563] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.563] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.563] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.563] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0046.563] PathFindFileNameA (pszPath="C:\\Boot\\sv-SE\\*.*") returned="*.*" [0046.563] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\sv-SE\\" | out: lpString1="C:\\Boot\\sv-SE\\") returned="C:\\Boot\\sv-SE\\" [0046.563] PathAddBackslashA (in: pszPath="C:\\Boot\\sv-SE\\" | out: pszPath="C:\\Boot\\sv-SE\\") returned="" [0046.563] lstrcatA (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\sv-SE\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\sv-SE\\HOW TO DECRYPT FILES.txt" [0046.563] GetFileAttributesA (lpFileName="C:\\Boot\\sv-SE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sv-se\\how to decrypt files.txt")) returned 0xffffffff [0046.563] CreateFileA (lpFileName="C:\\Boot\\sv-SE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\sv-se\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0046.564] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.564] WriteFile (in: hFile=0x84, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.565] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.565] CloseHandle (hObject=0x84) returned 1 [0046.565] lstrcatA (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned="C:\\Boot\\sv-SE\\bootmgr.exe.mui" [0046.565] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0046.565] lstrlenA (lpString="*.zip") returned 5 [0046.565] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0046.565] lstrlenA (lpString="*.rar") returned 5 [0046.565] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0046.566] lstrlenA (lpString="*.7z") returned 4 [0046.566] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0046.566] lstrlenA (lpString="*.tar") returned 5 [0046.566] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0046.566] lstrlenA (lpString="*.gzip") returned 6 [0046.566] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0046.566] lstrlenA (lpString="*.jpg") returned 5 [0046.566] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0046.566] lstrlenA (lpString="*.jpeg") returned 6 [0046.566] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0046.566] lstrlenA (lpString="*.psd") returned 5 [0046.566] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0046.566] lstrlenA (lpString="*.gif") returned 5 [0046.566] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0046.566] lstrlenA (lpString="*.doc") returned 5 [0046.566] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0046.566] lstrlenA (lpString="*.docx") returned 6 [0046.566] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0046.566] lstrlenA (lpString="*.xls") returned 5 [0046.566] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0046.566] lstrlenA (lpString="*.xlsx") returned 6 [0046.566] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0046.566] lstrlenA (lpString="*.ppt") returned 5 [0046.566] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0046.566] lstrlenA (lpString="*.pptx") returned 6 [0046.566] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0046.566] lstrlenA (lpString="*.pdf") returned 5 [0046.567] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0046.567] lstrlenA (lpString="*.mov") returned 5 [0046.567] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0046.567] lstrlenA (lpString="*.m2v") returned 5 [0046.567] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0046.567] lstrlenA (lpString="*.3gp") returned 5 [0046.567] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0046.567] lstrlenA (lpString="*.mpeg") returned 6 [0046.567] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0046.567] lstrlenA (lpString="*.mpg") returned 5 [0046.567] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0046.567] lstrlenA (lpString="*.flv") returned 5 [0046.567] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0046.567] lstrlenA (lpString="*.avi") returned 5 [0046.567] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0046.567] lstrlenA (lpString="*.mp4") returned 5 [0046.567] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0046.567] lstrlenA (lpString="*.wmv") returned 5 [0046.567] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0046.567] lstrlenA (lpString="*.divx") returned 6 [0046.567] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0046.567] lstrlenA (lpString="*.mkv") returned 5 [0046.567] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0046.567] lstrlenA (lpString="*.mp3") returned 5 [0046.567] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0046.567] lstrlenA (lpString="*.wav") returned 5 [0046.567] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0046.568] lstrlenA (lpString="*.flac") returned 6 [0046.568] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0046.568] lstrlenA (lpString="*.ape") returned 5 [0046.568] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0046.568] lstrlenA (lpString="*.wma") returned 5 [0046.568] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0046.568] lstrlenA (lpString="*.ac3") returned 5 [0046.568] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mxf") returned 0 [0046.568] lstrlenA (lpString="*.mxf") returned 5 [0046.568] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0046.568] FindClose (in: hFindFile=0x2d6f70 | out: hFindFile=0x2d6f70) returned 1 [0046.568] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0046.568] lstrcmpA (lpString1=".", lpString2="tr-TR") returned -1 [0046.568] lstrcmpA (lpString1="..", lpString2="tr-TR") returned -1 [0046.568] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0046.568] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="tr-TR" | out: lpString1="C:\\Boot\\tr-TR") returned="C:\\Boot\\tr-TR" [0046.568] lstrlenA (lpString="C:\\Boot\\tr-TR") returned 13 [0046.568] FindFirstFileA (in: lpFileName="C:\\Boot\\tr-TR\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8238, cFileName=".", cAlternateFileName="")) returned 0x2d6f70 [0046.569] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.569] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.570] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.570] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.570] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0046.570] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.570] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.570] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.570] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0046.570] PathFindFileNameA (pszPath="C:\\Boot\\tr-TR\\*.*") returned="*.*" [0046.570] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\tr-TR\\" | out: lpString1="C:\\Boot\\tr-TR\\") returned="C:\\Boot\\tr-TR\\" [0046.570] PathAddBackslashA (in: pszPath="C:\\Boot\\tr-TR\\" | out: pszPath="C:\\Boot\\tr-TR\\") returned="" [0046.570] lstrcatA (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\tr-TR\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\tr-TR\\HOW TO DECRYPT FILES.txt" [0046.570] GetFileAttributesA (lpFileName="C:\\Boot\\tr-TR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\tr-tr\\how to decrypt files.txt")) returned 0xffffffff [0046.570] CreateFileA (lpFileName="C:\\Boot\\tr-TR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\tr-tr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0046.570] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.570] WriteFile (in: hFile=0x84, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.572] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.572] CloseHandle (hObject=0x84) returned 1 [0046.572] lstrcatA (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned="C:\\Boot\\tr-TR\\bootmgr.exe.mui" [0046.572] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0046.572] lstrlenA (lpString="*.zip") returned 5 [0046.572] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0046.572] lstrlenA (lpString="*.rar") returned 5 [0046.572] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0046.572] lstrlenA (lpString="*.7z") returned 4 [0046.572] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0046.572] lstrlenA (lpString="*.tar") returned 5 [0046.572] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0046.572] lstrlenA (lpString="*.gzip") returned 6 [0046.572] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0046.572] lstrlenA (lpString="*.jpg") returned 5 [0046.572] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0046.573] lstrlenA (lpString="*.jpeg") returned 6 [0046.573] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0046.573] lstrlenA (lpString="*.psd") returned 5 [0046.573] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0046.573] lstrlenA (lpString="*.gif") returned 5 [0046.573] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0046.573] lstrlenA (lpString="*.doc") returned 5 [0046.573] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0046.573] lstrlenA (lpString="*.docx") returned 6 [0046.573] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0046.573] lstrlenA (lpString="*.xls") returned 5 [0046.573] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0046.573] lstrlenA (lpString="*.xlsx") returned 6 [0046.573] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0046.573] lstrlenA (lpString="*.ppt") returned 5 [0046.573] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0046.573] lstrlenA (lpString="*.pptx") returned 6 [0046.573] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0046.573] lstrlenA (lpString="*.pdf") returned 5 [0046.573] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0046.573] lstrlenA (lpString="*.mov") returned 5 [0046.573] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0046.573] lstrlenA (lpString="*.m2v") returned 5 [0046.573] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0046.573] lstrlenA (lpString="*.3gp") returned 5 [0046.573] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0046.573] lstrlenA (lpString="*.mpeg") returned 6 [0046.573] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0046.574] lstrlenA (lpString="*.mpg") returned 5 [0046.574] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0046.574] lstrlenA (lpString="*.flv") returned 5 [0046.574] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0046.574] lstrlenA (lpString="*.avi") returned 5 [0046.574] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0046.574] lstrlenA (lpString="*.mp4") returned 5 [0046.574] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0046.574] lstrlenA (lpString="*.wmv") returned 5 [0046.574] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0046.574] lstrlenA (lpString="*.divx") returned 6 [0046.574] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0046.574] lstrlenA (lpString="*.mkv") returned 5 [0046.574] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0046.574] lstrlenA (lpString="*.mp3") returned 5 [0046.574] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0046.574] lstrlenA (lpString="*.wav") returned 5 [0046.574] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0046.574] lstrlenA (lpString="*.flac") returned 6 [0046.574] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0046.574] lstrlenA (lpString="*.ape") returned 5 [0046.574] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0046.574] lstrlenA (lpString="*.wma") returned 5 [0046.574] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0046.574] lstrlenA (lpString="*.ac3") returned 5 [0046.575] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mxf") returned 0 [0046.575] lstrlenA (lpString="*.mxf") returned 5 [0046.575] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0046.575] FindClose (in: hFindFile=0x2d6f70 | out: hFindFile=0x2d6f70) returned 1 [0046.575] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0046.575] lstrcmpA (lpString1=".", lpString2="zh-CN") returned -1 [0046.575] lstrcmpA (lpString1="..", lpString2="zh-CN") returned -1 [0046.575] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0046.575] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="zh-CN" | out: lpString1="C:\\Boot\\zh-CN") returned="C:\\Boot\\zh-CN" [0046.575] lstrlenA (lpString="C:\\Boot\\zh-CN") returned 13 [0046.575] FindFirstFileA (in: lpFileName="C:\\Boot\\zh-CN\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8238, cFileName=".", cAlternateFileName="")) returned 0x2d6f70 [0046.575] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.575] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.575] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.575] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.575] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0046.576] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.576] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.576] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.576] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0046.576] PathFindFileNameA (pszPath="C:\\Boot\\zh-CN\\*.*") returned="*.*" [0046.576] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\zh-CN\\" | out: lpString1="C:\\Boot\\zh-CN\\") returned="C:\\Boot\\zh-CN\\" [0046.576] PathAddBackslashA (in: pszPath="C:\\Boot\\zh-CN\\" | out: pszPath="C:\\Boot\\zh-CN\\") returned="" [0046.576] lstrcatA (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\zh-CN\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\zh-CN\\HOW TO DECRYPT FILES.txt" [0046.576] GetFileAttributesA (lpFileName="C:\\Boot\\zh-CN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-cn\\how to decrypt files.txt")) returned 0xffffffff [0046.576] CreateFileA (lpFileName="C:\\Boot\\zh-CN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-cn\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0046.577] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.577] WriteFile (in: hFile=0x84, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.578] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.578] CloseHandle (hObject=0x84) returned 1 [0046.578] lstrcatA (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned="C:\\Boot\\zh-CN\\bootmgr.exe.mui" [0046.578] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0046.578] lstrlenA (lpString="*.zip") returned 5 [0046.578] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0046.578] lstrlenA (lpString="*.rar") returned 5 [0046.579] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0046.579] lstrlenA (lpString="*.7z") returned 4 [0046.579] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0046.579] lstrlenA (lpString="*.tar") returned 5 [0046.579] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0046.579] lstrlenA (lpString="*.gzip") returned 6 [0046.579] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0046.579] lstrlenA (lpString="*.jpg") returned 5 [0046.579] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0046.579] lstrlenA (lpString="*.jpeg") returned 6 [0046.579] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0046.579] lstrlenA (lpString="*.psd") returned 5 [0046.579] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0046.579] lstrlenA (lpString="*.gif") returned 5 [0046.579] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0046.579] lstrlenA (lpString="*.doc") returned 5 [0046.579] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0046.579] lstrlenA (lpString="*.docx") returned 6 [0046.579] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0046.579] lstrlenA (lpString="*.xls") returned 5 [0046.579] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0046.579] lstrlenA (lpString="*.xlsx") returned 6 [0046.579] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0046.579] lstrlenA (lpString="*.ppt") returned 5 [0046.579] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0046.579] lstrlenA (lpString="*.pptx") returned 6 [0046.579] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0046.580] lstrlenA (lpString="*.pdf") returned 5 [0046.580] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0046.580] lstrlenA (lpString="*.mov") returned 5 [0046.580] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0046.580] lstrlenA (lpString="*.m2v") returned 5 [0046.580] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0046.580] lstrlenA (lpString="*.3gp") returned 5 [0046.580] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0046.580] lstrlenA (lpString="*.mpeg") returned 6 [0046.580] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0046.580] lstrlenA (lpString="*.mpg") returned 5 [0046.580] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0046.580] lstrlenA (lpString="*.flv") returned 5 [0046.580] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0046.580] lstrlenA (lpString="*.avi") returned 5 [0046.580] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0046.580] lstrlenA (lpString="*.mp4") returned 5 [0046.580] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0046.580] lstrlenA (lpString="*.wmv") returned 5 [0046.580] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0046.580] lstrlenA (lpString="*.divx") returned 6 [0046.580] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0046.580] lstrlenA (lpString="*.mkv") returned 5 [0046.580] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0046.580] lstrlenA (lpString="*.mp3") returned 5 [0046.580] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0046.581] lstrlenA (lpString="*.wav") returned 5 [0046.581] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0046.581] lstrlenA (lpString="*.flac") returned 6 [0046.581] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0046.581] lstrlenA (lpString="*.ape") returned 5 [0046.581] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0046.581] lstrlenA (lpString="*.wma") returned 5 [0046.581] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0046.581] lstrlenA (lpString="*.ac3") returned 5 [0046.581] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mxf") returned 0 [0046.581] lstrlenA (lpString="*.mxf") returned 5 [0046.581] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0046.581] FindClose (in: hFindFile=0x2d6f70 | out: hFindFile=0x2d6f70) returned 1 [0046.581] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0046.581] lstrcmpA (lpString1=".", lpString2="zh-HK") returned -1 [0046.581] lstrcmpA (lpString1="..", lpString2="zh-HK") returned -1 [0046.581] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0046.581] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="zh-HK" | out: lpString1="C:\\Boot\\zh-HK") returned="C:\\Boot\\zh-HK" [0046.581] lstrlenA (lpString="C:\\Boot\\zh-HK") returned 13 [0046.581] FindFirstFileA (in: lpFileName="C:\\Boot\\zh-HK\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8238, cFileName=".", cAlternateFileName="")) returned 0x2d6f70 [0046.583] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.583] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.583] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.583] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.583] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0046.583] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.583] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.583] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.583] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0046.583] PathFindFileNameA (pszPath="C:\\Boot\\zh-HK\\*.*") returned="*.*" [0046.583] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\zh-HK\\" | out: lpString1="C:\\Boot\\zh-HK\\") returned="C:\\Boot\\zh-HK\\" [0046.583] PathAddBackslashA (in: pszPath="C:\\Boot\\zh-HK\\" | out: pszPath="C:\\Boot\\zh-HK\\") returned="" [0046.583] lstrcatA (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\zh-HK\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\zh-HK\\HOW TO DECRYPT FILES.txt" [0046.583] GetFileAttributesA (lpFileName="C:\\Boot\\zh-HK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-hk\\how to decrypt files.txt")) returned 0xffffffff [0046.583] CreateFileA (lpFileName="C:\\Boot\\zh-HK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-hk\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0046.584] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.584] WriteFile (in: hFile=0x84, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.585] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.585] CloseHandle (hObject=0x84) returned 1 [0046.585] lstrcatA (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned="C:\\Boot\\zh-HK\\bootmgr.exe.mui" [0046.585] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0046.586] lstrlenA (lpString="*.zip") returned 5 [0046.586] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0046.586] lstrlenA (lpString="*.rar") returned 5 [0046.586] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0046.586] lstrlenA (lpString="*.7z") returned 4 [0046.586] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0046.586] lstrlenA (lpString="*.tar") returned 5 [0046.586] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0046.586] lstrlenA (lpString="*.gzip") returned 6 [0046.586] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0046.586] lstrlenA (lpString="*.jpg") returned 5 [0046.586] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0046.586] lstrlenA (lpString="*.jpeg") returned 6 [0046.586] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0046.586] lstrlenA (lpString="*.psd") returned 5 [0046.586] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0046.586] lstrlenA (lpString="*.gif") returned 5 [0046.586] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0046.586] lstrlenA (lpString="*.doc") returned 5 [0046.586] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0046.586] lstrlenA (lpString="*.docx") returned 6 [0046.586] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0046.586] lstrlenA (lpString="*.xls") returned 5 [0046.586] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0046.586] lstrlenA (lpString="*.xlsx") returned 6 [0046.586] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0046.586] lstrlenA (lpString="*.ppt") returned 5 [0046.586] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0046.587] lstrlenA (lpString="*.pptx") returned 6 [0046.587] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0046.587] lstrlenA (lpString="*.pdf") returned 5 [0046.587] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0046.587] lstrlenA (lpString="*.mov") returned 5 [0046.587] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0046.587] lstrlenA (lpString="*.m2v") returned 5 [0046.587] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0046.587] lstrlenA (lpString="*.3gp") returned 5 [0046.587] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0046.587] lstrlenA (lpString="*.mpeg") returned 6 [0046.587] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0046.587] lstrlenA (lpString="*.mpg") returned 5 [0046.587] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0046.587] lstrlenA (lpString="*.flv") returned 5 [0046.587] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0046.587] lstrlenA (lpString="*.avi") returned 5 [0046.587] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0046.587] lstrlenA (lpString="*.mp4") returned 5 [0046.587] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0046.587] lstrlenA (lpString="*.wmv") returned 5 [0046.587] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0046.587] lstrlenA (lpString="*.divx") returned 6 [0046.587] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0046.587] lstrlenA (lpString="*.mkv") returned 5 [0046.587] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0046.587] lstrlenA (lpString="*.mp3") returned 5 [0046.587] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0046.588] lstrlenA (lpString="*.wav") returned 5 [0046.588] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0046.588] lstrlenA (lpString="*.flac") returned 6 [0046.588] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0046.588] lstrlenA (lpString="*.ape") returned 5 [0046.588] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0046.588] lstrlenA (lpString="*.wma") returned 5 [0046.588] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0046.588] lstrlenA (lpString="*.ac3") returned 5 [0046.588] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mxf") returned 0 [0046.588] lstrlenA (lpString="*.mxf") returned 5 [0046.588] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0046.588] FindClose (in: hFindFile=0x2d6f70 | out: hFindFile=0x2d6f70) returned 1 [0046.588] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0046.588] lstrcmpA (lpString1=".", lpString2="zh-TW") returned -1 [0046.588] lstrcmpA (lpString1="..", lpString2="zh-TW") returned -1 [0046.588] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0046.588] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="zh-TW" | out: lpString1="C:\\Boot\\zh-TW") returned="C:\\Boot\\zh-TW" [0046.588] lstrlenA (lpString="C:\\Boot\\zh-TW") returned 13 [0046.588] FindFirstFileA (in: lpFileName="C:\\Boot\\zh-TW\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8238, cFileName=".", cAlternateFileName="")) returned 0x2d6f70 [0046.589] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.589] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.589] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.589] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.589] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0046.589] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0046.589] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.589] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0046.589] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0046.589] PathFindFileNameA (pszPath="C:\\Boot\\zh-TW\\*.*") returned="*.*" [0046.589] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Boot\\zh-TW\\" | out: lpString1="C:\\Boot\\zh-TW\\") returned="C:\\Boot\\zh-TW\\" [0046.589] PathAddBackslashA (in: pszPath="C:\\Boot\\zh-TW\\" | out: pszPath="C:\\Boot\\zh-TW\\") returned="" [0046.589] lstrcatA (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Boot\\zh-TW\\HOW TO DECRYPT FILES.txt") returned="C:\\Boot\\zh-TW\\HOW TO DECRYPT FILES.txt" [0046.589] GetFileAttributesA (lpFileName="C:\\Boot\\zh-TW\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-tw\\how to decrypt files.txt")) returned 0xffffffff [0046.589] CreateFileA (lpFileName="C:\\Boot\\zh-TW\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\boot\\zh-tw\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0046.590] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.590] WriteFile (in: hFile=0x84, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.591] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.591] CloseHandle (hObject=0x84) returned 1 [0046.591] lstrcatA (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned="C:\\Boot\\zh-TW\\bootmgr.exe.mui" [0046.591] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0046.591] lstrlenA (lpString="*.zip") returned 5 [0046.591] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0046.591] lstrlenA (lpString="*.rar") returned 5 [0046.591] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0046.591] lstrlenA (lpString="*.7z") returned 4 [0046.591] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0046.591] lstrlenA (lpString="*.tar") returned 5 [0046.591] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0046.592] lstrlenA (lpString="*.gzip") returned 6 [0046.592] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0046.592] lstrlenA (lpString="*.jpg") returned 5 [0046.592] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0046.592] lstrlenA (lpString="*.jpeg") returned 6 [0046.592] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0046.592] lstrlenA (lpString="*.psd") returned 5 [0046.592] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0046.592] lstrlenA (lpString="*.gif") returned 5 [0046.592] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0046.592] lstrlenA (lpString="*.doc") returned 5 [0046.592] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0046.592] lstrlenA (lpString="*.docx") returned 6 [0046.592] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0046.592] lstrlenA (lpString="*.xls") returned 5 [0046.592] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0046.592] lstrlenA (lpString="*.xlsx") returned 6 [0046.592] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0046.592] lstrlenA (lpString="*.ppt") returned 5 [0046.592] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0046.592] lstrlenA (lpString="*.pptx") returned 6 [0046.592] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0046.593] lstrlenA (lpString="*.pdf") returned 5 [0046.593] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0046.593] lstrlenA (lpString="*.mov") returned 5 [0046.593] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0046.593] lstrlenA (lpString="*.m2v") returned 5 [0046.593] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0046.593] lstrlenA (lpString="*.3gp") returned 5 [0046.593] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0046.593] lstrlenA (lpString="*.mpeg") returned 6 [0046.593] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0046.593] lstrlenA (lpString="*.mpg") returned 5 [0046.593] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0046.593] lstrlenA (lpString="*.flv") returned 5 [0046.593] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0046.593] lstrlenA (lpString="*.avi") returned 5 [0046.593] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0046.593] lstrlenA (lpString="*.mp4") returned 5 [0046.593] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0046.593] lstrlenA (lpString="*.wmv") returned 5 [0046.593] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0046.593] lstrlenA (lpString="*.divx") returned 6 [0046.593] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0046.593] lstrlenA (lpString="*.mkv") returned 5 [0046.593] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0046.593] lstrlenA (lpString="*.mp3") returned 5 [0046.593] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0046.593] lstrlenA (lpString="*.wav") returned 5 [0046.593] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0046.593] lstrlenA (lpString="*.flac") returned 6 [0046.594] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0046.594] lstrlenA (lpString="*.ape") returned 5 [0046.594] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0046.594] lstrlenA (lpString="*.wma") returned 5 [0046.594] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0046.594] lstrlenA (lpString="*.ac3") returned 5 [0046.594] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mxf") returned 0 [0046.594] lstrlenA (lpString="*.mxf") returned 5 [0046.594] FindNextFileA (in: hFindFile=0x2d6f70, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0046.594] FindClose (in: hFindFile=0x2d6f70 | out: hFindFile=0x2d6f70) returned 1 [0046.594] FindNextFileA (in: hFindFile=0x2d5ef8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0046.594] FindClose (in: hFindFile=0x2d5ef8 | out: hFindFile=0x2d5ef8) returned 1 [0046.594] FindNextFileA (in: hFindFile=0x2d4d10, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0046.594] PeekMessageA (in: lpMsg=0x18fe14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fe14) returned 0 [0046.594] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bootmgr") returned 1 [0046.594] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr") returned 1 [0046.594] lstrcmpiA (lpString1="", lpString2="bootmgr") returned -1 [0046.594] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0046.594] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0046.594] PathAddBackslashA (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0046.594] lstrcatA (in: lpString1="C:\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\HOW TO DECRYPT FILES.txt") returned="C:\\HOW TO DECRYPT FILES.txt" [0046.595] GetFileAttributesA (lpFileName="C:\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\how to decrypt files.txt")) returned 0xffffffff [0046.595] CreateFileA (lpFileName="C:\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c [0046.599] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.599] WriteFile (in: hFile=0x7c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.600] SetFileTime (hFile=0x7c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.600] CloseHandle (hObject=0x7c) returned 1 [0046.600] lstrcatA (in: lpString1="C:\\", lpString2="bootmgr" | out: lpString1="C:\\bootmgr") returned="C:\\bootmgr" [0046.600] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.zip") returned 0 [0046.600] lstrlenA (lpString="*.zip") returned 5 [0046.600] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.rar") returned 0 [0046.600] lstrlenA (lpString="*.rar") returned 5 [0046.600] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.7z") returned 0 [0046.600] lstrlenA (lpString="*.7z") returned 4 [0046.600] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.tar") returned 0 [0046.600] lstrlenA (lpString="*.tar") returned 5 [0046.600] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.gzip") returned 0 [0046.601] lstrlenA (lpString="*.gzip") returned 6 [0046.601] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.jpg") returned 0 [0046.601] lstrlenA (lpString="*.jpg") returned 5 [0046.601] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.jpeg") returned 0 [0046.601] lstrlenA (lpString="*.jpeg") returned 6 [0046.601] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.psd") returned 0 [0046.601] lstrlenA (lpString="*.psd") returned 5 [0046.601] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.gif") returned 0 [0046.601] lstrlenA (lpString="*.gif") returned 5 [0046.601] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.doc") returned 0 [0046.601] lstrlenA (lpString="*.doc") returned 5 [0046.601] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.docx") returned 0 [0046.601] lstrlenA (lpString="*.docx") returned 6 [0046.601] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.xls") returned 0 [0046.601] lstrlenA (lpString="*.xls") returned 5 [0046.601] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.xlsx") returned 0 [0046.601] lstrlenA (lpString="*.xlsx") returned 6 [0046.601] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.ppt") returned 0 [0046.601] lstrlenA (lpString="*.ppt") returned 5 [0046.601] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.pptx") returned 0 [0046.601] lstrlenA (lpString="*.pptx") returned 6 [0046.601] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.pdf") returned 0 [0046.601] lstrlenA (lpString="*.pdf") returned 5 [0046.601] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mov") returned 0 [0046.601] lstrlenA (lpString="*.mov") returned 5 [0046.601] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.m2v") returned 0 [0046.601] lstrlenA (lpString="*.m2v") returned 5 [0046.601] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.3gp") returned 0 [0046.602] lstrlenA (lpString="*.3gp") returned 5 [0046.602] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mpeg") returned 0 [0046.602] lstrlenA (lpString="*.mpeg") returned 6 [0046.602] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mpg") returned 0 [0046.602] lstrlenA (lpString="*.mpg") returned 5 [0046.602] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.flv") returned 0 [0046.602] lstrlenA (lpString="*.flv") returned 5 [0046.602] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.avi") returned 0 [0046.602] lstrlenA (lpString="*.avi") returned 5 [0046.602] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mp4") returned 0 [0046.602] lstrlenA (lpString="*.mp4") returned 5 [0046.602] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.wmv") returned 0 [0046.602] lstrlenA (lpString="*.wmv") returned 5 [0046.602] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.divx") returned 0 [0046.602] lstrlenA (lpString="*.divx") returned 6 [0046.602] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mkv") returned 0 [0046.602] lstrlenA (lpString="*.mkv") returned 5 [0046.602] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mp3") returned 0 [0046.602] lstrlenA (lpString="*.mp3") returned 5 [0046.602] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.wav") returned 0 [0046.602] lstrlenA (lpString="*.wav") returned 5 [0046.602] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.flac") returned 0 [0046.602] lstrlenA (lpString="*.flac") returned 6 [0046.602] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.ape") returned 0 [0046.602] lstrlenA (lpString="*.ape") returned 5 [0046.602] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.wma") returned 0 [0046.602] lstrlenA (lpString="*.wma") returned 5 [0046.602] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.ac3") returned 0 [0046.603] lstrlenA (lpString="*.ac3") returned 5 [0046.603] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mxf") returned 0 [0046.603] lstrlenA (lpString="*.mxf") returned 5 [0046.603] FindNextFileA (in: hFindFile=0x2d4d10, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x2d6140, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0046.603] PeekMessageA (in: lpMsg=0x18fe14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fe14) returned 0 [0046.603] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BOOTSECT.BAK") returned 1 [0046.603] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BOOTSECT.BAK") returned 1 [0046.603] lstrcmpiA (lpString1="", lpString2="BOOTSECT.BAK") returned -1 [0046.603] PathFindFileNameA (pszPath="C:\\bootmgr") returned="bootmgr" [0046.603] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0046.603] PathAddBackslashA (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0046.603] lstrcatA (in: lpString1="C:\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\HOW TO DECRYPT FILES.txt") returned="C:\\HOW TO DECRYPT FILES.txt" [0046.603] GetFileAttributesA (lpFileName="C:\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\how to decrypt files.txt")) returned 0x20 [0046.603] lstrcatA (in: lpString1="C:\\", lpString2="BOOTSECT.BAK" | out: lpString1="C:\\BOOTSECT.BAK") returned="C:\\BOOTSECT.BAK" [0046.603] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.zip") returned 0 [0046.603] lstrlenA (lpString="*.zip") returned 5 [0046.603] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.rar") returned 0 [0046.603] lstrlenA (lpString="*.rar") returned 5 [0046.603] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.7z") returned 0 [0046.603] lstrlenA (lpString="*.7z") returned 4 [0046.603] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.tar") returned 0 [0046.603] lstrlenA (lpString="*.tar") returned 5 [0046.604] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.gzip") returned 0 [0046.604] lstrlenA (lpString="*.gzip") returned 6 [0046.604] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.jpg") returned 0 [0046.604] lstrlenA (lpString="*.jpg") returned 5 [0046.604] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.jpeg") returned 0 [0046.604] lstrlenA (lpString="*.jpeg") returned 6 [0046.604] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.psd") returned 0 [0046.604] lstrlenA (lpString="*.psd") returned 5 [0046.604] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.gif") returned 0 [0046.604] lstrlenA (lpString="*.gif") returned 5 [0046.604] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.doc") returned 0 [0046.604] lstrlenA (lpString="*.doc") returned 5 [0046.604] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.docx") returned 0 [0046.604] lstrlenA (lpString="*.docx") returned 6 [0046.604] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.xls") returned 0 [0046.604] lstrlenA (lpString="*.xls") returned 5 [0046.604] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.xlsx") returned 0 [0046.604] lstrlenA (lpString="*.xlsx") returned 6 [0046.604] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.ppt") returned 0 [0046.604] lstrlenA (lpString="*.ppt") returned 5 [0046.604] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.pptx") returned 0 [0046.604] lstrlenA (lpString="*.pptx") returned 6 [0046.604] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.pdf") returned 0 [0046.604] lstrlenA (lpString="*.pdf") returned 5 [0046.604] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.mov") returned 0 [0046.604] lstrlenA (lpString="*.mov") returned 5 [0046.604] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.m2v") returned 0 [0046.604] lstrlenA (lpString="*.m2v") returned 5 [0046.605] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.3gp") returned 0 [0046.605] lstrlenA (lpString="*.3gp") returned 5 [0046.605] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.mpeg") returned 0 [0046.605] lstrlenA (lpString="*.mpeg") returned 6 [0046.605] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.mpg") returned 0 [0046.605] lstrlenA (lpString="*.mpg") returned 5 [0046.605] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.flv") returned 0 [0046.605] lstrlenA (lpString="*.flv") returned 5 [0046.605] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.avi") returned 0 [0046.605] lstrlenA (lpString="*.avi") returned 5 [0046.605] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.mp4") returned 0 [0046.605] lstrlenA (lpString="*.mp4") returned 5 [0046.605] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.wmv") returned 0 [0046.605] lstrlenA (lpString="*.wmv") returned 5 [0046.605] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.divx") returned 0 [0046.605] lstrlenA (lpString="*.divx") returned 6 [0046.605] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.mkv") returned 0 [0046.605] lstrlenA (lpString="*.mkv") returned 5 [0046.605] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.mp3") returned 0 [0046.605] lstrlenA (lpString="*.mp3") returned 5 [0046.605] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.wav") returned 0 [0046.605] lstrlenA (lpString="*.wav") returned 5 [0046.605] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.flac") returned 0 [0046.605] lstrlenA (lpString="*.flac") returned 6 [0046.605] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.ape") returned 0 [0046.605] lstrlenA (lpString="*.ape") returned 5 [0046.605] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.wma") returned 0 [0046.605] lstrlenA (lpString="*.wma") returned 5 [0046.606] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.ac3") returned 0 [0046.606] lstrlenA (lpString="*.ac3") returned 5 [0046.606] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.mxf") returned 0 [0046.606] lstrlenA (lpString="*.mxf") returned 5 [0046.606] FindNextFileA (in: hFindFile=0x2d4d10, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0046.606] lstrcmpA (lpString1=".", lpString2="Config.Msi") returned -1 [0046.606] lstrcmpA (lpString1="..", lpString2="Config.Msi") returned -1 [0046.606] PathFindFileNameA (pszPath="C:\\BOOTSECT.BAK") returned="BOOTSECT.BAK" [0046.606] lstrcatA (in: lpString1="C:\\", lpString2="Config.Msi" | out: lpString1="C:\\Config.Msi") returned="C:\\Config.Msi" [0046.606] lstrlenA (lpString="C:\\Config.Msi") returned 13 [0046.606] FindFirstFileA (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18fb50, dwReserved1=0x2d5f0e, cFileName=".", cAlternateFileName="")) returned 0x2d5f08 [0046.607] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.607] FindNextFileA (in: hFindFile=0x2d5f08, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.607] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.607] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.607] FindNextFileA (in: hFindFile=0x2d5f08, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 0 [0046.607] FindClose (in: hFindFile=0x2d5f08 | out: hFindFile=0x2d5f08) returned 1 [0046.607] FindNextFileA (in: hFindFile=0x2d4d10, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x3, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0046.607] lstrcmpA (lpString1=".", lpString2="Documents and Settings") returned -1 [0046.607] lstrcmpA (lpString1="..", lpString2="Documents and Settings") returned -1 [0046.607] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0046.607] lstrcatA (in: lpString1="C:\\", lpString2="Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0046.607] lstrlenA (lpString="C:\\Documents and Settings") returned 25 [0046.607] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0046.621] FindNextFileA (in: hFindFile=0x2d4d10, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xae99ef60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x6f0044, dwReserved1=0x750063, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0046.621] PeekMessageA (in: lpMsg=0x18fe14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fe14) returned 0 [0046.621] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hiberfil.sys") returned -1 [0046.621] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hiberfil.sys") returned 1 [0046.621] lstrcmpiA (lpString1="", lpString2="hiberfil.sys") returned -1 [0046.621] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0046.621] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0046.621] PathAddBackslashA (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0046.621] lstrcatA (in: lpString1="C:\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\HOW TO DECRYPT FILES.txt") returned="C:\\HOW TO DECRYPT FILES.txt" [0046.622] GetFileAttributesA (lpFileName="C:\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\how to decrypt files.txt")) returned 0x20 [0046.622] lstrcatA (in: lpString1="C:\\", lpString2="hiberfil.sys" | out: lpString1="C:\\hiberfil.sys") returned="C:\\hiberfil.sys" [0046.622] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.zip") returned 0 [0046.622] lstrlenA (lpString="*.zip") returned 5 [0046.622] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.rar") returned 0 [0046.622] lstrlenA (lpString="*.rar") returned 5 [0046.622] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.7z") returned 0 [0046.622] lstrlenA (lpString="*.7z") returned 4 [0046.622] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.tar") returned 0 [0046.622] lstrlenA (lpString="*.tar") returned 5 [0046.622] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.gzip") returned 0 [0046.622] lstrlenA (lpString="*.gzip") returned 6 [0046.622] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.jpg") returned 0 [0046.622] lstrlenA (lpString="*.jpg") returned 5 [0046.622] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.jpeg") returned 0 [0046.622] lstrlenA (lpString="*.jpeg") returned 6 [0046.622] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.psd") returned 0 [0046.622] lstrlenA (lpString="*.psd") returned 5 [0046.622] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.gif") returned 0 [0046.622] lstrlenA (lpString="*.gif") returned 5 [0046.622] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.doc") returned 0 [0046.622] lstrlenA (lpString="*.doc") returned 5 [0046.622] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.docx") returned 0 [0046.623] lstrlenA (lpString="*.docx") returned 6 [0046.623] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.xls") returned 0 [0046.623] lstrlenA (lpString="*.xls") returned 5 [0046.623] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.xlsx") returned 0 [0046.623] lstrlenA (lpString="*.xlsx") returned 6 [0046.623] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.ppt") returned 0 [0046.623] lstrlenA (lpString="*.ppt") returned 5 [0046.623] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.pptx") returned 0 [0046.623] lstrlenA (lpString="*.pptx") returned 6 [0046.623] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.pdf") returned 0 [0046.623] lstrlenA (lpString="*.pdf") returned 5 [0046.623] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.mov") returned 0 [0046.623] lstrlenA (lpString="*.mov") returned 5 [0046.623] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.m2v") returned 0 [0046.623] lstrlenA (lpString="*.m2v") returned 5 [0046.623] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.3gp") returned 0 [0046.623] lstrlenA (lpString="*.3gp") returned 5 [0046.623] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.mpeg") returned 0 [0046.623] lstrlenA (lpString="*.mpeg") returned 6 [0046.623] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.mpg") returned 0 [0046.623] lstrlenA (lpString="*.mpg") returned 5 [0046.623] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.flv") returned 0 [0046.623] lstrlenA (lpString="*.flv") returned 5 [0046.623] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.avi") returned 0 [0046.624] lstrlenA (lpString="*.avi") returned 5 [0046.624] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.mp4") returned 0 [0046.624] lstrlenA (lpString="*.mp4") returned 5 [0046.624] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.wmv") returned 0 [0046.624] lstrlenA (lpString="*.wmv") returned 5 [0046.624] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.divx") returned 0 [0046.624] lstrlenA (lpString="*.divx") returned 6 [0046.624] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.mkv") returned 0 [0046.624] lstrlenA (lpString="*.mkv") returned 5 [0046.624] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.mp3") returned 0 [0046.624] lstrlenA (lpString="*.mp3") returned 5 [0046.624] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.wav") returned 0 [0046.624] lstrlenA (lpString="*.wav") returned 5 [0046.624] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.flac") returned 0 [0046.624] lstrlenA (lpString="*.flac") returned 6 [0046.624] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.ape") returned 0 [0046.624] lstrlenA (lpString="*.ape") returned 5 [0046.624] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.wma") returned 0 [0046.624] lstrlenA (lpString="*.wma") returned 5 [0046.624] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.ac3") returned 0 [0046.624] lstrlenA (lpString="*.ac3") returned 5 [0046.624] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.mxf") returned 0 [0046.624] lstrlenA (lpString="*.mxf") returned 5 [0046.624] FindNextFileA (in: hFindFile=0x2d4d10, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0046.625] lstrcmpA (lpString1=".", lpString2="MSOCache") returned -1 [0046.625] lstrcmpA (lpString1="..", lpString2="MSOCache") returned -1 [0046.625] PathFindFileNameA (pszPath="C:\\hiberfil.sys") returned="hiberfil.sys" [0046.625] lstrcatA (in: lpString1="C:\\", lpString2="MSOCache" | out: lpString1="C:\\MSOCache") returned="C:\\MSOCache" [0046.625] lstrlenA (lpString="C:\\MSOCache") returned 11 [0046.625] FindFirstFileA (in: lpFileName="C:\\MSOCache\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18fb50, dwReserved1=0x2d5f0e, cFileName=".", cAlternateFileName="")) returned 0x2d5ed8 [0046.625] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.625] FindNextFileA (in: hFindFile=0x2d5ed8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.625] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.625] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.625] FindNextFileA (in: hFindFile=0x2d5ed8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0046.626] lstrcmpA (lpString1=".", lpString2="All Users") returned -1 [0046.626] lstrcmpA (lpString1="..", lpString2="All Users") returned -1 [0046.626] PathFindFileNameA (pszPath="C:\\MSOCache\\*.*") returned="*.*" [0046.626] lstrcatA (in: lpString1="C:\\MSOCache\\", lpString2="All Users" | out: lpString1="C:\\MSOCache\\All Users") returned="C:\\MSOCache\\All Users" [0046.626] lstrlenA (lpString="C:\\MSOCache\\All Users") returned 21 [0046.626] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5f18, dwReserved1=0x2d5f13, cFileName=".", cAlternateFileName="")) returned 0x2d6f60 [0046.629] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.629] FindNextFileA (in: hFindFile=0x2d6f60, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.630] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.630] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.630] FindNextFileA (in: hFindFile=0x2d6f60, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0046.630] lstrcmpA (lpString1=".", lpString2="{90140000-0016-0409-1000-0000000FF1CE}-C") returned -1 [0046.630] lstrcmpA (lpString1="..", lpString2="{90140000-0016-0409-1000-0000000FF1CE}-C") returned -1 [0046.630] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0046.630] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0016-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C" [0046.630] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C") returned 62 [0046.630] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d6fa0, dwReserved1=0x2d6f9b, cFileName=".", cAlternateFileName="")) returned 0x2d6f20 [0046.631] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.631] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.631] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.632] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.632] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0046.632] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.632] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ExcelLR.cab") returned -1 [0046.632] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExcelLR.cab") returned 1 [0046.632] lstrcmpiA (lpString1="", lpString2="ExcelLR.cab") returned -1 [0046.632] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0046.632] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" [0046.632] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned="" [0046.632] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.632] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0046.632] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0046.636] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.636] WriteFile (in: hFile=0x88, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.637] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.637] CloseHandle (hObject=0x88) returned 1 [0046.638] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="ExcelLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" [0046.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.zip") returned 0 [0046.638] lstrlenA (lpString="*.zip") returned 5 [0046.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.rar") returned 0 [0046.638] lstrlenA (lpString="*.rar") returned 5 [0046.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.7z") returned 0 [0046.638] lstrlenA (lpString="*.7z") returned 4 [0046.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.tar") returned 0 [0046.638] lstrlenA (lpString="*.tar") returned 5 [0046.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.gzip") returned 0 [0046.638] lstrlenA (lpString="*.gzip") returned 6 [0046.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.jpg") returned 0 [0046.638] lstrlenA (lpString="*.jpg") returned 5 [0046.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.jpeg") returned 0 [0046.638] lstrlenA (lpString="*.jpeg") returned 6 [0046.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.psd") returned 0 [0046.638] lstrlenA (lpString="*.psd") returned 5 [0046.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.gif") returned 0 [0046.638] lstrlenA (lpString="*.gif") returned 5 [0046.638] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.doc") returned 0 [0046.638] lstrlenA (lpString="*.doc") returned 5 [0046.639] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.docx") returned 0 [0046.639] lstrlenA (lpString="*.docx") returned 6 [0046.639] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.xls") returned 0 [0046.639] lstrlenA (lpString="*.xls") returned 5 [0046.639] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.xlsx") returned 0 [0046.639] lstrlenA (lpString="*.xlsx") returned 6 [0046.639] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.ppt") returned 0 [0046.639] lstrlenA (lpString="*.ppt") returned 5 [0046.639] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.pptx") returned 0 [0046.639] lstrlenA (lpString="*.pptx") returned 6 [0046.639] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.pdf") returned 0 [0046.639] lstrlenA (lpString="*.pdf") returned 5 [0046.639] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.mov") returned 0 [0046.639] lstrlenA (lpString="*.mov") returned 5 [0046.639] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.m2v") returned 0 [0046.639] lstrlenA (lpString="*.m2v") returned 5 [0046.639] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.3gp") returned 0 [0046.639] lstrlenA (lpString="*.3gp") returned 5 [0046.639] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.mpeg") returned 0 [0046.640] lstrlenA (lpString="*.mpeg") returned 6 [0046.640] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.mpg") returned 0 [0046.640] lstrlenA (lpString="*.mpg") returned 5 [0046.640] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.flv") returned 0 [0046.640] lstrlenA (lpString="*.flv") returned 5 [0046.640] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.avi") returned 0 [0046.640] lstrlenA (lpString="*.avi") returned 5 [0046.640] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.mp4") returned 0 [0046.640] lstrlenA (lpString="*.mp4") returned 5 [0046.640] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.wmv") returned 0 [0046.640] lstrlenA (lpString="*.wmv") returned 5 [0046.640] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.divx") returned 0 [0046.640] lstrlenA (lpString="*.divx") returned 6 [0046.640] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.mkv") returned 0 [0046.640] lstrlenA (lpString="*.mkv") returned 5 [0046.640] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.mp3") returned 0 [0046.640] lstrlenA (lpString="*.mp3") returned 5 [0046.640] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.wav") returned 0 [0046.640] lstrlenA (lpString="*.wav") returned 5 [0046.640] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.flac") returned 0 [0046.640] lstrlenA (lpString="*.flac") returned 6 [0046.640] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.ape") returned 0 [0046.640] lstrlenA (lpString="*.ape") returned 5 [0046.640] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.wma") returned 0 [0046.640] lstrlenA (lpString="*.wma") returned 5 [0046.640] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.ac3") returned 0 [0046.640] lstrlenA (lpString="*.ac3") returned 5 [0046.640] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.mxf") returned 0 [0046.640] lstrlenA (lpString="*.mxf") returned 5 [0046.641] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x2d9290, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0046.641] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.641] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ExcelMUI.msi") returned -1 [0046.641] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExcelMUI.msi") returned 1 [0046.641] lstrcmpiA (lpString1="", lpString2="ExcelMUI.msi") returned -1 [0046.641] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned="ExcelLR.cab" [0046.641] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" [0046.641] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned="" [0046.641] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.641] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.641] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="ExcelMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" [0046.641] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.zip") returned 0 [0046.641] lstrlenA (lpString="*.zip") returned 5 [0046.641] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.rar") returned 0 [0046.641] lstrlenA (lpString="*.rar") returned 5 [0046.641] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.7z") returned 0 [0046.641] lstrlenA (lpString="*.7z") returned 4 [0046.641] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.tar") returned 0 [0046.641] lstrlenA (lpString="*.tar") returned 5 [0046.641] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.gzip") returned 0 [0046.641] lstrlenA (lpString="*.gzip") returned 6 [0046.642] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.jpg") returned 0 [0046.642] lstrlenA (lpString="*.jpg") returned 5 [0046.642] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.jpeg") returned 0 [0046.642] lstrlenA (lpString="*.jpeg") returned 6 [0046.642] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.psd") returned 0 [0046.642] lstrlenA (lpString="*.psd") returned 5 [0046.642] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.gif") returned 0 [0046.642] lstrlenA (lpString="*.gif") returned 5 [0046.642] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.doc") returned 0 [0046.642] lstrlenA (lpString="*.doc") returned 5 [0046.642] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.docx") returned 0 [0046.642] lstrlenA (lpString="*.docx") returned 6 [0046.642] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.xls") returned 0 [0046.642] lstrlenA (lpString="*.xls") returned 5 [0046.642] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.xlsx") returned 0 [0046.642] lstrlenA (lpString="*.xlsx") returned 6 [0046.642] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.ppt") returned 0 [0046.642] lstrlenA (lpString="*.ppt") returned 5 [0046.642] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.pptx") returned 0 [0046.642] lstrlenA (lpString="*.pptx") returned 6 [0046.642] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.pdf") returned 0 [0046.642] lstrlenA (lpString="*.pdf") returned 5 [0046.642] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.mov") returned 0 [0046.642] lstrlenA (lpString="*.mov") returned 5 [0046.642] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.m2v") returned 0 [0046.642] lstrlenA (lpString="*.m2v") returned 5 [0046.643] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.3gp") returned 0 [0046.643] lstrlenA (lpString="*.3gp") returned 5 [0046.643] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.mpeg") returned 0 [0046.643] lstrlenA (lpString="*.mpeg") returned 6 [0046.643] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.mpg") returned 0 [0046.643] lstrlenA (lpString="*.mpg") returned 5 [0046.643] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.flv") returned 0 [0046.643] lstrlenA (lpString="*.flv") returned 5 [0046.643] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.avi") returned 0 [0046.643] lstrlenA (lpString="*.avi") returned 5 [0046.643] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.mp4") returned 0 [0046.643] lstrlenA (lpString="*.mp4") returned 5 [0046.643] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.wmv") returned 0 [0046.643] lstrlenA (lpString="*.wmv") returned 5 [0046.643] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.divx") returned 0 [0046.643] lstrlenA (lpString="*.divx") returned 6 [0046.643] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.mkv") returned 0 [0046.643] lstrlenA (lpString="*.mkv") returned 5 [0046.643] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.mp3") returned 0 [0046.643] lstrlenA (lpString="*.mp3") returned 5 [0046.643] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.wav") returned 0 [0046.643] lstrlenA (lpString="*.wav") returned 5 [0046.643] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.flac") returned 0 [0046.643] lstrlenA (lpString="*.flac") returned 6 [0046.643] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.ape") returned 0 [0046.643] lstrlenA (lpString="*.ape") returned 5 [0046.643] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.wma") returned 0 [0046.644] lstrlenA (lpString="*.wma") returned 5 [0046.644] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.ac3") returned 0 [0046.644] lstrlenA (lpString="*.ac3") returned 5 [0046.644] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.mxf") returned 0 [0046.644] lstrlenA (lpString="*.mxf") returned 5 [0046.644] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x780074, dwReserved1=0x74, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0046.644] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.644] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ExcelMUI.xml") returned -1 [0046.644] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExcelMUI.xml") returned 1 [0046.644] lstrcmpiA (lpString1="", lpString2="ExcelMUI.xml") returned -1 [0046.644] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned="ExcelMUI.msi" [0046.644] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" [0046.644] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned="" [0046.644] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.644] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.644] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="ExcelMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" [0046.644] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.zip") returned 0 [0046.644] lstrlenA (lpString="*.zip") returned 5 [0046.644] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.rar") returned 0 [0046.644] lstrlenA (lpString="*.rar") returned 5 [0046.644] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.7z") returned 0 [0046.644] lstrlenA (lpString="*.7z") returned 4 [0046.644] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.tar") returned 0 [0046.645] lstrlenA (lpString="*.tar") returned 5 [0046.645] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.gzip") returned 0 [0046.645] lstrlenA (lpString="*.gzip") returned 6 [0046.645] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.jpg") returned 0 [0046.645] lstrlenA (lpString="*.jpg") returned 5 [0046.645] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.jpeg") returned 0 [0046.645] lstrlenA (lpString="*.jpeg") returned 6 [0046.645] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.psd") returned 0 [0046.645] lstrlenA (lpString="*.psd") returned 5 [0046.645] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.gif") returned 0 [0046.645] lstrlenA (lpString="*.gif") returned 5 [0046.645] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.doc") returned 0 [0046.645] lstrlenA (lpString="*.doc") returned 5 [0046.645] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.docx") returned 0 [0046.645] lstrlenA (lpString="*.docx") returned 6 [0046.645] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.xls") returned 0 [0046.645] lstrlenA (lpString="*.xls") returned 5 [0046.645] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.xlsx") returned 0 [0046.645] lstrlenA (lpString="*.xlsx") returned 6 [0046.645] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.ppt") returned 0 [0046.645] lstrlenA (lpString="*.ppt") returned 5 [0046.645] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.pptx") returned 0 [0046.645] lstrlenA (lpString="*.pptx") returned 6 [0046.645] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.pdf") returned 0 [0046.645] lstrlenA (lpString="*.pdf") returned 5 [0046.645] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.mov") returned 0 [0046.645] lstrlenA (lpString="*.mov") returned 5 [0046.646] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.m2v") returned 0 [0046.646] lstrlenA (lpString="*.m2v") returned 5 [0046.646] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.3gp") returned 0 [0046.646] lstrlenA (lpString="*.3gp") returned 5 [0046.646] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.mpeg") returned 0 [0046.646] lstrlenA (lpString="*.mpeg") returned 6 [0046.646] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.mpg") returned 0 [0046.646] lstrlenA (lpString="*.mpg") returned 5 [0046.646] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.flv") returned 0 [0046.646] lstrlenA (lpString="*.flv") returned 5 [0046.646] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.avi") returned 0 [0046.646] lstrlenA (lpString="*.avi") returned 5 [0046.646] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.mp4") returned 0 [0046.646] lstrlenA (lpString="*.mp4") returned 5 [0046.646] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.wmv") returned 0 [0046.646] lstrlenA (lpString="*.wmv") returned 5 [0046.646] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.divx") returned 0 [0046.646] lstrlenA (lpString="*.divx") returned 6 [0046.646] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.mkv") returned 0 [0046.646] lstrlenA (lpString="*.mkv") returned 5 [0046.646] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.mp3") returned 0 [0046.646] lstrlenA (lpString="*.mp3") returned 5 [0046.646] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.wav") returned 0 [0046.646] lstrlenA (lpString="*.wav") returned 5 [0046.646] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.flac") returned 0 [0046.646] lstrlenA (lpString="*.flac") returned 6 [0046.646] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.ape") returned 0 [0046.647] lstrlenA (lpString="*.ape") returned 5 [0046.647] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.wma") returned 0 [0046.647] lstrlenA (lpString="*.wma") returned 5 [0046.647] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.ac3") returned 0 [0046.647] lstrlenA (lpString="*.ac3") returned 5 [0046.647] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.mxf") returned 0 [0046.647] lstrlenA (lpString="*.mxf") returned 5 [0046.647] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0046.647] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.647] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0046.647] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0046.647] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0046.647] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned="ExcelMUI.xml" [0046.647] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" [0046.647] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned="" [0046.647] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.647] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.647] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" [0046.647] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.zip") returned 0 [0046.647] lstrlenA (lpString="*.zip") returned 5 [0046.647] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.rar") returned 0 [0046.647] lstrlenA (lpString="*.rar") returned 5 [0046.647] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.7z") returned 0 [0046.648] lstrlenA (lpString="*.7z") returned 4 [0046.648] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tar") returned 0 [0046.648] lstrlenA (lpString="*.tar") returned 5 [0046.648] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gzip") returned 0 [0046.648] lstrlenA (lpString="*.gzip") returned 6 [0046.648] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpg") returned 0 [0046.648] lstrlenA (lpString="*.jpg") returned 5 [0046.648] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpeg") returned 0 [0046.648] lstrlenA (lpString="*.jpeg") returned 6 [0046.648] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.psd") returned 0 [0046.648] lstrlenA (lpString="*.psd") returned 5 [0046.648] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gif") returned 0 [0046.648] lstrlenA (lpString="*.gif") returned 5 [0046.648] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.doc") returned 0 [0046.648] lstrlenA (lpString="*.doc") returned 5 [0046.648] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docx") returned 0 [0046.648] lstrlenA (lpString="*.docx") returned 6 [0046.648] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xls") returned 0 [0046.648] lstrlenA (lpString="*.xls") returned 5 [0046.648] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsx") returned 0 [0046.649] lstrlenA (lpString="*.xlsx") returned 6 [0046.649] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ppt") returned 0 [0046.649] lstrlenA (lpString="*.ppt") returned 5 [0046.649] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pptx") returned 0 [0046.649] lstrlenA (lpString="*.pptx") returned 6 [0046.649] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pdf") returned 0 [0046.649] lstrlenA (lpString="*.pdf") returned 5 [0046.649] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mov") returned 0 [0046.649] lstrlenA (lpString="*.mov") returned 5 [0046.649] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.m2v") returned 0 [0046.649] lstrlenA (lpString="*.m2v") returned 5 [0046.649] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.3gp") returned 0 [0046.649] lstrlenA (lpString="*.3gp") returned 5 [0046.649] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpeg") returned 0 [0046.649] lstrlenA (lpString="*.mpeg") returned 6 [0046.649] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpg") returned 0 [0046.649] lstrlenA (lpString="*.mpg") returned 5 [0046.649] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flv") returned 0 [0046.649] lstrlenA (lpString="*.flv") returned 5 [0046.649] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.avi") returned 0 [0046.649] lstrlenA (lpString="*.avi") returned 5 [0046.649] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp4") returned 0 [0046.649] lstrlenA (lpString="*.mp4") returned 5 [0046.649] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wmv") returned 0 [0046.649] lstrlenA (lpString="*.wmv") returned 5 [0046.649] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.divx") returned 0 [0046.650] lstrlenA (lpString="*.divx") returned 6 [0046.650] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mkv") returned 0 [0046.650] lstrlenA (lpString="*.mkv") returned 5 [0046.650] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp3") returned 0 [0046.650] lstrlenA (lpString="*.mp3") returned 5 [0046.650] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wav") returned 0 [0046.650] lstrlenA (lpString="*.wav") returned 5 [0046.650] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flac") returned 0 [0046.650] lstrlenA (lpString="*.flac") returned 6 [0046.650] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ape") returned 0 [0046.650] lstrlenA (lpString="*.ape") returned 5 [0046.650] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wma") returned 0 [0046.650] lstrlenA (lpString="*.wma") returned 5 [0046.650] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ac3") returned 0 [0046.650] lstrlenA (lpString="*.ac3") returned 5 [0046.650] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mxf") returned 0 [0046.650] lstrlenA (lpString="*.mxf") returned 5 [0046.650] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0046.650] FindClose (in: hFindFile=0x2d6f20 | out: hFindFile=0x2d6f20) returned 1 [0046.650] FindNextFileA (in: hFindFile=0x2d6f60, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0046.650] lstrcmpA (lpString1=".", lpString2="{90140000-0018-0409-1000-0000000FF1CE}-C") returned -1 [0046.650] lstrcmpA (lpString1="..", lpString2="{90140000-0018-0409-1000-0000000FF1CE}-C") returned -1 [0046.650] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0046.651] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0018-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C" [0046.651] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C") returned 62 [0046.651] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2d6f20 [0046.724] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.724] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.724] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.724] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.724] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0046.724] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.724] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PowerPointMUI.msi") returned -1 [0046.724] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PowerPointMUI.msi") returned -1 [0046.725] lstrcmpiA (lpString1="", lpString2="PowerPointMUI.msi") returned -1 [0046.725] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0046.725] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" [0046.725] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned="" [0046.725] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.725] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0046.725] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0046.725] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.725] WriteFile (in: hFile=0x88, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.727] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.727] CloseHandle (hObject=0x88) returned 1 [0046.727] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="PowerPointMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" [0046.727] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.zip") returned 0 [0046.727] lstrlenA (lpString="*.zip") returned 5 [0046.727] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.rar") returned 0 [0046.728] lstrlenA (lpString="*.rar") returned 5 [0046.728] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.7z") returned 0 [0046.728] lstrlenA (lpString="*.7z") returned 4 [0046.728] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.tar") returned 0 [0046.728] lstrlenA (lpString="*.tar") returned 5 [0046.728] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.gzip") returned 0 [0046.728] lstrlenA (lpString="*.gzip") returned 6 [0046.728] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.jpg") returned 0 [0046.728] lstrlenA (lpString="*.jpg") returned 5 [0046.728] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.jpeg") returned 0 [0046.728] lstrlenA (lpString="*.jpeg") returned 6 [0046.728] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.psd") returned 0 [0046.728] lstrlenA (lpString="*.psd") returned 5 [0046.728] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.gif") returned 0 [0046.728] lstrlenA (lpString="*.gif") returned 5 [0046.728] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.doc") returned 0 [0046.728] lstrlenA (lpString="*.doc") returned 5 [0046.728] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.docx") returned 0 [0046.728] lstrlenA (lpString="*.docx") returned 6 [0046.728] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.xls") returned 0 [0046.728] lstrlenA (lpString="*.xls") returned 5 [0046.728] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.xlsx") returned 0 [0046.728] lstrlenA (lpString="*.xlsx") returned 6 [0046.728] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.ppt") returned 0 [0046.728] lstrlenA (lpString="*.ppt") returned 5 [0046.728] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.pptx") returned 0 [0046.728] lstrlenA (lpString="*.pptx") returned 6 [0046.728] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.pdf") returned 0 [0046.729] lstrlenA (lpString="*.pdf") returned 5 [0046.729] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mov") returned 0 [0046.729] lstrlenA (lpString="*.mov") returned 5 [0046.729] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.m2v") returned 0 [0046.729] lstrlenA (lpString="*.m2v") returned 5 [0046.729] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.3gp") returned 0 [0046.729] lstrlenA (lpString="*.3gp") returned 5 [0046.729] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mpeg") returned 0 [0046.729] lstrlenA (lpString="*.mpeg") returned 6 [0046.729] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mpg") returned 0 [0046.729] lstrlenA (lpString="*.mpg") returned 5 [0046.729] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.flv") returned 0 [0046.729] lstrlenA (lpString="*.flv") returned 5 [0046.729] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.avi") returned 0 [0046.729] lstrlenA (lpString="*.avi") returned 5 [0046.729] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mp4") returned 0 [0046.729] lstrlenA (lpString="*.mp4") returned 5 [0046.729] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.wmv") returned 0 [0046.729] lstrlenA (lpString="*.wmv") returned 5 [0046.729] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.divx") returned 0 [0046.729] lstrlenA (lpString="*.divx") returned 6 [0046.729] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mkv") returned 0 [0046.729] lstrlenA (lpString="*.mkv") returned 5 [0046.729] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mp3") returned 0 [0046.729] lstrlenA (lpString="*.mp3") returned 5 [0046.729] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.wav") returned 0 [0046.729] lstrlenA (lpString="*.wav") returned 5 [0046.729] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.flac") returned 0 [0046.730] lstrlenA (lpString="*.flac") returned 6 [0046.730] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.ape") returned 0 [0046.730] lstrlenA (lpString="*.ape") returned 5 [0046.730] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.wma") returned 0 [0046.730] lstrlenA (lpString="*.wma") returned 5 [0046.730] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.ac3") returned 0 [0046.730] lstrlenA (lpString="*.ac3") returned 5 [0046.730] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mxf") returned 0 [0046.730] lstrlenA (lpString="*.mxf") returned 5 [0046.730] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x2d9290, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0046.730] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.730] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PowerPointMUI.xml") returned -1 [0046.730] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PowerPointMUI.xml") returned -1 [0046.730] lstrcmpiA (lpString1="", lpString2="PowerPointMUI.xml") returned -1 [0046.730] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned="PowerPointMUI.msi" [0046.730] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" [0046.730] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned="" [0046.730] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.730] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.730] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="PowerPointMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" [0046.730] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.zip") returned 0 [0046.730] lstrlenA (lpString="*.zip") returned 5 [0046.731] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.rar") returned 0 [0046.731] lstrlenA (lpString="*.rar") returned 5 [0046.731] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.7z") returned 0 [0046.731] lstrlenA (lpString="*.7z") returned 4 [0046.731] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.tar") returned 0 [0046.731] lstrlenA (lpString="*.tar") returned 5 [0046.731] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.gzip") returned 0 [0046.731] lstrlenA (lpString="*.gzip") returned 6 [0046.731] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.jpg") returned 0 [0046.731] lstrlenA (lpString="*.jpg") returned 5 [0046.731] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.jpeg") returned 0 [0046.731] lstrlenA (lpString="*.jpeg") returned 6 [0046.731] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.psd") returned 0 [0046.731] lstrlenA (lpString="*.psd") returned 5 [0046.731] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.gif") returned 0 [0046.731] lstrlenA (lpString="*.gif") returned 5 [0046.731] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.doc") returned 0 [0046.731] lstrlenA (lpString="*.doc") returned 5 [0046.731] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.docx") returned 0 [0046.731] lstrlenA (lpString="*.docx") returned 6 [0046.731] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.xls") returned 0 [0046.731] lstrlenA (lpString="*.xls") returned 5 [0046.731] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.xlsx") returned 0 [0046.731] lstrlenA (lpString="*.xlsx") returned 6 [0046.731] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.ppt") returned 0 [0046.731] lstrlenA (lpString="*.ppt") returned 5 [0046.731] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.pptx") returned 0 [0046.731] lstrlenA (lpString="*.pptx") returned 6 [0046.732] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.pdf") returned 0 [0046.732] lstrlenA (lpString="*.pdf") returned 5 [0046.732] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mov") returned 0 [0046.732] lstrlenA (lpString="*.mov") returned 5 [0046.732] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.m2v") returned 0 [0046.732] lstrlenA (lpString="*.m2v") returned 5 [0046.732] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.3gp") returned 0 [0046.732] lstrlenA (lpString="*.3gp") returned 5 [0046.732] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mpeg") returned 0 [0046.732] lstrlenA (lpString="*.mpeg") returned 6 [0046.732] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mpg") returned 0 [0046.732] lstrlenA (lpString="*.mpg") returned 5 [0046.732] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.flv") returned 0 [0046.732] lstrlenA (lpString="*.flv") returned 5 [0046.732] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.avi") returned 0 [0046.732] lstrlenA (lpString="*.avi") returned 5 [0046.732] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mp4") returned 0 [0046.733] lstrlenA (lpString="*.mp4") returned 5 [0046.733] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.wmv") returned 0 [0046.733] lstrlenA (lpString="*.wmv") returned 5 [0046.733] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.divx") returned 0 [0046.733] lstrlenA (lpString="*.divx") returned 6 [0046.733] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mkv") returned 0 [0046.733] lstrlenA (lpString="*.mkv") returned 5 [0046.733] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mp3") returned 0 [0046.733] lstrlenA (lpString="*.mp3") returned 5 [0046.733] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.wav") returned 0 [0046.733] lstrlenA (lpString="*.wav") returned 5 [0046.733] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.flac") returned 0 [0046.733] lstrlenA (lpString="*.flac") returned 6 [0046.733] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.ape") returned 0 [0046.733] lstrlenA (lpString="*.ape") returned 5 [0046.733] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.wma") returned 0 [0046.733] lstrlenA (lpString="*.wma") returned 5 [0046.733] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.ac3") returned 0 [0046.733] lstrlenA (lpString="*.ac3") returned 5 [0046.733] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mxf") returned 0 [0046.733] lstrlenA (lpString="*.mxf") returned 5 [0046.733] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0046.733] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.733] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PptLR.cab") returned -1 [0046.733] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PptLR.cab") returned -1 [0046.734] lstrcmpiA (lpString1="", lpString2="PptLR.cab") returned -1 [0046.734] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned="PowerPointMUI.xml" [0046.734] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" [0046.734] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned="" [0046.734] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.734] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.734] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="PptLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" [0046.734] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.zip") returned 0 [0046.734] lstrlenA (lpString="*.zip") returned 5 [0046.734] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.rar") returned 0 [0046.734] lstrlenA (lpString="*.rar") returned 5 [0046.734] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.7z") returned 0 [0046.734] lstrlenA (lpString="*.7z") returned 4 [0046.734] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.tar") returned 0 [0046.734] lstrlenA (lpString="*.tar") returned 5 [0046.734] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.gzip") returned 0 [0046.734] lstrlenA (lpString="*.gzip") returned 6 [0046.734] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.jpg") returned 0 [0046.734] lstrlenA (lpString="*.jpg") returned 5 [0046.734] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.jpeg") returned 0 [0046.734] lstrlenA (lpString="*.jpeg") returned 6 [0046.734] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.psd") returned 0 [0046.734] lstrlenA (lpString="*.psd") returned 5 [0046.734] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.gif") returned 0 [0046.735] lstrlenA (lpString="*.gif") returned 5 [0046.735] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.doc") returned 0 [0046.735] lstrlenA (lpString="*.doc") returned 5 [0046.735] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.docx") returned 0 [0046.735] lstrlenA (lpString="*.docx") returned 6 [0046.735] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.xls") returned 0 [0046.735] lstrlenA (lpString="*.xls") returned 5 [0046.735] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.xlsx") returned 0 [0046.735] lstrlenA (lpString="*.xlsx") returned 6 [0046.735] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.ppt") returned 0 [0046.735] lstrlenA (lpString="*.ppt") returned 5 [0046.735] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.pptx") returned 0 [0046.735] lstrlenA (lpString="*.pptx") returned 6 [0046.735] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.pdf") returned 0 [0046.735] lstrlenA (lpString="*.pdf") returned 5 [0046.735] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.mov") returned 0 [0046.735] lstrlenA (lpString="*.mov") returned 5 [0046.735] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.m2v") returned 0 [0046.735] lstrlenA (lpString="*.m2v") returned 5 [0046.735] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.3gp") returned 0 [0046.735] lstrlenA (lpString="*.3gp") returned 5 [0046.735] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.mpeg") returned 0 [0046.735] lstrlenA (lpString="*.mpeg") returned 6 [0046.735] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.mpg") returned 0 [0046.735] lstrlenA (lpString="*.mpg") returned 5 [0046.735] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.flv") returned 0 [0046.735] lstrlenA (lpString="*.flv") returned 5 [0046.735] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.avi") returned 0 [0046.736] lstrlenA (lpString="*.avi") returned 5 [0046.736] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.mp4") returned 0 [0046.736] lstrlenA (lpString="*.mp4") returned 5 [0046.736] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.wmv") returned 0 [0046.736] lstrlenA (lpString="*.wmv") returned 5 [0046.736] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.divx") returned 0 [0046.736] lstrlenA (lpString="*.divx") returned 6 [0046.736] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.mkv") returned 0 [0046.736] lstrlenA (lpString="*.mkv") returned 5 [0046.736] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.mp3") returned 0 [0046.736] lstrlenA (lpString="*.mp3") returned 5 [0046.736] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.wav") returned 0 [0046.736] lstrlenA (lpString="*.wav") returned 5 [0046.736] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.flac") returned 0 [0046.736] lstrlenA (lpString="*.flac") returned 6 [0046.736] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.ape") returned 0 [0046.736] lstrlenA (lpString="*.ape") returned 5 [0046.736] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.wma") returned 0 [0046.736] lstrlenA (lpString="*.wma") returned 5 [0046.736] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.ac3") returned 0 [0046.736] lstrlenA (lpString="*.ac3") returned 5 [0046.736] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.mxf") returned 0 [0046.736] lstrlenA (lpString="*.mxf") returned 5 [0046.736] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0046.736] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.736] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0046.736] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0046.737] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0046.737] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned="PptLR.cab" [0046.737] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" [0046.737] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned="" [0046.737] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.737] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.737] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" [0046.737] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.zip") returned 0 [0046.737] lstrlenA (lpString="*.zip") returned 5 [0046.737] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.rar") returned 0 [0046.737] lstrlenA (lpString="*.rar") returned 5 [0046.737] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.7z") returned 0 [0046.737] lstrlenA (lpString="*.7z") returned 4 [0046.737] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tar") returned 0 [0046.737] lstrlenA (lpString="*.tar") returned 5 [0046.737] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gzip") returned 0 [0046.737] lstrlenA (lpString="*.gzip") returned 6 [0046.737] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpg") returned 0 [0046.737] lstrlenA (lpString="*.jpg") returned 5 [0046.737] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpeg") returned 0 [0046.737] lstrlenA (lpString="*.jpeg") returned 6 [0046.737] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.psd") returned 0 [0046.737] lstrlenA (lpString="*.psd") returned 5 [0046.737] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gif") returned 0 [0046.738] lstrlenA (lpString="*.gif") returned 5 [0046.738] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.doc") returned 0 [0046.738] lstrlenA (lpString="*.doc") returned 5 [0046.738] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docx") returned 0 [0046.738] lstrlenA (lpString="*.docx") returned 6 [0046.738] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xls") returned 0 [0046.738] lstrlenA (lpString="*.xls") returned 5 [0046.738] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsx") returned 0 [0046.738] lstrlenA (lpString="*.xlsx") returned 6 [0046.738] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ppt") returned 0 [0046.738] lstrlenA (lpString="*.ppt") returned 5 [0046.738] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pptx") returned 0 [0046.738] lstrlenA (lpString="*.pptx") returned 6 [0046.738] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pdf") returned 0 [0046.738] lstrlenA (lpString="*.pdf") returned 5 [0046.738] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mov") returned 0 [0046.738] lstrlenA (lpString="*.mov") returned 5 [0046.738] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.m2v") returned 0 [0046.738] lstrlenA (lpString="*.m2v") returned 5 [0046.738] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.3gp") returned 0 [0046.738] lstrlenA (lpString="*.3gp") returned 5 [0046.738] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpeg") returned 0 [0046.738] lstrlenA (lpString="*.mpeg") returned 6 [0046.738] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpg") returned 0 [0046.738] lstrlenA (lpString="*.mpg") returned 5 [0046.738] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flv") returned 0 [0046.738] lstrlenA (lpString="*.flv") returned 5 [0046.738] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.avi") returned 0 [0046.739] lstrlenA (lpString="*.avi") returned 5 [0046.739] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp4") returned 0 [0046.739] lstrlenA (lpString="*.mp4") returned 5 [0046.739] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wmv") returned 0 [0046.739] lstrlenA (lpString="*.wmv") returned 5 [0046.739] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.divx") returned 0 [0046.739] lstrlenA (lpString="*.divx") returned 6 [0046.739] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mkv") returned 0 [0046.739] lstrlenA (lpString="*.mkv") returned 5 [0046.739] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp3") returned 0 [0046.739] lstrlenA (lpString="*.mp3") returned 5 [0046.739] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wav") returned 0 [0046.739] lstrlenA (lpString="*.wav") returned 5 [0046.739] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flac") returned 0 [0046.739] lstrlenA (lpString="*.flac") returned 6 [0046.739] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ape") returned 0 [0046.739] lstrlenA (lpString="*.ape") returned 5 [0046.739] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wma") returned 0 [0046.739] lstrlenA (lpString="*.wma") returned 5 [0046.739] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ac3") returned 0 [0046.739] lstrlenA (lpString="*.ac3") returned 5 [0046.739] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mxf") returned 0 [0046.739] lstrlenA (lpString="*.mxf") returned 5 [0046.739] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0046.739] FindClose (in: hFindFile=0x2d6f20 | out: hFindFile=0x2d6f20) returned 1 [0046.740] FindNextFileA (in: hFindFile=0x2d6f60, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0046.740] lstrcmpA (lpString1=".", lpString2="{90140000-0019-0409-1000-0000000FF1CE}-C") returned -1 [0046.740] lstrcmpA (lpString1="..", lpString2="{90140000-0019-0409-1000-0000000FF1CE}-C") returned -1 [0046.740] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0046.740] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0019-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C" [0046.740] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C") returned 62 [0046.740] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2d6f20 [0046.744] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.744] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.744] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.744] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.744] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0046.744] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.744] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PublisherMUI.msi") returned -1 [0046.744] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PublisherMUI.msi") returned -1 [0046.744] lstrcmpiA (lpString1="", lpString2="PublisherMUI.msi") returned -1 [0046.744] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0046.744] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" [0046.744] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned="" [0046.744] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.744] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0046.744] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0046.745] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.745] WriteFile (in: hFile=0x88, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.746] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.746] CloseHandle (hObject=0x88) returned 1 [0046.746] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="PublisherMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" [0046.746] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.zip") returned 0 [0046.746] lstrlenA (lpString="*.zip") returned 5 [0046.746] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.rar") returned 0 [0046.747] lstrlenA (lpString="*.rar") returned 5 [0046.747] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.7z") returned 0 [0046.747] lstrlenA (lpString="*.7z") returned 4 [0046.747] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.tar") returned 0 [0046.747] lstrlenA (lpString="*.tar") returned 5 [0046.747] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.gzip") returned 0 [0046.747] lstrlenA (lpString="*.gzip") returned 6 [0046.747] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.jpg") returned 0 [0046.747] lstrlenA (lpString="*.jpg") returned 5 [0046.747] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.jpeg") returned 0 [0046.747] lstrlenA (lpString="*.jpeg") returned 6 [0046.747] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.psd") returned 0 [0046.747] lstrlenA (lpString="*.psd") returned 5 [0046.747] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.gif") returned 0 [0046.747] lstrlenA (lpString="*.gif") returned 5 [0046.747] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.doc") returned 0 [0046.747] lstrlenA (lpString="*.doc") returned 5 [0046.747] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.docx") returned 0 [0046.747] lstrlenA (lpString="*.docx") returned 6 [0046.747] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.xls") returned 0 [0046.747] lstrlenA (lpString="*.xls") returned 5 [0046.747] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.xlsx") returned 0 [0046.747] lstrlenA (lpString="*.xlsx") returned 6 [0046.747] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.ppt") returned 0 [0046.747] lstrlenA (lpString="*.ppt") returned 5 [0046.747] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.pptx") returned 0 [0046.747] lstrlenA (lpString="*.pptx") returned 6 [0046.747] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.pdf") returned 0 [0046.747] lstrlenA (lpString="*.pdf") returned 5 [0046.748] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.mov") returned 0 [0046.748] lstrlenA (lpString="*.mov") returned 5 [0046.748] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.m2v") returned 0 [0046.748] lstrlenA (lpString="*.m2v") returned 5 [0046.748] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.3gp") returned 0 [0046.748] lstrlenA (lpString="*.3gp") returned 5 [0046.748] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.mpeg") returned 0 [0046.748] lstrlenA (lpString="*.mpeg") returned 6 [0046.748] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.mpg") returned 0 [0046.748] lstrlenA (lpString="*.mpg") returned 5 [0046.748] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.flv") returned 0 [0046.748] lstrlenA (lpString="*.flv") returned 5 [0046.748] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.avi") returned 0 [0046.748] lstrlenA (lpString="*.avi") returned 5 [0046.748] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.mp4") returned 0 [0046.749] lstrlenA (lpString="*.mp4") returned 5 [0046.749] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.wmv") returned 0 [0046.749] lstrlenA (lpString="*.wmv") returned 5 [0046.749] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.divx") returned 0 [0046.749] lstrlenA (lpString="*.divx") returned 6 [0046.749] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.mkv") returned 0 [0046.749] lstrlenA (lpString="*.mkv") returned 5 [0046.749] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.mp3") returned 0 [0046.749] lstrlenA (lpString="*.mp3") returned 5 [0046.749] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.wav") returned 0 [0046.749] lstrlenA (lpString="*.wav") returned 5 [0046.749] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.flac") returned 0 [0046.749] lstrlenA (lpString="*.flac") returned 6 [0046.749] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.ape") returned 0 [0046.749] lstrlenA (lpString="*.ape") returned 5 [0046.749] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.wma") returned 0 [0046.749] lstrlenA (lpString="*.wma") returned 5 [0046.749] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.ac3") returned 0 [0046.749] lstrlenA (lpString="*.ac3") returned 5 [0046.749] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.mxf") returned 0 [0046.749] lstrlenA (lpString="*.mxf") returned 5 [0046.749] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x2d9290, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0046.749] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.749] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PublisherMUI.xml") returned -1 [0046.749] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PublisherMUI.xml") returned -1 [0046.749] lstrcmpiA (lpString1="", lpString2="PublisherMUI.xml") returned -1 [0046.749] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned="PublisherMUI.msi" [0046.750] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" [0046.750] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned="" [0046.750] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.750] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.750] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="PublisherMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" [0046.750] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.zip") returned 0 [0046.750] lstrlenA (lpString="*.zip") returned 5 [0046.750] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.rar") returned 0 [0046.750] lstrlenA (lpString="*.rar") returned 5 [0046.750] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.7z") returned 0 [0046.750] lstrlenA (lpString="*.7z") returned 4 [0046.750] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.tar") returned 0 [0046.750] lstrlenA (lpString="*.tar") returned 5 [0046.750] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.gzip") returned 0 [0046.750] lstrlenA (lpString="*.gzip") returned 6 [0046.750] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.jpg") returned 0 [0046.750] lstrlenA (lpString="*.jpg") returned 5 [0046.750] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.jpeg") returned 0 [0046.750] lstrlenA (lpString="*.jpeg") returned 6 [0046.750] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.psd") returned 0 [0046.750] lstrlenA (lpString="*.psd") returned 5 [0046.750] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.gif") returned 0 [0046.750] lstrlenA (lpString="*.gif") returned 5 [0046.751] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.doc") returned 0 [0046.751] lstrlenA (lpString="*.doc") returned 5 [0046.751] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.docx") returned 0 [0046.751] lstrlenA (lpString="*.docx") returned 6 [0046.751] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.xls") returned 0 [0046.751] lstrlenA (lpString="*.xls") returned 5 [0046.751] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.xlsx") returned 0 [0046.751] lstrlenA (lpString="*.xlsx") returned 6 [0046.751] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.ppt") returned 0 [0046.751] lstrlenA (lpString="*.ppt") returned 5 [0046.751] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.pptx") returned 0 [0046.751] lstrlenA (lpString="*.pptx") returned 6 [0046.751] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.pdf") returned 0 [0046.751] lstrlenA (lpString="*.pdf") returned 5 [0046.751] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.mov") returned 0 [0046.751] lstrlenA (lpString="*.mov") returned 5 [0046.751] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.m2v") returned 0 [0046.751] lstrlenA (lpString="*.m2v") returned 5 [0046.751] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.3gp") returned 0 [0046.751] lstrlenA (lpString="*.3gp") returned 5 [0046.751] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.mpeg") returned 0 [0046.751] lstrlenA (lpString="*.mpeg") returned 6 [0046.751] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.mpg") returned 0 [0046.751] lstrlenA (lpString="*.mpg") returned 5 [0046.751] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.flv") returned 0 [0046.751] lstrlenA (lpString="*.flv") returned 5 [0046.751] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.avi") returned 0 [0046.752] lstrlenA (lpString="*.avi") returned 5 [0046.752] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.mp4") returned 0 [0046.752] lstrlenA (lpString="*.mp4") returned 5 [0046.752] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.wmv") returned 0 [0046.752] lstrlenA (lpString="*.wmv") returned 5 [0046.752] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.divx") returned 0 [0046.752] lstrlenA (lpString="*.divx") returned 6 [0046.752] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.mkv") returned 0 [0046.752] lstrlenA (lpString="*.mkv") returned 5 [0046.752] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.mp3") returned 0 [0046.752] lstrlenA (lpString="*.mp3") returned 5 [0046.752] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.wav") returned 0 [0046.752] lstrlenA (lpString="*.wav") returned 5 [0046.752] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.flac") returned 0 [0046.752] lstrlenA (lpString="*.flac") returned 6 [0046.752] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.ape") returned 0 [0046.752] lstrlenA (lpString="*.ape") returned 5 [0046.752] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.wma") returned 0 [0046.752] lstrlenA (lpString="*.wma") returned 5 [0046.752] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.ac3") returned 0 [0046.752] lstrlenA (lpString="*.ac3") returned 5 [0046.752] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", pszSpec="*.mxf") returned 0 [0046.752] lstrlenA (lpString="*.mxf") returned 5 [0046.752] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0046.752] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.752] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PubLR.cab") returned -1 [0046.752] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PubLR.cab") returned -1 [0046.753] lstrcmpiA (lpString1="", lpString2="PubLR.cab") returned -1 [0046.753] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned="PublisherMUI.xml" [0046.753] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" [0046.753] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned="" [0046.753] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.753] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.753] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="PubLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" [0046.753] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.zip") returned 0 [0046.753] lstrlenA (lpString="*.zip") returned 5 [0046.753] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.rar") returned 0 [0046.753] lstrlenA (lpString="*.rar") returned 5 [0046.753] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.7z") returned 0 [0046.753] lstrlenA (lpString="*.7z") returned 4 [0046.753] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.tar") returned 0 [0046.753] lstrlenA (lpString="*.tar") returned 5 [0046.753] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.gzip") returned 0 [0046.753] lstrlenA (lpString="*.gzip") returned 6 [0046.753] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.jpg") returned 0 [0046.753] lstrlenA (lpString="*.jpg") returned 5 [0046.753] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.jpeg") returned 0 [0046.753] lstrlenA (lpString="*.jpeg") returned 6 [0046.753] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.psd") returned 0 [0046.753] lstrlenA (lpString="*.psd") returned 5 [0046.753] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.gif") returned 0 [0046.754] lstrlenA (lpString="*.gif") returned 5 [0046.754] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.doc") returned 0 [0046.754] lstrlenA (lpString="*.doc") returned 5 [0046.754] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.docx") returned 0 [0046.754] lstrlenA (lpString="*.docx") returned 6 [0046.754] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.xls") returned 0 [0046.754] lstrlenA (lpString="*.xls") returned 5 [0046.754] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.xlsx") returned 0 [0046.754] lstrlenA (lpString="*.xlsx") returned 6 [0046.754] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.ppt") returned 0 [0046.754] lstrlenA (lpString="*.ppt") returned 5 [0046.754] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.pptx") returned 0 [0046.754] lstrlenA (lpString="*.pptx") returned 6 [0046.754] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.pdf") returned 0 [0046.754] lstrlenA (lpString="*.pdf") returned 5 [0046.754] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.mov") returned 0 [0046.754] lstrlenA (lpString="*.mov") returned 5 [0046.754] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.m2v") returned 0 [0046.754] lstrlenA (lpString="*.m2v") returned 5 [0046.754] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.3gp") returned 0 [0046.754] lstrlenA (lpString="*.3gp") returned 5 [0046.754] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.mpeg") returned 0 [0046.754] lstrlenA (lpString="*.mpeg") returned 6 [0046.754] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.mpg") returned 0 [0046.754] lstrlenA (lpString="*.mpg") returned 5 [0046.754] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.flv") returned 0 [0046.755] lstrlenA (lpString="*.flv") returned 5 [0046.755] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.avi") returned 0 [0046.755] lstrlenA (lpString="*.avi") returned 5 [0046.755] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.mp4") returned 0 [0046.755] lstrlenA (lpString="*.mp4") returned 5 [0046.755] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.wmv") returned 0 [0046.755] lstrlenA (lpString="*.wmv") returned 5 [0046.755] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.divx") returned 0 [0046.755] lstrlenA (lpString="*.divx") returned 6 [0046.755] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.mkv") returned 0 [0046.755] lstrlenA (lpString="*.mkv") returned 5 [0046.755] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.mp3") returned 0 [0046.755] lstrlenA (lpString="*.mp3") returned 5 [0046.755] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.wav") returned 0 [0046.755] lstrlenA (lpString="*.wav") returned 5 [0046.755] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.flac") returned 0 [0046.755] lstrlenA (lpString="*.flac") returned 6 [0046.755] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.ape") returned 0 [0046.755] lstrlenA (lpString="*.ape") returned 5 [0046.755] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.wma") returned 0 [0046.755] lstrlenA (lpString="*.wma") returned 5 [0046.755] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.ac3") returned 0 [0046.755] lstrlenA (lpString="*.ac3") returned 5 [0046.755] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", pszSpec="*.mxf") returned 0 [0046.755] lstrlenA (lpString="*.mxf") returned 5 [0046.755] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0046.755] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.756] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0046.756] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0046.756] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0046.756] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned="PubLR.cab" [0046.756] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" [0046.756] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned="" [0046.756] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.756] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.756] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" [0046.756] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.zip") returned 0 [0046.756] lstrlenA (lpString="*.zip") returned 5 [0046.756] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.rar") returned 0 [0046.756] lstrlenA (lpString="*.rar") returned 5 [0046.756] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.7z") returned 0 [0046.756] lstrlenA (lpString="*.7z") returned 4 [0046.756] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tar") returned 0 [0046.756] lstrlenA (lpString="*.tar") returned 5 [0046.756] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gzip") returned 0 [0046.756] lstrlenA (lpString="*.gzip") returned 6 [0046.756] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpg") returned 0 [0046.756] lstrlenA (lpString="*.jpg") returned 5 [0046.756] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpeg") returned 0 [0046.756] lstrlenA (lpString="*.jpeg") returned 6 [0046.757] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.psd") returned 0 [0046.757] lstrlenA (lpString="*.psd") returned 5 [0046.757] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gif") returned 0 [0046.757] lstrlenA (lpString="*.gif") returned 5 [0046.757] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.doc") returned 0 [0046.757] lstrlenA (lpString="*.doc") returned 5 [0046.757] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docx") returned 0 [0046.757] lstrlenA (lpString="*.docx") returned 6 [0046.757] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xls") returned 0 [0046.757] lstrlenA (lpString="*.xls") returned 5 [0046.757] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsx") returned 0 [0046.757] lstrlenA (lpString="*.xlsx") returned 6 [0046.757] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ppt") returned 0 [0046.757] lstrlenA (lpString="*.ppt") returned 5 [0046.757] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pptx") returned 0 [0046.757] lstrlenA (lpString="*.pptx") returned 6 [0046.757] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pdf") returned 0 [0046.757] lstrlenA (lpString="*.pdf") returned 5 [0046.757] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mov") returned 0 [0046.757] lstrlenA (lpString="*.mov") returned 5 [0046.757] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.m2v") returned 0 [0046.757] lstrlenA (lpString="*.m2v") returned 5 [0046.757] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.3gp") returned 0 [0046.757] lstrlenA (lpString="*.3gp") returned 5 [0046.757] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpeg") returned 0 [0046.757] lstrlenA (lpString="*.mpeg") returned 6 [0046.757] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpg") returned 0 [0046.758] lstrlenA (lpString="*.mpg") returned 5 [0046.758] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flv") returned 0 [0046.758] lstrlenA (lpString="*.flv") returned 5 [0046.758] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.avi") returned 0 [0046.758] lstrlenA (lpString="*.avi") returned 5 [0046.758] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp4") returned 0 [0046.758] lstrlenA (lpString="*.mp4") returned 5 [0046.758] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wmv") returned 0 [0046.758] lstrlenA (lpString="*.wmv") returned 5 [0046.758] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.divx") returned 0 [0046.758] lstrlenA (lpString="*.divx") returned 6 [0046.758] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mkv") returned 0 [0046.758] lstrlenA (lpString="*.mkv") returned 5 [0046.758] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp3") returned 0 [0046.758] lstrlenA (lpString="*.mp3") returned 5 [0046.758] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wav") returned 0 [0046.758] lstrlenA (lpString="*.wav") returned 5 [0046.758] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flac") returned 0 [0046.758] lstrlenA (lpString="*.flac") returned 6 [0046.758] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ape") returned 0 [0046.758] lstrlenA (lpString="*.ape") returned 5 [0046.758] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wma") returned 0 [0046.758] lstrlenA (lpString="*.wma") returned 5 [0046.758] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ac3") returned 0 [0046.758] lstrlenA (lpString="*.ac3") returned 5 [0046.758] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mxf") returned 0 [0046.758] lstrlenA (lpString="*.mxf") returned 5 [0046.759] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0046.759] FindClose (in: hFindFile=0x2d6f20 | out: hFindFile=0x2d6f20) returned 1 [0046.759] FindNextFileA (in: hFindFile=0x2d6f60, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0046.759] lstrcmpA (lpString1=".", lpString2="{90140000-001A-0409-1000-0000000FF1CE}-C") returned -1 [0046.759] lstrcmpA (lpString1="..", lpString2="{90140000-001A-0409-1000-0000000FF1CE}-C") returned -1 [0046.759] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0046.759] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-001A-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C" [0046.759] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C") returned 62 [0046.759] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2d6f20 [0046.762] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.762] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.762] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.762] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.763] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0046.763] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.763] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OutlkLR.cab") returned -1 [0046.763] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutlkLR.cab") returned -1 [0046.763] lstrcmpiA (lpString1="", lpString2="OutlkLR.cab") returned -1 [0046.763] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0046.763] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" [0046.763] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned="" [0046.763] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.763] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0046.763] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0046.764] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.764] WriteFile (in: hFile=0x88, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.765] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.765] CloseHandle (hObject=0x88) returned 1 [0046.765] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="OutlkLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" [0046.765] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.zip") returned 0 [0046.765] lstrlenA (lpString="*.zip") returned 5 [0046.766] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.rar") returned 0 [0046.766] lstrlenA (lpString="*.rar") returned 5 [0046.766] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.7z") returned 0 [0046.766] lstrlenA (lpString="*.7z") returned 4 [0046.766] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.tar") returned 0 [0046.766] lstrlenA (lpString="*.tar") returned 5 [0046.766] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.gzip") returned 0 [0046.766] lstrlenA (lpString="*.gzip") returned 6 [0046.766] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.jpg") returned 0 [0046.766] lstrlenA (lpString="*.jpg") returned 5 [0046.766] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.jpeg") returned 0 [0046.766] lstrlenA (lpString="*.jpeg") returned 6 [0046.766] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.psd") returned 0 [0046.766] lstrlenA (lpString="*.psd") returned 5 [0046.766] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.gif") returned 0 [0046.766] lstrlenA (lpString="*.gif") returned 5 [0046.766] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.doc") returned 0 [0046.766] lstrlenA (lpString="*.doc") returned 5 [0046.766] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.docx") returned 0 [0046.766] lstrlenA (lpString="*.docx") returned 6 [0046.766] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.xls") returned 0 [0046.766] lstrlenA (lpString="*.xls") returned 5 [0046.766] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.xlsx") returned 0 [0046.766] lstrlenA (lpString="*.xlsx") returned 6 [0046.766] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.ppt") returned 0 [0046.766] lstrlenA (lpString="*.ppt") returned 5 [0046.766] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.pptx") returned 0 [0046.767] lstrlenA (lpString="*.pptx") returned 6 [0046.767] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.pdf") returned 0 [0046.767] lstrlenA (lpString="*.pdf") returned 5 [0046.767] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.mov") returned 0 [0046.767] lstrlenA (lpString="*.mov") returned 5 [0046.767] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.m2v") returned 0 [0046.767] lstrlenA (lpString="*.m2v") returned 5 [0046.767] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.3gp") returned 0 [0046.767] lstrlenA (lpString="*.3gp") returned 5 [0046.767] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.mpeg") returned 0 [0046.767] lstrlenA (lpString="*.mpeg") returned 6 [0046.767] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.mpg") returned 0 [0046.767] lstrlenA (lpString="*.mpg") returned 5 [0046.767] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.flv") returned 0 [0046.767] lstrlenA (lpString="*.flv") returned 5 [0046.767] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.avi") returned 0 [0046.767] lstrlenA (lpString="*.avi") returned 5 [0046.767] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.mp4") returned 0 [0046.767] lstrlenA (lpString="*.mp4") returned 5 [0046.767] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.wmv") returned 0 [0046.767] lstrlenA (lpString="*.wmv") returned 5 [0046.767] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.divx") returned 0 [0046.767] lstrlenA (lpString="*.divx") returned 6 [0046.767] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.mkv") returned 0 [0046.767] lstrlenA (lpString="*.mkv") returned 5 [0046.767] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.mp3") returned 0 [0046.767] lstrlenA (lpString="*.mp3") returned 5 [0046.768] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.wav") returned 0 [0046.768] lstrlenA (lpString="*.wav") returned 5 [0046.768] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.flac") returned 0 [0046.768] lstrlenA (lpString="*.flac") returned 6 [0046.768] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.ape") returned 0 [0046.768] lstrlenA (lpString="*.ape") returned 5 [0046.768] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.wma") returned 0 [0046.768] lstrlenA (lpString="*.wma") returned 5 [0046.768] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.ac3") returned 0 [0046.768] lstrlenA (lpString="*.ac3") returned 5 [0046.768] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", pszSpec="*.mxf") returned 0 [0046.768] lstrlenA (lpString="*.mxf") returned 5 [0046.768] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x2d9290, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0046.768] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.768] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OutlookMUI.msi") returned -1 [0046.768] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutlookMUI.msi") returned -1 [0046.768] lstrcmpiA (lpString1="", lpString2="OutlookMUI.msi") returned -1 [0046.768] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned="OutlkLR.cab" [0046.768] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" [0046.768] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned="" [0046.768] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.768] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.768] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="OutlookMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" [0046.769] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.zip") returned 0 [0046.769] lstrlenA (lpString="*.zip") returned 5 [0046.769] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.rar") returned 0 [0046.769] lstrlenA (lpString="*.rar") returned 5 [0046.769] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.7z") returned 0 [0046.769] lstrlenA (lpString="*.7z") returned 4 [0046.769] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.tar") returned 0 [0046.769] lstrlenA (lpString="*.tar") returned 5 [0046.769] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.gzip") returned 0 [0046.769] lstrlenA (lpString="*.gzip") returned 6 [0046.769] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.jpg") returned 0 [0046.769] lstrlenA (lpString="*.jpg") returned 5 [0046.769] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.jpeg") returned 0 [0046.769] lstrlenA (lpString="*.jpeg") returned 6 [0046.769] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.psd") returned 0 [0046.769] lstrlenA (lpString="*.psd") returned 5 [0046.769] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.gif") returned 0 [0046.769] lstrlenA (lpString="*.gif") returned 5 [0046.769] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.doc") returned 0 [0046.769] lstrlenA (lpString="*.doc") returned 5 [0046.769] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.docx") returned 0 [0046.769] lstrlenA (lpString="*.docx") returned 6 [0046.769] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.xls") returned 0 [0046.769] lstrlenA (lpString="*.xls") returned 5 [0046.769] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.xlsx") returned 0 [0046.769] lstrlenA (lpString="*.xlsx") returned 6 [0046.770] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.ppt") returned 0 [0046.770] lstrlenA (lpString="*.ppt") returned 5 [0046.770] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.pptx") returned 0 [0046.770] lstrlenA (lpString="*.pptx") returned 6 [0046.770] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.pdf") returned 0 [0046.770] lstrlenA (lpString="*.pdf") returned 5 [0046.770] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.mov") returned 0 [0046.770] lstrlenA (lpString="*.mov") returned 5 [0046.770] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.m2v") returned 0 [0046.770] lstrlenA (lpString="*.m2v") returned 5 [0046.770] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.3gp") returned 0 [0046.770] lstrlenA (lpString="*.3gp") returned 5 [0046.770] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.mpeg") returned 0 [0046.770] lstrlenA (lpString="*.mpeg") returned 6 [0046.770] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.mpg") returned 0 [0046.770] lstrlenA (lpString="*.mpg") returned 5 [0046.770] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.flv") returned 0 [0046.770] lstrlenA (lpString="*.flv") returned 5 [0046.770] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.avi") returned 0 [0046.770] lstrlenA (lpString="*.avi") returned 5 [0046.770] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.mp4") returned 0 [0046.770] lstrlenA (lpString="*.mp4") returned 5 [0046.770] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.wmv") returned 0 [0046.770] lstrlenA (lpString="*.wmv") returned 5 [0046.770] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.divx") returned 0 [0046.770] lstrlenA (lpString="*.divx") returned 6 [0046.770] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.mkv") returned 0 [0046.770] lstrlenA (lpString="*.mkv") returned 5 [0046.771] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.mp3") returned 0 [0046.771] lstrlenA (lpString="*.mp3") returned 5 [0046.771] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.wav") returned 0 [0046.771] lstrlenA (lpString="*.wav") returned 5 [0046.771] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.flac") returned 0 [0046.771] lstrlenA (lpString="*.flac") returned 6 [0046.771] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.ape") returned 0 [0046.771] lstrlenA (lpString="*.ape") returned 5 [0046.771] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.wma") returned 0 [0046.771] lstrlenA (lpString="*.wma") returned 5 [0046.771] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.ac3") returned 0 [0046.771] lstrlenA (lpString="*.ac3") returned 5 [0046.771] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", pszSpec="*.mxf") returned 0 [0046.771] lstrlenA (lpString="*.mxf") returned 5 [0046.771] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x780074, dwReserved1=0x74, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0046.771] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.771] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OutlookMUI.xml") returned -1 [0046.771] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutlookMUI.xml") returned -1 [0046.771] lstrcmpiA (lpString1="", lpString2="OutlookMUI.xml") returned -1 [0046.771] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned="OutlookMUI.msi" [0046.771] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" [0046.771] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned="" [0046.771] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.771] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.771] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="OutlookMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" [0046.772] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.zip") returned 0 [0046.772] lstrlenA (lpString="*.zip") returned 5 [0046.772] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.rar") returned 0 [0046.772] lstrlenA (lpString="*.rar") returned 5 [0046.772] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.7z") returned 0 [0046.772] lstrlenA (lpString="*.7z") returned 4 [0046.772] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.tar") returned 0 [0046.772] lstrlenA (lpString="*.tar") returned 5 [0046.772] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.gzip") returned 0 [0046.772] lstrlenA (lpString="*.gzip") returned 6 [0046.772] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.jpg") returned 0 [0046.772] lstrlenA (lpString="*.jpg") returned 5 [0046.772] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.jpeg") returned 0 [0046.772] lstrlenA (lpString="*.jpeg") returned 6 [0046.772] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.psd") returned 0 [0046.772] lstrlenA (lpString="*.psd") returned 5 [0046.772] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.gif") returned 0 [0046.772] lstrlenA (lpString="*.gif") returned 5 [0046.772] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.doc") returned 0 [0046.772] lstrlenA (lpString="*.doc") returned 5 [0046.772] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.docx") returned 0 [0046.772] lstrlenA (lpString="*.docx") returned 6 [0046.772] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.xls") returned 0 [0046.772] lstrlenA (lpString="*.xls") returned 5 [0046.772] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.xlsx") returned 0 [0046.772] lstrlenA (lpString="*.xlsx") returned 6 [0046.772] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.ppt") returned 0 [0046.773] lstrlenA (lpString="*.ppt") returned 5 [0046.773] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.pptx") returned 0 [0046.773] lstrlenA (lpString="*.pptx") returned 6 [0046.773] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.pdf") returned 0 [0046.773] lstrlenA (lpString="*.pdf") returned 5 [0046.773] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.mov") returned 0 [0046.773] lstrlenA (lpString="*.mov") returned 5 [0046.773] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.m2v") returned 0 [0046.773] lstrlenA (lpString="*.m2v") returned 5 [0046.773] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.3gp") returned 0 [0046.773] lstrlenA (lpString="*.3gp") returned 5 [0046.773] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.mpeg") returned 0 [0046.773] lstrlenA (lpString="*.mpeg") returned 6 [0046.773] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.mpg") returned 0 [0046.773] lstrlenA (lpString="*.mpg") returned 5 [0046.773] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.flv") returned 0 [0046.773] lstrlenA (lpString="*.flv") returned 5 [0046.773] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.avi") returned 0 [0046.773] lstrlenA (lpString="*.avi") returned 5 [0046.773] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.mp4") returned 0 [0046.773] lstrlenA (lpString="*.mp4") returned 5 [0046.773] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.wmv") returned 0 [0046.773] lstrlenA (lpString="*.wmv") returned 5 [0046.773] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.divx") returned 0 [0046.773] lstrlenA (lpString="*.divx") returned 6 [0046.773] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.mkv") returned 0 [0046.773] lstrlenA (lpString="*.mkv") returned 5 [0046.774] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.mp3") returned 0 [0046.774] lstrlenA (lpString="*.mp3") returned 5 [0046.774] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.wav") returned 0 [0046.774] lstrlenA (lpString="*.wav") returned 5 [0046.774] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.flac") returned 0 [0046.774] lstrlenA (lpString="*.flac") returned 6 [0046.774] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.ape") returned 0 [0046.774] lstrlenA (lpString="*.ape") returned 5 [0046.774] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.wma") returned 0 [0046.774] lstrlenA (lpString="*.wma") returned 5 [0046.774] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.ac3") returned 0 [0046.774] lstrlenA (lpString="*.ac3") returned 5 [0046.774] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", pszSpec="*.mxf") returned 0 [0046.774] lstrlenA (lpString="*.mxf") returned 5 [0046.774] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0046.774] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.774] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0046.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0046.774] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0046.774] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned="OutlookMUI.xml" [0046.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" [0046.774] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned="" [0046.774] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.774] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.775] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" [0046.775] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.zip") returned 0 [0046.775] lstrlenA (lpString="*.zip") returned 5 [0046.775] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.rar") returned 0 [0046.775] lstrlenA (lpString="*.rar") returned 5 [0046.775] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.7z") returned 0 [0046.775] lstrlenA (lpString="*.7z") returned 4 [0046.775] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tar") returned 0 [0046.775] lstrlenA (lpString="*.tar") returned 5 [0046.775] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gzip") returned 0 [0046.775] lstrlenA (lpString="*.gzip") returned 6 [0046.775] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpg") returned 0 [0046.775] lstrlenA (lpString="*.jpg") returned 5 [0046.775] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpeg") returned 0 [0046.775] lstrlenA (lpString="*.jpeg") returned 6 [0046.775] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.psd") returned 0 [0046.775] lstrlenA (lpString="*.psd") returned 5 [0046.775] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gif") returned 0 [0046.775] lstrlenA (lpString="*.gif") returned 5 [0046.775] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.doc") returned 0 [0046.775] lstrlenA (lpString="*.doc") returned 5 [0046.775] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docx") returned 0 [0046.775] lstrlenA (lpString="*.docx") returned 6 [0046.776] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xls") returned 0 [0046.776] lstrlenA (lpString="*.xls") returned 5 [0046.776] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsx") returned 0 [0046.776] lstrlenA (lpString="*.xlsx") returned 6 [0046.776] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ppt") returned 0 [0046.776] lstrlenA (lpString="*.ppt") returned 5 [0046.776] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pptx") returned 0 [0046.776] lstrlenA (lpString="*.pptx") returned 6 [0046.776] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pdf") returned 0 [0046.776] lstrlenA (lpString="*.pdf") returned 5 [0046.776] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mov") returned 0 [0046.776] lstrlenA (lpString="*.mov") returned 5 [0046.776] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.m2v") returned 0 [0046.776] lstrlenA (lpString="*.m2v") returned 5 [0046.776] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.3gp") returned 0 [0046.776] lstrlenA (lpString="*.3gp") returned 5 [0046.776] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpeg") returned 0 [0046.776] lstrlenA (lpString="*.mpeg") returned 6 [0046.776] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpg") returned 0 [0046.776] lstrlenA (lpString="*.mpg") returned 5 [0046.776] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flv") returned 0 [0046.776] lstrlenA (lpString="*.flv") returned 5 [0046.776] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.avi") returned 0 [0046.776] lstrlenA (lpString="*.avi") returned 5 [0046.776] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp4") returned 0 [0046.776] lstrlenA (lpString="*.mp4") returned 5 [0046.777] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wmv") returned 0 [0046.777] lstrlenA (lpString="*.wmv") returned 5 [0046.777] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.divx") returned 0 [0046.777] lstrlenA (lpString="*.divx") returned 6 [0046.777] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mkv") returned 0 [0046.777] lstrlenA (lpString="*.mkv") returned 5 [0046.777] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp3") returned 0 [0046.777] lstrlenA (lpString="*.mp3") returned 5 [0046.777] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wav") returned 0 [0046.777] lstrlenA (lpString="*.wav") returned 5 [0046.777] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flac") returned 0 [0046.777] lstrlenA (lpString="*.flac") returned 6 [0046.777] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ape") returned 0 [0046.777] lstrlenA (lpString="*.ape") returned 5 [0046.777] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wma") returned 0 [0046.777] lstrlenA (lpString="*.wma") returned 5 [0046.777] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ac3") returned 0 [0046.777] lstrlenA (lpString="*.ac3") returned 5 [0046.777] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mxf") returned 0 [0046.777] lstrlenA (lpString="*.mxf") returned 5 [0046.777] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0046.777] FindClose (in: hFindFile=0x2d6f20 | out: hFindFile=0x2d6f20) returned 1 [0046.778] FindNextFileA (in: hFindFile=0x2d6f60, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0046.778] lstrcmpA (lpString1=".", lpString2="{90140000-001B-0409-1000-0000000FF1CE}-C") returned -1 [0046.778] lstrcmpA (lpString1="..", lpString2="{90140000-001B-0409-1000-0000000FF1CE}-C") returned -1 [0046.778] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0046.778] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-001B-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C" [0046.778] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C") returned 62 [0046.778] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2d6f20 [0046.779] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.779] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.780] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.780] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.780] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0046.780] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.780] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0046.780] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0046.780] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0046.780] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0046.780] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" [0046.780] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned="" [0046.780] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.780] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0046.780] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0046.782] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.782] WriteFile (in: hFile=0x88, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.784] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.784] CloseHandle (hObject=0x88) returned 1 [0046.784] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" [0046.784] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.zip") returned 0 [0046.784] lstrlenA (lpString="*.zip") returned 5 [0046.784] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.rar") returned 0 [0046.784] lstrlenA (lpString="*.rar") returned 5 [0046.784] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.7z") returned 0 [0046.784] lstrlenA (lpString="*.7z") returned 4 [0046.784] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tar") returned 0 [0046.784] lstrlenA (lpString="*.tar") returned 5 [0046.784] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gzip") returned 0 [0046.784] lstrlenA (lpString="*.gzip") returned 6 [0046.784] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpg") returned 0 [0046.784] lstrlenA (lpString="*.jpg") returned 5 [0046.784] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpeg") returned 0 [0046.784] lstrlenA (lpString="*.jpeg") returned 6 [0046.784] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.psd") returned 0 [0046.784] lstrlenA (lpString="*.psd") returned 5 [0046.785] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gif") returned 0 [0046.785] lstrlenA (lpString="*.gif") returned 5 [0046.785] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.doc") returned 0 [0046.785] lstrlenA (lpString="*.doc") returned 5 [0046.785] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docx") returned 0 [0046.785] lstrlenA (lpString="*.docx") returned 6 [0046.785] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xls") returned 0 [0046.785] lstrlenA (lpString="*.xls") returned 5 [0046.785] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsx") returned 0 [0046.785] lstrlenA (lpString="*.xlsx") returned 6 [0046.785] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ppt") returned 0 [0046.785] lstrlenA (lpString="*.ppt") returned 5 [0046.785] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pptx") returned 0 [0046.785] lstrlenA (lpString="*.pptx") returned 6 [0046.785] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pdf") returned 0 [0046.785] lstrlenA (lpString="*.pdf") returned 5 [0046.785] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mov") returned 0 [0046.785] lstrlenA (lpString="*.mov") returned 5 [0046.785] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.m2v") returned 0 [0046.785] lstrlenA (lpString="*.m2v") returned 5 [0046.785] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.3gp") returned 0 [0046.785] lstrlenA (lpString="*.3gp") returned 5 [0046.785] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpeg") returned 0 [0046.785] lstrlenA (lpString="*.mpeg") returned 6 [0046.785] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpg") returned 0 [0046.785] lstrlenA (lpString="*.mpg") returned 5 [0046.785] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flv") returned 0 [0046.785] lstrlenA (lpString="*.flv") returned 5 [0046.786] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.avi") returned 0 [0046.786] lstrlenA (lpString="*.avi") returned 5 [0046.786] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp4") returned 0 [0046.786] lstrlenA (lpString="*.mp4") returned 5 [0046.786] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wmv") returned 0 [0046.786] lstrlenA (lpString="*.wmv") returned 5 [0046.786] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.divx") returned 0 [0046.786] lstrlenA (lpString="*.divx") returned 6 [0046.786] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mkv") returned 0 [0046.786] lstrlenA (lpString="*.mkv") returned 5 [0046.786] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp3") returned 0 [0046.786] lstrlenA (lpString="*.mp3") returned 5 [0046.786] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wav") returned 0 [0046.786] lstrlenA (lpString="*.wav") returned 5 [0046.786] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flac") returned 0 [0046.786] lstrlenA (lpString="*.flac") returned 6 [0046.786] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ape") returned 0 [0046.786] lstrlenA (lpString="*.ape") returned 5 [0046.786] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wma") returned 0 [0046.786] lstrlenA (lpString="*.wma") returned 5 [0046.786] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ac3") returned 0 [0046.786] lstrlenA (lpString="*.ac3") returned 5 [0046.786] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mxf") returned 0 [0046.786] lstrlenA (lpString="*.mxf") returned 5 [0046.786] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x2d9290, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0046.786] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.786] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WordLR.cab") returned -1 [0046.787] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WordLR.cab") returned -1 [0046.787] lstrcmpiA (lpString1="", lpString2="WordLR.cab") returned -1 [0046.787] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="Setup.xml" [0046.787] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" [0046.787] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned="" [0046.787] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.787] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.787] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="WordLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" [0046.787] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.zip") returned 0 [0046.787] lstrlenA (lpString="*.zip") returned 5 [0046.787] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.rar") returned 0 [0046.787] lstrlenA (lpString="*.rar") returned 5 [0046.787] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.7z") returned 0 [0046.787] lstrlenA (lpString="*.7z") returned 4 [0046.787] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.tar") returned 0 [0046.787] lstrlenA (lpString="*.tar") returned 5 [0046.787] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.gzip") returned 0 [0046.787] lstrlenA (lpString="*.gzip") returned 6 [0046.787] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.jpg") returned 0 [0046.787] lstrlenA (lpString="*.jpg") returned 5 [0046.787] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.jpeg") returned 0 [0046.787] lstrlenA (lpString="*.jpeg") returned 6 [0046.787] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.psd") returned 0 [0046.788] lstrlenA (lpString="*.psd") returned 5 [0046.788] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.gif") returned 0 [0046.788] lstrlenA (lpString="*.gif") returned 5 [0046.788] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.doc") returned 0 [0046.788] lstrlenA (lpString="*.doc") returned 5 [0046.788] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.docx") returned 0 [0046.788] lstrlenA (lpString="*.docx") returned 6 [0046.788] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.xls") returned 0 [0046.788] lstrlenA (lpString="*.xls") returned 5 [0046.788] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.xlsx") returned 0 [0046.788] lstrlenA (lpString="*.xlsx") returned 6 [0046.788] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.ppt") returned 0 [0046.788] lstrlenA (lpString="*.ppt") returned 5 [0046.788] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.pptx") returned 0 [0046.788] lstrlenA (lpString="*.pptx") returned 6 [0046.788] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.pdf") returned 0 [0046.788] lstrlenA (lpString="*.pdf") returned 5 [0046.788] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.mov") returned 0 [0046.788] lstrlenA (lpString="*.mov") returned 5 [0046.788] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.m2v") returned 0 [0046.788] lstrlenA (lpString="*.m2v") returned 5 [0046.788] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.3gp") returned 0 [0046.788] lstrlenA (lpString="*.3gp") returned 5 [0046.788] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.mpeg") returned 0 [0046.788] lstrlenA (lpString="*.mpeg") returned 6 [0046.788] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.mpg") returned 0 [0046.788] lstrlenA (lpString="*.mpg") returned 5 [0046.788] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.flv") returned 0 [0046.788] lstrlenA (lpString="*.flv") returned 5 [0046.789] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.avi") returned 0 [0046.789] lstrlenA (lpString="*.avi") returned 5 [0046.789] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.mp4") returned 0 [0046.789] lstrlenA (lpString="*.mp4") returned 5 [0046.789] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.wmv") returned 0 [0046.789] lstrlenA (lpString="*.wmv") returned 5 [0046.789] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.divx") returned 0 [0046.789] lstrlenA (lpString="*.divx") returned 6 [0046.789] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.mkv") returned 0 [0046.789] lstrlenA (lpString="*.mkv") returned 5 [0046.789] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.mp3") returned 0 [0046.789] lstrlenA (lpString="*.mp3") returned 5 [0046.789] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.wav") returned 0 [0046.789] lstrlenA (lpString="*.wav") returned 5 [0046.789] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.flac") returned 0 [0046.789] lstrlenA (lpString="*.flac") returned 6 [0046.789] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.ape") returned 0 [0046.789] lstrlenA (lpString="*.ape") returned 5 [0046.789] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.wma") returned 0 [0046.789] lstrlenA (lpString="*.wma") returned 5 [0046.789] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.ac3") returned 0 [0046.789] lstrlenA (lpString="*.ac3") returned 5 [0046.789] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", pszSpec="*.mxf") returned 0 [0046.789] lstrlenA (lpString="*.mxf") returned 5 [0046.789] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x780074, dwReserved1=0x74, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0046.789] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.789] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WordMUI.msi") returned -1 [0046.789] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WordMUI.msi") returned -1 [0046.790] lstrcmpiA (lpString1="", lpString2="WordMUI.msi") returned -1 [0046.790] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned="WordLR.cab" [0046.790] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" [0046.790] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned="" [0046.790] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.790] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.790] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="WordMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" [0046.790] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.zip") returned 0 [0046.790] lstrlenA (lpString="*.zip") returned 5 [0046.790] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.rar") returned 0 [0046.790] lstrlenA (lpString="*.rar") returned 5 [0046.790] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.7z") returned 0 [0046.790] lstrlenA (lpString="*.7z") returned 4 [0046.790] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.tar") returned 0 [0046.790] lstrlenA (lpString="*.tar") returned 5 [0046.790] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.gzip") returned 0 [0046.790] lstrlenA (lpString="*.gzip") returned 6 [0046.790] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.jpg") returned 0 [0046.790] lstrlenA (lpString="*.jpg") returned 5 [0046.790] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.jpeg") returned 0 [0046.790] lstrlenA (lpString="*.jpeg") returned 6 [0046.790] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.psd") returned 0 [0046.790] lstrlenA (lpString="*.psd") returned 5 [0046.790] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.gif") returned 0 [0046.791] lstrlenA (lpString="*.gif") returned 5 [0046.791] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.doc") returned 0 [0046.791] lstrlenA (lpString="*.doc") returned 5 [0046.791] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.docx") returned 0 [0046.791] lstrlenA (lpString="*.docx") returned 6 [0046.791] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.xls") returned 0 [0046.791] lstrlenA (lpString="*.xls") returned 5 [0046.791] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.xlsx") returned 0 [0046.791] lstrlenA (lpString="*.xlsx") returned 6 [0046.791] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.ppt") returned 0 [0046.791] lstrlenA (lpString="*.ppt") returned 5 [0046.791] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.pptx") returned 0 [0046.791] lstrlenA (lpString="*.pptx") returned 6 [0046.791] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.pdf") returned 0 [0046.791] lstrlenA (lpString="*.pdf") returned 5 [0046.791] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.mov") returned 0 [0046.791] lstrlenA (lpString="*.mov") returned 5 [0046.791] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.m2v") returned 0 [0046.791] lstrlenA (lpString="*.m2v") returned 5 [0046.791] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.3gp") returned 0 [0046.791] lstrlenA (lpString="*.3gp") returned 5 [0046.791] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.mpeg") returned 0 [0046.791] lstrlenA (lpString="*.mpeg") returned 6 [0046.791] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.mpg") returned 0 [0046.791] lstrlenA (lpString="*.mpg") returned 5 [0046.791] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.flv") returned 0 [0046.791] lstrlenA (lpString="*.flv") returned 5 [0046.792] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.avi") returned 0 [0046.792] lstrlenA (lpString="*.avi") returned 5 [0046.792] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.mp4") returned 0 [0046.792] lstrlenA (lpString="*.mp4") returned 5 [0046.792] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.wmv") returned 0 [0046.792] lstrlenA (lpString="*.wmv") returned 5 [0046.792] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.divx") returned 0 [0046.792] lstrlenA (lpString="*.divx") returned 6 [0046.792] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.mkv") returned 0 [0046.792] lstrlenA (lpString="*.mkv") returned 5 [0046.792] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.mp3") returned 0 [0046.792] lstrlenA (lpString="*.mp3") returned 5 [0046.792] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.wav") returned 0 [0046.792] lstrlenA (lpString="*.wav") returned 5 [0046.792] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.flac") returned 0 [0046.792] lstrlenA (lpString="*.flac") returned 6 [0046.792] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.ape") returned 0 [0046.792] lstrlenA (lpString="*.ape") returned 5 [0046.792] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.wma") returned 0 [0046.792] lstrlenA (lpString="*.wma") returned 5 [0046.792] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.ac3") returned 0 [0046.792] lstrlenA (lpString="*.ac3") returned 5 [0046.792] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", pszSpec="*.mxf") returned 0 [0046.792] lstrlenA (lpString="*.mxf") returned 5 [0046.792] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x780074, dwReserved1=0x74, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0046.792] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.792] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WordMUI.xml") returned -1 [0046.793] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WordMUI.xml") returned -1 [0046.793] lstrcmpiA (lpString1="", lpString2="WordMUI.xml") returned -1 [0046.793] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned="WordMUI.msi" [0046.793] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" [0046.793] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned="" [0046.793] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.793] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.793] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="WordMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" [0046.793] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.zip") returned 0 [0046.793] lstrlenA (lpString="*.zip") returned 5 [0046.793] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.rar") returned 0 [0046.793] lstrlenA (lpString="*.rar") returned 5 [0046.793] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.7z") returned 0 [0046.793] lstrlenA (lpString="*.7z") returned 4 [0046.793] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.tar") returned 0 [0046.793] lstrlenA (lpString="*.tar") returned 5 [0046.793] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.gzip") returned 0 [0046.793] lstrlenA (lpString="*.gzip") returned 6 [0046.793] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.jpg") returned 0 [0046.793] lstrlenA (lpString="*.jpg") returned 5 [0046.793] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.jpeg") returned 0 [0046.794] lstrlenA (lpString="*.jpeg") returned 6 [0046.794] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.psd") returned 0 [0046.794] lstrlenA (lpString="*.psd") returned 5 [0046.794] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.gif") returned 0 [0046.794] lstrlenA (lpString="*.gif") returned 5 [0046.794] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.doc") returned 0 [0046.794] lstrlenA (lpString="*.doc") returned 5 [0046.794] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.docx") returned 0 [0046.794] lstrlenA (lpString="*.docx") returned 6 [0046.794] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.xls") returned 0 [0046.794] lstrlenA (lpString="*.xls") returned 5 [0046.794] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.xlsx") returned 0 [0046.794] lstrlenA (lpString="*.xlsx") returned 6 [0046.794] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.ppt") returned 0 [0046.794] lstrlenA (lpString="*.ppt") returned 5 [0046.794] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.pptx") returned 0 [0046.794] lstrlenA (lpString="*.pptx") returned 6 [0046.794] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.pdf") returned 0 [0046.794] lstrlenA (lpString="*.pdf") returned 5 [0046.794] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.mov") returned 0 [0046.794] lstrlenA (lpString="*.mov") returned 5 [0046.794] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.m2v") returned 0 [0046.794] lstrlenA (lpString="*.m2v") returned 5 [0046.794] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.3gp") returned 0 [0046.794] lstrlenA (lpString="*.3gp") returned 5 [0046.794] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.mpeg") returned 0 [0046.795] lstrlenA (lpString="*.mpeg") returned 6 [0046.795] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.mpg") returned 0 [0046.795] lstrlenA (lpString="*.mpg") returned 5 [0046.795] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.flv") returned 0 [0046.795] lstrlenA (lpString="*.flv") returned 5 [0046.795] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.avi") returned 0 [0046.795] lstrlenA (lpString="*.avi") returned 5 [0046.795] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.mp4") returned 0 [0046.795] lstrlenA (lpString="*.mp4") returned 5 [0046.795] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.wmv") returned 0 [0046.795] lstrlenA (lpString="*.wmv") returned 5 [0046.795] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.divx") returned 0 [0046.795] lstrlenA (lpString="*.divx") returned 6 [0046.795] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.mkv") returned 0 [0046.795] lstrlenA (lpString="*.mkv") returned 5 [0046.795] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.mp3") returned 0 [0046.796] lstrlenA (lpString="*.mp3") returned 5 [0046.796] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.wav") returned 0 [0046.796] lstrlenA (lpString="*.wav") returned 5 [0046.796] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.flac") returned 0 [0046.796] lstrlenA (lpString="*.flac") returned 6 [0046.796] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.ape") returned 0 [0046.796] lstrlenA (lpString="*.ape") returned 5 [0046.796] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.wma") returned 0 [0046.796] lstrlenA (lpString="*.wma") returned 5 [0046.796] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.ac3") returned 0 [0046.796] lstrlenA (lpString="*.ac3") returned 5 [0046.796] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", pszSpec="*.mxf") returned 0 [0046.796] lstrlenA (lpString="*.mxf") returned 5 [0046.796] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x780074, dwReserved1=0x74, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0046.796] FindClose (in: hFindFile=0x2d6f20 | out: hFindFile=0x2d6f20) returned 1 [0046.796] FindNextFileA (in: hFindFile=0x2d6f60, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0046.796] lstrcmpA (lpString1=".", lpString2="{90140000-002C-0409-1000-0000000FF1CE}-C") returned -1 [0046.796] lstrcmpA (lpString1="..", lpString2="{90140000-002C-0409-1000-0000000FF1CE}-C") returned -1 [0046.796] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0046.796] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-002C-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C" [0046.796] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C") returned 62 [0046.796] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2d6f20 [0046.816] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.817] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.817] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.817] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.817] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0046.817] lstrcmpA (lpString1=".", lpString2="Proof.en") returned -1 [0046.817] lstrcmpA (lpString1="..", lpString2="Proof.en") returned -1 [0046.817] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0046.817] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="Proof.en" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en" [0046.817] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en") returned 71 [0046.817] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d7fa8, dwReserved1=0x2d7fa3, cFileName=".", cAlternateFileName="")) returned 0x2d9050 [0046.817] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.817] FindNextFileA (in: hFindFile=0x2d9050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.818] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.818] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.818] FindNextFileA (in: hFindFile=0x2d9050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0046.818] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0046.818] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proof.cab") returned -1 [0046.818] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.cab") returned -1 [0046.818] lstrcmpiA (lpString1="", lpString2="Proof.cab") returned -1 [0046.818] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*.*") returned="*.*" [0046.818] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\" [0046.818] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\") returned="" [0046.818] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt" [0046.818] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\how to decrypt files.txt")) returned 0xffffffff [0046.818] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0046.819] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.819] WriteFile (in: hFile=0x8c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.820] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.820] CloseHandle (hObject=0x8c) returned 1 [0046.820] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpString2="Proof.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" [0046.820] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.zip") returned 0 [0046.820] lstrlenA (lpString="*.zip") returned 5 [0046.820] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.rar") returned 0 [0046.820] lstrlenA (lpString="*.rar") returned 5 [0046.820] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.7z") returned 0 [0046.820] lstrlenA (lpString="*.7z") returned 4 [0046.820] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.tar") returned 0 [0046.821] lstrlenA (lpString="*.tar") returned 5 [0046.821] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.gzip") returned 0 [0046.821] lstrlenA (lpString="*.gzip") returned 6 [0046.821] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.jpg") returned 0 [0046.821] lstrlenA (lpString="*.jpg") returned 5 [0046.821] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.jpeg") returned 0 [0046.821] lstrlenA (lpString="*.jpeg") returned 6 [0046.821] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.psd") returned 0 [0046.821] lstrlenA (lpString="*.psd") returned 5 [0046.821] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.gif") returned 0 [0046.821] lstrlenA (lpString="*.gif") returned 5 [0046.821] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.doc") returned 0 [0046.821] lstrlenA (lpString="*.doc") returned 5 [0046.821] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.docx") returned 0 [0046.821] lstrlenA (lpString="*.docx") returned 6 [0046.821] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.xls") returned 0 [0046.821] lstrlenA (lpString="*.xls") returned 5 [0046.821] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.xlsx") returned 0 [0046.821] lstrlenA (lpString="*.xlsx") returned 6 [0046.821] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.ppt") returned 0 [0046.821] lstrlenA (lpString="*.ppt") returned 5 [0046.821] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.pptx") returned 0 [0046.821] lstrlenA (lpString="*.pptx") returned 6 [0046.821] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.pdf") returned 0 [0046.821] lstrlenA (lpString="*.pdf") returned 5 [0046.821] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.mov") returned 0 [0046.821] lstrlenA (lpString="*.mov") returned 5 [0046.821] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.m2v") returned 0 [0046.822] lstrlenA (lpString="*.m2v") returned 5 [0046.822] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.3gp") returned 0 [0046.822] lstrlenA (lpString="*.3gp") returned 5 [0046.822] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.mpeg") returned 0 [0046.822] lstrlenA (lpString="*.mpeg") returned 6 [0046.822] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.mpg") returned 0 [0046.822] lstrlenA (lpString="*.mpg") returned 5 [0046.822] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.flv") returned 0 [0046.822] lstrlenA (lpString="*.flv") returned 5 [0046.822] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.avi") returned 0 [0046.822] lstrlenA (lpString="*.avi") returned 5 [0046.822] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.mp4") returned 0 [0046.822] lstrlenA (lpString="*.mp4") returned 5 [0046.822] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.wmv") returned 0 [0046.822] lstrlenA (lpString="*.wmv") returned 5 [0046.822] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.divx") returned 0 [0046.822] lstrlenA (lpString="*.divx") returned 6 [0046.822] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.mkv") returned 0 [0046.822] lstrlenA (lpString="*.mkv") returned 5 [0046.822] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.mp3") returned 0 [0046.822] lstrlenA (lpString="*.mp3") returned 5 [0046.822] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.wav") returned 0 [0046.822] lstrlenA (lpString="*.wav") returned 5 [0046.822] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.flac") returned 0 [0046.822] lstrlenA (lpString="*.flac") returned 6 [0046.822] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.ape") returned 0 [0046.822] lstrlenA (lpString="*.ape") returned 5 [0046.823] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.wma") returned 0 [0046.823] lstrlenA (lpString="*.wma") returned 5 [0046.823] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.ac3") returned 0 [0046.823] lstrlenA (lpString="*.ac3") returned 5 [0046.823] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", pszSpec="*.mxf") returned 0 [0046.823] lstrlenA (lpString="*.mxf") returned 5 [0046.823] FindNextFileA (in: hFindFile=0x2d9050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x2da390, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0046.823] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0046.823] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proof.msi") returned -1 [0046.823] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.msi") returned -1 [0046.823] lstrcmpiA (lpString1="", lpString2="Proof.msi") returned -1 [0046.823] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned="Proof.cab" [0046.823] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\" [0046.823] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\") returned="" [0046.823] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt" [0046.823] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\how to decrypt files.txt")) returned 0x2020 [0046.823] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpString2="Proof.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" [0046.823] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.zip") returned 0 [0046.823] lstrlenA (lpString="*.zip") returned 5 [0046.823] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.rar") returned 0 [0046.823] lstrlenA (lpString="*.rar") returned 5 [0046.823] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.7z") returned 0 [0046.824] lstrlenA (lpString="*.7z") returned 4 [0046.824] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.tar") returned 0 [0046.824] lstrlenA (lpString="*.tar") returned 5 [0046.824] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.gzip") returned 0 [0046.824] lstrlenA (lpString="*.gzip") returned 6 [0046.824] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.jpg") returned 0 [0046.824] lstrlenA (lpString="*.jpg") returned 5 [0046.824] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.jpeg") returned 0 [0046.824] lstrlenA (lpString="*.jpeg") returned 6 [0046.824] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.psd") returned 0 [0046.824] lstrlenA (lpString="*.psd") returned 5 [0046.824] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.gif") returned 0 [0046.824] lstrlenA (lpString="*.gif") returned 5 [0046.824] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.doc") returned 0 [0046.824] lstrlenA (lpString="*.doc") returned 5 [0046.824] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.docx") returned 0 [0046.824] lstrlenA (lpString="*.docx") returned 6 [0046.824] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.xls") returned 0 [0046.824] lstrlenA (lpString="*.xls") returned 5 [0046.824] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.xlsx") returned 0 [0046.824] lstrlenA (lpString="*.xlsx") returned 6 [0046.824] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.ppt") returned 0 [0046.824] lstrlenA (lpString="*.ppt") returned 5 [0046.824] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.pptx") returned 0 [0046.824] lstrlenA (lpString="*.pptx") returned 6 [0046.824] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.pdf") returned 0 [0046.824] lstrlenA (lpString="*.pdf") returned 5 [0046.824] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.mov") returned 0 [0046.825] lstrlenA (lpString="*.mov") returned 5 [0046.825] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.m2v") returned 0 [0046.825] lstrlenA (lpString="*.m2v") returned 5 [0046.825] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.3gp") returned 0 [0046.825] lstrlenA (lpString="*.3gp") returned 5 [0046.825] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.mpeg") returned 0 [0046.825] lstrlenA (lpString="*.mpeg") returned 6 [0046.825] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.mpg") returned 0 [0046.825] lstrlenA (lpString="*.mpg") returned 5 [0046.825] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.flv") returned 0 [0046.825] lstrlenA (lpString="*.flv") returned 5 [0046.825] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.avi") returned 0 [0046.825] lstrlenA (lpString="*.avi") returned 5 [0046.825] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.mp4") returned 0 [0046.825] lstrlenA (lpString="*.mp4") returned 5 [0046.825] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.wmv") returned 0 [0046.825] lstrlenA (lpString="*.wmv") returned 5 [0046.825] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.divx") returned 0 [0046.825] lstrlenA (lpString="*.divx") returned 6 [0046.825] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.mkv") returned 0 [0046.825] lstrlenA (lpString="*.mkv") returned 5 [0046.825] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.mp3") returned 0 [0046.825] lstrlenA (lpString="*.mp3") returned 5 [0046.825] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.wav") returned 0 [0046.825] lstrlenA (lpString="*.wav") returned 5 [0046.825] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.flac") returned 0 [0046.825] lstrlenA (lpString="*.flac") returned 6 [0046.825] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.ape") returned 0 [0046.826] lstrlenA (lpString="*.ape") returned 5 [0046.826] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.wma") returned 0 [0046.826] lstrlenA (lpString="*.wma") returned 5 [0046.826] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.ac3") returned 0 [0046.826] lstrlenA (lpString="*.ac3") returned 5 [0046.826] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", pszSpec="*.mxf") returned 0 [0046.826] lstrlenA (lpString="*.mxf") returned 5 [0046.826] FindNextFileA (in: hFindFile=0x2d9050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0046.826] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0046.826] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proof.xml") returned -1 [0046.826] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.xml") returned -1 [0046.826] lstrcmpiA (lpString1="", lpString2="Proof.xml") returned -1 [0046.826] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned="Proof.msi" [0046.826] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\" [0046.826] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\") returned="" [0046.826] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt" [0046.827] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\how to decrypt files.txt")) returned 0x2020 [0046.827] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpString2="Proof.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" [0046.827] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.zip") returned 0 [0046.827] lstrlenA (lpString="*.zip") returned 5 [0046.827] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.rar") returned 0 [0046.827] lstrlenA (lpString="*.rar") returned 5 [0046.827] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.7z") returned 0 [0046.827] lstrlenA (lpString="*.7z") returned 4 [0046.827] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.tar") returned 0 [0046.827] lstrlenA (lpString="*.tar") returned 5 [0046.827] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.gzip") returned 0 [0046.827] lstrlenA (lpString="*.gzip") returned 6 [0046.827] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.jpg") returned 0 [0046.827] lstrlenA (lpString="*.jpg") returned 5 [0046.827] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.jpeg") returned 0 [0046.827] lstrlenA (lpString="*.jpeg") returned 6 [0046.827] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.psd") returned 0 [0046.827] lstrlenA (lpString="*.psd") returned 5 [0046.827] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.gif") returned 0 [0046.827] lstrlenA (lpString="*.gif") returned 5 [0046.827] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.doc") returned 0 [0046.827] lstrlenA (lpString="*.doc") returned 5 [0046.827] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.docx") returned 0 [0046.827] lstrlenA (lpString="*.docx") returned 6 [0046.827] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.xls") returned 0 [0046.828] lstrlenA (lpString="*.xls") returned 5 [0046.828] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.xlsx") returned 0 [0046.828] lstrlenA (lpString="*.xlsx") returned 6 [0046.828] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.ppt") returned 0 [0046.828] lstrlenA (lpString="*.ppt") returned 5 [0046.828] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.pptx") returned 0 [0046.828] lstrlenA (lpString="*.pptx") returned 6 [0046.828] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.pdf") returned 0 [0046.828] lstrlenA (lpString="*.pdf") returned 5 [0046.828] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.mov") returned 0 [0046.828] lstrlenA (lpString="*.mov") returned 5 [0046.828] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.m2v") returned 0 [0046.828] lstrlenA (lpString="*.m2v") returned 5 [0046.828] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.3gp") returned 0 [0046.828] lstrlenA (lpString="*.3gp") returned 5 [0046.828] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.mpeg") returned 0 [0046.828] lstrlenA (lpString="*.mpeg") returned 6 [0046.828] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.mpg") returned 0 [0046.828] lstrlenA (lpString="*.mpg") returned 5 [0046.828] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.flv") returned 0 [0046.828] lstrlenA (lpString="*.flv") returned 5 [0046.828] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.avi") returned 0 [0046.828] lstrlenA (lpString="*.avi") returned 5 [0046.828] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.mp4") returned 0 [0046.828] lstrlenA (lpString="*.mp4") returned 5 [0046.828] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.wmv") returned 0 [0046.828] lstrlenA (lpString="*.wmv") returned 5 [0046.828] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.divx") returned 0 [0046.829] lstrlenA (lpString="*.divx") returned 6 [0046.829] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.mkv") returned 0 [0046.829] lstrlenA (lpString="*.mkv") returned 5 [0046.829] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.mp3") returned 0 [0046.829] lstrlenA (lpString="*.mp3") returned 5 [0046.829] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.wav") returned 0 [0046.829] lstrlenA (lpString="*.wav") returned 5 [0046.829] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.flac") returned 0 [0046.829] lstrlenA (lpString="*.flac") returned 6 [0046.829] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.ape") returned 0 [0046.829] lstrlenA (lpString="*.ape") returned 5 [0046.829] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.wma") returned 0 [0046.829] lstrlenA (lpString="*.wma") returned 5 [0046.829] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.ac3") returned 0 [0046.829] lstrlenA (lpString="*.ac3") returned 5 [0046.829] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", pszSpec="*.mxf") returned 0 [0046.829] lstrlenA (lpString="*.mxf") returned 5 [0046.829] FindNextFileA (in: hFindFile=0x2d9050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0046.829] FindClose (in: hFindFile=0x2d9050 | out: hFindFile=0x2d9050) returned 1 [0046.829] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0046.829] lstrcmpA (lpString1=".", lpString2="Proof.es") returned -1 [0046.829] lstrcmpA (lpString1="..", lpString2="Proof.es") returned -1 [0046.829] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0046.830] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="Proof.es" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es" [0046.830] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es") returned 71 [0046.830] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540050, dwReserved1=0x460020, cFileName=".", cAlternateFileName="")) returned 0x2d9050 [0046.831] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.831] FindNextFileA (in: hFindFile=0x2d9050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x460000, cFileName="..", cAlternateFileName="")) returned 1 [0046.831] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.831] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.831] FindNextFileA (in: hFindFile=0x2d9050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0046.831] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0046.831] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proof.cab") returned -1 [0046.831] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.cab") returned -1 [0046.831] lstrcmpiA (lpString1="", lpString2="Proof.cab") returned -1 [0046.831] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*.*") returned="*.*" [0046.831] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\" [0046.831] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\") returned="" [0046.831] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt" [0046.831] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\how to decrypt files.txt")) returned 0xffffffff [0046.831] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0046.832] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.832] WriteFile (in: hFile=0x8c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.833] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.834] CloseHandle (hObject=0x8c) returned 1 [0046.834] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpString2="Proof.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" [0046.834] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.zip") returned 0 [0046.834] lstrlenA (lpString="*.zip") returned 5 [0046.834] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.rar") returned 0 [0046.834] lstrlenA (lpString="*.rar") returned 5 [0046.834] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.7z") returned 0 [0046.834] lstrlenA (lpString="*.7z") returned 4 [0046.834] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.tar") returned 0 [0046.834] lstrlenA (lpString="*.tar") returned 5 [0046.834] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.gzip") returned 0 [0046.834] lstrlenA (lpString="*.gzip") returned 6 [0046.834] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.jpg") returned 0 [0046.834] lstrlenA (lpString="*.jpg") returned 5 [0046.834] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.jpeg") returned 0 [0046.834] lstrlenA (lpString="*.jpeg") returned 6 [0046.834] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.psd") returned 0 [0046.834] lstrlenA (lpString="*.psd") returned 5 [0046.834] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.gif") returned 0 [0046.835] lstrlenA (lpString="*.gif") returned 5 [0046.835] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.doc") returned 0 [0046.835] lstrlenA (lpString="*.doc") returned 5 [0046.835] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.docx") returned 0 [0046.835] lstrlenA (lpString="*.docx") returned 6 [0046.835] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.xls") returned 0 [0046.835] lstrlenA (lpString="*.xls") returned 5 [0046.835] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.xlsx") returned 0 [0046.835] lstrlenA (lpString="*.xlsx") returned 6 [0046.835] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.ppt") returned 0 [0046.835] lstrlenA (lpString="*.ppt") returned 5 [0046.835] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.pptx") returned 0 [0046.835] lstrlenA (lpString="*.pptx") returned 6 [0046.835] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.pdf") returned 0 [0046.835] lstrlenA (lpString="*.pdf") returned 5 [0046.835] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.mov") returned 0 [0046.835] lstrlenA (lpString="*.mov") returned 5 [0046.835] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.m2v") returned 0 [0046.835] lstrlenA (lpString="*.m2v") returned 5 [0046.835] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.3gp") returned 0 [0046.835] lstrlenA (lpString="*.3gp") returned 5 [0046.835] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.mpeg") returned 0 [0046.835] lstrlenA (lpString="*.mpeg") returned 6 [0046.835] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.mpg") returned 0 [0046.835] lstrlenA (lpString="*.mpg") returned 5 [0046.835] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.flv") returned 0 [0046.835] lstrlenA (lpString="*.flv") returned 5 [0046.835] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.avi") returned 0 [0046.835] lstrlenA (lpString="*.avi") returned 5 [0046.835] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.mp4") returned 0 [0046.836] lstrlenA (lpString="*.mp4") returned 5 [0046.836] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.wmv") returned 0 [0046.836] lstrlenA (lpString="*.wmv") returned 5 [0046.836] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.divx") returned 0 [0046.836] lstrlenA (lpString="*.divx") returned 6 [0046.836] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.mkv") returned 0 [0046.836] lstrlenA (lpString="*.mkv") returned 5 [0046.836] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.mp3") returned 0 [0046.836] lstrlenA (lpString="*.mp3") returned 5 [0046.836] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.wav") returned 0 [0046.836] lstrlenA (lpString="*.wav") returned 5 [0046.836] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.flac") returned 0 [0046.836] lstrlenA (lpString="*.flac") returned 6 [0046.836] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.ape") returned 0 [0046.836] lstrlenA (lpString="*.ape") returned 5 [0046.836] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.wma") returned 0 [0046.836] lstrlenA (lpString="*.wma") returned 5 [0046.836] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.ac3") returned 0 [0046.836] lstrlenA (lpString="*.ac3") returned 5 [0046.836] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", pszSpec="*.mxf") returned 0 [0046.836] lstrlenA (lpString="*.mxf") returned 5 [0046.836] FindNextFileA (in: hFindFile=0x2d9050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x2da390, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0046.836] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0046.836] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proof.msi") returned -1 [0046.836] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.msi") returned -1 [0046.836] lstrcmpiA (lpString1="", lpString2="Proof.msi") returned -1 [0046.836] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned="Proof.cab" [0046.836] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\" [0046.836] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\") returned="" [0046.836] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt" [0046.836] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\how to decrypt files.txt")) returned 0x2020 [0046.837] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpString2="Proof.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" [0046.837] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.zip") returned 0 [0046.837] lstrlenA (lpString="*.zip") returned 5 [0046.837] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.rar") returned 0 [0046.837] lstrlenA (lpString="*.rar") returned 5 [0046.837] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.7z") returned 0 [0046.837] lstrlenA (lpString="*.7z") returned 4 [0046.837] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.tar") returned 0 [0046.837] lstrlenA (lpString="*.tar") returned 5 [0046.837] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.gzip") returned 0 [0046.837] lstrlenA (lpString="*.gzip") returned 6 [0046.837] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.jpg") returned 0 [0046.837] lstrlenA (lpString="*.jpg") returned 5 [0046.837] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.jpeg") returned 0 [0046.837] lstrlenA (lpString="*.jpeg") returned 6 [0046.837] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.psd") returned 0 [0046.837] lstrlenA (lpString="*.psd") returned 5 [0046.837] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.gif") returned 0 [0046.837] lstrlenA (lpString="*.gif") returned 5 [0046.837] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.doc") returned 0 [0046.837] lstrlenA (lpString="*.doc") returned 5 [0046.837] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.docx") returned 0 [0046.837] lstrlenA (lpString="*.docx") returned 6 [0046.837] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.xls") returned 0 [0046.837] lstrlenA (lpString="*.xls") returned 5 [0046.837] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.xlsx") returned 0 [0046.838] lstrlenA (lpString="*.xlsx") returned 6 [0046.838] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.ppt") returned 0 [0046.838] lstrlenA (lpString="*.ppt") returned 5 [0046.838] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.pptx") returned 0 [0046.838] lstrlenA (lpString="*.pptx") returned 6 [0046.838] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.pdf") returned 0 [0046.838] lstrlenA (lpString="*.pdf") returned 5 [0046.838] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.mov") returned 0 [0046.838] lstrlenA (lpString="*.mov") returned 5 [0046.838] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.m2v") returned 0 [0046.838] lstrlenA (lpString="*.m2v") returned 5 [0046.838] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.3gp") returned 0 [0046.838] lstrlenA (lpString="*.3gp") returned 5 [0046.838] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.mpeg") returned 0 [0046.838] lstrlenA (lpString="*.mpeg") returned 6 [0046.838] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.mpg") returned 0 [0046.838] lstrlenA (lpString="*.mpg") returned 5 [0046.838] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.flv") returned 0 [0046.838] lstrlenA (lpString="*.flv") returned 5 [0046.838] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.avi") returned 0 [0046.838] lstrlenA (lpString="*.avi") returned 5 [0046.838] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.mp4") returned 0 [0046.838] lstrlenA (lpString="*.mp4") returned 5 [0046.838] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.wmv") returned 0 [0046.838] lstrlenA (lpString="*.wmv") returned 5 [0046.838] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.divx") returned 0 [0046.839] lstrlenA (lpString="*.divx") returned 6 [0046.839] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.mkv") returned 0 [0046.839] lstrlenA (lpString="*.mkv") returned 5 [0046.839] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.mp3") returned 0 [0046.839] lstrlenA (lpString="*.mp3") returned 5 [0046.839] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.wav") returned 0 [0046.839] lstrlenA (lpString="*.wav") returned 5 [0046.839] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.flac") returned 0 [0046.839] lstrlenA (lpString="*.flac") returned 6 [0046.839] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.ape") returned 0 [0046.839] lstrlenA (lpString="*.ape") returned 5 [0046.839] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.wma") returned 0 [0046.839] lstrlenA (lpString="*.wma") returned 5 [0046.839] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.ac3") returned 0 [0046.839] lstrlenA (lpString="*.ac3") returned 5 [0046.839] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", pszSpec="*.mxf") returned 0 [0046.839] lstrlenA (lpString="*.mxf") returned 5 [0046.839] FindNextFileA (in: hFindFile=0x2d9050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0046.839] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0046.839] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proof.xml") returned -1 [0046.839] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.xml") returned -1 [0046.839] lstrcmpiA (lpString1="", lpString2="Proof.xml") returned -1 [0046.839] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned="Proof.msi" [0046.839] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\" [0046.839] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\") returned="" [0046.840] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt" [0046.840] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\how to decrypt files.txt")) returned 0x2020 [0046.840] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpString2="Proof.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" [0046.840] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.zip") returned 0 [0046.840] lstrlenA (lpString="*.zip") returned 5 [0046.840] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.rar") returned 0 [0046.840] lstrlenA (lpString="*.rar") returned 5 [0046.840] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.7z") returned 0 [0046.840] lstrlenA (lpString="*.7z") returned 4 [0046.840] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.tar") returned 0 [0046.840] lstrlenA (lpString="*.tar") returned 5 [0046.840] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.gzip") returned 0 [0046.840] lstrlenA (lpString="*.gzip") returned 6 [0046.840] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.jpg") returned 0 [0046.840] lstrlenA (lpString="*.jpg") returned 5 [0046.840] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.jpeg") returned 0 [0046.840] lstrlenA (lpString="*.jpeg") returned 6 [0046.840] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.psd") returned 0 [0046.840] lstrlenA (lpString="*.psd") returned 5 [0046.840] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.gif") returned 0 [0046.840] lstrlenA (lpString="*.gif") returned 5 [0046.841] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.doc") returned 0 [0046.841] lstrlenA (lpString="*.doc") returned 5 [0046.841] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.docx") returned 0 [0046.841] lstrlenA (lpString="*.docx") returned 6 [0046.841] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.xls") returned 0 [0046.841] lstrlenA (lpString="*.xls") returned 5 [0046.841] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.xlsx") returned 0 [0046.841] lstrlenA (lpString="*.xlsx") returned 6 [0046.841] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.ppt") returned 0 [0046.841] lstrlenA (lpString="*.ppt") returned 5 [0046.841] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.pptx") returned 0 [0046.841] lstrlenA (lpString="*.pptx") returned 6 [0046.841] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.pdf") returned 0 [0046.841] lstrlenA (lpString="*.pdf") returned 5 [0046.841] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.mov") returned 0 [0046.841] lstrlenA (lpString="*.mov") returned 5 [0046.841] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.m2v") returned 0 [0046.842] lstrlenA (lpString="*.m2v") returned 5 [0046.842] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.3gp") returned 0 [0046.842] lstrlenA (lpString="*.3gp") returned 5 [0046.842] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.mpeg") returned 0 [0046.842] lstrlenA (lpString="*.mpeg") returned 6 [0046.842] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.mpg") returned 0 [0046.842] lstrlenA (lpString="*.mpg") returned 5 [0046.842] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.flv") returned 0 [0046.842] lstrlenA (lpString="*.flv") returned 5 [0046.842] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.avi") returned 0 [0046.842] lstrlenA (lpString="*.avi") returned 5 [0046.843] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.mp4") returned 0 [0046.843] lstrlenA (lpString="*.mp4") returned 5 [0046.843] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.wmv") returned 0 [0046.843] lstrlenA (lpString="*.wmv") returned 5 [0046.843] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.divx") returned 0 [0046.843] lstrlenA (lpString="*.divx") returned 6 [0046.843] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.mkv") returned 0 [0046.843] lstrlenA (lpString="*.mkv") returned 5 [0046.843] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.mp3") returned 0 [0046.843] lstrlenA (lpString="*.mp3") returned 5 [0046.843] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.wav") returned 0 [0046.843] lstrlenA (lpString="*.wav") returned 5 [0046.843] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.flac") returned 0 [0046.843] lstrlenA (lpString="*.flac") returned 6 [0046.843] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.ape") returned 0 [0046.843] lstrlenA (lpString="*.ape") returned 5 [0046.843] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.wma") returned 0 [0046.843] lstrlenA (lpString="*.wma") returned 5 [0046.843] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.ac3") returned 0 [0046.843] lstrlenA (lpString="*.ac3") returned 5 [0046.843] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", pszSpec="*.mxf") returned 0 [0046.843] lstrlenA (lpString="*.mxf") returned 5 [0046.843] FindNextFileA (in: hFindFile=0x2d9050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0046.843] FindClose (in: hFindFile=0x2d9050 | out: hFindFile=0x2d9050) returned 1 [0046.844] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0046.844] lstrcmpA (lpString1=".", lpString2="Proof.fr") returned -1 [0046.844] lstrcmpA (lpString1="..", lpString2="Proof.fr") returned -1 [0046.844] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0046.844] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="Proof.fr" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr" [0046.844] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr") returned 71 [0046.844] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540050, dwReserved1=0x460020, cFileName=".", cAlternateFileName="")) returned 0x2d9050 [0046.844] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.844] FindNextFileA (in: hFindFile=0x2d9050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x460000, cFileName="..", cAlternateFileName="")) returned 1 [0046.844] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.845] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.845] FindNextFileA (in: hFindFile=0x2d9050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0046.845] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0046.845] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proof.cab") returned -1 [0046.845] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.cab") returned -1 [0046.845] lstrcmpiA (lpString1="", lpString2="Proof.cab") returned -1 [0046.845] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*.*") returned="*.*" [0046.845] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\" [0046.845] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\") returned="" [0046.845] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt" [0046.845] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\how to decrypt files.txt")) returned 0xffffffff [0046.845] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0046.845] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.845] WriteFile (in: hFile=0x8c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.847] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.847] CloseHandle (hObject=0x8c) returned 1 [0046.847] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpString2="Proof.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" [0046.847] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.zip") returned 0 [0046.847] lstrlenA (lpString="*.zip") returned 5 [0046.847] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.rar") returned 0 [0046.847] lstrlenA (lpString="*.rar") returned 5 [0046.847] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.7z") returned 0 [0046.847] lstrlenA (lpString="*.7z") returned 4 [0046.847] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.tar") returned 0 [0046.847] lstrlenA (lpString="*.tar") returned 5 [0046.848] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.gzip") returned 0 [0046.848] lstrlenA (lpString="*.gzip") returned 6 [0046.848] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.jpg") returned 0 [0046.848] lstrlenA (lpString="*.jpg") returned 5 [0046.848] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.jpeg") returned 0 [0046.848] lstrlenA (lpString="*.jpeg") returned 6 [0046.848] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.psd") returned 0 [0046.848] lstrlenA (lpString="*.psd") returned 5 [0046.848] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.gif") returned 0 [0046.848] lstrlenA (lpString="*.gif") returned 5 [0046.848] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.doc") returned 0 [0046.848] lstrlenA (lpString="*.doc") returned 5 [0046.848] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.docx") returned 0 [0046.848] lstrlenA (lpString="*.docx") returned 6 [0046.848] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.xls") returned 0 [0046.848] lstrlenA (lpString="*.xls") returned 5 [0046.848] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.xlsx") returned 0 [0046.848] lstrlenA (lpString="*.xlsx") returned 6 [0046.848] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.ppt") returned 0 [0046.848] lstrlenA (lpString="*.ppt") returned 5 [0046.848] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.pptx") returned 0 [0046.848] lstrlenA (lpString="*.pptx") returned 6 [0046.848] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.pdf") returned 0 [0046.848] lstrlenA (lpString="*.pdf") returned 5 [0046.848] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.mov") returned 0 [0046.849] lstrlenA (lpString="*.mov") returned 5 [0046.849] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.m2v") returned 0 [0046.849] lstrlenA (lpString="*.m2v") returned 5 [0046.849] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.3gp") returned 0 [0046.849] lstrlenA (lpString="*.3gp") returned 5 [0046.849] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.mpeg") returned 0 [0046.849] lstrlenA (lpString="*.mpeg") returned 6 [0046.849] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.mpg") returned 0 [0046.849] lstrlenA (lpString="*.mpg") returned 5 [0046.849] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.flv") returned 0 [0046.849] lstrlenA (lpString="*.flv") returned 5 [0046.849] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.avi") returned 0 [0046.849] lstrlenA (lpString="*.avi") returned 5 [0046.849] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.mp4") returned 0 [0046.849] lstrlenA (lpString="*.mp4") returned 5 [0046.849] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.wmv") returned 0 [0046.849] lstrlenA (lpString="*.wmv") returned 5 [0046.849] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.divx") returned 0 [0046.849] lstrlenA (lpString="*.divx") returned 6 [0046.849] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.mkv") returned 0 [0046.849] lstrlenA (lpString="*.mkv") returned 5 [0046.849] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.mp3") returned 0 [0046.849] lstrlenA (lpString="*.mp3") returned 5 [0046.849] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.wav") returned 0 [0046.849] lstrlenA (lpString="*.wav") returned 5 [0046.849] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.flac") returned 0 [0046.849] lstrlenA (lpString="*.flac") returned 6 [0046.850] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.ape") returned 0 [0046.850] lstrlenA (lpString="*.ape") returned 5 [0046.850] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.wma") returned 0 [0046.850] lstrlenA (lpString="*.wma") returned 5 [0046.850] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.ac3") returned 0 [0046.850] lstrlenA (lpString="*.ac3") returned 5 [0046.850] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", pszSpec="*.mxf") returned 0 [0046.850] lstrlenA (lpString="*.mxf") returned 5 [0046.850] FindNextFileA (in: hFindFile=0x2d9050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x2da390, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0046.850] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0046.850] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proof.msi") returned -1 [0046.850] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.msi") returned -1 [0046.850] lstrcmpiA (lpString1="", lpString2="Proof.msi") returned -1 [0046.850] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned="Proof.cab" [0046.850] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\" [0046.850] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\") returned="" [0046.850] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt" [0046.850] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\how to decrypt files.txt")) returned 0x2020 [0046.850] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpString2="Proof.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" [0046.850] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.zip") returned 0 [0046.850] lstrlenA (lpString="*.zip") returned 5 [0046.851] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.rar") returned 0 [0046.851] lstrlenA (lpString="*.rar") returned 5 [0046.851] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.7z") returned 0 [0046.851] lstrlenA (lpString="*.7z") returned 4 [0046.851] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.tar") returned 0 [0046.851] lstrlenA (lpString="*.tar") returned 5 [0046.851] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.gzip") returned 0 [0046.851] lstrlenA (lpString="*.gzip") returned 6 [0046.851] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.jpg") returned 0 [0046.851] lstrlenA (lpString="*.jpg") returned 5 [0046.851] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.jpeg") returned 0 [0046.851] lstrlenA (lpString="*.jpeg") returned 6 [0046.851] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.psd") returned 0 [0046.851] lstrlenA (lpString="*.psd") returned 5 [0046.851] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.gif") returned 0 [0046.851] lstrlenA (lpString="*.gif") returned 5 [0046.851] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.doc") returned 0 [0046.851] lstrlenA (lpString="*.doc") returned 5 [0046.851] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.docx") returned 0 [0046.851] lstrlenA (lpString="*.docx") returned 6 [0046.851] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.xls") returned 0 [0046.851] lstrlenA (lpString="*.xls") returned 5 [0046.851] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.xlsx") returned 0 [0046.851] lstrlenA (lpString="*.xlsx") returned 6 [0046.851] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.ppt") returned 0 [0046.851] lstrlenA (lpString="*.ppt") returned 5 [0046.852] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.pptx") returned 0 [0046.852] lstrlenA (lpString="*.pptx") returned 6 [0046.852] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.pdf") returned 0 [0046.852] lstrlenA (lpString="*.pdf") returned 5 [0046.852] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.mov") returned 0 [0046.852] lstrlenA (lpString="*.mov") returned 5 [0046.852] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.m2v") returned 0 [0046.852] lstrlenA (lpString="*.m2v") returned 5 [0046.852] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.3gp") returned 0 [0046.852] lstrlenA (lpString="*.3gp") returned 5 [0046.852] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.mpeg") returned 0 [0046.852] lstrlenA (lpString="*.mpeg") returned 6 [0046.852] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.mpg") returned 0 [0046.852] lstrlenA (lpString="*.mpg") returned 5 [0046.852] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.flv") returned 0 [0046.852] lstrlenA (lpString="*.flv") returned 5 [0046.852] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.avi") returned 0 [0046.852] lstrlenA (lpString="*.avi") returned 5 [0046.852] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.mp4") returned 0 [0046.852] lstrlenA (lpString="*.mp4") returned 5 [0046.852] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.wmv") returned 0 [0046.852] lstrlenA (lpString="*.wmv") returned 5 [0046.852] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.divx") returned 0 [0046.852] lstrlenA (lpString="*.divx") returned 6 [0046.852] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.mkv") returned 0 [0046.852] lstrlenA (lpString="*.mkv") returned 5 [0046.853] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.mp3") returned 0 [0046.853] lstrlenA (lpString="*.mp3") returned 5 [0046.853] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.wav") returned 0 [0046.853] lstrlenA (lpString="*.wav") returned 5 [0046.853] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.flac") returned 0 [0046.853] lstrlenA (lpString="*.flac") returned 6 [0046.853] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.ape") returned 0 [0046.853] lstrlenA (lpString="*.ape") returned 5 [0046.853] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.wma") returned 0 [0046.853] lstrlenA (lpString="*.wma") returned 5 [0046.853] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.ac3") returned 0 [0046.853] lstrlenA (lpString="*.ac3") returned 5 [0046.853] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", pszSpec="*.mxf") returned 0 [0046.853] lstrlenA (lpString="*.mxf") returned 5 [0046.853] FindNextFileA (in: hFindFile=0x2d9050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0046.853] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0046.853] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proof.xml") returned -1 [0046.853] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.xml") returned -1 [0046.853] lstrcmpiA (lpString1="", lpString2="Proof.xml") returned -1 [0046.853] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned="Proof.msi" [0046.853] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\" [0046.853] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\") returned="" [0046.853] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt" [0046.853] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\how to decrypt files.txt")) returned 0x2020 [0046.854] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpString2="Proof.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" [0046.854] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.zip") returned 0 [0046.854] lstrlenA (lpString="*.zip") returned 5 [0046.854] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.rar") returned 0 [0046.854] lstrlenA (lpString="*.rar") returned 5 [0046.854] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.7z") returned 0 [0046.854] lstrlenA (lpString="*.7z") returned 4 [0046.854] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.tar") returned 0 [0046.854] lstrlenA (lpString="*.tar") returned 5 [0046.854] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.gzip") returned 0 [0046.854] lstrlenA (lpString="*.gzip") returned 6 [0046.854] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.jpg") returned 0 [0046.854] lstrlenA (lpString="*.jpg") returned 5 [0046.854] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.jpeg") returned 0 [0046.854] lstrlenA (lpString="*.jpeg") returned 6 [0046.854] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.psd") returned 0 [0046.854] lstrlenA (lpString="*.psd") returned 5 [0046.854] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.gif") returned 0 [0046.854] lstrlenA (lpString="*.gif") returned 5 [0046.854] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.doc") returned 0 [0046.854] lstrlenA (lpString="*.doc") returned 5 [0046.854] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.docx") returned 0 [0046.854] lstrlenA (lpString="*.docx") returned 6 [0046.854] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.xls") returned 0 [0046.854] lstrlenA (lpString="*.xls") returned 5 [0046.854] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.xlsx") returned 0 [0046.855] lstrlenA (lpString="*.xlsx") returned 6 [0046.855] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.ppt") returned 0 [0046.855] lstrlenA (lpString="*.ppt") returned 5 [0046.855] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.pptx") returned 0 [0046.855] lstrlenA (lpString="*.pptx") returned 6 [0046.855] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.pdf") returned 0 [0046.855] lstrlenA (lpString="*.pdf") returned 5 [0046.855] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.mov") returned 0 [0046.855] lstrlenA (lpString="*.mov") returned 5 [0046.855] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.m2v") returned 0 [0046.855] lstrlenA (lpString="*.m2v") returned 5 [0046.855] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.3gp") returned 0 [0046.855] lstrlenA (lpString="*.3gp") returned 5 [0046.855] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.mpeg") returned 0 [0046.855] lstrlenA (lpString="*.mpeg") returned 6 [0046.855] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.mpg") returned 0 [0046.855] lstrlenA (lpString="*.mpg") returned 5 [0046.855] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.flv") returned 0 [0046.855] lstrlenA (lpString="*.flv") returned 5 [0046.855] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.avi") returned 0 [0046.855] lstrlenA (lpString="*.avi") returned 5 [0046.855] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.mp4") returned 0 [0046.855] lstrlenA (lpString="*.mp4") returned 5 [0046.855] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.wmv") returned 0 [0046.855] lstrlenA (lpString="*.wmv") returned 5 [0046.855] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.divx") returned 0 [0046.855] lstrlenA (lpString="*.divx") returned 6 [0046.856] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.mkv") returned 0 [0046.856] lstrlenA (lpString="*.mkv") returned 5 [0046.856] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.mp3") returned 0 [0046.856] lstrlenA (lpString="*.mp3") returned 5 [0046.856] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.wav") returned 0 [0046.856] lstrlenA (lpString="*.wav") returned 5 [0046.856] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.flac") returned 0 [0046.856] lstrlenA (lpString="*.flac") returned 6 [0046.856] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.ape") returned 0 [0046.856] lstrlenA (lpString="*.ape") returned 5 [0046.856] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.wma") returned 0 [0046.856] lstrlenA (lpString="*.wma") returned 5 [0046.856] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.ac3") returned 0 [0046.856] lstrlenA (lpString="*.ac3") returned 5 [0046.856] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", pszSpec="*.mxf") returned 0 [0046.856] lstrlenA (lpString="*.mxf") returned 5 [0046.856] FindNextFileA (in: hFindFile=0x2d9050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0046.856] FindClose (in: hFindFile=0x2d9050 | out: hFindFile=0x2d9050) returned 1 [0046.856] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0046.856] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.856] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proofing.msi") returned -1 [0046.856] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proofing.msi") returned -1 [0046.856] lstrcmpiA (lpString1="", lpString2="Proofing.msi") returned -1 [0046.857] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0046.857] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\" [0046.857] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\") returned="" [0046.857] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.857] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0046.857] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0046.858] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.858] WriteFile (in: hFile=0x88, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.859] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.859] CloseHandle (hObject=0x88) returned 1 [0046.859] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="Proofing.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" [0046.859] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.zip") returned 0 [0046.859] lstrlenA (lpString="*.zip") returned 5 [0046.859] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.rar") returned 0 [0046.859] lstrlenA (lpString="*.rar") returned 5 [0046.860] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.7z") returned 0 [0046.860] lstrlenA (lpString="*.7z") returned 4 [0046.860] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.tar") returned 0 [0046.860] lstrlenA (lpString="*.tar") returned 5 [0046.860] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.gzip") returned 0 [0046.860] lstrlenA (lpString="*.gzip") returned 6 [0046.860] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.jpg") returned 0 [0046.860] lstrlenA (lpString="*.jpg") returned 5 [0046.860] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.jpeg") returned 0 [0046.860] lstrlenA (lpString="*.jpeg") returned 6 [0046.860] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.psd") returned 0 [0046.860] lstrlenA (lpString="*.psd") returned 5 [0046.860] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.gif") returned 0 [0046.860] lstrlenA (lpString="*.gif") returned 5 [0046.860] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.doc") returned 0 [0046.860] lstrlenA (lpString="*.doc") returned 5 [0046.860] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.docx") returned 0 [0046.860] lstrlenA (lpString="*.docx") returned 6 [0046.860] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.xls") returned 0 [0046.860] lstrlenA (lpString="*.xls") returned 5 [0046.860] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.xlsx") returned 0 [0046.860] lstrlenA (lpString="*.xlsx") returned 6 [0046.860] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.ppt") returned 0 [0046.860] lstrlenA (lpString="*.ppt") returned 5 [0046.860] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.pptx") returned 0 [0046.860] lstrlenA (lpString="*.pptx") returned 6 [0046.860] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.pdf") returned 0 [0046.860] lstrlenA (lpString="*.pdf") returned 5 [0046.861] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.mov") returned 0 [0046.861] lstrlenA (lpString="*.mov") returned 5 [0046.861] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.m2v") returned 0 [0046.861] lstrlenA (lpString="*.m2v") returned 5 [0046.861] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.3gp") returned 0 [0046.861] lstrlenA (lpString="*.3gp") returned 5 [0046.861] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.mpeg") returned 0 [0046.861] lstrlenA (lpString="*.mpeg") returned 6 [0046.861] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.mpg") returned 0 [0046.861] lstrlenA (lpString="*.mpg") returned 5 [0046.861] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.flv") returned 0 [0046.861] lstrlenA (lpString="*.flv") returned 5 [0046.861] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.avi") returned 0 [0046.861] lstrlenA (lpString="*.avi") returned 5 [0046.861] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.mp4") returned 0 [0046.861] lstrlenA (lpString="*.mp4") returned 5 [0046.861] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.wmv") returned 0 [0046.861] lstrlenA (lpString="*.wmv") returned 5 [0046.861] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.divx") returned 0 [0046.861] lstrlenA (lpString="*.divx") returned 6 [0046.861] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.mkv") returned 0 [0046.861] lstrlenA (lpString="*.mkv") returned 5 [0046.861] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.mp3") returned 0 [0046.861] lstrlenA (lpString="*.mp3") returned 5 [0046.861] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.wav") returned 0 [0046.861] lstrlenA (lpString="*.wav") returned 5 [0046.861] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.flac") returned 0 [0046.861] lstrlenA (lpString="*.flac") returned 6 [0046.862] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.ape") returned 0 [0046.862] lstrlenA (lpString="*.ape") returned 5 [0046.862] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.wma") returned 0 [0046.862] lstrlenA (lpString="*.wma") returned 5 [0046.862] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.ac3") returned 0 [0046.862] lstrlenA (lpString="*.ac3") returned 5 [0046.862] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", pszSpec="*.mxf") returned 0 [0046.862] lstrlenA (lpString="*.mxf") returned 5 [0046.862] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x2d9290, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0046.862] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.862] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Proofing.xml") returned -1 [0046.862] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proofing.xml") returned -1 [0046.862] lstrcmpiA (lpString1="", lpString2="Proofing.xml") returned -1 [0046.862] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned="Proofing.msi" [0046.862] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\" [0046.862] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\") returned="" [0046.862] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.862] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.862] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="Proofing.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" [0046.862] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.zip") returned 0 [0046.862] lstrlenA (lpString="*.zip") returned 5 [0046.862] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.rar") returned 0 [0046.863] lstrlenA (lpString="*.rar") returned 5 [0046.863] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.7z") returned 0 [0046.863] lstrlenA (lpString="*.7z") returned 4 [0046.863] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.tar") returned 0 [0046.863] lstrlenA (lpString="*.tar") returned 5 [0046.863] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.gzip") returned 0 [0046.863] lstrlenA (lpString="*.gzip") returned 6 [0046.863] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.jpg") returned 0 [0046.863] lstrlenA (lpString="*.jpg") returned 5 [0046.863] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.jpeg") returned 0 [0046.863] lstrlenA (lpString="*.jpeg") returned 6 [0046.863] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.psd") returned 0 [0046.863] lstrlenA (lpString="*.psd") returned 5 [0046.863] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.gif") returned 0 [0046.863] lstrlenA (lpString="*.gif") returned 5 [0046.863] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.doc") returned 0 [0046.863] lstrlenA (lpString="*.doc") returned 5 [0046.863] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.docx") returned 0 [0046.863] lstrlenA (lpString="*.docx") returned 6 [0046.863] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.xls") returned 0 [0046.863] lstrlenA (lpString="*.xls") returned 5 [0046.863] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.xlsx") returned 0 [0046.863] lstrlenA (lpString="*.xlsx") returned 6 [0046.863] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.ppt") returned 0 [0046.863] lstrlenA (lpString="*.ppt") returned 5 [0046.863] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.pptx") returned 0 [0046.863] lstrlenA (lpString="*.pptx") returned 6 [0046.864] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.pdf") returned 0 [0046.864] lstrlenA (lpString="*.pdf") returned 5 [0046.864] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.mov") returned 0 [0046.864] lstrlenA (lpString="*.mov") returned 5 [0046.864] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.m2v") returned 0 [0046.864] lstrlenA (lpString="*.m2v") returned 5 [0046.864] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.3gp") returned 0 [0046.864] lstrlenA (lpString="*.3gp") returned 5 [0046.864] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.mpeg") returned 0 [0046.864] lstrlenA (lpString="*.mpeg") returned 6 [0046.864] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.mpg") returned 0 [0046.864] lstrlenA (lpString="*.mpg") returned 5 [0046.864] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.flv") returned 0 [0046.864] lstrlenA (lpString="*.flv") returned 5 [0046.864] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.avi") returned 0 [0046.864] lstrlenA (lpString="*.avi") returned 5 [0046.864] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.mp4") returned 0 [0046.864] lstrlenA (lpString="*.mp4") returned 5 [0046.864] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.wmv") returned 0 [0046.864] lstrlenA (lpString="*.wmv") returned 5 [0046.864] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.divx") returned 0 [0046.864] lstrlenA (lpString="*.divx") returned 6 [0046.864] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.mkv") returned 0 [0046.864] lstrlenA (lpString="*.mkv") returned 5 [0046.864] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.mp3") returned 0 [0046.864] lstrlenA (lpString="*.mp3") returned 5 [0046.864] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.wav") returned 0 [0046.865] lstrlenA (lpString="*.wav") returned 5 [0046.865] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.flac") returned 0 [0046.865] lstrlenA (lpString="*.flac") returned 6 [0046.865] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.ape") returned 0 [0046.865] lstrlenA (lpString="*.ape") returned 5 [0046.865] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.wma") returned 0 [0046.865] lstrlenA (lpString="*.wma") returned 5 [0046.865] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.ac3") returned 0 [0046.865] lstrlenA (lpString="*.ac3") returned 5 [0046.865] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", pszSpec="*.mxf") returned 0 [0046.865] lstrlenA (lpString="*.mxf") returned 5 [0046.865] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0046.865] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.865] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0046.865] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0046.865] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0046.865] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned="Proofing.xml" [0046.865] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\" [0046.865] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\") returned="" [0046.865] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.865] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.865] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" [0046.865] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.zip") returned 0 [0046.866] lstrlenA (lpString="*.zip") returned 5 [0046.866] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.rar") returned 0 [0046.866] lstrlenA (lpString="*.rar") returned 5 [0046.866] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.7z") returned 0 [0046.866] lstrlenA (lpString="*.7z") returned 4 [0046.866] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tar") returned 0 [0046.866] lstrlenA (lpString="*.tar") returned 5 [0046.866] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gzip") returned 0 [0046.866] lstrlenA (lpString="*.gzip") returned 6 [0046.866] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpg") returned 0 [0046.866] lstrlenA (lpString="*.jpg") returned 5 [0046.866] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpeg") returned 0 [0046.866] lstrlenA (lpString="*.jpeg") returned 6 [0046.866] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.psd") returned 0 [0046.866] lstrlenA (lpString="*.psd") returned 5 [0046.866] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gif") returned 0 [0046.866] lstrlenA (lpString="*.gif") returned 5 [0046.866] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.doc") returned 0 [0046.866] lstrlenA (lpString="*.doc") returned 5 [0046.866] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docx") returned 0 [0046.866] lstrlenA (lpString="*.docx") returned 6 [0046.866] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xls") returned 0 [0046.866] lstrlenA (lpString="*.xls") returned 5 [0046.866] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsx") returned 0 [0046.866] lstrlenA (lpString="*.xlsx") returned 6 [0046.866] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ppt") returned 0 [0046.866] lstrlenA (lpString="*.ppt") returned 5 [0046.867] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pptx") returned 0 [0046.867] lstrlenA (lpString="*.pptx") returned 6 [0046.867] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pdf") returned 0 [0046.867] lstrlenA (lpString="*.pdf") returned 5 [0046.867] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mov") returned 0 [0046.867] lstrlenA (lpString="*.mov") returned 5 [0046.867] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.m2v") returned 0 [0046.867] lstrlenA (lpString="*.m2v") returned 5 [0046.867] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.3gp") returned 0 [0046.867] lstrlenA (lpString="*.3gp") returned 5 [0046.867] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpeg") returned 0 [0046.867] lstrlenA (lpString="*.mpeg") returned 6 [0046.867] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpg") returned 0 [0046.867] lstrlenA (lpString="*.mpg") returned 5 [0046.867] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flv") returned 0 [0046.867] lstrlenA (lpString="*.flv") returned 5 [0046.867] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.avi") returned 0 [0046.867] lstrlenA (lpString="*.avi") returned 5 [0046.867] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp4") returned 0 [0046.867] lstrlenA (lpString="*.mp4") returned 5 [0046.867] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wmv") returned 0 [0046.867] lstrlenA (lpString="*.wmv") returned 5 [0046.867] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.divx") returned 0 [0046.867] lstrlenA (lpString="*.divx") returned 6 [0046.867] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mkv") returned 0 [0046.867] lstrlenA (lpString="*.mkv") returned 5 [0046.867] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp3") returned 0 [0046.868] lstrlenA (lpString="*.mp3") returned 5 [0046.868] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wav") returned 0 [0046.868] lstrlenA (lpString="*.wav") returned 5 [0046.868] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flac") returned 0 [0046.868] lstrlenA (lpString="*.flac") returned 6 [0046.868] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ape") returned 0 [0046.868] lstrlenA (lpString="*.ape") returned 5 [0046.868] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wma") returned 0 [0046.868] lstrlenA (lpString="*.wma") returned 5 [0046.868] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ac3") returned 0 [0046.868] lstrlenA (lpString="*.ac3") returned 5 [0046.868] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mxf") returned 0 [0046.868] lstrlenA (lpString="*.mxf") returned 5 [0046.868] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0046.868] FindClose (in: hFindFile=0x2d6f20 | out: hFindFile=0x2d6f20) returned 1 [0046.868] FindNextFileA (in: hFindFile=0x2d6f60, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0046.868] lstrcmpA (lpString1=".", lpString2="{90140000-0043-0409-1000-0000000FF1CE}-C") returned -1 [0046.868] lstrcmpA (lpString1="..", lpString2="{90140000-0043-0409-1000-0000000FF1CE}-C") returned -1 [0046.868] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0046.868] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0043-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C" [0046.868] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C") returned 62 [0046.868] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2d6f20 [0046.872] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.872] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.872] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.872] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.872] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0046.872] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.872] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Office32MUI.msi") returned -1 [0046.872] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office32MUI.msi") returned -1 [0046.872] lstrcmpiA (lpString1="", lpString2="Office32MUI.msi") returned -1 [0046.872] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0046.872] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" [0046.872] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned="" [0046.872] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.873] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0046.873] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0046.874] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.874] WriteFile (in: hFile=0x88, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.875] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.875] CloseHandle (hObject=0x88) returned 1 [0046.875] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="Office32MUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" [0046.875] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.zip") returned 0 [0046.875] lstrlenA (lpString="*.zip") returned 5 [0046.875] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.rar") returned 0 [0046.876] lstrlenA (lpString="*.rar") returned 5 [0046.876] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.7z") returned 0 [0046.876] lstrlenA (lpString="*.7z") returned 4 [0046.876] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.tar") returned 0 [0046.876] lstrlenA (lpString="*.tar") returned 5 [0046.876] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.gzip") returned 0 [0046.876] lstrlenA (lpString="*.gzip") returned 6 [0046.876] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.jpg") returned 0 [0046.876] lstrlenA (lpString="*.jpg") returned 5 [0046.876] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.jpeg") returned 0 [0046.876] lstrlenA (lpString="*.jpeg") returned 6 [0046.876] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.psd") returned 0 [0046.876] lstrlenA (lpString="*.psd") returned 5 [0046.876] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.gif") returned 0 [0046.876] lstrlenA (lpString="*.gif") returned 5 [0046.876] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.doc") returned 0 [0046.876] lstrlenA (lpString="*.doc") returned 5 [0046.876] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.docx") returned 0 [0046.876] lstrlenA (lpString="*.docx") returned 6 [0046.876] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.xls") returned 0 [0046.876] lstrlenA (lpString="*.xls") returned 5 [0046.876] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.xlsx") returned 0 [0046.876] lstrlenA (lpString="*.xlsx") returned 6 [0046.876] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.ppt") returned 0 [0046.876] lstrlenA (lpString="*.ppt") returned 5 [0046.876] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.pptx") returned 0 [0046.876] lstrlenA (lpString="*.pptx") returned 6 [0046.877] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.pdf") returned 0 [0046.877] lstrlenA (lpString="*.pdf") returned 5 [0046.877] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.mov") returned 0 [0046.877] lstrlenA (lpString="*.mov") returned 5 [0046.877] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.m2v") returned 0 [0046.877] lstrlenA (lpString="*.m2v") returned 5 [0046.877] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.3gp") returned 0 [0046.877] lstrlenA (lpString="*.3gp") returned 5 [0046.877] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.mpeg") returned 0 [0046.877] lstrlenA (lpString="*.mpeg") returned 6 [0046.877] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.mpg") returned 0 [0046.877] lstrlenA (lpString="*.mpg") returned 5 [0046.877] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.flv") returned 0 [0046.877] lstrlenA (lpString="*.flv") returned 5 [0046.877] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.avi") returned 0 [0046.877] lstrlenA (lpString="*.avi") returned 5 [0046.877] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.mp4") returned 0 [0046.877] lstrlenA (lpString="*.mp4") returned 5 [0046.877] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.wmv") returned 0 [0046.877] lstrlenA (lpString="*.wmv") returned 5 [0046.877] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.divx") returned 0 [0046.877] lstrlenA (lpString="*.divx") returned 6 [0046.877] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.mkv") returned 0 [0046.877] lstrlenA (lpString="*.mkv") returned 5 [0046.877] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.mp3") returned 0 [0046.877] lstrlenA (lpString="*.mp3") returned 5 [0046.877] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.wav") returned 0 [0046.878] lstrlenA (lpString="*.wav") returned 5 [0046.878] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.flac") returned 0 [0046.878] lstrlenA (lpString="*.flac") returned 6 [0046.878] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.ape") returned 0 [0046.878] lstrlenA (lpString="*.ape") returned 5 [0046.878] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.wma") returned 0 [0046.878] lstrlenA (lpString="*.wma") returned 5 [0046.878] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.ac3") returned 0 [0046.878] lstrlenA (lpString="*.ac3") returned 5 [0046.878] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", pszSpec="*.mxf") returned 0 [0046.878] lstrlenA (lpString="*.mxf") returned 5 [0046.878] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x2d9290, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0046.878] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.878] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Office32MUI.xml") returned -1 [0046.878] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office32MUI.xml") returned -1 [0046.878] lstrcmpiA (lpString1="", lpString2="Office32MUI.xml") returned -1 [0046.878] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned="Office32MUI.msi" [0046.878] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" [0046.878] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned="" [0046.878] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.878] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.878] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="Office32MUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" [0046.879] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.zip") returned 0 [0046.879] lstrlenA (lpString="*.zip") returned 5 [0046.879] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.rar") returned 0 [0046.879] lstrlenA (lpString="*.rar") returned 5 [0046.879] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.7z") returned 0 [0046.879] lstrlenA (lpString="*.7z") returned 4 [0046.879] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.tar") returned 0 [0046.879] lstrlenA (lpString="*.tar") returned 5 [0046.879] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.gzip") returned 0 [0046.879] lstrlenA (lpString="*.gzip") returned 6 [0046.879] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.jpg") returned 0 [0046.879] lstrlenA (lpString="*.jpg") returned 5 [0046.879] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.jpeg") returned 0 [0046.879] lstrlenA (lpString="*.jpeg") returned 6 [0046.879] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.psd") returned 0 [0046.879] lstrlenA (lpString="*.psd") returned 5 [0046.879] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.gif") returned 0 [0046.879] lstrlenA (lpString="*.gif") returned 5 [0046.879] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.doc") returned 0 [0046.879] lstrlenA (lpString="*.doc") returned 5 [0046.879] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.docx") returned 0 [0046.879] lstrlenA (lpString="*.docx") returned 6 [0046.879] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.xls") returned 0 [0046.879] lstrlenA (lpString="*.xls") returned 5 [0046.879] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.xlsx") returned 0 [0046.879] lstrlenA (lpString="*.xlsx") returned 6 [0046.879] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.ppt") returned 0 [0046.880] lstrlenA (lpString="*.ppt") returned 5 [0046.880] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.pptx") returned 0 [0046.880] lstrlenA (lpString="*.pptx") returned 6 [0046.880] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.pdf") returned 0 [0046.880] lstrlenA (lpString="*.pdf") returned 5 [0046.880] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.mov") returned 0 [0046.880] lstrlenA (lpString="*.mov") returned 5 [0046.880] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.m2v") returned 0 [0046.880] lstrlenA (lpString="*.m2v") returned 5 [0046.880] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.3gp") returned 0 [0046.880] lstrlenA (lpString="*.3gp") returned 5 [0046.880] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.mpeg") returned 0 [0046.880] lstrlenA (lpString="*.mpeg") returned 6 [0046.880] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.mpg") returned 0 [0046.880] lstrlenA (lpString="*.mpg") returned 5 [0046.880] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.flv") returned 0 [0046.880] lstrlenA (lpString="*.flv") returned 5 [0046.880] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.avi") returned 0 [0046.880] lstrlenA (lpString="*.avi") returned 5 [0046.880] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.mp4") returned 0 [0046.880] lstrlenA (lpString="*.mp4") returned 5 [0046.880] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.wmv") returned 0 [0046.880] lstrlenA (lpString="*.wmv") returned 5 [0046.880] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.divx") returned 0 [0046.880] lstrlenA (lpString="*.divx") returned 6 [0046.880] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.mkv") returned 0 [0046.880] lstrlenA (lpString="*.mkv") returned 5 [0046.881] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.mp3") returned 0 [0046.881] lstrlenA (lpString="*.mp3") returned 5 [0046.881] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.wav") returned 0 [0046.881] lstrlenA (lpString="*.wav") returned 5 [0046.881] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.flac") returned 0 [0046.881] lstrlenA (lpString="*.flac") returned 6 [0046.881] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.ape") returned 0 [0046.881] lstrlenA (lpString="*.ape") returned 5 [0046.881] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.wma") returned 0 [0046.881] lstrlenA (lpString="*.wma") returned 5 [0046.881] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.ac3") returned 0 [0046.881] lstrlenA (lpString="*.ac3") returned 5 [0046.881] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", pszSpec="*.mxf") returned 0 [0046.881] lstrlenA (lpString="*.mxf") returned 5 [0046.881] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x780074, dwReserved1=0x74, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0046.881] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.881] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OWOW32LR.cab") returned -1 [0046.881] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OWOW32LR.cab") returned -1 [0046.881] lstrcmpiA (lpString1="", lpString2="OWOW32LR.cab") returned -1 [0046.881] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned="Office32MUI.xml" [0046.881] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" [0046.881] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned="" [0046.881] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.881] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.881] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="OWOW32LR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" [0046.881] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.zip") returned 0 [0046.881] lstrlenA (lpString="*.zip") returned 5 [0046.881] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.rar") returned 0 [0046.881] lstrlenA (lpString="*.rar") returned 5 [0046.882] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.7z") returned 0 [0046.882] lstrlenA (lpString="*.7z") returned 4 [0046.882] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.tar") returned 0 [0046.882] lstrlenA (lpString="*.tar") returned 5 [0046.882] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.gzip") returned 0 [0046.882] lstrlenA (lpString="*.gzip") returned 6 [0046.882] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.jpg") returned 0 [0046.882] lstrlenA (lpString="*.jpg") returned 5 [0046.882] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.jpeg") returned 0 [0046.882] lstrlenA (lpString="*.jpeg") returned 6 [0046.882] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.psd") returned 0 [0046.882] lstrlenA (lpString="*.psd") returned 5 [0046.882] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.gif") returned 0 [0046.882] lstrlenA (lpString="*.gif") returned 5 [0046.882] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.doc") returned 0 [0046.882] lstrlenA (lpString="*.doc") returned 5 [0046.882] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.docx") returned 0 [0046.882] lstrlenA (lpString="*.docx") returned 6 [0046.882] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.xls") returned 0 [0046.882] lstrlenA (lpString="*.xls") returned 5 [0046.882] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.xlsx") returned 0 [0046.882] lstrlenA (lpString="*.xlsx") returned 6 [0046.882] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.ppt") returned 0 [0046.882] lstrlenA (lpString="*.ppt") returned 5 [0046.882] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.pptx") returned 0 [0046.882] lstrlenA (lpString="*.pptx") returned 6 [0046.882] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.pdf") returned 0 [0046.882] lstrlenA (lpString="*.pdf") returned 5 [0046.882] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.mov") returned 0 [0046.882] lstrlenA (lpString="*.mov") returned 5 [0046.882] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.m2v") returned 0 [0046.882] lstrlenA (lpString="*.m2v") returned 5 [0046.882] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.3gp") returned 0 [0046.882] lstrlenA (lpString="*.3gp") returned 5 [0046.882] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.mpeg") returned 0 [0046.882] lstrlenA (lpString="*.mpeg") returned 6 [0046.883] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.mpg") returned 0 [0046.883] lstrlenA (lpString="*.mpg") returned 5 [0046.883] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.flv") returned 0 [0046.883] lstrlenA (lpString="*.flv") returned 5 [0046.883] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.avi") returned 0 [0046.883] lstrlenA (lpString="*.avi") returned 5 [0046.883] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.mp4") returned 0 [0046.883] lstrlenA (lpString="*.mp4") returned 5 [0046.883] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.wmv") returned 0 [0046.883] lstrlenA (lpString="*.wmv") returned 5 [0046.883] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.divx") returned 0 [0046.883] lstrlenA (lpString="*.divx") returned 6 [0046.883] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.mkv") returned 0 [0046.883] lstrlenA (lpString="*.mkv") returned 5 [0046.883] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.mp3") returned 0 [0046.883] lstrlenA (lpString="*.mp3") returned 5 [0046.883] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.wav") returned 0 [0046.883] lstrlenA (lpString="*.wav") returned 5 [0046.883] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.flac") returned 0 [0046.883] lstrlenA (lpString="*.flac") returned 6 [0046.883] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.ape") returned 0 [0046.883] lstrlenA (lpString="*.ape") returned 5 [0046.883] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.wma") returned 0 [0046.883] lstrlenA (lpString="*.wma") returned 5 [0046.883] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.ac3") returned 0 [0046.883] lstrlenA (lpString="*.ac3") returned 5 [0046.883] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", pszSpec="*.mxf") returned 0 [0046.883] lstrlenA (lpString="*.mxf") returned 5 [0046.883] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0046.884] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.884] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0046.884] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0046.884] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0046.884] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned="OWOW32LR.cab" [0046.884] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" [0046.884] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned="" [0046.884] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.884] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.884] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" [0046.884] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.zip") returned 0 [0046.884] lstrlenA (lpString="*.zip") returned 5 [0046.884] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.rar") returned 0 [0046.884] lstrlenA (lpString="*.rar") returned 5 [0046.884] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.7z") returned 0 [0046.884] lstrlenA (lpString="*.7z") returned 4 [0046.884] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tar") returned 0 [0046.884] lstrlenA (lpString="*.tar") returned 5 [0046.884] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gzip") returned 0 [0046.884] lstrlenA (lpString="*.gzip") returned 6 [0046.884] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpg") returned 0 [0046.884] lstrlenA (lpString="*.jpg") returned 5 [0046.884] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpeg") returned 0 [0046.884] lstrlenA (lpString="*.jpeg") returned 6 [0046.884] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.psd") returned 0 [0046.885] lstrlenA (lpString="*.psd") returned 5 [0046.885] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gif") returned 0 [0046.885] lstrlenA (lpString="*.gif") returned 5 [0046.885] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.doc") returned 0 [0046.885] lstrlenA (lpString="*.doc") returned 5 [0046.885] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docx") returned 0 [0046.885] lstrlenA (lpString="*.docx") returned 6 [0046.885] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xls") returned 0 [0046.885] lstrlenA (lpString="*.xls") returned 5 [0046.885] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsx") returned 0 [0046.885] lstrlenA (lpString="*.xlsx") returned 6 [0046.885] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ppt") returned 0 [0046.885] lstrlenA (lpString="*.ppt") returned 5 [0046.885] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pptx") returned 0 [0046.885] lstrlenA (lpString="*.pptx") returned 6 [0046.885] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pdf") returned 0 [0046.885] lstrlenA (lpString="*.pdf") returned 5 [0046.885] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mov") returned 0 [0046.885] lstrlenA (lpString="*.mov") returned 5 [0046.885] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.m2v") returned 0 [0046.885] lstrlenA (lpString="*.m2v") returned 5 [0046.885] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.3gp") returned 0 [0046.885] lstrlenA (lpString="*.3gp") returned 5 [0046.885] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpeg") returned 0 [0046.885] lstrlenA (lpString="*.mpeg") returned 6 [0046.885] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpg") returned 0 [0046.885] lstrlenA (lpString="*.mpg") returned 5 [0046.886] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flv") returned 0 [0046.886] lstrlenA (lpString="*.flv") returned 5 [0046.886] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.avi") returned 0 [0046.886] lstrlenA (lpString="*.avi") returned 5 [0046.886] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp4") returned 0 [0046.886] lstrlenA (lpString="*.mp4") returned 5 [0046.886] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wmv") returned 0 [0046.886] lstrlenA (lpString="*.wmv") returned 5 [0046.886] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.divx") returned 0 [0046.886] lstrlenA (lpString="*.divx") returned 6 [0046.886] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mkv") returned 0 [0046.886] lstrlenA (lpString="*.mkv") returned 5 [0046.886] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp3") returned 0 [0046.886] lstrlenA (lpString="*.mp3") returned 5 [0046.886] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wav") returned 0 [0046.886] lstrlenA (lpString="*.wav") returned 5 [0046.886] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flac") returned 0 [0046.886] lstrlenA (lpString="*.flac") returned 6 [0046.886] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ape") returned 0 [0046.886] lstrlenA (lpString="*.ape") returned 5 [0046.886] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wma") returned 0 [0046.886] lstrlenA (lpString="*.wma") returned 5 [0046.886] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ac3") returned 0 [0046.886] lstrlenA (lpString="*.ac3") returned 5 [0046.886] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mxf") returned 0 [0046.886] lstrlenA (lpString="*.mxf") returned 5 [0046.886] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0046.887] FindClose (in: hFindFile=0x2d6f20 | out: hFindFile=0x2d6f20) returned 1 [0046.887] FindNextFileA (in: hFindFile=0x2d6f60, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0046.887] lstrcmpA (lpString1=".", lpString2="{90140000-0044-0409-1000-0000000FF1CE}-C") returned -1 [0046.887] lstrcmpA (lpString1="..", lpString2="{90140000-0044-0409-1000-0000000FF1CE}-C") returned -1 [0046.887] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0046.887] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0044-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C" [0046.887] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C") returned 62 [0046.887] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2d6f20 [0046.889] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.889] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.890] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.890] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.890] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0046.890] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.890] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InfLR.cab") returned -1 [0046.890] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InfLR.cab") returned -1 [0046.890] lstrcmpiA (lpString1="", lpString2="InfLR.cab") returned -1 [0046.890] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0046.890] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" [0046.890] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned="" [0046.890] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.890] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0046.890] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0046.891] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.891] WriteFile (in: hFile=0x88, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.892] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.892] CloseHandle (hObject=0x88) returned 1 [0046.892] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="InfLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" [0046.892] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.zip") returned 0 [0046.892] lstrlenA (lpString="*.zip") returned 5 [0046.892] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.rar") returned 0 [0046.892] lstrlenA (lpString="*.rar") returned 5 [0046.892] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.7z") returned 0 [0046.892] lstrlenA (lpString="*.7z") returned 4 [0046.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.tar") returned 0 [0046.893] lstrlenA (lpString="*.tar") returned 5 [0046.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.gzip") returned 0 [0046.893] lstrlenA (lpString="*.gzip") returned 6 [0046.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.jpg") returned 0 [0046.893] lstrlenA (lpString="*.jpg") returned 5 [0046.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.jpeg") returned 0 [0046.893] lstrlenA (lpString="*.jpeg") returned 6 [0046.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.psd") returned 0 [0046.893] lstrlenA (lpString="*.psd") returned 5 [0046.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.gif") returned 0 [0046.893] lstrlenA (lpString="*.gif") returned 5 [0046.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.doc") returned 0 [0046.893] lstrlenA (lpString="*.doc") returned 5 [0046.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.docx") returned 0 [0046.893] lstrlenA (lpString="*.docx") returned 6 [0046.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.xls") returned 0 [0046.893] lstrlenA (lpString="*.xls") returned 5 [0046.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.xlsx") returned 0 [0046.893] lstrlenA (lpString="*.xlsx") returned 6 [0046.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.ppt") returned 0 [0046.893] lstrlenA (lpString="*.ppt") returned 5 [0046.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.pptx") returned 0 [0046.893] lstrlenA (lpString="*.pptx") returned 6 [0046.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.pdf") returned 0 [0046.893] lstrlenA (lpString="*.pdf") returned 5 [0046.893] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.mov") returned 0 [0046.894] lstrlenA (lpString="*.mov") returned 5 [0046.894] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.m2v") returned 0 [0046.894] lstrlenA (lpString="*.m2v") returned 5 [0046.894] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.3gp") returned 0 [0046.894] lstrlenA (lpString="*.3gp") returned 5 [0046.894] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.mpeg") returned 0 [0046.894] lstrlenA (lpString="*.mpeg") returned 6 [0046.894] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.mpg") returned 0 [0046.894] lstrlenA (lpString="*.mpg") returned 5 [0046.894] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.flv") returned 0 [0046.894] lstrlenA (lpString="*.flv") returned 5 [0046.894] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.avi") returned 0 [0046.894] lstrlenA (lpString="*.avi") returned 5 [0046.894] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.mp4") returned 0 [0046.894] lstrlenA (lpString="*.mp4") returned 5 [0046.894] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.wmv") returned 0 [0046.894] lstrlenA (lpString="*.wmv") returned 5 [0046.894] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.divx") returned 0 [0046.894] lstrlenA (lpString="*.divx") returned 6 [0046.894] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.mkv") returned 0 [0046.894] lstrlenA (lpString="*.mkv") returned 5 [0046.894] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.mp3") returned 0 [0046.894] lstrlenA (lpString="*.mp3") returned 5 [0046.894] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.wav") returned 0 [0046.894] lstrlenA (lpString="*.wav") returned 5 [0046.894] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.flac") returned 0 [0046.894] lstrlenA (lpString="*.flac") returned 6 [0046.895] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.ape") returned 0 [0046.895] lstrlenA (lpString="*.ape") returned 5 [0046.895] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.wma") returned 0 [0046.895] lstrlenA (lpString="*.wma") returned 5 [0046.895] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.ac3") returned 0 [0046.895] lstrlenA (lpString="*.ac3") returned 5 [0046.895] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", pszSpec="*.mxf") returned 0 [0046.895] lstrlenA (lpString="*.mxf") returned 5 [0046.895] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x2d9290, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0046.895] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.895] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InfoPathMUI.msi") returned -1 [0046.895] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InfoPathMUI.msi") returned -1 [0046.895] lstrcmpiA (lpString1="", lpString2="InfoPathMUI.msi") returned -1 [0046.895] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned="InfLR.cab" [0046.895] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" [0046.895] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned="" [0046.895] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.895] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.895] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="InfoPathMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" [0046.895] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.zip") returned 0 [0046.895] lstrlenA (lpString="*.zip") returned 5 [0046.895] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.rar") returned 0 [0046.895] lstrlenA (lpString="*.rar") returned 5 [0046.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.7z") returned 0 [0046.896] lstrlenA (lpString="*.7z") returned 4 [0046.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.tar") returned 0 [0046.896] lstrlenA (lpString="*.tar") returned 5 [0046.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.gzip") returned 0 [0046.896] lstrlenA (lpString="*.gzip") returned 6 [0046.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.jpg") returned 0 [0046.896] lstrlenA (lpString="*.jpg") returned 5 [0046.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.jpeg") returned 0 [0046.896] lstrlenA (lpString="*.jpeg") returned 6 [0046.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.psd") returned 0 [0046.896] lstrlenA (lpString="*.psd") returned 5 [0046.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.gif") returned 0 [0046.896] lstrlenA (lpString="*.gif") returned 5 [0046.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.doc") returned 0 [0046.896] lstrlenA (lpString="*.doc") returned 5 [0046.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.docx") returned 0 [0046.896] lstrlenA (lpString="*.docx") returned 6 [0046.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.xls") returned 0 [0046.896] lstrlenA (lpString="*.xls") returned 5 [0046.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.xlsx") returned 0 [0046.896] lstrlenA (lpString="*.xlsx") returned 6 [0046.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.ppt") returned 0 [0046.896] lstrlenA (lpString="*.ppt") returned 5 [0046.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.pptx") returned 0 [0046.896] lstrlenA (lpString="*.pptx") returned 6 [0046.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.pdf") returned 0 [0046.896] lstrlenA (lpString="*.pdf") returned 5 [0046.896] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.mov") returned 0 [0046.896] lstrlenA (lpString="*.mov") returned 5 [0046.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.m2v") returned 0 [0046.897] lstrlenA (lpString="*.m2v") returned 5 [0046.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.3gp") returned 0 [0046.897] lstrlenA (lpString="*.3gp") returned 5 [0046.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.mpeg") returned 0 [0046.897] lstrlenA (lpString="*.mpeg") returned 6 [0046.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.mpg") returned 0 [0046.897] lstrlenA (lpString="*.mpg") returned 5 [0046.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.flv") returned 0 [0046.897] lstrlenA (lpString="*.flv") returned 5 [0046.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.avi") returned 0 [0046.897] lstrlenA (lpString="*.avi") returned 5 [0046.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.mp4") returned 0 [0046.897] lstrlenA (lpString="*.mp4") returned 5 [0046.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.wmv") returned 0 [0046.897] lstrlenA (lpString="*.wmv") returned 5 [0046.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.divx") returned 0 [0046.897] lstrlenA (lpString="*.divx") returned 6 [0046.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.mkv") returned 0 [0046.897] lstrlenA (lpString="*.mkv") returned 5 [0046.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.mp3") returned 0 [0046.897] lstrlenA (lpString="*.mp3") returned 5 [0046.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.wav") returned 0 [0046.897] lstrlenA (lpString="*.wav") returned 5 [0046.897] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.flac") returned 0 [0046.897] lstrlenA (lpString="*.flac") returned 6 [0046.898] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.ape") returned 0 [0046.898] lstrlenA (lpString="*.ape") returned 5 [0046.898] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.wma") returned 0 [0046.898] lstrlenA (lpString="*.wma") returned 5 [0046.898] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.ac3") returned 0 [0046.898] lstrlenA (lpString="*.ac3") returned 5 [0046.898] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", pszSpec="*.mxf") returned 0 [0046.898] lstrlenA (lpString="*.mxf") returned 5 [0046.898] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x780074, dwReserved1=0x74, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0046.898] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.898] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InfoPathMUI.xml") returned -1 [0046.898] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InfoPathMUI.xml") returned -1 [0046.898] lstrcmpiA (lpString1="", lpString2="InfoPathMUI.xml") returned -1 [0046.898] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned="InfoPathMUI.msi" [0046.898] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" [0046.898] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned="" [0046.898] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.898] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.898] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="InfoPathMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" [0046.898] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.zip") returned 0 [0046.898] lstrlenA (lpString="*.zip") returned 5 [0046.898] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.rar") returned 0 [0046.898] lstrlenA (lpString="*.rar") returned 5 [0046.898] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.7z") returned 0 [0046.899] lstrlenA (lpString="*.7z") returned 4 [0046.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.tar") returned 0 [0046.899] lstrlenA (lpString="*.tar") returned 5 [0046.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.gzip") returned 0 [0046.899] lstrlenA (lpString="*.gzip") returned 6 [0046.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.jpg") returned 0 [0046.899] lstrlenA (lpString="*.jpg") returned 5 [0046.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.jpeg") returned 0 [0046.899] lstrlenA (lpString="*.jpeg") returned 6 [0046.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.psd") returned 0 [0046.899] lstrlenA (lpString="*.psd") returned 5 [0046.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.gif") returned 0 [0046.899] lstrlenA (lpString="*.gif") returned 5 [0046.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.doc") returned 0 [0046.899] lstrlenA (lpString="*.doc") returned 5 [0046.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.docx") returned 0 [0046.899] lstrlenA (lpString="*.docx") returned 6 [0046.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.xls") returned 0 [0046.899] lstrlenA (lpString="*.xls") returned 5 [0046.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.xlsx") returned 0 [0046.899] lstrlenA (lpString="*.xlsx") returned 6 [0046.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.ppt") returned 0 [0046.899] lstrlenA (lpString="*.ppt") returned 5 [0046.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.pptx") returned 0 [0046.899] lstrlenA (lpString="*.pptx") returned 6 [0046.899] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.pdf") returned 0 [0046.900] lstrlenA (lpString="*.pdf") returned 5 [0046.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.mov") returned 0 [0046.900] lstrlenA (lpString="*.mov") returned 5 [0046.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.m2v") returned 0 [0046.900] lstrlenA (lpString="*.m2v") returned 5 [0046.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.3gp") returned 0 [0046.900] lstrlenA (lpString="*.3gp") returned 5 [0046.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.mpeg") returned 0 [0046.900] lstrlenA (lpString="*.mpeg") returned 6 [0046.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.mpg") returned 0 [0046.900] lstrlenA (lpString="*.mpg") returned 5 [0046.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.flv") returned 0 [0046.900] lstrlenA (lpString="*.flv") returned 5 [0046.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.avi") returned 0 [0046.900] lstrlenA (lpString="*.avi") returned 5 [0046.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.mp4") returned 0 [0046.900] lstrlenA (lpString="*.mp4") returned 5 [0046.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.wmv") returned 0 [0046.900] lstrlenA (lpString="*.wmv") returned 5 [0046.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.divx") returned 0 [0046.900] lstrlenA (lpString="*.divx") returned 6 [0046.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.mkv") returned 0 [0046.900] lstrlenA (lpString="*.mkv") returned 5 [0046.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.mp3") returned 0 [0046.900] lstrlenA (lpString="*.mp3") returned 5 [0046.900] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.wav") returned 0 [0046.900] lstrlenA (lpString="*.wav") returned 5 [0046.901] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.flac") returned 0 [0046.901] lstrlenA (lpString="*.flac") returned 6 [0046.901] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.ape") returned 0 [0046.901] lstrlenA (lpString="*.ape") returned 5 [0046.901] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.wma") returned 0 [0046.901] lstrlenA (lpString="*.wma") returned 5 [0046.901] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.ac3") returned 0 [0046.901] lstrlenA (lpString="*.ac3") returned 5 [0046.901] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", pszSpec="*.mxf") returned 0 [0046.901] lstrlenA (lpString="*.mxf") returned 5 [0046.901] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0046.901] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.901] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0046.901] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0046.901] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0046.901] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned="InfoPathMUI.xml" [0046.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" [0046.901] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned="" [0046.901] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.901] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.901] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" [0046.901] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.zip") returned 0 [0046.901] lstrlenA (lpString="*.zip") returned 5 [0046.901] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.rar") returned 0 [0046.902] lstrlenA (lpString="*.rar") returned 5 [0046.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.7z") returned 0 [0046.902] lstrlenA (lpString="*.7z") returned 4 [0046.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tar") returned 0 [0046.902] lstrlenA (lpString="*.tar") returned 5 [0046.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gzip") returned 0 [0046.902] lstrlenA (lpString="*.gzip") returned 6 [0046.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpg") returned 0 [0046.902] lstrlenA (lpString="*.jpg") returned 5 [0046.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpeg") returned 0 [0046.902] lstrlenA (lpString="*.jpeg") returned 6 [0046.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.psd") returned 0 [0046.902] lstrlenA (lpString="*.psd") returned 5 [0046.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gif") returned 0 [0046.902] lstrlenA (lpString="*.gif") returned 5 [0046.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.doc") returned 0 [0046.902] lstrlenA (lpString="*.doc") returned 5 [0046.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docx") returned 0 [0046.902] lstrlenA (lpString="*.docx") returned 6 [0046.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xls") returned 0 [0046.902] lstrlenA (lpString="*.xls") returned 5 [0046.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsx") returned 0 [0046.902] lstrlenA (lpString="*.xlsx") returned 6 [0046.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ppt") returned 0 [0046.902] lstrlenA (lpString="*.ppt") returned 5 [0046.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pptx") returned 0 [0046.902] lstrlenA (lpString="*.pptx") returned 6 [0046.902] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pdf") returned 0 [0046.903] lstrlenA (lpString="*.pdf") returned 5 [0046.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mov") returned 0 [0046.903] lstrlenA (lpString="*.mov") returned 5 [0046.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.m2v") returned 0 [0046.903] lstrlenA (lpString="*.m2v") returned 5 [0046.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.3gp") returned 0 [0046.903] lstrlenA (lpString="*.3gp") returned 5 [0046.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpeg") returned 0 [0046.903] lstrlenA (lpString="*.mpeg") returned 6 [0046.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpg") returned 0 [0046.903] lstrlenA (lpString="*.mpg") returned 5 [0046.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flv") returned 0 [0046.903] lstrlenA (lpString="*.flv") returned 5 [0046.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.avi") returned 0 [0046.903] lstrlenA (lpString="*.avi") returned 5 [0046.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp4") returned 0 [0046.903] lstrlenA (lpString="*.mp4") returned 5 [0046.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wmv") returned 0 [0046.903] lstrlenA (lpString="*.wmv") returned 5 [0046.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.divx") returned 0 [0046.903] lstrlenA (lpString="*.divx") returned 6 [0046.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mkv") returned 0 [0046.903] lstrlenA (lpString="*.mkv") returned 5 [0046.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp3") returned 0 [0046.903] lstrlenA (lpString="*.mp3") returned 5 [0046.903] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wav") returned 0 [0046.903] lstrlenA (lpString="*.wav") returned 5 [0046.904] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flac") returned 0 [0046.904] lstrlenA (lpString="*.flac") returned 6 [0046.904] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ape") returned 0 [0046.904] lstrlenA (lpString="*.ape") returned 5 [0046.904] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wma") returned 0 [0046.904] lstrlenA (lpString="*.wma") returned 5 [0046.904] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ac3") returned 0 [0046.904] lstrlenA (lpString="*.ac3") returned 5 [0046.904] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mxf") returned 0 [0046.904] lstrlenA (lpString="*.mxf") returned 5 [0046.904] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0046.904] FindClose (in: hFindFile=0x2d6f20 | out: hFindFile=0x2d6f20) returned 1 [0046.905] FindNextFileA (in: hFindFile=0x2d6f60, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0046.905] lstrcmpA (lpString1=".", lpString2="{90140000-0054-0409-1000-0000000FF1CE}-C") returned -1 [0046.905] lstrcmpA (lpString1="..", lpString2="{90140000-0054-0409-1000-0000000FF1CE}-C") returned -1 [0046.905] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0046.905] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0054-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C" [0046.905] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C") returned 62 [0046.905] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2d6f20 [0046.905] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.905] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.905] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.905] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.905] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0046.905] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.905] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0046.905] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0046.906] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0046.906] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0046.906] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" [0046.906] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned="" [0046.906] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.906] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0046.906] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0046.908] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.908] WriteFile (in: hFile=0x88, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.910] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.910] CloseHandle (hObject=0x88) returned 1 [0046.910] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" [0046.910] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.zip") returned 0 [0046.910] lstrlenA (lpString="*.zip") returned 5 [0046.910] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.rar") returned 0 [0046.910] lstrlenA (lpString="*.rar") returned 5 [0046.910] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.7z") returned 0 [0046.910] lstrlenA (lpString="*.7z") returned 4 [0046.910] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tar") returned 0 [0046.910] lstrlenA (lpString="*.tar") returned 5 [0046.910] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gzip") returned 0 [0046.910] lstrlenA (lpString="*.gzip") returned 6 [0046.910] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpg") returned 0 [0046.911] lstrlenA (lpString="*.jpg") returned 5 [0046.911] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpeg") returned 0 [0046.911] lstrlenA (lpString="*.jpeg") returned 6 [0046.911] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.psd") returned 0 [0046.911] lstrlenA (lpString="*.psd") returned 5 [0046.911] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gif") returned 0 [0046.911] lstrlenA (lpString="*.gif") returned 5 [0046.911] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.doc") returned 0 [0046.911] lstrlenA (lpString="*.doc") returned 5 [0046.911] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docx") returned 0 [0046.911] lstrlenA (lpString="*.docx") returned 6 [0046.911] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xls") returned 0 [0046.911] lstrlenA (lpString="*.xls") returned 5 [0046.911] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsx") returned 0 [0046.911] lstrlenA (lpString="*.xlsx") returned 6 [0046.911] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ppt") returned 0 [0046.911] lstrlenA (lpString="*.ppt") returned 5 [0046.911] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pptx") returned 0 [0046.911] lstrlenA (lpString="*.pptx") returned 6 [0046.911] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pdf") returned 0 [0046.911] lstrlenA (lpString="*.pdf") returned 5 [0046.911] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mov") returned 0 [0046.911] lstrlenA (lpString="*.mov") returned 5 [0046.911] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.m2v") returned 0 [0046.911] lstrlenA (lpString="*.m2v") returned 5 [0046.911] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.3gp") returned 0 [0046.911] lstrlenA (lpString="*.3gp") returned 5 [0046.912] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpeg") returned 0 [0046.912] lstrlenA (lpString="*.mpeg") returned 6 [0046.912] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpg") returned 0 [0046.912] lstrlenA (lpString="*.mpg") returned 5 [0046.912] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flv") returned 0 [0046.912] lstrlenA (lpString="*.flv") returned 5 [0046.912] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.avi") returned 0 [0046.912] lstrlenA (lpString="*.avi") returned 5 [0046.912] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp4") returned 0 [0046.912] lstrlenA (lpString="*.mp4") returned 5 [0046.912] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wmv") returned 0 [0046.912] lstrlenA (lpString="*.wmv") returned 5 [0046.912] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.divx") returned 0 [0046.912] lstrlenA (lpString="*.divx") returned 6 [0046.912] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mkv") returned 0 [0046.912] lstrlenA (lpString="*.mkv") returned 5 [0046.912] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp3") returned 0 [0046.912] lstrlenA (lpString="*.mp3") returned 5 [0046.912] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wav") returned 0 [0046.912] lstrlenA (lpString="*.wav") returned 5 [0046.912] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flac") returned 0 [0046.912] lstrlenA (lpString="*.flac") returned 6 [0046.912] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ape") returned 0 [0046.912] lstrlenA (lpString="*.ape") returned 5 [0046.912] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wma") returned 0 [0046.912] lstrlenA (lpString="*.wma") returned 5 [0046.912] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ac3") returned 0 [0046.912] lstrlenA (lpString="*.ac3") returned 5 [0046.913] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mxf") returned 0 [0046.913] lstrlenA (lpString="*.mxf") returned 5 [0046.913] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x2d9290, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0046.913] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.913] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VisioLR.cab") returned -1 [0046.913] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VisioLR.cab") returned -1 [0046.913] lstrcmpiA (lpString1="", lpString2="VisioLR.cab") returned -1 [0046.913] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="Setup.xml" [0046.913] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" [0046.913] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned="" [0046.913] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.913] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.913] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="VisioLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" [0046.913] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.zip") returned 0 [0046.913] lstrlenA (lpString="*.zip") returned 5 [0046.913] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.rar") returned 0 [0046.913] lstrlenA (lpString="*.rar") returned 5 [0046.913] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.7z") returned 0 [0046.913] lstrlenA (lpString="*.7z") returned 4 [0046.913] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.tar") returned 0 [0046.913] lstrlenA (lpString="*.tar") returned 5 [0046.913] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.gzip") returned 0 [0046.913] lstrlenA (lpString="*.gzip") returned 6 [0046.913] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.jpg") returned 0 [0046.914] lstrlenA (lpString="*.jpg") returned 5 [0046.914] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.jpeg") returned 0 [0046.914] lstrlenA (lpString="*.jpeg") returned 6 [0046.914] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.psd") returned 0 [0046.914] lstrlenA (lpString="*.psd") returned 5 [0046.914] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.gif") returned 0 [0046.914] lstrlenA (lpString="*.gif") returned 5 [0046.914] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.doc") returned 0 [0046.914] lstrlenA (lpString="*.doc") returned 5 [0046.914] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.docx") returned 0 [0046.914] lstrlenA (lpString="*.docx") returned 6 [0046.914] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.xls") returned 0 [0046.914] lstrlenA (lpString="*.xls") returned 5 [0046.914] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.xlsx") returned 0 [0046.914] lstrlenA (lpString="*.xlsx") returned 6 [0046.914] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.ppt") returned 0 [0046.914] lstrlenA (lpString="*.ppt") returned 5 [0046.914] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.pptx") returned 0 [0046.914] lstrlenA (lpString="*.pptx") returned 6 [0046.914] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.pdf") returned 0 [0046.914] lstrlenA (lpString="*.pdf") returned 5 [0046.914] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.mov") returned 0 [0046.914] lstrlenA (lpString="*.mov") returned 5 [0046.914] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.m2v") returned 0 [0046.914] lstrlenA (lpString="*.m2v") returned 5 [0046.914] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.3gp") returned 0 [0046.914] lstrlenA (lpString="*.3gp") returned 5 [0046.915] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.mpeg") returned 0 [0046.915] lstrlenA (lpString="*.mpeg") returned 6 [0046.915] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.mpg") returned 0 [0046.915] lstrlenA (lpString="*.mpg") returned 5 [0046.915] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.flv") returned 0 [0046.915] lstrlenA (lpString="*.flv") returned 5 [0046.915] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.avi") returned 0 [0046.915] lstrlenA (lpString="*.avi") returned 5 [0046.915] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.mp4") returned 0 [0046.915] lstrlenA (lpString="*.mp4") returned 5 [0046.915] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.wmv") returned 0 [0046.915] lstrlenA (lpString="*.wmv") returned 5 [0046.915] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.divx") returned 0 [0046.915] lstrlenA (lpString="*.divx") returned 6 [0046.915] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.mkv") returned 0 [0046.915] lstrlenA (lpString="*.mkv") returned 5 [0046.915] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.mp3") returned 0 [0046.915] lstrlenA (lpString="*.mp3") returned 5 [0046.915] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.wav") returned 0 [0046.915] lstrlenA (lpString="*.wav") returned 5 [0046.915] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.flac") returned 0 [0046.915] lstrlenA (lpString="*.flac") returned 6 [0046.915] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.ape") returned 0 [0046.915] lstrlenA (lpString="*.ape") returned 5 [0046.915] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.wma") returned 0 [0046.915] lstrlenA (lpString="*.wma") returned 5 [0046.915] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.ac3") returned 0 [0046.915] lstrlenA (lpString="*.ac3") returned 5 [0046.916] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", pszSpec="*.mxf") returned 0 [0046.916] lstrlenA (lpString="*.mxf") returned 5 [0046.916] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0046.916] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.916] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VisioMUI.msi") returned -1 [0046.916] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VisioMUI.msi") returned -1 [0046.916] lstrcmpiA (lpString1="", lpString2="VisioMUI.msi") returned -1 [0046.916] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned="VisioLR.cab" [0046.916] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" [0046.916] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned="" [0046.916] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.916] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.916] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="VisioMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" [0046.916] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.zip") returned 0 [0046.916] lstrlenA (lpString="*.zip") returned 5 [0046.916] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.rar") returned 0 [0046.916] lstrlenA (lpString="*.rar") returned 5 [0046.916] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.7z") returned 0 [0046.916] lstrlenA (lpString="*.7z") returned 4 [0046.916] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.tar") returned 0 [0046.916] lstrlenA (lpString="*.tar") returned 5 [0046.916] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.gzip") returned 0 [0046.916] lstrlenA (lpString="*.gzip") returned 6 [0046.917] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.jpg") returned 0 [0046.917] lstrlenA (lpString="*.jpg") returned 5 [0046.917] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.jpeg") returned 0 [0046.917] lstrlenA (lpString="*.jpeg") returned 6 [0046.917] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.psd") returned 0 [0046.917] lstrlenA (lpString="*.psd") returned 5 [0046.917] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.gif") returned 0 [0046.917] lstrlenA (lpString="*.gif") returned 5 [0046.917] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.doc") returned 0 [0046.917] lstrlenA (lpString="*.doc") returned 5 [0046.917] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.docx") returned 0 [0046.917] lstrlenA (lpString="*.docx") returned 6 [0046.917] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.xls") returned 0 [0046.917] lstrlenA (lpString="*.xls") returned 5 [0046.917] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.xlsx") returned 0 [0046.917] lstrlenA (lpString="*.xlsx") returned 6 [0046.917] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.ppt") returned 0 [0046.917] lstrlenA (lpString="*.ppt") returned 5 [0046.917] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.pptx") returned 0 [0046.917] lstrlenA (lpString="*.pptx") returned 6 [0046.917] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.pdf") returned 0 [0046.917] lstrlenA (lpString="*.pdf") returned 5 [0046.917] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.mov") returned 0 [0046.917] lstrlenA (lpString="*.mov") returned 5 [0046.917] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.m2v") returned 0 [0046.917] lstrlenA (lpString="*.m2v") returned 5 [0046.917] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.3gp") returned 0 [0046.918] lstrlenA (lpString="*.3gp") returned 5 [0046.918] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.mpeg") returned 0 [0046.918] lstrlenA (lpString="*.mpeg") returned 6 [0046.918] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.mpg") returned 0 [0046.918] lstrlenA (lpString="*.mpg") returned 5 [0046.918] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.flv") returned 0 [0046.918] lstrlenA (lpString="*.flv") returned 5 [0046.918] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.avi") returned 0 [0046.918] lstrlenA (lpString="*.avi") returned 5 [0046.918] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.mp4") returned 0 [0046.918] lstrlenA (lpString="*.mp4") returned 5 [0046.918] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.wmv") returned 0 [0046.918] lstrlenA (lpString="*.wmv") returned 5 [0046.918] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.divx") returned 0 [0046.918] lstrlenA (lpString="*.divx") returned 6 [0046.918] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.mkv") returned 0 [0046.918] lstrlenA (lpString="*.mkv") returned 5 [0046.918] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.mp3") returned 0 [0046.918] lstrlenA (lpString="*.mp3") returned 5 [0046.918] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.wav") returned 0 [0046.918] lstrlenA (lpString="*.wav") returned 5 [0046.918] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.flac") returned 0 [0046.918] lstrlenA (lpString="*.flac") returned 6 [0046.918] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.ape") returned 0 [0046.918] lstrlenA (lpString="*.ape") returned 5 [0046.918] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.wma") returned 0 [0046.918] lstrlenA (lpString="*.wma") returned 5 [0046.918] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.ac3") returned 0 [0046.919] lstrlenA (lpString="*.ac3") returned 5 [0046.919] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", pszSpec="*.mxf") returned 0 [0046.919] lstrlenA (lpString="*.mxf") returned 5 [0046.919] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x780074, dwReserved1=0x74, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0046.919] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.919] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VisioMUI.xml") returned -1 [0046.919] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VisioMUI.xml") returned -1 [0046.919] lstrcmpiA (lpString1="", lpString2="VisioMUI.xml") returned -1 [0046.919] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned="VisioMUI.msi" [0046.919] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" [0046.919] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned="" [0046.919] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.919] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.919] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="VisioMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" [0046.919] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.zip") returned 0 [0046.922] lstrlenA (lpString="*.zip") returned 5 [0046.922] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.rar") returned 0 [0046.922] lstrlenA (lpString="*.rar") returned 5 [0046.922] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.7z") returned 0 [0046.922] lstrlenA (lpString="*.7z") returned 4 [0046.922] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.tar") returned 0 [0046.922] lstrlenA (lpString="*.tar") returned 5 [0046.923] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.gzip") returned 0 [0046.923] lstrlenA (lpString="*.gzip") returned 6 [0046.923] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.jpg") returned 0 [0046.923] lstrlenA (lpString="*.jpg") returned 5 [0046.923] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.jpeg") returned 0 [0046.923] lstrlenA (lpString="*.jpeg") returned 6 [0046.923] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.psd") returned 0 [0046.923] lstrlenA (lpString="*.psd") returned 5 [0046.923] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.gif") returned 0 [0046.923] lstrlenA (lpString="*.gif") returned 5 [0046.923] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.doc") returned 0 [0046.923] lstrlenA (lpString="*.doc") returned 5 [0046.923] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.docx") returned 0 [0046.923] lstrlenA (lpString="*.docx") returned 6 [0046.923] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.xls") returned 0 [0046.923] lstrlenA (lpString="*.xls") returned 5 [0046.923] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.xlsx") returned 0 [0046.923] lstrlenA (lpString="*.xlsx") returned 6 [0046.923] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.ppt") returned 0 [0046.923] lstrlenA (lpString="*.ppt") returned 5 [0046.923] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.pptx") returned 0 [0046.923] lstrlenA (lpString="*.pptx") returned 6 [0046.923] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.pdf") returned 0 [0046.923] lstrlenA (lpString="*.pdf") returned 5 [0046.923] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.mov") returned 0 [0046.923] lstrlenA (lpString="*.mov") returned 5 [0046.923] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.m2v") returned 0 [0046.924] lstrlenA (lpString="*.m2v") returned 5 [0046.924] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.3gp") returned 0 [0046.924] lstrlenA (lpString="*.3gp") returned 5 [0046.924] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.mpeg") returned 0 [0046.924] lstrlenA (lpString="*.mpeg") returned 6 [0046.924] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.mpg") returned 0 [0046.924] lstrlenA (lpString="*.mpg") returned 5 [0046.924] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.flv") returned 0 [0046.924] lstrlenA (lpString="*.flv") returned 5 [0046.924] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.avi") returned 0 [0046.924] lstrlenA (lpString="*.avi") returned 5 [0046.924] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.mp4") returned 0 [0046.924] lstrlenA (lpString="*.mp4") returned 5 [0046.924] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.wmv") returned 0 [0046.924] lstrlenA (lpString="*.wmv") returned 5 [0046.924] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.divx") returned 0 [0046.924] lstrlenA (lpString="*.divx") returned 6 [0046.924] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.mkv") returned 0 [0046.924] lstrlenA (lpString="*.mkv") returned 5 [0046.924] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.mp3") returned 0 [0046.924] lstrlenA (lpString="*.mp3") returned 5 [0046.924] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.wav") returned 0 [0046.924] lstrlenA (lpString="*.wav") returned 5 [0046.924] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.flac") returned 0 [0046.924] lstrlenA (lpString="*.flac") returned 6 [0046.924] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.ape") returned 0 [0046.924] lstrlenA (lpString="*.ape") returned 5 [0046.924] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.wma") returned 0 [0046.925] lstrlenA (lpString="*.wma") returned 5 [0046.925] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.ac3") returned 0 [0046.925] lstrlenA (lpString="*.ac3") returned 5 [0046.925] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", pszSpec="*.mxf") returned 0 [0046.925] lstrlenA (lpString="*.mxf") returned 5 [0046.925] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x780074, dwReserved1=0x74, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 0 [0046.925] FindClose (in: hFindFile=0x2d6f20 | out: hFindFile=0x2d6f20) returned 1 [0046.925] FindNextFileA (in: hFindFile=0x2d6f60, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0046.925] lstrcmpA (lpString1=".", lpString2="{90140000-00A1-0409-1000-0000000FF1CE}-C") returned -1 [0046.925] lstrcmpA (lpString1="..", lpString2="{90140000-00A1-0409-1000-0000000FF1CE}-C") returned -1 [0046.925] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0046.925] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-00A1-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C" [0046.925] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C") returned 62 [0046.925] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2d6f20 [0046.928] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.929] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.929] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.929] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.929] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0046.929] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.929] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OneNoteMUI.msi") returned -1 [0046.929] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OneNoteMUI.msi") returned -1 [0046.929] lstrcmpiA (lpString1="", lpString2="OneNoteMUI.msi") returned -1 [0046.929] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0046.929] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" [0046.929] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned="" [0046.929] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.929] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0046.929] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0046.930] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.930] WriteFile (in: hFile=0x88, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.931] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.931] CloseHandle (hObject=0x88) returned 1 [0046.931] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="OneNoteMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" [0046.931] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.zip") returned 0 [0046.931] lstrlenA (lpString="*.zip") returned 5 [0046.931] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.rar") returned 0 [0046.931] lstrlenA (lpString="*.rar") returned 5 [0046.931] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.7z") returned 0 [0046.932] lstrlenA (lpString="*.7z") returned 4 [0046.932] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.tar") returned 0 [0046.932] lstrlenA (lpString="*.tar") returned 5 [0046.932] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.gzip") returned 0 [0046.932] lstrlenA (lpString="*.gzip") returned 6 [0046.932] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.jpg") returned 0 [0046.932] lstrlenA (lpString="*.jpg") returned 5 [0046.932] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.jpeg") returned 0 [0046.932] lstrlenA (lpString="*.jpeg") returned 6 [0046.932] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.psd") returned 0 [0046.932] lstrlenA (lpString="*.psd") returned 5 [0046.932] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.gif") returned 0 [0046.932] lstrlenA (lpString="*.gif") returned 5 [0046.932] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.doc") returned 0 [0046.932] lstrlenA (lpString="*.doc") returned 5 [0046.932] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.docx") returned 0 [0046.932] lstrlenA (lpString="*.docx") returned 6 [0046.932] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.xls") returned 0 [0046.932] lstrlenA (lpString="*.xls") returned 5 [0046.932] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.xlsx") returned 0 [0046.932] lstrlenA (lpString="*.xlsx") returned 6 [0046.932] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.ppt") returned 0 [0046.932] lstrlenA (lpString="*.ppt") returned 5 [0046.932] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.pptx") returned 0 [0046.932] lstrlenA (lpString="*.pptx") returned 6 [0046.932] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.pdf") returned 0 [0046.932] lstrlenA (lpString="*.pdf") returned 5 [0046.932] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.mov") returned 0 [0046.933] lstrlenA (lpString="*.mov") returned 5 [0046.933] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.m2v") returned 0 [0046.933] lstrlenA (lpString="*.m2v") returned 5 [0046.933] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.3gp") returned 0 [0046.933] lstrlenA (lpString="*.3gp") returned 5 [0046.933] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.mpeg") returned 0 [0046.933] lstrlenA (lpString="*.mpeg") returned 6 [0046.933] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.mpg") returned 0 [0046.933] lstrlenA (lpString="*.mpg") returned 5 [0046.933] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.flv") returned 0 [0046.933] lstrlenA (lpString="*.flv") returned 5 [0046.933] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.avi") returned 0 [0046.933] lstrlenA (lpString="*.avi") returned 5 [0046.933] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.mp4") returned 0 [0046.933] lstrlenA (lpString="*.mp4") returned 5 [0046.933] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.wmv") returned 0 [0046.933] lstrlenA (lpString="*.wmv") returned 5 [0046.933] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.divx") returned 0 [0046.933] lstrlenA (lpString="*.divx") returned 6 [0046.933] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.mkv") returned 0 [0046.933] lstrlenA (lpString="*.mkv") returned 5 [0046.933] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.mp3") returned 0 [0046.933] lstrlenA (lpString="*.mp3") returned 5 [0046.933] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.wav") returned 0 [0046.933] lstrlenA (lpString="*.wav") returned 5 [0046.933] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.flac") returned 0 [0046.933] lstrlenA (lpString="*.flac") returned 6 [0046.933] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.ape") returned 0 [0046.934] lstrlenA (lpString="*.ape") returned 5 [0046.934] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.wma") returned 0 [0046.934] lstrlenA (lpString="*.wma") returned 5 [0046.934] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.ac3") returned 0 [0046.934] lstrlenA (lpString="*.ac3") returned 5 [0046.934] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", pszSpec="*.mxf") returned 0 [0046.934] lstrlenA (lpString="*.mxf") returned 5 [0046.934] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x2d9290, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0046.934] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.934] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OneNoteMUI.xml") returned -1 [0046.934] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OneNoteMUI.xml") returned -1 [0046.934] lstrcmpiA (lpString1="", lpString2="OneNoteMUI.xml") returned -1 [0046.934] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned="OneNoteMUI.msi" [0046.934] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" [0046.934] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned="" [0046.934] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.934] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.934] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="OneNoteMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" [0046.934] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.zip") returned 0 [0046.934] lstrlenA (lpString="*.zip") returned 5 [0046.934] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.rar") returned 0 [0046.934] lstrlenA (lpString="*.rar") returned 5 [0046.934] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.7z") returned 0 [0046.934] lstrlenA (lpString="*.7z") returned 4 [0046.935] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.tar") returned 0 [0046.935] lstrlenA (lpString="*.tar") returned 5 [0046.935] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.gzip") returned 0 [0046.935] lstrlenA (lpString="*.gzip") returned 6 [0046.935] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.jpg") returned 0 [0046.935] lstrlenA (lpString="*.jpg") returned 5 [0046.935] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.jpeg") returned 0 [0046.935] lstrlenA (lpString="*.jpeg") returned 6 [0046.935] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.psd") returned 0 [0046.935] lstrlenA (lpString="*.psd") returned 5 [0046.935] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.gif") returned 0 [0046.935] lstrlenA (lpString="*.gif") returned 5 [0046.935] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.doc") returned 0 [0046.935] lstrlenA (lpString="*.doc") returned 5 [0046.935] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.docx") returned 0 [0046.935] lstrlenA (lpString="*.docx") returned 6 [0046.935] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.xls") returned 0 [0046.935] lstrlenA (lpString="*.xls") returned 5 [0046.935] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.xlsx") returned 0 [0046.936] lstrlenA (lpString="*.xlsx") returned 6 [0046.936] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.ppt") returned 0 [0046.936] lstrlenA (lpString="*.ppt") returned 5 [0046.936] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.pptx") returned 0 [0046.936] lstrlenA (lpString="*.pptx") returned 6 [0046.936] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.pdf") returned 0 [0046.936] lstrlenA (lpString="*.pdf") returned 5 [0046.936] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.mov") returned 0 [0046.936] lstrlenA (lpString="*.mov") returned 5 [0046.936] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.m2v") returned 0 [0046.936] lstrlenA (lpString="*.m2v") returned 5 [0046.936] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.3gp") returned 0 [0046.936] lstrlenA (lpString="*.3gp") returned 5 [0046.936] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.mpeg") returned 0 [0046.936] lstrlenA (lpString="*.mpeg") returned 6 [0046.936] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.mpg") returned 0 [0046.936] lstrlenA (lpString="*.mpg") returned 5 [0046.936] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.flv") returned 0 [0046.936] lstrlenA (lpString="*.flv") returned 5 [0046.936] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.avi") returned 0 [0046.936] lstrlenA (lpString="*.avi") returned 5 [0046.936] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.mp4") returned 0 [0046.936] lstrlenA (lpString="*.mp4") returned 5 [0046.936] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.wmv") returned 0 [0046.936] lstrlenA (lpString="*.wmv") returned 5 [0046.936] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.divx") returned 0 [0046.936] lstrlenA (lpString="*.divx") returned 6 [0046.936] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.mkv") returned 0 [0046.937] lstrlenA (lpString="*.mkv") returned 5 [0046.937] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.mp3") returned 0 [0046.937] lstrlenA (lpString="*.mp3") returned 5 [0046.937] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.wav") returned 0 [0046.937] lstrlenA (lpString="*.wav") returned 5 [0046.937] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.flac") returned 0 [0046.937] lstrlenA (lpString="*.flac") returned 6 [0046.937] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.ape") returned 0 [0046.937] lstrlenA (lpString="*.ape") returned 5 [0046.937] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.wma") returned 0 [0046.937] lstrlenA (lpString="*.wma") returned 5 [0046.937] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.ac3") returned 0 [0046.937] lstrlenA (lpString="*.ac3") returned 5 [0046.937] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", pszSpec="*.mxf") returned 0 [0046.937] lstrlenA (lpString="*.mxf") returned 5 [0046.937] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x780074, dwReserved1=0x74, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0046.937] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.937] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OnoteLR.cab") returned -1 [0046.937] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OnoteLR.cab") returned -1 [0046.937] lstrcmpiA (lpString1="", lpString2="OnoteLR.cab") returned -1 [0046.937] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned="OneNoteMUI.xml" [0046.937] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" [0046.937] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned="" [0046.937] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.937] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.938] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="OnoteLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" [0046.938] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.zip") returned 0 [0046.938] lstrlenA (lpString="*.zip") returned 5 [0046.938] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.rar") returned 0 [0046.938] lstrlenA (lpString="*.rar") returned 5 [0046.938] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.7z") returned 0 [0046.938] lstrlenA (lpString="*.7z") returned 4 [0046.938] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.tar") returned 0 [0046.938] lstrlenA (lpString="*.tar") returned 5 [0046.938] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.gzip") returned 0 [0046.938] lstrlenA (lpString="*.gzip") returned 6 [0046.938] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.jpg") returned 0 [0046.938] lstrlenA (lpString="*.jpg") returned 5 [0046.938] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.jpeg") returned 0 [0046.938] lstrlenA (lpString="*.jpeg") returned 6 [0046.938] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.psd") returned 0 [0046.938] lstrlenA (lpString="*.psd") returned 5 [0046.938] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.gif") returned 0 [0046.938] lstrlenA (lpString="*.gif") returned 5 [0046.938] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.doc") returned 0 [0046.938] lstrlenA (lpString="*.doc") returned 5 [0046.938] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.docx") returned 0 [0046.938] lstrlenA (lpString="*.docx") returned 6 [0046.938] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.xls") returned 0 [0046.938] lstrlenA (lpString="*.xls") returned 5 [0046.938] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.xlsx") returned 0 [0046.938] lstrlenA (lpString="*.xlsx") returned 6 [0046.938] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.ppt") returned 0 [0046.939] lstrlenA (lpString="*.ppt") returned 5 [0046.939] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.pptx") returned 0 [0046.939] lstrlenA (lpString="*.pptx") returned 6 [0046.939] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.pdf") returned 0 [0046.939] lstrlenA (lpString="*.pdf") returned 5 [0046.939] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.mov") returned 0 [0046.939] lstrlenA (lpString="*.mov") returned 5 [0046.939] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.m2v") returned 0 [0046.939] lstrlenA (lpString="*.m2v") returned 5 [0046.939] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.3gp") returned 0 [0046.939] lstrlenA (lpString="*.3gp") returned 5 [0046.939] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.mpeg") returned 0 [0046.939] lstrlenA (lpString="*.mpeg") returned 6 [0046.939] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.mpg") returned 0 [0046.939] lstrlenA (lpString="*.mpg") returned 5 [0046.939] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.flv") returned 0 [0046.939] lstrlenA (lpString="*.flv") returned 5 [0046.939] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.avi") returned 0 [0046.939] lstrlenA (lpString="*.avi") returned 5 [0046.939] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.mp4") returned 0 [0046.939] lstrlenA (lpString="*.mp4") returned 5 [0046.939] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.wmv") returned 0 [0046.939] lstrlenA (lpString="*.wmv") returned 5 [0046.939] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.divx") returned 0 [0046.939] lstrlenA (lpString="*.divx") returned 6 [0046.939] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.mkv") returned 0 [0046.939] lstrlenA (lpString="*.mkv") returned 5 [0046.940] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.mp3") returned 0 [0046.940] lstrlenA (lpString="*.mp3") returned 5 [0046.940] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.wav") returned 0 [0046.940] lstrlenA (lpString="*.wav") returned 5 [0046.940] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.flac") returned 0 [0046.940] lstrlenA (lpString="*.flac") returned 6 [0046.940] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.ape") returned 0 [0046.940] lstrlenA (lpString="*.ape") returned 5 [0046.940] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.wma") returned 0 [0046.940] lstrlenA (lpString="*.wma") returned 5 [0046.940] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.ac3") returned 0 [0046.940] lstrlenA (lpString="*.ac3") returned 5 [0046.940] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", pszSpec="*.mxf") returned 0 [0046.940] lstrlenA (lpString="*.mxf") returned 5 [0046.940] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0046.940] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.940] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0046.940] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0046.940] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0046.940] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned="OnoteLR.cab" [0046.940] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" [0046.940] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned="" [0046.940] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.940] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.941] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" [0046.941] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.zip") returned 0 [0046.941] lstrlenA (lpString="*.zip") returned 5 [0046.941] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.rar") returned 0 [0046.941] lstrlenA (lpString="*.rar") returned 5 [0046.941] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.7z") returned 0 [0046.941] lstrlenA (lpString="*.7z") returned 4 [0046.941] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tar") returned 0 [0046.941] lstrlenA (lpString="*.tar") returned 5 [0046.941] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gzip") returned 0 [0046.941] lstrlenA (lpString="*.gzip") returned 6 [0046.941] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpg") returned 0 [0046.941] lstrlenA (lpString="*.jpg") returned 5 [0046.941] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpeg") returned 0 [0046.941] lstrlenA (lpString="*.jpeg") returned 6 [0046.941] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.psd") returned 0 [0046.941] lstrlenA (lpString="*.psd") returned 5 [0046.941] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gif") returned 0 [0046.941] lstrlenA (lpString="*.gif") returned 5 [0046.941] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.doc") returned 0 [0046.941] lstrlenA (lpString="*.doc") returned 5 [0046.941] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docx") returned 0 [0046.941] lstrlenA (lpString="*.docx") returned 6 [0046.941] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xls") returned 0 [0046.941] lstrlenA (lpString="*.xls") returned 5 [0046.941] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsx") returned 0 [0046.941] lstrlenA (lpString="*.xlsx") returned 6 [0046.942] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ppt") returned 0 [0046.942] lstrlenA (lpString="*.ppt") returned 5 [0046.942] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pptx") returned 0 [0046.942] lstrlenA (lpString="*.pptx") returned 6 [0046.942] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pdf") returned 0 [0046.942] lstrlenA (lpString="*.pdf") returned 5 [0046.942] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mov") returned 0 [0046.942] lstrlenA (lpString="*.mov") returned 5 [0046.942] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.m2v") returned 0 [0046.942] lstrlenA (lpString="*.m2v") returned 5 [0046.942] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.3gp") returned 0 [0046.942] lstrlenA (lpString="*.3gp") returned 5 [0046.942] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpeg") returned 0 [0046.942] lstrlenA (lpString="*.mpeg") returned 6 [0046.942] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpg") returned 0 [0046.942] lstrlenA (lpString="*.mpg") returned 5 [0046.942] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flv") returned 0 [0046.942] lstrlenA (lpString="*.flv") returned 5 [0046.942] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.avi") returned 0 [0046.942] lstrlenA (lpString="*.avi") returned 5 [0046.942] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp4") returned 0 [0046.942] lstrlenA (lpString="*.mp4") returned 5 [0046.942] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wmv") returned 0 [0046.942] lstrlenA (lpString="*.wmv") returned 5 [0046.942] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.divx") returned 0 [0046.942] lstrlenA (lpString="*.divx") returned 6 [0046.942] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mkv") returned 0 [0046.943] lstrlenA (lpString="*.mkv") returned 5 [0046.943] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp3") returned 0 [0046.943] lstrlenA (lpString="*.mp3") returned 5 [0046.943] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wav") returned 0 [0046.943] lstrlenA (lpString="*.wav") returned 5 [0046.943] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flac") returned 0 [0046.943] lstrlenA (lpString="*.flac") returned 6 [0046.943] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ape") returned 0 [0046.943] lstrlenA (lpString="*.ape") returned 5 [0046.943] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wma") returned 0 [0046.943] lstrlenA (lpString="*.wma") returned 5 [0046.943] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ac3") returned 0 [0046.943] lstrlenA (lpString="*.ac3") returned 5 [0046.943] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mxf") returned 0 [0046.943] lstrlenA (lpString="*.mxf") returned 5 [0046.943] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0046.943] FindClose (in: hFindFile=0x2d6f20 | out: hFindFile=0x2d6f20) returned 1 [0046.943] FindNextFileA (in: hFindFile=0x2d6f60, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0046.943] lstrcmpA (lpString1=".", lpString2="{90140000-00B4-0409-1000-0000000FF1CE}-C") returned -1 [0046.943] lstrcmpA (lpString1="..", lpString2="{90140000-00B4-0409-1000-0000000FF1CE}-C") returned -1 [0046.943] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0046.943] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-00B4-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C" [0046.943] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C") returned 62 [0046.944] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2d6f20 [0046.948] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.948] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.948] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.948] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.948] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0046.948] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.948] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProjectMUI.msi") returned -1 [0046.948] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectMUI.msi") returned -1 [0046.948] lstrcmpiA (lpString1="", lpString2="ProjectMUI.msi") returned -1 [0046.948] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0046.948] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" [0046.948] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned="" [0046.948] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.949] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0046.949] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0046.949] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.949] WriteFile (in: hFile=0x88, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.951] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.951] CloseHandle (hObject=0x88) returned 1 [0046.951] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="ProjectMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" [0046.951] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.zip") returned 0 [0046.951] lstrlenA (lpString="*.zip") returned 5 [0046.951] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.rar") returned 0 [0046.951] lstrlenA (lpString="*.rar") returned 5 [0046.951] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.7z") returned 0 [0046.951] lstrlenA (lpString="*.7z") returned 4 [0046.951] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.tar") returned 0 [0046.951] lstrlenA (lpString="*.tar") returned 5 [0046.951] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.gzip") returned 0 [0046.951] lstrlenA (lpString="*.gzip") returned 6 [0046.951] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.jpg") returned 0 [0046.952] lstrlenA (lpString="*.jpg") returned 5 [0046.952] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.jpeg") returned 0 [0046.952] lstrlenA (lpString="*.jpeg") returned 6 [0046.952] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.psd") returned 0 [0046.952] lstrlenA (lpString="*.psd") returned 5 [0046.952] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.gif") returned 0 [0046.952] lstrlenA (lpString="*.gif") returned 5 [0046.952] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.doc") returned 0 [0046.952] lstrlenA (lpString="*.doc") returned 5 [0046.952] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.docx") returned 0 [0046.952] lstrlenA (lpString="*.docx") returned 6 [0046.952] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.xls") returned 0 [0046.952] lstrlenA (lpString="*.xls") returned 5 [0046.952] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.xlsx") returned 0 [0046.952] lstrlenA (lpString="*.xlsx") returned 6 [0046.952] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.ppt") returned 0 [0046.952] lstrlenA (lpString="*.ppt") returned 5 [0046.952] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.pptx") returned 0 [0046.952] lstrlenA (lpString="*.pptx") returned 6 [0046.952] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.pdf") returned 0 [0046.952] lstrlenA (lpString="*.pdf") returned 5 [0046.952] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.mov") returned 0 [0046.952] lstrlenA (lpString="*.mov") returned 5 [0046.952] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.m2v") returned 0 [0046.952] lstrlenA (lpString="*.m2v") returned 5 [0046.952] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.3gp") returned 0 [0046.952] lstrlenA (lpString="*.3gp") returned 5 [0046.952] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.mpeg") returned 0 [0046.953] lstrlenA (lpString="*.mpeg") returned 6 [0046.953] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.mpg") returned 0 [0046.953] lstrlenA (lpString="*.mpg") returned 5 [0046.953] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.flv") returned 0 [0046.953] lstrlenA (lpString="*.flv") returned 5 [0046.953] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.avi") returned 0 [0046.953] lstrlenA (lpString="*.avi") returned 5 [0046.953] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.mp4") returned 0 [0046.953] lstrlenA (lpString="*.mp4") returned 5 [0046.953] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.wmv") returned 0 [0046.953] lstrlenA (lpString="*.wmv") returned 5 [0046.953] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.divx") returned 0 [0046.953] lstrlenA (lpString="*.divx") returned 6 [0046.953] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.mkv") returned 0 [0046.953] lstrlenA (lpString="*.mkv") returned 5 [0046.953] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.mp3") returned 0 [0046.953] lstrlenA (lpString="*.mp3") returned 5 [0046.953] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.wav") returned 0 [0046.953] lstrlenA (lpString="*.wav") returned 5 [0046.953] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.flac") returned 0 [0046.953] lstrlenA (lpString="*.flac") returned 6 [0046.953] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.ape") returned 0 [0046.953] lstrlenA (lpString="*.ape") returned 5 [0046.953] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.wma") returned 0 [0046.953] lstrlenA (lpString="*.wma") returned 5 [0046.953] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.ac3") returned 0 [0046.953] lstrlenA (lpString="*.ac3") returned 5 [0046.953] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", pszSpec="*.mxf") returned 0 [0046.953] lstrlenA (lpString="*.mxf") returned 5 [0046.954] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x2d9290, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0046.954] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.954] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProjectMUI.xml") returned -1 [0046.954] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectMUI.xml") returned -1 [0046.954] lstrcmpiA (lpString1="", lpString2="ProjectMUI.xml") returned -1 [0046.954] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned="ProjectMUI.msi" [0046.954] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" [0046.954] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned="" [0046.954] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.954] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.954] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="ProjectMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" [0046.954] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.zip") returned 0 [0046.954] lstrlenA (lpString="*.zip") returned 5 [0046.954] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.rar") returned 0 [0046.954] lstrlenA (lpString="*.rar") returned 5 [0046.954] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.7z") returned 0 [0046.954] lstrlenA (lpString="*.7z") returned 4 [0046.954] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.tar") returned 0 [0046.954] lstrlenA (lpString="*.tar") returned 5 [0046.954] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.gzip") returned 0 [0046.954] lstrlenA (lpString="*.gzip") returned 6 [0046.954] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.jpg") returned 0 [0046.955] lstrlenA (lpString="*.jpg") returned 5 [0046.955] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.jpeg") returned 0 [0046.955] lstrlenA (lpString="*.jpeg") returned 6 [0046.955] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.psd") returned 0 [0046.955] lstrlenA (lpString="*.psd") returned 5 [0046.955] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.gif") returned 0 [0046.955] lstrlenA (lpString="*.gif") returned 5 [0046.955] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.doc") returned 0 [0046.955] lstrlenA (lpString="*.doc") returned 5 [0046.955] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.docx") returned 0 [0046.955] lstrlenA (lpString="*.docx") returned 6 [0046.955] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.xls") returned 0 [0046.955] lstrlenA (lpString="*.xls") returned 5 [0046.955] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.xlsx") returned 0 [0046.955] lstrlenA (lpString="*.xlsx") returned 6 [0046.955] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.ppt") returned 0 [0046.955] lstrlenA (lpString="*.ppt") returned 5 [0046.955] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.pptx") returned 0 [0046.955] lstrlenA (lpString="*.pptx") returned 6 [0046.955] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.pdf") returned 0 [0046.955] lstrlenA (lpString="*.pdf") returned 5 [0046.955] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.mov") returned 0 [0046.955] lstrlenA (lpString="*.mov") returned 5 [0046.955] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.m2v") returned 0 [0046.955] lstrlenA (lpString="*.m2v") returned 5 [0046.955] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.3gp") returned 0 [0046.955] lstrlenA (lpString="*.3gp") returned 5 [0046.955] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.mpeg") returned 0 [0046.956] lstrlenA (lpString="*.mpeg") returned 6 [0046.956] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.mpg") returned 0 [0046.956] lstrlenA (lpString="*.mpg") returned 5 [0046.956] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.flv") returned 0 [0046.956] lstrlenA (lpString="*.flv") returned 5 [0046.956] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.avi") returned 0 [0046.956] lstrlenA (lpString="*.avi") returned 5 [0046.956] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.mp4") returned 0 [0046.956] lstrlenA (lpString="*.mp4") returned 5 [0046.956] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.wmv") returned 0 [0046.956] lstrlenA (lpString="*.wmv") returned 5 [0046.956] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.divx") returned 0 [0046.956] lstrlenA (lpString="*.divx") returned 6 [0046.956] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.mkv") returned 0 [0046.956] lstrlenA (lpString="*.mkv") returned 5 [0046.956] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.mp3") returned 0 [0046.956] lstrlenA (lpString="*.mp3") returned 5 [0046.956] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.wav") returned 0 [0046.956] lstrlenA (lpString="*.wav") returned 5 [0046.956] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.flac") returned 0 [0046.956] lstrlenA (lpString="*.flac") returned 6 [0046.956] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.ape") returned 0 [0046.956] lstrlenA (lpString="*.ape") returned 5 [0046.956] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.wma") returned 0 [0046.956] lstrlenA (lpString="*.wma") returned 5 [0046.956] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.ac3") returned 0 [0046.956] lstrlenA (lpString="*.ac3") returned 5 [0046.957] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", pszSpec="*.mxf") returned 0 [0046.957] lstrlenA (lpString="*.mxf") returned 5 [0046.957] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x780074, dwReserved1=0x74, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0046.957] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.957] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProjLR.cab") returned -1 [0046.957] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjLR.cab") returned -1 [0046.957] lstrcmpiA (lpString1="", lpString2="ProjLR.cab") returned -1 [0046.957] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned="ProjectMUI.xml" [0046.957] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" [0046.957] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned="" [0046.957] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.957] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.957] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="ProjLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" [0046.957] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.zip") returned 0 [0046.957] lstrlenA (lpString="*.zip") returned 5 [0046.957] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.rar") returned 0 [0046.957] lstrlenA (lpString="*.rar") returned 5 [0046.957] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.7z") returned 0 [0046.957] lstrlenA (lpString="*.7z") returned 4 [0046.957] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.tar") returned 0 [0046.957] lstrlenA (lpString="*.tar") returned 5 [0046.957] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.gzip") returned 0 [0046.957] lstrlenA (lpString="*.gzip") returned 6 [0046.957] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.jpg") returned 0 [0046.957] lstrlenA (lpString="*.jpg") returned 5 [0046.958] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.jpeg") returned 0 [0046.958] lstrlenA (lpString="*.jpeg") returned 6 [0046.958] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.psd") returned 0 [0046.958] lstrlenA (lpString="*.psd") returned 5 [0046.958] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.gif") returned 0 [0046.958] lstrlenA (lpString="*.gif") returned 5 [0046.958] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.doc") returned 0 [0046.958] lstrlenA (lpString="*.doc") returned 5 [0046.958] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.docx") returned 0 [0046.958] lstrlenA (lpString="*.docx") returned 6 [0046.958] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.xls") returned 0 [0046.958] lstrlenA (lpString="*.xls") returned 5 [0046.958] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.xlsx") returned 0 [0046.958] lstrlenA (lpString="*.xlsx") returned 6 [0046.958] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.ppt") returned 0 [0046.958] lstrlenA (lpString="*.ppt") returned 5 [0046.958] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.pptx") returned 0 [0046.958] lstrlenA (lpString="*.pptx") returned 6 [0046.958] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.pdf") returned 0 [0046.958] lstrlenA (lpString="*.pdf") returned 5 [0046.958] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.mov") returned 0 [0046.958] lstrlenA (lpString="*.mov") returned 5 [0046.958] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.m2v") returned 0 [0046.958] lstrlenA (lpString="*.m2v") returned 5 [0046.958] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.3gp") returned 0 [0046.958] lstrlenA (lpString="*.3gp") returned 5 [0046.958] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.mpeg") returned 0 [0046.958] lstrlenA (lpString="*.mpeg") returned 6 [0046.959] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.mpg") returned 0 [0046.959] lstrlenA (lpString="*.mpg") returned 5 [0046.959] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.flv") returned 0 [0046.959] lstrlenA (lpString="*.flv") returned 5 [0046.959] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.avi") returned 0 [0046.959] lstrlenA (lpString="*.avi") returned 5 [0046.959] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.mp4") returned 0 [0046.959] lstrlenA (lpString="*.mp4") returned 5 [0046.959] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.wmv") returned 0 [0046.959] lstrlenA (lpString="*.wmv") returned 5 [0046.959] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.divx") returned 0 [0046.959] lstrlenA (lpString="*.divx") returned 6 [0046.959] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.mkv") returned 0 [0046.959] lstrlenA (lpString="*.mkv") returned 5 [0046.959] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.mp3") returned 0 [0046.959] lstrlenA (lpString="*.mp3") returned 5 [0046.959] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.wav") returned 0 [0046.959] lstrlenA (lpString="*.wav") returned 5 [0046.959] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.flac") returned 0 [0046.959] lstrlenA (lpString="*.flac") returned 6 [0046.959] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.ape") returned 0 [0046.959] lstrlenA (lpString="*.ape") returned 5 [0046.959] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.wma") returned 0 [0046.959] lstrlenA (lpString="*.wma") returned 5 [0046.959] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.ac3") returned 0 [0046.959] lstrlenA (lpString="*.ac3") returned 5 [0046.959] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", pszSpec="*.mxf") returned 0 [0046.959] lstrlenA (lpString="*.mxf") returned 5 [0046.960] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0046.960] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.960] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0046.960] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0046.960] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0046.960] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned="ProjLR.cab" [0046.960] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" [0046.960] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned="" [0046.960] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.960] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.960] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" [0046.960] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.zip") returned 0 [0046.960] lstrlenA (lpString="*.zip") returned 5 [0046.960] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.rar") returned 0 [0046.960] lstrlenA (lpString="*.rar") returned 5 [0046.960] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.7z") returned 0 [0046.960] lstrlenA (lpString="*.7z") returned 4 [0046.960] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tar") returned 0 [0046.960] lstrlenA (lpString="*.tar") returned 5 [0046.960] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gzip") returned 0 [0046.960] lstrlenA (lpString="*.gzip") returned 6 [0046.960] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpg") returned 0 [0046.960] lstrlenA (lpString="*.jpg") returned 5 [0046.960] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpeg") returned 0 [0046.961] lstrlenA (lpString="*.jpeg") returned 6 [0046.961] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.psd") returned 0 [0046.961] lstrlenA (lpString="*.psd") returned 5 [0046.961] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gif") returned 0 [0046.961] lstrlenA (lpString="*.gif") returned 5 [0046.961] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.doc") returned 0 [0046.961] lstrlenA (lpString="*.doc") returned 5 [0046.961] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docx") returned 0 [0046.961] lstrlenA (lpString="*.docx") returned 6 [0046.961] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xls") returned 0 [0046.961] lstrlenA (lpString="*.xls") returned 5 [0046.961] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsx") returned 0 [0046.961] lstrlenA (lpString="*.xlsx") returned 6 [0046.961] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ppt") returned 0 [0046.961] lstrlenA (lpString="*.ppt") returned 5 [0046.961] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pptx") returned 0 [0046.961] lstrlenA (lpString="*.pptx") returned 6 [0046.961] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pdf") returned 0 [0046.961] lstrlenA (lpString="*.pdf") returned 5 [0046.961] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mov") returned 0 [0046.961] lstrlenA (lpString="*.mov") returned 5 [0046.961] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.m2v") returned 0 [0046.961] lstrlenA (lpString="*.m2v") returned 5 [0046.961] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.3gp") returned 0 [0046.961] lstrlenA (lpString="*.3gp") returned 5 [0046.961] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpeg") returned 0 [0046.961] lstrlenA (lpString="*.mpeg") returned 6 [0046.961] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpg") returned 0 [0046.962] lstrlenA (lpString="*.mpg") returned 5 [0046.962] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flv") returned 0 [0046.962] lstrlenA (lpString="*.flv") returned 5 [0046.962] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.avi") returned 0 [0046.962] lstrlenA (lpString="*.avi") returned 5 [0046.962] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp4") returned 0 [0046.962] lstrlenA (lpString="*.mp4") returned 5 [0046.962] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wmv") returned 0 [0046.962] lstrlenA (lpString="*.wmv") returned 5 [0046.962] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.divx") returned 0 [0046.962] lstrlenA (lpString="*.divx") returned 6 [0046.962] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mkv") returned 0 [0046.962] lstrlenA (lpString="*.mkv") returned 5 [0046.962] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp3") returned 0 [0046.962] lstrlenA (lpString="*.mp3") returned 5 [0046.962] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wav") returned 0 [0046.962] lstrlenA (lpString="*.wav") returned 5 [0046.962] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flac") returned 0 [0046.962] lstrlenA (lpString="*.flac") returned 6 [0046.962] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ape") returned 0 [0046.962] lstrlenA (lpString="*.ape") returned 5 [0046.962] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wma") returned 0 [0046.962] lstrlenA (lpString="*.wma") returned 5 [0046.962] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ac3") returned 0 [0046.962] lstrlenA (lpString="*.ac3") returned 5 [0046.962] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mxf") returned 0 [0046.962] lstrlenA (lpString="*.mxf") returned 5 [0046.963] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0046.963] FindClose (in: hFindFile=0x2d6f20 | out: hFindFile=0x2d6f20) returned 1 [0046.963] FindNextFileA (in: hFindFile=0x2d6f60, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0046.963] lstrcmpA (lpString1=".", lpString2="{90140000-00BA-0409-1000-0000000FF1CE}-C") returned -1 [0046.963] lstrcmpA (lpString1="..", lpString2="{90140000-00BA-0409-1000-0000000FF1CE}-C") returned -1 [0046.963] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0046.963] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-00BA-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C" [0046.963] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C") returned 62 [0046.963] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2d6f20 [0046.967] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.967] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.967] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.967] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.967] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0046.967] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.967] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GrooveLR.cab") returned -1 [0046.967] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GrooveLR.cab") returned 1 [0046.967] lstrcmpiA (lpString1="", lpString2="GrooveLR.cab") returned -1 [0046.968] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0046.968] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" [0046.968] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned="" [0046.968] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.968] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0046.968] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0046.968] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.968] WriteFile (in: hFile=0x88, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.970] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.970] CloseHandle (hObject=0x88) returned 1 [0046.970] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="GrooveLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" [0046.970] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.zip") returned 0 [0046.970] lstrlenA (lpString="*.zip") returned 5 [0046.970] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.rar") returned 0 [0046.970] lstrlenA (lpString="*.rar") returned 5 [0046.971] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.7z") returned 0 [0046.971] lstrlenA (lpString="*.7z") returned 4 [0046.971] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.tar") returned 0 [0046.971] lstrlenA (lpString="*.tar") returned 5 [0046.971] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.gzip") returned 0 [0046.971] lstrlenA (lpString="*.gzip") returned 6 [0046.971] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.jpg") returned 0 [0046.971] lstrlenA (lpString="*.jpg") returned 5 [0046.971] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.jpeg") returned 0 [0046.971] lstrlenA (lpString="*.jpeg") returned 6 [0046.971] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.psd") returned 0 [0046.971] lstrlenA (lpString="*.psd") returned 5 [0046.971] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.gif") returned 0 [0046.971] lstrlenA (lpString="*.gif") returned 5 [0046.971] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.doc") returned 0 [0046.971] lstrlenA (lpString="*.doc") returned 5 [0046.971] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.docx") returned 0 [0046.971] lstrlenA (lpString="*.docx") returned 6 [0046.971] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.xls") returned 0 [0046.971] lstrlenA (lpString="*.xls") returned 5 [0046.971] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.xlsx") returned 0 [0046.971] lstrlenA (lpString="*.xlsx") returned 6 [0046.971] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.ppt") returned 0 [0046.971] lstrlenA (lpString="*.ppt") returned 5 [0046.971] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.pptx") returned 0 [0046.971] lstrlenA (lpString="*.pptx") returned 6 [0046.971] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.pdf") returned 0 [0046.971] lstrlenA (lpString="*.pdf") returned 5 [0046.971] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.mov") returned 0 [0046.972] lstrlenA (lpString="*.mov") returned 5 [0046.972] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.m2v") returned 0 [0046.972] lstrlenA (lpString="*.m2v") returned 5 [0046.972] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.3gp") returned 0 [0046.972] lstrlenA (lpString="*.3gp") returned 5 [0046.972] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.mpeg") returned 0 [0046.972] lstrlenA (lpString="*.mpeg") returned 6 [0046.972] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.mpg") returned 0 [0046.972] lstrlenA (lpString="*.mpg") returned 5 [0046.972] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.flv") returned 0 [0046.972] lstrlenA (lpString="*.flv") returned 5 [0046.972] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.avi") returned 0 [0046.972] lstrlenA (lpString="*.avi") returned 5 [0046.972] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.mp4") returned 0 [0046.972] lstrlenA (lpString="*.mp4") returned 5 [0046.972] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.wmv") returned 0 [0046.972] lstrlenA (lpString="*.wmv") returned 5 [0046.972] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.divx") returned 0 [0046.972] lstrlenA (lpString="*.divx") returned 6 [0046.972] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.mkv") returned 0 [0046.972] lstrlenA (lpString="*.mkv") returned 5 [0046.972] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.mp3") returned 0 [0046.972] lstrlenA (lpString="*.mp3") returned 5 [0046.972] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.wav") returned 0 [0046.972] lstrlenA (lpString="*.wav") returned 5 [0046.972] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.flac") returned 0 [0046.972] lstrlenA (lpString="*.flac") returned 6 [0046.973] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.ape") returned 0 [0046.973] lstrlenA (lpString="*.ape") returned 5 [0046.973] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.wma") returned 0 [0046.973] lstrlenA (lpString="*.wma") returned 5 [0046.973] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.ac3") returned 0 [0046.973] lstrlenA (lpString="*.ac3") returned 5 [0046.973] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", pszSpec="*.mxf") returned 0 [0046.973] lstrlenA (lpString="*.mxf") returned 5 [0046.973] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x2d9290, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0046.973] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.973] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GrooveMUI.msi") returned -1 [0046.973] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GrooveMUI.msi") returned 1 [0046.973] lstrcmpiA (lpString1="", lpString2="GrooveMUI.msi") returned -1 [0046.973] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned="GrooveLR.cab" [0046.973] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" [0046.973] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned="" [0046.973] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.973] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.973] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="GrooveMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" [0046.973] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.zip") returned 0 [0046.973] lstrlenA (lpString="*.zip") returned 5 [0046.973] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.rar") returned 0 [0046.974] lstrlenA (lpString="*.rar") returned 5 [0046.974] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.7z") returned 0 [0046.974] lstrlenA (lpString="*.7z") returned 4 [0046.974] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.tar") returned 0 [0046.974] lstrlenA (lpString="*.tar") returned 5 [0046.974] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.gzip") returned 0 [0046.974] lstrlenA (lpString="*.gzip") returned 6 [0046.974] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.jpg") returned 0 [0046.974] lstrlenA (lpString="*.jpg") returned 5 [0046.974] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.jpeg") returned 0 [0046.974] lstrlenA (lpString="*.jpeg") returned 6 [0046.974] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.psd") returned 0 [0046.974] lstrlenA (lpString="*.psd") returned 5 [0046.974] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.gif") returned 0 [0046.974] lstrlenA (lpString="*.gif") returned 5 [0046.974] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.doc") returned 0 [0046.974] lstrlenA (lpString="*.doc") returned 5 [0046.974] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.docx") returned 0 [0046.974] lstrlenA (lpString="*.docx") returned 6 [0046.974] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.xls") returned 0 [0046.974] lstrlenA (lpString="*.xls") returned 5 [0046.974] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.xlsx") returned 0 [0046.974] lstrlenA (lpString="*.xlsx") returned 6 [0046.974] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.ppt") returned 0 [0046.974] lstrlenA (lpString="*.ppt") returned 5 [0046.974] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.pptx") returned 0 [0046.975] lstrlenA (lpString="*.pptx") returned 6 [0046.975] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.pdf") returned 0 [0046.975] lstrlenA (lpString="*.pdf") returned 5 [0046.975] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.mov") returned 0 [0046.975] lstrlenA (lpString="*.mov") returned 5 [0046.975] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.m2v") returned 0 [0046.975] lstrlenA (lpString="*.m2v") returned 5 [0046.975] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.3gp") returned 0 [0046.975] lstrlenA (lpString="*.3gp") returned 5 [0046.975] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.mpeg") returned 0 [0046.975] lstrlenA (lpString="*.mpeg") returned 6 [0046.975] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.mpg") returned 0 [0046.975] lstrlenA (lpString="*.mpg") returned 5 [0046.975] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.flv") returned 0 [0046.975] lstrlenA (lpString="*.flv") returned 5 [0046.975] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.avi") returned 0 [0046.975] lstrlenA (lpString="*.avi") returned 5 [0046.975] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.mp4") returned 0 [0046.975] lstrlenA (lpString="*.mp4") returned 5 [0046.975] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.wmv") returned 0 [0046.975] lstrlenA (lpString="*.wmv") returned 5 [0046.975] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.divx") returned 0 [0046.975] lstrlenA (lpString="*.divx") returned 6 [0046.975] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.mkv") returned 0 [0046.975] lstrlenA (lpString="*.mkv") returned 5 [0046.975] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.mp3") returned 0 [0046.975] lstrlenA (lpString="*.mp3") returned 5 [0046.976] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.wav") returned 0 [0046.976] lstrlenA (lpString="*.wav") returned 5 [0046.976] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.flac") returned 0 [0046.976] lstrlenA (lpString="*.flac") returned 6 [0046.976] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.ape") returned 0 [0046.976] lstrlenA (lpString="*.ape") returned 5 [0046.976] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.wma") returned 0 [0046.976] lstrlenA (lpString="*.wma") returned 5 [0046.976] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.ac3") returned 0 [0046.976] lstrlenA (lpString="*.ac3") returned 5 [0046.976] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", pszSpec="*.mxf") returned 0 [0046.976] lstrlenA (lpString="*.mxf") returned 5 [0046.976] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x780074, dwReserved1=0x74, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0046.976] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.976] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GrooveMUI.xml") returned -1 [0046.976] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GrooveMUI.xml") returned 1 [0046.976] lstrcmpiA (lpString1="", lpString2="GrooveMUI.xml") returned -1 [0046.976] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned="GrooveMUI.msi" [0046.976] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" [0046.976] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned="" [0046.976] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.976] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.976] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="GrooveMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" [0046.977] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.zip") returned 0 [0046.977] lstrlenA (lpString="*.zip") returned 5 [0046.977] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.rar") returned 0 [0046.977] lstrlenA (lpString="*.rar") returned 5 [0046.977] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.7z") returned 0 [0046.977] lstrlenA (lpString="*.7z") returned 4 [0046.977] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.tar") returned 0 [0046.977] lstrlenA (lpString="*.tar") returned 5 [0046.977] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.gzip") returned 0 [0046.977] lstrlenA (lpString="*.gzip") returned 6 [0046.977] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.jpg") returned 0 [0046.977] lstrlenA (lpString="*.jpg") returned 5 [0046.977] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.jpeg") returned 0 [0046.977] lstrlenA (lpString="*.jpeg") returned 6 [0046.977] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.psd") returned 0 [0046.977] lstrlenA (lpString="*.psd") returned 5 [0046.977] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.gif") returned 0 [0046.977] lstrlenA (lpString="*.gif") returned 5 [0046.977] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.doc") returned 0 [0046.977] lstrlenA (lpString="*.doc") returned 5 [0046.977] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.docx") returned 0 [0046.977] lstrlenA (lpString="*.docx") returned 6 [0046.977] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.xls") returned 0 [0046.977] lstrlenA (lpString="*.xls") returned 5 [0046.977] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.xlsx") returned 0 [0046.977] lstrlenA (lpString="*.xlsx") returned 6 [0046.977] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.ppt") returned 0 [0046.978] lstrlenA (lpString="*.ppt") returned 5 [0046.978] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.pptx") returned 0 [0046.978] lstrlenA (lpString="*.pptx") returned 6 [0046.978] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.pdf") returned 0 [0046.978] lstrlenA (lpString="*.pdf") returned 5 [0046.978] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.mov") returned 0 [0046.978] lstrlenA (lpString="*.mov") returned 5 [0046.978] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.m2v") returned 0 [0046.978] lstrlenA (lpString="*.m2v") returned 5 [0046.978] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.3gp") returned 0 [0046.978] lstrlenA (lpString="*.3gp") returned 5 [0046.978] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.mpeg") returned 0 [0046.978] lstrlenA (lpString="*.mpeg") returned 6 [0046.978] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.mpg") returned 0 [0046.978] lstrlenA (lpString="*.mpg") returned 5 [0046.978] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.flv") returned 0 [0046.978] lstrlenA (lpString="*.flv") returned 5 [0046.978] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.avi") returned 0 [0046.978] lstrlenA (lpString="*.avi") returned 5 [0046.978] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.mp4") returned 0 [0046.978] lstrlenA (lpString="*.mp4") returned 5 [0046.978] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.wmv") returned 0 [0046.978] lstrlenA (lpString="*.wmv") returned 5 [0046.978] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.divx") returned 0 [0046.978] lstrlenA (lpString="*.divx") returned 6 [0046.978] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.mkv") returned 0 [0046.978] lstrlenA (lpString="*.mkv") returned 5 [0046.979] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.mp3") returned 0 [0046.979] lstrlenA (lpString="*.mp3") returned 5 [0046.979] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.wav") returned 0 [0046.979] lstrlenA (lpString="*.wav") returned 5 [0046.979] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.flac") returned 0 [0046.979] lstrlenA (lpString="*.flac") returned 6 [0046.979] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.ape") returned 0 [0046.979] lstrlenA (lpString="*.ape") returned 5 [0046.979] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.wma") returned 0 [0046.979] lstrlenA (lpString="*.wma") returned 5 [0046.979] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.ac3") returned 0 [0046.979] lstrlenA (lpString="*.ac3") returned 5 [0046.979] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", pszSpec="*.mxf") returned 0 [0046.979] lstrlenA (lpString="*.mxf") returned 5 [0046.979] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0046.979] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.979] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0046.979] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0046.979] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0046.979] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned="GrooveMUI.xml" [0046.979] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" [0046.979] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned="" [0046.979] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.979] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0046.980] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" [0046.980] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.zip") returned 0 [0046.980] lstrlenA (lpString="*.zip") returned 5 [0046.980] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.rar") returned 0 [0046.980] lstrlenA (lpString="*.rar") returned 5 [0046.980] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.7z") returned 0 [0046.980] lstrlenA (lpString="*.7z") returned 4 [0046.980] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tar") returned 0 [0046.980] lstrlenA (lpString="*.tar") returned 5 [0046.980] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gzip") returned 0 [0046.980] lstrlenA (lpString="*.gzip") returned 6 [0046.980] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpg") returned 0 [0046.980] lstrlenA (lpString="*.jpg") returned 5 [0046.980] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpeg") returned 0 [0046.980] lstrlenA (lpString="*.jpeg") returned 6 [0046.980] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.psd") returned 0 [0046.980] lstrlenA (lpString="*.psd") returned 5 [0046.980] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gif") returned 0 [0046.980] lstrlenA (lpString="*.gif") returned 5 [0046.980] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.doc") returned 0 [0046.980] lstrlenA (lpString="*.doc") returned 5 [0046.980] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docx") returned 0 [0046.980] lstrlenA (lpString="*.docx") returned 6 [0046.980] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xls") returned 0 [0046.980] lstrlenA (lpString="*.xls") returned 5 [0046.980] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsx") returned 0 [0046.980] lstrlenA (lpString="*.xlsx") returned 6 [0046.981] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ppt") returned 0 [0046.981] lstrlenA (lpString="*.ppt") returned 5 [0046.981] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pptx") returned 0 [0046.981] lstrlenA (lpString="*.pptx") returned 6 [0046.981] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pdf") returned 0 [0046.981] lstrlenA (lpString="*.pdf") returned 5 [0046.981] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mov") returned 0 [0046.981] lstrlenA (lpString="*.mov") returned 5 [0046.981] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.m2v") returned 0 [0046.981] lstrlenA (lpString="*.m2v") returned 5 [0046.981] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.3gp") returned 0 [0046.981] lstrlenA (lpString="*.3gp") returned 5 [0046.981] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpeg") returned 0 [0046.981] lstrlenA (lpString="*.mpeg") returned 6 [0046.981] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpg") returned 0 [0046.981] lstrlenA (lpString="*.mpg") returned 5 [0046.981] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flv") returned 0 [0046.981] lstrlenA (lpString="*.flv") returned 5 [0046.981] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.avi") returned 0 [0046.981] lstrlenA (lpString="*.avi") returned 5 [0046.981] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp4") returned 0 [0046.981] lstrlenA (lpString="*.mp4") returned 5 [0046.981] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wmv") returned 0 [0046.981] lstrlenA (lpString="*.wmv") returned 5 [0046.981] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.divx") returned 0 [0046.981] lstrlenA (lpString="*.divx") returned 6 [0046.981] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mkv") returned 0 [0046.982] lstrlenA (lpString="*.mkv") returned 5 [0046.982] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp3") returned 0 [0046.982] lstrlenA (lpString="*.mp3") returned 5 [0046.982] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wav") returned 0 [0046.982] lstrlenA (lpString="*.wav") returned 5 [0046.982] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flac") returned 0 [0046.982] lstrlenA (lpString="*.flac") returned 6 [0046.982] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ape") returned 0 [0046.982] lstrlenA (lpString="*.ape") returned 5 [0046.982] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wma") returned 0 [0046.982] lstrlenA (lpString="*.wma") returned 5 [0046.982] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ac3") returned 0 [0046.982] lstrlenA (lpString="*.ac3") returned 5 [0046.982] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mxf") returned 0 [0046.982] lstrlenA (lpString="*.mxf") returned 5 [0046.982] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0046.982] FindClose (in: hFindFile=0x2d6f20 | out: hFindFile=0x2d6f20) returned 1 [0046.983] FindNextFileA (in: hFindFile=0x2d6f60, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0046.983] lstrcmpA (lpString1=".", lpString2="{90140000-0115-0409-1000-0000000FF1CE}-C") returned -1 [0046.983] lstrcmpA (lpString1="..", lpString2="{90140000-0115-0409-1000-0000000FF1CE}-C") returned -1 [0046.983] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0046.983] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0115-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C" [0046.983] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C") returned 62 [0046.983] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2d6f20 [0046.988] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.988] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.989] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.989] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.989] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0046.989] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0046.989] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0046.989] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0046.989] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="1033" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033" [0046.989] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033") returned 67 [0046.989] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d7fa8, dwReserved1=0x2d7fa3, cFileName=".", cAlternateFileName="")) returned 0x2d9048 [0046.990] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0046.990] FindNextFileA (in: hFindFile=0x2d9048, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0046.990] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0046.990] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0046.990] FindNextFileA (in: hFindFile=0x2d9048, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0046.990] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0046.990] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dwintl20.dll") returned 1 [0046.990] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dwintl20.dll") returned 1 [0046.990] lstrcmpiA (lpString1="", lpString2="dwintl20.dll") returned -1 [0046.990] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*.*") returned="*.*" [0046.991] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\" [0046.991] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\") returned="" [0046.991] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\HOW TO DECRYPT FILES.txt" [0046.991] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\how to decrypt files.txt")) returned 0xffffffff [0046.991] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0046.992] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.992] WriteFile (in: hFile=0x8c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0046.993] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0046.994] CloseHandle (hObject=0x8c) returned 1 [0046.994] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpString2="dwintl20.dll" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" [0046.994] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.zip") returned 0 [0046.994] lstrlenA (lpString="*.zip") returned 5 [0046.994] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.rar") returned 0 [0046.994] lstrlenA (lpString="*.rar") returned 5 [0046.994] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.7z") returned 0 [0046.994] lstrlenA (lpString="*.7z") returned 4 [0046.994] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.tar") returned 0 [0046.994] lstrlenA (lpString="*.tar") returned 5 [0046.994] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.gzip") returned 0 [0046.995] lstrlenA (lpString="*.gzip") returned 6 [0046.995] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.jpg") returned 0 [0046.995] lstrlenA (lpString="*.jpg") returned 5 [0046.995] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.jpeg") returned 0 [0046.995] lstrlenA (lpString="*.jpeg") returned 6 [0046.995] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.psd") returned 0 [0046.995] lstrlenA (lpString="*.psd") returned 5 [0046.995] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.gif") returned 0 [0046.995] lstrlenA (lpString="*.gif") returned 5 [0046.995] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.doc") returned 0 [0046.995] lstrlenA (lpString="*.doc") returned 5 [0046.995] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.docx") returned 0 [0046.995] lstrlenA (lpString="*.docx") returned 6 [0046.995] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.xls") returned 0 [0046.995] lstrlenA (lpString="*.xls") returned 5 [0046.995] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.xlsx") returned 0 [0046.995] lstrlenA (lpString="*.xlsx") returned 6 [0046.995] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.ppt") returned 0 [0046.995] lstrlenA (lpString="*.ppt") returned 5 [0046.995] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.pptx") returned 0 [0046.995] lstrlenA (lpString="*.pptx") returned 6 [0046.995] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.pdf") returned 0 [0046.995] lstrlenA (lpString="*.pdf") returned 5 [0046.995] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.mov") returned 0 [0046.995] lstrlenA (lpString="*.mov") returned 5 [0046.995] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.m2v") returned 0 [0046.995] lstrlenA (lpString="*.m2v") returned 5 [0046.996] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.3gp") returned 0 [0046.996] lstrlenA (lpString="*.3gp") returned 5 [0046.996] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.mpeg") returned 0 [0046.996] lstrlenA (lpString="*.mpeg") returned 6 [0046.996] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.mpg") returned 0 [0046.996] lstrlenA (lpString="*.mpg") returned 5 [0046.996] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.flv") returned 0 [0046.996] lstrlenA (lpString="*.flv") returned 5 [0046.996] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.avi") returned 0 [0046.996] lstrlenA (lpString="*.avi") returned 5 [0046.996] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.mp4") returned 0 [0046.996] lstrlenA (lpString="*.mp4") returned 5 [0046.996] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.wmv") returned 0 [0046.996] lstrlenA (lpString="*.wmv") returned 5 [0046.996] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.divx") returned 0 [0046.996] lstrlenA (lpString="*.divx") returned 6 [0046.996] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.mkv") returned 0 [0046.996] lstrlenA (lpString="*.mkv") returned 5 [0046.996] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.mp3") returned 0 [0046.996] lstrlenA (lpString="*.mp3") returned 5 [0046.996] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.wav") returned 0 [0046.996] lstrlenA (lpString="*.wav") returned 5 [0046.996] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.flac") returned 0 [0046.996] lstrlenA (lpString="*.flac") returned 6 [0046.996] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.ape") returned 0 [0046.996] lstrlenA (lpString="*.ape") returned 5 [0046.996] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.wma") returned 0 [0046.996] lstrlenA (lpString="*.wma") returned 5 [0046.997] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.ac3") returned 0 [0046.997] lstrlenA (lpString="*.ac3") returned 5 [0046.997] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", pszSpec="*.mxf") returned 0 [0046.997] lstrlenA (lpString="*.mxf") returned 5 [0046.997] FindNextFileA (in: hFindFile=0x2d9048, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0046.997] FindClose (in: hFindFile=0x2d9048 | out: hFindFile=0x2d9048) returned 1 [0046.997] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0046.997] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0046.997] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="branding.xml") returned 1 [0046.997] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="branding.xml") returned 1 [0046.997] lstrcmpiA (lpString1="", lpString2="branding.xml") returned -1 [0046.997] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0046.997] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0046.997] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0046.997] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0046.997] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0046.997] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0046.998] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0046.998] WriteFile (in: hFile=0x88, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0047.000] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.000] CloseHandle (hObject=0x88) returned 1 [0047.000] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="branding.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" [0047.001] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.zip") returned 0 [0047.001] lstrlenA (lpString="*.zip") returned 5 [0047.001] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.rar") returned 0 [0047.001] lstrlenA (lpString="*.rar") returned 5 [0047.001] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.7z") returned 0 [0047.001] lstrlenA (lpString="*.7z") returned 4 [0047.001] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.tar") returned 0 [0047.001] lstrlenA (lpString="*.tar") returned 5 [0047.001] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.gzip") returned 0 [0047.001] lstrlenA (lpString="*.gzip") returned 6 [0047.001] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.jpg") returned 0 [0047.001] lstrlenA (lpString="*.jpg") returned 5 [0047.001] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.jpeg") returned 0 [0047.001] lstrlenA (lpString="*.jpeg") returned 6 [0047.001] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.psd") returned 0 [0047.001] lstrlenA (lpString="*.psd") returned 5 [0047.001] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.gif") returned 0 [0047.001] lstrlenA (lpString="*.gif") returned 5 [0047.001] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.doc") returned 0 [0047.001] lstrlenA (lpString="*.doc") returned 5 [0047.001] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.docx") returned 0 [0047.001] lstrlenA (lpString="*.docx") returned 6 [0047.001] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.xls") returned 0 [0047.001] lstrlenA (lpString="*.xls") returned 5 [0047.001] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.xlsx") returned 0 [0047.001] lstrlenA (lpString="*.xlsx") returned 6 [0047.001] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.ppt") returned 0 [0047.001] lstrlenA (lpString="*.ppt") returned 5 [0047.002] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.pptx") returned 0 [0047.002] lstrlenA (lpString="*.pptx") returned 6 [0047.002] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.pdf") returned 0 [0047.002] lstrlenA (lpString="*.pdf") returned 5 [0047.002] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.mov") returned 0 [0047.002] lstrlenA (lpString="*.mov") returned 5 [0047.002] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.m2v") returned 0 [0047.002] lstrlenA (lpString="*.m2v") returned 5 [0047.002] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.3gp") returned 0 [0047.002] lstrlenA (lpString="*.3gp") returned 5 [0047.002] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.mpeg") returned 0 [0047.002] lstrlenA (lpString="*.mpeg") returned 6 [0047.002] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.mpg") returned 0 [0047.002] lstrlenA (lpString="*.mpg") returned 5 [0047.002] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.flv") returned 0 [0047.002] lstrlenA (lpString="*.flv") returned 5 [0047.002] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.avi") returned 0 [0047.002] lstrlenA (lpString="*.avi") returned 5 [0047.002] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.mp4") returned 0 [0047.002] lstrlenA (lpString="*.mp4") returned 5 [0047.002] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.wmv") returned 0 [0047.002] lstrlenA (lpString="*.wmv") returned 5 [0047.002] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.divx") returned 0 [0047.002] lstrlenA (lpString="*.divx") returned 6 [0047.002] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.mkv") returned 0 [0047.002] lstrlenA (lpString="*.mkv") returned 5 [0047.002] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.mp3") returned 0 [0047.002] lstrlenA (lpString="*.mp3") returned 5 [0047.003] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.wav") returned 0 [0047.003] lstrlenA (lpString="*.wav") returned 5 [0047.003] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.flac") returned 0 [0047.003] lstrlenA (lpString="*.flac") returned 6 [0047.003] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.ape") returned 0 [0047.003] lstrlenA (lpString="*.ape") returned 5 [0047.003] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.wma") returned 0 [0047.003] lstrlenA (lpString="*.wma") returned 5 [0047.003] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.ac3") returned 0 [0047.003] lstrlenA (lpString="*.ac3") returned 5 [0047.003] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", pszSpec="*.mxf") returned 0 [0047.003] lstrlenA (lpString="*.mxf") returned 5 [0047.003] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x2d9290, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0047.003] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.003] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DW20.EXE") returned 1 [0047.003] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DW20.EXE") returned 1 [0047.003] lstrcmpiA (lpString1="", lpString2="DW20.EXE") returned -1 [0047.003] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned="branding.xml" [0047.003] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0047.003] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0047.003] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.003] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.003] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="DW20.EXE" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" [0047.004] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.zip") returned 0 [0047.004] lstrlenA (lpString="*.zip") returned 5 [0047.004] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.rar") returned 0 [0047.004] lstrlenA (lpString="*.rar") returned 5 [0047.004] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.7z") returned 0 [0047.004] lstrlenA (lpString="*.7z") returned 4 [0047.004] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.tar") returned 0 [0047.004] lstrlenA (lpString="*.tar") returned 5 [0047.004] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.gzip") returned 0 [0047.004] lstrlenA (lpString="*.gzip") returned 6 [0047.004] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.jpg") returned 0 [0047.004] lstrlenA (lpString="*.jpg") returned 5 [0047.004] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.jpeg") returned 0 [0047.004] lstrlenA (lpString="*.jpeg") returned 6 [0047.004] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.psd") returned 0 [0047.004] lstrlenA (lpString="*.psd") returned 5 [0047.004] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.gif") returned 0 [0047.004] lstrlenA (lpString="*.gif") returned 5 [0047.004] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.doc") returned 0 [0047.004] lstrlenA (lpString="*.doc") returned 5 [0047.004] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.docx") returned 0 [0047.004] lstrlenA (lpString="*.docx") returned 6 [0047.004] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.xls") returned 0 [0047.004] lstrlenA (lpString="*.xls") returned 5 [0047.004] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.xlsx") returned 0 [0047.004] lstrlenA (lpString="*.xlsx") returned 6 [0047.004] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.ppt") returned 0 [0047.005] lstrlenA (lpString="*.ppt") returned 5 [0047.005] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.pptx") returned 0 [0047.005] lstrlenA (lpString="*.pptx") returned 6 [0047.005] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.pdf") returned 0 [0047.005] lstrlenA (lpString="*.pdf") returned 5 [0047.005] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.mov") returned 0 [0047.005] lstrlenA (lpString="*.mov") returned 5 [0047.005] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.m2v") returned 0 [0047.005] lstrlenA (lpString="*.m2v") returned 5 [0047.005] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.3gp") returned 0 [0047.005] lstrlenA (lpString="*.3gp") returned 5 [0047.005] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.mpeg") returned 0 [0047.005] lstrlenA (lpString="*.mpeg") returned 6 [0047.005] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.mpg") returned 0 [0047.005] lstrlenA (lpString="*.mpg") returned 5 [0047.005] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.flv") returned 0 [0047.005] lstrlenA (lpString="*.flv") returned 5 [0047.005] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.avi") returned 0 [0047.005] lstrlenA (lpString="*.avi") returned 5 [0047.005] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.mp4") returned 0 [0047.005] lstrlenA (lpString="*.mp4") returned 5 [0047.005] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.wmv") returned 0 [0047.005] lstrlenA (lpString="*.wmv") returned 5 [0047.005] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.divx") returned 0 [0047.005] lstrlenA (lpString="*.divx") returned 6 [0047.005] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.mkv") returned 0 [0047.005] lstrlenA (lpString="*.mkv") returned 5 [0047.005] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.mp3") returned 0 [0047.005] lstrlenA (lpString="*.mp3") returned 5 [0047.006] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.wav") returned 0 [0047.006] lstrlenA (lpString="*.wav") returned 5 [0047.006] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.flac") returned 0 [0047.006] lstrlenA (lpString="*.flac") returned 6 [0047.006] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.ape") returned 0 [0047.006] lstrlenA (lpString="*.ape") returned 5 [0047.006] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.wma") returned 0 [0047.006] lstrlenA (lpString="*.wma") returned 5 [0047.006] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.ac3") returned 0 [0047.006] lstrlenA (lpString="*.ac3") returned 5 [0047.006] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", pszSpec="*.mxf") returned 0 [0047.006] lstrlenA (lpString="*.mxf") returned 5 [0047.006] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x780074, dwReserved1=0x74, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0047.006] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.006] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dwdcw20.dll") returned 1 [0047.006] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dwdcw20.dll") returned 1 [0047.006] lstrcmpiA (lpString1="", lpString2="dwdcw20.dll") returned -1 [0047.006] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned="DW20.EXE" [0047.006] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0047.006] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0047.006] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.006] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.007] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="dwdcw20.dll" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" [0047.007] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.zip") returned 0 [0047.007] lstrlenA (lpString="*.zip") returned 5 [0047.007] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.rar") returned 0 [0047.007] lstrlenA (lpString="*.rar") returned 5 [0047.007] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.7z") returned 0 [0047.007] lstrlenA (lpString="*.7z") returned 4 [0047.007] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.tar") returned 0 [0047.007] lstrlenA (lpString="*.tar") returned 5 [0047.007] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.gzip") returned 0 [0047.007] lstrlenA (lpString="*.gzip") returned 6 [0047.007] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.jpg") returned 0 [0047.007] lstrlenA (lpString="*.jpg") returned 5 [0047.007] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.jpeg") returned 0 [0047.007] lstrlenA (lpString="*.jpeg") returned 6 [0047.007] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.psd") returned 0 [0047.007] lstrlenA (lpString="*.psd") returned 5 [0047.007] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.gif") returned 0 [0047.007] lstrlenA (lpString="*.gif") returned 5 [0047.007] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.doc") returned 0 [0047.007] lstrlenA (lpString="*.doc") returned 5 [0047.007] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.docx") returned 0 [0047.007] lstrlenA (lpString="*.docx") returned 6 [0047.007] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.xls") returned 0 [0047.007] lstrlenA (lpString="*.xls") returned 5 [0047.007] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.xlsx") returned 0 [0047.008] lstrlenA (lpString="*.xlsx") returned 6 [0047.008] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.ppt") returned 0 [0047.008] lstrlenA (lpString="*.ppt") returned 5 [0047.008] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.pptx") returned 0 [0047.008] lstrlenA (lpString="*.pptx") returned 6 [0047.008] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.pdf") returned 0 [0047.008] lstrlenA (lpString="*.pdf") returned 5 [0047.008] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.mov") returned 0 [0047.008] lstrlenA (lpString="*.mov") returned 5 [0047.008] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.m2v") returned 0 [0047.008] lstrlenA (lpString="*.m2v") returned 5 [0047.008] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.3gp") returned 0 [0047.008] lstrlenA (lpString="*.3gp") returned 5 [0047.008] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.mpeg") returned 0 [0047.008] lstrlenA (lpString="*.mpeg") returned 6 [0047.008] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.mpg") returned 0 [0047.008] lstrlenA (lpString="*.mpg") returned 5 [0047.008] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.flv") returned 0 [0047.008] lstrlenA (lpString="*.flv") returned 5 [0047.008] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.avi") returned 0 [0047.008] lstrlenA (lpString="*.avi") returned 5 [0047.008] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.mp4") returned 0 [0047.008] lstrlenA (lpString="*.mp4") returned 5 [0047.008] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.wmv") returned 0 [0047.008] lstrlenA (lpString="*.wmv") returned 5 [0047.008] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.divx") returned 0 [0047.008] lstrlenA (lpString="*.divx") returned 6 [0047.008] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.mkv") returned 0 [0047.009] lstrlenA (lpString="*.mkv") returned 5 [0047.009] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.mp3") returned 0 [0047.009] lstrlenA (lpString="*.mp3") returned 5 [0047.009] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.wav") returned 0 [0047.009] lstrlenA (lpString="*.wav") returned 5 [0047.009] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.flac") returned 0 [0047.009] lstrlenA (lpString="*.flac") returned 6 [0047.009] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.ape") returned 0 [0047.009] lstrlenA (lpString="*.ape") returned 5 [0047.009] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.wma") returned 0 [0047.009] lstrlenA (lpString="*.wma") returned 5 [0047.009] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.ac3") returned 0 [0047.009] lstrlenA (lpString="*.ac3") returned 5 [0047.009] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", pszSpec="*.mxf") returned 0 [0047.009] lstrlenA (lpString="*.mxf") returned 5 [0047.009] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x780074, dwReserved1=0x74, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0047.009] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.009] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dwtrig20.exe") returned 1 [0047.009] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dwtrig20.exe") returned 1 [0047.009] lstrcmpiA (lpString1="", lpString2="dwtrig20.exe") returned -1 [0047.009] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned="dwdcw20.dll" [0047.009] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0047.009] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0047.009] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.009] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.010] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="dwtrig20.exe" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" [0047.010] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.zip") returned 0 [0047.010] lstrlenA (lpString="*.zip") returned 5 [0047.010] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.rar") returned 0 [0047.010] lstrlenA (lpString="*.rar") returned 5 [0047.010] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.7z") returned 0 [0047.010] lstrlenA (lpString="*.7z") returned 4 [0047.010] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.tar") returned 0 [0047.010] lstrlenA (lpString="*.tar") returned 5 [0047.010] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.gzip") returned 0 [0047.010] lstrlenA (lpString="*.gzip") returned 6 [0047.010] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.jpg") returned 0 [0047.010] lstrlenA (lpString="*.jpg") returned 5 [0047.010] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.jpeg") returned 0 [0047.010] lstrlenA (lpString="*.jpeg") returned 6 [0047.010] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.psd") returned 0 [0047.010] lstrlenA (lpString="*.psd") returned 5 [0047.010] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.gif") returned 0 [0047.010] lstrlenA (lpString="*.gif") returned 5 [0047.010] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.doc") returned 0 [0047.010] lstrlenA (lpString="*.doc") returned 5 [0047.010] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.docx") returned 0 [0047.010] lstrlenA (lpString="*.docx") returned 6 [0047.010] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.xls") returned 0 [0047.010] lstrlenA (lpString="*.xls") returned 5 [0047.010] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.xlsx") returned 0 [0047.010] lstrlenA (lpString="*.xlsx") returned 6 [0047.010] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.ppt") returned 0 [0047.011] lstrlenA (lpString="*.ppt") returned 5 [0047.011] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.pptx") returned 0 [0047.011] lstrlenA (lpString="*.pptx") returned 6 [0047.011] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.pdf") returned 0 [0047.011] lstrlenA (lpString="*.pdf") returned 5 [0047.011] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.mov") returned 0 [0047.011] lstrlenA (lpString="*.mov") returned 5 [0047.011] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.m2v") returned 0 [0047.011] lstrlenA (lpString="*.m2v") returned 5 [0047.011] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.3gp") returned 0 [0047.011] lstrlenA (lpString="*.3gp") returned 5 [0047.011] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.mpeg") returned 0 [0047.011] lstrlenA (lpString="*.mpeg") returned 6 [0047.011] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.mpg") returned 0 [0047.011] lstrlenA (lpString="*.mpg") returned 5 [0047.011] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.flv") returned 0 [0047.011] lstrlenA (lpString="*.flv") returned 5 [0047.011] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.avi") returned 0 [0047.011] lstrlenA (lpString="*.avi") returned 5 [0047.011] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.mp4") returned 0 [0047.011] lstrlenA (lpString="*.mp4") returned 5 [0047.011] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.wmv") returned 0 [0047.011] lstrlenA (lpString="*.wmv") returned 5 [0047.011] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.divx") returned 0 [0047.011] lstrlenA (lpString="*.divx") returned 6 [0047.011] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.mkv") returned 0 [0047.011] lstrlenA (lpString="*.mkv") returned 5 [0047.011] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.mp3") returned 0 [0047.012] lstrlenA (lpString="*.mp3") returned 5 [0047.012] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.wav") returned 0 [0047.012] lstrlenA (lpString="*.wav") returned 5 [0047.012] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.flac") returned 0 [0047.012] lstrlenA (lpString="*.flac") returned 6 [0047.012] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.ape") returned 0 [0047.012] lstrlenA (lpString="*.ape") returned 5 [0047.012] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.wma") returned 0 [0047.012] lstrlenA (lpString="*.wma") returned 5 [0047.012] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.ac3") returned 0 [0047.012] lstrlenA (lpString="*.ac3") returned 5 [0047.012] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", pszSpec="*.mxf") returned 0 [0047.012] lstrlenA (lpString="*.mxf") returned 5 [0047.012] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0047.012] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.012] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.VC90.CRT.manifest") returned -1 [0047.012] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VC90.CRT.manifest") returned -1 [0047.012] lstrcmpiA (lpString1="", lpString2="Microsoft.VC90.CRT.manifest") returned -1 [0047.012] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned="dwtrig20.exe" [0047.012] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0047.012] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0047.012] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.012] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.012] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="Microsoft.VC90.CRT.manifest" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" [0047.012] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.zip") returned 0 [0047.012] lstrlenA (lpString="*.zip") returned 5 [0047.013] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.rar") returned 0 [0047.013] lstrlenA (lpString="*.rar") returned 5 [0047.013] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.7z") returned 0 [0047.013] lstrlenA (lpString="*.7z") returned 4 [0047.013] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.tar") returned 0 [0047.013] lstrlenA (lpString="*.tar") returned 5 [0047.013] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.gzip") returned 0 [0047.013] lstrlenA (lpString="*.gzip") returned 6 [0047.013] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.jpg") returned 0 [0047.013] lstrlenA (lpString="*.jpg") returned 5 [0047.013] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.jpeg") returned 0 [0047.013] lstrlenA (lpString="*.jpeg") returned 6 [0047.013] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.psd") returned 0 [0047.013] lstrlenA (lpString="*.psd") returned 5 [0047.013] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.gif") returned 0 [0047.013] lstrlenA (lpString="*.gif") returned 5 [0047.013] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.doc") returned 0 [0047.014] lstrlenA (lpString="*.doc") returned 5 [0047.014] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.docx") returned 0 [0047.014] lstrlenA (lpString="*.docx") returned 6 [0047.014] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.xls") returned 0 [0047.014] lstrlenA (lpString="*.xls") returned 5 [0047.014] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.xlsx") returned 0 [0047.014] lstrlenA (lpString="*.xlsx") returned 6 [0047.014] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.ppt") returned 0 [0047.014] lstrlenA (lpString="*.ppt") returned 5 [0047.014] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.pptx") returned 0 [0047.014] lstrlenA (lpString="*.pptx") returned 6 [0047.014] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.pdf") returned 0 [0047.014] lstrlenA (lpString="*.pdf") returned 5 [0047.014] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.mov") returned 0 [0047.014] lstrlenA (lpString="*.mov") returned 5 [0047.014] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.m2v") returned 0 [0047.014] lstrlenA (lpString="*.m2v") returned 5 [0047.014] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.3gp") returned 0 [0047.014] lstrlenA (lpString="*.3gp") returned 5 [0047.014] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.mpeg") returned 0 [0047.014] lstrlenA (lpString="*.mpeg") returned 6 [0047.014] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.mpg") returned 0 [0047.014] lstrlenA (lpString="*.mpg") returned 5 [0047.014] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.flv") returned 0 [0047.014] lstrlenA (lpString="*.flv") returned 5 [0047.014] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.avi") returned 0 [0047.014] lstrlenA (lpString="*.avi") returned 5 [0047.015] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.mp4") returned 0 [0047.015] lstrlenA (lpString="*.mp4") returned 5 [0047.015] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.wmv") returned 0 [0047.015] lstrlenA (lpString="*.wmv") returned 5 [0047.015] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.divx") returned 0 [0047.015] lstrlenA (lpString="*.divx") returned 6 [0047.015] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.mkv") returned 0 [0047.015] lstrlenA (lpString="*.mkv") returned 5 [0047.015] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.mp3") returned 0 [0047.015] lstrlenA (lpString="*.mp3") returned 5 [0047.015] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.wav") returned 0 [0047.015] lstrlenA (lpString="*.wav") returned 5 [0047.015] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.flac") returned 0 [0047.015] lstrlenA (lpString="*.flac") returned 6 [0047.015] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.ape") returned 0 [0047.015] lstrlenA (lpString="*.ape") returned 5 [0047.015] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.wma") returned 0 [0047.015] lstrlenA (lpString="*.wma") returned 5 [0047.015] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.ac3") returned 0 [0047.015] lstrlenA (lpString="*.ac3") returned 5 [0047.015] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", pszSpec="*.mxf") returned 0 [0047.015] lstrlenA (lpString="*.mxf") returned 5 [0047.015] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x780074, dwReserved1=0x74, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0047.015] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.015] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msvcr90.dll") returned -1 [0047.015] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msvcr90.dll") returned -1 [0047.015] lstrcmpiA (lpString1="", lpString2="msvcr90.dll") returned -1 [0047.015] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned="Microsoft.VC90.CRT.manifest" [0047.016] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0047.016] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0047.016] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.016] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.016] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="msvcr90.dll" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" [0047.016] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.zip") returned 0 [0047.016] lstrlenA (lpString="*.zip") returned 5 [0047.016] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.rar") returned 0 [0047.016] lstrlenA (lpString="*.rar") returned 5 [0047.016] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.7z") returned 0 [0047.016] lstrlenA (lpString="*.7z") returned 4 [0047.016] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.tar") returned 0 [0047.016] lstrlenA (lpString="*.tar") returned 5 [0047.016] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.gzip") returned 0 [0047.016] lstrlenA (lpString="*.gzip") returned 6 [0047.016] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.jpg") returned 0 [0047.016] lstrlenA (lpString="*.jpg") returned 5 [0047.016] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.jpeg") returned 0 [0047.016] lstrlenA (lpString="*.jpeg") returned 6 [0047.016] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.psd") returned 0 [0047.016] lstrlenA (lpString="*.psd") returned 5 [0047.016] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.gif") returned 0 [0047.016] lstrlenA (lpString="*.gif") returned 5 [0047.016] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.doc") returned 0 [0047.016] lstrlenA (lpString="*.doc") returned 5 [0047.017] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.docx") returned 0 [0047.017] lstrlenA (lpString="*.docx") returned 6 [0047.017] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.xls") returned 0 [0047.017] lstrlenA (lpString="*.xls") returned 5 [0047.017] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.xlsx") returned 0 [0047.017] lstrlenA (lpString="*.xlsx") returned 6 [0047.017] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.ppt") returned 0 [0047.017] lstrlenA (lpString="*.ppt") returned 5 [0047.017] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.pptx") returned 0 [0047.017] lstrlenA (lpString="*.pptx") returned 6 [0047.017] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.pdf") returned 0 [0047.017] lstrlenA (lpString="*.pdf") returned 5 [0047.017] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.mov") returned 0 [0047.017] lstrlenA (lpString="*.mov") returned 5 [0047.017] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.m2v") returned 0 [0047.017] lstrlenA (lpString="*.m2v") returned 5 [0047.017] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.3gp") returned 0 [0047.017] lstrlenA (lpString="*.3gp") returned 5 [0047.017] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.mpeg") returned 0 [0047.017] lstrlenA (lpString="*.mpeg") returned 6 [0047.017] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.mpg") returned 0 [0047.017] lstrlenA (lpString="*.mpg") returned 5 [0047.017] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.flv") returned 0 [0047.017] lstrlenA (lpString="*.flv") returned 5 [0047.017] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.avi") returned 0 [0047.017] lstrlenA (lpString="*.avi") returned 5 [0047.017] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.mp4") returned 0 [0047.017] lstrlenA (lpString="*.mp4") returned 5 [0047.017] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.wmv") returned 0 [0047.018] lstrlenA (lpString="*.wmv") returned 5 [0047.018] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.divx") returned 0 [0047.018] lstrlenA (lpString="*.divx") returned 6 [0047.018] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.mkv") returned 0 [0047.018] lstrlenA (lpString="*.mkv") returned 5 [0047.018] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.mp3") returned 0 [0047.018] lstrlenA (lpString="*.mp3") returned 5 [0047.018] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.wav") returned 0 [0047.018] lstrlenA (lpString="*.wav") returned 5 [0047.018] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.flac") returned 0 [0047.018] lstrlenA (lpString="*.flac") returned 6 [0047.018] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.ape") returned 0 [0047.018] lstrlenA (lpString="*.ape") returned 5 [0047.018] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.wma") returned 0 [0047.018] lstrlenA (lpString="*.wma") returned 5 [0047.018] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.ac3") returned 0 [0047.018] lstrlenA (lpString="*.ac3") returned 5 [0047.018] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", pszSpec="*.mxf") returned 0 [0047.018] lstrlenA (lpString="*.mxf") returned 5 [0047.018] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x780074, dwReserved1=0x74, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0047.018] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.018] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OfficeLR.cab") returned -1 [0047.018] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeLR.cab") returned -1 [0047.018] lstrcmpiA (lpString1="", lpString2="OfficeLR.cab") returned -1 [0047.018] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned="msvcr90.dll" [0047.018] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0047.018] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0047.018] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.019] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.019] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="OfficeLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" [0047.019] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.zip") returned 0 [0047.019] lstrlenA (lpString="*.zip") returned 5 [0047.019] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.rar") returned 0 [0047.019] lstrlenA (lpString="*.rar") returned 5 [0047.019] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.7z") returned 0 [0047.019] lstrlenA (lpString="*.7z") returned 4 [0047.019] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.tar") returned 0 [0047.019] lstrlenA (lpString="*.tar") returned 5 [0047.019] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.gzip") returned 0 [0047.019] lstrlenA (lpString="*.gzip") returned 6 [0047.019] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.jpg") returned 0 [0047.019] lstrlenA (lpString="*.jpg") returned 5 [0047.019] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.jpeg") returned 0 [0047.019] lstrlenA (lpString="*.jpeg") returned 6 [0047.019] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.psd") returned 0 [0047.019] lstrlenA (lpString="*.psd") returned 5 [0047.019] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.gif") returned 0 [0047.019] lstrlenA (lpString="*.gif") returned 5 [0047.019] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.doc") returned 0 [0047.019] lstrlenA (lpString="*.doc") returned 5 [0047.019] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.docx") returned 0 [0047.019] lstrlenA (lpString="*.docx") returned 6 [0047.019] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.xls") returned 0 [0047.019] lstrlenA (lpString="*.xls") returned 5 [0047.020] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.xlsx") returned 0 [0047.020] lstrlenA (lpString="*.xlsx") returned 6 [0047.020] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.ppt") returned 0 [0047.020] lstrlenA (lpString="*.ppt") returned 5 [0047.020] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.pptx") returned 0 [0047.020] lstrlenA (lpString="*.pptx") returned 6 [0047.020] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.pdf") returned 0 [0047.020] lstrlenA (lpString="*.pdf") returned 5 [0047.020] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.mov") returned 0 [0047.020] lstrlenA (lpString="*.mov") returned 5 [0047.020] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.m2v") returned 0 [0047.020] lstrlenA (lpString="*.m2v") returned 5 [0047.020] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.3gp") returned 0 [0047.020] lstrlenA (lpString="*.3gp") returned 5 [0047.020] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.mpeg") returned 0 [0047.020] lstrlenA (lpString="*.mpeg") returned 6 [0047.020] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.mpg") returned 0 [0047.020] lstrlenA (lpString="*.mpg") returned 5 [0047.020] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.flv") returned 0 [0047.020] lstrlenA (lpString="*.flv") returned 5 [0047.020] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.avi") returned 0 [0047.020] lstrlenA (lpString="*.avi") returned 5 [0047.020] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.mp4") returned 0 [0047.020] lstrlenA (lpString="*.mp4") returned 5 [0047.020] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.wmv") returned 0 [0047.020] lstrlenA (lpString="*.wmv") returned 5 [0047.020] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.divx") returned 0 [0047.020] lstrlenA (lpString="*.divx") returned 6 [0047.020] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.mkv") returned 0 [0047.021] lstrlenA (lpString="*.mkv") returned 5 [0047.021] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.mp3") returned 0 [0047.021] lstrlenA (lpString="*.mp3") returned 5 [0047.021] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.wav") returned 0 [0047.021] lstrlenA (lpString="*.wav") returned 5 [0047.021] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.flac") returned 0 [0047.021] lstrlenA (lpString="*.flac") returned 6 [0047.021] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.ape") returned 0 [0047.021] lstrlenA (lpString="*.ape") returned 5 [0047.021] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.wma") returned 0 [0047.021] lstrlenA (lpString="*.wma") returned 5 [0047.021] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.ac3") returned 0 [0047.021] lstrlenA (lpString="*.ac3") returned 5 [0047.021] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", pszSpec="*.mxf") returned 0 [0047.021] lstrlenA (lpString="*.mxf") returned 5 [0047.021] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x780074, dwReserved1=0x74, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0047.021] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.021] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OfficeMUI.msi") returned -1 [0047.021] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeMUI.msi") returned -1 [0047.021] lstrcmpiA (lpString1="", lpString2="OfficeMUI.msi") returned -1 [0047.021] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned="OfficeLR.cab" [0047.021] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0047.021] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0047.021] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.021] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.021] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="OfficeMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" [0047.022] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.zip") returned 0 [0047.022] lstrlenA (lpString="*.zip") returned 5 [0047.022] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.rar") returned 0 [0047.022] lstrlenA (lpString="*.rar") returned 5 [0047.022] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.7z") returned 0 [0047.022] lstrlenA (lpString="*.7z") returned 4 [0047.022] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.tar") returned 0 [0047.022] lstrlenA (lpString="*.tar") returned 5 [0047.022] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.gzip") returned 0 [0047.022] lstrlenA (lpString="*.gzip") returned 6 [0047.022] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.jpg") returned 0 [0047.022] lstrlenA (lpString="*.jpg") returned 5 [0047.022] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.jpeg") returned 0 [0047.022] lstrlenA (lpString="*.jpeg") returned 6 [0047.022] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.psd") returned 0 [0047.022] lstrlenA (lpString="*.psd") returned 5 [0047.022] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.gif") returned 0 [0047.022] lstrlenA (lpString="*.gif") returned 5 [0047.022] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.doc") returned 0 [0047.022] lstrlenA (lpString="*.doc") returned 5 [0047.022] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.docx") returned 0 [0047.022] lstrlenA (lpString="*.docx") returned 6 [0047.022] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.xls") returned 0 [0047.022] lstrlenA (lpString="*.xls") returned 5 [0047.022] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.xlsx") returned 0 [0047.022] lstrlenA (lpString="*.xlsx") returned 6 [0047.022] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.ppt") returned 0 [0047.023] lstrlenA (lpString="*.ppt") returned 5 [0047.023] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.pptx") returned 0 [0047.023] lstrlenA (lpString="*.pptx") returned 6 [0047.023] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.pdf") returned 0 [0047.023] lstrlenA (lpString="*.pdf") returned 5 [0047.023] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.mov") returned 0 [0047.023] lstrlenA (lpString="*.mov") returned 5 [0047.023] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.m2v") returned 0 [0047.023] lstrlenA (lpString="*.m2v") returned 5 [0047.023] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.3gp") returned 0 [0047.023] lstrlenA (lpString="*.3gp") returned 5 [0047.023] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.mpeg") returned 0 [0047.023] lstrlenA (lpString="*.mpeg") returned 6 [0047.023] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.mpg") returned 0 [0047.023] lstrlenA (lpString="*.mpg") returned 5 [0047.023] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.flv") returned 0 [0047.023] lstrlenA (lpString="*.flv") returned 5 [0047.023] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.avi") returned 0 [0047.023] lstrlenA (lpString="*.avi") returned 5 [0047.023] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.mp4") returned 0 [0047.023] lstrlenA (lpString="*.mp4") returned 5 [0047.023] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.wmv") returned 0 [0047.023] lstrlenA (lpString="*.wmv") returned 5 [0047.023] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.divx") returned 0 [0047.023] lstrlenA (lpString="*.divx") returned 6 [0047.023] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.mkv") returned 0 [0047.023] lstrlenA (lpString="*.mkv") returned 5 [0047.023] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.mp3") returned 0 [0047.024] lstrlenA (lpString="*.mp3") returned 5 [0047.024] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.wav") returned 0 [0047.024] lstrlenA (lpString="*.wav") returned 5 [0047.024] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.flac") returned 0 [0047.024] lstrlenA (lpString="*.flac") returned 6 [0047.024] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.ape") returned 0 [0047.024] lstrlenA (lpString="*.ape") returned 5 [0047.024] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.wma") returned 0 [0047.024] lstrlenA (lpString="*.wma") returned 5 [0047.024] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.ac3") returned 0 [0047.024] lstrlenA (lpString="*.ac3") returned 5 [0047.024] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", pszSpec="*.mxf") returned 0 [0047.024] lstrlenA (lpString="*.mxf") returned 5 [0047.024] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x780074, dwReserved1=0x74, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0047.024] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.024] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OfficeMUI.xml") returned -1 [0047.024] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeMUI.xml") returned -1 [0047.024] lstrcmpiA (lpString1="", lpString2="OfficeMUI.xml") returned -1 [0047.024] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned="OfficeMUI.msi" [0047.024] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0047.024] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0047.024] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.024] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.025] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="OfficeMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" [0047.025] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.zip") returned 0 [0047.025] lstrlenA (lpString="*.zip") returned 5 [0047.025] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.rar") returned 0 [0047.025] lstrlenA (lpString="*.rar") returned 5 [0047.025] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.7z") returned 0 [0047.025] lstrlenA (lpString="*.7z") returned 4 [0047.025] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.tar") returned 0 [0047.025] lstrlenA (lpString="*.tar") returned 5 [0047.025] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.gzip") returned 0 [0047.025] lstrlenA (lpString="*.gzip") returned 6 [0047.025] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.jpg") returned 0 [0047.025] lstrlenA (lpString="*.jpg") returned 5 [0047.025] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.jpeg") returned 0 [0047.025] lstrlenA (lpString="*.jpeg") returned 6 [0047.025] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.psd") returned 0 [0047.025] lstrlenA (lpString="*.psd") returned 5 [0047.025] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.gif") returned 0 [0047.025] lstrlenA (lpString="*.gif") returned 5 [0047.025] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.doc") returned 0 [0047.025] lstrlenA (lpString="*.doc") returned 5 [0047.025] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.docx") returned 0 [0047.025] lstrlenA (lpString="*.docx") returned 6 [0047.025] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.xls") returned 0 [0047.025] lstrlenA (lpString="*.xls") returned 5 [0047.025] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.xlsx") returned 0 [0047.025] lstrlenA (lpString="*.xlsx") returned 6 [0047.025] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.ppt") returned 0 [0047.025] lstrlenA (lpString="*.ppt") returned 5 [0047.025] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.pptx") returned 0 [0047.025] lstrlenA (lpString="*.pptx") returned 6 [0047.026] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.pdf") returned 0 [0047.026] lstrlenA (lpString="*.pdf") returned 5 [0047.026] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.mov") returned 0 [0047.026] lstrlenA (lpString="*.mov") returned 5 [0047.026] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.m2v") returned 0 [0047.026] lstrlenA (lpString="*.m2v") returned 5 [0047.026] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.3gp") returned 0 [0047.026] lstrlenA (lpString="*.3gp") returned 5 [0047.026] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.mpeg") returned 0 [0047.026] lstrlenA (lpString="*.mpeg") returned 6 [0047.026] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.mpg") returned 0 [0047.026] lstrlenA (lpString="*.mpg") returned 5 [0047.026] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.flv") returned 0 [0047.026] lstrlenA (lpString="*.flv") returned 5 [0047.026] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.avi") returned 0 [0047.026] lstrlenA (lpString="*.avi") returned 5 [0047.026] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.mp4") returned 0 [0047.026] lstrlenA (lpString="*.mp4") returned 5 [0047.026] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.wmv") returned 0 [0047.026] lstrlenA (lpString="*.wmv") returned 5 [0047.026] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.divx") returned 0 [0047.026] lstrlenA (lpString="*.divx") returned 6 [0047.026] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.mkv") returned 0 [0047.026] lstrlenA (lpString="*.mkv") returned 5 [0047.026] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.mp3") returned 0 [0047.026] lstrlenA (lpString="*.mp3") returned 5 [0047.026] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.wav") returned 0 [0047.026] lstrlenA (lpString="*.wav") returned 5 [0047.026] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.flac") returned 0 [0047.026] lstrlenA (lpString="*.flac") returned 6 [0047.026] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.ape") returned 0 [0047.026] lstrlenA (lpString="*.ape") returned 5 [0047.026] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.wma") returned 0 [0047.026] lstrlenA (lpString="*.wma") returned 5 [0047.027] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.ac3") returned 0 [0047.027] lstrlenA (lpString="*.ac3") returned 5 [0047.027] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", pszSpec="*.mxf") returned 0 [0047.027] lstrlenA (lpString="*.mxf") returned 5 [0047.027] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x780074, dwReserved1=0x74, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0047.027] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.027] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OfficeMUISet.msi") returned -1 [0047.027] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeMUISet.msi") returned -1 [0047.027] lstrcmpiA (lpString1="", lpString2="OfficeMUISet.msi") returned -1 [0047.027] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned="OfficeMUI.xml" [0047.027] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0047.027] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0047.027] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.027] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.027] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="OfficeMUISet.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" [0047.027] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.zip") returned 0 [0047.027] lstrlenA (lpString="*.zip") returned 5 [0047.027] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.rar") returned 0 [0047.027] lstrlenA (lpString="*.rar") returned 5 [0047.027] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.7z") returned 0 [0047.027] lstrlenA (lpString="*.7z") returned 4 [0047.027] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.tar") returned 0 [0047.027] lstrlenA (lpString="*.tar") returned 5 [0047.027] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.gzip") returned 0 [0047.027] lstrlenA (lpString="*.gzip") returned 6 [0047.027] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.jpg") returned 0 [0047.027] lstrlenA (lpString="*.jpg") returned 5 [0047.027] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.jpeg") returned 0 [0047.028] lstrlenA (lpString="*.jpeg") returned 6 [0047.028] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.psd") returned 0 [0047.028] lstrlenA (lpString="*.psd") returned 5 [0047.028] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.gif") returned 0 [0047.028] lstrlenA (lpString="*.gif") returned 5 [0047.028] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.doc") returned 0 [0047.028] lstrlenA (lpString="*.doc") returned 5 [0047.028] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.docx") returned 0 [0047.028] lstrlenA (lpString="*.docx") returned 6 [0047.028] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.xls") returned 0 [0047.028] lstrlenA (lpString="*.xls") returned 5 [0047.028] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.xlsx") returned 0 [0047.028] lstrlenA (lpString="*.xlsx") returned 6 [0047.028] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.ppt") returned 0 [0047.028] lstrlenA (lpString="*.ppt") returned 5 [0047.028] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.pptx") returned 0 [0047.028] lstrlenA (lpString="*.pptx") returned 6 [0047.028] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.pdf") returned 0 [0047.028] lstrlenA (lpString="*.pdf") returned 5 [0047.028] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.mov") returned 0 [0047.028] lstrlenA (lpString="*.mov") returned 5 [0047.028] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.m2v") returned 0 [0047.029] lstrlenA (lpString="*.m2v") returned 5 [0047.029] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.3gp") returned 0 [0047.029] lstrlenA (lpString="*.3gp") returned 5 [0047.029] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.mpeg") returned 0 [0047.029] lstrlenA (lpString="*.mpeg") returned 6 [0047.029] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.mpg") returned 0 [0047.029] lstrlenA (lpString="*.mpg") returned 5 [0047.029] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.flv") returned 0 [0047.029] lstrlenA (lpString="*.flv") returned 5 [0047.029] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.avi") returned 0 [0047.029] lstrlenA (lpString="*.avi") returned 5 [0047.029] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.mp4") returned 0 [0047.029] lstrlenA (lpString="*.mp4") returned 5 [0047.029] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.wmv") returned 0 [0047.029] lstrlenA (lpString="*.wmv") returned 5 [0047.029] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.divx") returned 0 [0047.029] lstrlenA (lpString="*.divx") returned 6 [0047.029] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.mkv") returned 0 [0047.029] lstrlenA (lpString="*.mkv") returned 5 [0047.029] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.mp3") returned 0 [0047.029] lstrlenA (lpString="*.mp3") returned 5 [0047.029] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.wav") returned 0 [0047.029] lstrlenA (lpString="*.wav") returned 5 [0047.029] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.flac") returned 0 [0047.029] lstrlenA (lpString="*.flac") returned 6 [0047.029] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.ape") returned 0 [0047.030] lstrlenA (lpString="*.ape") returned 5 [0047.030] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.wma") returned 0 [0047.030] lstrlenA (lpString="*.wma") returned 5 [0047.030] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.ac3") returned 0 [0047.030] lstrlenA (lpString="*.ac3") returned 5 [0047.030] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", pszSpec="*.mxf") returned 0 [0047.030] lstrlenA (lpString="*.mxf") returned 5 [0047.030] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x780074, dwReserved1=0x74, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0047.030] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.030] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OfficeMUISet.xml") returned -1 [0047.030] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeMUISet.xml") returned -1 [0047.030] lstrcmpiA (lpString1="", lpString2="OfficeMUISet.xml") returned -1 [0047.030] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned="OfficeMUISet.msi" [0047.030] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0047.030] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0047.030] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.030] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.030] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="OfficeMUISet.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" [0047.030] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.zip") returned 0 [0047.030] lstrlenA (lpString="*.zip") returned 5 [0047.030] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.rar") returned 0 [0047.030] lstrlenA (lpString="*.rar") returned 5 [0047.030] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.7z") returned 0 [0047.030] lstrlenA (lpString="*.7z") returned 4 [0047.031] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.tar") returned 0 [0047.031] lstrlenA (lpString="*.tar") returned 5 [0047.031] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.gzip") returned 0 [0047.031] lstrlenA (lpString="*.gzip") returned 6 [0047.031] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.jpg") returned 0 [0047.031] lstrlenA (lpString="*.jpg") returned 5 [0047.031] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.jpeg") returned 0 [0047.031] lstrlenA (lpString="*.jpeg") returned 6 [0047.031] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.psd") returned 0 [0047.031] lstrlenA (lpString="*.psd") returned 5 [0047.031] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.gif") returned 0 [0047.031] lstrlenA (lpString="*.gif") returned 5 [0047.031] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.doc") returned 0 [0047.031] lstrlenA (lpString="*.doc") returned 5 [0047.031] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.docx") returned 0 [0047.031] lstrlenA (lpString="*.docx") returned 6 [0047.031] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.xls") returned 0 [0047.031] lstrlenA (lpString="*.xls") returned 5 [0047.031] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.xlsx") returned 0 [0047.031] lstrlenA (lpString="*.xlsx") returned 6 [0047.031] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.ppt") returned 0 [0047.031] lstrlenA (lpString="*.ppt") returned 5 [0047.031] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.pptx") returned 0 [0047.031] lstrlenA (lpString="*.pptx") returned 6 [0047.031] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.pdf") returned 0 [0047.031] lstrlenA (lpString="*.pdf") returned 5 [0047.031] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.mov") returned 0 [0047.031] lstrlenA (lpString="*.mov") returned 5 [0047.032] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.m2v") returned 0 [0047.032] lstrlenA (lpString="*.m2v") returned 5 [0047.032] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.3gp") returned 0 [0047.032] lstrlenA (lpString="*.3gp") returned 5 [0047.032] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.mpeg") returned 0 [0047.032] lstrlenA (lpString="*.mpeg") returned 6 [0047.032] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.mpg") returned 0 [0047.032] lstrlenA (lpString="*.mpg") returned 5 [0047.032] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.flv") returned 0 [0047.032] lstrlenA (lpString="*.flv") returned 5 [0047.032] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.avi") returned 0 [0047.032] lstrlenA (lpString="*.avi") returned 5 [0047.032] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.mp4") returned 0 [0047.032] lstrlenA (lpString="*.mp4") returned 5 [0047.032] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.wmv") returned 0 [0047.032] lstrlenA (lpString="*.wmv") returned 5 [0047.032] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.divx") returned 0 [0047.032] lstrlenA (lpString="*.divx") returned 6 [0047.032] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.mkv") returned 0 [0047.032] lstrlenA (lpString="*.mkv") returned 5 [0047.032] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.mp3") returned 0 [0047.032] lstrlenA (lpString="*.mp3") returned 5 [0047.032] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.wav") returned 0 [0047.032] lstrlenA (lpString="*.wav") returned 5 [0047.032] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.flac") returned 0 [0047.032] lstrlenA (lpString="*.flac") returned 6 [0047.032] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.ape") returned 0 [0047.032] lstrlenA (lpString="*.ape") returned 5 [0047.032] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.wma") returned 0 [0047.033] lstrlenA (lpString="*.wma") returned 5 [0047.033] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.ac3") returned 0 [0047.033] lstrlenA (lpString="*.ac3") returned 5 [0047.033] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", pszSpec="*.mxf") returned 0 [0047.033] lstrlenA (lpString="*.mxf") returned 5 [0047.033] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x780074, dwReserved1=0x74, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0047.033] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.033] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="osetupui.dll") returned -1 [0047.033] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="osetupui.dll") returned -1 [0047.033] lstrcmpiA (lpString1="", lpString2="osetupui.dll") returned -1 [0047.033] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned="OfficeMUISet.xml" [0047.033] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0047.033] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0047.033] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.033] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.033] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="osetupui.dll" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" [0047.033] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.zip") returned 0 [0047.033] lstrlenA (lpString="*.zip") returned 5 [0047.033] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.rar") returned 0 [0047.033] lstrlenA (lpString="*.rar") returned 5 [0047.033] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.7z") returned 0 [0047.033] lstrlenA (lpString="*.7z") returned 4 [0047.033] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.tar") returned 0 [0047.033] lstrlenA (lpString="*.tar") returned 5 [0047.033] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.gzip") returned 0 [0047.034] lstrlenA (lpString="*.gzip") returned 6 [0047.034] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.jpg") returned 0 [0047.034] lstrlenA (lpString="*.jpg") returned 5 [0047.034] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.jpeg") returned 0 [0047.034] lstrlenA (lpString="*.jpeg") returned 6 [0047.034] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.psd") returned 0 [0047.034] lstrlenA (lpString="*.psd") returned 5 [0047.034] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.gif") returned 0 [0047.034] lstrlenA (lpString="*.gif") returned 5 [0047.034] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.doc") returned 0 [0047.034] lstrlenA (lpString="*.doc") returned 5 [0047.034] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.docx") returned 0 [0047.034] lstrlenA (lpString="*.docx") returned 6 [0047.034] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.xls") returned 0 [0047.034] lstrlenA (lpString="*.xls") returned 5 [0047.034] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.xlsx") returned 0 [0047.034] lstrlenA (lpString="*.xlsx") returned 6 [0047.034] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.ppt") returned 0 [0047.034] lstrlenA (lpString="*.ppt") returned 5 [0047.034] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.pptx") returned 0 [0047.034] lstrlenA (lpString="*.pptx") returned 6 [0047.034] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.pdf") returned 0 [0047.034] lstrlenA (lpString="*.pdf") returned 5 [0047.034] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.mov") returned 0 [0047.034] lstrlenA (lpString="*.mov") returned 5 [0047.034] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.m2v") returned 0 [0047.034] lstrlenA (lpString="*.m2v") returned 5 [0047.035] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.3gp") returned 0 [0047.035] lstrlenA (lpString="*.3gp") returned 5 [0047.035] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.mpeg") returned 0 [0047.035] lstrlenA (lpString="*.mpeg") returned 6 [0047.035] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.mpg") returned 0 [0047.035] lstrlenA (lpString="*.mpg") returned 5 [0047.035] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.flv") returned 0 [0047.035] lstrlenA (lpString="*.flv") returned 5 [0047.035] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.avi") returned 0 [0047.035] lstrlenA (lpString="*.avi") returned 5 [0047.035] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.mp4") returned 0 [0047.035] lstrlenA (lpString="*.mp4") returned 5 [0047.035] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.wmv") returned 0 [0047.035] lstrlenA (lpString="*.wmv") returned 5 [0047.035] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.divx") returned 0 [0047.035] lstrlenA (lpString="*.divx") returned 6 [0047.035] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.mkv") returned 0 [0047.035] lstrlenA (lpString="*.mkv") returned 5 [0047.035] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.mp3") returned 0 [0047.035] lstrlenA (lpString="*.mp3") returned 5 [0047.035] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.wav") returned 0 [0047.035] lstrlenA (lpString="*.wav") returned 5 [0047.035] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.flac") returned 0 [0047.035] lstrlenA (lpString="*.flac") returned 6 [0047.035] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.ape") returned 0 [0047.035] lstrlenA (lpString="*.ape") returned 5 [0047.035] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.wma") returned 0 [0047.036] lstrlenA (lpString="*.wma") returned 5 [0047.036] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.ac3") returned 0 [0047.036] lstrlenA (lpString="*.ac3") returned 5 [0047.036] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", pszSpec="*.mxf") returned 0 [0047.036] lstrlenA (lpString="*.mxf") returned 5 [0047.036] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x780074, dwReserved1=0x74, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0047.036] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.036] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="pss10r.chm") returned -1 [0047.036] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pss10r.chm") returned -1 [0047.036] lstrcmpiA (lpString1="", lpString2="pss10r.chm") returned -1 [0047.036] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned="osetupui.dll" [0047.036] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0047.036] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0047.036] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.036] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.036] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="pss10r.chm" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" [0047.036] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.zip") returned 0 [0047.036] lstrlenA (lpString="*.zip") returned 5 [0047.036] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.rar") returned 0 [0047.036] lstrlenA (lpString="*.rar") returned 5 [0047.036] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.7z") returned 0 [0047.036] lstrlenA (lpString="*.7z") returned 4 [0047.036] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.tar") returned 0 [0047.037] lstrlenA (lpString="*.tar") returned 5 [0047.037] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.gzip") returned 0 [0047.037] lstrlenA (lpString="*.gzip") returned 6 [0047.037] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.jpg") returned 0 [0047.037] lstrlenA (lpString="*.jpg") returned 5 [0047.037] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.jpeg") returned 0 [0047.037] lstrlenA (lpString="*.jpeg") returned 6 [0047.037] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.psd") returned 0 [0047.037] lstrlenA (lpString="*.psd") returned 5 [0047.037] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.gif") returned 0 [0047.037] lstrlenA (lpString="*.gif") returned 5 [0047.037] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.doc") returned 0 [0047.037] lstrlenA (lpString="*.doc") returned 5 [0047.037] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.docx") returned 0 [0047.037] lstrlenA (lpString="*.docx") returned 6 [0047.037] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.xls") returned 0 [0047.037] lstrlenA (lpString="*.xls") returned 5 [0047.037] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.xlsx") returned 0 [0047.037] lstrlenA (lpString="*.xlsx") returned 6 [0047.037] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.ppt") returned 0 [0047.037] lstrlenA (lpString="*.ppt") returned 5 [0047.037] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.pptx") returned 0 [0047.037] lstrlenA (lpString="*.pptx") returned 6 [0047.037] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.pdf") returned 0 [0047.037] lstrlenA (lpString="*.pdf") returned 5 [0047.037] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.mov") returned 0 [0047.037] lstrlenA (lpString="*.mov") returned 5 [0047.038] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.m2v") returned 0 [0047.038] lstrlenA (lpString="*.m2v") returned 5 [0047.038] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.3gp") returned 0 [0047.038] lstrlenA (lpString="*.3gp") returned 5 [0047.038] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.mpeg") returned 0 [0047.038] lstrlenA (lpString="*.mpeg") returned 6 [0047.038] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.mpg") returned 0 [0047.038] lstrlenA (lpString="*.mpg") returned 5 [0047.038] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.flv") returned 0 [0047.038] lstrlenA (lpString="*.flv") returned 5 [0047.038] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.avi") returned 0 [0047.038] lstrlenA (lpString="*.avi") returned 5 [0047.038] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.mp4") returned 0 [0047.038] lstrlenA (lpString="*.mp4") returned 5 [0047.038] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.wmv") returned 0 [0047.038] lstrlenA (lpString="*.wmv") returned 5 [0047.038] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.divx") returned 0 [0047.038] lstrlenA (lpString="*.divx") returned 6 [0047.038] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.mkv") returned 0 [0047.038] lstrlenA (lpString="*.mkv") returned 5 [0047.038] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.mp3") returned 0 [0047.038] lstrlenA (lpString="*.mp3") returned 5 [0047.038] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.wav") returned 0 [0047.038] lstrlenA (lpString="*.wav") returned 5 [0047.038] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.flac") returned 0 [0047.039] lstrlenA (lpString="*.flac") returned 6 [0047.039] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.ape") returned 0 [0047.039] lstrlenA (lpString="*.ape") returned 5 [0047.039] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.wma") returned 0 [0047.039] lstrlenA (lpString="*.wma") returned 5 [0047.039] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.ac3") returned 0 [0047.039] lstrlenA (lpString="*.ac3") returned 5 [0047.039] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", pszSpec="*.mxf") returned 0 [0047.039] lstrlenA (lpString="*.mxf") returned 5 [0047.039] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x780074, dwReserved1=0x74, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0047.039] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.039] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="setup.chm") returned -1 [0047.039] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="setup.chm") returned -1 [0047.039] lstrcmpiA (lpString1="", lpString2="setup.chm") returned -1 [0047.039] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned="pss10r.chm" [0047.039] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0047.039] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0047.039] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.039] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.039] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="setup.chm" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" [0047.039] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.zip") returned 0 [0047.039] lstrlenA (lpString="*.zip") returned 5 [0047.039] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.rar") returned 0 [0047.039] lstrlenA (lpString="*.rar") returned 5 [0047.040] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.7z") returned 0 [0047.040] lstrlenA (lpString="*.7z") returned 4 [0047.040] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.tar") returned 0 [0047.040] lstrlenA (lpString="*.tar") returned 5 [0047.040] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.gzip") returned 0 [0047.040] lstrlenA (lpString="*.gzip") returned 6 [0047.040] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.jpg") returned 0 [0047.040] lstrlenA (lpString="*.jpg") returned 5 [0047.040] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.jpeg") returned 0 [0047.040] lstrlenA (lpString="*.jpeg") returned 6 [0047.040] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.psd") returned 0 [0047.040] lstrlenA (lpString="*.psd") returned 5 [0047.040] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.gif") returned 0 [0047.040] lstrlenA (lpString="*.gif") returned 5 [0047.040] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.doc") returned 0 [0047.040] lstrlenA (lpString="*.doc") returned 5 [0047.040] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.docx") returned 0 [0047.040] lstrlenA (lpString="*.docx") returned 6 [0047.040] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.xls") returned 0 [0047.040] lstrlenA (lpString="*.xls") returned 5 [0047.040] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.xlsx") returned 0 [0047.040] lstrlenA (lpString="*.xlsx") returned 6 [0047.040] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.ppt") returned 0 [0047.040] lstrlenA (lpString="*.ppt") returned 5 [0047.040] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.pptx") returned 0 [0047.040] lstrlenA (lpString="*.pptx") returned 6 [0047.040] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.pdf") returned 0 [0047.040] lstrlenA (lpString="*.pdf") returned 5 [0047.040] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.mov") returned 0 [0047.040] lstrlenA (lpString="*.mov") returned 5 [0047.040] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.m2v") returned 0 [0047.040] lstrlenA (lpString="*.m2v") returned 5 [0047.040] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.3gp") returned 0 [0047.040] lstrlenA (lpString="*.3gp") returned 5 [0047.041] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.mpeg") returned 0 [0047.041] lstrlenA (lpString="*.mpeg") returned 6 [0047.041] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.mpg") returned 0 [0047.041] lstrlenA (lpString="*.mpg") returned 5 [0047.041] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.flv") returned 0 [0047.041] lstrlenA (lpString="*.flv") returned 5 [0047.041] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.avi") returned 0 [0047.041] lstrlenA (lpString="*.avi") returned 5 [0047.041] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.mp4") returned 0 [0047.041] lstrlenA (lpString="*.mp4") returned 5 [0047.041] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.wmv") returned 0 [0047.041] lstrlenA (lpString="*.wmv") returned 5 [0047.041] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.divx") returned 0 [0047.041] lstrlenA (lpString="*.divx") returned 6 [0047.041] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.mkv") returned 0 [0047.041] lstrlenA (lpString="*.mkv") returned 5 [0047.041] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.mp3") returned 0 [0047.041] lstrlenA (lpString="*.mp3") returned 5 [0047.041] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.wav") returned 0 [0047.041] lstrlenA (lpString="*.wav") returned 5 [0047.041] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.flac") returned 0 [0047.041] lstrlenA (lpString="*.flac") returned 6 [0047.041] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.ape") returned 0 [0047.041] lstrlenA (lpString="*.ape") returned 5 [0047.041] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.wma") returned 0 [0047.041] lstrlenA (lpString="*.wma") returned 5 [0047.041] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.ac3") returned 0 [0047.041] lstrlenA (lpString="*.ac3") returned 5 [0047.041] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", pszSpec="*.mxf") returned 0 [0047.041] lstrlenA (lpString="*.mxf") returned 5 [0047.041] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0047.041] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.041] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0047.041] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0047.042] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0047.042] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned="setup.chm" [0047.042] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0047.042] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0047.042] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.042] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.042] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" [0047.042] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.zip") returned 0 [0047.042] lstrlenA (lpString="*.zip") returned 5 [0047.042] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.rar") returned 0 [0047.042] lstrlenA (lpString="*.rar") returned 5 [0047.042] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.7z") returned 0 [0047.042] lstrlenA (lpString="*.7z") returned 4 [0047.042] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tar") returned 0 [0047.042] lstrlenA (lpString="*.tar") returned 5 [0047.042] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gzip") returned 0 [0047.042] lstrlenA (lpString="*.gzip") returned 6 [0047.042] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpg") returned 0 [0047.043] lstrlenA (lpString="*.jpg") returned 5 [0047.043] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpeg") returned 0 [0047.043] lstrlenA (lpString="*.jpeg") returned 6 [0047.043] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.psd") returned 0 [0047.043] lstrlenA (lpString="*.psd") returned 5 [0047.043] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gif") returned 0 [0047.043] lstrlenA (lpString="*.gif") returned 5 [0047.043] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.doc") returned 0 [0047.043] lstrlenA (lpString="*.doc") returned 5 [0047.043] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docx") returned 0 [0047.043] lstrlenA (lpString="*.docx") returned 6 [0047.043] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xls") returned 0 [0047.043] lstrlenA (lpString="*.xls") returned 5 [0047.043] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsx") returned 0 [0047.043] lstrlenA (lpString="*.xlsx") returned 6 [0047.043] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ppt") returned 0 [0047.043] lstrlenA (lpString="*.ppt") returned 5 [0047.043] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pptx") returned 0 [0047.043] lstrlenA (lpString="*.pptx") returned 6 [0047.043] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pdf") returned 0 [0047.043] lstrlenA (lpString="*.pdf") returned 5 [0047.043] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mov") returned 0 [0047.043] lstrlenA (lpString="*.mov") returned 5 [0047.043] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.m2v") returned 0 [0047.043] lstrlenA (lpString="*.m2v") returned 5 [0047.043] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.3gp") returned 0 [0047.043] lstrlenA (lpString="*.3gp") returned 5 [0047.044] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpeg") returned 0 [0047.044] lstrlenA (lpString="*.mpeg") returned 6 [0047.044] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpg") returned 0 [0047.044] lstrlenA (lpString="*.mpg") returned 5 [0047.044] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flv") returned 0 [0047.044] lstrlenA (lpString="*.flv") returned 5 [0047.044] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.avi") returned 0 [0047.044] lstrlenA (lpString="*.avi") returned 5 [0047.044] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp4") returned 0 [0047.044] lstrlenA (lpString="*.mp4") returned 5 [0047.044] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wmv") returned 0 [0047.044] lstrlenA (lpString="*.wmv") returned 5 [0047.044] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.divx") returned 0 [0047.044] lstrlenA (lpString="*.divx") returned 6 [0047.045] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mkv") returned 0 [0047.045] lstrlenA (lpString="*.mkv") returned 5 [0047.045] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp3") returned 0 [0047.045] lstrlenA (lpString="*.mp3") returned 5 [0047.045] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wav") returned 0 [0047.045] lstrlenA (lpString="*.wav") returned 5 [0047.045] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flac") returned 0 [0047.045] lstrlenA (lpString="*.flac") returned 6 [0047.045] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ape") returned 0 [0047.045] lstrlenA (lpString="*.ape") returned 5 [0047.045] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wma") returned 0 [0047.045] lstrlenA (lpString="*.wma") returned 5 [0047.045] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ac3") returned 0 [0047.045] lstrlenA (lpString="*.ac3") returned 5 [0047.045] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mxf") returned 0 [0047.045] lstrlenA (lpString="*.mxf") returned 5 [0047.045] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x780074, dwReserved1=0x74, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0047.045] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.045] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ShellUI.MST") returned -1 [0047.045] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ShellUI.MST") returned -1 [0047.045] lstrcmpiA (lpString1="", lpString2="ShellUI.MST") returned -1 [0047.045] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="Setup.xml" [0047.045] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" [0047.045] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned="" [0047.045] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.046] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.046] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="ShellUI.MST" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" [0047.046] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.zip") returned 0 [0047.046] lstrlenA (lpString="*.zip") returned 5 [0047.046] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.rar") returned 0 [0047.046] lstrlenA (lpString="*.rar") returned 5 [0047.046] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.7z") returned 0 [0047.046] lstrlenA (lpString="*.7z") returned 4 [0047.046] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.tar") returned 0 [0047.046] lstrlenA (lpString="*.tar") returned 5 [0047.046] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.gzip") returned 0 [0047.046] lstrlenA (lpString="*.gzip") returned 6 [0047.046] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.jpg") returned 0 [0047.046] lstrlenA (lpString="*.jpg") returned 5 [0047.046] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.jpeg") returned 0 [0047.046] lstrlenA (lpString="*.jpeg") returned 6 [0047.046] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.psd") returned 0 [0047.046] lstrlenA (lpString="*.psd") returned 5 [0047.046] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.gif") returned 0 [0047.047] lstrlenA (lpString="*.gif") returned 5 [0047.047] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.doc") returned 0 [0047.047] lstrlenA (lpString="*.doc") returned 5 [0047.047] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.docx") returned 0 [0047.047] lstrlenA (lpString="*.docx") returned 6 [0047.047] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.xls") returned 0 [0047.047] lstrlenA (lpString="*.xls") returned 5 [0047.047] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.xlsx") returned 0 [0047.047] lstrlenA (lpString="*.xlsx") returned 6 [0047.047] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.ppt") returned 0 [0047.047] lstrlenA (lpString="*.ppt") returned 5 [0047.047] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.pptx") returned 0 [0047.047] lstrlenA (lpString="*.pptx") returned 6 [0047.047] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.pdf") returned 0 [0047.047] lstrlenA (lpString="*.pdf") returned 5 [0047.047] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.mov") returned 0 [0047.047] lstrlenA (lpString="*.mov") returned 5 [0047.047] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.m2v") returned 0 [0047.047] lstrlenA (lpString="*.m2v") returned 5 [0047.047] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.3gp") returned 0 [0047.047] lstrlenA (lpString="*.3gp") returned 5 [0047.047] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.mpeg") returned 0 [0047.047] lstrlenA (lpString="*.mpeg") returned 6 [0047.047] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.mpg") returned 0 [0047.047] lstrlenA (lpString="*.mpg") returned 5 [0047.047] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.flv") returned 0 [0047.047] lstrlenA (lpString="*.flv") returned 5 [0047.047] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.avi") returned 0 [0047.048] lstrlenA (lpString="*.avi") returned 5 [0047.048] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.mp4") returned 0 [0047.048] lstrlenA (lpString="*.mp4") returned 5 [0047.048] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.wmv") returned 0 [0047.048] lstrlenA (lpString="*.wmv") returned 5 [0047.048] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.divx") returned 0 [0047.048] lstrlenA (lpString="*.divx") returned 6 [0047.048] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.mkv") returned 0 [0047.048] lstrlenA (lpString="*.mkv") returned 5 [0047.048] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.mp3") returned 0 [0047.048] lstrlenA (lpString="*.mp3") returned 5 [0047.048] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.wav") returned 0 [0047.048] lstrlenA (lpString="*.wav") returned 5 [0047.048] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.flac") returned 0 [0047.048] lstrlenA (lpString="*.flac") returned 6 [0047.048] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.ape") returned 0 [0047.048] lstrlenA (lpString="*.ape") returned 5 [0047.048] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.wma") returned 0 [0047.048] lstrlenA (lpString="*.wma") returned 5 [0047.048] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.ac3") returned 0 [0047.048] lstrlenA (lpString="*.ac3") returned 5 [0047.048] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", pszSpec="*.mxf") returned 0 [0047.048] lstrlenA (lpString="*.mxf") returned 5 [0047.048] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x780074, dwReserved1=0x74, cFileName="ShellUI.MST", cAlternateFileName="")) returned 0 [0047.048] FindClose (in: hFindFile=0x2d6f20 | out: hFindFile=0x2d6f20) returned 1 [0047.049] FindNextFileA (in: hFindFile=0x2d6f60, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9AFC7~1")) returned 1 [0047.049] lstrcmpA (lpString1=".", lpString2="{90140000-0117-0409-1000-0000000FF1CE}-C") returned -1 [0047.049] lstrcmpA (lpString1="..", lpString2="{90140000-0117-0409-1000-0000000FF1CE}-C") returned -1 [0047.049] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0047.049] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0117-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C" [0047.049] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C") returned 62 [0047.049] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2d6f20 [0047.055] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.055] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.055] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.056] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.056] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0047.056] lstrcmpA (lpString1=".", lpString2="Access.en-us") returned -1 [0047.056] lstrcmpA (lpString1="..", lpString2="Access.en-us") returned -1 [0047.056] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0047.056] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpString2="Access.en-us" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us" [0047.056] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us") returned 75 [0047.056] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d7fa8, dwReserved1=0x2d7fa3, cFileName=".", cAlternateFileName="")) returned 0x2d9058 [0047.059] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.059] FindNextFileA (in: hFindFile=0x2d9058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.059] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.059] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.059] FindNextFileA (in: hFindFile=0x2d9058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0047.059] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.059] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AccessMUI.msi") returned 1 [0047.059] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccessMUI.msi") returned 1 [0047.059] lstrcmpiA (lpString1="", lpString2="AccessMUI.msi") returned -1 [0047.059] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*.*") returned="*.*" [0047.059] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" [0047.059] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\") returned="" [0047.059] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" [0047.060] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\how to decrypt files.txt")) returned 0xffffffff [0047.060] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0047.060] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0047.060] WriteFile (in: hFile=0x8c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0047.062] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.062] CloseHandle (hObject=0x8c) returned 1 [0047.062] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpString2="AccessMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" [0047.062] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.zip") returned 0 [0047.062] lstrlenA (lpString="*.zip") returned 5 [0047.062] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.rar") returned 0 [0047.062] lstrlenA (lpString="*.rar") returned 5 [0047.062] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.7z") returned 0 [0047.062] lstrlenA (lpString="*.7z") returned 4 [0047.062] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.tar") returned 0 [0047.062] lstrlenA (lpString="*.tar") returned 5 [0047.062] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.gzip") returned 0 [0047.062] lstrlenA (lpString="*.gzip") returned 6 [0047.062] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.jpg") returned 0 [0047.062] lstrlenA (lpString="*.jpg") returned 5 [0047.062] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.jpeg") returned 0 [0047.062] lstrlenA (lpString="*.jpeg") returned 6 [0047.062] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.psd") returned 0 [0047.063] lstrlenA (lpString="*.psd") returned 5 [0047.063] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.gif") returned 0 [0047.063] lstrlenA (lpString="*.gif") returned 5 [0047.063] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.doc") returned 0 [0047.063] lstrlenA (lpString="*.doc") returned 5 [0047.063] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.docx") returned 0 [0047.063] lstrlenA (lpString="*.docx") returned 6 [0047.063] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.xls") returned 0 [0047.063] lstrlenA (lpString="*.xls") returned 5 [0047.063] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.xlsx") returned 0 [0047.063] lstrlenA (lpString="*.xlsx") returned 6 [0047.063] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.ppt") returned 0 [0047.063] lstrlenA (lpString="*.ppt") returned 5 [0047.063] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.pptx") returned 0 [0047.063] lstrlenA (lpString="*.pptx") returned 6 [0047.063] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.pdf") returned 0 [0047.063] lstrlenA (lpString="*.pdf") returned 5 [0047.063] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.mov") returned 0 [0047.063] lstrlenA (lpString="*.mov") returned 5 [0047.063] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.m2v") returned 0 [0047.063] lstrlenA (lpString="*.m2v") returned 5 [0047.063] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.3gp") returned 0 [0047.063] lstrlenA (lpString="*.3gp") returned 5 [0047.063] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.mpeg") returned 0 [0047.063] lstrlenA (lpString="*.mpeg") returned 6 [0047.063] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.mpg") returned 0 [0047.063] lstrlenA (lpString="*.mpg") returned 5 [0047.063] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.flv") returned 0 [0047.064] lstrlenA (lpString="*.flv") returned 5 [0047.064] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.avi") returned 0 [0047.064] lstrlenA (lpString="*.avi") returned 5 [0047.064] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.mp4") returned 0 [0047.064] lstrlenA (lpString="*.mp4") returned 5 [0047.064] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.wmv") returned 0 [0047.064] lstrlenA (lpString="*.wmv") returned 5 [0047.064] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.divx") returned 0 [0047.064] lstrlenA (lpString="*.divx") returned 6 [0047.064] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.mkv") returned 0 [0047.064] lstrlenA (lpString="*.mkv") returned 5 [0047.064] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.mp3") returned 0 [0047.064] lstrlenA (lpString="*.mp3") returned 5 [0047.064] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.wav") returned 0 [0047.064] lstrlenA (lpString="*.wav") returned 5 [0047.064] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.flac") returned 0 [0047.064] lstrlenA (lpString="*.flac") returned 6 [0047.064] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.ape") returned 0 [0047.064] lstrlenA (lpString="*.ape") returned 5 [0047.064] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.wma") returned 0 [0047.064] lstrlenA (lpString="*.wma") returned 5 [0047.064] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.ac3") returned 0 [0047.064] lstrlenA (lpString="*.ac3") returned 5 [0047.064] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", pszSpec="*.mxf") returned 0 [0047.064] lstrlenA (lpString="*.mxf") returned 5 [0047.064] FindNextFileA (in: hFindFile=0x2d9058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x2da3a0, cFileName="AccessMUI.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0047.064] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.064] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AccessMUI.xml") returned 1 [0047.065] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccessMUI.xml") returned 1 [0047.065] lstrcmpiA (lpString1="", lpString2="AccessMUI.xml") returned -1 [0047.065] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned="AccessMUI.msi" [0047.065] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" [0047.065] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\") returned="" [0047.065] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" [0047.065] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\how to decrypt files.txt")) returned 0x2020 [0047.065] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpString2="AccessMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" [0047.065] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.zip") returned 0 [0047.065] lstrlenA (lpString="*.zip") returned 5 [0047.065] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.rar") returned 0 [0047.065] lstrlenA (lpString="*.rar") returned 5 [0047.065] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.7z") returned 0 [0047.065] lstrlenA (lpString="*.7z") returned 4 [0047.065] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.tar") returned 0 [0047.065] lstrlenA (lpString="*.tar") returned 5 [0047.065] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.gzip") returned 0 [0047.065] lstrlenA (lpString="*.gzip") returned 6 [0047.065] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.jpg") returned 0 [0047.065] lstrlenA (lpString="*.jpg") returned 5 [0047.065] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.jpeg") returned 0 [0047.065] lstrlenA (lpString="*.jpeg") returned 6 [0047.065] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.psd") returned 0 [0047.065] lstrlenA (lpString="*.psd") returned 5 [0047.066] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.gif") returned 0 [0047.066] lstrlenA (lpString="*.gif") returned 5 [0047.066] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.doc") returned 0 [0047.066] lstrlenA (lpString="*.doc") returned 5 [0047.066] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.docx") returned 0 [0047.066] lstrlenA (lpString="*.docx") returned 6 [0047.066] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.xls") returned 0 [0047.066] lstrlenA (lpString="*.xls") returned 5 [0047.066] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.xlsx") returned 0 [0047.066] lstrlenA (lpString="*.xlsx") returned 6 [0047.066] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.ppt") returned 0 [0047.066] lstrlenA (lpString="*.ppt") returned 5 [0047.066] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.pptx") returned 0 [0047.066] lstrlenA (lpString="*.pptx") returned 6 [0047.066] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.pdf") returned 0 [0047.066] lstrlenA (lpString="*.pdf") returned 5 [0047.066] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.mov") returned 0 [0047.066] lstrlenA (lpString="*.mov") returned 5 [0047.066] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.m2v") returned 0 [0047.066] lstrlenA (lpString="*.m2v") returned 5 [0047.066] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.3gp") returned 0 [0047.066] lstrlenA (lpString="*.3gp") returned 5 [0047.066] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.mpeg") returned 0 [0047.066] lstrlenA (lpString="*.mpeg") returned 6 [0047.066] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.mpg") returned 0 [0047.066] lstrlenA (lpString="*.mpg") returned 5 [0047.066] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.flv") returned 0 [0047.066] lstrlenA (lpString="*.flv") returned 5 [0047.067] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.avi") returned 0 [0047.067] lstrlenA (lpString="*.avi") returned 5 [0047.067] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.mp4") returned 0 [0047.067] lstrlenA (lpString="*.mp4") returned 5 [0047.067] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.wmv") returned 0 [0047.067] lstrlenA (lpString="*.wmv") returned 5 [0047.067] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.divx") returned 0 [0047.067] lstrlenA (lpString="*.divx") returned 6 [0047.067] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.mkv") returned 0 [0047.067] lstrlenA (lpString="*.mkv") returned 5 [0047.067] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.mp3") returned 0 [0047.067] lstrlenA (lpString="*.mp3") returned 5 [0047.067] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.wav") returned 0 [0047.067] lstrlenA (lpString="*.wav") returned 5 [0047.067] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.flac") returned 0 [0047.067] lstrlenA (lpString="*.flac") returned 6 [0047.067] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.ape") returned 0 [0047.067] lstrlenA (lpString="*.ape") returned 5 [0047.067] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.wma") returned 0 [0047.067] lstrlenA (lpString="*.wma") returned 5 [0047.067] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.ac3") returned 0 [0047.067] lstrlenA (lpString="*.ac3") returned 5 [0047.067] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", pszSpec="*.mxf") returned 0 [0047.067] lstrlenA (lpString="*.mxf") returned 5 [0047.067] FindNextFileA (in: hFindFile=0x2d9058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="AccLR.cab", cAlternateFileName="")) returned 1 [0047.067] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.067] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AccLR.cab") returned 1 [0047.068] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccLR.cab") returned 1 [0047.068] lstrcmpiA (lpString1="", lpString2="AccLR.cab") returned -1 [0047.068] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned="AccessMUI.xml" [0047.068] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" [0047.068] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\") returned="" [0047.068] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" [0047.068] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\how to decrypt files.txt")) returned 0x2020 [0047.068] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpString2="AccLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" [0047.068] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.zip") returned 0 [0047.068] lstrlenA (lpString="*.zip") returned 5 [0047.068] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.rar") returned 0 [0047.068] lstrlenA (lpString="*.rar") returned 5 [0047.068] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.7z") returned 0 [0047.068] lstrlenA (lpString="*.7z") returned 4 [0047.068] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.tar") returned 0 [0047.068] lstrlenA (lpString="*.tar") returned 5 [0047.068] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.gzip") returned 0 [0047.068] lstrlenA (lpString="*.gzip") returned 6 [0047.068] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.jpg") returned 0 [0047.068] lstrlenA (lpString="*.jpg") returned 5 [0047.068] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.jpeg") returned 0 [0047.068] lstrlenA (lpString="*.jpeg") returned 6 [0047.068] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.psd") returned 0 [0047.068] lstrlenA (lpString="*.psd") returned 5 [0047.068] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.gif") returned 0 [0047.069] lstrlenA (lpString="*.gif") returned 5 [0047.069] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.doc") returned 0 [0047.069] lstrlenA (lpString="*.doc") returned 5 [0047.069] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.docx") returned 0 [0047.069] lstrlenA (lpString="*.docx") returned 6 [0047.069] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.xls") returned 0 [0047.069] lstrlenA (lpString="*.xls") returned 5 [0047.069] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.xlsx") returned 0 [0047.069] lstrlenA (lpString="*.xlsx") returned 6 [0047.069] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.ppt") returned 0 [0047.069] lstrlenA (lpString="*.ppt") returned 5 [0047.069] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.pptx") returned 0 [0047.069] lstrlenA (lpString="*.pptx") returned 6 [0047.069] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.pdf") returned 0 [0047.069] lstrlenA (lpString="*.pdf") returned 5 [0047.069] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.mov") returned 0 [0047.069] lstrlenA (lpString="*.mov") returned 5 [0047.069] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.m2v") returned 0 [0047.069] lstrlenA (lpString="*.m2v") returned 5 [0047.069] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.3gp") returned 0 [0047.069] lstrlenA (lpString="*.3gp") returned 5 [0047.069] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.mpeg") returned 0 [0047.069] lstrlenA (lpString="*.mpeg") returned 6 [0047.069] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.mpg") returned 0 [0047.069] lstrlenA (lpString="*.mpg") returned 5 [0047.069] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.flv") returned 0 [0047.069] lstrlenA (lpString="*.flv") returned 5 [0047.069] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.avi") returned 0 [0047.070] lstrlenA (lpString="*.avi") returned 5 [0047.070] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.mp4") returned 0 [0047.070] lstrlenA (lpString="*.mp4") returned 5 [0047.070] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.wmv") returned 0 [0047.070] lstrlenA (lpString="*.wmv") returned 5 [0047.070] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.divx") returned 0 [0047.070] lstrlenA (lpString="*.divx") returned 6 [0047.070] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.mkv") returned 0 [0047.070] lstrlenA (lpString="*.mkv") returned 5 [0047.070] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.mp3") returned 0 [0047.070] lstrlenA (lpString="*.mp3") returned 5 [0047.070] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.wav") returned 0 [0047.070] lstrlenA (lpString="*.wav") returned 5 [0047.070] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.flac") returned 0 [0047.070] lstrlenA (lpString="*.flac") returned 6 [0047.070] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.ape") returned 0 [0047.070] lstrlenA (lpString="*.ape") returned 5 [0047.070] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.wma") returned 0 [0047.070] lstrlenA (lpString="*.wma") returned 5 [0047.070] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.ac3") returned 0 [0047.070] lstrlenA (lpString="*.ac3") returned 5 [0047.070] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", pszSpec="*.mxf") returned 0 [0047.070] lstrlenA (lpString="*.mxf") returned 5 [0047.070] FindNextFileA (in: hFindFile=0x2d9058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0047.070] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.070] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="branding.xml") returned 1 [0047.070] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="branding.xml") returned 1 [0047.071] lstrcmpiA (lpString1="", lpString2="branding.xml") returned -1 [0047.071] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned="AccLR.cab" [0047.071] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" [0047.071] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\") returned="" [0047.071] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" [0047.071] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\how to decrypt files.txt")) returned 0x2020 [0047.071] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpString2="branding.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" [0047.071] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.zip") returned 0 [0047.071] lstrlenA (lpString="*.zip") returned 5 [0047.071] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.rar") returned 0 [0047.071] lstrlenA (lpString="*.rar") returned 5 [0047.071] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.7z") returned 0 [0047.071] lstrlenA (lpString="*.7z") returned 4 [0047.071] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.tar") returned 0 [0047.071] lstrlenA (lpString="*.tar") returned 5 [0047.071] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.gzip") returned 0 [0047.071] lstrlenA (lpString="*.gzip") returned 6 [0047.071] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.jpg") returned 0 [0047.071] lstrlenA (lpString="*.jpg") returned 5 [0047.071] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.jpeg") returned 0 [0047.071] lstrlenA (lpString="*.jpeg") returned 6 [0047.071] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.psd") returned 0 [0047.071] lstrlenA (lpString="*.psd") returned 5 [0047.071] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.gif") returned 0 [0047.072] lstrlenA (lpString="*.gif") returned 5 [0047.072] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.doc") returned 0 [0047.072] lstrlenA (lpString="*.doc") returned 5 [0047.072] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.docx") returned 0 [0047.072] lstrlenA (lpString="*.docx") returned 6 [0047.072] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.xls") returned 0 [0047.072] lstrlenA (lpString="*.xls") returned 5 [0047.072] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.xlsx") returned 0 [0047.072] lstrlenA (lpString="*.xlsx") returned 6 [0047.072] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.ppt") returned 0 [0047.072] lstrlenA (lpString="*.ppt") returned 5 [0047.072] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.pptx") returned 0 [0047.072] lstrlenA (lpString="*.pptx") returned 6 [0047.072] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.pdf") returned 0 [0047.072] lstrlenA (lpString="*.pdf") returned 5 [0047.072] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.mov") returned 0 [0047.072] lstrlenA (lpString="*.mov") returned 5 [0047.072] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.m2v") returned 0 [0047.072] lstrlenA (lpString="*.m2v") returned 5 [0047.072] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.3gp") returned 0 [0047.072] lstrlenA (lpString="*.3gp") returned 5 [0047.072] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.mpeg") returned 0 [0047.072] lstrlenA (lpString="*.mpeg") returned 6 [0047.072] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.mpg") returned 0 [0047.072] lstrlenA (lpString="*.mpg") returned 5 [0047.072] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.flv") returned 0 [0047.072] lstrlenA (lpString="*.flv") returned 5 [0047.073] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.avi") returned 0 [0047.073] lstrlenA (lpString="*.avi") returned 5 [0047.073] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.mp4") returned 0 [0047.073] lstrlenA (lpString="*.mp4") returned 5 [0047.073] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.wmv") returned 0 [0047.073] lstrlenA (lpString="*.wmv") returned 5 [0047.073] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.divx") returned 0 [0047.073] lstrlenA (lpString="*.divx") returned 6 [0047.073] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.mkv") returned 0 [0047.073] lstrlenA (lpString="*.mkv") returned 5 [0047.073] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.mp3") returned 0 [0047.073] lstrlenA (lpString="*.mp3") returned 5 [0047.073] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.wav") returned 0 [0047.073] lstrlenA (lpString="*.wav") returned 5 [0047.073] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.flac") returned 0 [0047.073] lstrlenA (lpString="*.flac") returned 6 [0047.073] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.ape") returned 0 [0047.073] lstrlenA (lpString="*.ape") returned 5 [0047.073] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.wma") returned 0 [0047.073] lstrlenA (lpString="*.wma") returned 5 [0047.073] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.ac3") returned 0 [0047.073] lstrlenA (lpString="*.ac3") returned 5 [0047.073] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", pszSpec="*.mxf") returned 0 [0047.073] lstrlenA (lpString="*.mxf") returned 5 [0047.073] FindNextFileA (in: hFindFile=0x2d9058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="branding.xml", cAlternateFileName="")) returned 0 [0047.073] FindClose (in: hFindFile=0x2d9058 | out: hFindFile=0x2d9058) returned 1 [0047.074] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0047.074] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.074] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AccessMUISet.msi") returned 1 [0047.074] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccessMUISet.msi") returned 1 [0047.074] lstrcmpiA (lpString1="", lpString2="AccessMUISet.msi") returned -1 [0047.074] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0047.074] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\" [0047.074] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\") returned="" [0047.074] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.074] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0047.074] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0047.075] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0047.075] WriteFile (in: hFile=0x88, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0047.076] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.076] CloseHandle (hObject=0x88) returned 1 [0047.077] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpString2="AccessMUISet.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" [0047.077] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.zip") returned 0 [0047.077] lstrlenA (lpString="*.zip") returned 5 [0047.077] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.rar") returned 0 [0047.077] lstrlenA (lpString="*.rar") returned 5 [0047.077] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.7z") returned 0 [0047.077] lstrlenA (lpString="*.7z") returned 4 [0047.077] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.tar") returned 0 [0047.077] lstrlenA (lpString="*.tar") returned 5 [0047.077] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.gzip") returned 0 [0047.077] lstrlenA (lpString="*.gzip") returned 6 [0047.077] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.jpg") returned 0 [0047.077] lstrlenA (lpString="*.jpg") returned 5 [0047.077] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.jpeg") returned 0 [0047.077] lstrlenA (lpString="*.jpeg") returned 6 [0047.077] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.psd") returned 0 [0047.077] lstrlenA (lpString="*.psd") returned 5 [0047.077] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.gif") returned 0 [0047.077] lstrlenA (lpString="*.gif") returned 5 [0047.077] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.doc") returned 0 [0047.077] lstrlenA (lpString="*.doc") returned 5 [0047.077] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.docx") returned 0 [0047.077] lstrlenA (lpString="*.docx") returned 6 [0047.077] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.xls") returned 0 [0047.077] lstrlenA (lpString="*.xls") returned 5 [0047.078] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.xlsx") returned 0 [0047.078] lstrlenA (lpString="*.xlsx") returned 6 [0047.078] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.ppt") returned 0 [0047.078] lstrlenA (lpString="*.ppt") returned 5 [0047.078] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.pptx") returned 0 [0047.078] lstrlenA (lpString="*.pptx") returned 6 [0047.078] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.pdf") returned 0 [0047.078] lstrlenA (lpString="*.pdf") returned 5 [0047.078] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.mov") returned 0 [0047.078] lstrlenA (lpString="*.mov") returned 5 [0047.078] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.m2v") returned 0 [0047.078] lstrlenA (lpString="*.m2v") returned 5 [0047.078] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.3gp") returned 0 [0047.078] lstrlenA (lpString="*.3gp") returned 5 [0047.078] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.mpeg") returned 0 [0047.078] lstrlenA (lpString="*.mpeg") returned 6 [0047.078] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.mpg") returned 0 [0047.078] lstrlenA (lpString="*.mpg") returned 5 [0047.078] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.flv") returned 0 [0047.078] lstrlenA (lpString="*.flv") returned 5 [0047.078] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.avi") returned 0 [0047.078] lstrlenA (lpString="*.avi") returned 5 [0047.078] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.mp4") returned 0 [0047.078] lstrlenA (lpString="*.mp4") returned 5 [0047.078] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.wmv") returned 0 [0047.078] lstrlenA (lpString="*.wmv") returned 5 [0047.078] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.divx") returned 0 [0047.078] lstrlenA (lpString="*.divx") returned 6 [0047.079] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.mkv") returned 0 [0047.079] lstrlenA (lpString="*.mkv") returned 5 [0047.079] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.mp3") returned 0 [0047.079] lstrlenA (lpString="*.mp3") returned 5 [0047.079] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.wav") returned 0 [0047.079] lstrlenA (lpString="*.wav") returned 5 [0047.079] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.flac") returned 0 [0047.079] lstrlenA (lpString="*.flac") returned 6 [0047.079] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.ape") returned 0 [0047.079] lstrlenA (lpString="*.ape") returned 5 [0047.079] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.wma") returned 0 [0047.079] lstrlenA (lpString="*.wma") returned 5 [0047.079] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.ac3") returned 0 [0047.079] lstrlenA (lpString="*.ac3") returned 5 [0047.079] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", pszSpec="*.mxf") returned 0 [0047.079] lstrlenA (lpString="*.mxf") returned 5 [0047.079] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x2d9290, cFileName="AccessMUISet.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0047.079] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.079] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AccessMUISet.xml") returned 1 [0047.079] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccessMUISet.xml") returned 1 [0047.079] lstrcmpiA (lpString1="", lpString2="AccessMUISet.xml") returned -1 [0047.079] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned="AccessMUISet.msi" [0047.079] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\" [0047.079] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\") returned="" [0047.079] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.079] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.080] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpString2="AccessMUISet.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" [0047.080] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.zip") returned 0 [0047.080] lstrlenA (lpString="*.zip") returned 5 [0047.080] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.rar") returned 0 [0047.080] lstrlenA (lpString="*.rar") returned 5 [0047.080] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.7z") returned 0 [0047.080] lstrlenA (lpString="*.7z") returned 4 [0047.080] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.tar") returned 0 [0047.080] lstrlenA (lpString="*.tar") returned 5 [0047.080] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.gzip") returned 0 [0047.080] lstrlenA (lpString="*.gzip") returned 6 [0047.080] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.jpg") returned 0 [0047.080] lstrlenA (lpString="*.jpg") returned 5 [0047.080] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.jpeg") returned 0 [0047.080] lstrlenA (lpString="*.jpeg") returned 6 [0047.080] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.psd") returned 0 [0047.080] lstrlenA (lpString="*.psd") returned 5 [0047.080] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.gif") returned 0 [0047.080] lstrlenA (lpString="*.gif") returned 5 [0047.080] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.doc") returned 0 [0047.080] lstrlenA (lpString="*.doc") returned 5 [0047.080] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.docx") returned 0 [0047.080] lstrlenA (lpString="*.docx") returned 6 [0047.080] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.xls") returned 0 [0047.080] lstrlenA (lpString="*.xls") returned 5 [0047.081] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.xlsx") returned 0 [0047.081] lstrlenA (lpString="*.xlsx") returned 6 [0047.081] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.ppt") returned 0 [0047.081] lstrlenA (lpString="*.ppt") returned 5 [0047.081] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.pptx") returned 0 [0047.081] lstrlenA (lpString="*.pptx") returned 6 [0047.081] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.pdf") returned 0 [0047.081] lstrlenA (lpString="*.pdf") returned 5 [0047.081] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.mov") returned 0 [0047.081] lstrlenA (lpString="*.mov") returned 5 [0047.081] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.m2v") returned 0 [0047.081] lstrlenA (lpString="*.m2v") returned 5 [0047.081] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.3gp") returned 0 [0047.081] lstrlenA (lpString="*.3gp") returned 5 [0047.081] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.mpeg") returned 0 [0047.081] lstrlenA (lpString="*.mpeg") returned 6 [0047.081] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.mpg") returned 0 [0047.081] lstrlenA (lpString="*.mpg") returned 5 [0047.081] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.flv") returned 0 [0047.081] lstrlenA (lpString="*.flv") returned 5 [0047.081] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.avi") returned 0 [0047.081] lstrlenA (lpString="*.avi") returned 5 [0047.081] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.mp4") returned 0 [0047.081] lstrlenA (lpString="*.mp4") returned 5 [0047.081] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.wmv") returned 0 [0047.081] lstrlenA (lpString="*.wmv") returned 5 [0047.081] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.divx") returned 0 [0047.081] lstrlenA (lpString="*.divx") returned 6 [0047.082] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.mkv") returned 0 [0047.082] lstrlenA (lpString="*.mkv") returned 5 [0047.082] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.mp3") returned 0 [0047.082] lstrlenA (lpString="*.mp3") returned 5 [0047.082] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.wav") returned 0 [0047.082] lstrlenA (lpString="*.wav") returned 5 [0047.082] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.flac") returned 0 [0047.082] lstrlenA (lpString="*.flac") returned 6 [0047.082] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.ape") returned 0 [0047.082] lstrlenA (lpString="*.ape") returned 5 [0047.082] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.wma") returned 0 [0047.082] lstrlenA (lpString="*.wma") returned 5 [0047.082] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.ac3") returned 0 [0047.082] lstrlenA (lpString="*.ac3") returned 5 [0047.082] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", pszSpec="*.mxf") returned 0 [0047.082] lstrlenA (lpString="*.mxf") returned 5 [0047.082] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0047.082] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.082] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0047.082] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0047.082] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0047.082] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned="AccessMUISet.xml" [0047.082] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\" [0047.082] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\") returned="" [0047.082] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.082] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.083] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" [0047.083] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.zip") returned 0 [0047.083] lstrlenA (lpString="*.zip") returned 5 [0047.083] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.rar") returned 0 [0047.083] lstrlenA (lpString="*.rar") returned 5 [0047.083] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.7z") returned 0 [0047.083] lstrlenA (lpString="*.7z") returned 4 [0047.083] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tar") returned 0 [0047.083] lstrlenA (lpString="*.tar") returned 5 [0047.083] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gzip") returned 0 [0047.083] lstrlenA (lpString="*.gzip") returned 6 [0047.083] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpg") returned 0 [0047.083] lstrlenA (lpString="*.jpg") returned 5 [0047.083] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpeg") returned 0 [0047.083] lstrlenA (lpString="*.jpeg") returned 6 [0047.083] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.psd") returned 0 [0047.083] lstrlenA (lpString="*.psd") returned 5 [0047.083] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gif") returned 0 [0047.083] lstrlenA (lpString="*.gif") returned 5 [0047.083] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.doc") returned 0 [0047.083] lstrlenA (lpString="*.doc") returned 5 [0047.083] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docx") returned 0 [0047.083] lstrlenA (lpString="*.docx") returned 6 [0047.083] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xls") returned 0 [0047.083] lstrlenA (lpString="*.xls") returned 5 [0047.083] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsx") returned 0 [0047.084] lstrlenA (lpString="*.xlsx") returned 6 [0047.084] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ppt") returned 0 [0047.084] lstrlenA (lpString="*.ppt") returned 5 [0047.084] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pptx") returned 0 [0047.084] lstrlenA (lpString="*.pptx") returned 6 [0047.084] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pdf") returned 0 [0047.084] lstrlenA (lpString="*.pdf") returned 5 [0047.084] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mov") returned 0 [0047.084] lstrlenA (lpString="*.mov") returned 5 [0047.084] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.m2v") returned 0 [0047.084] lstrlenA (lpString="*.m2v") returned 5 [0047.084] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.3gp") returned 0 [0047.084] lstrlenA (lpString="*.3gp") returned 5 [0047.084] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpeg") returned 0 [0047.084] lstrlenA (lpString="*.mpeg") returned 6 [0047.084] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpg") returned 0 [0047.084] lstrlenA (lpString="*.mpg") returned 5 [0047.084] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flv") returned 0 [0047.084] lstrlenA (lpString="*.flv") returned 5 [0047.084] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.avi") returned 0 [0047.084] lstrlenA (lpString="*.avi") returned 5 [0047.084] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp4") returned 0 [0047.084] lstrlenA (lpString="*.mp4") returned 5 [0047.084] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wmv") returned 0 [0047.084] lstrlenA (lpString="*.wmv") returned 5 [0047.084] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.divx") returned 0 [0047.084] lstrlenA (lpString="*.divx") returned 6 [0047.085] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mkv") returned 0 [0047.085] lstrlenA (lpString="*.mkv") returned 5 [0047.085] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp3") returned 0 [0047.085] lstrlenA (lpString="*.mp3") returned 5 [0047.085] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wav") returned 0 [0047.085] lstrlenA (lpString="*.wav") returned 5 [0047.085] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flac") returned 0 [0047.085] lstrlenA (lpString="*.flac") returned 6 [0047.085] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ape") returned 0 [0047.085] lstrlenA (lpString="*.ape") returned 5 [0047.085] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wma") returned 0 [0047.085] lstrlenA (lpString="*.wma") returned 5 [0047.085] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ac3") returned 0 [0047.085] lstrlenA (lpString="*.ac3") returned 5 [0047.085] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mxf") returned 0 [0047.085] lstrlenA (lpString="*.mxf") returned 5 [0047.085] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0047.085] FindClose (in: hFindFile=0x2d6f20 | out: hFindFile=0x2d6f20) returned 1 [0047.085] FindNextFileA (in: hFindFile=0x2d6f60, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~1")) returned 1 [0047.085] lstrcmpA (lpString1=".", lpString2="{91140000-0011-0000-1000-0000000FF1CE}-C") returned -1 [0047.085] lstrcmpA (lpString1="..", lpString2="{91140000-0011-0000-1000-0000000FF1CE}-C") returned -1 [0047.085] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0047.085] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{91140000-0011-0000-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C" [0047.085] lstrlenA (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C") returned 62 [0047.086] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2d6f20 [0047.089] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.089] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.089] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.089] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.089] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0047.089] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.089] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Office32WW.msi") returned -1 [0047.089] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office32WW.msi") returned -1 [0047.089] lstrcmpiA (lpString1="", lpString2="Office32WW.msi") returned -1 [0047.089] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0047.089] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0047.089] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="" [0047.089] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.089] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0047.090] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0047.090] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0047.090] WriteFile (in: hFile=0x88, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0047.092] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.092] CloseHandle (hObject=0x88) returned 1 [0047.092] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="Office32WW.msi" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" [0047.092] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.zip") returned 0 [0047.092] lstrlenA (lpString="*.zip") returned 5 [0047.092] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.rar") returned 0 [0047.092] lstrlenA (lpString="*.rar") returned 5 [0047.092] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.7z") returned 0 [0047.092] lstrlenA (lpString="*.7z") returned 4 [0047.092] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.tar") returned 0 [0047.092] lstrlenA (lpString="*.tar") returned 5 [0047.092] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.gzip") returned 0 [0047.092] lstrlenA (lpString="*.gzip") returned 6 [0047.092] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.jpg") returned 0 [0047.092] lstrlenA (lpString="*.jpg") returned 5 [0047.092] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.jpeg") returned 0 [0047.092] lstrlenA (lpString="*.jpeg") returned 6 [0047.092] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.psd") returned 0 [0047.093] lstrlenA (lpString="*.psd") returned 5 [0047.093] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.gif") returned 0 [0047.093] lstrlenA (lpString="*.gif") returned 5 [0047.093] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.doc") returned 0 [0047.093] lstrlenA (lpString="*.doc") returned 5 [0047.093] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.docx") returned 0 [0047.093] lstrlenA (lpString="*.docx") returned 6 [0047.093] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.xls") returned 0 [0047.093] lstrlenA (lpString="*.xls") returned 5 [0047.093] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.xlsx") returned 0 [0047.093] lstrlenA (lpString="*.xlsx") returned 6 [0047.093] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.ppt") returned 0 [0047.093] lstrlenA (lpString="*.ppt") returned 5 [0047.093] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.pptx") returned 0 [0047.093] lstrlenA (lpString="*.pptx") returned 6 [0047.093] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.pdf") returned 0 [0047.093] lstrlenA (lpString="*.pdf") returned 5 [0047.093] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.mov") returned 0 [0047.093] lstrlenA (lpString="*.mov") returned 5 [0047.093] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.m2v") returned 0 [0047.093] lstrlenA (lpString="*.m2v") returned 5 [0047.093] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.3gp") returned 0 [0047.093] lstrlenA (lpString="*.3gp") returned 5 [0047.093] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.mpeg") returned 0 [0047.093] lstrlenA (lpString="*.mpeg") returned 6 [0047.093] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.mpg") returned 0 [0047.093] lstrlenA (lpString="*.mpg") returned 5 [0047.094] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.flv") returned 0 [0047.094] lstrlenA (lpString="*.flv") returned 5 [0047.094] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.avi") returned 0 [0047.094] lstrlenA (lpString="*.avi") returned 5 [0047.094] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.mp4") returned 0 [0047.094] lstrlenA (lpString="*.mp4") returned 5 [0047.094] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.wmv") returned 0 [0047.094] lstrlenA (lpString="*.wmv") returned 5 [0047.094] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.divx") returned 0 [0047.094] lstrlenA (lpString="*.divx") returned 6 [0047.094] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.mkv") returned 0 [0047.094] lstrlenA (lpString="*.mkv") returned 5 [0047.094] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.mp3") returned 0 [0047.094] lstrlenA (lpString="*.mp3") returned 5 [0047.094] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.wav") returned 0 [0047.094] lstrlenA (lpString="*.wav") returned 5 [0047.094] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.flac") returned 0 [0047.094] lstrlenA (lpString="*.flac") returned 6 [0047.094] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.ape") returned 0 [0047.094] lstrlenA (lpString="*.ape") returned 5 [0047.094] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.wma") returned 0 [0047.094] lstrlenA (lpString="*.wma") returned 5 [0047.094] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.ac3") returned 0 [0047.094] lstrlenA (lpString="*.ac3") returned 5 [0047.094] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", pszSpec="*.mxf") returned 0 [0047.094] lstrlenA (lpString="*.mxf") returned 5 [0047.094] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x2d9290, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0047.095] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.095] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Office32WW.xml") returned -1 [0047.095] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office32WW.xml") returned -1 [0047.095] lstrcmpiA (lpString1="", lpString2="Office32WW.xml") returned -1 [0047.095] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned="Office32WW.msi" [0047.095] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0047.095] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="" [0047.095] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.095] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.095] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="Office32WW.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" [0047.095] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.zip") returned 0 [0047.095] lstrlenA (lpString="*.zip") returned 5 [0047.095] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.rar") returned 0 [0047.095] lstrlenA (lpString="*.rar") returned 5 [0047.095] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.7z") returned 0 [0047.095] lstrlenA (lpString="*.7z") returned 4 [0047.095] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.tar") returned 0 [0047.095] lstrlenA (lpString="*.tar") returned 5 [0047.095] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.gzip") returned 0 [0047.095] lstrlenA (lpString="*.gzip") returned 6 [0047.095] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.jpg") returned 0 [0047.095] lstrlenA (lpString="*.jpg") returned 5 [0047.095] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.jpeg") returned 0 [0047.095] lstrlenA (lpString="*.jpeg") returned 6 [0047.095] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.psd") returned 0 [0047.096] lstrlenA (lpString="*.psd") returned 5 [0047.096] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.gif") returned 0 [0047.096] lstrlenA (lpString="*.gif") returned 5 [0047.096] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.doc") returned 0 [0047.096] lstrlenA (lpString="*.doc") returned 5 [0047.096] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.docx") returned 0 [0047.096] lstrlenA (lpString="*.docx") returned 6 [0047.096] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.xls") returned 0 [0047.096] lstrlenA (lpString="*.xls") returned 5 [0047.096] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.xlsx") returned 0 [0047.096] lstrlenA (lpString="*.xlsx") returned 6 [0047.096] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.ppt") returned 0 [0047.096] lstrlenA (lpString="*.ppt") returned 5 [0047.096] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.pptx") returned 0 [0047.096] lstrlenA (lpString="*.pptx") returned 6 [0047.096] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.pdf") returned 0 [0047.096] lstrlenA (lpString="*.pdf") returned 5 [0047.096] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.mov") returned 0 [0047.096] lstrlenA (lpString="*.mov") returned 5 [0047.096] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.m2v") returned 0 [0047.096] lstrlenA (lpString="*.m2v") returned 5 [0047.096] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.3gp") returned 0 [0047.096] lstrlenA (lpString="*.3gp") returned 5 [0047.096] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.mpeg") returned 0 [0047.096] lstrlenA (lpString="*.mpeg") returned 6 [0047.096] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.mpg") returned 0 [0047.096] lstrlenA (lpString="*.mpg") returned 5 [0047.096] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.flv") returned 0 [0047.097] lstrlenA (lpString="*.flv") returned 5 [0047.097] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.avi") returned 0 [0047.097] lstrlenA (lpString="*.avi") returned 5 [0047.097] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.mp4") returned 0 [0047.097] lstrlenA (lpString="*.mp4") returned 5 [0047.097] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.wmv") returned 0 [0047.097] lstrlenA (lpString="*.wmv") returned 5 [0047.097] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.divx") returned 0 [0047.097] lstrlenA (lpString="*.divx") returned 6 [0047.097] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.mkv") returned 0 [0047.097] lstrlenA (lpString="*.mkv") returned 5 [0047.097] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.mp3") returned 0 [0047.097] lstrlenA (lpString="*.mp3") returned 5 [0047.097] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.wav") returned 0 [0047.097] lstrlenA (lpString="*.wav") returned 5 [0047.097] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.flac") returned 0 [0047.097] lstrlenA (lpString="*.flac") returned 6 [0047.097] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.ape") returned 0 [0047.097] lstrlenA (lpString="*.ape") returned 5 [0047.097] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.wma") returned 0 [0047.097] lstrlenA (lpString="*.wma") returned 5 [0047.097] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.ac3") returned 0 [0047.097] lstrlenA (lpString="*.ac3") returned 5 [0047.097] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", pszSpec="*.mxf") returned 0 [0047.097] lstrlenA (lpString="*.mxf") returned 5 [0047.097] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf885a000, ftCreationTime.dwHighDateTime=0x1cac4d7, ftLastAccessTime.dwLowDateTime=0xf885a000, ftLastAccessTime.dwHighDateTime=0x1cac4d7, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x780074, dwReserved1=0x74, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0047.098] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.098] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ose.exe") returned -1 [0047.098] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ose.exe") returned -1 [0047.098] lstrcmpiA (lpString1="", lpString2="ose.exe") returned -1 [0047.098] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned="Office32WW.xml" [0047.098] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0047.098] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="" [0047.098] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.098] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.098] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="ose.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" [0047.098] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.zip") returned 0 [0047.098] lstrlenA (lpString="*.zip") returned 5 [0047.098] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.rar") returned 0 [0047.098] lstrlenA (lpString="*.rar") returned 5 [0047.098] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.7z") returned 0 [0047.098] lstrlenA (lpString="*.7z") returned 4 [0047.098] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.tar") returned 0 [0047.098] lstrlenA (lpString="*.tar") returned 5 [0047.098] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.gzip") returned 0 [0047.098] lstrlenA (lpString="*.gzip") returned 6 [0047.098] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.jpg") returned 0 [0047.098] lstrlenA (lpString="*.jpg") returned 5 [0047.098] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.jpeg") returned 0 [0047.099] lstrlenA (lpString="*.jpeg") returned 6 [0047.099] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.psd") returned 0 [0047.099] lstrlenA (lpString="*.psd") returned 5 [0047.099] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.gif") returned 0 [0047.099] lstrlenA (lpString="*.gif") returned 5 [0047.099] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.doc") returned 0 [0047.099] lstrlenA (lpString="*.doc") returned 5 [0047.099] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.docx") returned 0 [0047.099] lstrlenA (lpString="*.docx") returned 6 [0047.099] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.xls") returned 0 [0047.099] lstrlenA (lpString="*.xls") returned 5 [0047.099] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.xlsx") returned 0 [0047.099] lstrlenA (lpString="*.xlsx") returned 6 [0047.099] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.ppt") returned 0 [0047.099] lstrlenA (lpString="*.ppt") returned 5 [0047.099] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.pptx") returned 0 [0047.099] lstrlenA (lpString="*.pptx") returned 6 [0047.099] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.pdf") returned 0 [0047.099] lstrlenA (lpString="*.pdf") returned 5 [0047.099] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.mov") returned 0 [0047.099] lstrlenA (lpString="*.mov") returned 5 [0047.099] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.m2v") returned 0 [0047.099] lstrlenA (lpString="*.m2v") returned 5 [0047.099] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.3gp") returned 0 [0047.099] lstrlenA (lpString="*.3gp") returned 5 [0047.099] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.mpeg") returned 0 [0047.099] lstrlenA (lpString="*.mpeg") returned 6 [0047.100] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.mpg") returned 0 [0047.100] lstrlenA (lpString="*.mpg") returned 5 [0047.100] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.flv") returned 0 [0047.100] lstrlenA (lpString="*.flv") returned 5 [0047.100] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.avi") returned 0 [0047.100] lstrlenA (lpString="*.avi") returned 5 [0047.100] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.mp4") returned 0 [0047.100] lstrlenA (lpString="*.mp4") returned 5 [0047.100] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.wmv") returned 0 [0047.100] lstrlenA (lpString="*.wmv") returned 5 [0047.100] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.divx") returned 0 [0047.100] lstrlenA (lpString="*.divx") returned 6 [0047.100] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.mkv") returned 0 [0047.100] lstrlenA (lpString="*.mkv") returned 5 [0047.100] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.mp3") returned 0 [0047.100] lstrlenA (lpString="*.mp3") returned 5 [0047.100] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.wav") returned 0 [0047.100] lstrlenA (lpString="*.wav") returned 5 [0047.100] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.flac") returned 0 [0047.100] lstrlenA (lpString="*.flac") returned 6 [0047.100] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.ape") returned 0 [0047.100] lstrlenA (lpString="*.ape") returned 5 [0047.100] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.wma") returned 0 [0047.100] lstrlenA (lpString="*.wma") returned 5 [0047.100] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.ac3") returned 0 [0047.100] lstrlenA (lpString="*.ac3") returned 5 [0047.100] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", pszSpec="*.mxf") returned 0 [0047.101] lstrlenA (lpString="*.mxf") returned 5 [0047.101] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd900f00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbd900f00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x16854390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x780074, dwReserved1=0x74, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0047.101] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.101] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="osetup.dll") returned -1 [0047.101] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="osetup.dll") returned -1 [0047.101] lstrcmpiA (lpString1="", lpString2="osetup.dll") returned -1 [0047.101] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned="ose.exe" [0047.101] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0047.101] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="" [0047.101] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.101] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.101] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="osetup.dll" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" [0047.101] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.zip") returned 0 [0047.101] lstrlenA (lpString="*.zip") returned 5 [0047.101] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.rar") returned 0 [0047.101] lstrlenA (lpString="*.rar") returned 5 [0047.101] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.7z") returned 0 [0047.101] lstrlenA (lpString="*.7z") returned 4 [0047.101] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.tar") returned 0 [0047.101] lstrlenA (lpString="*.tar") returned 5 [0047.101] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.gzip") returned 0 [0047.101] lstrlenA (lpString="*.gzip") returned 6 [0047.101] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.jpg") returned 0 [0047.101] lstrlenA (lpString="*.jpg") returned 5 [0047.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.jpeg") returned 0 [0047.102] lstrlenA (lpString="*.jpeg") returned 6 [0047.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.psd") returned 0 [0047.102] lstrlenA (lpString="*.psd") returned 5 [0047.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.gif") returned 0 [0047.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.doc") returned 0 [0047.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.docx") returned 0 [0047.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.xls") returned 0 [0047.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.xlsx") returned 0 [0047.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.ppt") returned 0 [0047.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.pptx") returned 0 [0047.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.pdf") returned 0 [0047.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mov") returned 0 [0047.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.m2v") returned 0 [0047.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.3gp") returned 0 [0047.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mpeg") returned 0 [0047.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mpg") returned 0 [0047.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.flv") returned 0 [0047.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.avi") returned 0 [0047.102] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mp4") returned 0 [0047.103] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.wmv") returned 0 [0047.103] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.divx") returned 0 [0047.103] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mkv") returned 0 [0047.103] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mp3") returned 0 [0047.103] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.wav") returned 0 [0047.103] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.flac") returned 0 [0047.103] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.ape") returned 0 [0047.103] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.wma") returned 0 [0047.103] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.ac3") returned 0 [0047.103] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", pszSpec="*.mxf") returned 0 [0047.103] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0047.103] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.103] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OWOW32WW.cab") returned -1 [0047.103] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OWOW32WW.cab") returned -1 [0047.103] lstrcmpiA (lpString1="", lpString2="OWOW32WW.cab") returned -1 [0047.103] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned="osetup.dll" [0047.103] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0047.103] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="" [0047.103] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.103] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.104] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="OWOW32WW.cab" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" [0047.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.zip") returned 0 [0047.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.rar") returned 0 [0047.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.7z") returned 0 [0047.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.tar") returned 0 [0047.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.gzip") returned 0 [0047.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.jpg") returned 0 [0047.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.jpeg") returned 0 [0047.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.psd") returned 0 [0047.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.gif") returned 0 [0047.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.doc") returned 0 [0047.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.docx") returned 0 [0047.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.xls") returned 0 [0047.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.xlsx") returned 0 [0047.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.ppt") returned 0 [0047.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.pptx") returned 0 [0047.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.pdf") returned 0 [0047.104] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mov") returned 0 [0047.105] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.m2v") returned 0 [0047.105] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.3gp") returned 0 [0047.105] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mpeg") returned 0 [0047.105] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mpg") returned 0 [0047.105] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.flv") returned 0 [0047.105] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.avi") returned 0 [0047.105] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mp4") returned 0 [0047.105] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.wmv") returned 0 [0047.105] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.divx") returned 0 [0047.105] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mkv") returned 0 [0047.105] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mp3") returned 0 [0047.105] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.wav") returned 0 [0047.105] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.flac") returned 0 [0047.105] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.ape") returned 0 [0047.105] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.wma") returned 0 [0047.105] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.ac3") returned 0 [0047.105] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", pszSpec="*.mxf") returned 0 [0047.105] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a02e00, ftCreationTime.dwHighDateTime=0x1cac5f7, ftLastAccessTime.dwLowDateTime=0xe3a02e00, ftLastAccessTime.dwHighDateTime=0x1cac5f7, ftLastWriteTime.dwLowDateTime=0x17e0dbf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0047.106] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.106] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PidGenX.dll") returned -1 [0047.106] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PidGenX.dll") returned -1 [0047.106] lstrcmpiA (lpString1="", lpString2="PidGenX.dll") returned -1 [0047.106] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned="OWOW32WW.cab" [0047.106] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0047.106] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="" [0047.106] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.106] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.106] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="PidGenX.dll" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" [0047.106] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.zip") returned 0 [0047.106] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.rar") returned 0 [0047.106] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.7z") returned 0 [0047.106] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.tar") returned 0 [0047.106] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.gzip") returned 0 [0047.106] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.jpg") returned 0 [0047.106] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.jpeg") returned 0 [0047.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.psd") returned 0 [0047.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.gif") returned 0 [0047.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.doc") returned 0 [0047.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.docx") returned 0 [0047.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.xls") returned 0 [0047.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.xlsx") returned 0 [0047.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.ppt") returned 0 [0047.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.pptx") returned 0 [0047.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.pdf") returned 0 [0047.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mov") returned 0 [0047.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.m2v") returned 0 [0047.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.3gp") returned 0 [0047.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mpeg") returned 0 [0047.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mpg") returned 0 [0047.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.flv") returned 0 [0047.107] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.avi") returned 0 [0047.108] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mp4") returned 0 [0047.108] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.wmv") returned 0 [0047.108] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.divx") returned 0 [0047.108] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mkv") returned 0 [0047.108] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mp3") returned 0 [0047.108] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.wav") returned 0 [0047.108] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.flac") returned 0 [0047.108] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.ape") returned 0 [0047.108] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.wma") returned 0 [0047.108] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.ac3") returned 0 [0047.108] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", pszSpec="*.mxf") returned 0 [0047.108] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x780074, dwReserved1=0x74, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0047.108] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.108] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="pkeyconfig-office.xrm-ms") returned -1 [0047.108] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pkeyconfig-office.xrm-ms") returned -1 [0047.108] lstrcmpiA (lpString1="", lpString2="pkeyconfig-office.xrm-ms") returned -1 [0047.108] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned="PidGenX.dll" [0047.108] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0047.108] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="" [0047.108] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.109] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.109] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="pkeyconfig-office.xrm-ms" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" [0047.109] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.zip") returned 0 [0047.109] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.rar") returned 0 [0047.109] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.7z") returned 0 [0047.109] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.tar") returned 0 [0047.109] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.gzip") returned 0 [0047.109] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.jpg") returned 0 [0047.109] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.jpeg") returned 0 [0047.109] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.psd") returned 0 [0047.109] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.gif") returned 0 [0047.109] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.doc") returned 0 [0047.109] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.docx") returned 0 [0047.109] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.xls") returned 0 [0047.109] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.xlsx") returned 0 [0047.109] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.ppt") returned 0 [0047.109] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.pptx") returned 0 [0047.109] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.pdf") returned 0 [0047.109] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mov") returned 0 [0047.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.m2v") returned 0 [0047.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.3gp") returned 0 [0047.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mpeg") returned 0 [0047.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mpg") returned 0 [0047.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.flv") returned 0 [0047.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.avi") returned 0 [0047.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mp4") returned 0 [0047.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.wmv") returned 0 [0047.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.divx") returned 0 [0047.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mkv") returned 0 [0047.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mp3") returned 0 [0047.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.wav") returned 0 [0047.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.flac") returned 0 [0047.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.ape") returned 0 [0047.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.wma") returned 0 [0047.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.ac3") returned 0 [0047.110] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", pszSpec="*.mxf") returned 0 [0047.110] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00, dwReserved0=0x780074, dwReserved1=0x74, cFileName="ProPlusrWW.msi", cAlternateFileName="PROPLU~1.MSI")) returned 1 [0047.110] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.111] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProPlusrWW.msi") returned -1 [0047.111] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProPlusrWW.msi") returned -1 [0047.111] lstrcmpiA (lpString1="", lpString2="ProPlusrWW.msi") returned -1 [0047.111] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned="pkeyconfig-office.xrm-ms" [0047.111] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0047.111] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="" [0047.111] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.111] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.111] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="ProPlusrWW.msi" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" [0047.111] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", pszSpec="*.zip") returned 0 [0047.111] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", pszSpec="*.rar") returned 0 [0047.111] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", pszSpec="*.7z") returned 0 [0047.111] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", pszSpec="*.tar") returned 0 [0047.111] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", pszSpec="*.gzip") returned 0 [0047.111] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", pszSpec="*.jpg") returned 0 [0047.111] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", pszSpec="*.jpeg") returned 0 [0047.111] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", pszSpec="*.psd") returned 0 [0047.111] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", pszSpec="*.gif") returned 0 [0047.111] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", pszSpec="*.doc") returned 0 [0047.111] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", pszSpec="*.docx") returned 0 [0047.112] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x780074, dwReserved1=0x74, cFileName="ProPlusrWW.xml", cAlternateFileName="PROPLU~1.XML")) returned 1 [0047.112] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.112] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProPlusrWW.xml") returned -1 [0047.112] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProPlusrWW.xml") returned -1 [0047.112] lstrcmpiA (lpString1="", lpString2="ProPlusrWW.xml") returned -1 [0047.112] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned="ProPlusrWW.msi" [0047.112] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0047.112] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="" [0047.112] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.112] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.112] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="ProPlusrWW.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" [0047.112] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb, dwReserved0=0x780074, dwReserved1=0x74, cFileName="ProPrWW.cab", cAlternateFileName="")) returned 1 [0047.112] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.113] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProPrWW.cab") returned -1 [0047.113] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProPrWW.cab") returned -1 [0047.113] lstrcmpiA (lpString1="", lpString2="ProPrWW.cab") returned -1 [0047.113] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned="ProPlusrWW.xml" [0047.113] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0047.113] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="" [0047.113] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.113] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.113] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="ProPrWW.cab" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" [0047.113] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31, dwReserved0=0x780074, dwReserved1=0x74, cFileName="ProPrWW2.cab", cAlternateFileName="")) returned 1 [0047.113] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.113] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProPrWW2.cab") returned -1 [0047.113] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProPrWW2.cab") returned -1 [0047.113] lstrcmpiA (lpString1="", lpString2="ProPrWW2.cab") returned -1 [0047.113] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned="ProPrWW.cab" [0047.113] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0047.113] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="" [0047.113] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.113] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.113] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="ProPrWW2.cab" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" [0047.114] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec13c00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbec13c00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x1682d290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x780074, dwReserved1=0x74, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0047.114] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.114] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="setup.exe") returned -1 [0047.114] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="setup.exe") returned -1 [0047.114] lstrcmpiA (lpString1="", lpString2="setup.exe") returned -1 [0047.114] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned="ProPrWW2.cab" [0047.114] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0047.114] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="" [0047.114] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.114] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.114] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="setup.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" [0047.114] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0047.114] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.114] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0047.114] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0047.114] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0047.114] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned="setup.exe" [0047.114] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" [0047.114] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned="" [0047.114] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.114] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.115] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" [0047.115] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0047.115] FindClose (in: hFindFile=0x2d6f20 | out: hFindFile=0x2d6f20) returned 1 [0047.115] FindNextFileA (in: hFindFile=0x2d6f60, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~3")) returned 1 [0047.115] lstrcmpA (lpString1=".", lpString2="{91140000-003B-0000-1000-0000000FF1CE}-C") returned -1 [0047.115] lstrcmpA (lpString1="..", lpString2="{91140000-003B-0000-1000-0000000FF1CE}-C") returned -1 [0047.115] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0047.115] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{91140000-003B-0000-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C" [0047.115] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2d6f20 [0047.120] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.120] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.120] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.120] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.120] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0047.121] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.121] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Office32WW.msi") returned -1 [0047.121] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office32WW.msi") returned -1 [0047.121] lstrcmpiA (lpString1="", lpString2="Office32WW.msi") returned -1 [0047.121] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0047.121] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" [0047.121] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="" [0047.121] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.121] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0047.121] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0047.125] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.125] CloseHandle (hObject=0x88) returned 1 [0047.126] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="Office32WW.msi" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" [0047.126] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x2d9690, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0047.126] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.126] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Office32WW.xml") returned -1 [0047.126] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office32WW.xml") returned -1 [0047.126] lstrcmpiA (lpString1="", lpString2="Office32WW.xml") returned -1 [0047.126] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned="Office32WW.msi" [0047.126] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" [0047.126] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="" [0047.126] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.126] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.126] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="Office32WW.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" [0047.126] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x780074, dwReserved1=0x74, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0047.126] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.126] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ose.exe") returned -1 [0047.126] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ose.exe") returned -1 [0047.126] lstrcmpiA (lpString1="", lpString2="ose.exe") returned -1 [0047.126] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned="Office32WW.xml" [0047.126] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" [0047.126] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="" [0047.126] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.127] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.127] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="ose.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" [0047.127] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6644b620, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x6644b620, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa81b8770, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x780074, dwReserved1=0x74, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0047.127] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.127] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="osetup.dll") returned -1 [0047.127] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="osetup.dll") returned -1 [0047.127] lstrcmpiA (lpString1="", lpString2="osetup.dll") returned -1 [0047.127] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned="ose.exe" [0047.127] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" [0047.127] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="" [0047.127] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.127] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.127] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="osetup.dll" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" [0047.127] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0047.127] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.127] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OWOW32WW.cab") returned -1 [0047.127] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OWOW32WW.cab") returned -1 [0047.127] lstrcmpiA (lpString1="", lpString2="OWOW32WW.cab") returned -1 [0047.127] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned="osetup.dll" [0047.127] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" [0047.127] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="" [0047.127] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.127] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.127] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="OWOW32WW.cab" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" [0047.127] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0047.128] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.128] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PidGenX.dll") returned -1 [0047.128] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PidGenX.dll") returned -1 [0047.128] lstrcmpiA (lpString1="", lpString2="PidGenX.dll") returned -1 [0047.128] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned="OWOW32WW.cab" [0047.128] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" [0047.128] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="" [0047.128] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.128] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.128] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="PidGenX.dll" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" [0047.128] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x780074, dwReserved1=0x74, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0047.128] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.128] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="pkeyconfig-office.xrm-ms") returned -1 [0047.128] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pkeyconfig-office.xrm-ms") returned -1 [0047.128] lstrcmpiA (lpString1="", lpString2="pkeyconfig-office.xrm-ms") returned -1 [0047.128] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned="PidGenX.dll" [0047.128] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" [0047.128] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="" [0047.128] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.128] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.128] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="pkeyconfig-office.xrm-ms" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" [0047.128] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PrjProrWW.msi", cAlternateFileName="PRJPRO~1.MSI")) returned 1 [0047.129] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.129] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PrjProrWW.msi") returned -1 [0047.129] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PrjProrWW.msi") returned -1 [0047.129] lstrcmpiA (lpString1="", lpString2="PrjProrWW.msi") returned -1 [0047.129] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned="pkeyconfig-office.xrm-ms" [0047.129] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" [0047.129] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="" [0047.129] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.129] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.129] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="PrjProrWW.msi" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" [0047.129] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PrjProrWW.xml", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0047.129] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.129] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PrjProrWW.xml") returned -1 [0047.129] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PrjProrWW.xml") returned -1 [0047.129] lstrcmpiA (lpString1="", lpString2="PrjProrWW.xml") returned -1 [0047.129] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned="PrjProrWW.msi" [0047.129] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" [0047.129] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="" [0047.129] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.129] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.130] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="PrjProrWW.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" [0047.130] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PrjPrrWW.cab", cAlternateFileName="")) returned 1 [0047.130] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.130] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PrjPrrWW.cab") returned -1 [0047.130] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PrjPrrWW.cab") returned -1 [0047.130] lstrcmpiA (lpString1="", lpString2="PrjPrrWW.cab") returned -1 [0047.130] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned="PrjProrWW.xml" [0047.130] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" [0047.130] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="" [0047.130] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.130] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.130] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="PrjPrrWW.cab" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" [0047.130] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69dde270, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x69dde270, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa8191670, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x780074, dwReserved1=0x74, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0047.130] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.130] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="setup.exe") returned -1 [0047.130] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="setup.exe") returned -1 [0047.130] lstrcmpiA (lpString1="", lpString2="setup.exe") returned -1 [0047.130] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned="PrjPrrWW.cab" [0047.130] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" [0047.130] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="" [0047.131] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.131] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.131] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="setup.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" [0047.131] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0047.131] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.131] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0047.131] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0047.131] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0047.131] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned="setup.exe" [0047.131] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" [0047.131] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned="" [0047.131] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.131] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.131] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" [0047.131] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0047.131] FindClose (in: hFindFile=0x2d6f20 | out: hFindFile=0x2d6f20) returned 1 [0047.132] FindNextFileA (in: hFindFile=0x2d6f60, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 1 [0047.132] lstrcmpA (lpString1=".", lpString2="{91140000-0057-0000-1000-0000000FF1CE}-C") returned -1 [0047.132] lstrcmpA (lpString1="..", lpString2="{91140000-0057-0000-1000-0000000FF1CE}-C") returned -1 [0047.132] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0047.132] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{91140000-0057-0000-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C" [0047.132] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2d6f20 [0047.135] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.135] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.135] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.135] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.135] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0047.135] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.135] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Office32WW.msi") returned -1 [0047.135] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office32WW.msi") returned -1 [0047.135] lstrcmpiA (lpString1="", lpString2="Office32WW.msi") returned -1 [0047.135] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0047.135] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" [0047.135] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="" [0047.135] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.135] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0xffffffff [0047.136] CreateFileA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0047.137] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.137] CloseHandle (hObject=0x88) returned 1 [0047.138] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="Office32WW.msi" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" [0047.138] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x2d9690, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0047.138] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.138] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Office32WW.xml") returned -1 [0047.138] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office32WW.xml") returned -1 [0047.138] lstrcmpiA (lpString1="", lpString2="Office32WW.xml") returned -1 [0047.138] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned="Office32WW.msi" [0047.138] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" [0047.138] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="" [0047.138] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.138] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.138] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="Office32WW.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" [0047.138] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec54b6b0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xec54b6b0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x4a687710, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x780074, dwReserved1=0x74, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0047.138] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.138] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ose.exe") returned -1 [0047.139] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ose.exe") returned -1 [0047.139] lstrcmpiA (lpString1="", lpString2="ose.exe") returned -1 [0047.139] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned="Office32WW.xml" [0047.139] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" [0047.139] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="" [0047.139] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.139] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.139] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="ose.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" [0047.139] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde72fbf0, ftCreationTime.dwHighDateTime=0x1cb0d0b, ftLastAccessTime.dwLowDateTime=0xde72fbf0, ftLastAccessTime.dwHighDateTime=0x1cb0d0b, ftLastWriteTime.dwLowDateTime=0x49c902c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x780074, dwReserved1=0x74, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0047.139] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.139] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="osetup.dll") returned -1 [0047.139] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="osetup.dll") returned -1 [0047.139] lstrcmpiA (lpString1="", lpString2="osetup.dll") returned -1 [0047.139] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned="ose.exe" [0047.139] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" [0047.139] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="" [0047.139] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.139] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.139] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="osetup.dll" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" [0047.140] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x465d00f0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0047.140] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.140] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OWOW32WW.cab") returned -1 [0047.140] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OWOW32WW.cab") returned -1 [0047.140] lstrcmpiA (lpString1="", lpString2="OWOW32WW.cab") returned -1 [0047.140] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned="osetup.dll" [0047.140] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" [0047.140] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="" [0047.140] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.140] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.140] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="OWOW32WW.cab" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" [0047.140] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7c66670, ftCreationTime.dwHighDateTime=0x1cb0ee5, ftLastAccessTime.dwLowDateTime=0xe7c66670, ftLastAccessTime.dwHighDateTime=0x1cb0ee5, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0047.140] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.140] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PidGenX.dll") returned -1 [0047.140] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PidGenX.dll") returned -1 [0047.140] lstrcmpiA (lpString1="", lpString2="PidGenX.dll") returned -1 [0047.140] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned="OWOW32WW.cab" [0047.140] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" [0047.140] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="" [0047.140] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.140] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.141] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="PidGenX.dll" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" [0047.141] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x780074, dwReserved1=0x74, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0047.141] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.141] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="pkeyconfig-office.xrm-ms") returned -1 [0047.141] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pkeyconfig-office.xrm-ms") returned -1 [0047.141] lstrcmpiA (lpString1="", lpString2="pkeyconfig-office.xrm-ms") returned -1 [0047.141] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned="PidGenX.dll" [0047.141] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" [0047.141] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="" [0047.141] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.141] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.141] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="pkeyconfig-office.xrm-ms" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" [0047.141] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb7e7af0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xeb7e7af0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x49c691c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x780074, dwReserved1=0x74, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0047.141] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.141] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="setup.exe") returned -1 [0047.141] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="setup.exe") returned -1 [0047.141] lstrcmpiA (lpString1="", lpString2="setup.exe") returned -1 [0047.141] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned="pkeyconfig-office.xrm-ms" [0047.141] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" [0047.141] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="" [0047.141] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.142] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.142] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="setup.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" [0047.142] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0047.142] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.142] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Setup.xml") returned -1 [0047.142] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0047.142] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0047.142] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned="setup.exe" [0047.142] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" [0047.142] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="" [0047.142] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.142] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.142] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" [0047.142] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x46a46a30, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa2f7, dwReserved0=0x780074, dwReserved1=0x74, cFileName="VisiorWW.cab", cAlternateFileName="")) returned 1 [0047.142] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.142] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VisiorWW.cab") returned -1 [0047.142] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VisiorWW.cab") returned -1 [0047.142] lstrcmpiA (lpString1="", lpString2="VisiorWW.cab") returned -1 [0047.143] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned="Setup.xml" [0047.143] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" [0047.143] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="" [0047.143] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.143] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.143] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="VisiorWW.cab" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" [0047.143] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468ee660, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb80800, dwReserved0=0x780074, dwReserved1=0x74, cFileName="VisiorWW.msi", cAlternateFileName="")) returned 1 [0047.143] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.143] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VisiorWW.msi") returned -1 [0047.143] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VisiorWW.msi") returned -1 [0047.143] lstrcmpiA (lpString1="", lpString2="VisiorWW.msi") returned -1 [0047.143] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned="VisiorWW.cab" [0047.143] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" [0047.143] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="" [0047.143] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.143] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.143] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="VisiorWW.msi" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" [0047.143] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x780074, dwReserved1=0x74, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 1 [0047.143] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.143] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VisiorWW.xml") returned -1 [0047.144] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VisiorWW.xml") returned -1 [0047.144] lstrcmpiA (lpString1="", lpString2="VisiorWW.xml") returned -1 [0047.144] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned="VisiorWW.msi" [0047.144] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" [0047.144] PathAddBackslashA (in: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\" | out: pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned="" [0047.144] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" [0047.144] GetFileAttributesA (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\how to decrypt files.txt")) returned 0x2020 [0047.144] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="VisiorWW.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" [0047.144] FindNextFileA (in: hFindFile=0x2d6f20, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x780074, dwReserved1=0x74, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 0 [0047.144] FindClose (in: hFindFile=0x2d6f20 | out: hFindFile=0x2d6f20) returned 1 [0047.144] FindNextFileA (in: hFindFile=0x2d6f60, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 0 [0047.144] FindClose (in: hFindFile=0x2d6f60 | out: hFindFile=0x2d6f60) returned 1 [0047.144] FindNextFileA (in: hFindFile=0x2d5ed8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 0 [0047.144] FindClose (in: hFindFile=0x2d5ed8 | out: hFindFile=0x2d5ed8) returned 1 [0047.144] FindNextFileA (in: hFindFile=0x2d4d10, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xaece4da0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x53004d, dwReserved1=0x3, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0047.144] PeekMessageA (in: lpMsg=0x18fe14, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fe14) returned 0 [0047.145] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="pagefile.sys") returned -1 [0047.145] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pagefile.sys") returned -1 [0047.145] lstrcmpiA (lpString1="", lpString2="pagefile.sys") returned -1 [0047.145] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0047.145] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0047.145] PathAddBackslashA (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0047.145] lstrcatA (in: lpString1="C:\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\HOW TO DECRYPT FILES.txt") returned="C:\\HOW TO DECRYPT FILES.txt" [0047.145] GetFileAttributesA (lpFileName="C:\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\how to decrypt files.txt")) returned 0x20 [0047.145] lstrcatA (in: lpString1="C:\\", lpString2="pagefile.sys" | out: lpString1="C:\\pagefile.sys") returned="C:\\pagefile.sys" [0047.145] FindNextFileA (in: hFindFile=0x2d4d10, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0047.145] lstrcmpA (lpString1=".", lpString2="PerfLogs") returned -1 [0047.145] lstrcmpA (lpString1="..", lpString2="PerfLogs") returned -1 [0047.145] PathFindFileNameA (pszPath="C:\\pagefile.sys") returned="pagefile.sys" [0047.145] lstrcatA (in: lpString1="C:\\", lpString2="PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0047.145] FindFirstFileA (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18fb50, dwReserved1=0x2d5f0e, cFileName=".", cAlternateFileName="")) returned 0x2d5ed8 [0047.146] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.146] FindNextFileA (in: hFindFile=0x2d5ed8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.146] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.146] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.146] FindNextFileA (in: hFindFile=0x2d5ed8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0047.146] lstrcmpA (lpString1=".", lpString2="Admin") returned -1 [0047.146] lstrcmpA (lpString1="..", lpString2="Admin") returned -1 [0047.146] PathFindFileNameA (pszPath="C:\\PerfLogs\\*.*") returned="*.*" [0047.146] lstrcatA (in: lpString1="C:\\PerfLogs\\", lpString2="Admin" | out: lpString1="C:\\PerfLogs\\Admin") returned="C:\\PerfLogs\\Admin" [0047.146] FindFirstFileA (in: lpFileName="C:\\PerfLogs\\Admin\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5f18, dwReserved1=0x2d5f13, cFileName=".", cAlternateFileName="")) returned 0x2d6f58 [0047.146] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.146] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.146] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.147] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.147] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 0 [0047.147] FindClose (in: hFindFile=0x2d6f58 | out: hFindFile=0x2d6f58) returned 1 [0047.147] FindNextFileA (in: hFindFile=0x2d5ed8, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 0 [0047.147] FindClose (in: hFindFile=0x2d5ed8 | out: hFindFile=0x2d5ed8) returned 1 [0047.147] FindNextFileA (in: hFindFile=0x2d4d10, lpFindFileData=0x18fe38 | out: lpFindFileData=0x18fe38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe48d5620, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe48d5620, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650050, dwReserved1=0x3, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0047.147] lstrcmpA (lpString1=".", lpString2="Program Files") returned -1 [0047.147] lstrcmpA (lpString1="..", lpString2="Program Files") returned -1 [0047.147] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0047.147] lstrcatA (in: lpString1="C:\\", lpString2="Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0047.147] FindFirstFileA (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe48d5620, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe48d5620, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x640041, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2d5f10 [0047.147] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.147] FindNextFileA (in: hFindFile=0x2d5f10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe48d5620, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe48d5620, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.147] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.147] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.147] FindNextFileA (in: hFindFile=0x2d5f10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdd8ceac0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd8ceac0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0047.148] lstrcmpA (lpString1=".", lpString2="Common Files") returned -1 [0047.148] lstrcmpA (lpString1="..", lpString2="Common Files") returned -1 [0047.148] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*" [0047.148] lstrcatA (in: lpString1="C:\\Program Files\\", lpString2="Common Files" | out: lpString1="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0047.148] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdd8ceac0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd8ceac0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5f50, dwReserved1=0x2d5f4b, cFileName=".", cAlternateFileName="")) returned 0x2d6fa8 [0047.148] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.148] FindNextFileA (in: hFindFile=0x2d6fa8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdd8ceac0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd8ceac0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.148] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.148] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.148] FindNextFileA (in: hFindFile=0x2d6fa8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99eb4be0, ftCreationTime.dwHighDateTime=0x1d5e069, ftLastAccessTime.dwLowDateTime=0xf7f98290, ftLastAccessTime.dwHighDateTime=0x1d5cc4d, ftLastWriteTime.dwLowDateTime=0xf7f98290, ftLastWriteTime.dwHighDateTime=0x1d5cc4d, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="centralcreditcard.exe", cAlternateFileName="CENTRA~1.EXE")) returned 1 [0047.148] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0047.148] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="centralcreditcard.exe") returned 1 [0047.148] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="centralcreditcard.exe") returned 1 [0047.148] lstrcmpiA (lpString1="", lpString2="centralcreditcard.exe") returned -1 [0047.148] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\*.*") returned="*.*" [0047.148] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\" | out: lpString1="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0047.148] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\" | out: pszPath="C:\\Program Files\\Common Files\\") returned="" [0047.148] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\HOW TO DECRYPT FILES.txt" [0047.148] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\how to decrypt files.txt")) returned 0xffffffff [0047.149] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0047.150] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.150] CloseHandle (hObject=0x84) returned 1 [0047.151] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\", lpString2="centralcreditcard.exe" | out: lpString1="C:\\Program Files\\Common Files\\centralcreditcard.exe") returned="C:\\Program Files\\Common Files\\centralcreditcard.exe" [0047.151] FindNextFileA (in: hFindFile=0x2d6fa8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8290, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0047.151] lstrcmpA (lpString1=".", lpString2="DESIGNER") returned -1 [0047.151] lstrcmpA (lpString1="..", lpString2="DESIGNER") returned -1 [0047.151] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\centralcreditcard.exe") returned="centralcreditcard.exe" [0047.151] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\", lpString2="DESIGNER" | out: lpString1="C:\\Program Files\\Common Files\\DESIGNER") returned="C:\\Program Files\\Common Files\\DESIGNER" [0047.151] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d805c, cFileName=".", cAlternateFileName="")) returned 0x2d6f58 [0047.151] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.151] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.152] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.152] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.152] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0047.152] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0047.152] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSADDNDR.DLL") returned -1 [0047.152] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSADDNDR.DLL") returned -1 [0047.152] lstrcmpiA (lpString1="", lpString2="MSADDNDR.DLL") returned -1 [0047.152] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\DESIGNER\\*.*") returned="*.*" [0047.152] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\DESIGNER\\" | out: lpString1="C:\\Program Files\\Common Files\\DESIGNER\\") returned="C:\\Program Files\\Common Files\\DESIGNER\\" [0047.152] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\DESIGNER\\" | out: pszPath="C:\\Program Files\\Common Files\\DESIGNER\\") returned="" [0047.152] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\DESIGNER\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\DESIGNER\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\DESIGNER\\HOW TO DECRYPT FILES.txt" [0047.152] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\designer\\how to decrypt files.txt")) returned 0xffffffff [0047.152] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\designer\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0047.154] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.155] CloseHandle (hObject=0x88) returned 1 [0047.155] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\DESIGNER\\", lpString2="MSADDNDR.DLL" | out: lpString1="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" [0047.155] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0 [0047.155] FindClose (in: hFindFile=0x2d6f58 | out: hFindFile=0x2d6f58) returned 1 [0047.155] FindNextFileA (in: hFindFile=0x2d6fa8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0047.155] lstrcmpA (lpString1=".", lpString2="Microsoft Shared") returned -1 [0047.155] lstrcmpA (lpString1="..", lpString2="Microsoft Shared") returned -1 [0047.155] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\*.*") returned="*.*" [0047.155] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\", lpString2="Microsoft Shared" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared") returned="C:\\Program Files\\Common Files\\Microsoft Shared" [0047.155] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d82a0, cFileName=".", cAlternateFileName="")) returned 0x2d6f58 [0047.156] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.156] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.156] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.156] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.156] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0047.156] lstrcmpA (lpString1=".", lpString2="DW") returned -1 [0047.156] lstrcmpA (lpString1="..", lpString2="DW") returned -1 [0047.156] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0047.156] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="DW" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW" [0047.156] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2d8068 [0047.158] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.158] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.158] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.158] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.158] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0047.158] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.158] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DBGHELP.DLL") returned 1 [0047.158] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DBGHELP.DLL") returned 1 [0047.158] lstrcmpiA (lpString1="", lpString2="DBGHELP.DLL") returned -1 [0047.158] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*") returned="*.*" [0047.159] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\" [0047.159] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\") returned="" [0047.159] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\HOW TO DECRYPT FILES.txt" [0047.159] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\how to decrypt files.txt")) returned 0xffffffff [0047.159] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0047.160] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.161] CloseHandle (hObject=0x8c) returned 1 [0047.161] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", lpString2="DBGHELP.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" [0047.161] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x0, dwReserved1=0x2d8370, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0047.161] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.161] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DW20.EXE") returned 1 [0047.161] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DW20.EXE") returned 1 [0047.161] lstrcmpiA (lpString1="", lpString2="DW20.EXE") returned -1 [0047.161] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned="DBGHELP.DLL" [0047.161] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\" [0047.161] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\") returned="" [0047.161] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\HOW TO DECRYPT FILES.txt" [0047.161] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\how to decrypt files.txt")) returned 0x20 [0047.161] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", lpString2="DW20.EXE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" [0047.161] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0047.161] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.162] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DWTRIG20.EXE") returned 1 [0047.162] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DWTRIG20.EXE") returned 1 [0047.162] lstrcmpiA (lpString1="", lpString2="DWTRIG20.EXE") returned -1 [0047.162] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned="DW20.EXE" [0047.162] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\" [0047.162] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\") returned="" [0047.162] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\HOW TO DECRYPT FILES.txt" [0047.162] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\how to decrypt files.txt")) returned 0x20 [0047.162] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", lpString2="DWTRIG20.EXE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" [0047.162] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 0 [0047.162] FindClose (in: hFindFile=0x2d8068 | out: hFindFile=0x2d8068) returned 1 [0047.162] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0047.162] lstrcmpA (lpString1=".", lpString2="EQUATION") returned -1 [0047.162] lstrcmpA (lpString1="..", lpString2="EQUATION") returned -1 [0047.162] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0047.162] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="EQUATION" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION" [0047.162] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.163] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.163] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.164] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.164] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.164] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0047.164] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0047.164] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0047.164] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*") returned="*.*" [0047.164] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="1033" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033" [0047.164] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0047.165] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.165] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.165] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.165] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.165] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0047.165] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.165] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EEINTL.DLL") returned -1 [0047.165] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EEINTL.DLL") returned 1 [0047.165] lstrcmpiA (lpString1="", lpString2="EEINTL.DLL") returned -1 [0047.165] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*") returned="*.*" [0047.166] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\" [0047.166] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\") returned="" [0047.167] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\HOW TO DECRYPT FILES.txt" [0047.167] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\how to decrypt files.txt")) returned 0xffffffff [0047.167] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.169] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.169] CloseHandle (hObject=0x90) returned 1 [0047.170] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", lpString2="EEINTL.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" [0047.170] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 0 [0047.170] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0047.170] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0047.170] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.170] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EQNEDT32.CNT") returned -1 [0047.170] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EQNEDT32.CNT") returned 1 [0047.170] lstrcmpiA (lpString1="", lpString2="EQNEDT32.CNT") returned -1 [0047.170] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*") returned="*.*" [0047.170] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" [0047.170] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned="" [0047.170] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt" [0047.170] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\how to decrypt files.txt")) returned 0xffffffff [0047.170] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0047.172] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.172] CloseHandle (hObject=0x8c) returned 1 [0047.172] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="EQNEDT32.CNT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" [0047.172] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x0, dwReserved1=0x2d8308, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1 [0047.172] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.172] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EQNEDT32.EXE") returned -1 [0047.172] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EQNEDT32.EXE") returned 1 [0047.173] lstrcmpiA (lpString1="", lpString2="EQNEDT32.EXE") returned -1 [0047.173] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned="EQNEDT32.CNT" [0047.173] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" [0047.173] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned="" [0047.173] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt" [0047.173] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\how to decrypt files.txt")) returned 0x20 [0047.173] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="EQNEDT32.EXE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" [0047.173] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="eqnedt32.exe.manifest", cAlternateFileName="EQNEDT~1.MAN")) returned 1 [0047.173] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.173] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eqnedt32.exe.manifest") returned -1 [0047.173] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eqnedt32.exe.manifest") returned 1 [0047.173] lstrcmpiA (lpString1="", lpString2="eqnedt32.exe.manifest") returned -1 [0047.173] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned="EQNEDT32.EXE" [0047.173] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" [0047.173] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned="" [0047.173] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt" [0047.173] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\how to decrypt files.txt")) returned 0x20 [0047.173] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="eqnedt32.exe.manifest" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" [0047.173] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1 [0047.174] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.174] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EQNEDT32.HLP") returned -1 [0047.174] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EQNEDT32.HLP") returned 1 [0047.174] lstrcmpiA (lpString1="", lpString2="EQNEDT32.HLP") returned -1 [0047.174] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned="eqnedt32.exe.manifest" [0047.174] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" [0047.174] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned="" [0047.174] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt" [0047.174] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\how to decrypt files.txt")) returned 0x20 [0047.174] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="EQNEDT32.HLP" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" [0047.174] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1 [0047.174] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.174] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MTEXTRA.TTF") returned -1 [0047.174] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MTEXTRA.TTF") returned -1 [0047.174] lstrcmpiA (lpString1="", lpString2="MTEXTRA.TTF") returned -1 [0047.174] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned="EQNEDT32.HLP" [0047.174] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" [0047.174] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned="" [0047.174] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt" [0047.174] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\how to decrypt files.txt")) returned 0x20 [0047.174] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="MTEXTRA.TTF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" [0047.175] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 0 [0047.175] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.175] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="EURO", cAlternateFileName="")) returned 1 [0047.175] lstrcmpA (lpString1=".", lpString2="EURO") returned -1 [0047.175] lstrcmpA (lpString1="..", lpString2="EURO") returned -1 [0047.175] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0047.175] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="EURO" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO" [0047.175] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d8068 [0047.176] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.176] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.176] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.176] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.176] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0047.176] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.176] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOEURO.DLL") returned -1 [0047.176] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOEURO.DLL") returned -1 [0047.177] lstrcmpiA (lpString1="", lpString2="MSOEURO.DLL") returned -1 [0047.177] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*") returned="*.*" [0047.177] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\" [0047.177] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\") returned="" [0047.177] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\HOW TO DECRYPT FILES.txt" [0047.177] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\how to decrypt files.txt")) returned 0xffffffff [0047.177] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0047.178] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.178] CloseHandle (hObject=0x8c) returned 1 [0047.179] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", lpString2="MSOEURO.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" [0047.179] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 0 [0047.179] FindClose (in: hFindFile=0x2d8068 | out: hFindFile=0x2d8068) returned 1 [0047.179] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Filters", cAlternateFileName="")) returned 1 [0047.179] lstrcmpA (lpString1=".", lpString2="Filters") returned -1 [0047.179] lstrcmpA (lpString1="..", lpString2="Filters") returned -1 [0047.179] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0047.179] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="Filters" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters" [0047.179] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8378, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.183] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.183] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.183] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.183] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.183] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0047.183] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.183] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msgfilt.dll") returned -1 [0047.183] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msgfilt.dll") returned -1 [0047.183] lstrcmpiA (lpString1="", lpString2="msgfilt.dll") returned -1 [0047.183] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*") returned="*.*" [0047.183] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" [0047.183] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\") returned="" [0047.183] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW TO DECRYPT FILES.txt" [0047.184] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\how to decrypt files.txt")) returned 0xffffffff [0047.184] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0047.185] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.188] CloseHandle (hObject=0x8c) returned 1 [0047.189] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", lpString2="msgfilt.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" [0047.189] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x6b29d7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x140790, dwReserved0=0x0, dwReserved1=0x2d8300, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0047.189] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.189] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="odffilt.dll") returned -1 [0047.189] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="odffilt.dll") returned -1 [0047.189] lstrcmpiA (lpString1="", lpString2="odffilt.dll") returned -1 [0047.189] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned="msgfilt.dll" [0047.189] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" [0047.189] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\") returned="" [0047.189] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW TO DECRYPT FILES.txt" [0047.189] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\how to decrypt files.txt")) returned 0x20 [0047.189] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", lpString2="odffilt.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" [0047.189] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x16af90, dwReserved0=0x0, dwReserved1=0x0, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0047.189] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.189] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="offfiltx.dll") returned -1 [0047.189] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="offfiltx.dll") returned -1 [0047.189] lstrcmpiA (lpString1="", lpString2="offfiltx.dll") returned -1 [0047.189] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned="odffilt.dll" [0047.190] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" [0047.190] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\") returned="" [0047.190] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW TO DECRYPT FILES.txt" [0047.190] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\how to decrypt files.txt")) returned 0x20 [0047.190] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", lpString2="offfiltx.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" [0047.190] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0047.190] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.190] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISFILT.DLL") returned -1 [0047.190] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISFILT.DLL") returned -1 [0047.190] lstrcmpiA (lpString1="", lpString2="VISFILT.DLL") returned -1 [0047.190] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned="offfiltx.dll" [0047.190] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" [0047.190] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\") returned="" [0047.190] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW TO DECRYPT FILES.txt" [0047.190] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\how to decrypt files.txt")) returned 0x20 [0047.190] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", lpString2="VISFILT.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" [0047.190] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0 [0047.190] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.191] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0047.191] lstrcmpA (lpString1=".", lpString2="GRPHFLT") returned -1 [0047.191] lstrcmpA (lpString1="..", lpString2="GRPHFLT") returned -1 [0047.191] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0047.191] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="GRPHFLT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT" [0047.191] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.194] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.194] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.194] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.194] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.194] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0047.194] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.194] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CGMIMP32.CFG") returned 1 [0047.194] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CGMIMP32.CFG") returned 1 [0047.194] lstrcmpiA (lpString1="", lpString2="CGMIMP32.CFG") returned -1 [0047.194] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*") returned="*.*" [0047.194] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0047.194] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0047.194] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" [0047.194] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0xffffffff [0047.194] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0047.196] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.196] CloseHandle (hObject=0x8c) returned 1 [0047.197] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="CGMIMP32.CFG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" [0047.197] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0x0, dwReserved1=0x2d8300, cFileName="CGMIMP32.FLT", cAlternateFileName="")) returned 1 [0047.197] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.197] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CGMIMP32.FLT") returned 1 [0047.197] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CGMIMP32.FLT") returned 1 [0047.197] lstrcmpiA (lpString1="", lpString2="CGMIMP32.FLT") returned -1 [0047.197] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned="CGMIMP32.CFG" [0047.197] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0047.197] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0047.197] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" [0047.197] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20 [0047.197] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="CGMIMP32.FLT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" [0047.197] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FNT", cAlternateFileName="")) returned 1 [0047.197] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.197] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CGMIMP32.FNT") returned 1 [0047.197] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CGMIMP32.FNT") returned 1 [0047.197] lstrcmpiA (lpString1="", lpString2="CGMIMP32.FNT") returned -1 [0047.198] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned="CGMIMP32.FLT" [0047.198] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0047.198] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0047.198] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" [0047.198] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20 [0047.198] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="CGMIMP32.FNT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" [0047.198] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 1 [0047.198] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.198] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EPSIMP32.FLT") returned -1 [0047.198] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EPSIMP32.FLT") returned 1 [0047.198] lstrcmpiA (lpString1="", lpString2="EPSIMP32.FLT") returned -1 [0047.198] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned="CGMIMP32.FNT" [0047.198] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0047.198] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0047.198] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" [0047.198] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20 [0047.198] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="EPSIMP32.FLT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" [0047.198] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIFIMP32.FLT", cAlternateFileName="")) returned 1 [0047.198] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.198] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GIFIMP32.FLT") returned -1 [0047.199] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GIFIMP32.FLT") returned 1 [0047.199] lstrcmpiA (lpString1="", lpString2="GIFIMP32.FLT") returned -1 [0047.199] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned="EPSIMP32.FLT" [0047.199] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0047.199] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0047.199] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" [0047.199] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20 [0047.199] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="GIFIMP32.FLT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" [0047.199] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPEGIM32.FLT", cAlternateFileName="")) returned 1 [0047.199] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.199] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="JPEGIM32.FLT") returned -1 [0047.199] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="JPEGIM32.FLT") returned -1 [0047.199] lstrcmpiA (lpString1="", lpString2="JPEGIM32.FLT") returned -1 [0047.199] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned="GIFIMP32.FLT" [0047.199] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0047.199] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0047.199] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" [0047.199] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20 [0047.199] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="JPEGIM32.FLT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" [0047.199] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.CGM", cAlternateFileName="")) returned 1 [0047.200] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.200] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MS.CGM") returned -1 [0047.200] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MS.CGM") returned -1 [0047.200] lstrcmpiA (lpString1="", lpString2="MS.CGM") returned -1 [0047.200] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned="JPEGIM32.FLT" [0047.200] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0047.200] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0047.200] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" [0047.200] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20 [0047.200] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="MS.CGM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" [0047.200] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x3adb, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EPS", cAlternateFileName="")) returned 1 [0047.200] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.200] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MS.EPS") returned -1 [0047.200] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MS.EPS") returned -1 [0047.200] lstrcmpiA (lpString1="", lpString2="MS.EPS") returned -1 [0047.200] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned="MS.CGM" [0047.200] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0047.200] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0047.201] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" [0047.201] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20 [0047.201] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="MS.EPS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" [0047.201] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GIF", cAlternateFileName="")) returned 1 [0047.201] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.201] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MS.GIF") returned -1 [0047.201] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MS.GIF") returned -1 [0047.201] lstrcmpiA (lpString1="", lpString2="MS.GIF") returned -1 [0047.201] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned="MS.EPS" [0047.201] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0047.201] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0047.201] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" [0047.201] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20 [0047.201] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="MS.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" [0047.201] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" [0047.201] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" [0047.201] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF." [0047.201] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.wannacry" [0047.201] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0047.202] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x42d [0047.203] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x916cf600, dwHighDateTime=0x1bcabec), lpLastAccessTime=0x407536*(dwLowDateTime=0xeee42ef0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0x916cf600, dwHighDateTime=0x1bcabec)) returned 1 [0047.203] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0047.203] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3af, lpOverlapped=0x0) returned 1 [0047.222] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned="MS.GIF" [0047.222] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0047.222] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3af, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3af, lpOverlapped=0x0) returned 1 [0047.223] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0047.223] CloseHandle (hObject=0x8c) returned 1 [0047.227] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.wannacry")) returned 1 [0047.228] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x2000002, dwReserved1=0x2d5ed8, cFileName="MS.JPG", cAlternateFileName="")) returned 1 [0047.228] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.228] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MS.JPG") returned -1 [0047.228] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MS.JPG") returned -1 [0047.228] lstrcmpiA (lpString1="", lpString2="MS.JPG") returned -1 [0047.228] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned="MS.GIF" [0047.228] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0047.228] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0047.228] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" [0047.228] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20 [0047.229] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="MS.JPG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" [0047.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", pszSpec="*.zip") returned 0 [0047.229] lstrlenA (lpString="*.zip") returned 5 [0047.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", pszSpec="*.rar") returned 0 [0047.229] lstrlenA (lpString="*.rar") returned 5 [0047.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", pszSpec="*.7z") returned 0 [0047.229] lstrlenA (lpString="*.7z") returned 4 [0047.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", pszSpec="*.tar") returned 0 [0047.229] lstrlenA (lpString="*.tar") returned 5 [0047.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", pszSpec="*.gzip") returned 0 [0047.229] lstrlenA (lpString="*.gzip") returned 6 [0047.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", pszSpec="*.jpg") returned 1 [0047.229] lstrlenA (lpString="*.jpg") returned 5 [0047.229] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" [0047.229] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" [0047.229] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG." [0047.229] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.wannacry" [0047.229] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0047.230] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x425 [0047.230] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x916cf600, dwHighDateTime=0x1bcabec), lpLastAccessTime=0x407536*(dwLowDateTime=0xeee42ef0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0x916cf600, dwHighDateTime=0x1bcabec)) returned 1 [0047.230] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0047.230] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3a7, lpOverlapped=0x0) returned 1 [0047.233] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned="MS.JPG" [0047.233] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0047.233] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3a7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3a7, lpOverlapped=0x0) returned 1 [0047.233] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0047.233] CloseHandle (hObject=0x8c) returned 1 [0047.235] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.wannacry")) returned 1 [0047.236] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x2000002, dwReserved1=0x2d5ed8, cFileName="MS.PNG", cAlternateFileName="")) returned 1 [0047.236] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.236] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MS.PNG") returned -1 [0047.236] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MS.PNG") returned -1 [0047.236] lstrcmpiA (lpString1="", lpString2="MS.PNG") returned -1 [0047.236] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned="MS.JPG" [0047.236] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0047.236] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0047.236] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" [0047.236] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20 [0047.236] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="MS.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" [0047.236] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.zip") returned 0 [0047.236] lstrlenA (lpString="*.zip") returned 5 [0047.236] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.rar") returned 0 [0047.236] lstrlenA (lpString="*.rar") returned 5 [0047.236] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.7z") returned 0 [0047.236] lstrlenA (lpString="*.7z") returned 4 [0047.236] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.tar") returned 0 [0047.236] lstrlenA (lpString="*.tar") returned 5 [0047.236] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.gzip") returned 0 [0047.237] lstrlenA (lpString="*.gzip") returned 6 [0047.237] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.jpg") returned 0 [0047.237] lstrlenA (lpString="*.jpg") returned 5 [0047.237] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.jpeg") returned 0 [0047.237] lstrlenA (lpString="*.jpeg") returned 6 [0047.237] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.psd") returned 0 [0047.237] lstrlenA (lpString="*.psd") returned 5 [0047.237] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.gif") returned 0 [0047.237] lstrlenA (lpString="*.gif") returned 5 [0047.237] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.doc") returned 0 [0047.237] lstrlenA (lpString="*.doc") returned 5 [0047.237] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.docx") returned 0 [0047.237] lstrlenA (lpString="*.docx") returned 6 [0047.237] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.xls") returned 0 [0047.237] lstrlenA (lpString="*.xls") returned 5 [0047.237] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.xlsx") returned 0 [0047.237] lstrlenA (lpString="*.xlsx") returned 6 [0047.237] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.ppt") returned 0 [0047.237] lstrlenA (lpString="*.ppt") returned 5 [0047.237] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.pptx") returned 0 [0047.237] lstrlenA (lpString="*.pptx") returned 6 [0047.237] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.pdf") returned 0 [0047.237] lstrlenA (lpString="*.pdf") returned 5 [0047.237] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.mov") returned 0 [0047.237] lstrlenA (lpString="*.mov") returned 5 [0047.237] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.m2v") returned 0 [0047.237] lstrlenA (lpString="*.m2v") returned 5 [0047.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.3gp") returned 0 [0047.238] lstrlenA (lpString="*.3gp") returned 5 [0047.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.mpeg") returned 0 [0047.238] lstrlenA (lpString="*.mpeg") returned 6 [0047.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.mpg") returned 0 [0047.238] lstrlenA (lpString="*.mpg") returned 5 [0047.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.flv") returned 0 [0047.238] lstrlenA (lpString="*.flv") returned 5 [0047.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.avi") returned 0 [0047.238] lstrlenA (lpString="*.avi") returned 5 [0047.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.mp4") returned 0 [0047.238] lstrlenA (lpString="*.mp4") returned 5 [0047.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.wmv") returned 0 [0047.238] lstrlenA (lpString="*.wmv") returned 5 [0047.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.divx") returned 0 [0047.238] lstrlenA (lpString="*.divx") returned 6 [0047.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.mkv") returned 0 [0047.238] lstrlenA (lpString="*.mkv") returned 5 [0047.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.mp3") returned 0 [0047.238] lstrlenA (lpString="*.mp3") returned 5 [0047.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.wav") returned 0 [0047.238] lstrlenA (lpString="*.wav") returned 5 [0047.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.flac") returned 0 [0047.238] lstrlenA (lpString="*.flac") returned 6 [0047.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.ape") returned 0 [0047.238] lstrlenA (lpString="*.ape") returned 5 [0047.238] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.wma") returned 0 [0047.238] lstrlenA (lpString="*.wma") returned 5 [0047.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.ac3") returned 0 [0047.239] lstrlenA (lpString="*.ac3") returned 5 [0047.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.mxf") returned 0 [0047.239] lstrlenA (lpString="*.mxf") returned 5 [0047.239] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WPG", cAlternateFileName="")) returned 1 [0047.239] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.239] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MS.WPG") returned -1 [0047.239] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MS.WPG") returned -1 [0047.239] lstrcmpiA (lpString1="", lpString2="MS.WPG") returned -1 [0047.239] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned="MS.PNG" [0047.239] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0047.239] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0047.239] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" [0047.239] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20 [0047.239] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="MS.WPG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" [0047.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.zip") returned 0 [0047.239] lstrlenA (lpString="*.zip") returned 5 [0047.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.rar") returned 0 [0047.239] lstrlenA (lpString="*.rar") returned 5 [0047.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.7z") returned 0 [0047.239] lstrlenA (lpString="*.7z") returned 4 [0047.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.tar") returned 0 [0047.239] lstrlenA (lpString="*.tar") returned 5 [0047.239] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.gzip") returned 0 [0047.239] lstrlenA (lpString="*.gzip") returned 6 [0047.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.jpg") returned 0 [0047.240] lstrlenA (lpString="*.jpg") returned 5 [0047.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.jpeg") returned 0 [0047.240] lstrlenA (lpString="*.jpeg") returned 6 [0047.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.psd") returned 0 [0047.240] lstrlenA (lpString="*.psd") returned 5 [0047.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.gif") returned 0 [0047.240] lstrlenA (lpString="*.gif") returned 5 [0047.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.doc") returned 0 [0047.240] lstrlenA (lpString="*.doc") returned 5 [0047.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.docx") returned 0 [0047.240] lstrlenA (lpString="*.docx") returned 6 [0047.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.xls") returned 0 [0047.240] lstrlenA (lpString="*.xls") returned 5 [0047.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.xlsx") returned 0 [0047.240] lstrlenA (lpString="*.xlsx") returned 6 [0047.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.ppt") returned 0 [0047.240] lstrlenA (lpString="*.ppt") returned 5 [0047.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.pptx") returned 0 [0047.240] lstrlenA (lpString="*.pptx") returned 6 [0047.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.pdf") returned 0 [0047.240] lstrlenA (lpString="*.pdf") returned 5 [0047.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mov") returned 0 [0047.240] lstrlenA (lpString="*.mov") returned 5 [0047.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.m2v") returned 0 [0047.240] lstrlenA (lpString="*.m2v") returned 5 [0047.240] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.3gp") returned 0 [0047.240] lstrlenA (lpString="*.3gp") returned 5 [0047.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mpeg") returned 0 [0047.241] lstrlenA (lpString="*.mpeg") returned 6 [0047.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mpg") returned 0 [0047.241] lstrlenA (lpString="*.mpg") returned 5 [0047.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.flv") returned 0 [0047.241] lstrlenA (lpString="*.flv") returned 5 [0047.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.avi") returned 0 [0047.241] lstrlenA (lpString="*.avi") returned 5 [0047.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mp4") returned 0 [0047.241] lstrlenA (lpString="*.mp4") returned 5 [0047.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.wmv") returned 0 [0047.241] lstrlenA (lpString="*.wmv") returned 5 [0047.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.divx") returned 0 [0047.241] lstrlenA (lpString="*.divx") returned 6 [0047.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mkv") returned 0 [0047.241] lstrlenA (lpString="*.mkv") returned 5 [0047.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mp3") returned 0 [0047.241] lstrlenA (lpString="*.mp3") returned 5 [0047.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.wav") returned 0 [0047.241] lstrlenA (lpString="*.wav") returned 5 [0047.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.flac") returned 0 [0047.241] lstrlenA (lpString="*.flac") returned 6 [0047.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.ape") returned 0 [0047.241] lstrlenA (lpString="*.ape") returned 5 [0047.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.wma") returned 0 [0047.241] lstrlenA (lpString="*.wma") returned 5 [0047.241] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.ac3") returned 0 [0047.241] lstrlenA (lpString="*.ac3") returned 5 [0047.242] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mxf") returned 0 [0047.242] lstrlenA (lpString="*.mxf") returned 5 [0047.242] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 1 [0047.242] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.242] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PICTIM32.FLT") returned -1 [0047.242] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PICTIM32.FLT") returned -1 [0047.242] lstrcmpiA (lpString1="", lpString2="PICTIM32.FLT") returned -1 [0047.242] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned="MS.WPG" [0047.242] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0047.242] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0047.242] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" [0047.242] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20 [0047.242] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="PICTIM32.FLT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" [0047.242] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.zip") returned 0 [0047.242] lstrlenA (lpString="*.zip") returned 5 [0047.242] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.rar") returned 0 [0047.242] lstrlenA (lpString="*.rar") returned 5 [0047.242] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.7z") returned 0 [0047.242] lstrlenA (lpString="*.7z") returned 4 [0047.242] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.tar") returned 0 [0047.242] lstrlenA (lpString="*.tar") returned 5 [0047.242] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.gzip") returned 0 [0047.242] lstrlenA (lpString="*.gzip") returned 6 [0047.242] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.jpg") returned 0 [0047.243] lstrlenA (lpString="*.jpg") returned 5 [0047.243] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.jpeg") returned 0 [0047.243] lstrlenA (lpString="*.jpeg") returned 6 [0047.243] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.psd") returned 0 [0047.243] lstrlenA (lpString="*.psd") returned 5 [0047.243] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.gif") returned 0 [0047.243] lstrlenA (lpString="*.gif") returned 5 [0047.243] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.doc") returned 0 [0047.243] lstrlenA (lpString="*.doc") returned 5 [0047.243] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.docx") returned 0 [0047.243] lstrlenA (lpString="*.docx") returned 6 [0047.243] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.xls") returned 0 [0047.243] lstrlenA (lpString="*.xls") returned 5 [0047.243] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.xlsx") returned 0 [0047.243] lstrlenA (lpString="*.xlsx") returned 6 [0047.243] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.ppt") returned 0 [0047.243] lstrlenA (lpString="*.ppt") returned 5 [0047.243] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.pptx") returned 0 [0047.243] lstrlenA (lpString="*.pptx") returned 6 [0047.243] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.pdf") returned 0 [0047.243] lstrlenA (lpString="*.pdf") returned 5 [0047.243] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mov") returned 0 [0047.243] lstrlenA (lpString="*.mov") returned 5 [0047.243] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.m2v") returned 0 [0047.243] lstrlenA (lpString="*.m2v") returned 5 [0047.243] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.3gp") returned 0 [0047.243] lstrlenA (lpString="*.3gp") returned 5 [0047.243] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mpeg") returned 0 [0047.244] lstrlenA (lpString="*.mpeg") returned 6 [0047.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mpg") returned 0 [0047.244] lstrlenA (lpString="*.mpg") returned 5 [0047.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.flv") returned 0 [0047.244] lstrlenA (lpString="*.flv") returned 5 [0047.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.avi") returned 0 [0047.244] lstrlenA (lpString="*.avi") returned 5 [0047.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mp4") returned 0 [0047.244] lstrlenA (lpString="*.mp4") returned 5 [0047.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.wmv") returned 0 [0047.244] lstrlenA (lpString="*.wmv") returned 5 [0047.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.divx") returned 0 [0047.244] lstrlenA (lpString="*.divx") returned 6 [0047.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mkv") returned 0 [0047.244] lstrlenA (lpString="*.mkv") returned 5 [0047.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mp3") returned 0 [0047.244] lstrlenA (lpString="*.mp3") returned 5 [0047.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.wav") returned 0 [0047.244] lstrlenA (lpString="*.wav") returned 5 [0047.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.flac") returned 0 [0047.244] lstrlenA (lpString="*.flac") returned 6 [0047.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.ape") returned 0 [0047.244] lstrlenA (lpString="*.ape") returned 5 [0047.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.wma") returned 0 [0047.244] lstrlenA (lpString="*.wma") returned 5 [0047.244] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.ac3") returned 0 [0047.244] lstrlenA (lpString="*.ac3") returned 5 [0047.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mxf") returned 0 [0047.245] lstrlenA (lpString="*.mxf") returned 5 [0047.245] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNG32.FLT", cAlternateFileName="")) returned 1 [0047.245] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.245] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PNG32.FLT") returned -1 [0047.245] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PNG32.FLT") returned -1 [0047.245] lstrcmpiA (lpString1="", lpString2="PNG32.FLT") returned -1 [0047.245] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned="PICTIM32.FLT" [0047.245] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0047.245] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0047.245] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" [0047.245] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20 [0047.245] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="PNG32.FLT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" [0047.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.zip") returned 0 [0047.245] lstrlenA (lpString="*.zip") returned 5 [0047.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.rar") returned 0 [0047.245] lstrlenA (lpString="*.rar") returned 5 [0047.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.7z") returned 0 [0047.245] lstrlenA (lpString="*.7z") returned 4 [0047.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.tar") returned 0 [0047.245] lstrlenA (lpString="*.tar") returned 5 [0047.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.gzip") returned 0 [0047.245] lstrlenA (lpString="*.gzip") returned 6 [0047.245] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.jpg") returned 0 [0047.246] lstrlenA (lpString="*.jpg") returned 5 [0047.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.jpeg") returned 0 [0047.246] lstrlenA (lpString="*.jpeg") returned 6 [0047.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.psd") returned 0 [0047.246] lstrlenA (lpString="*.psd") returned 5 [0047.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.gif") returned 0 [0047.246] lstrlenA (lpString="*.gif") returned 5 [0047.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.doc") returned 0 [0047.246] lstrlenA (lpString="*.doc") returned 5 [0047.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.docx") returned 0 [0047.246] lstrlenA (lpString="*.docx") returned 6 [0047.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.xls") returned 0 [0047.246] lstrlenA (lpString="*.xls") returned 5 [0047.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.xlsx") returned 0 [0047.246] lstrlenA (lpString="*.xlsx") returned 6 [0047.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.ppt") returned 0 [0047.246] lstrlenA (lpString="*.ppt") returned 5 [0047.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.pptx") returned 0 [0047.246] lstrlenA (lpString="*.pptx") returned 6 [0047.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.pdf") returned 0 [0047.246] lstrlenA (lpString="*.pdf") returned 5 [0047.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.mov") returned 0 [0047.246] lstrlenA (lpString="*.mov") returned 5 [0047.246] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.m2v") returned 0 [0047.247] lstrlenA (lpString="*.m2v") returned 5 [0047.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.3gp") returned 0 [0047.247] lstrlenA (lpString="*.3gp") returned 5 [0047.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.mpeg") returned 0 [0047.247] lstrlenA (lpString="*.mpeg") returned 6 [0047.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.mpg") returned 0 [0047.247] lstrlenA (lpString="*.mpg") returned 5 [0047.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.flv") returned 0 [0047.247] lstrlenA (lpString="*.flv") returned 5 [0047.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.avi") returned 0 [0047.247] lstrlenA (lpString="*.avi") returned 5 [0047.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.mp4") returned 0 [0047.247] lstrlenA (lpString="*.mp4") returned 5 [0047.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.wmv") returned 0 [0047.247] lstrlenA (lpString="*.wmv") returned 5 [0047.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.divx") returned 0 [0047.247] lstrlenA (lpString="*.divx") returned 6 [0047.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.mkv") returned 0 [0047.247] lstrlenA (lpString="*.mkv") returned 5 [0047.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.mp3") returned 0 [0047.247] lstrlenA (lpString="*.mp3") returned 5 [0047.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.wav") returned 0 [0047.247] lstrlenA (lpString="*.wav") returned 5 [0047.247] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.flac") returned 0 [0047.247] lstrlenA (lpString="*.flac") returned 6 [0047.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.ape") returned 0 [0047.248] lstrlenA (lpString="*.ape") returned 5 [0047.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.wma") returned 0 [0047.248] lstrlenA (lpString="*.wma") returned 5 [0047.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.ac3") returned 0 [0047.248] lstrlenA (lpString="*.ac3") returned 5 [0047.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.mxf") returned 0 [0047.248] lstrlenA (lpString="*.mxf") returned 5 [0047.248] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 1 [0047.248] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.248] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WPGIMP32.FLT") returned -1 [0047.248] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WPGIMP32.FLT") returned -1 [0047.248] lstrcmpiA (lpString1="", lpString2="WPGIMP32.FLT") returned -1 [0047.248] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned="PNG32.FLT" [0047.248] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" [0047.248] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned="" [0047.248] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" [0047.248] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\how to decrypt files.txt")) returned 0x20 [0047.248] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="WPGIMP32.FLT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" [0047.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.zip") returned 0 [0047.248] lstrlenA (lpString="*.zip") returned 5 [0047.248] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.rar") returned 0 [0047.248] lstrlenA (lpString="*.rar") returned 5 [0047.249] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.7z") returned 0 [0047.249] lstrlenA (lpString="*.7z") returned 4 [0047.249] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.tar") returned 0 [0047.249] lstrlenA (lpString="*.tar") returned 5 [0047.249] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.gzip") returned 0 [0047.249] lstrlenA (lpString="*.gzip") returned 6 [0047.249] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.jpg") returned 0 [0047.249] lstrlenA (lpString="*.jpg") returned 5 [0047.249] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.jpeg") returned 0 [0047.249] lstrlenA (lpString="*.jpeg") returned 6 [0047.249] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.psd") returned 0 [0047.249] lstrlenA (lpString="*.psd") returned 5 [0047.249] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.gif") returned 0 [0047.249] lstrlenA (lpString="*.gif") returned 5 [0047.249] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.doc") returned 0 [0047.249] lstrlenA (lpString="*.doc") returned 5 [0047.249] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.docx") returned 0 [0047.249] lstrlenA (lpString="*.docx") returned 6 [0047.249] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.xls") returned 0 [0047.249] lstrlenA (lpString="*.xls") returned 5 [0047.249] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.xlsx") returned 0 [0047.249] lstrlenA (lpString="*.xlsx") returned 6 [0047.249] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.ppt") returned 0 [0047.249] lstrlenA (lpString="*.ppt") returned 5 [0047.249] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.pptx") returned 0 [0047.249] lstrlenA (lpString="*.pptx") returned 6 [0047.249] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.pdf") returned 0 [0047.249] lstrlenA (lpString="*.pdf") returned 5 [0047.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.mov") returned 0 [0047.250] lstrlenA (lpString="*.mov") returned 5 [0047.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.m2v") returned 0 [0047.250] lstrlenA (lpString="*.m2v") returned 5 [0047.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.3gp") returned 0 [0047.250] lstrlenA (lpString="*.3gp") returned 5 [0047.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.mpeg") returned 0 [0047.250] lstrlenA (lpString="*.mpeg") returned 6 [0047.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.mpg") returned 0 [0047.250] lstrlenA (lpString="*.mpg") returned 5 [0047.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.flv") returned 0 [0047.250] lstrlenA (lpString="*.flv") returned 5 [0047.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.avi") returned 0 [0047.250] lstrlenA (lpString="*.avi") returned 5 [0047.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.mp4") returned 0 [0047.250] lstrlenA (lpString="*.mp4") returned 5 [0047.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.wmv") returned 0 [0047.250] lstrlenA (lpString="*.wmv") returned 5 [0047.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.divx") returned 0 [0047.250] lstrlenA (lpString="*.divx") returned 6 [0047.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.mkv") returned 0 [0047.250] lstrlenA (lpString="*.mkv") returned 5 [0047.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.mp3") returned 0 [0047.250] lstrlenA (lpString="*.mp3") returned 5 [0047.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.wav") returned 0 [0047.250] lstrlenA (lpString="*.wav") returned 5 [0047.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.flac") returned 0 [0047.250] lstrlenA (lpString="*.flac") returned 6 [0047.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.ape") returned 0 [0047.251] lstrlenA (lpString="*.ape") returned 5 [0047.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.wma") returned 0 [0047.251] lstrlenA (lpString="*.wma") returned 5 [0047.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.ac3") returned 0 [0047.251] lstrlenA (lpString="*.ac3") returned 5 [0047.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.mxf") returned 0 [0047.251] lstrlenA (lpString="*.mxf") returned 5 [0047.251] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 0 [0047.251] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.251] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Help", cAlternateFileName="")) returned 1 [0047.251] lstrcmpA (lpString1=".", lpString2="Help") returned -1 [0047.251] lstrcmpA (lpString1="..", lpString2="Help") returned -1 [0047.251] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0047.251] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="Help" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help" [0047.251] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help") returned 51 [0047.251] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d8068 [0047.253] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.253] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.253] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.253] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.253] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0047.253] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.253] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hxds.dll") returned -1 [0047.253] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hxds.dll") returned -1 [0047.253] lstrcmpiA (lpString1="", lpString2="hxds.dll") returned -1 [0047.253] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*") returned="*.*" [0047.253] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\" [0047.253] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\") returned="" [0047.253] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt" [0047.253] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\how to decrypt files.txt")) returned 0xffffffff [0047.253] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0047.254] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0047.254] WriteFile (in: hFile=0x8c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0047.255] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.255] CloseHandle (hObject=0x8c) returned 1 [0047.255] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", lpString2="hxds.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" [0047.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.zip") returned 0 [0047.256] lstrlenA (lpString="*.zip") returned 5 [0047.256] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.rar") returned 0 [0047.256] lstrlenA (lpString="*.rar") returned 5 [0047.256] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.7z") returned 0 [0047.256] lstrlenA (lpString="*.7z") returned 4 [0047.256] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.tar") returned 0 [0047.256] lstrlenA (lpString="*.tar") returned 5 [0047.256] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.gzip") returned 0 [0047.256] lstrlenA (lpString="*.gzip") returned 6 [0047.256] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.jpg") returned 0 [0047.256] lstrlenA (lpString="*.jpg") returned 5 [0047.256] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.jpeg") returned 0 [0047.256] lstrlenA (lpString="*.jpeg") returned 6 [0047.256] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.psd") returned 0 [0047.256] lstrlenA (lpString="*.psd") returned 5 [0047.256] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.gif") returned 0 [0047.256] lstrlenA (lpString="*.gif") returned 5 [0047.256] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.doc") returned 0 [0047.256] lstrlenA (lpString="*.doc") returned 5 [0047.256] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.docx") returned 0 [0047.256] lstrlenA (lpString="*.docx") returned 6 [0047.256] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.xls") returned 0 [0047.256] lstrlenA (lpString="*.xls") returned 5 [0047.256] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.xlsx") returned 0 [0047.256] lstrlenA (lpString="*.xlsx") returned 6 [0047.256] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.ppt") returned 0 [0047.256] lstrlenA (lpString="*.ppt") returned 5 [0047.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.pptx") returned 0 [0047.257] lstrlenA (lpString="*.pptx") returned 6 [0047.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.pdf") returned 0 [0047.257] lstrlenA (lpString="*.pdf") returned 5 [0047.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.mov") returned 0 [0047.257] lstrlenA (lpString="*.mov") returned 5 [0047.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.m2v") returned 0 [0047.257] lstrlenA (lpString="*.m2v") returned 5 [0047.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.3gp") returned 0 [0047.257] lstrlenA (lpString="*.3gp") returned 5 [0047.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.mpeg") returned 0 [0047.257] lstrlenA (lpString="*.mpeg") returned 6 [0047.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.mpg") returned 0 [0047.257] lstrlenA (lpString="*.mpg") returned 5 [0047.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.flv") returned 0 [0047.257] lstrlenA (lpString="*.flv") returned 5 [0047.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.avi") returned 0 [0047.257] lstrlenA (lpString="*.avi") returned 5 [0047.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.mp4") returned 0 [0047.257] lstrlenA (lpString="*.mp4") returned 5 [0047.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.wmv") returned 0 [0047.258] lstrlenA (lpString="*.wmv") returned 5 [0047.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.divx") returned 0 [0047.258] lstrlenA (lpString="*.divx") returned 6 [0047.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.mkv") returned 0 [0047.258] lstrlenA (lpString="*.mkv") returned 5 [0047.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.mp3") returned 0 [0047.258] lstrlenA (lpString="*.mp3") returned 5 [0047.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.wav") returned 0 [0047.258] lstrlenA (lpString="*.wav") returned 5 [0047.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.flac") returned 0 [0047.258] lstrlenA (lpString="*.flac") returned 6 [0047.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.ape") returned 0 [0047.258] lstrlenA (lpString="*.ape") returned 5 [0047.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.wma") returned 0 [0047.258] lstrlenA (lpString="*.wma") returned 5 [0047.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.ac3") returned 0 [0047.258] lstrlenA (lpString="*.ac3") returned 5 [0047.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.mxf") returned 0 [0047.258] lstrlenA (lpString="*.mxf") returned 5 [0047.258] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0x0, dwReserved1=0x2d8378, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1 [0047.258] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.258] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ITIRCL55.DLL") returned -1 [0047.258] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ITIRCL55.DLL") returned -1 [0047.258] lstrcmpiA (lpString1="", lpString2="ITIRCL55.DLL") returned -1 [0047.258] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned="hxds.dll" [0047.259] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\" [0047.259] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\") returned="" [0047.259] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt" [0047.259] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\how to decrypt files.txt")) returned 0x20 [0047.259] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", lpString2="ITIRCL55.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" [0047.259] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.zip") returned 0 [0047.259] lstrlenA (lpString="*.zip") returned 5 [0047.259] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.rar") returned 0 [0047.259] lstrlenA (lpString="*.rar") returned 5 [0047.259] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.7z") returned 0 [0047.259] lstrlenA (lpString="*.7z") returned 4 [0047.259] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.tar") returned 0 [0047.259] lstrlenA (lpString="*.tar") returned 5 [0047.259] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.gzip") returned 0 [0047.259] lstrlenA (lpString="*.gzip") returned 6 [0047.259] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.jpg") returned 0 [0047.259] lstrlenA (lpString="*.jpg") returned 5 [0047.259] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.jpeg") returned 0 [0047.259] lstrlenA (lpString="*.jpeg") returned 6 [0047.259] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.psd") returned 0 [0047.259] lstrlenA (lpString="*.psd") returned 5 [0047.259] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.gif") returned 0 [0047.259] lstrlenA (lpString="*.gif") returned 5 [0047.259] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.doc") returned 0 [0047.260] lstrlenA (lpString="*.doc") returned 5 [0047.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.docx") returned 0 [0047.260] lstrlenA (lpString="*.docx") returned 6 [0047.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.xls") returned 0 [0047.260] lstrlenA (lpString="*.xls") returned 5 [0047.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.xlsx") returned 0 [0047.260] lstrlenA (lpString="*.xlsx") returned 6 [0047.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.ppt") returned 0 [0047.260] lstrlenA (lpString="*.ppt") returned 5 [0047.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.pptx") returned 0 [0047.260] lstrlenA (lpString="*.pptx") returned 6 [0047.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.pdf") returned 0 [0047.260] lstrlenA (lpString="*.pdf") returned 5 [0047.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.mov") returned 0 [0047.260] lstrlenA (lpString="*.mov") returned 5 [0047.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.m2v") returned 0 [0047.260] lstrlenA (lpString="*.m2v") returned 5 [0047.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.3gp") returned 0 [0047.260] lstrlenA (lpString="*.3gp") returned 5 [0047.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.mpeg") returned 0 [0047.260] lstrlenA (lpString="*.mpeg") returned 6 [0047.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.mpg") returned 0 [0047.260] lstrlenA (lpString="*.mpg") returned 5 [0047.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.flv") returned 0 [0047.260] lstrlenA (lpString="*.flv") returned 5 [0047.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.avi") returned 0 [0047.260] lstrlenA (lpString="*.avi") returned 5 [0047.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.mp4") returned 0 [0047.261] lstrlenA (lpString="*.mp4") returned 5 [0047.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.wmv") returned 0 [0047.261] lstrlenA (lpString="*.wmv") returned 5 [0047.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.divx") returned 0 [0047.261] lstrlenA (lpString="*.divx") returned 6 [0047.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.mkv") returned 0 [0047.261] lstrlenA (lpString="*.mkv") returned 5 [0047.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.mp3") returned 0 [0047.261] lstrlenA (lpString="*.mp3") returned 5 [0047.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.wav") returned 0 [0047.261] lstrlenA (lpString="*.wav") returned 5 [0047.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.flac") returned 0 [0047.261] lstrlenA (lpString="*.flac") returned 6 [0047.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.ape") returned 0 [0047.261] lstrlenA (lpString="*.ape") returned 5 [0047.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.wma") returned 0 [0047.261] lstrlenA (lpString="*.wma") returned 5 [0047.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.ac3") returned 0 [0047.261] lstrlenA (lpString="*.ac3") returned 5 [0047.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", pszSpec="*.mxf") returned 0 [0047.261] lstrlenA (lpString="*.mxf") returned 5 [0047.261] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 1 [0047.261] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.261] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msitss55.dll") returned -1 [0047.261] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msitss55.dll") returned -1 [0047.261] lstrcmpiA (lpString1="", lpString2="msitss55.dll") returned -1 [0047.262] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned="ITIRCL55.DLL" [0047.262] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\" [0047.262] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\") returned="" [0047.262] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt" [0047.262] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\how to decrypt files.txt")) returned 0x20 [0047.262] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", lpString2="msitss55.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" [0047.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.zip") returned 0 [0047.262] lstrlenA (lpString="*.zip") returned 5 [0047.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.rar") returned 0 [0047.262] lstrlenA (lpString="*.rar") returned 5 [0047.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.7z") returned 0 [0047.262] lstrlenA (lpString="*.7z") returned 4 [0047.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.tar") returned 0 [0047.262] lstrlenA (lpString="*.tar") returned 5 [0047.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.gzip") returned 0 [0047.262] lstrlenA (lpString="*.gzip") returned 6 [0047.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.jpg") returned 0 [0047.262] lstrlenA (lpString="*.jpg") returned 5 [0047.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.jpeg") returned 0 [0047.263] lstrlenA (lpString="*.jpeg") returned 6 [0047.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.psd") returned 0 [0047.263] lstrlenA (lpString="*.psd") returned 5 [0047.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.gif") returned 0 [0047.263] lstrlenA (lpString="*.gif") returned 5 [0047.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.doc") returned 0 [0047.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.docx") returned 0 [0047.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.xls") returned 0 [0047.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.xlsx") returned 0 [0047.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.ppt") returned 0 [0047.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.pptx") returned 0 [0047.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.pdf") returned 0 [0047.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.mov") returned 0 [0047.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.m2v") returned 0 [0047.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.3gp") returned 0 [0047.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.mpeg") returned 0 [0047.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.mpg") returned 0 [0047.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.flv") returned 0 [0047.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.avi") returned 0 [0047.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.mp4") returned 0 [0047.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.wmv") returned 0 [0047.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.divx") returned 0 [0047.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.mkv") returned 0 [0047.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.mp3") returned 0 [0047.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.wav") returned 0 [0047.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.flac") returned 0 [0047.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.ape") returned 0 [0047.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.wma") returned 0 [0047.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.ac3") returned 0 [0047.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", pszSpec="*.mxf") returned 0 [0047.265] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 0 [0047.265] FindClose (in: hFindFile=0x2d8068 | out: hFindFile=0x2d8068) returned 1 [0047.265] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ink", cAlternateFileName="")) returned 1 [0047.265] lstrcmpA (lpString1=".", lpString2="ink") returned -1 [0047.265] lstrcmpA (lpString1="..", lpString2="ink") returned -1 [0047.265] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0047.265] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="ink" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink" [0047.265] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d8068 [0047.265] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.265] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.265] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.266] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.266] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0047.266] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.266] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Alphabet.xml") returned 1 [0047.266] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Alphabet.xml") returned 1 [0047.266] lstrcmpiA (lpString1="", lpString2="Alphabet.xml") returned -1 [0047.266] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.266] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.266] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.266] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.266] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0xffffffff [0047.266] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0047.268] WriteFile (in: hFile=0x8c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0047.269] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.269] CloseHandle (hObject=0x8c) returned 1 [0047.270] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="Alphabet.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" [0047.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.zip") returned 0 [0047.270] lstrlenA (lpString="*.zip") returned 5 [0047.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.rar") returned 0 [0047.270] lstrlenA (lpString="*.rar") returned 5 [0047.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.7z") returned 0 [0047.270] lstrlenA (lpString="*.7z") returned 4 [0047.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.tar") returned 0 [0047.270] lstrlenA (lpString="*.tar") returned 5 [0047.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.gzip") returned 0 [0047.270] lstrlenA (lpString="*.gzip") returned 6 [0047.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.jpg") returned 0 [0047.270] lstrlenA (lpString="*.jpg") returned 5 [0047.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.jpeg") returned 0 [0047.270] lstrlenA (lpString="*.jpeg") returned 6 [0047.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.psd") returned 0 [0047.270] lstrlenA (lpString="*.psd") returned 5 [0047.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.gif") returned 0 [0047.270] lstrlenA (lpString="*.gif") returned 5 [0047.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.doc") returned 0 [0047.270] lstrlenA (lpString="*.doc") returned 5 [0047.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.docx") returned 0 [0047.270] lstrlenA (lpString="*.docx") returned 6 [0047.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.xls") returned 0 [0047.271] lstrlenA (lpString="*.xls") returned 5 [0047.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.xlsx") returned 0 [0047.271] lstrlenA (lpString="*.xlsx") returned 6 [0047.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.ppt") returned 0 [0047.271] lstrlenA (lpString="*.ppt") returned 5 [0047.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.pptx") returned 0 [0047.271] lstrlenA (lpString="*.pptx") returned 6 [0047.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.pdf") returned 0 [0047.271] lstrlenA (lpString="*.pdf") returned 5 [0047.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.mov") returned 0 [0047.271] lstrlenA (lpString="*.mov") returned 5 [0047.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.m2v") returned 0 [0047.271] lstrlenA (lpString="*.m2v") returned 5 [0047.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.3gp") returned 0 [0047.271] lstrlenA (lpString="*.3gp") returned 5 [0047.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.mpeg") returned 0 [0047.271] lstrlenA (lpString="*.mpeg") returned 6 [0047.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.mpg") returned 0 [0047.271] lstrlenA (lpString="*.mpg") returned 5 [0047.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.flv") returned 0 [0047.271] lstrlenA (lpString="*.flv") returned 5 [0047.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.avi") returned 0 [0047.271] lstrlenA (lpString="*.avi") returned 5 [0047.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.mp4") returned 0 [0047.271] lstrlenA (lpString="*.mp4") returned 5 [0047.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.wmv") returned 0 [0047.272] lstrlenA (lpString="*.wmv") returned 5 [0047.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.divx") returned 0 [0047.272] lstrlenA (lpString="*.divx") returned 6 [0047.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.mkv") returned 0 [0047.272] lstrlenA (lpString="*.mkv") returned 5 [0047.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.mp3") returned 0 [0047.272] lstrlenA (lpString="*.mp3") returned 5 [0047.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.wav") returned 0 [0047.272] lstrlenA (lpString="*.wav") returned 5 [0047.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.flac") returned 0 [0047.272] lstrlenA (lpString="*.flac") returned 6 [0047.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.ape") returned 0 [0047.272] lstrlenA (lpString="*.ape") returned 5 [0047.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.wma") returned 0 [0047.272] lstrlenA (lpString="*.wma") returned 5 [0047.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.ac3") returned 0 [0047.272] lstrlenA (lpString="*.ac3") returned 5 [0047.272] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", pszSpec="*.mxf") returned 0 [0047.272] lstrlenA (lpString="*.mxf") returned 5 [0047.272] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8370, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0047.272] lstrcmpA (lpString1=".", lpString2="ar-SA") returned -1 [0047.272] lstrcmpA (lpString1="..", lpString2="ar-SA") returned -1 [0047.272] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned="Alphabet.xml" [0047.272] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ar-SA" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA" [0047.273] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA") returned 56 [0047.273] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d813e, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.274] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.274] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.274] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.274] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.274] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.274] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.274] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0047.274] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0047.274] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0047.274] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*") returned="*.*" [0047.274] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\" [0047.274] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\") returned="" [0047.274] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\HOW TO DECRYPT FILES.txt" [0047.274] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\how to decrypt files.txt")) returned 0xffffffff [0047.275] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.276] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0047.276] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0047.278] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.278] CloseHandle (hObject=0x90) returned 1 [0047.278] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" [0047.278] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0047.278] lstrlenA (lpString="*.zip") returned 5 [0047.278] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0047.278] lstrlenA (lpString="*.rar") returned 5 [0047.278] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0047.278] lstrlenA (lpString="*.7z") returned 4 [0047.279] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0047.279] lstrlenA (lpString="*.tar") returned 5 [0047.279] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0047.279] lstrlenA (lpString="*.gzip") returned 6 [0047.279] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0047.279] lstrlenA (lpString="*.jpg") returned 5 [0047.279] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0047.279] lstrlenA (lpString="*.jpeg") returned 6 [0047.279] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0047.279] lstrlenA (lpString="*.psd") returned 5 [0047.279] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0047.279] lstrlenA (lpString="*.gif") returned 5 [0047.279] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0047.279] lstrlenA (lpString="*.doc") returned 5 [0047.279] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0047.279] lstrlenA (lpString="*.docx") returned 6 [0047.279] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0047.279] lstrlenA (lpString="*.xls") returned 5 [0047.279] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0047.279] lstrlenA (lpString="*.xlsx") returned 6 [0047.279] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0047.279] lstrlenA (lpString="*.ppt") returned 5 [0047.279] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0047.279] lstrlenA (lpString="*.pptx") returned 6 [0047.279] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0047.279] lstrlenA (lpString="*.pdf") returned 5 [0047.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0047.280] lstrlenA (lpString="*.mov") returned 5 [0047.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0047.280] lstrlenA (lpString="*.m2v") returned 5 [0047.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0047.280] lstrlenA (lpString="*.3gp") returned 5 [0047.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0047.280] lstrlenA (lpString="*.mpeg") returned 6 [0047.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0047.280] lstrlenA (lpString="*.mpg") returned 5 [0047.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0047.280] lstrlenA (lpString="*.flv") returned 5 [0047.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0047.280] lstrlenA (lpString="*.avi") returned 5 [0047.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0047.280] lstrlenA (lpString="*.mp4") returned 5 [0047.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0047.280] lstrlenA (lpString="*.wmv") returned 5 [0047.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0047.280] lstrlenA (lpString="*.divx") returned 6 [0047.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0047.280] lstrlenA (lpString="*.mkv") returned 5 [0047.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0047.280] lstrlenA (lpString="*.mp3") returned 5 [0047.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0047.280] lstrlenA (lpString="*.wav") returned 5 [0047.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0047.281] lstrlenA (lpString="*.flac") returned 6 [0047.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0047.281] lstrlenA (lpString="*.ape") returned 5 [0047.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0047.281] lstrlenA (lpString="*.wma") returned 5 [0047.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0047.281] lstrlenA (lpString="*.ac3") returned 5 [0047.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", pszSpec="*.mxf") returned 0 [0047.281] lstrlenA (lpString="*.mxf") returned 5 [0047.281] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.281] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.281] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0047.281] lstrcmpA (lpString1=".", lpString2="bg-BG") returned -1 [0047.281] lstrcmpA (lpString1="..", lpString2="bg-BG") returned -1 [0047.281] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.281] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="bg-BG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG" [0047.281] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG") returned 56 [0047.281] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8380, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.282] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.282] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.282] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.282] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.282] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.282] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.282] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0047.282] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0047.282] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0047.282] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*") returned="*.*" [0047.282] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\" [0047.282] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\") returned="" [0047.283] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\HOW TO DECRYPT FILES.txt" [0047.283] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\how to decrypt files.txt")) returned 0xffffffff [0047.283] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.283] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0047.283] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0047.284] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.284] CloseHandle (hObject=0x90) returned 1 [0047.285] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" [0047.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0047.285] lstrlenA (lpString="*.zip") returned 5 [0047.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0047.285] lstrlenA (lpString="*.rar") returned 5 [0047.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0047.285] lstrlenA (lpString="*.7z") returned 4 [0047.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0047.285] lstrlenA (lpString="*.tar") returned 5 [0047.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0047.285] lstrlenA (lpString="*.gzip") returned 6 [0047.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0047.285] lstrlenA (lpString="*.jpg") returned 5 [0047.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0047.285] lstrlenA (lpString="*.jpeg") returned 6 [0047.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0047.285] lstrlenA (lpString="*.psd") returned 5 [0047.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0047.285] lstrlenA (lpString="*.gif") returned 5 [0047.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0047.285] lstrlenA (lpString="*.doc") returned 5 [0047.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0047.285] lstrlenA (lpString="*.docx") returned 6 [0047.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0047.285] lstrlenA (lpString="*.xls") returned 5 [0047.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0047.286] lstrlenA (lpString="*.xlsx") returned 6 [0047.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0047.286] lstrlenA (lpString="*.ppt") returned 5 [0047.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0047.286] lstrlenA (lpString="*.pptx") returned 6 [0047.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0047.286] lstrlenA (lpString="*.pdf") returned 5 [0047.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0047.286] lstrlenA (lpString="*.mov") returned 5 [0047.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0047.286] lstrlenA (lpString="*.m2v") returned 5 [0047.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0047.286] lstrlenA (lpString="*.3gp") returned 5 [0047.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0047.286] lstrlenA (lpString="*.mpeg") returned 6 [0047.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0047.286] lstrlenA (lpString="*.mpg") returned 5 [0047.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0047.286] lstrlenA (lpString="*.flv") returned 5 [0047.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0047.286] lstrlenA (lpString="*.avi") returned 5 [0047.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0047.286] lstrlenA (lpString="*.mp4") returned 5 [0047.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0047.286] lstrlenA (lpString="*.wmv") returned 5 [0047.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0047.286] lstrlenA (lpString="*.divx") returned 6 [0047.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0047.286] lstrlenA (lpString="*.mkv") returned 5 [0047.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0047.286] lstrlenA (lpString="*.mp3") returned 5 [0047.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0047.287] lstrlenA (lpString="*.wav") returned 5 [0047.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0047.287] lstrlenA (lpString="*.flac") returned 6 [0047.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0047.287] lstrlenA (lpString="*.ape") returned 5 [0047.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0047.287] lstrlenA (lpString="*.wma") returned 5 [0047.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0047.287] lstrlenA (lpString="*.ac3") returned 5 [0047.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", pszSpec="*.mxf") returned 0 [0047.287] lstrlenA (lpString="*.mxf") returned 5 [0047.287] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.287] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.287] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0047.287] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.287] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Content.xml") returned 1 [0047.287] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Content.xml") returned 1 [0047.287] lstrcmpiA (lpString1="", lpString2="Content.xml") returned -1 [0047.287] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.287] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.287] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.287] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.287] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.287] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="Content.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" [0047.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.zip") returned 0 [0047.288] lstrlenA (lpString="*.zip") returned 5 [0047.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.rar") returned 0 [0047.288] lstrlenA (lpString="*.rar") returned 5 [0047.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.7z") returned 0 [0047.288] lstrlenA (lpString="*.7z") returned 4 [0047.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.tar") returned 0 [0047.288] lstrlenA (lpString="*.tar") returned 5 [0047.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.gzip") returned 0 [0047.288] lstrlenA (lpString="*.gzip") returned 6 [0047.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.jpg") returned 0 [0047.288] lstrlenA (lpString="*.jpg") returned 5 [0047.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.jpeg") returned 0 [0047.288] lstrlenA (lpString="*.jpeg") returned 6 [0047.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.psd") returned 0 [0047.288] lstrlenA (lpString="*.psd") returned 5 [0047.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.gif") returned 0 [0047.288] lstrlenA (lpString="*.gif") returned 5 [0047.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.doc") returned 0 [0047.288] lstrlenA (lpString="*.doc") returned 5 [0047.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.docx") returned 0 [0047.288] lstrlenA (lpString="*.docx") returned 6 [0047.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.xls") returned 0 [0047.288] lstrlenA (lpString="*.xls") returned 5 [0047.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.xlsx") returned 0 [0047.288] lstrlenA (lpString="*.xlsx") returned 6 [0047.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.ppt") returned 0 [0047.289] lstrlenA (lpString="*.ppt") returned 5 [0047.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.pptx") returned 0 [0047.289] lstrlenA (lpString="*.pptx") returned 6 [0047.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.pdf") returned 0 [0047.289] lstrlenA (lpString="*.pdf") returned 5 [0047.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.mov") returned 0 [0047.289] lstrlenA (lpString="*.mov") returned 5 [0047.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.m2v") returned 0 [0047.289] lstrlenA (lpString="*.m2v") returned 5 [0047.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.3gp") returned 0 [0047.289] lstrlenA (lpString="*.3gp") returned 5 [0047.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.mpeg") returned 0 [0047.289] lstrlenA (lpString="*.mpeg") returned 6 [0047.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.mpg") returned 0 [0047.289] lstrlenA (lpString="*.mpg") returned 5 [0047.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.flv") returned 0 [0047.289] lstrlenA (lpString="*.flv") returned 5 [0047.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.avi") returned 0 [0047.289] lstrlenA (lpString="*.avi") returned 5 [0047.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.mp4") returned 0 [0047.289] lstrlenA (lpString="*.mp4") returned 5 [0047.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.wmv") returned 0 [0047.289] lstrlenA (lpString="*.wmv") returned 5 [0047.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.divx") returned 0 [0047.289] lstrlenA (lpString="*.divx") returned 6 [0047.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.mkv") returned 0 [0047.289] lstrlenA (lpString="*.mkv") returned 5 [0047.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.mp3") returned 0 [0047.290] lstrlenA (lpString="*.mp3") returned 5 [0047.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.wav") returned 0 [0047.290] lstrlenA (lpString="*.wav") returned 5 [0047.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.flac") returned 0 [0047.290] lstrlenA (lpString="*.flac") returned 6 [0047.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.ape") returned 0 [0047.290] lstrlenA (lpString="*.ape") returned 5 [0047.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.wma") returned 0 [0047.290] lstrlenA (lpString="*.wma") returned 5 [0047.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.ac3") returned 0 [0047.290] lstrlenA (lpString="*.ac3") returned 5 [0047.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", pszSpec="*.mxf") returned 0 [0047.290] lstrlenA (lpString="*.mxf") returned 5 [0047.290] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0047.290] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.290] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ConvertInkStore.exe") returned 1 [0047.290] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ConvertInkStore.exe") returned 1 [0047.290] lstrcmpiA (lpString1="", lpString2="ConvertInkStore.exe") returned -1 [0047.290] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned="Content.xml" [0047.290] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.290] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.290] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.290] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.291] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ConvertInkStore.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" [0047.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.zip") returned 0 [0047.291] lstrlenA (lpString="*.zip") returned 5 [0047.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.rar") returned 0 [0047.291] lstrlenA (lpString="*.rar") returned 5 [0047.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.7z") returned 0 [0047.291] lstrlenA (lpString="*.7z") returned 4 [0047.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.tar") returned 0 [0047.291] lstrlenA (lpString="*.tar") returned 5 [0047.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.gzip") returned 0 [0047.291] lstrlenA (lpString="*.gzip") returned 6 [0047.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.jpg") returned 0 [0047.291] lstrlenA (lpString="*.jpg") returned 5 [0047.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.jpeg") returned 0 [0047.291] lstrlenA (lpString="*.jpeg") returned 6 [0047.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.psd") returned 0 [0047.291] lstrlenA (lpString="*.psd") returned 5 [0047.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.gif") returned 0 [0047.291] lstrlenA (lpString="*.gif") returned 5 [0047.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.doc") returned 0 [0047.291] lstrlenA (lpString="*.doc") returned 5 [0047.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.docx") returned 0 [0047.291] lstrlenA (lpString="*.docx") returned 6 [0047.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.xls") returned 0 [0047.292] lstrlenA (lpString="*.xls") returned 5 [0047.292] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.xlsx") returned 0 [0047.292] lstrlenA (lpString="*.xlsx") returned 6 [0047.292] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.ppt") returned 0 [0047.292] lstrlenA (lpString="*.ppt") returned 5 [0047.292] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.pptx") returned 0 [0047.292] lstrlenA (lpString="*.pptx") returned 6 [0047.292] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.pdf") returned 0 [0047.292] lstrlenA (lpString="*.pdf") returned 5 [0047.292] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.mov") returned 0 [0047.292] lstrlenA (lpString="*.mov") returned 5 [0047.292] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.m2v") returned 0 [0047.292] lstrlenA (lpString="*.m2v") returned 5 [0047.292] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.3gp") returned 0 [0047.292] lstrlenA (lpString="*.3gp") returned 5 [0047.292] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.mpeg") returned 0 [0047.292] lstrlenA (lpString="*.mpeg") returned 6 [0047.292] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.mpg") returned 0 [0047.292] lstrlenA (lpString="*.mpg") returned 5 [0047.292] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.flv") returned 0 [0047.292] lstrlenA (lpString="*.flv") returned 5 [0047.292] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.avi") returned 0 [0047.292] lstrlenA (lpString="*.avi") returned 5 [0047.292] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.mp4") returned 0 [0047.292] lstrlenA (lpString="*.mp4") returned 5 [0047.292] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.wmv") returned 0 [0047.293] lstrlenA (lpString="*.wmv") returned 5 [0047.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.divx") returned 0 [0047.293] lstrlenA (lpString="*.divx") returned 6 [0047.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.mkv") returned 0 [0047.293] lstrlenA (lpString="*.mkv") returned 5 [0047.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.mp3") returned 0 [0047.293] lstrlenA (lpString="*.mp3") returned 5 [0047.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.wav") returned 0 [0047.293] lstrlenA (lpString="*.wav") returned 5 [0047.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.flac") returned 0 [0047.293] lstrlenA (lpString="*.flac") returned 6 [0047.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.ape") returned 0 [0047.293] lstrlenA (lpString="*.ape") returned 5 [0047.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.wma") returned 0 [0047.293] lstrlenA (lpString="*.wma") returned 5 [0047.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.ac3") returned 0 [0047.293] lstrlenA (lpString="*.ac3") returned 5 [0047.293] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", pszSpec="*.mxf") returned 0 [0047.293] lstrlenA (lpString="*.mxf") returned 5 [0047.293] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0047.293] lstrcmpA (lpString1=".", lpString2="cs-CZ") returned -1 [0047.293] lstrcmpA (lpString1="..", lpString2="cs-CZ") returned -1 [0047.293] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned="ConvertInkStore.exe" [0047.293] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="cs-CZ" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ" [0047.293] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ") returned 56 [0047.294] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d813e, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.294] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.294] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.294] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.294] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.295] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.295] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.295] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0047.295] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0047.295] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0047.295] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*") returned="*.*" [0047.295] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\" [0047.295] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\") returned="" [0047.295] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\HOW TO DECRYPT FILES.txt" [0047.295] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\how to decrypt files.txt")) returned 0xffffffff [0047.295] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.295] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0047.295] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0047.297] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.297] CloseHandle (hObject=0x90) returned 1 [0047.297] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" [0047.297] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0047.297] lstrlenA (lpString="*.zip") returned 5 [0047.297] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0047.297] lstrlenA (lpString="*.rar") returned 5 [0047.297] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0047.297] lstrlenA (lpString="*.7z") returned 4 [0047.297] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0047.297] lstrlenA (lpString="*.tar") returned 5 [0047.297] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0047.297] lstrlenA (lpString="*.gzip") returned 6 [0047.297] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0047.297] lstrlenA (lpString="*.jpg") returned 5 [0047.297] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0047.297] lstrlenA (lpString="*.jpeg") returned 6 [0047.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0047.298] lstrlenA (lpString="*.psd") returned 5 [0047.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0047.298] lstrlenA (lpString="*.gif") returned 5 [0047.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0047.298] lstrlenA (lpString="*.doc") returned 5 [0047.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0047.298] lstrlenA (lpString="*.docx") returned 6 [0047.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0047.298] lstrlenA (lpString="*.xls") returned 5 [0047.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0047.298] lstrlenA (lpString="*.xlsx") returned 6 [0047.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0047.298] lstrlenA (lpString="*.ppt") returned 5 [0047.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0047.298] lstrlenA (lpString="*.pptx") returned 6 [0047.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0047.298] lstrlenA (lpString="*.pdf") returned 5 [0047.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0047.298] lstrlenA (lpString="*.mov") returned 5 [0047.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0047.298] lstrlenA (lpString="*.m2v") returned 5 [0047.299] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0047.299] lstrlenA (lpString="*.3gp") returned 5 [0047.299] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0047.299] lstrlenA (lpString="*.mpeg") returned 6 [0047.299] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0047.299] lstrlenA (lpString="*.mpg") returned 5 [0047.299] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0047.299] lstrlenA (lpString="*.flv") returned 5 [0047.299] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0047.299] lstrlenA (lpString="*.avi") returned 5 [0047.299] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0047.299] lstrlenA (lpString="*.mp4") returned 5 [0047.299] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0047.299] lstrlenA (lpString="*.wmv") returned 5 [0047.299] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0047.299] lstrlenA (lpString="*.divx") returned 6 [0047.299] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0047.299] lstrlenA (lpString="*.mkv") returned 5 [0047.299] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0047.299] lstrlenA (lpString="*.mp3") returned 5 [0047.299] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0047.299] lstrlenA (lpString="*.wav") returned 5 [0047.299] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0047.299] lstrlenA (lpString="*.flac") returned 6 [0047.299] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0047.299] lstrlenA (lpString="*.ape") returned 5 [0047.300] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0047.300] lstrlenA (lpString="*.wma") returned 5 [0047.300] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0047.300] lstrlenA (lpString="*.ac3") returned 5 [0047.300] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", pszSpec="*.mxf") returned 0 [0047.300] lstrlenA (lpString="*.mxf") returned 5 [0047.300] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.300] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.300] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="da-DK", cAlternateFileName="")) returned 1 [0047.300] lstrcmpA (lpString1=".", lpString2="da-DK") returned -1 [0047.300] lstrcmpA (lpString1="..", lpString2="da-DK") returned -1 [0047.300] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.300] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="da-DK" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK" [0047.300] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK") returned 56 [0047.300] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8380, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.301] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.301] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.301] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.301] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.301] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.301] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.301] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0047.301] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0047.301] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0047.301] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*") returned="*.*" [0047.301] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\" [0047.301] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\") returned="" [0047.301] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\HOW TO DECRYPT FILES.txt" [0047.301] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\how to decrypt files.txt")) returned 0xffffffff [0047.301] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.303] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0047.303] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0047.304] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.304] CloseHandle (hObject=0x90) returned 1 [0047.304] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" [0047.304] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0047.304] lstrlenA (lpString="*.zip") returned 5 [0047.304] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0047.304] lstrlenA (lpString="*.rar") returned 5 [0047.304] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0047.305] lstrlenA (lpString="*.7z") returned 4 [0047.305] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0047.305] lstrlenA (lpString="*.tar") returned 5 [0047.305] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0047.305] lstrlenA (lpString="*.gzip") returned 6 [0047.305] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0047.305] lstrlenA (lpString="*.jpg") returned 5 [0047.305] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0047.305] lstrlenA (lpString="*.jpeg") returned 6 [0047.305] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0047.305] lstrlenA (lpString="*.psd") returned 5 [0047.305] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0047.305] lstrlenA (lpString="*.gif") returned 5 [0047.305] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0047.305] lstrlenA (lpString="*.doc") returned 5 [0047.305] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0047.305] lstrlenA (lpString="*.docx") returned 6 [0047.305] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0047.305] lstrlenA (lpString="*.xls") returned 5 [0047.305] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0047.305] lstrlenA (lpString="*.xlsx") returned 6 [0047.305] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0047.305] lstrlenA (lpString="*.ppt") returned 5 [0047.305] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0047.305] lstrlenA (lpString="*.pptx") returned 6 [0047.305] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0047.305] lstrlenA (lpString="*.pdf") returned 5 [0047.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0047.306] lstrlenA (lpString="*.mov") returned 5 [0047.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0047.306] lstrlenA (lpString="*.m2v") returned 5 [0047.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0047.306] lstrlenA (lpString="*.3gp") returned 5 [0047.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0047.306] lstrlenA (lpString="*.mpeg") returned 6 [0047.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0047.306] lstrlenA (lpString="*.mpg") returned 5 [0047.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0047.306] lstrlenA (lpString="*.flv") returned 5 [0047.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0047.306] lstrlenA (lpString="*.avi") returned 5 [0047.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0047.306] lstrlenA (lpString="*.mp4") returned 5 [0047.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0047.306] lstrlenA (lpString="*.wmv") returned 5 [0047.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0047.306] lstrlenA (lpString="*.divx") returned 6 [0047.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0047.306] lstrlenA (lpString="*.mkv") returned 5 [0047.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0047.306] lstrlenA (lpString="*.mp3") returned 5 [0047.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0047.306] lstrlenA (lpString="*.wav") returned 5 [0047.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0047.306] lstrlenA (lpString="*.flac") returned 6 [0047.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0047.307] lstrlenA (lpString="*.ape") returned 5 [0047.307] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0047.307] lstrlenA (lpString="*.wma") returned 5 [0047.307] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0047.307] lstrlenA (lpString="*.ac3") returned 5 [0047.307] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", pszSpec="*.mxf") returned 0 [0047.307] lstrlenA (lpString="*.mxf") returned 5 [0047.307] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.307] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.307] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="de-DE", cAlternateFileName="")) returned 1 [0047.307] lstrcmpA (lpString1=".", lpString2="de-DE") returned -1 [0047.307] lstrcmpA (lpString1="..", lpString2="de-DE") returned -1 [0047.307] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.307] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="de-DE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE" [0047.307] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE") returned 56 [0047.307] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8380, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.309] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.309] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.309] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.309] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.309] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.309] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.325] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0047.325] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0047.325] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0047.325] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*") returned="*.*" [0047.325] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\" [0047.325] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\") returned="" [0047.325] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\HOW TO DECRYPT FILES.txt" [0047.325] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\how to decrypt files.txt")) returned 0xffffffff [0047.326] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.326] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0047.326] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0047.328] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.328] CloseHandle (hObject=0x90) returned 1 [0047.328] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" [0047.328] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0047.328] lstrlenA (lpString="*.zip") returned 5 [0047.328] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0047.328] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0047.328] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0047.328] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0047.328] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0047.328] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0047.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0047.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0047.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0047.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0047.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0047.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0047.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0047.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0047.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0047.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0047.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0047.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0047.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0047.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0047.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0047.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0047.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0047.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0047.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0047.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0047.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0047.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0047.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0047.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0047.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0047.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0047.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", pszSpec="*.mxf") returned 0 [0047.330] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.330] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.330] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="el-GR", cAlternateFileName="")) returned 1 [0047.330] lstrcmpA (lpString1=".", lpString2="el-GR") returned -1 [0047.330] lstrcmpA (lpString1="..", lpString2="el-GR") returned -1 [0047.330] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.330] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="el-GR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR" [0047.331] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8380, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.331] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.331] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.331] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.331] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.331] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.331] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.331] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0047.332] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0047.332] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0047.332] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*") returned="*.*" [0047.332] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\" [0047.332] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\") returned="" [0047.332] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\HOW TO DECRYPT FILES.txt" [0047.332] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\how to decrypt files.txt")) returned 0xffffffff [0047.332] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.332] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0047.333] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.334] CloseHandle (hObject=0x90) returned 1 [0047.334] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" [0047.334] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0047.334] lstrlenA (lpString="*.zip") returned 5 [0047.334] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0047.334] lstrlenA (lpString="*.rar") returned 5 [0047.334] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0047.334] lstrlenA (lpString="*.7z") returned 4 [0047.334] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0047.334] lstrlenA (lpString="*.tar") returned 5 [0047.334] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0047.334] lstrlenA (lpString="*.gzip") returned 6 [0047.334] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0047.334] lstrlenA (lpString="*.jpg") returned 5 [0047.334] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0047.334] lstrlenA (lpString="*.jpeg") returned 6 [0047.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0047.335] lstrlenA (lpString="*.psd") returned 5 [0047.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0047.335] lstrlenA (lpString="*.gif") returned 5 [0047.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0047.335] lstrlenA (lpString="*.doc") returned 5 [0047.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0047.335] lstrlenA (lpString="*.docx") returned 6 [0047.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0047.335] lstrlenA (lpString="*.xls") returned 5 [0047.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0047.335] lstrlenA (lpString="*.xlsx") returned 6 [0047.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0047.335] lstrlenA (lpString="*.ppt") returned 5 [0047.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0047.335] lstrlenA (lpString="*.pptx") returned 6 [0047.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0047.335] lstrlenA (lpString="*.pdf") returned 5 [0047.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0047.335] lstrlenA (lpString="*.mov") returned 5 [0047.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0047.335] lstrlenA (lpString="*.m2v") returned 5 [0047.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0047.335] lstrlenA (lpString="*.3gp") returned 5 [0047.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0047.335] lstrlenA (lpString="*.mpeg") returned 6 [0047.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0047.335] lstrlenA (lpString="*.mpg") returned 5 [0047.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0047.336] lstrlenA (lpString="*.flv") returned 5 [0047.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0047.336] lstrlenA (lpString="*.avi") returned 5 [0047.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0047.336] lstrlenA (lpString="*.mp4") returned 5 [0047.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0047.336] lstrlenA (lpString="*.wmv") returned 5 [0047.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0047.336] lstrlenA (lpString="*.divx") returned 6 [0047.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0047.336] lstrlenA (lpString="*.mkv") returned 5 [0047.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0047.336] lstrlenA (lpString="*.mp3") returned 5 [0047.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0047.336] lstrlenA (lpString="*.wav") returned 5 [0047.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0047.336] lstrlenA (lpString="*.flac") returned 6 [0047.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0047.336] lstrlenA (lpString="*.ape") returned 5 [0047.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0047.336] lstrlenA (lpString="*.wma") returned 5 [0047.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0047.336] lstrlenA (lpString="*.ac3") returned 5 [0047.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", pszSpec="*.mxf") returned 0 [0047.337] lstrlenA (lpString="*.mxf") returned 5 [0047.337] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.337] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.337] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="en-US", cAlternateFileName="")) returned 1 [0047.337] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0047.337] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0047.337] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.337] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US" [0047.337] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US") returned 56 [0047.337] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8380, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.339] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.339] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.339] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.339] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.339] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0047.340] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.340] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="boxed-correct.avi") returned 1 [0047.340] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="boxed-correct.avi") returned 1 [0047.340] lstrcmpiA (lpString1="", lpString2="boxed-correct.avi") returned -1 [0047.340] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*") returned="*.*" [0047.340] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0047.340] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0047.340] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0047.340] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0047.340] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.341] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0047.341] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0047.343] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.343] CloseHandle (hObject=0x90) returned 1 [0047.343] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="boxed-correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" [0047.343] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.zip") returned 0 [0047.343] lstrlenA (lpString="*.zip") returned 5 [0047.343] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.rar") returned 0 [0047.343] lstrlenA (lpString="*.rar") returned 5 [0047.343] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.7z") returned 0 [0047.343] lstrlenA (lpString="*.7z") returned 4 [0047.343] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.tar") returned 0 [0047.343] lstrlenA (lpString="*.tar") returned 5 [0047.343] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.gzip") returned 0 [0047.343] lstrlenA (lpString="*.gzip") returned 6 [0047.343] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.jpg") returned 0 [0047.343] lstrlenA (lpString="*.jpg") returned 5 [0047.343] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.jpeg") returned 0 [0047.343] lstrlenA (lpString="*.jpeg") returned 6 [0047.344] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.psd") returned 0 [0047.344] lstrlenA (lpString="*.psd") returned 5 [0047.344] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.gif") returned 0 [0047.344] lstrlenA (lpString="*.gif") returned 5 [0047.344] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.doc") returned 0 [0047.344] lstrlenA (lpString="*.doc") returned 5 [0047.344] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.docx") returned 0 [0047.344] lstrlenA (lpString="*.docx") returned 6 [0047.344] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.xls") returned 0 [0047.344] lstrlenA (lpString="*.xls") returned 5 [0047.344] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.xlsx") returned 0 [0047.344] lstrlenA (lpString="*.xlsx") returned 6 [0047.344] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.ppt") returned 0 [0047.344] lstrlenA (lpString="*.ppt") returned 5 [0047.344] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.pptx") returned 0 [0047.344] lstrlenA (lpString="*.pptx") returned 6 [0047.344] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.pdf") returned 0 [0047.344] lstrlenA (lpString="*.pdf") returned 5 [0047.344] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.mov") returned 0 [0047.344] lstrlenA (lpString="*.mov") returned 5 [0047.344] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.m2v") returned 0 [0047.344] lstrlenA (lpString="*.m2v") returned 5 [0047.344] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.3gp") returned 0 [0047.344] lstrlenA (lpString="*.3gp") returned 5 [0047.344] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.mpeg") returned 0 [0047.344] lstrlenA (lpString="*.mpeg") returned 6 [0047.344] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.mpg") returned 0 [0047.344] lstrlenA (lpString="*.mpg") returned 5 [0047.345] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.flv") returned 0 [0047.345] lstrlenA (lpString="*.flv") returned 5 [0047.345] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", pszSpec="*.avi") returned 1 [0047.345] lstrlenA (lpString="*.avi") returned 5 [0047.345] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" [0047.345] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" [0047.345] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi." [0047.345] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.wannacry" [0047.345] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.346] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x2d8140, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0047.346] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.346] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="boxed-delete.avi") returned 1 [0047.346] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="boxed-delete.avi") returned 1 [0047.346] lstrcmpiA (lpString1="", lpString2="boxed-delete.avi") returned -1 [0047.346] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned="boxed-correct.avi" [0047.346] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0047.346] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0047.346] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0047.346] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0047.346] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="boxed-delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" [0047.346] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.zip") returned 0 [0047.346] lstrlenA (lpString="*.zip") returned 5 [0047.346] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.rar") returned 0 [0047.346] lstrlenA (lpString="*.rar") returned 5 [0047.347] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.7z") returned 0 [0047.347] lstrlenA (lpString="*.7z") returned 4 [0047.347] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.tar") returned 0 [0047.347] lstrlenA (lpString="*.tar") returned 5 [0047.347] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.gzip") returned 0 [0047.347] lstrlenA (lpString="*.gzip") returned 6 [0047.347] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.jpg") returned 0 [0047.347] lstrlenA (lpString="*.jpg") returned 5 [0047.347] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.jpeg") returned 0 [0047.347] lstrlenA (lpString="*.jpeg") returned 6 [0047.347] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.psd") returned 0 [0047.347] lstrlenA (lpString="*.psd") returned 5 [0047.347] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.gif") returned 0 [0047.347] lstrlenA (lpString="*.gif") returned 5 [0047.347] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.doc") returned 0 [0047.347] lstrlenA (lpString="*.doc") returned 5 [0047.347] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.docx") returned 0 [0047.347] lstrlenA (lpString="*.docx") returned 6 [0047.347] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.xls") returned 0 [0047.347] lstrlenA (lpString="*.xls") returned 5 [0047.347] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.xlsx") returned 0 [0047.347] lstrlenA (lpString="*.xlsx") returned 6 [0047.347] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.ppt") returned 0 [0047.347] lstrlenA (lpString="*.ppt") returned 5 [0047.347] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.pptx") returned 0 [0047.347] lstrlenA (lpString="*.pptx") returned 6 [0047.348] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.pdf") returned 0 [0047.348] lstrlenA (lpString="*.pdf") returned 5 [0047.348] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.mov") returned 0 [0047.348] lstrlenA (lpString="*.mov") returned 5 [0047.348] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.m2v") returned 0 [0047.348] lstrlenA (lpString="*.m2v") returned 5 [0047.348] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.3gp") returned 0 [0047.348] lstrlenA (lpString="*.3gp") returned 5 [0047.348] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.mpeg") returned 0 [0047.348] lstrlenA (lpString="*.mpeg") returned 6 [0047.348] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.mpg") returned 0 [0047.348] lstrlenA (lpString="*.mpg") returned 5 [0047.348] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.flv") returned 0 [0047.348] lstrlenA (lpString="*.flv") returned 5 [0047.348] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", pszSpec="*.avi") returned 1 [0047.348] lstrlenA (lpString="*.avi") returned 5 [0047.348] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" [0047.348] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" [0047.348] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi." [0047.348] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.wannacry" [0047.348] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.349] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x2d8140, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0047.349] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.349] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="boxed-join.avi") returned 1 [0047.349] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="boxed-join.avi") returned 1 [0047.349] lstrcmpiA (lpString1="", lpString2="boxed-join.avi") returned -1 [0047.349] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned="boxed-delete.avi" [0047.349] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0047.349] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0047.350] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0047.350] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0047.350] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="boxed-join.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" [0047.350] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.zip") returned 0 [0047.350] lstrlenA (lpString="*.zip") returned 5 [0047.350] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.rar") returned 0 [0047.350] lstrlenA (lpString="*.rar") returned 5 [0047.350] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.7z") returned 0 [0047.350] lstrlenA (lpString="*.7z") returned 4 [0047.350] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.tar") returned 0 [0047.350] lstrlenA (lpString="*.tar") returned 5 [0047.350] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.gzip") returned 0 [0047.350] lstrlenA (lpString="*.gzip") returned 6 [0047.350] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.jpg") returned 0 [0047.350] lstrlenA (lpString="*.jpg") returned 5 [0047.350] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.jpeg") returned 0 [0047.350] lstrlenA (lpString="*.jpeg") returned 6 [0047.350] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.psd") returned 0 [0047.350] lstrlenA (lpString="*.psd") returned 5 [0047.350] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.gif") returned 0 [0047.350] lstrlenA (lpString="*.gif") returned 5 [0047.350] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.doc") returned 0 [0047.350] lstrlenA (lpString="*.doc") returned 5 [0047.351] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.docx") returned 0 [0047.351] lstrlenA (lpString="*.docx") returned 6 [0047.351] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.xls") returned 0 [0047.351] lstrlenA (lpString="*.xls") returned 5 [0047.351] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.xlsx") returned 0 [0047.351] lstrlenA (lpString="*.xlsx") returned 6 [0047.351] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.ppt") returned 0 [0047.351] lstrlenA (lpString="*.ppt") returned 5 [0047.351] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.pptx") returned 0 [0047.351] lstrlenA (lpString="*.pptx") returned 6 [0047.351] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.pdf") returned 0 [0047.351] lstrlenA (lpString="*.pdf") returned 5 [0047.351] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.mov") returned 0 [0047.351] lstrlenA (lpString="*.mov") returned 5 [0047.351] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.m2v") returned 0 [0047.351] lstrlenA (lpString="*.m2v") returned 5 [0047.351] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.3gp") returned 0 [0047.351] lstrlenA (lpString="*.3gp") returned 5 [0047.351] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.mpeg") returned 0 [0047.351] lstrlenA (lpString="*.mpeg") returned 6 [0047.351] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.mpg") returned 0 [0047.351] lstrlenA (lpString="*.mpg") returned 5 [0047.351] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.flv") returned 0 [0047.351] lstrlenA (lpString="*.flv") returned 5 [0047.351] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", pszSpec="*.avi") returned 1 [0047.351] lstrlenA (lpString="*.avi") returned 5 [0047.352] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" [0047.352] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" [0047.352] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi." [0047.352] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.wannacry" [0047.352] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.352] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x2d8138, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0047.352] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.352] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="boxed-split.avi") returned 1 [0047.352] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="boxed-split.avi") returned 1 [0047.352] lstrcmpiA (lpString1="", lpString2="boxed-split.avi") returned -1 [0047.352] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned="boxed-join.avi" [0047.352] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0047.352] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0047.352] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0047.352] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0047.352] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="boxed-split.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" [0047.352] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.zip") returned 0 [0047.352] lstrlenA (lpString="*.zip") returned 5 [0047.352] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.rar") returned 0 [0047.353] lstrlenA (lpString="*.rar") returned 5 [0047.353] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.7z") returned 0 [0047.353] lstrlenA (lpString="*.7z") returned 4 [0047.353] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.tar") returned 0 [0047.353] lstrlenA (lpString="*.tar") returned 5 [0047.353] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.gzip") returned 0 [0047.353] lstrlenA (lpString="*.gzip") returned 6 [0047.353] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.jpg") returned 0 [0047.353] lstrlenA (lpString="*.jpg") returned 5 [0047.353] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.jpeg") returned 0 [0047.353] lstrlenA (lpString="*.jpeg") returned 6 [0047.353] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.psd") returned 0 [0047.353] lstrlenA (lpString="*.psd") returned 5 [0047.353] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.gif") returned 0 [0047.353] lstrlenA (lpString="*.gif") returned 5 [0047.353] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.doc") returned 0 [0047.353] lstrlenA (lpString="*.doc") returned 5 [0047.353] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.docx") returned 0 [0047.353] lstrlenA (lpString="*.docx") returned 6 [0047.353] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.xls") returned 0 [0047.353] lstrlenA (lpString="*.xls") returned 5 [0047.353] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.xlsx") returned 0 [0047.353] lstrlenA (lpString="*.xlsx") returned 6 [0047.353] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.ppt") returned 0 [0047.353] lstrlenA (lpString="*.ppt") returned 5 [0047.353] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.pptx") returned 0 [0047.354] lstrlenA (lpString="*.pptx") returned 6 [0047.354] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.pdf") returned 0 [0047.354] lstrlenA (lpString="*.pdf") returned 5 [0047.354] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.mov") returned 0 [0047.354] lstrlenA (lpString="*.mov") returned 5 [0047.354] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.m2v") returned 0 [0047.354] lstrlenA (lpString="*.m2v") returned 5 [0047.354] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.3gp") returned 0 [0047.354] lstrlenA (lpString="*.3gp") returned 5 [0047.354] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.mpeg") returned 0 [0047.354] lstrlenA (lpString="*.mpeg") returned 6 [0047.354] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.mpg") returned 0 [0047.354] lstrlenA (lpString="*.mpg") returned 5 [0047.354] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.flv") returned 0 [0047.354] lstrlenA (lpString="*.flv") returned 5 [0047.354] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", pszSpec="*.avi") returned 1 [0047.354] lstrlenA (lpString="*.avi") returned 5 [0047.354] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" [0047.354] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" [0047.354] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi." [0047.354] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.wannacry" [0047.354] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.355] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x2d8140, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0047.355] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.355] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="correct.avi") returned 1 [0047.355] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="correct.avi") returned 1 [0047.355] lstrcmpiA (lpString1="", lpString2="correct.avi") returned -1 [0047.355] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned="boxed-split.avi" [0047.355] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0047.355] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0047.355] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0047.355] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0047.355] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" [0047.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.zip") returned 0 [0047.355] lstrlenA (lpString="*.zip") returned 5 [0047.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.rar") returned 0 [0047.355] lstrlenA (lpString="*.rar") returned 5 [0047.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.7z") returned 0 [0047.355] lstrlenA (lpString="*.7z") returned 4 [0047.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.tar") returned 0 [0047.356] lstrlenA (lpString="*.tar") returned 5 [0047.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.gzip") returned 0 [0047.356] lstrlenA (lpString="*.gzip") returned 6 [0047.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.jpg") returned 0 [0047.356] lstrlenA (lpString="*.jpg") returned 5 [0047.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.jpeg") returned 0 [0047.356] lstrlenA (lpString="*.jpeg") returned 6 [0047.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.psd") returned 0 [0047.356] lstrlenA (lpString="*.psd") returned 5 [0047.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.gif") returned 0 [0047.356] lstrlenA (lpString="*.gif") returned 5 [0047.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.doc") returned 0 [0047.356] lstrlenA (lpString="*.doc") returned 5 [0047.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.docx") returned 0 [0047.356] lstrlenA (lpString="*.docx") returned 6 [0047.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.xls") returned 0 [0047.356] lstrlenA (lpString="*.xls") returned 5 [0047.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.xlsx") returned 0 [0047.356] lstrlenA (lpString="*.xlsx") returned 6 [0047.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.ppt") returned 0 [0047.357] lstrlenA (lpString="*.ppt") returned 5 [0047.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.pptx") returned 0 [0047.357] lstrlenA (lpString="*.pptx") returned 6 [0047.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.pdf") returned 0 [0047.357] lstrlenA (lpString="*.pdf") returned 5 [0047.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.mov") returned 0 [0047.357] lstrlenA (lpString="*.mov") returned 5 [0047.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.m2v") returned 0 [0047.357] lstrlenA (lpString="*.m2v") returned 5 [0047.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.3gp") returned 0 [0047.357] lstrlenA (lpString="*.3gp") returned 5 [0047.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.mpeg") returned 0 [0047.357] lstrlenA (lpString="*.mpeg") returned 6 [0047.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.mpg") returned 0 [0047.357] lstrlenA (lpString="*.mpg") returned 5 [0047.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.flv") returned 0 [0047.357] lstrlenA (lpString="*.flv") returned 5 [0047.357] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", pszSpec="*.avi") returned 1 [0047.357] lstrlenA (lpString="*.avi") returned 5 [0047.357] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" [0047.357] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" [0047.357] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi." [0047.357] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.wannacry" [0047.357] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.358] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x2d8138, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0047.358] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.358] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="delete.avi") returned 1 [0047.358] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="delete.avi") returned 1 [0047.358] lstrcmpiA (lpString1="", lpString2="delete.avi") returned -1 [0047.358] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned="correct.avi" [0047.358] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0047.358] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0047.358] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0047.358] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0047.358] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" [0047.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.zip") returned 0 [0047.358] lstrlenA (lpString="*.zip") returned 5 [0047.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.rar") returned 0 [0047.358] lstrlenA (lpString="*.rar") returned 5 [0047.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.7z") returned 0 [0047.358] lstrlenA (lpString="*.7z") returned 4 [0047.358] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.tar") returned 0 [0047.358] lstrlenA (lpString="*.tar") returned 5 [0047.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.gzip") returned 0 [0047.359] lstrlenA (lpString="*.gzip") returned 6 [0047.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.jpg") returned 0 [0047.359] lstrlenA (lpString="*.jpg") returned 5 [0047.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.jpeg") returned 0 [0047.359] lstrlenA (lpString="*.jpeg") returned 6 [0047.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.psd") returned 0 [0047.359] lstrlenA (lpString="*.psd") returned 5 [0047.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.gif") returned 0 [0047.359] lstrlenA (lpString="*.gif") returned 5 [0047.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.doc") returned 0 [0047.359] lstrlenA (lpString="*.doc") returned 5 [0047.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.docx") returned 0 [0047.359] lstrlenA (lpString="*.docx") returned 6 [0047.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.xls") returned 0 [0047.359] lstrlenA (lpString="*.xls") returned 5 [0047.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.xlsx") returned 0 [0047.359] lstrlenA (lpString="*.xlsx") returned 6 [0047.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.ppt") returned 0 [0047.359] lstrlenA (lpString="*.ppt") returned 5 [0047.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.pptx") returned 0 [0047.359] lstrlenA (lpString="*.pptx") returned 6 [0047.359] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.pdf") returned 0 [0047.359] lstrlenA (lpString="*.pdf") returned 5 [0047.360] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.mov") returned 0 [0047.360] lstrlenA (lpString="*.mov") returned 5 [0047.360] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.m2v") returned 0 [0047.360] lstrlenA (lpString="*.m2v") returned 5 [0047.360] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.3gp") returned 0 [0047.360] lstrlenA (lpString="*.3gp") returned 5 [0047.360] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.mpeg") returned 0 [0047.360] lstrlenA (lpString="*.mpeg") returned 6 [0047.360] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.mpg") returned 0 [0047.360] lstrlenA (lpString="*.mpg") returned 5 [0047.360] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.flv") returned 0 [0047.360] lstrlenA (lpString="*.flv") returned 5 [0047.360] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", pszSpec="*.avi") returned 1 [0047.360] lstrlenA (lpString="*.avi") returned 5 [0047.360] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" [0047.360] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" [0047.360] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi." [0047.360] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.wannacry" [0047.360] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.361] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x2d8130, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0047.361] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.361] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FlickLearningWizard.exe.mui") returned -1 [0047.361] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FlickLearningWizard.exe.mui") returned 1 [0047.361] lstrcmpiA (lpString1="", lpString2="FlickLearningWizard.exe.mui") returned -1 [0047.361] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned="delete.avi" [0047.361] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0047.362] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0047.362] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0047.362] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0047.362] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="FlickLearningWizard.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" [0047.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.zip") returned 0 [0047.362] lstrlenA (lpString="*.zip") returned 5 [0047.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.rar") returned 0 [0047.362] lstrlenA (lpString="*.rar") returned 5 [0047.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.7z") returned 0 [0047.362] lstrlenA (lpString="*.7z") returned 4 [0047.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.tar") returned 0 [0047.362] lstrlenA (lpString="*.tar") returned 5 [0047.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.gzip") returned 0 [0047.362] lstrlenA (lpString="*.gzip") returned 6 [0047.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.jpg") returned 0 [0047.362] lstrlenA (lpString="*.jpg") returned 5 [0047.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.jpeg") returned 0 [0047.362] lstrlenA (lpString="*.jpeg") returned 6 [0047.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.psd") returned 0 [0047.362] lstrlenA (lpString="*.psd") returned 5 [0047.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.gif") returned 0 [0047.362] lstrlenA (lpString="*.gif") returned 5 [0047.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.doc") returned 0 [0047.362] lstrlenA (lpString="*.doc") returned 5 [0047.363] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.docx") returned 0 [0047.363] lstrlenA (lpString="*.docx") returned 6 [0047.363] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.xls") returned 0 [0047.363] lstrlenA (lpString="*.xls") returned 5 [0047.363] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.xlsx") returned 0 [0047.363] lstrlenA (lpString="*.xlsx") returned 6 [0047.363] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.ppt") returned 0 [0047.363] lstrlenA (lpString="*.ppt") returned 5 [0047.363] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.pptx") returned 0 [0047.363] lstrlenA (lpString="*.pptx") returned 6 [0047.363] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.pdf") returned 0 [0047.363] lstrlenA (lpString="*.pdf") returned 5 [0047.363] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.mov") returned 0 [0047.363] lstrlenA (lpString="*.mov") returned 5 [0047.363] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.m2v") returned 0 [0047.363] lstrlenA (lpString="*.m2v") returned 5 [0047.363] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.3gp") returned 0 [0047.363] lstrlenA (lpString="*.3gp") returned 5 [0047.363] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.mpeg") returned 0 [0047.363] lstrlenA (lpString="*.mpeg") returned 6 [0047.363] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.mpg") returned 0 [0047.363] lstrlenA (lpString="*.mpg") returned 5 [0047.363] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.flv") returned 0 [0047.363] lstrlenA (lpString="*.flv") returned 5 [0047.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.avi") returned 0 [0047.364] lstrlenA (lpString="*.avi") returned 5 [0047.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.mp4") returned 0 [0047.364] lstrlenA (lpString="*.mp4") returned 5 [0047.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.wmv") returned 0 [0047.364] lstrlenA (lpString="*.wmv") returned 5 [0047.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.divx") returned 0 [0047.364] lstrlenA (lpString="*.divx") returned 6 [0047.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.mkv") returned 0 [0047.364] lstrlenA (lpString="*.mkv") returned 5 [0047.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.mp3") returned 0 [0047.364] lstrlenA (lpString="*.mp3") returned 5 [0047.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.wav") returned 0 [0047.364] lstrlenA (lpString="*.wav") returned 5 [0047.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.flac") returned 0 [0047.364] lstrlenA (lpString="*.flac") returned 6 [0047.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.ape") returned 0 [0047.364] lstrlenA (lpString="*.ape") returned 5 [0047.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.wma") returned 0 [0047.364] lstrlenA (lpString="*.wma") returned 5 [0047.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.ac3") returned 0 [0047.364] lstrlenA (lpString="*.ac3") returned 5 [0047.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", pszSpec="*.mxf") returned 0 [0047.364] lstrlenA (lpString="*.mxf") returned 5 [0047.364] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0047.364] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.365] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InkObj.dll.mui") returned -1 [0047.365] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InkObj.dll.mui") returned -1 [0047.365] lstrcmpiA (lpString1="", lpString2="InkObj.dll.mui") returned -1 [0047.365] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned="FlickLearningWizard.exe.mui" [0047.365] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0047.365] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0047.365] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0047.365] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0047.365] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="InkObj.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" [0047.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.zip") returned 0 [0047.365] lstrlenA (lpString="*.zip") returned 5 [0047.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.rar") returned 0 [0047.365] lstrlenA (lpString="*.rar") returned 5 [0047.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.7z") returned 0 [0047.365] lstrlenA (lpString="*.7z") returned 4 [0047.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.tar") returned 0 [0047.365] lstrlenA (lpString="*.tar") returned 5 [0047.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.gzip") returned 0 [0047.365] lstrlenA (lpString="*.gzip") returned 6 [0047.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.jpg") returned 0 [0047.365] lstrlenA (lpString="*.jpg") returned 5 [0047.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.jpeg") returned 0 [0047.366] lstrlenA (lpString="*.jpeg") returned 6 [0047.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.psd") returned 0 [0047.366] lstrlenA (lpString="*.psd") returned 5 [0047.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.gif") returned 0 [0047.366] lstrlenA (lpString="*.gif") returned 5 [0047.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.doc") returned 0 [0047.366] lstrlenA (lpString="*.doc") returned 5 [0047.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.docx") returned 0 [0047.366] lstrlenA (lpString="*.docx") returned 6 [0047.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.xls") returned 0 [0047.366] lstrlenA (lpString="*.xls") returned 5 [0047.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.xlsx") returned 0 [0047.366] lstrlenA (lpString="*.xlsx") returned 6 [0047.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.ppt") returned 0 [0047.366] lstrlenA (lpString="*.ppt") returned 5 [0047.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.pptx") returned 0 [0047.366] lstrlenA (lpString="*.pptx") returned 6 [0047.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.pdf") returned 0 [0047.366] lstrlenA (lpString="*.pdf") returned 5 [0047.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.mov") returned 0 [0047.366] lstrlenA (lpString="*.mov") returned 5 [0047.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.m2v") returned 0 [0047.366] lstrlenA (lpString="*.m2v") returned 5 [0047.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.3gp") returned 0 [0047.367] lstrlenA (lpString="*.3gp") returned 5 [0047.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.mpeg") returned 0 [0047.367] lstrlenA (lpString="*.mpeg") returned 6 [0047.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.mpg") returned 0 [0047.367] lstrlenA (lpString="*.mpg") returned 5 [0047.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.flv") returned 0 [0047.367] lstrlenA (lpString="*.flv") returned 5 [0047.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.avi") returned 0 [0047.367] lstrlenA (lpString="*.avi") returned 5 [0047.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.mp4") returned 0 [0047.367] lstrlenA (lpString="*.mp4") returned 5 [0047.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.wmv") returned 0 [0047.367] lstrlenA (lpString="*.wmv") returned 5 [0047.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.divx") returned 0 [0047.367] lstrlenA (lpString="*.divx") returned 6 [0047.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.mkv") returned 0 [0047.367] lstrlenA (lpString="*.mkv") returned 5 [0047.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.mp3") returned 0 [0047.367] lstrlenA (lpString="*.mp3") returned 5 [0047.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.wav") returned 0 [0047.367] lstrlenA (lpString="*.wav") returned 5 [0047.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.flac") returned 0 [0047.367] lstrlenA (lpString="*.flac") returned 6 [0047.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.ape") returned 0 [0047.367] lstrlenA (lpString="*.ape") returned 5 [0047.368] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.wma") returned 0 [0047.368] lstrlenA (lpString="*.wma") returned 5 [0047.368] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.ac3") returned 0 [0047.368] lstrlenA (lpString="*.ac3") returned 5 [0047.368] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", pszSpec="*.mxf") returned 0 [0047.368] lstrlenA (lpString="*.mxf") returned 5 [0047.368] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0047.368] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.368] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InkWatson.exe.mui") returned -1 [0047.368] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InkWatson.exe.mui") returned -1 [0047.368] lstrcmpiA (lpString1="", lpString2="InkWatson.exe.mui") returned -1 [0047.368] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned="InkObj.dll.mui" [0047.368] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0047.368] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0047.368] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0047.368] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0047.368] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="InkWatson.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" [0047.368] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.zip") returned 0 [0047.368] lstrlenA (lpString="*.zip") returned 5 [0047.368] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.rar") returned 0 [0047.368] lstrlenA (lpString="*.rar") returned 5 [0047.368] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.7z") returned 0 [0047.369] lstrlenA (lpString="*.7z") returned 4 [0047.369] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.tar") returned 0 [0047.369] lstrlenA (lpString="*.tar") returned 5 [0047.369] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.gzip") returned 0 [0047.369] lstrlenA (lpString="*.gzip") returned 6 [0047.369] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.jpg") returned 0 [0047.369] lstrlenA (lpString="*.jpg") returned 5 [0047.369] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.jpeg") returned 0 [0047.369] lstrlenA (lpString="*.jpeg") returned 6 [0047.369] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.psd") returned 0 [0047.369] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.gif") returned 0 [0047.369] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.doc") returned 0 [0047.369] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.docx") returned 0 [0047.369] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.xls") returned 0 [0047.369] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.xlsx") returned 0 [0047.369] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.ppt") returned 0 [0047.369] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.pptx") returned 0 [0047.369] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.pdf") returned 0 [0047.369] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.mov") returned 0 [0047.369] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.m2v") returned 0 [0047.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.3gp") returned 0 [0047.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.mpeg") returned 0 [0047.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.mpg") returned 0 [0047.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.flv") returned 0 [0047.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.avi") returned 0 [0047.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.mp4") returned 0 [0047.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.wmv") returned 0 [0047.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.divx") returned 0 [0047.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.mkv") returned 0 [0047.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.mp3") returned 0 [0047.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.wav") returned 0 [0047.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.flac") returned 0 [0047.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.ape") returned 0 [0047.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.wma") returned 0 [0047.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.ac3") returned 0 [0047.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", pszSpec="*.mxf") returned 0 [0047.370] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0047.370] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.370] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InputPersonalization.exe.mui") returned -1 [0047.371] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InputPersonalization.exe.mui") returned -1 [0047.371] lstrcmpiA (lpString1="", lpString2="InputPersonalization.exe.mui") returned -1 [0047.371] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned="InkWatson.exe.mui" [0047.371] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0047.371] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0047.371] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0047.371] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0047.371] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="InputPersonalization.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" [0047.371] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui", pszSpec="*.zip") returned 0 [0047.371] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui", pszSpec="*.rar") returned 0 [0047.371] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui", pszSpec="*.7z") returned 0 [0047.371] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui", pszSpec="*.tar") returned 0 [0047.371] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui", pszSpec="*.gzip") returned 0 [0047.371] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui", pszSpec="*.jpg") returned 0 [0047.371] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui", pszSpec="*.jpeg") returned 0 [0047.371] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui", pszSpec="*.psd") returned 0 [0047.371] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui", pszSpec="*.gif") returned 0 [0047.372] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0047.372] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.372] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IPSEventLogMsg.dll.mui") returned -1 [0047.372] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPSEventLogMsg.dll.mui") returned -1 [0047.372] lstrcmpiA (lpString1="", lpString2="IPSEventLogMsg.dll.mui") returned -1 [0047.372] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned="InputPersonalization.exe.mui" [0047.372] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0047.372] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0047.372] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0047.372] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0047.372] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="IPSEventLogMsg.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" [0047.372] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0047.373] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.373] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IpsMigrationPlugin.dll.mui") returned -1 [0047.373] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IpsMigrationPlugin.dll.mui") returned -1 [0047.373] lstrcmpiA (lpString1="", lpString2="IpsMigrationPlugin.dll.mui") returned -1 [0047.373] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned="IPSEventLogMsg.dll.mui" [0047.373] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0047.373] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0047.373] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0047.373] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0047.373] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="IpsMigrationPlugin.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" [0047.373] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0047.373] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.373] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="join.avi") returned -1 [0047.373] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="join.avi") returned -1 [0047.373] lstrcmpiA (lpString1="", lpString2="join.avi") returned -1 [0047.373] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned="IpsMigrationPlugin.dll.mui" [0047.373] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0047.373] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0047.373] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0047.374] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0047.374] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="join.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" [0047.374] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" [0047.374] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" [0047.374] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi." [0047.374] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.wannacry" [0047.374] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.374] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x2d8130, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0047.374] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.374] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="micaut.dll.mui") returned -1 [0047.374] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="micaut.dll.mui") returned -1 [0047.374] lstrcmpiA (lpString1="", lpString2="micaut.dll.mui") returned -1 [0047.374] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned="join.avi" [0047.374] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0047.374] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0047.374] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0047.374] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0047.375] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="micaut.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" [0047.375] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0047.375] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.375] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mip.exe.mui") returned -1 [0047.375] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mip.exe.mui") returned -1 [0047.375] lstrcmpiA (lpString1="", lpString2="mip.exe.mui") returned -1 [0047.375] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned="micaut.dll.mui" [0047.375] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0047.375] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0047.375] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0047.375] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0047.375] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="mip.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" [0047.375] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0047.375] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.375] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mshwLatin.dll.mui") returned -1 [0047.375] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mshwLatin.dll.mui") returned -1 [0047.376] lstrcmpiA (lpString1="", lpString2="mshwLatin.dll.mui") returned -1 [0047.376] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned="mip.exe.mui" [0047.376] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0047.376] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0047.376] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0047.376] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0047.376] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="mshwLatin.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" [0047.376] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0047.376] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.376] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtscom.dll.mui") returned -1 [0047.376] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtscom.dll.mui") returned -1 [0047.376] lstrcmpiA (lpString1="", lpString2="rtscom.dll.mui") returned -1 [0047.376] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned="mshwLatin.dll.mui" [0047.376] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0047.376] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0047.376] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0047.376] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0047.376] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="rtscom.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" [0047.377] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0047.377] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.377] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ShapeCollector.exe.mui") returned -1 [0047.377] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ShapeCollector.exe.mui") returned -1 [0047.377] lstrcmpiA (lpString1="", lpString2="ShapeCollector.exe.mui") returned -1 [0047.378] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned="rtscom.dll.mui" [0047.378] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0047.378] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0047.378] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0047.378] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0047.378] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="ShapeCollector.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" [0047.378] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0047.378] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.378] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="split.avi") returned -1 [0047.378] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="split.avi") returned -1 [0047.378] lstrcmpiA (lpString1="", lpString2="split.avi") returned -1 [0047.379] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned="ShapeCollector.exe.mui" [0047.379] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0047.379] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0047.379] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" [0047.379] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\how to decrypt files.txt")) returned 0x20 [0047.381] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x2d8130, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0047.381] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.381] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tabskb.dll.mui") returned -1 [0047.381] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tabskb.dll.mui") returned -1 [0047.382] lstrcmpiA (lpString1="", lpString2="tabskb.dll.mui") returned -1 [0047.382] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned="split.avi" [0047.382] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0047.382] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0047.382] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0047.382] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.382] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TipBand.dll.mui") returned -1 [0047.382] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TipBand.dll.mui") returned -1 [0047.382] lstrcmpiA (lpString1="", lpString2="TipBand.dll.mui") returned -1 [0047.383] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned="tabskb.dll.mui" [0047.383] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0047.383] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0047.383] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0047.383] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.383] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TipRes.dll.mui") returned -1 [0047.383] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TipRes.dll.mui") returned -1 [0047.383] lstrcmpiA (lpString1="", lpString2="TipRes.dll.mui") returned -1 [0047.383] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned="TipBand.dll.mui" [0047.383] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0047.383] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0047.383] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.383] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.383] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0047.383] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0047.383] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0047.383] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned="TipRes.dll.mui" [0047.383] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0047.383] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0047.384] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0047.384] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.384] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TipTsf.dll.mui") returned -1 [0047.384] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TipTsf.dll.mui") returned -1 [0047.384] lstrcmpiA (lpString1="", lpString2="TipTsf.dll.mui") returned -1 [0047.384] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned="tipresx.dll.mui" [0047.384] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" [0047.384] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned="" [0047.384] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0047.384] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.384] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="es-ES", cAlternateFileName="")) returned 1 [0047.384] lstrcmpA (lpString1=".", lpString2="es-ES") returned -1 [0047.384] lstrcmpA (lpString1="..", lpString2="es-ES") returned -1 [0047.384] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.385] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.385] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.385] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.385] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.385] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.385] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.385] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.385] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0047.386] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0047.386] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0047.386] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*") returned="*.*" [0047.386] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\" [0047.386] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\") returned="" [0047.390] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.390] CloseHandle (hObject=0x90) returned 1 [0047.391] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.391] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.391] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="et-EE", cAlternateFileName="")) returned 1 [0047.391] lstrcmpA (lpString1=".", lpString2="et-EE") returned -1 [0047.391] lstrcmpA (lpString1="..", lpString2="et-EE") returned -1 [0047.391] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.391] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8380, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.393] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.393] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.393] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.393] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.393] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.393] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.393] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0047.393] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0047.393] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0047.393] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*") returned="*.*" [0047.393] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\" [0047.393] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\") returned="" [0047.396] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.397] CloseHandle (hObject=0x90) returned 1 [0047.397] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.397] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.397] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0047.397] lstrcmpA (lpString1=".", lpString2="fi-FI") returned -1 [0047.397] lstrcmpA (lpString1="..", lpString2="fi-FI") returned -1 [0047.397] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.397] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8380, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.398] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.398] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.398] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.398] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.398] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.398] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.398] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0047.398] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0047.398] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0047.398] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*") returned="*.*" [0047.398] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\" [0047.398] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\") returned="" [0047.400] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.400] CloseHandle (hObject=0x90) returned 1 [0047.400] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.400] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.400] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0047.400] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.400] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FlickAnimation.avi") returned -1 [0047.400] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FlickAnimation.avi") returned 1 [0047.400] lstrcmpiA (lpString1="", lpString2="FlickAnimation.avi") returned -1 [0047.400] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.400] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.400] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.401] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c53a9c4, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5c53a9c4, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe2800, dwReserved0=0x2d8138, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0047.401] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.401] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FlickLearningWizard.exe") returned -1 [0047.401] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FlickLearningWizard.exe") returned 1 [0047.401] lstrcmpiA (lpString1="", lpString2="FlickLearningWizard.exe") returned -1 [0047.401] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned="FlickAnimation.avi" [0047.401] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.401] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.401] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0047.401] lstrcmpA (lpString1=".", lpString2="fr-FR") returned -1 [0047.401] lstrcmpA (lpString1="..", lpString2="fr-FR") returned -1 [0047.401] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe") returned="FlickLearningWizard.exe" [0047.401] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d813e, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.402] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.402] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.402] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.402] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.402] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.402] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.402] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0047.402] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0047.402] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0047.402] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*") returned="*.*" [0047.402] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\" [0047.402] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\") returned="" [0047.404] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.404] CloseHandle (hObject=0x90) returned 1 [0047.404] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.404] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.404] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0047.404] lstrcmpA (lpString1=".", lpString2="fsdefinitions") returned -1 [0047.404] lstrcmpA (lpString1="..", lpString2="fsdefinitions") returned -1 [0047.404] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.404] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8380, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.407] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.407] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.407] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.407] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.407] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0047.407] lstrcmpA (lpString1=".", lpString2="auxpad") returned -1 [0047.407] lstrcmpA (lpString1="..", lpString2="auxpad") returned -1 [0047.407] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0047.407] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2db3c0, dwReserved1=0x2db3bb, cFileName=".", cAlternateFileName="")) returned 0x2d8148 [0047.408] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.408] FindNextFileA (in: hFindFile=0x2d8148, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.408] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.408] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.408] FindNextFileA (in: hFindFile=0x2d8148, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0047.408] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.408] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="auxbase.xml") returned 1 [0047.409] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="auxbase.xml") returned 1 [0047.409] lstrcmpiA (lpString1="", lpString2="auxbase.xml") returned -1 [0047.409] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*") returned="*.*" [0047.409] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\" [0047.409] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\") returned="" [0047.412] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.412] CloseHandle (hObject=0x94) returned 1 [0047.412] FindNextFileA (in: hFindFile=0x2d8148, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0047.412] FindClose (in: hFindFile=0x2d8148 | out: hFindFile=0x2d8148) returned 1 [0047.413] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0047.413] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.413] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="auxpad.xml") returned 1 [0047.413] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="auxpad.xml") returned 1 [0047.413] lstrcmpiA (lpString1="", lpString2="auxpad.xml") returned -1 [0047.413] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0047.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" [0047.413] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="" [0047.414] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.415] CloseHandle (hObject=0x90) returned 1 [0047.415] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8390, cFileName="keypad", cAlternateFileName="")) returned 1 [0047.415] lstrcmpA (lpString1=".", lpString2="keypad") returned -1 [0047.415] lstrcmpA (lpString1="..", lpString2="keypad") returned -1 [0047.415] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned="auxpad.xml" [0047.415] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d815a, cFileName=".", cAlternateFileName="")) returned 0x2d8148 [0047.415] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.415] FindNextFileA (in: hFindFile=0x2d8148, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.415] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.415] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.415] FindNextFileA (in: hFindFile=0x2d8148, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0047.416] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.416] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ea.xml") returned 1 [0047.416] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ea.xml") returned 1 [0047.416] lstrcmpiA (lpString1="", lpString2="ea.xml") returned -1 [0047.416] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*") returned="*.*" [0047.416] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\" [0047.416] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\") returned="" [0047.417] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.417] CloseHandle (hObject=0x94) returned 1 [0047.418] FindNextFileA (in: hFindFile=0x2d8148, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x2d8480, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0047.418] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.418] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="keypadbase.xml") returned -1 [0047.418] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="keypadbase.xml") returned -1 [0047.418] lstrcmpiA (lpString1="", lpString2="keypadbase.xml") returned -1 [0047.418] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned="ea.xml" [0047.418] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\" [0047.418] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\") returned="" [0047.418] FindNextFileA (in: hFindFile=0x2d8148, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0047.418] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.418] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="kor-kor.xml") returned -1 [0047.418] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="kor-kor.xml") returned -1 [0047.418] lstrcmpiA (lpString1="", lpString2="kor-kor.xml") returned -1 [0047.418] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned="keypadbase.xml" [0047.420] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\" [0047.420] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\") returned="" [0047.420] FindNextFileA (in: hFindFile=0x2d8148, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0047.420] FindClose (in: hFindFile=0x2d8148 | out: hFindFile=0x2d8148) returned 1 [0047.420] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0047.420] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.420] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="keypad.xml") returned -1 [0047.420] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="keypad.xml") returned -1 [0047.420] lstrcmpiA (lpString1="", lpString2="keypad.xml") returned -1 [0047.420] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0047.420] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" [0047.420] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="" [0047.420] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="main", cAlternateFileName="")) returned 1 [0047.420] lstrcmpA (lpString1=".", lpString2="main") returned -1 [0047.420] lstrcmpA (lpString1="..", lpString2="main") returned -1 [0047.421] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned="keypad.xml" [0047.421] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d815a, cFileName=".", cAlternateFileName="")) returned 0x2d8148 [0047.502] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.502] FindNextFileA (in: hFindFile=0x2d8148, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.502] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.503] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.503] FindNextFileA (in: hFindFile=0x2d8148, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0047.503] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.503] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="base.xml") returned 1 [0047.503] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base.xml") returned 1 [0047.503] lstrcmpiA (lpString1="", lpString2="base.xml") returned -1 [0047.503] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*") returned="*.*" [0047.503] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" [0047.503] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="" [0047.503] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0xffffffff [0047.503] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0047.504] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0047.504] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0047.505] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.505] CloseHandle (hObject=0x94) returned 1 [0047.505] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="base.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" [0047.505] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.zip") returned 0 [0047.506] lstrlenA (lpString="*.zip") returned 5 [0047.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.rar") returned 0 [0047.506] lstrlenA (lpString="*.rar") returned 5 [0047.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.7z") returned 0 [0047.506] lstrlenA (lpString="*.7z") returned 4 [0047.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.tar") returned 0 [0047.506] lstrlenA (lpString="*.tar") returned 5 [0047.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.gzip") returned 0 [0047.506] lstrlenA (lpString="*.gzip") returned 6 [0047.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.jpg") returned 0 [0047.506] lstrlenA (lpString="*.jpg") returned 5 [0047.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.jpeg") returned 0 [0047.506] lstrlenA (lpString="*.jpeg") returned 6 [0047.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.psd") returned 0 [0047.506] lstrlenA (lpString="*.psd") returned 5 [0047.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.gif") returned 0 [0047.506] lstrlenA (lpString="*.gif") returned 5 [0047.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.doc") returned 0 [0047.506] lstrlenA (lpString="*.doc") returned 5 [0047.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.docx") returned 0 [0047.506] lstrlenA (lpString="*.docx") returned 6 [0047.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.xls") returned 0 [0047.506] lstrlenA (lpString="*.xls") returned 5 [0047.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.xlsx") returned 0 [0047.506] lstrlenA (lpString="*.xlsx") returned 6 [0047.506] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.ppt") returned 0 [0047.506] lstrlenA (lpString="*.ppt") returned 5 [0047.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.pptx") returned 0 [0047.507] lstrlenA (lpString="*.pptx") returned 6 [0047.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.pdf") returned 0 [0047.507] lstrlenA (lpString="*.pdf") returned 5 [0047.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.mov") returned 0 [0047.507] lstrlenA (lpString="*.mov") returned 5 [0047.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.m2v") returned 0 [0047.507] lstrlenA (lpString="*.m2v") returned 5 [0047.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.3gp") returned 0 [0047.507] lstrlenA (lpString="*.3gp") returned 5 [0047.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.mpeg") returned 0 [0047.507] lstrlenA (lpString="*.mpeg") returned 6 [0047.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.mpg") returned 0 [0047.507] lstrlenA (lpString="*.mpg") returned 5 [0047.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.flv") returned 0 [0047.507] lstrlenA (lpString="*.flv") returned 5 [0047.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.avi") returned 0 [0047.507] lstrlenA (lpString="*.avi") returned 5 [0047.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.mp4") returned 0 [0047.507] lstrlenA (lpString="*.mp4") returned 5 [0047.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.wmv") returned 0 [0047.507] lstrlenA (lpString="*.wmv") returned 5 [0047.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.divx") returned 0 [0047.507] lstrlenA (lpString="*.divx") returned 6 [0047.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.mkv") returned 0 [0047.507] lstrlenA (lpString="*.mkv") returned 5 [0047.507] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.mp3") returned 0 [0047.508] lstrlenA (lpString="*.mp3") returned 5 [0047.508] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.wav") returned 0 [0047.508] lstrlenA (lpString="*.wav") returned 5 [0047.508] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.flac") returned 0 [0047.508] lstrlenA (lpString="*.flac") returned 6 [0047.508] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.ape") returned 0 [0047.508] lstrlenA (lpString="*.ape") returned 5 [0047.508] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.wma") returned 0 [0047.508] lstrlenA (lpString="*.wma") returned 5 [0047.508] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.ac3") returned 0 [0047.508] lstrlenA (lpString="*.ac3") returned 5 [0047.508] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", pszSpec="*.mxf") returned 0 [0047.508] lstrlenA (lpString="*.mxf") returned 5 [0047.508] FindNextFileA (in: hFindFile=0x2d8148, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x2d8478, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0047.508] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.508] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="baseAltGr_rtl.xml") returned 1 [0047.508] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="baseAltGr_rtl.xml") returned 1 [0047.508] lstrcmpiA (lpString1="", lpString2="baseAltGr_rtl.xml") returned -1 [0047.508] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned="base.xml" [0047.508] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" [0047.508] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="" [0047.508] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0047.508] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0047.509] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="baseAltGr_rtl.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" [0047.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.zip") returned 0 [0047.509] lstrlenA (lpString="*.zip") returned 5 [0047.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.rar") returned 0 [0047.509] lstrlenA (lpString="*.rar") returned 5 [0047.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.7z") returned 0 [0047.509] lstrlenA (lpString="*.7z") returned 4 [0047.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.tar") returned 0 [0047.509] lstrlenA (lpString="*.tar") returned 5 [0047.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.gzip") returned 0 [0047.509] lstrlenA (lpString="*.gzip") returned 6 [0047.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.jpg") returned 0 [0047.509] lstrlenA (lpString="*.jpg") returned 5 [0047.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.jpeg") returned 0 [0047.509] lstrlenA (lpString="*.jpeg") returned 6 [0047.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.psd") returned 0 [0047.509] lstrlenA (lpString="*.psd") returned 5 [0047.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.gif") returned 0 [0047.509] lstrlenA (lpString="*.gif") returned 5 [0047.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.doc") returned 0 [0047.509] lstrlenA (lpString="*.doc") returned 5 [0047.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.docx") returned 0 [0047.509] lstrlenA (lpString="*.docx") returned 6 [0047.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.xls") returned 0 [0047.509] lstrlenA (lpString="*.xls") returned 5 [0047.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.xlsx") returned 0 [0047.509] lstrlenA (lpString="*.xlsx") returned 6 [0047.509] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.ppt") returned 0 [0047.510] lstrlenA (lpString="*.ppt") returned 5 [0047.510] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.pptx") returned 0 [0047.510] lstrlenA (lpString="*.pptx") returned 6 [0047.510] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.pdf") returned 0 [0047.510] lstrlenA (lpString="*.pdf") returned 5 [0047.510] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.mov") returned 0 [0047.510] lstrlenA (lpString="*.mov") returned 5 [0047.510] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.m2v") returned 0 [0047.510] lstrlenA (lpString="*.m2v") returned 5 [0047.510] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.3gp") returned 0 [0047.510] lstrlenA (lpString="*.3gp") returned 5 [0047.510] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.mpeg") returned 0 [0047.510] lstrlenA (lpString="*.mpeg") returned 6 [0047.510] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.mpg") returned 0 [0047.510] lstrlenA (lpString="*.mpg") returned 5 [0047.510] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.flv") returned 0 [0047.510] lstrlenA (lpString="*.flv") returned 5 [0047.510] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.avi") returned 0 [0047.510] lstrlenA (lpString="*.avi") returned 5 [0047.510] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.mp4") returned 0 [0047.510] lstrlenA (lpString="*.mp4") returned 5 [0047.510] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.wmv") returned 0 [0047.510] lstrlenA (lpString="*.wmv") returned 5 [0047.510] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.divx") returned 0 [0047.510] lstrlenA (lpString="*.divx") returned 6 [0047.510] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.mkv") returned 0 [0047.510] lstrlenA (lpString="*.mkv") returned 5 [0047.510] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.mp3") returned 0 [0047.510] lstrlenA (lpString="*.mp3") returned 5 [0047.511] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.wav") returned 0 [0047.511] lstrlenA (lpString="*.wav") returned 5 [0047.511] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.flac") returned 0 [0047.511] lstrlenA (lpString="*.flac") returned 6 [0047.511] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.ape") returned 0 [0047.511] lstrlenA (lpString="*.ape") returned 5 [0047.511] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.wma") returned 0 [0047.511] lstrlenA (lpString="*.wma") returned 5 [0047.511] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.ac3") returned 0 [0047.511] lstrlenA (lpString="*.ac3") returned 5 [0047.511] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", pszSpec="*.mxf") returned 0 [0047.511] lstrlenA (lpString="*.mxf") returned 5 [0047.511] FindNextFileA (in: hFindFile=0x2d8148, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x460020, dwReserved1=0x4c0049, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0047.511] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.511] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="base_altgr.xml") returned 1 [0047.511] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_altgr.xml") returned 1 [0047.511] lstrcmpiA (lpString1="", lpString2="base_altgr.xml") returned -1 [0047.511] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned="baseAltGr_rtl.xml" [0047.511] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" [0047.511] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="" [0047.511] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0047.511] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0047.511] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="base_altgr.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" [0047.511] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.zip") returned 0 [0047.511] lstrlenA (lpString="*.zip") returned 5 [0047.511] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.rar") returned 0 [0047.511] lstrlenA (lpString="*.rar") returned 5 [0047.511] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.7z") returned 0 [0047.512] lstrlenA (lpString="*.7z") returned 4 [0047.512] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.tar") returned 0 [0047.512] lstrlenA (lpString="*.tar") returned 5 [0047.512] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.gzip") returned 0 [0047.512] lstrlenA (lpString="*.gzip") returned 6 [0047.512] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.jpg") returned 0 [0047.512] lstrlenA (lpString="*.jpg") returned 5 [0047.512] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.jpeg") returned 0 [0047.512] lstrlenA (lpString="*.jpeg") returned 6 [0047.512] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.psd") returned 0 [0047.512] lstrlenA (lpString="*.psd") returned 5 [0047.512] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.gif") returned 0 [0047.514] lstrlenA (lpString="*.gif") returned 5 [0047.514] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.doc") returned 0 [0047.514] lstrlenA (lpString="*.doc") returned 5 [0047.514] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.docx") returned 0 [0047.514] lstrlenA (lpString="*.docx") returned 6 [0047.514] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.xls") returned 0 [0047.514] lstrlenA (lpString="*.xls") returned 5 [0047.514] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.xlsx") returned 0 [0047.514] lstrlenA (lpString="*.xlsx") returned 6 [0047.514] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.ppt") returned 0 [0047.514] lstrlenA (lpString="*.ppt") returned 5 [0047.514] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.pptx") returned 0 [0047.514] lstrlenA (lpString="*.pptx") returned 6 [0047.514] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.pdf") returned 0 [0047.514] lstrlenA (lpString="*.pdf") returned 5 [0047.514] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.mov") returned 0 [0047.514] lstrlenA (lpString="*.mov") returned 5 [0047.514] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.m2v") returned 0 [0047.514] lstrlenA (lpString="*.m2v") returned 5 [0047.514] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.3gp") returned 0 [0047.514] lstrlenA (lpString="*.3gp") returned 5 [0047.514] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.mpeg") returned 0 [0047.514] lstrlenA (lpString="*.mpeg") returned 6 [0047.515] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.mpg") returned 0 [0047.515] lstrlenA (lpString="*.mpg") returned 5 [0047.515] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.flv") returned 0 [0047.515] lstrlenA (lpString="*.flv") returned 5 [0047.515] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.avi") returned 0 [0047.515] lstrlenA (lpString="*.avi") returned 5 [0047.515] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.mp4") returned 0 [0047.515] lstrlenA (lpString="*.mp4") returned 5 [0047.515] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.wmv") returned 0 [0047.515] lstrlenA (lpString="*.wmv") returned 5 [0047.515] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.divx") returned 0 [0047.515] lstrlenA (lpString="*.divx") returned 6 [0047.515] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.mkv") returned 0 [0047.515] lstrlenA (lpString="*.mkv") returned 5 [0047.515] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.mp3") returned 0 [0047.515] lstrlenA (lpString="*.mp3") returned 5 [0047.515] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.wav") returned 0 [0047.515] lstrlenA (lpString="*.wav") returned 5 [0047.515] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.flac") returned 0 [0047.515] lstrlenA (lpString="*.flac") returned 6 [0047.515] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.ape") returned 0 [0047.515] lstrlenA (lpString="*.ape") returned 5 [0047.515] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.wma") returned 0 [0047.515] lstrlenA (lpString="*.wma") returned 5 [0047.515] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.ac3") returned 0 [0047.515] lstrlenA (lpString="*.ac3") returned 5 [0047.515] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", pszSpec="*.mxf") returned 0 [0047.515] lstrlenA (lpString="*.mxf") returned 5 [0047.516] FindNextFileA (in: hFindFile=0x2d8148, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x460020, dwReserved1=0x4c0049, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0047.516] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.516] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="base_ca.xml") returned 1 [0047.516] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_ca.xml") returned 1 [0047.516] lstrcmpiA (lpString1="", lpString2="base_ca.xml") returned -1 [0047.516] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned="base_altgr.xml" [0047.516] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" [0047.516] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="" [0047.516] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0047.516] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0047.516] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="base_ca.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" [0047.516] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.zip") returned 0 [0047.516] lstrlenA (lpString="*.zip") returned 5 [0047.516] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.rar") returned 0 [0047.516] lstrlenA (lpString="*.rar") returned 5 [0047.516] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.7z") returned 0 [0047.516] lstrlenA (lpString="*.7z") returned 4 [0047.516] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.tar") returned 0 [0047.516] lstrlenA (lpString="*.tar") returned 5 [0047.516] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.gzip") returned 0 [0047.516] lstrlenA (lpString="*.gzip") returned 6 [0047.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.jpg") returned 0 [0047.517] lstrlenA (lpString="*.jpg") returned 5 [0047.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.jpeg") returned 0 [0047.517] lstrlenA (lpString="*.jpeg") returned 6 [0047.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.psd") returned 0 [0047.517] lstrlenA (lpString="*.psd") returned 5 [0047.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.gif") returned 0 [0047.517] lstrlenA (lpString="*.gif") returned 5 [0047.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.doc") returned 0 [0047.517] lstrlenA (lpString="*.doc") returned 5 [0047.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.docx") returned 0 [0047.517] lstrlenA (lpString="*.docx") returned 6 [0047.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.xls") returned 0 [0047.517] lstrlenA (lpString="*.xls") returned 5 [0047.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.xlsx") returned 0 [0047.517] lstrlenA (lpString="*.xlsx") returned 6 [0047.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.ppt") returned 0 [0047.517] lstrlenA (lpString="*.ppt") returned 5 [0047.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.pptx") returned 0 [0047.517] lstrlenA (lpString="*.pptx") returned 6 [0047.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.pdf") returned 0 [0047.517] lstrlenA (lpString="*.pdf") returned 5 [0047.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.mov") returned 0 [0047.517] lstrlenA (lpString="*.mov") returned 5 [0047.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.m2v") returned 0 [0047.517] lstrlenA (lpString="*.m2v") returned 5 [0047.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.3gp") returned 0 [0047.518] lstrlenA (lpString="*.3gp") returned 5 [0047.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.mpeg") returned 0 [0047.518] lstrlenA (lpString="*.mpeg") returned 6 [0047.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.mpg") returned 0 [0047.518] lstrlenA (lpString="*.mpg") returned 5 [0047.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.flv") returned 0 [0047.518] lstrlenA (lpString="*.flv") returned 5 [0047.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.avi") returned 0 [0047.518] lstrlenA (lpString="*.avi") returned 5 [0047.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.mp4") returned 0 [0047.518] lstrlenA (lpString="*.mp4") returned 5 [0047.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.wmv") returned 0 [0047.518] lstrlenA (lpString="*.wmv") returned 5 [0047.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.divx") returned 0 [0047.518] lstrlenA (lpString="*.divx") returned 6 [0047.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.mkv") returned 0 [0047.518] lstrlenA (lpString="*.mkv") returned 5 [0047.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.mp3") returned 0 [0047.518] lstrlenA (lpString="*.mp3") returned 5 [0047.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.wav") returned 0 [0047.518] lstrlenA (lpString="*.wav") returned 5 [0047.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.flac") returned 0 [0047.518] lstrlenA (lpString="*.flac") returned 6 [0047.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.ape") returned 0 [0047.518] lstrlenA (lpString="*.ape") returned 5 [0047.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.wma") returned 0 [0047.519] lstrlenA (lpString="*.wma") returned 5 [0047.519] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.ac3") returned 0 [0047.519] lstrlenA (lpString="*.ac3") returned 5 [0047.519] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", pszSpec="*.mxf") returned 0 [0047.519] lstrlenA (lpString="*.mxf") returned 5 [0047.519] FindNextFileA (in: hFindFile=0x2d8148, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x460020, dwReserved1=0x4c0049, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0047.519] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.519] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="base_heb.xml") returned 1 [0047.519] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_heb.xml") returned 1 [0047.519] lstrcmpiA (lpString1="", lpString2="base_heb.xml") returned -1 [0047.519] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned="base_ca.xml" [0047.519] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" [0047.519] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="" [0047.519] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0047.519] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0047.519] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="base_heb.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" [0047.519] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.zip") returned 0 [0047.519] lstrlenA (lpString="*.zip") returned 5 [0047.519] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.rar") returned 0 [0047.519] lstrlenA (lpString="*.rar") returned 5 [0047.519] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.7z") returned 0 [0047.519] lstrlenA (lpString="*.7z") returned 4 [0047.519] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.tar") returned 0 [0047.520] lstrlenA (lpString="*.tar") returned 5 [0047.520] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.gzip") returned 0 [0047.520] lstrlenA (lpString="*.gzip") returned 6 [0047.520] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.jpg") returned 0 [0047.520] lstrlenA (lpString="*.jpg") returned 5 [0047.520] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.jpeg") returned 0 [0047.520] lstrlenA (lpString="*.jpeg") returned 6 [0047.520] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.psd") returned 0 [0047.520] lstrlenA (lpString="*.psd") returned 5 [0047.520] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.gif") returned 0 [0047.520] lstrlenA (lpString="*.gif") returned 5 [0047.520] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.doc") returned 0 [0047.520] lstrlenA (lpString="*.doc") returned 5 [0047.520] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.docx") returned 0 [0047.520] lstrlenA (lpString="*.docx") returned 6 [0047.520] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.xls") returned 0 [0047.520] lstrlenA (lpString="*.xls") returned 5 [0047.520] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.xlsx") returned 0 [0047.520] lstrlenA (lpString="*.xlsx") returned 6 [0047.520] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.ppt") returned 0 [0047.520] lstrlenA (lpString="*.ppt") returned 5 [0047.520] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.pptx") returned 0 [0047.520] lstrlenA (lpString="*.pptx") returned 6 [0047.520] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.pdf") returned 0 [0047.520] lstrlenA (lpString="*.pdf") returned 5 [0047.520] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.mov") returned 0 [0047.520] lstrlenA (lpString="*.mov") returned 5 [0047.521] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.m2v") returned 0 [0047.521] lstrlenA (lpString="*.m2v") returned 5 [0047.521] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.3gp") returned 0 [0047.521] lstrlenA (lpString="*.3gp") returned 5 [0047.521] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.mpeg") returned 0 [0047.521] lstrlenA (lpString="*.mpeg") returned 6 [0047.521] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.mpg") returned 0 [0047.521] lstrlenA (lpString="*.mpg") returned 5 [0047.521] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.flv") returned 0 [0047.521] lstrlenA (lpString="*.flv") returned 5 [0047.521] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.avi") returned 0 [0047.521] lstrlenA (lpString="*.avi") returned 5 [0047.521] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.mp4") returned 0 [0047.521] lstrlenA (lpString="*.mp4") returned 5 [0047.521] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.wmv") returned 0 [0047.521] lstrlenA (lpString="*.wmv") returned 5 [0047.521] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.divx") returned 0 [0047.521] lstrlenA (lpString="*.divx") returned 6 [0047.521] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.mkv") returned 0 [0047.521] lstrlenA (lpString="*.mkv") returned 5 [0047.521] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.mp3") returned 0 [0047.521] lstrlenA (lpString="*.mp3") returned 5 [0047.521] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.wav") returned 0 [0047.521] lstrlenA (lpString="*.wav") returned 5 [0047.521] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.flac") returned 0 [0047.522] lstrlenA (lpString="*.flac") returned 6 [0047.522] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.ape") returned 0 [0047.522] lstrlenA (lpString="*.ape") returned 5 [0047.522] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.wma") returned 0 [0047.522] lstrlenA (lpString="*.wma") returned 5 [0047.522] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.ac3") returned 0 [0047.522] lstrlenA (lpString="*.ac3") returned 5 [0047.522] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", pszSpec="*.mxf") returned 0 [0047.522] lstrlenA (lpString="*.mxf") returned 5 [0047.522] FindNextFileA (in: hFindFile=0x2d8148, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x460020, dwReserved1=0x4c0049, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0047.522] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.522] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="base_jpn.xml") returned 1 [0047.522] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_jpn.xml") returned 1 [0047.522] lstrcmpiA (lpString1="", lpString2="base_jpn.xml") returned -1 [0047.522] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned="base_heb.xml" [0047.522] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" [0047.522] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="" [0047.522] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0047.522] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0047.522] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="base_jpn.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" [0047.522] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.zip") returned 0 [0047.522] lstrlenA (lpString="*.zip") returned 5 [0047.523] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.rar") returned 0 [0047.523] lstrlenA (lpString="*.rar") returned 5 [0047.523] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.7z") returned 0 [0047.523] lstrlenA (lpString="*.7z") returned 4 [0047.523] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.tar") returned 0 [0047.523] lstrlenA (lpString="*.tar") returned 5 [0047.523] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.gzip") returned 0 [0047.523] lstrlenA (lpString="*.gzip") returned 6 [0047.523] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.jpg") returned 0 [0047.523] lstrlenA (lpString="*.jpg") returned 5 [0047.523] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.jpeg") returned 0 [0047.523] lstrlenA (lpString="*.jpeg") returned 6 [0047.523] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.psd") returned 0 [0047.523] lstrlenA (lpString="*.psd") returned 5 [0047.523] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.gif") returned 0 [0047.523] lstrlenA (lpString="*.gif") returned 5 [0047.523] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.doc") returned 0 [0047.523] lstrlenA (lpString="*.doc") returned 5 [0047.523] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.docx") returned 0 [0047.523] lstrlenA (lpString="*.docx") returned 6 [0047.523] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.xls") returned 0 [0047.523] lstrlenA (lpString="*.xls") returned 5 [0047.523] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.xlsx") returned 0 [0047.523] lstrlenA (lpString="*.xlsx") returned 6 [0047.523] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.ppt") returned 0 [0047.523] lstrlenA (lpString="*.ppt") returned 5 [0047.524] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.pptx") returned 0 [0047.524] lstrlenA (lpString="*.pptx") returned 6 [0047.524] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.pdf") returned 0 [0047.524] lstrlenA (lpString="*.pdf") returned 5 [0047.524] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.mov") returned 0 [0047.524] lstrlenA (lpString="*.mov") returned 5 [0047.524] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.m2v") returned 0 [0047.524] lstrlenA (lpString="*.m2v") returned 5 [0047.524] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.3gp") returned 0 [0047.524] lstrlenA (lpString="*.3gp") returned 5 [0047.524] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.mpeg") returned 0 [0047.524] lstrlenA (lpString="*.mpeg") returned 6 [0047.524] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.mpg") returned 0 [0047.524] lstrlenA (lpString="*.mpg") returned 5 [0047.524] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.flv") returned 0 [0047.524] lstrlenA (lpString="*.flv") returned 5 [0047.524] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.avi") returned 0 [0047.524] lstrlenA (lpString="*.avi") returned 5 [0047.524] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.mp4") returned 0 [0047.524] lstrlenA (lpString="*.mp4") returned 5 [0047.524] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.wmv") returned 0 [0047.524] lstrlenA (lpString="*.wmv") returned 5 [0047.524] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.divx") returned 0 [0047.525] lstrlenA (lpString="*.divx") returned 6 [0047.525] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.mkv") returned 0 [0047.525] lstrlenA (lpString="*.mkv") returned 5 [0047.525] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.mp3") returned 0 [0047.525] lstrlenA (lpString="*.mp3") returned 5 [0047.525] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.wav") returned 0 [0047.525] lstrlenA (lpString="*.wav") returned 5 [0047.525] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.flac") returned 0 [0047.525] lstrlenA (lpString="*.flac") returned 6 [0047.525] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.ape") returned 0 [0047.525] lstrlenA (lpString="*.ape") returned 5 [0047.525] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.wma") returned 0 [0047.525] lstrlenA (lpString="*.wma") returned 5 [0047.525] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.ac3") returned 0 [0047.525] lstrlenA (lpString="*.ac3") returned 5 [0047.525] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", pszSpec="*.mxf") returned 0 [0047.525] lstrlenA (lpString="*.mxf") returned 5 [0047.525] FindNextFileA (in: hFindFile=0x2d8148, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x460020, dwReserved1=0x4c0049, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0047.525] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.525] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="base_kor.xml") returned 1 [0047.525] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_kor.xml") returned 1 [0047.525] lstrcmpiA (lpString1="", lpString2="base_kor.xml") returned -1 [0047.525] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned="base_jpn.xml" [0047.525] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" [0047.525] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="" [0047.525] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0047.526] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0047.526] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="base_kor.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" [0047.526] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.zip") returned 0 [0047.526] lstrlenA (lpString="*.zip") returned 5 [0047.526] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.rar") returned 0 [0047.526] lstrlenA (lpString="*.rar") returned 5 [0047.526] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.7z") returned 0 [0047.526] lstrlenA (lpString="*.7z") returned 4 [0047.526] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.tar") returned 0 [0047.526] lstrlenA (lpString="*.tar") returned 5 [0047.526] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.gzip") returned 0 [0047.526] lstrlenA (lpString="*.gzip") returned 6 [0047.526] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.jpg") returned 0 [0047.526] lstrlenA (lpString="*.jpg") returned 5 [0047.526] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.jpeg") returned 0 [0047.526] lstrlenA (lpString="*.jpeg") returned 6 [0047.526] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.psd") returned 0 [0047.526] lstrlenA (lpString="*.psd") returned 5 [0047.526] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.gif") returned 0 [0047.526] lstrlenA (lpString="*.gif") returned 5 [0047.526] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.doc") returned 0 [0047.527] lstrlenA (lpString="*.doc") returned 5 [0047.527] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.docx") returned 0 [0047.527] lstrlenA (lpString="*.docx") returned 6 [0047.527] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.xls") returned 0 [0047.527] lstrlenA (lpString="*.xls") returned 5 [0047.527] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.xlsx") returned 0 [0047.527] lstrlenA (lpString="*.xlsx") returned 6 [0047.527] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.ppt") returned 0 [0047.527] lstrlenA (lpString="*.ppt") returned 5 [0047.527] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.pptx") returned 0 [0047.527] lstrlenA (lpString="*.pptx") returned 6 [0047.527] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.pdf") returned 0 [0047.527] lstrlenA (lpString="*.pdf") returned 5 [0047.527] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.mov") returned 0 [0047.527] lstrlenA (lpString="*.mov") returned 5 [0047.527] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.m2v") returned 0 [0047.527] lstrlenA (lpString="*.m2v") returned 5 [0047.527] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.3gp") returned 0 [0047.527] lstrlenA (lpString="*.3gp") returned 5 [0047.527] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.mpeg") returned 0 [0047.527] lstrlenA (lpString="*.mpeg") returned 6 [0047.527] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.mpg") returned 0 [0047.528] lstrlenA (lpString="*.mpg") returned 5 [0047.528] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.flv") returned 0 [0047.528] lstrlenA (lpString="*.flv") returned 5 [0047.528] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.avi") returned 0 [0047.528] lstrlenA (lpString="*.avi") returned 5 [0047.528] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.mp4") returned 0 [0047.528] lstrlenA (lpString="*.mp4") returned 5 [0047.528] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.wmv") returned 0 [0047.528] lstrlenA (lpString="*.wmv") returned 5 [0047.528] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.divx") returned 0 [0047.528] lstrlenA (lpString="*.divx") returned 6 [0047.528] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.mkv") returned 0 [0047.528] lstrlenA (lpString="*.mkv") returned 5 [0047.528] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.mp3") returned 0 [0047.528] lstrlenA (lpString="*.mp3") returned 5 [0047.528] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.wav") returned 0 [0047.528] lstrlenA (lpString="*.wav") returned 5 [0047.528] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.flac") returned 0 [0047.528] lstrlenA (lpString="*.flac") returned 6 [0047.528] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.ape") returned 0 [0047.528] lstrlenA (lpString="*.ape") returned 5 [0047.528] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.wma") returned 0 [0047.529] lstrlenA (lpString="*.wma") returned 5 [0047.529] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.ac3") returned 0 [0047.529] lstrlenA (lpString="*.ac3") returned 5 [0047.529] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", pszSpec="*.mxf") returned 0 [0047.529] lstrlenA (lpString="*.mxf") returned 5 [0047.529] FindNextFileA (in: hFindFile=0x2d8148, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x460020, dwReserved1=0x4c0049, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0047.529] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.529] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="base_rtl.xml") returned 1 [0047.529] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_rtl.xml") returned 1 [0047.529] lstrcmpiA (lpString1="", lpString2="base_rtl.xml") returned -1 [0047.529] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned="base_kor.xml" [0047.529] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" [0047.529] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="" [0047.529] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0047.529] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0047.529] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="base_rtl.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" [0047.529] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", pszSpec="*.zip") returned 0 [0047.529] lstrlenA (lpString="*.zip") returned 5 [0047.529] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", pszSpec="*.rar") returned 0 [0047.529] lstrlenA (lpString="*.rar") returned 5 [0047.529] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", pszSpec="*.7z") returned 0 [0047.529] lstrlenA (lpString="*.7z") returned 4 [0047.529] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", pszSpec="*.tar") returned 0 [0047.530] lstrlenA (lpString="*.tar") returned 5 [0047.530] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", pszSpec="*.gzip") returned 0 [0047.530] lstrlenA (lpString="*.gzip") returned 6 [0047.530] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", pszSpec="*.jpg") returned 0 [0047.530] lstrlenA (lpString="*.jpg") returned 5 [0047.530] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", pszSpec="*.jpeg") returned 0 [0047.530] lstrlenA (lpString="*.jpeg") returned 6 [0047.530] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", pszSpec="*.psd") returned 0 [0047.530] lstrlenA (lpString="*.psd") returned 5 [0047.530] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", pszSpec="*.gif") returned 0 [0047.530] lstrlenA (lpString="*.gif") returned 5 [0047.530] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", pszSpec="*.doc") returned 0 [0047.530] lstrlenA (lpString="*.doc") returned 5 [0047.530] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", pszSpec="*.docx") returned 0 [0047.530] FindNextFileA (in: hFindFile=0x2d8148, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x460020, dwReserved1=0x4c0049, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0047.530] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.532] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ja-jp.xml") returned -1 [0047.532] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ja-jp.xml") returned -1 [0047.532] lstrcmpiA (lpString1="", lpString2="ja-jp.xml") returned -1 [0047.532] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned="base_rtl.xml" [0047.532] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" [0047.532] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="" [0047.532] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0047.532] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0047.532] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="ja-jp.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" [0047.532] FindNextFileA (in: hFindFile=0x2d8148, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x460020, dwReserved1=0x4c0049, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0047.532] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.532] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ko-kr.xml") returned -1 [0047.532] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ko-kr.xml") returned -1 [0047.532] lstrcmpiA (lpString1="", lpString2="ko-kr.xml") returned -1 [0047.532] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned="ja-jp.xml" [0047.532] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" [0047.532] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="" [0047.532] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0047.532] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0047.533] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="ko-kr.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" [0047.533] FindNextFileA (in: hFindFile=0x2d8148, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f774659, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x460020, dwReserved1=0x4c0049, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0047.533] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.533] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="zh-changjei.xml") returned -1 [0047.533] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="zh-changjei.xml") returned -1 [0047.533] lstrcmpiA (lpString1="", lpString2="zh-changjei.xml") returned -1 [0047.533] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned="ko-kr.xml" [0047.533] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" [0047.533] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="" [0047.533] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0047.533] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0047.533] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="zh-changjei.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" [0047.533] FindNextFileA (in: hFindFile=0x2d8148, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x460020, dwReserved1=0x4c0049, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0047.533] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.533] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="zh-dayi.xml") returned -1 [0047.533] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="zh-dayi.xml") returned -1 [0047.533] lstrcmpiA (lpString1="", lpString2="zh-dayi.xml") returned -1 [0047.533] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned="zh-changjei.xml" [0047.533] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" [0047.533] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="" [0047.533] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0047.534] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0047.534] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="zh-dayi.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" [0047.534] FindNextFileA (in: hFindFile=0x2d8148, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x460020, dwReserved1=0x4c0049, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0047.534] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.534] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="zh-phonetic.xml") returned -1 [0047.534] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="zh-phonetic.xml") returned -1 [0047.534] lstrcmpiA (lpString1="", lpString2="zh-phonetic.xml") returned -1 [0047.534] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned="zh-dayi.xml" [0047.534] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" [0047.534] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned="" [0047.534] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" [0047.534] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\how to decrypt files.txt")) returned 0x20 [0047.534] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="zh-phonetic.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" [0047.534] FindNextFileA (in: hFindFile=0x2d8148, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x460020, dwReserved1=0x4c0049, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0047.534] FindClose (in: hFindFile=0x2d8148 | out: hFindFile=0x2d8148) returned 1 [0047.535] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="main.xml", cAlternateFileName="")) returned 1 [0047.535] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.535] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="main.xml") returned -1 [0047.535] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="main.xml") returned -1 [0047.535] lstrcmpiA (lpString1="", lpString2="main.xml") returned -1 [0047.535] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0047.535] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" [0047.535] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="" [0047.535] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0047.535] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0047.535] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="main.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" [0047.535] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="numbers", cAlternateFileName="")) returned 1 [0047.535] lstrcmpA (lpString1=".", lpString2="numbers") returned -1 [0047.535] lstrcmpA (lpString1="..", lpString2="numbers") returned -1 [0047.535] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned="main.xml" [0047.535] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="numbers" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers" [0047.535] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d815a, cFileName=".", cAlternateFileName="")) returned 0x2d8150 [0047.536] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.536] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.536] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.536] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.536] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0047.536] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.536] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="numbase.xml") returned -1 [0047.536] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="numbase.xml") returned -1 [0047.536] lstrcmpiA (lpString1="", lpString2="numbase.xml") returned -1 [0047.536] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*") returned="*.*" [0047.536] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\" [0047.536] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\") returned="" [0047.536] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\HOW TO DECRYPT FILES.txt" [0047.536] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\how to decrypt files.txt")) returned 0xffffffff [0047.536] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0047.541] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.541] CloseHandle (hObject=0x94) returned 1 [0047.542] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", lpString2="numbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" [0047.542] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 0 [0047.542] FindClose (in: hFindFile=0x2d8150 | out: hFindFile=0x2d8150) returned 1 [0047.542] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0047.542] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.542] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="numbers.xml") returned -1 [0047.542] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="numbers.xml") returned -1 [0047.542] lstrcmpiA (lpString1="", lpString2="numbers.xml") returned -1 [0047.542] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0047.542] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" [0047.542] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="" [0047.542] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0047.542] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0047.542] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="numbers.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" [0047.542] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0047.542] lstrcmpA (lpString1=".", lpString2="oskmenu") returned -1 [0047.543] lstrcmpA (lpString1="..", lpString2="oskmenu") returned -1 [0047.543] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned="numbers.xml" [0047.543] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="oskmenu" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu" [0047.543] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d815a, cFileName=".", cAlternateFileName="")) returned 0x2d8150 [0047.544] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.544] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.544] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.544] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.544] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0047.544] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.544] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="oskmenubase.xml") returned -1 [0047.544] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oskmenubase.xml") returned -1 [0047.544] lstrcmpiA (lpString1="", lpString2="oskmenubase.xml") returned -1 [0047.544] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*") returned="*.*" [0047.544] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\" [0047.545] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\") returned="" [0047.545] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\HOW TO DECRYPT FILES.txt" [0047.545] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\how to decrypt files.txt")) returned 0xffffffff [0047.545] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0047.546] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.546] CloseHandle (hObject=0x94) returned 1 [0047.547] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", lpString2="oskmenubase.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" [0047.547] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0047.547] FindClose (in: hFindFile=0x2d8150 | out: hFindFile=0x2d8150) returned 1 [0047.547] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0047.547] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.547] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="oskmenu.xml") returned -1 [0047.547] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oskmenu.xml") returned -1 [0047.547] lstrcmpiA (lpString1="", lpString2="oskmenu.xml") returned -1 [0047.547] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0047.547] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" [0047.547] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="" [0047.547] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0047.547] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0047.547] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="oskmenu.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" [0047.548] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0047.548] lstrcmpA (lpString1=".", lpString2="osknumpad") returned -1 [0047.548] lstrcmpA (lpString1="..", lpString2="osknumpad") returned -1 [0047.548] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned="oskmenu.xml" [0047.548] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="osknumpad" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad" [0047.548] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d815a, cFileName=".", cAlternateFileName="")) returned 0x2d8150 [0047.548] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.548] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.548] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.548] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.548] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0047.548] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.548] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="osknumpadbase.xml") returned -1 [0047.548] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="osknumpadbase.xml") returned -1 [0047.548] lstrcmpiA (lpString1="", lpString2="osknumpadbase.xml") returned -1 [0047.548] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*") returned="*.*" [0047.548] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\" [0047.549] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\") returned="" [0047.549] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\HOW TO DECRYPT FILES.txt" [0047.549] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\how to decrypt files.txt")) returned 0xffffffff [0047.549] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0047.550] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.551] CloseHandle (hObject=0x94) returned 1 [0047.551] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", lpString2="osknumpadbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" [0047.551] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0047.551] FindClose (in: hFindFile=0x2d8150 | out: hFindFile=0x2d8150) returned 1 [0047.551] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0047.551] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.551] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="osknumpad.xml") returned -1 [0047.551] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="osknumpad.xml") returned -1 [0047.551] lstrcmpiA (lpString1="", lpString2="osknumpad.xml") returned -1 [0047.551] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0047.551] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" [0047.551] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="" [0047.551] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0047.551] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0047.552] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="osknumpad.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" [0047.552] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="oskpred", cAlternateFileName="")) returned 1 [0047.552] lstrcmpA (lpString1=".", lpString2="oskpred") returned -1 [0047.552] lstrcmpA (lpString1="..", lpString2="oskpred") returned -1 [0047.552] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned="osknumpad.xml" [0047.552] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="oskpred" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred" [0047.552] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d815a, cFileName=".", cAlternateFileName="")) returned 0x2d8150 [0047.552] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.552] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.552] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.552] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.552] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0047.552] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.552] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="oskpredbase.xml") returned -1 [0047.553] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oskpredbase.xml") returned -1 [0047.553] lstrcmpiA (lpString1="", lpString2="oskpredbase.xml") returned -1 [0047.553] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*") returned="*.*" [0047.553] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\" [0047.553] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\") returned="" [0047.553] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\HOW TO DECRYPT FILES.txt" [0047.553] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\how to decrypt files.txt")) returned 0xffffffff [0047.553] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0047.554] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.554] CloseHandle (hObject=0x94) returned 1 [0047.555] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", lpString2="oskpredbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" [0047.555] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0047.555] FindClose (in: hFindFile=0x2d8150 | out: hFindFile=0x2d8150) returned 1 [0047.555] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0047.555] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.555] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="oskpred.xml") returned -1 [0047.555] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oskpred.xml") returned -1 [0047.555] lstrcmpiA (lpString1="", lpString2="oskpred.xml") returned -1 [0047.555] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0047.555] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" [0047.555] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="" [0047.555] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0047.555] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0047.555] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="oskpred.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" [0047.555] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="symbols", cAlternateFileName="")) returned 1 [0047.556] lstrcmpA (lpString1=".", lpString2="symbols") returned -1 [0047.556] lstrcmpA (lpString1="..", lpString2="symbols") returned -1 [0047.556] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned="oskpred.xml" [0047.556] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="symbols" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols" [0047.556] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d815a, cFileName=".", cAlternateFileName="")) returned 0x2d8150 [0047.556] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.556] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.556] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.556] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.556] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0047.556] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.556] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ea-sym.xml") returned -1 [0047.556] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ea-sym.xml") returned 1 [0047.556] lstrcmpiA (lpString1="", lpString2="ea-sym.xml") returned -1 [0047.556] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*") returned="*.*" [0047.556] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\" [0047.557] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\") returned="" [0047.557] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt" [0047.557] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\how to decrypt files.txt")) returned 0xffffffff [0047.557] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0047.559] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.559] CloseHandle (hObject=0x94) returned 1 [0047.560] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", lpString2="ea-sym.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" [0047.560] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x2d8488, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0047.560] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.560] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ja-jp-sym.xml") returned -1 [0047.560] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ja-jp-sym.xml") returned -1 [0047.560] lstrcmpiA (lpString1="", lpString2="ja-jp-sym.xml") returned -1 [0047.560] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned="ea-sym.xml" [0047.560] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\" [0047.560] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\") returned="" [0047.560] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt" [0047.560] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\how to decrypt files.txt")) returned 0x20 [0047.560] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", lpString2="ja-jp-sym.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" [0047.560] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0047.560] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.560] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="symbase.xml") returned -1 [0047.560] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="symbase.xml") returned -1 [0047.560] lstrcmpiA (lpString1="", lpString2="symbase.xml") returned -1 [0047.560] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned="ja-jp-sym.xml" [0047.561] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\" [0047.561] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\") returned="" [0047.561] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt" [0047.561] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\how to decrypt files.txt")) returned 0x20 [0047.561] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", lpString2="symbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" [0047.561] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0047.561] FindClose (in: hFindFile=0x2d8150 | out: hFindFile=0x2d8150) returned 1 [0047.561] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0047.561] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.561] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="symbols.xml") returned -1 [0047.561] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="symbols.xml") returned -1 [0047.561] lstrcmpiA (lpString1="", lpString2="symbols.xml") returned -1 [0047.561] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0047.561] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" [0047.561] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="" [0047.561] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0047.561] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0047.562] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="symbols.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" [0047.562] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="web", cAlternateFileName="")) returned 1 [0047.562] lstrcmpA (lpString1=".", lpString2="web") returned -1 [0047.562] lstrcmpA (lpString1="..", lpString2="web") returned -1 [0047.562] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned="symbols.xml" [0047.562] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="web" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web" [0047.562] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d815a, cFileName=".", cAlternateFileName="")) returned 0x2d8148 [0047.563] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.563] FindNextFileA (in: hFindFile=0x2d8148, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.563] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.563] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.563] FindNextFileA (in: hFindFile=0x2d8148, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0047.563] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.563] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="webbase.xml") returned -1 [0047.563] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="webbase.xml") returned -1 [0047.563] lstrcmpiA (lpString1="", lpString2="webbase.xml") returned -1 [0047.563] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*") returned="*.*" [0047.563] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\" [0047.563] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\") returned="" [0047.563] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\HOW TO DECRYPT FILES.txt" [0047.563] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\how to decrypt files.txt")) returned 0xffffffff [0047.564] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0047.565] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.565] CloseHandle (hObject=0x94) returned 1 [0047.565] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", lpString2="webbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" [0047.565] FindNextFileA (in: hFindFile=0x2d8148, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 0 [0047.566] FindClose (in: hFindFile=0x2d8148 | out: hFindFile=0x2d8148) returned 1 [0047.566] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="web.xml", cAlternateFileName="")) returned 1 [0047.566] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.566] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="web.xml") returned -1 [0047.566] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="web.xml") returned -1 [0047.566] lstrcmpiA (lpString1="", lpString2="web.xml") returned -1 [0047.566] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0047.566] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" [0047.566] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned="" [0047.566] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" [0047.566] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\how to decrypt files.txt")) returned 0x20 [0047.566] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="web.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" [0047.566] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="web.xml", cAlternateFileName="")) returned 0 [0047.566] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.566] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="he-IL", cAlternateFileName="")) returned 1 [0047.566] lstrcmpA (lpString1=".", lpString2="he-IL") returned -1 [0047.566] lstrcmpA (lpString1="..", lpString2="he-IL") returned -1 [0047.567] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.567] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="he-IL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL" [0047.567] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.567] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.567] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x780000, cFileName="..", cAlternateFileName="")) returned 1 [0047.567] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.567] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.567] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.567] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.567] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0047.567] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0047.568] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0047.568] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*") returned="*.*" [0047.568] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\" [0047.568] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\") returned="" [0047.568] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\HOW TO DECRYPT FILES.txt" [0047.568] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\how to decrypt files.txt")) returned 0xffffffff [0047.568] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.569] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.569] CloseHandle (hObject=0x90) returned 1 [0047.570] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" [0047.570] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.570] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.570] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0047.570] lstrcmpA (lpString1=".", lpString2="hr-HR") returned -1 [0047.570] lstrcmpA (lpString1="..", lpString2="hr-HR") returned -1 [0047.570] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.570] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="hr-HR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR" [0047.570] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8380, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.570] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.570] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.570] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.570] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.570] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.570] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.571] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0047.571] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0047.571] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0047.571] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*") returned="*.*" [0047.571] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\" [0047.571] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\") returned="" [0047.571] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\HOW TO DECRYPT FILES.txt" [0047.571] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\how to decrypt files.txt")) returned 0xffffffff [0047.571] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.572] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.572] CloseHandle (hObject=0x90) returned 1 [0047.572] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" [0047.572] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.572] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.572] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0047.572] lstrcmpA (lpString1=".", lpString2="hu-HU") returned -1 [0047.572] lstrcmpA (lpString1="..", lpString2="hu-HU") returned -1 [0047.572] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.573] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="hu-HU" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU" [0047.573] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8380, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.573] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.573] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.573] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.573] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.573] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.573] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.573] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0047.573] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0047.573] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0047.573] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*") returned="*.*" [0047.573] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\" [0047.573] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\") returned="" [0047.573] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\HOW TO DECRYPT FILES.txt" [0047.573] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\how to decrypt files.txt")) returned 0xffffffff [0047.573] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.577] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.577] CloseHandle (hObject=0x90) returned 1 [0047.577] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" [0047.577] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.577] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.578] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0047.578] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.578] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hwrcommonlm.dat") returned -1 [0047.578] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hwrcommonlm.dat") returned -1 [0047.578] lstrcmpiA (lpString1="", lpString2="hwrcommonlm.dat") returned -1 [0047.578] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.578] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.578] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.578] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.578] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.578] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="hwrcommonlm.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" [0047.578] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0047.578] lstrcmpA (lpString1=".", lpString2="HWRCustomization") returned -1 [0047.578] lstrcmpA (lpString1="..", lpString2="HWRCustomization") returned -1 [0047.578] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned="hwrcommonlm.dat" [0047.578] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HWRCustomization" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization" [0047.578] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d813e, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.579] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.579] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.579] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.579] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.579] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 0 [0047.579] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.579] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x570048, dwReserved1=0x3, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1 [0047.579] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.580] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hwrenalm.dat") returned -1 [0047.580] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hwrenalm.dat") returned -1 [0047.580] lstrcmpiA (lpString1="", lpString2="hwrenalm.dat") returned -1 [0047.580] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.580] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.580] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.580] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.580] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.580] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="hwrenalm.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" [0047.580] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33535c00, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x33535c00, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x332fa78d, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xc7240, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0047.580] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.580] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hwrenclm.dat") returned -1 [0047.580] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hwrenclm.dat") returned -1 [0047.580] lstrcmpiA (lpString1="", lpString2="hwrenclm.dat") returned -1 [0047.580] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned="hwrenalm.dat" [0047.580] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.580] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.580] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.580] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.580] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="hwrenclm.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" [0047.580] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd661d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x32bd661d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x32a7f9d8, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x10ca50, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0047.580] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.580] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hwrlatinlm.dat") returned -1 [0047.580] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hwrlatinlm.dat") returned -1 [0047.580] lstrcmpiA (lpString1="", lpString2="hwrlatinlm.dat") returned -1 [0047.580] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned="hwrenclm.dat" [0047.581] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.581] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.581] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.581] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.581] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="hwrlatinlm.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" [0047.581] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94dbb3, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3d94dbb3, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3c28ab1e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2e99a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruklm.dat", cAlternateFileName="")) returned 1 [0047.581] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.581] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hwruklm.dat") returned -1 [0047.581] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hwruklm.dat") returned -1 [0047.581] lstrcmpiA (lpString1="", lpString2="hwruklm.dat") returned -1 [0047.581] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned="hwrlatinlm.dat" [0047.581] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.581] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.581] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.581] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.581] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="hwruklm.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" [0047.581] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruksh.dat", cAlternateFileName="")) returned 1 [0047.581] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.581] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hwruksh.dat") returned -1 [0047.581] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hwruksh.dat") returned -1 [0047.581] lstrcmpiA (lpString1="", lpString2="hwruksh.dat") returned -1 [0047.581] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned="hwruklm.dat" [0047.581] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.581] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.581] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.581] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.582] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="hwruksh.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" [0047.582] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0047.582] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.582] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hwrusalm.dat") returned -1 [0047.582] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hwrusalm.dat") returned -1 [0047.582] lstrcmpiA (lpString1="", lpString2="hwrusalm.dat") returned -1 [0047.582] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned="hwruksh.dat" [0047.582] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.582] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.582] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.582] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.582] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="hwrusalm.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" [0047.582] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbfb43d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3dbfb43d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3da7e69b, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x3ee0d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0047.582] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.582] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hwrusash.dat") returned -1 [0047.582] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hwrusash.dat") returned -1 [0047.582] lstrcmpiA (lpString1="", lpString2="hwrusash.dat") returned -1 [0047.582] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned="hwrusalm.dat" [0047.582] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.582] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.582] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.582] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.582] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="hwrusash.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" [0047.582] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4bfb78, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x4c4bfb78, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x298e8420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0047.582] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.582] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InkDiv.dll") returned -1 [0047.583] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InkDiv.dll") returned -1 [0047.583] lstrcmpiA (lpString1="", lpString2="InkDiv.dll") returned -1 [0047.583] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned="hwrusash.dat" [0047.583] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.583] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.583] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.583] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.583] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="InkDiv.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll" [0047.583] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c412911, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c412911, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29a8c2e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x201800, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0047.583] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.583] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InkObj.dll") returned -1 [0047.583] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InkObj.dll") returned -1 [0047.583] lstrcmpiA (lpString1="", lpString2="InkObj.dll") returned -1 [0047.583] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll") returned="InkDiv.dll" [0047.583] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.583] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.583] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.583] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.583] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="InkObj.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" [0047.583] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eab8150, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5eab8150, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe4490e80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe", cAlternateFileName="")) returned 1 [0047.583] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.583] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InkWatson.exe") returned -1 [0047.583] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InkWatson.exe") returned -1 [0047.583] lstrcmpiA (lpString1="", lpString2="InkWatson.exe") returned -1 [0047.583] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned="InkObj.dll" [0047.583] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.583] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.583] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.584] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.584] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="InkWatson.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe" [0047.584] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7700d105, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7700d105, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe45c2150, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0047.584] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.584] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InputPersonalization.exe") returned -1 [0047.584] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InputPersonalization.exe") returned -1 [0047.584] lstrcmpiA (lpString1="", lpString2="InputPersonalization.exe") returned -1 [0047.584] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned="InkWatson.exe" [0047.584] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.584] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.584] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.584] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.584] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="InputPersonalization.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe" [0047.584] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865215, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x91865215, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0047.584] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.584] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipscat.xml") returned -1 [0047.584] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipscat.xml") returned -1 [0047.584] lstrcmpiA (lpString1="", lpString2="ipscat.xml") returned -1 [0047.584] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned="InputPersonalization.exe" [0047.584] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.584] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.584] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.584] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.584] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipscat.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" [0047.584] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27bfdab7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27bfdab7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0047.585] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.585] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipschs.xml") returned -1 [0047.585] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipschs.xml") returned -1 [0047.585] lstrcmpiA (lpString1="", lpString2="ipschs.xml") returned -1 [0047.585] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned="ipscat.xml" [0047.585] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.585] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.585] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.585] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.585] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipschs.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" [0047.585] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0047.585] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.585] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipscht.xml") returned -1 [0047.585] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipscht.xml") returned -1 [0047.585] lstrcmpiA (lpString1="", lpString2="ipscht.xml") returned -1 [0047.585] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned="ipschs.xml" [0047.585] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.585] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.585] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.585] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.585] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipscht.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" [0047.585] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0047.585] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.585] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ipscsy.xml") returned -1 [0047.585] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ipscsy.xml") returned -1 [0047.586] lstrcmpiA (lpString1="", lpString2="ipscsy.xml") returned -1 [0047.586] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned="ipscht.xml" [0047.586] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.586] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.586] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.586] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.586] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipscsy.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" [0047.586] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0047.586] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.586] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned="ipscsy.xml" [0047.586] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.586] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.586] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.586] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.586] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsdan.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" [0047.586] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0047.586] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.586] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned="ipsdan.xml" [0047.586] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.586] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.586] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.586] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.587] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsdeu.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" [0047.587] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c6fece, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c6fece, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0047.587] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.587] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned="ipsdeu.xml" [0047.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.587] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.587] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.587] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.587] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsen.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" [0047.587] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0047.587] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.587] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned="ipsen.xml" [0047.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.587] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.587] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.587] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.587] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsesp.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" [0047.587] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58cd8515, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x58cd8515, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x5ca35e50, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0047.587] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.587] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned="ipsesp.xml" [0047.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.587] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.587] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.587] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.588] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="IPSEventLogMsg.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" [0047.588] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c9602b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c9602b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0047.588] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.588] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned="IPSEventLogMsg.dll" [0047.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.588] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.588] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.588] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.588] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsfin.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" [0047.588] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0047.588] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.588] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned="ipsfin.xml" [0047.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.588] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.588] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.588] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.588] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsfra.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" [0047.588] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0047.588] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.588] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned="ipsfra.xml" [0047.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.588] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.588] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.589] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.589] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipshrv.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" [0047.589] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0047.589] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.589] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned="ipshrv.xml" [0047.589] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.589] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.589] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.589] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.589] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsita.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" [0047.589] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d08442, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d08442, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9188b373, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0047.589] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.589] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned="ipsita.xml" [0047.589] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.589] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.589] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.589] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.589] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsjpn.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" [0047.589] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0047.589] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.589] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned="ipsjpn.xml" [0047.589] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.589] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.589] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.589] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.590] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipskor.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" [0047.590] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc49d13, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5dc49d13, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a1fc7a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0047.590] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.590] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned="ipskor.xml" [0047.590] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.590] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.590] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.590] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.590] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="IpsMigrationPlugin.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll" [0047.590] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0047.590] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.590] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned="IpsMigrationPlugin.dll" [0047.590] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.590] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.590] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.590] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.590] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsnld.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" [0047.591] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0047.591] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.591] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned="ipsnld.xml" [0047.591] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.591] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.591] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.591] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.591] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsnor.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" [0047.591] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0047.591] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.591] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned="ipsnor.xml" [0047.591] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.591] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.591] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.591] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.591] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsplk.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" [0047.591] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63de1b63, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x63de1b63, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a991650, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0047.591] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.597] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned="ipsplk.xml" [0047.597] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.597] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.597] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.597] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.597] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="IpsPlugin.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" [0047.597] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0047.597] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.597] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned="IpsPlugin.dll" [0047.597] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.597] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.597] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.597] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.597] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsptb.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" [0047.597] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0047.597] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.597] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned="ipsptb.xml" [0047.597] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.597] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.597] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.597] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.598] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsptg.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" [0047.598] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0047.598] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.598] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned="ipsptg.xml" [0047.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.598] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.598] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.598] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.598] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsrom.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" [0047.598] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0047.598] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.598] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned="ipsrom.xml" [0047.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.598] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.598] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.598] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.598] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsrus.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" [0047.598] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0047.598] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.598] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned="ipsrus.xml" [0047.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.598] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.598] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.599] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.599] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipssrb.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" [0047.599] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0047.599] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.599] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned="ipssrb.xml" [0047.599] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.599] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.599] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.599] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.599] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipssrl.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" [0047.599] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0047.599] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.599] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned="ipssrl.xml" [0047.599] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.599] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.599] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.599] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.599] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipssve.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" [0047.599] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0047.599] lstrcmpA (lpString1=".", lpString2="it-IT") returned -1 [0047.599] lstrcmpA (lpString1="..", lpString2="it-IT") returned -1 [0047.599] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned="ipssve.xml" [0047.599] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="it-IT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT" [0047.599] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d813e, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.600] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.600] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.600] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.600] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.600] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.600] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.600] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*") returned="*.*" [0047.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\" [0047.600] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\") returned="" [0047.600] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\HOW TO DECRYPT FILES.txt" [0047.600] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\how to decrypt files.txt")) returned 0xffffffff [0047.600] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.602] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.602] CloseHandle (hObject=0x90) returned 1 [0047.602] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" [0047.602] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.602] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.602] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0047.602] lstrcmpA (lpString1=".", lpString2="ja-JP") returned -1 [0047.602] lstrcmpA (lpString1="..", lpString2="ja-JP") returned -1 [0047.602] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.602] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ja-JP" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP" [0047.602] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8380, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.603] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.603] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.603] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.603] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.603] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.603] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.603] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*") returned="*.*" [0047.603] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\" [0047.603] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\") returned="" [0047.603] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\HOW TO DECRYPT FILES.txt" [0047.603] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\how to decrypt files.txt")) returned 0xffffffff [0047.603] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.604] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.605] CloseHandle (hObject=0x90) returned 1 [0047.605] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" [0047.605] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.605] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.605] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0047.605] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.605] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.605] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.605] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.605] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.605] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.605] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="journal.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" [0047.605] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0047.605] lstrcmpA (lpString1=".", lpString2="ko-KR") returned -1 [0047.605] lstrcmpA (lpString1="..", lpString2="ko-KR") returned -1 [0047.605] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll") returned="journal.dll" [0047.605] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ko-KR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR" [0047.605] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d813e, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.606] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.606] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.606] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.606] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.606] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.606] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.606] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*") returned="*.*" [0047.606] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\" [0047.606] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\") returned="" [0047.606] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\HOW TO DECRYPT FILES.txt" [0047.606] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\how to decrypt files.txt")) returned 0xffffffff [0047.607] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.608] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.608] CloseHandle (hObject=0x90) returned 1 [0047.608] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" [0047.608] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.608] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.608] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0047.608] lstrcmpA (lpString1=".", lpString2="lt-LT") returned -1 [0047.608] lstrcmpA (lpString1="..", lpString2="lt-LT") returned -1 [0047.608] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.609] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="lt-LT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT" [0047.609] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8380, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.610] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.610] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.610] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.610] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.610] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.610] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.610] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*") returned="*.*" [0047.610] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\" [0047.610] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\") returned="" [0047.610] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\HOW TO DECRYPT FILES.txt" [0047.610] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\how to decrypt files.txt")) returned 0xffffffff [0047.610] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.611] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.612] CloseHandle (hObject=0x90) returned 1 [0047.612] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" [0047.612] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.612] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.612] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0047.612] lstrcmpA (lpString1=".", lpString2="lv-LV") returned -1 [0047.612] lstrcmpA (lpString1="..", lpString2="lv-LV") returned -1 [0047.612] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.612] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="lv-LV" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV" [0047.612] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8380, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.613] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.613] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.613] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.613] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.613] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.613] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.613] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*") returned="*.*" [0047.613] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\" [0047.613] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\") returned="" [0047.613] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\HOW TO DECRYPT FILES.txt" [0047.613] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\how to decrypt files.txt")) returned 0xffffffff [0047.613] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.614] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.614] CloseHandle (hObject=0x90) returned 1 [0047.614] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" [0047.614] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.614] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.615] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e22d6e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x69e22d6e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x3188e7b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a0200, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0047.615] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.615] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.615] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.615] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.615] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.615] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.615] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="micaut.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" [0047.615] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472c5956, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0xa4945a00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x9fcc4285, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0047.615] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.615] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll") returned="micaut.dll" [0047.615] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.615] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.615] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.615] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.615] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="Microsoft.Ink.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" [0047.615] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12394d3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa12394d3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa125f634, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x179c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0047.615] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.615] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned="Microsoft.Ink.dll" [0047.615] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.616] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.616] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.616] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.616] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="mip.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe" [0047.616] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ad46e47, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5ad46e47, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x344e2230, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x609c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0047.616] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.616] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned="mip.exe" [0047.616] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.616] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.616] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.616] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.616] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="mraut.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" [0047.616] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66c00201, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x66c00201, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x34eb4c90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0047.616] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.616] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.616] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.616] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.616] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.616] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="mshwgst.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll" [0047.616] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901e133e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x901e133e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x353c2bb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x105a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0047.616] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.616] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.617] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.617] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.617] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.617] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="mshwLatin.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll" [0047.617] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0047.617] lstrcmpA (lpString1=".", lpString2="nb-NO") returned -1 [0047.617] lstrcmpA (lpString1="..", lpString2="nb-NO") returned -1 [0047.617] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="nb-NO" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO" [0047.617] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d813e, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.617] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.617] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.617] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.617] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.617] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.617] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.617] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\" [0047.618] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\") returned="" [0047.618] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\HOW TO DECRYPT FILES.txt" [0047.618] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\how to decrypt files.txt")) returned 0xffffffff [0047.618] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.620] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.620] CloseHandle (hObject=0x90) returned 1 [0047.620] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" [0047.620] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.620] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.620] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0047.620] lstrcmpA (lpString1=".", lpString2="nl-NL") returned -1 [0047.620] lstrcmpA (lpString1="..", lpString2="nl-NL") returned -1 [0047.620] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="nl-NL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL" [0047.620] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8380, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.621] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.621] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.621] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.621] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.621] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.621] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.621] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\" [0047.621] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\") returned="" [0047.621] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\HOW TO DECRYPT FILES.txt" [0047.621] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\how to decrypt files.txt")) returned 0xffffffff [0047.621] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.631] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.631] CloseHandle (hObject=0x90) returned 1 [0047.631] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" [0047.631] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.631] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.631] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0047.631] lstrcmpA (lpString1=".", lpString2="pl-PL") returned -1 [0047.631] lstrcmpA (lpString1="..", lpString2="pl-PL") returned -1 [0047.631] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="pl-PL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL" [0047.631] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8380, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.633] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.633] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.633] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.633] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.633] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.633] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.633] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\" [0047.633] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\") returned="" [0047.633] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\HOW TO DECRYPT FILES.txt" [0047.633] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\how to decrypt files.txt")) returned 0xffffffff [0047.633] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.634] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.634] CloseHandle (hObject=0x90) returned 1 [0047.635] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" [0047.635] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.635] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.636] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0047.636] lstrcmpA (lpString1=".", lpString2="pt-BR") returned -1 [0047.636] lstrcmpA (lpString1="..", lpString2="pt-BR") returned -1 [0047.636] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="pt-BR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR" [0047.636] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8380, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.636] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.636] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.637] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.637] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.637] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.637] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.637] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\" [0047.637] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\") returned="" [0047.637] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\HOW TO DECRYPT FILES.txt" [0047.637] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\how to decrypt files.txt")) returned 0xffffffff [0047.637] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.637] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0047.637] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0047.639] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.639] CloseHandle (hObject=0x90) returned 1 [0047.639] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" [0047.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0047.639] lstrlenA (lpString="*.zip") returned 5 [0047.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0047.639] lstrlenA (lpString="*.rar") returned 5 [0047.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0047.639] lstrlenA (lpString="*.7z") returned 4 [0047.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0047.639] lstrlenA (lpString="*.tar") returned 5 [0047.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0047.639] lstrlenA (lpString="*.gzip") returned 6 [0047.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0047.639] lstrlenA (lpString="*.jpg") returned 5 [0047.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0047.639] lstrlenA (lpString="*.jpeg") returned 6 [0047.640] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0047.640] lstrlenA (lpString="*.psd") returned 5 [0047.640] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0047.640] lstrlenA (lpString="*.gif") returned 5 [0047.640] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0047.640] lstrlenA (lpString="*.doc") returned 5 [0047.640] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0047.640] lstrlenA (lpString="*.docx") returned 6 [0047.640] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0047.640] lstrlenA (lpString="*.xls") returned 5 [0047.640] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0047.640] lstrlenA (lpString="*.xlsx") returned 6 [0047.640] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0047.640] lstrlenA (lpString="*.ppt") returned 5 [0047.640] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0047.640] lstrlenA (lpString="*.pptx") returned 6 [0047.640] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0047.640] lstrlenA (lpString="*.pdf") returned 5 [0047.640] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0047.640] lstrlenA (lpString="*.mov") returned 5 [0047.640] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0047.640] lstrlenA (lpString="*.m2v") returned 5 [0047.640] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0047.640] lstrlenA (lpString="*.3gp") returned 5 [0047.640] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0047.640] lstrlenA (lpString="*.mpeg") returned 6 [0047.640] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0047.640] lstrlenA (lpString="*.mpg") returned 5 [0047.640] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0047.640] lstrlenA (lpString="*.flv") returned 5 [0047.640] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0047.640] lstrlenA (lpString="*.avi") returned 5 [0047.640] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0047.640] lstrlenA (lpString="*.mp4") returned 5 [0047.641] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0047.641] lstrlenA (lpString="*.wmv") returned 5 [0047.641] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0047.641] lstrlenA (lpString="*.divx") returned 6 [0047.641] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0047.641] lstrlenA (lpString="*.mkv") returned 5 [0047.641] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0047.641] lstrlenA (lpString="*.mp3") returned 5 [0047.641] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0047.641] lstrlenA (lpString="*.wav") returned 5 [0047.641] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0047.641] lstrlenA (lpString="*.flac") returned 6 [0047.641] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0047.641] lstrlenA (lpString="*.ape") returned 5 [0047.641] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0047.641] lstrlenA (lpString="*.wma") returned 5 [0047.641] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0047.641] lstrlenA (lpString="*.ac3") returned 5 [0047.641] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", pszSpec="*.mxf") returned 0 [0047.641] lstrlenA (lpString="*.mxf") returned 5 [0047.641] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.641] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.641] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0047.641] lstrcmpA (lpString1=".", lpString2="pt-PT") returned -1 [0047.641] lstrcmpA (lpString1="..", lpString2="pt-PT") returned -1 [0047.641] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.641] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="pt-PT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT" [0047.641] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT") returned 56 [0047.641] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8380, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.642] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.642] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.642] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.642] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.642] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.642] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0047.642] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0047.642] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0047.642] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*") returned="*.*" [0047.642] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\" [0047.642] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\") returned="" [0047.642] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\HOW TO DECRYPT FILES.txt" [0047.642] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\how to decrypt files.txt")) returned 0xffffffff [0047.642] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.643] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0047.643] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0047.644] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.644] CloseHandle (hObject=0x90) returned 1 [0047.645] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" [0047.645] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0047.645] lstrlenA (lpString="*.zip") returned 5 [0047.645] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0047.645] lstrlenA (lpString="*.rar") returned 5 [0047.645] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0047.645] lstrlenA (lpString="*.7z") returned 4 [0047.645] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0047.645] lstrlenA (lpString="*.tar") returned 5 [0047.645] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0047.645] lstrlenA (lpString="*.gzip") returned 6 [0047.645] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0047.645] lstrlenA (lpString="*.jpg") returned 5 [0047.645] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0047.645] lstrlenA (lpString="*.jpeg") returned 6 [0047.645] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0047.645] lstrlenA (lpString="*.psd") returned 5 [0047.645] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0047.645] lstrlenA (lpString="*.gif") returned 5 [0047.645] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0047.645] lstrlenA (lpString="*.doc") returned 5 [0047.645] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0047.645] lstrlenA (lpString="*.docx") returned 6 [0047.645] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0047.645] lstrlenA (lpString="*.xls") returned 5 [0047.645] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0047.645] lstrlenA (lpString="*.xlsx") returned 6 [0047.645] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0047.645] lstrlenA (lpString="*.ppt") returned 5 [0047.645] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0047.646] lstrlenA (lpString="*.pptx") returned 6 [0047.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0047.646] lstrlenA (lpString="*.pdf") returned 5 [0047.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0047.646] lstrlenA (lpString="*.mov") returned 5 [0047.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0047.646] lstrlenA (lpString="*.m2v") returned 5 [0047.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0047.646] lstrlenA (lpString="*.3gp") returned 5 [0047.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0047.646] lstrlenA (lpString="*.mpeg") returned 6 [0047.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0047.646] lstrlenA (lpString="*.mpg") returned 5 [0047.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0047.646] lstrlenA (lpString="*.flv") returned 5 [0047.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0047.646] lstrlenA (lpString="*.avi") returned 5 [0047.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0047.646] lstrlenA (lpString="*.mp4") returned 5 [0047.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0047.646] lstrlenA (lpString="*.wmv") returned 5 [0047.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0047.646] lstrlenA (lpString="*.divx") returned 6 [0047.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0047.646] lstrlenA (lpString="*.mkv") returned 5 [0047.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0047.646] lstrlenA (lpString="*.mp3") returned 5 [0047.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0047.646] lstrlenA (lpString="*.wav") returned 5 [0047.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0047.646] lstrlenA (lpString="*.flac") returned 6 [0047.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0047.646] lstrlenA (lpString="*.ape") returned 5 [0047.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0047.647] lstrlenA (lpString="*.wma") returned 5 [0047.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0047.647] lstrlenA (lpString="*.ac3") returned 5 [0047.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", pszSpec="*.mxf") returned 0 [0047.647] lstrlenA (lpString="*.mxf") returned 5 [0047.647] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.647] lstrcmpA (lpString1=".", lpString2="ro-RO") returned -1 [0047.647] lstrcmpA (lpString1="..", lpString2="ro-RO") returned -1 [0047.647] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.647] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ro-RO" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO" [0047.647] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO") returned 56 [0047.648] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8380, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.648] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.648] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.648] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.648] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.648] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.648] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.648] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0047.648] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0047.648] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0047.648] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*") returned="*.*" [0047.648] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\" [0047.648] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\") returned="" [0047.648] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\HOW TO DECRYPT FILES.txt" [0047.648] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\how to decrypt files.txt")) returned 0xffffffff [0047.648] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.649] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0047.649] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0047.650] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.650] CloseHandle (hObject=0x90) returned 1 [0047.651] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" [0047.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0047.651] lstrlenA (lpString="*.zip") returned 5 [0047.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0047.651] lstrlenA (lpString="*.rar") returned 5 [0047.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0047.651] lstrlenA (lpString="*.7z") returned 4 [0047.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0047.651] lstrlenA (lpString="*.tar") returned 5 [0047.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0047.651] lstrlenA (lpString="*.gzip") returned 6 [0047.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0047.651] lstrlenA (lpString="*.jpg") returned 5 [0047.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0047.651] lstrlenA (lpString="*.jpeg") returned 6 [0047.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0047.651] lstrlenA (lpString="*.psd") returned 5 [0047.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0047.651] lstrlenA (lpString="*.gif") returned 5 [0047.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0047.651] lstrlenA (lpString="*.doc") returned 5 [0047.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0047.651] lstrlenA (lpString="*.docx") returned 6 [0047.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0047.651] lstrlenA (lpString="*.xls") returned 5 [0047.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0047.651] lstrlenA (lpString="*.xlsx") returned 6 [0047.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0047.652] lstrlenA (lpString="*.ppt") returned 5 [0047.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0047.652] lstrlenA (lpString="*.pptx") returned 6 [0047.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0047.652] lstrlenA (lpString="*.pdf") returned 5 [0047.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0047.652] lstrlenA (lpString="*.mov") returned 5 [0047.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0047.652] lstrlenA (lpString="*.m2v") returned 5 [0047.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0047.652] lstrlenA (lpString="*.3gp") returned 5 [0047.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0047.652] lstrlenA (lpString="*.mpeg") returned 6 [0047.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0047.652] lstrlenA (lpString="*.mpg") returned 5 [0047.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0047.652] lstrlenA (lpString="*.flv") returned 5 [0047.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0047.652] lstrlenA (lpString="*.avi") returned 5 [0047.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0047.652] lstrlenA (lpString="*.mp4") returned 5 [0047.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0047.652] lstrlenA (lpString="*.wmv") returned 5 [0047.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0047.652] lstrlenA (lpString="*.divx") returned 6 [0047.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0047.653] lstrlenA (lpString="*.mkv") returned 5 [0047.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0047.653] lstrlenA (lpString="*.mp3") returned 5 [0047.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0047.653] lstrlenA (lpString="*.wav") returned 5 [0047.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0047.653] lstrlenA (lpString="*.flac") returned 6 [0047.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0047.653] lstrlenA (lpString="*.ape") returned 5 [0047.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0047.653] lstrlenA (lpString="*.wma") returned 5 [0047.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0047.653] lstrlenA (lpString="*.ac3") returned 5 [0047.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", pszSpec="*.mxf") returned 0 [0047.653] lstrlenA (lpString="*.mxf") returned 5 [0047.653] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.653] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.653] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a795bf, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x42a795bf, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43f1e320, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0047.653] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.653] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtscom.dll") returned -1 [0047.653] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtscom.dll") returned -1 [0047.653] lstrcmpiA (lpString1="", lpString2="rtscom.dll") returned -1 [0047.653] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.653] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.653] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.653] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.653] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.653] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="rtscom.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll" [0047.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.zip") returned 0 [0047.654] lstrlenA (lpString="*.zip") returned 5 [0047.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.rar") returned 0 [0047.654] lstrlenA (lpString="*.rar") returned 5 [0047.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.7z") returned 0 [0047.654] lstrlenA (lpString="*.7z") returned 4 [0047.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.tar") returned 0 [0047.654] lstrlenA (lpString="*.tar") returned 5 [0047.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.gzip") returned 0 [0047.654] lstrlenA (lpString="*.gzip") returned 6 [0047.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.jpg") returned 0 [0047.654] lstrlenA (lpString="*.jpg") returned 5 [0047.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.jpeg") returned 0 [0047.654] lstrlenA (lpString="*.jpeg") returned 6 [0047.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.psd") returned 0 [0047.654] lstrlenA (lpString="*.psd") returned 5 [0047.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.gif") returned 0 [0047.654] lstrlenA (lpString="*.gif") returned 5 [0047.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.doc") returned 0 [0047.654] lstrlenA (lpString="*.doc") returned 5 [0047.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.docx") returned 0 [0047.654] lstrlenA (lpString="*.docx") returned 6 [0047.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.xls") returned 0 [0047.654] lstrlenA (lpString="*.xls") returned 5 [0047.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.xlsx") returned 0 [0047.654] lstrlenA (lpString="*.xlsx") returned 6 [0047.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.ppt") returned 0 [0047.654] lstrlenA (lpString="*.ppt") returned 5 [0047.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.pptx") returned 0 [0047.654] lstrlenA (lpString="*.pptx") returned 6 [0047.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.pdf") returned 0 [0047.654] lstrlenA (lpString="*.pdf") returned 5 [0047.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.mov") returned 0 [0047.655] lstrlenA (lpString="*.mov") returned 5 [0047.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.m2v") returned 0 [0047.655] lstrlenA (lpString="*.m2v") returned 5 [0047.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.3gp") returned 0 [0047.655] lstrlenA (lpString="*.3gp") returned 5 [0047.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.mpeg") returned 0 [0047.655] lstrlenA (lpString="*.mpeg") returned 6 [0047.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.mpg") returned 0 [0047.655] lstrlenA (lpString="*.mpg") returned 5 [0047.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.flv") returned 0 [0047.655] lstrlenA (lpString="*.flv") returned 5 [0047.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.avi") returned 0 [0047.655] lstrlenA (lpString="*.avi") returned 5 [0047.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.mp4") returned 0 [0047.655] lstrlenA (lpString="*.mp4") returned 5 [0047.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.wmv") returned 0 [0047.655] lstrlenA (lpString="*.wmv") returned 5 [0047.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.divx") returned 0 [0047.655] lstrlenA (lpString="*.divx") returned 6 [0047.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.mkv") returned 0 [0047.655] lstrlenA (lpString="*.mkv") returned 5 [0047.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.mp3") returned 0 [0047.655] lstrlenA (lpString="*.mp3") returned 5 [0047.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.wav") returned 0 [0047.655] lstrlenA (lpString="*.wav") returned 5 [0047.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.flac") returned 0 [0047.655] lstrlenA (lpString="*.flac") returned 6 [0047.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.ape") returned 0 [0047.655] lstrlenA (lpString="*.ape") returned 5 [0047.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.wma") returned 0 [0047.655] lstrlenA (lpString="*.wma") returned 5 [0047.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.ac3") returned 0 [0047.655] lstrlenA (lpString="*.ac3") returned 5 [0047.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", pszSpec="*.mxf") returned 0 [0047.656] lstrlenA (lpString="*.mxf") returned 5 [0047.656] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0047.656] lstrcmpA (lpString1=".", lpString2="ru-RU") returned -1 [0047.656] lstrcmpA (lpString1="..", lpString2="ru-RU") returned -1 [0047.656] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll") returned="rtscom.dll" [0047.656] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ru-RU" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU" [0047.656] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU") returned 56 [0047.656] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d813e, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.657] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.657] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.657] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.657] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.657] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.657] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.657] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0047.657] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0047.657] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0047.657] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*") returned="*.*" [0047.657] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\" [0047.657] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\") returned="" [0047.657] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\HOW TO DECRYPT FILES.txt" [0047.657] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\how to decrypt files.txt")) returned 0xffffffff [0047.657] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.658] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0047.658] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0047.659] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.659] CloseHandle (hObject=0x90) returned 1 [0047.659] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" [0047.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0047.659] lstrlenA (lpString="*.zip") returned 5 [0047.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0047.659] lstrlenA (lpString="*.rar") returned 5 [0047.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0047.659] lstrlenA (lpString="*.7z") returned 4 [0047.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0047.659] lstrlenA (lpString="*.tar") returned 5 [0047.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0047.659] lstrlenA (lpString="*.gzip") returned 6 [0047.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0047.659] lstrlenA (lpString="*.jpg") returned 5 [0047.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0047.659] lstrlenA (lpString="*.jpeg") returned 6 [0047.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0047.660] lstrlenA (lpString="*.psd") returned 5 [0047.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0047.660] lstrlenA (lpString="*.gif") returned 5 [0047.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0047.660] lstrlenA (lpString="*.doc") returned 5 [0047.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0047.660] lstrlenA (lpString="*.docx") returned 6 [0047.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0047.660] lstrlenA (lpString="*.xls") returned 5 [0047.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0047.660] lstrlenA (lpString="*.xlsx") returned 6 [0047.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0047.660] lstrlenA (lpString="*.ppt") returned 5 [0047.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0047.660] lstrlenA (lpString="*.pptx") returned 6 [0047.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0047.660] lstrlenA (lpString="*.pdf") returned 5 [0047.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0047.660] lstrlenA (lpString="*.mov") returned 5 [0047.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0047.660] lstrlenA (lpString="*.m2v") returned 5 [0047.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0047.660] lstrlenA (lpString="*.3gp") returned 5 [0047.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0047.660] lstrlenA (lpString="*.mpeg") returned 6 [0047.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0047.660] lstrlenA (lpString="*.mpg") returned 5 [0047.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0047.660] lstrlenA (lpString="*.flv") returned 5 [0047.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0047.661] lstrlenA (lpString="*.avi") returned 5 [0047.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0047.661] lstrlenA (lpString="*.mp4") returned 5 [0047.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0047.661] lstrlenA (lpString="*.wmv") returned 5 [0047.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0047.661] lstrlenA (lpString="*.divx") returned 6 [0047.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0047.661] lstrlenA (lpString="*.mkv") returned 5 [0047.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0047.661] lstrlenA (lpString="*.mp3") returned 5 [0047.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0047.661] lstrlenA (lpString="*.wav") returned 5 [0047.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0047.661] lstrlenA (lpString="*.flac") returned 6 [0047.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0047.661] lstrlenA (lpString="*.ape") returned 5 [0047.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0047.661] lstrlenA (lpString="*.wma") returned 5 [0047.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0047.661] lstrlenA (lpString="*.ac3") returned 5 [0047.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", pszSpec="*.mxf") returned 0 [0047.661] lstrlenA (lpString="*.mxf") returned 5 [0047.661] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.661] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.661] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a593198, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6a593198, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf44c0670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0047.661] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.662] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ShapeCollector.exe") returned -1 [0047.662] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ShapeCollector.exe") returned -1 [0047.662] lstrcmpiA (lpString1="", lpString2="ShapeCollector.exe") returned -1 [0047.662] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.662] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.662] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.662] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.662] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.662] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ShapeCollector.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" [0047.662] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.zip") returned 0 [0047.662] lstrlenA (lpString="*.zip") returned 5 [0047.662] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.rar") returned 0 [0047.662] lstrlenA (lpString="*.rar") returned 5 [0047.662] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.7z") returned 0 [0047.662] lstrlenA (lpString="*.7z") returned 4 [0047.662] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.tar") returned 0 [0047.662] lstrlenA (lpString="*.tar") returned 5 [0047.662] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.gzip") returned 0 [0047.662] lstrlenA (lpString="*.gzip") returned 6 [0047.662] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.jpg") returned 0 [0047.662] lstrlenA (lpString="*.jpg") returned 5 [0047.662] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.jpeg") returned 0 [0047.662] lstrlenA (lpString="*.jpeg") returned 6 [0047.662] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.psd") returned 0 [0047.662] lstrlenA (lpString="*.psd") returned 5 [0047.662] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.gif") returned 0 [0047.662] lstrlenA (lpString="*.gif") returned 5 [0047.662] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.doc") returned 0 [0047.662] lstrlenA (lpString="*.doc") returned 5 [0047.663] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.docx") returned 0 [0047.663] lstrlenA (lpString="*.docx") returned 6 [0047.663] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.xls") returned 0 [0047.663] lstrlenA (lpString="*.xls") returned 5 [0047.663] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.xlsx") returned 0 [0047.663] lstrlenA (lpString="*.xlsx") returned 6 [0047.663] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.ppt") returned 0 [0047.663] lstrlenA (lpString="*.ppt") returned 5 [0047.663] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.pptx") returned 0 [0047.663] lstrlenA (lpString="*.pptx") returned 6 [0047.663] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.pdf") returned 0 [0047.663] lstrlenA (lpString="*.pdf") returned 5 [0047.663] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.mov") returned 0 [0047.663] lstrlenA (lpString="*.mov") returned 5 [0047.663] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.m2v") returned 0 [0047.663] lstrlenA (lpString="*.m2v") returned 5 [0047.663] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.3gp") returned 0 [0047.663] lstrlenA (lpString="*.3gp") returned 5 [0047.663] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.mpeg") returned 0 [0047.663] lstrlenA (lpString="*.mpeg") returned 6 [0047.663] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.mpg") returned 0 [0047.663] lstrlenA (lpString="*.mpg") returned 5 [0047.663] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.flv") returned 0 [0047.663] lstrlenA (lpString="*.flv") returned 5 [0047.663] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.avi") returned 0 [0047.663] lstrlenA (lpString="*.avi") returned 5 [0047.663] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.mp4") returned 0 [0047.663] lstrlenA (lpString="*.mp4") returned 5 [0047.663] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.wmv") returned 0 [0047.663] lstrlenA (lpString="*.wmv") returned 5 [0047.663] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.divx") returned 0 [0047.663] lstrlenA (lpString="*.divx") returned 6 [0047.663] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.mkv") returned 0 [0047.663] lstrlenA (lpString="*.mkv") returned 5 [0047.664] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.mp3") returned 0 [0047.664] lstrlenA (lpString="*.mp3") returned 5 [0047.664] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.wav") returned 0 [0047.664] lstrlenA (lpString="*.wav") returned 5 [0047.664] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.flac") returned 0 [0047.664] lstrlenA (lpString="*.flac") returned 6 [0047.664] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.ape") returned 0 [0047.664] lstrlenA (lpString="*.ape") returned 5 [0047.664] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.wma") returned 0 [0047.664] lstrlenA (lpString="*.wma") returned 5 [0047.664] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.ac3") returned 0 [0047.664] lstrlenA (lpString="*.ac3") returned 5 [0047.664] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", pszSpec="*.mxf") returned 0 [0047.664] lstrlenA (lpString="*.mxf") returned 5 [0047.664] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0047.664] lstrcmpA (lpString1=".", lpString2="sk-SK") returned -1 [0047.664] lstrcmpA (lpString1="..", lpString2="sk-SK") returned -1 [0047.664] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned="ShapeCollector.exe" [0047.664] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="sk-SK" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK" [0047.664] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK") returned 56 [0047.664] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d813e, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.665] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.665] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.665] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.665] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.665] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.665] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.665] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0047.665] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0047.665] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0047.665] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*") returned="*.*" [0047.665] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\" [0047.665] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\") returned="" [0047.665] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\HOW TO DECRYPT FILES.txt" [0047.665] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\how to decrypt files.txt")) returned 0xffffffff [0047.665] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.665] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0047.665] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0047.666] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.667] CloseHandle (hObject=0x90) returned 1 [0047.667] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" [0047.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0047.667] lstrlenA (lpString="*.zip") returned 5 [0047.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0047.667] lstrlenA (lpString="*.rar") returned 5 [0047.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0047.667] lstrlenA (lpString="*.7z") returned 4 [0047.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0047.667] lstrlenA (lpString="*.tar") returned 5 [0047.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0047.667] lstrlenA (lpString="*.gzip") returned 6 [0047.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0047.667] lstrlenA (lpString="*.jpg") returned 5 [0047.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0047.667] lstrlenA (lpString="*.jpeg") returned 6 [0047.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0047.667] lstrlenA (lpString="*.psd") returned 5 [0047.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0047.668] lstrlenA (lpString="*.gif") returned 5 [0047.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0047.668] lstrlenA (lpString="*.doc") returned 5 [0047.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0047.668] lstrlenA (lpString="*.docx") returned 6 [0047.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0047.668] lstrlenA (lpString="*.xls") returned 5 [0047.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0047.668] lstrlenA (lpString="*.xlsx") returned 6 [0047.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0047.668] lstrlenA (lpString="*.ppt") returned 5 [0047.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0047.668] lstrlenA (lpString="*.pptx") returned 6 [0047.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0047.668] lstrlenA (lpString="*.pdf") returned 5 [0047.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0047.668] lstrlenA (lpString="*.mov") returned 5 [0047.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0047.668] lstrlenA (lpString="*.m2v") returned 5 [0047.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0047.668] lstrlenA (lpString="*.3gp") returned 5 [0047.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0047.668] lstrlenA (lpString="*.mpeg") returned 6 [0047.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0047.668] lstrlenA (lpString="*.mpg") returned 5 [0047.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0047.669] lstrlenA (lpString="*.flv") returned 5 [0047.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0047.669] lstrlenA (lpString="*.avi") returned 5 [0047.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0047.669] lstrlenA (lpString="*.mp4") returned 5 [0047.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0047.669] lstrlenA (lpString="*.wmv") returned 5 [0047.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0047.669] lstrlenA (lpString="*.divx") returned 6 [0047.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0047.669] lstrlenA (lpString="*.mkv") returned 5 [0047.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0047.669] lstrlenA (lpString="*.mp3") returned 5 [0047.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0047.669] lstrlenA (lpString="*.wav") returned 5 [0047.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0047.669] lstrlenA (lpString="*.flac") returned 6 [0047.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0047.669] lstrlenA (lpString="*.ape") returned 5 [0047.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0047.669] lstrlenA (lpString="*.wma") returned 5 [0047.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0047.669] lstrlenA (lpString="*.ac3") returned 5 [0047.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", pszSpec="*.mxf") returned 0 [0047.669] lstrlenA (lpString="*.mxf") returned 5 [0047.669] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.669] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.669] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0047.669] lstrcmpA (lpString1=".", lpString2="sl-SI") returned -1 [0047.670] lstrcmpA (lpString1="..", lpString2="sl-SI") returned -1 [0047.670] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.670] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="sl-SI" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI" [0047.670] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI") returned 56 [0047.670] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8380, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.670] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.670] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.670] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.670] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.670] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.670] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.670] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0047.670] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0047.670] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0047.670] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*.*") returned="*.*" [0047.670] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\" [0047.670] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\") returned="" [0047.670] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\HOW TO DECRYPT FILES.txt" [0047.671] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\how to decrypt files.txt")) returned 0xffffffff [0047.671] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.672] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0047.672] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0047.673] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.673] CloseHandle (hObject=0x90) returned 1 [0047.673] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" [0047.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0047.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0047.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0047.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0047.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0047.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0047.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0047.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0047.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0047.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0047.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0047.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0047.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0047.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0047.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0047.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0047.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0047.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0047.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0047.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0047.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0047.674] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0047.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0047.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0047.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0047.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0047.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0047.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0047.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0047.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0047.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0047.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0047.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0047.675] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", pszSpec="*.mxf") returned 0 [0047.675] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.675] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.675] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0047.675] lstrcmpA (lpString1=".", lpString2="sr-Latn-CS") returned -1 [0047.675] lstrcmpA (lpString1="..", lpString2="sr-Latn-CS") returned -1 [0047.675] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.675] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="sr-Latn-CS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS" [0047.676] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8380, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.676] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.676] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.676] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.676] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.676] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.676] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.676] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0047.676] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0047.676] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0047.676] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*.*") returned="*.*" [0047.676] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\" [0047.676] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\") returned="" [0047.676] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\HOW TO DECRYPT FILES.txt" [0047.676] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\how to decrypt files.txt")) returned 0xffffffff [0047.677] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.677] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0047.678] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.678] CloseHandle (hObject=0x90) returned 1 [0047.681] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" [0047.681] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0047.681] lstrlenA (lpString="*.zip") returned 5 [0047.681] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0047.681] lstrlenA (lpString="*.rar") returned 5 [0047.681] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0047.681] lstrlenA (lpString="*.7z") returned 4 [0047.681] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0047.681] lstrlenA (lpString="*.tar") returned 5 [0047.681] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0047.681] lstrlenA (lpString="*.gzip") returned 6 [0047.681] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0047.681] lstrlenA (lpString="*.jpg") returned 5 [0047.681] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0047.681] lstrlenA (lpString="*.jpeg") returned 6 [0047.682] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0047.682] lstrlenA (lpString="*.psd") returned 5 [0047.682] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0047.682] lstrlenA (lpString="*.gif") returned 5 [0047.682] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0047.682] lstrlenA (lpString="*.doc") returned 5 [0047.682] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0047.682] lstrlenA (lpString="*.docx") returned 6 [0047.682] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0047.682] lstrlenA (lpString="*.xls") returned 5 [0047.682] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0047.682] lstrlenA (lpString="*.xlsx") returned 6 [0047.682] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0047.682] lstrlenA (lpString="*.ppt") returned 5 [0047.682] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0047.682] lstrlenA (lpString="*.pptx") returned 6 [0047.682] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0047.682] lstrlenA (lpString="*.pdf") returned 5 [0047.682] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0047.682] lstrlenA (lpString="*.mov") returned 5 [0047.682] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0047.682] lstrlenA (lpString="*.m2v") returned 5 [0047.682] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0047.682] lstrlenA (lpString="*.3gp") returned 5 [0047.682] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0047.683] lstrlenA (lpString="*.mpeg") returned 6 [0047.683] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0047.683] lstrlenA (lpString="*.mpg") returned 5 [0047.683] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0047.683] lstrlenA (lpString="*.flv") returned 5 [0047.683] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0047.683] lstrlenA (lpString="*.avi") returned 5 [0047.683] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0047.683] lstrlenA (lpString="*.mp4") returned 5 [0047.683] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0047.683] lstrlenA (lpString="*.wmv") returned 5 [0047.683] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0047.683] lstrlenA (lpString="*.divx") returned 6 [0047.683] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0047.683] lstrlenA (lpString="*.mkv") returned 5 [0047.683] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0047.683] lstrlenA (lpString="*.mp3") returned 5 [0047.683] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0047.683] lstrlenA (lpString="*.wav") returned 5 [0047.683] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0047.683] lstrlenA (lpString="*.flac") returned 6 [0047.683] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0047.683] lstrlenA (lpString="*.ape") returned 5 [0047.683] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0047.683] lstrlenA (lpString="*.wma") returned 5 [0047.683] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0047.683] lstrlenA (lpString="*.ac3") returned 5 [0047.683] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", pszSpec="*.mxf") returned 0 [0047.684] lstrlenA (lpString="*.mxf") returned 5 [0047.684] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.684] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.684] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0047.684] lstrcmpA (lpString1=".", lpString2="sv-SE") returned -1 [0047.684] lstrcmpA (lpString1="..", lpString2="sv-SE") returned -1 [0047.684] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.684] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="sv-SE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE" [0047.684] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE") returned 56 [0047.684] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8388, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.686] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.686] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.686] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.686] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.686] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.686] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.686] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0047.686] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0047.686] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0047.686] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*.*") returned="*.*" [0047.686] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\" [0047.686] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\") returned="" [0047.686] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\HOW TO DECRYPT FILES.txt" [0047.686] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\how to decrypt files.txt")) returned 0xffffffff [0047.686] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.686] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0047.686] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0047.687] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.687] CloseHandle (hObject=0x90) returned 1 [0047.688] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" [0047.688] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0047.688] lstrlenA (lpString="*.zip") returned 5 [0047.688] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0047.688] lstrlenA (lpString="*.rar") returned 5 [0047.688] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0047.688] lstrlenA (lpString="*.7z") returned 4 [0047.688] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0047.688] lstrlenA (lpString="*.tar") returned 5 [0047.688] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0047.688] lstrlenA (lpString="*.gzip") returned 6 [0047.688] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0047.688] lstrlenA (lpString="*.jpg") returned 5 [0047.688] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0047.688] lstrlenA (lpString="*.jpeg") returned 6 [0047.688] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0047.688] lstrlenA (lpString="*.psd") returned 5 [0047.688] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0047.688] lstrlenA (lpString="*.gif") returned 5 [0047.688] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0047.688] lstrlenA (lpString="*.doc") returned 5 [0047.688] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0047.688] lstrlenA (lpString="*.docx") returned 6 [0047.688] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0047.688] lstrlenA (lpString="*.xls") returned 5 [0047.688] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0047.688] lstrlenA (lpString="*.xlsx") returned 6 [0047.689] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0047.689] lstrlenA (lpString="*.ppt") returned 5 [0047.689] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0047.689] lstrlenA (lpString="*.pptx") returned 6 [0047.689] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0047.689] lstrlenA (lpString="*.pdf") returned 5 [0047.689] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0047.689] lstrlenA (lpString="*.mov") returned 5 [0047.689] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0047.689] lstrlenA (lpString="*.m2v") returned 5 [0047.689] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0047.689] lstrlenA (lpString="*.3gp") returned 5 [0047.689] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0047.689] lstrlenA (lpString="*.mpeg") returned 6 [0047.689] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0047.689] lstrlenA (lpString="*.mpg") returned 5 [0047.689] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0047.689] lstrlenA (lpString="*.flv") returned 5 [0047.689] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0047.689] lstrlenA (lpString="*.avi") returned 5 [0047.689] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0047.689] lstrlenA (lpString="*.mp4") returned 5 [0047.689] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0047.689] lstrlenA (lpString="*.wmv") returned 5 [0047.689] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0047.689] lstrlenA (lpString="*.divx") returned 6 [0047.689] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0047.689] lstrlenA (lpString="*.mkv") returned 5 [0047.689] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0047.689] lstrlenA (lpString="*.mp3") returned 5 [0047.689] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0047.689] lstrlenA (lpString="*.wav") returned 5 [0047.689] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0047.690] lstrlenA (lpString="*.flac") returned 6 [0047.690] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0047.690] lstrlenA (lpString="*.ape") returned 5 [0047.690] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0047.690] lstrlenA (lpString="*.wma") returned 5 [0047.690] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0047.690] lstrlenA (lpString="*.ac3") returned 5 [0047.690] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", pszSpec="*.mxf") returned 0 [0047.690] lstrlenA (lpString="*.mxf") returned 5 [0047.690] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.690] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.690] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ef1310, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x56ef1310, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x449d3e50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0047.690] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.690] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TabIpsps.dll") returned -1 [0047.690] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TabIpsps.dll") returned -1 [0047.690] lstrcmpiA (lpString1="", lpString2="TabIpsps.dll") returned -1 [0047.690] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.690] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.690] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.690] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.690] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.690] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="TabIpsps.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll" [0047.690] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.zip") returned 0 [0047.690] lstrlenA (lpString="*.zip") returned 5 [0047.690] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.rar") returned 0 [0047.690] lstrlenA (lpString="*.rar") returned 5 [0047.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.7z") returned 0 [0047.691] lstrlenA (lpString="*.7z") returned 4 [0047.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.tar") returned 0 [0047.691] lstrlenA (lpString="*.tar") returned 5 [0047.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.gzip") returned 0 [0047.691] lstrlenA (lpString="*.gzip") returned 6 [0047.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.jpg") returned 0 [0047.691] lstrlenA (lpString="*.jpg") returned 5 [0047.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.jpeg") returned 0 [0047.691] lstrlenA (lpString="*.jpeg") returned 6 [0047.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.psd") returned 0 [0047.691] lstrlenA (lpString="*.psd") returned 5 [0047.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.gif") returned 0 [0047.691] lstrlenA (lpString="*.gif") returned 5 [0047.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.doc") returned 0 [0047.691] lstrlenA (lpString="*.doc") returned 5 [0047.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.docx") returned 0 [0047.691] lstrlenA (lpString="*.docx") returned 6 [0047.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.xls") returned 0 [0047.691] lstrlenA (lpString="*.xls") returned 5 [0047.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.xlsx") returned 0 [0047.691] lstrlenA (lpString="*.xlsx") returned 6 [0047.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.ppt") returned 0 [0047.691] lstrlenA (lpString="*.ppt") returned 5 [0047.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.pptx") returned 0 [0047.691] lstrlenA (lpString="*.pptx") returned 6 [0047.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.pdf") returned 0 [0047.691] lstrlenA (lpString="*.pdf") returned 5 [0047.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.mov") returned 0 [0047.691] lstrlenA (lpString="*.mov") returned 5 [0047.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.m2v") returned 0 [0047.691] lstrlenA (lpString="*.m2v") returned 5 [0047.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.3gp") returned 0 [0047.692] lstrlenA (lpString="*.3gp") returned 5 [0047.692] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.mpeg") returned 0 [0047.692] lstrlenA (lpString="*.mpeg") returned 6 [0047.692] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.mpg") returned 0 [0047.692] lstrlenA (lpString="*.mpg") returned 5 [0047.692] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.flv") returned 0 [0047.692] lstrlenA (lpString="*.flv") returned 5 [0047.692] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.avi") returned 0 [0047.692] lstrlenA (lpString="*.avi") returned 5 [0047.692] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.mp4") returned 0 [0047.692] lstrlenA (lpString="*.mp4") returned 5 [0047.692] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.wmv") returned 0 [0047.692] lstrlenA (lpString="*.wmv") returned 5 [0047.692] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.divx") returned 0 [0047.692] lstrlenA (lpString="*.divx") returned 6 [0047.692] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.mkv") returned 0 [0047.692] lstrlenA (lpString="*.mkv") returned 5 [0047.692] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.mp3") returned 0 [0047.692] lstrlenA (lpString="*.mp3") returned 5 [0047.692] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.wav") returned 0 [0047.692] lstrlenA (lpString="*.wav") returned 5 [0047.692] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.flac") returned 0 [0047.692] lstrlenA (lpString="*.flac") returned 6 [0047.692] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.ape") returned 0 [0047.692] lstrlenA (lpString="*.ape") returned 5 [0047.692] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.wma") returned 0 [0047.692] lstrlenA (lpString="*.wma") returned 5 [0047.692] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.ac3") returned 0 [0047.692] lstrlenA (lpString="*.ac3") returned 5 [0047.692] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", pszSpec="*.mxf") returned 0 [0047.692] lstrlenA (lpString="*.mxf") returned 5 [0047.692] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf05363, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bf05363, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bf05363, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6d600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll", cAlternateFileName="")) returned 1 [0047.692] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.692] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tabskb.dll") returned -1 [0047.693] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tabskb.dll") returned -1 [0047.693] lstrcmpiA (lpString1="", lpString2="tabskb.dll") returned -1 [0047.693] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll") returned="TabIpsps.dll" [0047.693] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.693] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.693] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.693] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.693] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="tabskb.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll" [0047.693] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.zip") returned 0 [0047.693] lstrlenA (lpString="*.zip") returned 5 [0047.693] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.rar") returned 0 [0047.693] lstrlenA (lpString="*.rar") returned 5 [0047.693] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.7z") returned 0 [0047.693] lstrlenA (lpString="*.7z") returned 4 [0047.693] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.tar") returned 0 [0047.693] lstrlenA (lpString="*.tar") returned 5 [0047.693] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.gzip") returned 0 [0047.693] lstrlenA (lpString="*.gzip") returned 6 [0047.693] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.jpg") returned 0 [0047.693] lstrlenA (lpString="*.jpg") returned 5 [0047.693] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.jpeg") returned 0 [0047.693] lstrlenA (lpString="*.jpeg") returned 6 [0047.693] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.psd") returned 0 [0047.693] lstrlenA (lpString="*.psd") returned 5 [0047.693] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.gif") returned 0 [0047.693] lstrlenA (lpString="*.gif") returned 5 [0047.693] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.doc") returned 0 [0047.693] lstrlenA (lpString="*.doc") returned 5 [0047.693] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.docx") returned 0 [0047.693] lstrlenA (lpString="*.docx") returned 6 [0047.693] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.xls") returned 0 [0047.694] lstrlenA (lpString="*.xls") returned 5 [0047.694] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.xlsx") returned 0 [0047.694] lstrlenA (lpString="*.xlsx") returned 6 [0047.694] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.ppt") returned 0 [0047.694] lstrlenA (lpString="*.ppt") returned 5 [0047.694] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.pptx") returned 0 [0047.694] lstrlenA (lpString="*.pptx") returned 6 [0047.694] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.pdf") returned 0 [0047.694] lstrlenA (lpString="*.pdf") returned 5 [0047.694] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.mov") returned 0 [0047.694] lstrlenA (lpString="*.mov") returned 5 [0047.694] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.m2v") returned 0 [0047.694] lstrlenA (lpString="*.m2v") returned 5 [0047.694] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.3gp") returned 0 [0047.694] lstrlenA (lpString="*.3gp") returned 5 [0047.694] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.mpeg") returned 0 [0047.694] lstrlenA (lpString="*.mpeg") returned 6 [0047.694] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.mpg") returned 0 [0047.694] lstrlenA (lpString="*.mpg") returned 5 [0047.694] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.flv") returned 0 [0047.694] lstrlenA (lpString="*.flv") returned 5 [0047.694] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.avi") returned 0 [0047.694] lstrlenA (lpString="*.avi") returned 5 [0047.694] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.mp4") returned 0 [0047.694] lstrlenA (lpString="*.mp4") returned 5 [0047.694] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.wmv") returned 0 [0047.694] lstrlenA (lpString="*.wmv") returned 5 [0047.694] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.divx") returned 0 [0047.694] lstrlenA (lpString="*.divx") returned 6 [0047.694] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.mkv") returned 0 [0047.694] lstrlenA (lpString="*.mkv") returned 5 [0047.694] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.mp3") returned 0 [0047.694] lstrlenA (lpString="*.mp3") returned 5 [0047.695] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.wav") returned 0 [0047.695] lstrlenA (lpString="*.wav") returned 5 [0047.695] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.flac") returned 0 [0047.695] lstrlenA (lpString="*.flac") returned 6 [0047.695] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.ape") returned 0 [0047.695] lstrlenA (lpString="*.ape") returned 5 [0047.695] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.wma") returned 0 [0047.695] lstrlenA (lpString="*.wma") returned 5 [0047.695] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.ac3") returned 0 [0047.695] lstrlenA (lpString="*.ac3") returned 5 [0047.695] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", pszSpec="*.mxf") returned 0 [0047.695] lstrlenA (lpString="*.mxf") returned 5 [0047.695] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c03bb8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x45c03bb8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf8825d20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe", cAlternateFileName="")) returned 1 [0047.695] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.695] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TabTip.exe") returned -1 [0047.695] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TabTip.exe") returned -1 [0047.695] lstrcmpiA (lpString1="", lpString2="TabTip.exe") returned -1 [0047.695] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll") returned="tabskb.dll" [0047.695] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.695] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.695] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.695] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.695] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="TabTip.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe" [0047.695] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.zip") returned 0 [0047.695] lstrlenA (lpString="*.zip") returned 5 [0047.695] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.rar") returned 0 [0047.695] lstrlenA (lpString="*.rar") returned 5 [0047.695] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.7z") returned 0 [0047.695] lstrlenA (lpString="*.7z") returned 4 [0047.695] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.tar") returned 0 [0047.696] lstrlenA (lpString="*.tar") returned 5 [0047.696] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.gzip") returned 0 [0047.696] lstrlenA (lpString="*.gzip") returned 6 [0047.696] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.jpg") returned 0 [0047.696] lstrlenA (lpString="*.jpg") returned 5 [0047.696] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.jpeg") returned 0 [0047.696] lstrlenA (lpString="*.jpeg") returned 6 [0047.696] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.psd") returned 0 [0047.696] lstrlenA (lpString="*.psd") returned 5 [0047.696] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.gif") returned 0 [0047.696] lstrlenA (lpString="*.gif") returned 5 [0047.696] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.doc") returned 0 [0047.696] lstrlenA (lpString="*.doc") returned 5 [0047.696] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.docx") returned 0 [0047.696] lstrlenA (lpString="*.docx") returned 6 [0047.696] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.xls") returned 0 [0047.696] lstrlenA (lpString="*.xls") returned 5 [0047.696] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.xlsx") returned 0 [0047.696] lstrlenA (lpString="*.xlsx") returned 6 [0047.696] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.ppt") returned 0 [0047.696] lstrlenA (lpString="*.ppt") returned 5 [0047.696] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.pptx") returned 0 [0047.696] lstrlenA (lpString="*.pptx") returned 6 [0047.696] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.pdf") returned 0 [0047.696] lstrlenA (lpString="*.pdf") returned 5 [0047.696] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.mov") returned 0 [0047.696] lstrlenA (lpString="*.mov") returned 5 [0047.696] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.m2v") returned 0 [0047.696] lstrlenA (lpString="*.m2v") returned 5 [0047.696] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.3gp") returned 0 [0047.696] lstrlenA (lpString="*.3gp") returned 5 [0047.696] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.mpeg") returned 0 [0047.696] lstrlenA (lpString="*.mpeg") returned 6 [0047.697] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.mpg") returned 0 [0047.697] lstrlenA (lpString="*.mpg") returned 5 [0047.697] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.flv") returned 0 [0047.697] lstrlenA (lpString="*.flv") returned 5 [0047.697] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.avi") returned 0 [0047.697] lstrlenA (lpString="*.avi") returned 5 [0047.697] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.mp4") returned 0 [0047.697] lstrlenA (lpString="*.mp4") returned 5 [0047.697] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.wmv") returned 0 [0047.697] lstrlenA (lpString="*.wmv") returned 5 [0047.697] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.divx") returned 0 [0047.697] lstrlenA (lpString="*.divx") returned 6 [0047.697] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.mkv") returned 0 [0047.697] lstrlenA (lpString="*.mkv") returned 5 [0047.697] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.mp3") returned 0 [0047.697] lstrlenA (lpString="*.mp3") returned 5 [0047.697] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.wav") returned 0 [0047.697] lstrlenA (lpString="*.wav") returned 5 [0047.697] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.flac") returned 0 [0047.697] lstrlenA (lpString="*.flac") returned 6 [0047.697] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.ape") returned 0 [0047.697] lstrlenA (lpString="*.ape") returned 5 [0047.697] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.wma") returned 0 [0047.697] lstrlenA (lpString="*.wma") returned 5 [0047.697] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.ac3") returned 0 [0047.697] lstrlenA (lpString="*.ac3") returned 5 [0047.697] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", pszSpec="*.mxf") returned 0 [0047.697] lstrlenA (lpString="*.mxf") returned 5 [0047.697] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0047.697] lstrcmpA (lpString1=".", lpString2="th-TH") returned -1 [0047.697] lstrcmpA (lpString1="..", lpString2="th-TH") returned -1 [0047.697] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned="TabTip.exe" [0047.697] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="th-TH" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH" [0047.697] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH") returned 56 [0047.697] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d813e, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.698] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.698] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.698] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.698] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.698] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.698] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.698] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0047.698] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0047.698] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0047.698] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*.*") returned="*.*" [0047.698] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\" [0047.698] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\") returned="" [0047.698] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\HOW TO DECRYPT FILES.txt" [0047.698] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\how to decrypt files.txt")) returned 0xffffffff [0047.698] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.699] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0047.699] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0047.700] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.700] CloseHandle (hObject=0x90) returned 1 [0047.701] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" [0047.701] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.zip") returned 0 [0047.701] lstrlenA (lpString="*.zip") returned 5 [0047.701] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.rar") returned 0 [0047.701] lstrlenA (lpString="*.rar") returned 5 [0047.701] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.7z") returned 0 [0047.701] lstrlenA (lpString="*.7z") returned 4 [0047.701] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.tar") returned 0 [0047.701] lstrlenA (lpString="*.tar") returned 5 [0047.701] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.gzip") returned 0 [0047.701] lstrlenA (lpString="*.gzip") returned 6 [0047.701] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.jpg") returned 0 [0047.701] lstrlenA (lpString="*.jpg") returned 5 [0047.701] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.jpeg") returned 0 [0047.701] lstrlenA (lpString="*.jpeg") returned 6 [0047.701] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.psd") returned 0 [0047.701] lstrlenA (lpString="*.psd") returned 5 [0047.701] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.gif") returned 0 [0047.701] lstrlenA (lpString="*.gif") returned 5 [0047.701] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.doc") returned 0 [0047.701] lstrlenA (lpString="*.doc") returned 5 [0047.701] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.docx") returned 0 [0047.701] lstrlenA (lpString="*.docx") returned 6 [0047.701] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.xls") returned 0 [0047.701] lstrlenA (lpString="*.xls") returned 5 [0047.701] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.xlsx") returned 0 [0047.701] lstrlenA (lpString="*.xlsx") returned 6 [0047.701] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.ppt") returned 0 [0047.701] lstrlenA (lpString="*.ppt") returned 5 [0047.701] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.pptx") returned 0 [0047.701] lstrlenA (lpString="*.pptx") returned 6 [0047.701] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.pdf") returned 0 [0047.701] lstrlenA (lpString="*.pdf") returned 5 [0047.702] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.mov") returned 0 [0047.702] lstrlenA (lpString="*.mov") returned 5 [0047.702] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.m2v") returned 0 [0047.702] lstrlenA (lpString="*.m2v") returned 5 [0047.702] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.3gp") returned 0 [0047.702] lstrlenA (lpString="*.3gp") returned 5 [0047.702] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.mpeg") returned 0 [0047.702] lstrlenA (lpString="*.mpeg") returned 6 [0047.702] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.mpg") returned 0 [0047.702] lstrlenA (lpString="*.mpg") returned 5 [0047.702] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.flv") returned 0 [0047.702] lstrlenA (lpString="*.flv") returned 5 [0047.702] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.avi") returned 0 [0047.702] lstrlenA (lpString="*.avi") returned 5 [0047.702] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.mp4") returned 0 [0047.702] lstrlenA (lpString="*.mp4") returned 5 [0047.702] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.wmv") returned 0 [0047.702] lstrlenA (lpString="*.wmv") returned 5 [0047.702] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.divx") returned 0 [0047.702] lstrlenA (lpString="*.divx") returned 6 [0047.702] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.mkv") returned 0 [0047.702] lstrlenA (lpString="*.mkv") returned 5 [0047.702] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.mp3") returned 0 [0047.702] lstrlenA (lpString="*.mp3") returned 5 [0047.702] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.wav") returned 0 [0047.702] lstrlenA (lpString="*.wav") returned 5 [0047.702] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.flac") returned 0 [0047.702] lstrlenA (lpString="*.flac") returned 6 [0047.702] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.ape") returned 0 [0047.702] lstrlenA (lpString="*.ape") returned 5 [0047.702] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.wma") returned 0 [0047.702] lstrlenA (lpString="*.wma") returned 5 [0047.703] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.ac3") returned 0 [0047.703] lstrlenA (lpString="*.ac3") returned 5 [0047.703] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", pszSpec="*.mxf") returned 0 [0047.703] lstrlenA (lpString="*.mxf") returned 5 [0047.703] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.703] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.703] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bbeec8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x41bbeec8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44c363f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="TipBand.dll", cAlternateFileName="")) returned 1 [0047.703] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.703] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TipBand.dll") returned -1 [0047.703] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TipBand.dll") returned -1 [0047.703] lstrcmpiA (lpString1="", lpString2="TipBand.dll") returned -1 [0047.703] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.703] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.703] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.703] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.703] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.703] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="TipBand.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll" [0047.703] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.zip") returned 0 [0047.703] lstrlenA (lpString="*.zip") returned 5 [0047.703] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.rar") returned 0 [0047.703] lstrlenA (lpString="*.rar") returned 5 [0047.703] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.7z") returned 0 [0047.703] lstrlenA (lpString="*.7z") returned 4 [0047.703] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.tar") returned 0 [0047.703] lstrlenA (lpString="*.tar") returned 5 [0047.704] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.gzip") returned 0 [0047.704] lstrlenA (lpString="*.gzip") returned 6 [0047.704] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.jpg") returned 0 [0047.704] lstrlenA (lpString="*.jpg") returned 5 [0047.704] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.jpeg") returned 0 [0047.704] lstrlenA (lpString="*.jpeg") returned 6 [0047.704] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.psd") returned 0 [0047.704] lstrlenA (lpString="*.psd") returned 5 [0047.704] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.gif") returned 0 [0047.704] lstrlenA (lpString="*.gif") returned 5 [0047.704] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.doc") returned 0 [0047.704] lstrlenA (lpString="*.doc") returned 5 [0047.704] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.docx") returned 0 [0047.704] lstrlenA (lpString="*.docx") returned 6 [0047.704] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.xls") returned 0 [0047.704] lstrlenA (lpString="*.xls") returned 5 [0047.704] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.xlsx") returned 0 [0047.704] lstrlenA (lpString="*.xlsx") returned 6 [0047.704] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.ppt") returned 0 [0047.704] lstrlenA (lpString="*.ppt") returned 5 [0047.704] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.pptx") returned 0 [0047.704] lstrlenA (lpString="*.pptx") returned 6 [0047.704] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.pdf") returned 0 [0047.704] lstrlenA (lpString="*.pdf") returned 5 [0047.704] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.mov") returned 0 [0047.704] lstrlenA (lpString="*.mov") returned 5 [0047.704] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.m2v") returned 0 [0047.704] lstrlenA (lpString="*.m2v") returned 5 [0047.704] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.3gp") returned 0 [0047.704] lstrlenA (lpString="*.3gp") returned 5 [0047.704] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.mpeg") returned 0 [0047.704] lstrlenA (lpString="*.mpeg") returned 6 [0047.704] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.mpg") returned 0 [0047.705] lstrlenA (lpString="*.mpg") returned 5 [0047.705] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.flv") returned 0 [0047.705] lstrlenA (lpString="*.flv") returned 5 [0047.705] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.avi") returned 0 [0047.705] lstrlenA (lpString="*.avi") returned 5 [0047.705] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.mp4") returned 0 [0047.705] lstrlenA (lpString="*.mp4") returned 5 [0047.705] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.wmv") returned 0 [0047.705] lstrlenA (lpString="*.wmv") returned 5 [0047.705] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.divx") returned 0 [0047.705] lstrlenA (lpString="*.divx") returned 6 [0047.705] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.mkv") returned 0 [0047.705] lstrlenA (lpString="*.mkv") returned 5 [0047.705] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.mp3") returned 0 [0047.705] lstrlenA (lpString="*.mp3") returned 5 [0047.705] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.wav") returned 0 [0047.705] lstrlenA (lpString="*.wav") returned 5 [0047.705] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.flac") returned 0 [0047.705] lstrlenA (lpString="*.flac") returned 6 [0047.705] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.ape") returned 0 [0047.705] lstrlenA (lpString="*.ape") returned 5 [0047.705] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.wma") returned 0 [0047.705] lstrlenA (lpString="*.wma") returned 5 [0047.705] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.ac3") returned 0 [0047.705] lstrlenA (lpString="*.ac3") returned 5 [0047.705] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", pszSpec="*.mxf") returned 0 [0047.705] lstrlenA (lpString="*.mxf") returned 5 [0047.705] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d6a2945, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5d6a2945, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0047.705] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.705] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TipRes.dll") returned -1 [0047.705] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TipRes.dll") returned -1 [0047.705] lstrcmpiA (lpString1="", lpString2="TipRes.dll") returned -1 [0047.705] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned="TipBand.dll" [0047.705] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.706] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.706] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.706] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.706] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="TipRes.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" [0047.706] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.zip") returned 0 [0047.706] lstrlenA (lpString="*.zip") returned 5 [0047.706] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.rar") returned 0 [0047.706] lstrlenA (lpString="*.rar") returned 5 [0047.706] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.7z") returned 0 [0047.706] lstrlenA (lpString="*.7z") returned 4 [0047.706] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.tar") returned 0 [0047.706] lstrlenA (lpString="*.tar") returned 5 [0047.706] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.gzip") returned 0 [0047.706] lstrlenA (lpString="*.gzip") returned 6 [0047.706] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.jpg") returned 0 [0047.706] lstrlenA (lpString="*.jpg") returned 5 [0047.706] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.jpeg") returned 0 [0047.706] lstrlenA (lpString="*.jpeg") returned 6 [0047.706] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.psd") returned 0 [0047.706] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.gif") returned 0 [0047.706] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.doc") returned 0 [0047.706] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.docx") returned 0 [0047.706] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.xls") returned 0 [0047.706] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.xlsx") returned 0 [0047.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.ppt") returned 0 [0047.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.pptx") returned 0 [0047.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.pdf") returned 0 [0047.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.mov") returned 0 [0047.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.m2v") returned 0 [0047.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.3gp") returned 0 [0047.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.mpeg") returned 0 [0047.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.mpg") returned 0 [0047.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.flv") returned 0 [0047.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.avi") returned 0 [0047.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.mp4") returned 0 [0047.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.wmv") returned 0 [0047.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.divx") returned 0 [0047.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.mkv") returned 0 [0047.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.mp3") returned 0 [0047.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.wav") returned 0 [0047.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.flac") returned 0 [0047.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.ape") returned 0 [0047.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.wma") returned 0 [0047.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.ac3") returned 0 [0047.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", pszSpec="*.mxf") returned 0 [0047.707] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7038f2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x3d7038f2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll", cAlternateFileName="")) returned 1 [0047.707] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.707] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll") returned -1 [0047.708] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll") returned -1 [0047.708] lstrcmpiA (lpString1="", lpString2="tipresx.dll") returned -1 [0047.708] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned="TipRes.dll" [0047.708] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.708] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.708] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.708] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.708] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="tipresx.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" [0047.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll", pszSpec="*.zip") returned 0 [0047.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll", pszSpec="*.rar") returned 0 [0047.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll", pszSpec="*.7z") returned 0 [0047.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll", pszSpec="*.tar") returned 0 [0047.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll", pszSpec="*.gzip") returned 0 [0047.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll", pszSpec="*.jpg") returned 0 [0047.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll", pszSpec="*.jpeg") returned 0 [0047.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll", pszSpec="*.psd") returned 0 [0047.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll", pszSpec="*.gif") returned 0 [0047.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll", pszSpec="*.doc") returned 0 [0047.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll", pszSpec="*.docx") returned 0 [0047.709] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa125f634, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa125f634, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa1285794, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x130600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipskins.dll", cAlternateFileName="")) returned 1 [0047.709] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.709] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipskins.dll") returned -1 [0047.709] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipskins.dll") returned -1 [0047.709] lstrcmpiA (lpString1="", lpString2="tipskins.dll") returned -1 [0047.709] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned="tipresx.dll" [0047.709] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.709] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.709] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.709] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.709] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="tipskins.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll" [0047.709] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1213373, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa1213373, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa12394d3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7ae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0047.709] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.709] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tiptsf.dll") returned -1 [0047.709] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tiptsf.dll") returned -1 [0047.709] lstrcmpiA (lpString1="", lpString2="tiptsf.dll") returned -1 [0047.709] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned="tipskins.dll" [0047.709] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.709] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.709] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.709] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.709] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="tiptsf.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" [0047.709] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3dda83b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3dda83b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3dda83b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0047.709] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.709] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tpcps.dll") returned -1 [0047.709] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tpcps.dll") returned -1 [0047.710] lstrcmpiA (lpString1="", lpString2="tpcps.dll") returned -1 [0047.710] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned="tiptsf.dll" [0047.710] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" [0047.710] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned="" [0047.710] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" [0047.710] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\how to decrypt files.txt")) returned 0x20 [0047.710] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="tpcps.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll" [0047.710] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0047.710] lstrcmpA (lpString1=".", lpString2="tr-TR") returned -1 [0047.710] lstrcmpA (lpString1="..", lpString2="tr-TR") returned -1 [0047.710] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll") returned="tpcps.dll" [0047.710] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="tr-TR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR" [0047.710] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d813e, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.711] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.711] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.711] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.711] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.711] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.711] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.711] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0047.711] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0047.711] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0047.711] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*.*") returned="*.*" [0047.711] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\" [0047.711] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\") returned="" [0047.711] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\HOW TO DECRYPT FILES.txt" [0047.711] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\how to decrypt files.txt")) returned 0xffffffff [0047.711] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.715] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.715] CloseHandle (hObject=0x90) returned 1 [0047.715] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" [0047.715] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.715] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.715] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0047.715] lstrcmpA (lpString1=".", lpString2="uk-UA") returned -1 [0047.715] lstrcmpA (lpString1="..", lpString2="uk-UA") returned -1 [0047.716] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.716] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="uk-UA" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA" [0047.716] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8380, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.716] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.716] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.716] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.716] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.716] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.716] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.716] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0047.716] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0047.716] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0047.716] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*.*") returned="*.*" [0047.716] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\" [0047.716] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\") returned="" [0047.716] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\HOW TO DECRYPT FILES.txt" [0047.716] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\how to decrypt files.txt")) returned 0xffffffff [0047.717] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.718] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.718] CloseHandle (hObject=0x90) returned 1 [0047.718] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" [0047.718] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.718] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.718] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0047.718] lstrcmpA (lpString1=".", lpString2="zh-CN") returned -1 [0047.718] lstrcmpA (lpString1="..", lpString2="zh-CN") returned -1 [0047.718] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.718] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="zh-CN" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN" [0047.718] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8380, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.719] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.719] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.720] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.720] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.720] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.720] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.720] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0047.720] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0047.720] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0047.720] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*.*") returned="*.*" [0047.720] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\" [0047.720] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\") returned="" [0047.720] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\HOW TO DECRYPT FILES.txt" [0047.720] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\how to decrypt files.txt")) returned 0xffffffff [0047.720] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.721] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.721] CloseHandle (hObject=0x90) returned 1 [0047.721] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" [0047.722] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.722] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.722] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0047.722] lstrcmpA (lpString1=".", lpString2="zh-TW") returned -1 [0047.722] lstrcmpA (lpString1="..", lpString2="zh-TW") returned -1 [0047.722] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0047.722] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="zh-TW" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW" [0047.722] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8380, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.722] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.722] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.722] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.722] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.722] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0047.722] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.723] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tipresx.dll.mui") returned -1 [0047.723] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0047.723] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0047.723] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*.*") returned="*.*" [0047.723] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\" [0047.723] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\") returned="" [0047.723] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\HOW TO DECRYPT FILES.txt" [0047.723] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\how to decrypt files.txt")) returned 0xffffffff [0047.723] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.724] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.724] CloseHandle (hObject=0x90) returned 1 [0047.724] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" [0047.724] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0047.724] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.724] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0047.724] FindClose (in: hFindFile=0x2d8068 | out: hFindFile=0x2d8068) returned 1 [0047.725] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1 [0047.725] lstrcmpA (lpString1=".", lpString2="MSClientDataMgr") returned -1 [0047.725] lstrcmpA (lpString1="..", lpString2="MSClientDataMgr") returned -1 [0047.725] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0047.725] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="MSClientDataMgr" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr" [0047.725] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2d8080 [0047.726] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.726] FindNextFileA (in: hFindFile=0x2d8080, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.726] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.726] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.726] FindNextFileA (in: hFindFile=0x2d8080, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 1 [0047.726] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.726] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSCDM.DLL") returned -1 [0047.726] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSCDM.DLL") returned -1 [0047.726] lstrcmpiA (lpString1="", lpString2="MSCDM.DLL") returned -1 [0047.726] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*.*") returned="*.*" [0047.726] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\" [0047.726] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\") returned="" [0047.731] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.731] CloseHandle (hObject=0x8c) returned 1 [0047.731] FindNextFileA (in: hFindFile=0x2d8080, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 0 [0047.731] FindClose (in: hFindFile=0x2d8080 | out: hFindFile=0x2d8080) returned 1 [0047.731] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0047.731] lstrcmpA (lpString1=".", lpString2="MSInfo") returned -1 [0047.731] lstrcmpA (lpString1="..", lpString2="MSInfo") returned -1 [0047.731] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0047.731] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d83a0, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.731] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.731] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.731] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.732] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.732] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0047.732] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0047.732] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0047.732] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*") returned="*.*" [0047.732] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2d80b8 [0047.732] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.732] FindNextFileA (in: hFindFile=0x2d80b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.732] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.732] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.732] FindNextFileA (in: hFindFile=0x2d80b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0047.732] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.732] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msinfo32.exe.mui") returned -1 [0047.732] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msinfo32.exe.mui") returned -1 [0047.732] lstrcmpiA (lpString1="", lpString2="msinfo32.exe.mui") returned -1 [0047.732] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*.*") returned="*.*" [0047.732] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\" [0047.732] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\") returned="" [0047.734] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.734] CloseHandle (hObject=0x90) returned 1 [0047.734] FindNextFileA (in: hFindFile=0x2d80b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 0 [0047.734] FindClose (in: hFindFile=0x2d80b8 | out: hFindFile=0x2d80b8) returned 1 [0047.734] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0047.734] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.734] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msinfo32.exe") returned -1 [0047.734] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msinfo32.exe") returned -1 [0047.734] lstrcmpiA (lpString1="", lpString2="msinfo32.exe") returned -1 [0047.734] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*") returned="*.*" [0047.734] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\" [0047.734] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\") returned="" [0047.735] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.735] CloseHandle (hObject=0x8c) returned 1 [0047.735] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="msinfo32.exe", cAlternateFileName="")) returned 0 [0047.736] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0047.736] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0047.736] lstrcmpA (lpString1=".", lpString2="OFFICE14") returned -1 [0047.736] lstrcmpA (lpString1="..", lpString2="OFFICE14") returned -1 [0047.736] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0047.736] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8300, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.736] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.736] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.736] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.736] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.736] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0047.736] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0047.736] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0047.736] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*") returned="*.*" [0047.736] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0047.737] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.737] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.737] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.737] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.737] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0x305a8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ACEINTL.DLL", cAlternateFileName="")) returned 1 [0047.737] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.737] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEINTL.DLL") returned 1 [0047.737] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEINTL.DLL") returned 1 [0047.737] lstrcmpiA (lpString1="", lpString2="ACEINTL.DLL") returned -1 [0047.737] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*") returned="*.*" [0047.738] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" [0047.738] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned="" [0047.739] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.739] CloseHandle (hObject=0x90) returned 1 [0047.739] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0xcdb0, dwReserved0=0x0, dwReserved1=0x2d83e0, cFileName="ACEODBCI.DLL", cAlternateFileName="")) returned 1 [0047.739] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.739] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEODBCI.DLL") returned 1 [0047.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEODBCI.DLL") returned 1 [0047.739] lstrcmpiA (lpString1="", lpString2="ACEODBCI.DLL") returned -1 [0047.739] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned="ACEINTL.DLL" [0047.739] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" [0047.739] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned="" [0047.740] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x51d0, dwReserved0=0x74, dwReserved1=0x0, cFileName="ACERECR.DLL", cAlternateFileName="")) returned 1 [0047.740] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.740] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACERECR.DLL") returned 1 [0047.740] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACERECR.DLL") returned 1 [0047.740] lstrcmpiA (lpString1="", lpString2="ACERECR.DLL") returned -1 [0047.740] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned="ACEODBCI.DLL" [0047.740] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" [0047.740] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned="" [0047.740] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xd2990, dwReserved0=0x74, dwReserved1=0x0, cFileName="ACEWSTR.DLL", cAlternateFileName="")) returned 1 [0047.740] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.740] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEWSTR.DLL") returned 1 [0047.740] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEWSTR.DLL") returned 1 [0047.740] lstrcmpiA (lpString1="", lpString2="ACEWSTR.DLL") returned -1 [0047.740] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned="ACERECR.DLL" [0047.740] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" [0047.740] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned="" [0047.740] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f139500, ftCreationTime.dwHighDateTime=0x1c69359, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7f139500, ftLastWriteTime.dwHighDateTime=0x1c69359, nFileSizeHigh=0x0, nFileSizeLow=0x19a3ff, dwReserved0=0x74, dwReserved1=0x0, cFileName="ADO210.CHM", cAlternateFileName="")) returned 1 [0047.740] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.740] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ADO210.CHM") returned 1 [0047.740] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADO210.CHM") returned 1 [0047.740] lstrcmpiA (lpString1="", lpString2="ADO210.CHM") returned -1 [0047.740] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned="ACEWSTR.DLL" [0047.740] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" [0047.741] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned="" [0047.741] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b06d00, ftCreationTime.dwHighDateTime=0x1ca9127, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe4b06d00, ftLastWriteTime.dwHighDateTime=0x1ca9127, nFileSizeHigh=0x0, nFileSizeLow=0x25b50, dwReserved0=0x74, dwReserved1=0x0, cFileName="ALRTINTL.DLL", cAlternateFileName="")) returned 1 [0047.741] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.741] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ALRTINTL.DLL") returned 1 [0047.741] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ALRTINTL.DLL") returned 1 [0047.741] lstrcmpiA (lpString1="", lpString2="ALRTINTL.DLL") returned -1 [0047.741] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned="ADO210.CHM" [0047.741] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" [0047.741] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned="" [0047.741] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xc24a9ec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x269380, dwReserved0=0x74, dwReserved1=0x0, cFileName="MSOINTL.DLL", cAlternateFileName="")) returned 1 [0047.741] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.741] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOINTL.DLL") returned -1 [0047.741] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOINTL.DLL") returned -1 [0047.741] lstrcmpiA (lpString1="", lpString2="MSOINTL.DLL") returned -1 [0047.741] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned="ALRTINTL.DLL" [0047.741] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" [0047.741] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned="" [0047.741] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b30dd00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5b30dd00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0xd980, dwReserved0=0x74, dwReserved1=0x0, cFileName="MSOINTL.DLL.IDX_DLL", cAlternateFileName="MSOINT~1.IDX")) returned 1 [0047.741] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.741] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOINTL.DLL.IDX_DLL") returned -1 [0047.741] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOINTL.DLL.IDX_DLL") returned -1 [0047.741] lstrcmpiA (lpString1="", lpString2="MSOINTL.DLL.IDX_DLL") returned -1 [0047.741] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned="MSOINTL.DLL" [0047.742] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" [0047.742] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned="" [0047.742] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c620a00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee8f1b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c620a00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x152f80, dwReserved0=0x74, dwReserved1=0x0, cFileName="MSOINTL.REST.IDX_DLL", cAlternateFileName="MSOINT~2.IDX")) returned 1 [0047.742] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.742] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOINTL.REST.IDX_DLL") returned -1 [0047.742] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOINTL.REST.IDX_DLL") returned -1 [0047.742] lstrcmpiA (lpString1="", lpString2="MSOINTL.REST.IDX_DLL") returned -1 [0047.742] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned="MSOINTL.DLL.IDX_DLL" [0047.742] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" [0047.742] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned="" [0047.742] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0x74, dwReserved1=0x0, cFileName="MSSOAPR3.DLL", cAlternateFileName="")) returned 1 [0047.742] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.742] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSSOAPR3.DLL") returned -1 [0047.742] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSSOAPR3.DLL") returned -1 [0047.742] lstrcmpiA (lpString1="", lpString2="MSSOAPR3.DLL") returned -1 [0047.742] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned="MSOINTL.REST.IDX_DLL" [0047.742] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" [0047.742] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned="" [0047.742] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x356f9800, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x356f9800, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x74, dwReserved1=0x0, cFileName="OARPMANR.DLL", cAlternateFileName="")) returned 1 [0047.743] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.743] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OARPMANR.DLL") returned -1 [0047.743] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OARPMANR.DLL") returned -1 [0047.743] lstrcmpiA (lpString1="", lpString2="OARPMANR.DLL") returned -1 [0047.743] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned="MSSOAPR3.DLL" [0047.743] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" [0047.743] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned="" [0047.743] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d183e00, ftCreationTime.dwHighDateTime=0x1ca520c, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4d183e00, ftLastWriteTime.dwHighDateTime=0x1ca520c, nFileSizeHigh=0x0, nFileSizeLow=0x795, dwReserved0=0x74, dwReserved1=0x0, cFileName="README.HTM", cAlternateFileName="")) returned 1 [0047.743] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.743] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="README.HTM") returned -1 [0047.743] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="README.HTM") returned -1 [0047.743] lstrcmpiA (lpString1="", lpString2="README.HTM") returned -1 [0047.743] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned="OARPMANR.DLL" [0047.743] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" [0047.743] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned="" [0047.743] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x74, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 1 [0047.743] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.743] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="xlsrvintl.dll") returned -1 [0047.743] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="xlsrvintl.dll") returned -1 [0047.743] lstrcmpiA (lpString1="", lpString2="xlsrvintl.dll") returned -1 [0047.743] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned="README.HTM" [0047.743] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" [0047.743] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned="" [0047.744] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x74, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 0 [0047.744] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0047.744] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703dbc00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xd80a4ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x703dbc00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x310788, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0047.744] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.744] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACECORE.DLL") returned 1 [0047.744] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACECORE.DLL") returned 1 [0047.744] lstrcmpiA (lpString1="", lpString2="ACECORE.DLL") returned -1 [0047.744] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*") returned="*.*" [0047.744] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.744] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.748] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.748] CloseHandle (hObject=0x8c) returned 1 [0047.748] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd80f11a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0x0, dwReserved1=0x2d8308, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1 [0047.748] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.748] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEDAO.DLL") returned 1 [0047.748] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEDAO.DLL") returned 1 [0047.748] lstrcmpiA (lpString1="", lpString2="ACEDAO.DLL") returned -1 [0047.748] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned="ACECORE.DLL" [0047.748] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.748] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.748] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xa990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEERR.DLL", cAlternateFileName="")) returned 1 [0047.748] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.748] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEERR.DLL") returned 1 [0047.748] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEERR.DLL") returned 1 [0047.748] lstrcmpiA (lpString1="", lpString2="ACEERR.DLL") returned -1 [0047.748] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned="ACEDAO.DLL" [0047.748] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.748] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.749] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xf73a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEES.DLL", cAlternateFileName="")) returned 1 [0047.749] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.749] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEES.DLL") returned 1 [0047.749] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEES.DLL") returned 1 [0047.749] lstrcmpiA (lpString1="", lpString2="ACEES.DLL") returned -1 [0047.749] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned="ACEERR.DLL" [0047.749] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.749] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.749] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x6bfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCH.DLL", cAlternateFileName="")) returned 1 [0047.749] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.749] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEEXCH.DLL") returned 1 [0047.749] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEEXCH.DLL") returned 1 [0047.749] lstrcmpiA (lpString1="", lpString2="ACEEXCH.DLL") returned -1 [0047.749] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned="ACEES.DLL" [0047.749] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.749] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.749] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xdbb98, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCL.DLL", cAlternateFileName="")) returned 1 [0047.749] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.749] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEEXCL.DLL") returned 1 [0047.749] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEEXCL.DLL") returned 1 [0047.749] lstrcmpiA (lpString1="", lpString2="ACEEXCL.DLL") returned -1 [0047.749] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned="ACEEXCH.DLL" [0047.749] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.749] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.750] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x53bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBC.DLL", cAlternateFileName="")) returned 1 [0047.750] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.750] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEODBC.DLL") returned 1 [0047.750] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEODBC.DLL") returned 1 [0047.750] lstrcmpiA (lpString1="", lpString2="ACEODBC.DLL") returned -1 [0047.750] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned="ACEEXCL.DLL" [0047.750] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.750] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.750] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODDBS.DLL", cAlternateFileName="")) returned 1 [0047.750] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.750] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEODDBS.DLL") returned 1 [0047.750] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEODDBS.DLL") returned 1 [0047.750] lstrcmpiA (lpString1="", lpString2="ACEODDBS.DLL") returned -1 [0047.750] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned="ACEODBC.DLL" [0047.750] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.750] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.750] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODEXL.DLL", cAlternateFileName="")) returned 1 [0047.750] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.750] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEODEXL.DLL") returned 1 [0047.750] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEODEXL.DLL") returned 1 [0047.750] lstrcmpiA (lpString1="", lpString2="ACEODEXL.DLL") returned -1 [0047.750] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned="ACEODDBS.DLL" [0047.751] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.751] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.751] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODTXT.DLL", cAlternateFileName="")) returned 1 [0047.751] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.751] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEODTXT.DLL") returned 1 [0047.751] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEODTXT.DLL") returned 1 [0047.751] lstrcmpiA (lpString1="", lpString2="ACEODTXT.DLL") returned -1 [0047.751] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned="ACEODEXL.DLL" [0047.751] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.751] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.751] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8189720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x833a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEOLEDB.DLL", cAlternateFileName="")) returned 1 [0047.751] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.751] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEOLEDB.DLL") returned 1 [0047.751] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEOLEDB.DLL") returned 1 [0047.751] lstrcmpiA (lpString1="", lpString2="ACEOLEDB.DLL") returned -1 [0047.751] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned="ACEODTXT.DLL" [0047.751] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.751] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.752] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96faef00, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd8247e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x96faef00, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x6e398, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACER3X.DLL", cAlternateFileName="")) returned 1 [0047.752] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.752] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACER3X.DLL") returned 1 [0047.752] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACER3X.DLL") returned 1 [0047.752] lstrcmpiA (lpString1="", lpString2="ACER3X.DLL") returned -1 [0047.752] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned="ACEOLEDB.DLL" [0047.752] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.752] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.752] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0xd9c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERCLR.DLL", cAlternateFileName="")) returned 1 [0047.752] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.752] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACERCLR.DLL") returned 1 [0047.752] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACERCLR.DLL") returned 1 [0047.752] lstrcmpiA (lpString1="", lpString2="ACERCLR.DLL") returned -1 [0047.752] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned="ACER3X.DLL" [0047.752] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.752] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.752] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xa8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEREP.DLL", cAlternateFileName="")) returned 1 [0047.753] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.753] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEREP.DLL") returned 1 [0047.753] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEREP.DLL") returned 1 [0047.753] lstrcmpiA (lpString1="", lpString2="ACEREP.DLL") returned -1 [0047.753] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned="ACERCLR.DLL" [0047.753] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.753] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.753] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82940c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x48990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACETXT.DLL", cAlternateFileName="")) returned 1 [0047.753] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.753] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACETXT.DLL") returned 1 [0047.753] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACETXT.DLL") returned 1 [0047.753] lstrcmpiA (lpString1="", lpString2="ACETXT.DLL") returned -1 [0047.753] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned="ACEREP.DLL" [0047.753] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.753] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.753] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1092c00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xd82ba220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1092c00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x2e8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWDAT.DLL", cAlternateFileName="")) returned 1 [0047.753] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.753] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEWDAT.DLL") returned 1 [0047.753] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEWDAT.DLL") returned 1 [0047.754] lstrcmpiA (lpString1="", lpString2="ACEWDAT.DLL") returned -1 [0047.754] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned="ACETXT.DLL" [0047.754] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.754] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.754] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0c9f00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xcf0c7d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8e0c9f00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x4dba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSS.DLL", cAlternateFileName="")) returned 1 [0047.754] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.754] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEWSS.DLL") returned 1 [0047.754] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEWSS.DLL") returned 1 [0047.754] lstrcmpiA (lpString1="", lpString2="ACEWSS.DLL") returned -1 [0047.754] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned="ACEWDAT.DLL" [0047.754] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.754] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.754] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82e0380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x7a998, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEXBE.DLL", cAlternateFileName="")) returned 1 [0047.754] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.754] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACEXBE.DLL") returned 1 [0047.754] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEXBE.DLL") returned 1 [0047.754] lstrcmpiA (lpString1="", lpString2="ACEXBE.DLL") returned -1 [0047.754] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned="ACEWSS.DLL" [0047.754] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.754] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.755] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c38700, ftCreationTime.dwHighDateTime=0x1cbc9fc, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x67c38700, ftLastWriteTime.dwHighDateTime=0x1cbc9fc, nFileSizeHigh=0x0, nFileSizeLow=0x5e158, dwReserved0=0x0, dwReserved1=0x0, cFileName="ATLCONV.DLL", cAlternateFileName="")) returned 1 [0047.755] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.755] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ATLCONV.DLL") returned 1 [0047.755] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ATLCONV.DLL") returned 1 [0047.755] lstrcmpiA (lpString1="", lpString2="ATLCONV.DLL") returned -1 [0047.755] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned="ACEXBE.DLL" [0047.755] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.755] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.755] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb10f7500, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0xda5b0540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb10f7500, ftLastWriteTime.dwHighDateTime=0x1cbe56c, nFileSizeHigh=0x0, nFileSizeLow=0x4d67b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Csi.dll", cAlternateFileName="")) returned 1 [0047.755] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.755] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Csi.dll") returned 1 [0047.755] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Csi.dll") returned 1 [0047.755] lstrcmpiA (lpString1="", lpString2="Csi.dll") returned -1 [0047.755] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned="ATLCONV.DLL" [0047.755] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.755] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.755] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef87d800, ftCreationTime.dwHighDateTime=0x1cb8cce, ftLastAccessTime.dwLowDateTime=0xda5d66a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xef87d800, ftLastWriteTime.dwHighDateTime=0x1cb8cce, nFileSizeHigh=0x0, nFileSizeLow=0x1b3980, dwReserved0=0x0, dwReserved1=0x0, cFileName="CsiSoap.dll", cAlternateFileName="")) returned 1 [0047.755] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.755] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CsiSoap.dll") returned 1 [0047.755] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CsiSoap.dll") returned 1 [0047.756] lstrcmpiA (lpString1="", lpString2="CsiSoap.dll") returned -1 [0047.756] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned="Csi.dll" [0047.756] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.756] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.756] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cultures", cAlternateFileName="")) returned 1 [0047.756] lstrcmpA (lpString1=".", lpString2="Cultures") returned -1 [0047.756] lstrcmpA (lpString1="..", lpString2="Cultures") returned -1 [0047.756] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned="CsiSoap.dll" [0047.756] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d80d0, cFileName=".", cAlternateFileName="")) returned 0x2d80c8 [0047.757] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.757] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.757] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.757] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.757] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1 [0047.757] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.757] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OFFICE.ODF") returned -1 [0047.757] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OFFICE.ODF") returned -1 [0047.757] lstrcmpiA (lpString1="", lpString2="OFFICE.ODF") returned -1 [0047.757] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*.*") returned="*.*" [0047.757] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\" [0047.757] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\") returned="" [0047.759] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.759] CloseHandle (hObject=0x90) returned 1 [0047.759] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 0 [0047.759] FindClose (in: hFindFile=0x2d80c8 | out: hFindFile=0x2d80c8) returned 1 [0047.759] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x7eb48, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0047.759] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.759] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EXPSRV.DLL") returned -1 [0047.759] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXPSRV.DLL") returned 1 [0047.759] lstrcmpiA (lpString1="", lpString2="EXPSRV.DLL") returned -1 [0047.759] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*") returned="*.*" [0047.759] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.759] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.759] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebd7300, ftCreationTime.dwHighDateTime=0x1cba5c3, ftLastAccessTime.dwLowDateTime=0xcef710e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3ebd7300, ftLastWriteTime.dwHighDateTime=0x1cba5c3, nFileSizeHigh=0x0, nFileSizeLow=0x21d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_PDF.DLL", cAlternateFileName="")) returned 1 [0047.759] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.759] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EXP_PDF.DLL") returned -1 [0047.759] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXP_PDF.DLL") returned 1 [0047.759] lstrcmpiA (lpString1="", lpString2="EXP_PDF.DLL") returned -1 [0047.759] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned="EXPSRV.DLL" [0047.759] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.760] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.760] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5bf6900, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf5b0aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5bf6900, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x11578, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_XPS.DLL", cAlternateFileName="")) returned 1 [0047.760] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.760] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EXP_XPS.DLL") returned -1 [0047.760] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXP_XPS.DLL") returned 1 [0047.760] lstrcmpiA (lpString1="", lpString2="EXP_XPS.DLL") returned -1 [0047.760] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned="EXP_PDF.DLL" [0047.760] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.760] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.760] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd66e7600, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xe572de20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd66e7600, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x26560, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLTLDR.EXE", cAlternateFileName="")) returned 1 [0047.760] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.760] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FLTLDR.EXE") returned -1 [0047.760] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FLTLDR.EXE") returned 1 [0047.760] lstrcmpiA (lpString1="", lpString2="FLTLDR.EXE") returned -1 [0047.760] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned="EXP_XPS.DLL" [0047.760] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.760] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.760] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7bf3f00, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7bf3f00, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x417360, dwReserved0=0x0, dwReserved1=0x0, cFileName="IACOM2.DLL", cAlternateFileName="")) returned 1 [0047.760] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.760] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IACOM2.DLL") returned -1 [0047.760] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IACOM2.DLL") returned -1 [0047.760] lstrcmpiA (lpString1="", lpString2="IACOM2.DLL") returned -1 [0047.760] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned="FLTLDR.EXE" [0047.760] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.760] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.761] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x31d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICLUA.EXE", cAlternateFileName="")) returned 1 [0047.761] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.761] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LICLUA.EXE") returned -1 [0047.761] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LICLUA.EXE") returned -1 [0047.761] lstrcmpiA (lpString1="", lpString2="LICLUA.EXE") returned -1 [0047.761] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned="IACOM2.DLL" [0047.761] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.761] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.761] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc821f600, ftCreationTime.dwHighDateTime=0x1cbdfb3, ftLastAccessTime.dwLowDateTime=0xd776b9a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc821f600, ftLastWriteTime.dwHighDateTime=0x1cbdfb3, nFileSizeHigh=0x0, nFileSizeLow=0x183d780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.DLL", cAlternateFileName="")) returned 1 [0047.761] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.761] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSO.DLL") returned -1 [0047.761] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSO.DLL") returned -1 [0047.761] lstrcmpiA (lpString1="", lpString2="MSO.DLL") returned -1 [0047.761] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned="LICLUA.EXE" [0047.761] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.761] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.761] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee94c400, ftCreationTime.dwHighDateTime=0x1cb7007, ftLastAccessTime.dwLowDateTime=0xd6225500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xee94c400, ftLastWriteTime.dwHighDateTime=0x1cb7007, nFileSizeHigh=0x0, nFileSizeLow=0x73b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOICONS.EXE", cAlternateFileName="")) returned 1 [0047.761] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.761] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOICONS.EXE") returned -1 [0047.761] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOICONS.EXE") returned -1 [0047.761] lstrcmpiA (lpString1="", lpString2="MSOICONS.EXE") returned -1 [0047.761] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned="MSO.DLL" [0047.761] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.761] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.761] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xec32f3e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x4529780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSORES.DLL", cAlternateFileName="")) returned 1 [0047.761] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.761] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSORES.DLL") returned -1 [0047.762] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSORES.DLL") returned -1 [0047.762] lstrcmpiA (lpString1="", lpString2="MSORES.DLL") returned -1 [0047.762] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned="MSOICONS.EXE" [0047.762] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.762] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.762] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4293d00, ftCreationTime.dwHighDateTime=0x1cbc468, ftLastAccessTime.dwLowDateTime=0xd77dddc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa4293d00, ftLastWriteTime.dwHighDateTime=0x1cbc468, nFileSizeHigh=0x0, nFileSizeLow=0x135f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoshext.dll", cAlternateFileName="")) returned 1 [0047.762] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.762] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msoshext.dll") returned -1 [0047.762] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msoshext.dll") returned -1 [0047.762] lstrcmpiA (lpString1="", lpString2="msoshext.dll") returned -1 [0047.762] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned="MSORES.DLL" [0047.762] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.762] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.762] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc276d800, ftCreationTime.dwHighDateTime=0x1cab8aa, ftLastAccessTime.dwLowDateTime=0x6a050eb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc276d800, ftLastWriteTime.dwHighDateTime=0x1cab8aa, nFileSizeHigh=0x0, nFileSizeLow=0xdb50, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXEV.DLL", cAlternateFileName="")) returned 1 [0047.762] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.762] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOXEV.DLL") returned -1 [0047.763] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOXEV.DLL") returned -1 [0047.763] lstrcmpiA (lpString1="", lpString2="MSOXEV.DLL") returned -1 [0047.763] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned="msoshext.dll" [0047.763] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.763] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.763] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1d950, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLED.EXE", cAlternateFileName="")) returned 1 [0047.763] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.763] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOXMLED.EXE") returned -1 [0047.763] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOXMLED.EXE") returned -1 [0047.763] lstrcmpiA (lpString1="", lpString2="MSOXMLED.EXE") returned -1 [0047.763] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned="MSOXEV.DLL" [0047.763] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.763] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.763] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0xdb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLMF.DLL", cAlternateFileName="")) returned 1 [0047.763] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.763] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOXMLMF.DLL") returned -1 [0047.763] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOXMLMF.DLL") returned -1 [0047.763] lstrcmpiA (lpString1="", lpString2="MSOXMLMF.DLL") returned -1 [0047.763] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned="MSOXMLED.EXE" [0047.763] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.763] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.763] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3922200, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3922200, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x124980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPTLS.DLL", cAlternateFileName="")) returned 1 [0047.763] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.763] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSPTLS.DLL") returned -1 [0047.763] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPTLS.DLL") returned -1 [0047.763] lstrcmpiA (lpString1="", lpString2="MSPTLS.DLL") returned -1 [0047.764] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned="MSOXMLMF.DLL" [0047.764] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.764] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.764] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xac370, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAP30.DLL", cAlternateFileName="")) returned 1 [0047.764] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.764] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSSOAP30.DLL") returned -1 [0047.764] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSSOAP30.DLL") returned -1 [0047.764] lstrcmpiA (lpString1="", lpString2="MSSOAP30.DLL") returned -1 [0047.764] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned="MSPTLS.DLL" [0047.764] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.764] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.764] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x1a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUAUTH.CAB", cAlternateFileName="")) returned 1 [0047.764] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.777] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MUAUTH.CAB") returned -1 [0047.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MUAUTH.CAB") returned -1 [0047.777] lstrcmpiA (lpString1="", lpString2="MUAUTH.CAB") returned -1 [0047.778] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned="MSSOAP30.DLL" [0047.778] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.778] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.778] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x6190, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUOPTIN.DLL", cAlternateFileName="")) returned 1 [0047.778] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.778] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MUOPTIN.DLL") returned -1 [0047.778] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MUOPTIN.DLL") returned -1 [0047.778] lstrcmpiA (lpString1="", lpString2="MUOPTIN.DLL") returned -1 [0047.778] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned="MUAUTH.CAB" [0047.778] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.778] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.778] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x161d5800, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xd63a22c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x161d5800, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x38d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oarpmany.exe", cAlternateFileName="")) returned 1 [0047.778] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.778] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Oarpmany.exe") returned -1 [0047.778] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Oarpmany.exe") returned -1 [0047.778] lstrcmpiA (lpString1="", lpString2="Oarpmany.exe") returned -1 [0047.778] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned="MUOPTIN.DLL" [0047.778] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.778] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.778] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d2900, ftCreationTime.dwHighDateTime=0x1cab9ac, ftLastAccessTime.dwLowDateTime=0xbe0f9da0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7f9d2900, ftLastWriteTime.dwHighDateTime=0x1cab9ac, nFileSizeHigh=0x0, nFileSizeLow=0x7568, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBCMON.DLL", cAlternateFileName="")) returned 1 [0047.778] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.778] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ODBCMON.DLL") returned -1 [0047.778] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ODBCMON.DLL") returned -1 [0047.779] lstrcmpiA (lpString1="", lpString2="ODBCMON.DLL") returned -1 [0047.779] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned="Oarpmany.exe" [0047.779] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.779] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.779] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1 [0047.779] lstrcmpA (lpString1=".", lpString2="Office Setup Controller") returned -1 [0047.779] lstrcmpA (lpString1="..", lpString2="Office Setup Controller") returned -1 [0047.779] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned="ODBCMON.DLL" [0047.779] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d80d0, cFileName=".", cAlternateFileName="")) returned 0x2d80e0 [0047.781] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.781] FindNextFileA (in: hFindFile=0x2d80e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.782] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.782] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.782] FindNextFileA (in: hFindFile=0x2d80e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0047.782] lstrcmpA (lpString1=".", lpString2="Access.en-us") returned -1 [0047.782] lstrcmpA (lpString1="..", lpString2="Access.en-us") returned -1 [0047.782] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0047.782] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2db3c0, dwReserved1=0x2db3bb, cFileName=".", cAlternateFileName="")) returned 0x2d8030 [0047.785] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.785] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.785] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.786] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.786] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AccessMUI.XML", cAlternateFileName="ACCESS~1.XML")) returned 1 [0047.786] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.786] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AccessMUI.XML") returned 1 [0047.786] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccessMUI.XML") returned 1 [0047.786] lstrcmpiA (lpString1="", lpString2="AccessMUI.XML") returned -1 [0047.786] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*") returned="*.*" [0047.786] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\" [0047.786] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\") returned="" [0047.787] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.787] CloseHandle (hObject=0x94) returned 1 [0047.787] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x2d8440, cFileName="AccessMUISet.XML", cAlternateFileName="ACCESS~2.XML")) returned 1 [0047.787] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.787] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AccessMUISet.XML") returned 1 [0047.787] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccessMUISet.XML") returned 1 [0047.788] lstrcmpiA (lpString1="", lpString2="AccessMUISet.XML") returned -1 [0047.788] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned="AccessMUI.XML" [0047.788] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\" [0047.788] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\") returned="" [0047.788] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x730073, dwReserved1=0x65002e, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0047.788] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.788] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SETUP.XML") returned -1 [0047.788] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETUP.XML") returned -1 [0047.788] lstrcmpiA (lpString1="", lpString2="SETUP.XML") returned -1 [0047.788] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned="AccessMUISet.XML" [0047.788] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\" [0047.788] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\") returned="" [0047.788] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x730073, dwReserved1=0x65002e, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0047.788] FindClose (in: hFindFile=0x2d8030 | out: hFindFile=0x2d8030) returned 1 [0047.788] FindNextFileA (in: hFindFile=0x2d80e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1 [0047.788] lstrcmpA (lpString1=".", lpString2="Excel.en-us") returned -1 [0047.788] lstrcmpA (lpString1="..", lpString2="Excel.en-us") returned -1 [0047.788] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0047.788] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x730073, dwReserved1=0x65002e, cFileName=".", cAlternateFileName="")) returned 0x2d8030 [0047.789] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.789] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x650000, cFileName="..", cAlternateFileName="")) returned 1 [0047.789] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.789] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.789] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 1 [0047.789] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.789] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ExcelMUI.XML") returned -1 [0047.789] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExcelMUI.XML") returned 1 [0047.789] lstrcmpiA (lpString1="", lpString2="ExcelMUI.XML") returned -1 [0047.789] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*") returned="*.*" [0047.790] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\" [0047.790] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\") returned="" [0047.791] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.791] CloseHandle (hObject=0x94) returned 1 [0047.791] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x2d8440, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0047.791] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.791] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SETUP.XML") returned -1 [0047.791] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETUP.XML") returned -1 [0047.791] lstrcmpiA (lpString1="", lpString2="SETUP.XML") returned -1 [0047.791] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned="ExcelMUI.XML" [0047.791] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\" [0047.791] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\") returned="" [0047.791] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x2d8440, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0047.791] FindClose (in: hFindFile=0x2d8030 | out: hFindFile=0x2d8030) returned 1 [0047.791] FindNextFileA (in: hFindFile=0x2d80e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1 [0047.791] lstrcmpA (lpString1=".", lpString2="Groove.en-us") returned -1 [0047.792] lstrcmpA (lpString1="..", lpString2="Groove.en-us") returned -1 [0047.792] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0047.792] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e006c, dwReserved1=0x6e0065, cFileName=".", cAlternateFileName="")) returned 0x2d8030 [0047.795] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.795] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x6e0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.795] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.795] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0047.795] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 1 [0047.795] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.795] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GrooveMUI.XML") returned -1 [0047.795] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GrooveMUI.XML") returned 1 [0047.795] lstrcmpiA (lpString1="", lpString2="GrooveMUI.XML") returned -1 [0047.795] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*") returned="*.*" [0047.795] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\" [0047.795] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\") returned="" [0047.811] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0047.811] CloseHandle (hObject=0x94) returned 1 [0047.811] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x2d8440, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0047.811] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.811] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SETUP.XML") returned -1 [0047.811] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETUP.XML") returned -1 [0047.811] lstrcmpiA (lpString1="", lpString2="SETUP.XML") returned -1 [0047.811] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned="GrooveMUI.XML" [0047.812] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\" [0047.812] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\") returned="" [0047.812] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x2d8440, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0047.812] FindClose (in: hFindFile=0x2d8030 | out: hFindFile=0x2d8030) returned 1 [0047.812] FindNextFileA (in: hFindFile=0x2d80e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1 [0047.812] lstrcmpA (lpString1=".", lpString2="InfoPath.en-us") returned -1 [0047.812] lstrcmpA (lpString1="..", lpString2="InfoPath.en-us") returned -1 [0047.812] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0047.812] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650076, dwReserved1=0x65002e, cFileName=".", cAlternateFileName="")) returned 0x2d8030 [0047.813] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0047.813] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x650000, cFileName="..", cAlternateFileName="")) returned 1 [0047.813] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0047.814] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="InfoPathMUI.XML", cAlternateFileName="INFOPA~1.XML")) returned 1 [0047.814] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.814] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InfoPathMUI.XML") returned -1 [0047.814] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InfoPathMUI.XML") returned -1 [0047.814] lstrcmpiA (lpString1="", lpString2="InfoPathMUI.XML") returned -1 [0047.814] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*") returned="*.*" [0047.814] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\" [0047.814] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\") returned="" [0047.817] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x2d8440, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0047.817] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.817] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SETUP.XML") returned -1 [0047.817] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETUP.XML") returned -1 [0047.817] lstrcmpiA (lpString1="", lpString2="SETUP.XML") returned -1 [0047.817] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned="InfoPathMUI.XML" [0047.817] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\" [0047.817] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\") returned="" [0047.817] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x2d8440, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0047.817] FindClose (in: hFindFile=0x2d8030 | out: hFindFile=0x2d8030) returned 1 [0047.817] FindNextFileA (in: hFindFile=0x2d80e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1 [0047.818] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.818] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ODeploy.exe") returned -1 [0047.818] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ODeploy.exe") returned -1 [0047.818] lstrcmpiA (lpString1="", lpString2="ODeploy.exe") returned -1 [0047.818] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0047.818] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" [0047.818] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="" [0047.819] FindNextFileA (in: hFindFile=0x2d80e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8428, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 1 [0047.819] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned="ODeploy.exe" [0047.819] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d81f0, cFileName=".", cAlternateFileName="")) returned 0x2d8030 [0047.821] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.821] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9fff00, ftCreationTime.dwHighDateTime=0x1cba028, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e9fff00, ftLastWriteTime.dwHighDateTime=0x1cba028, nFileSizeHigh=0x0, nFileSizeLow=0x3b78, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1 [0047.821] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.821] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BRANDING.DLL") returned 1 [0047.821] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BRANDING.DLL") returned 1 [0047.821] lstrcmpiA (lpString1="", lpString2="BRANDING.DLL") returned -1 [0047.821] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*") returned="*.*" [0047.821] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" [0047.821] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="" [0047.822] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x470e1800, ftCreationTime.dwHighDateTime=0x1caccea, ftLastAccessTime.dwLowDateTime=0x15334ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x470e1800, ftLastWriteTime.dwHighDateTime=0x1caccea, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x2d8440, cFileName="BRANDING.XML", cAlternateFileName="")) returned 1 [0047.823] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.823] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned="BRANDING.DLL" [0047.823] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" [0047.823] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="" [0047.823] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4114ea00, ftCreationTime.dwHighDateTime=0x1ca6af2, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4114ea00, ftLastWriteTime.dwHighDateTime=0x1ca6af2, nFileSizeHigh=0x0, nFileSizeLow=0x11644, dwReserved0=0x650063, dwReserved1=0x65002e, cFileName="OCT.CHM", cAlternateFileName="")) returned 1 [0047.823] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.823] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned="BRANDING.XML" [0047.823] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" [0047.823] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="" [0047.823] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c27050, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x650063, dwReserved1=0x65002e, cFileName="OfficeMUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0047.823] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.823] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned="OCT.CHM" [0047.823] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" [0047.823] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="" [0047.823] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x650063, dwReserved1=0x65002e, cFileName="OfficeMUISet.XML", cAlternateFileName="OFFICE~2.XML")) returned 1 [0047.823] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.823] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned="OfficeMUI.XML" [0047.823] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" [0047.823] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="" [0047.823] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x650063, dwReserved1=0x65002e, cFileName="OSETUPUI.DLL", cAlternateFileName="")) returned 1 [0047.823] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.824] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned="OfficeMUISet.XML" [0047.824] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" [0047.824] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="" [0047.824] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4804a00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd4804a00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x650063, dwReserved1=0x65002e, cFileName="promointl.dll", cAlternateFileName="PROMOI~1.DLL")) returned 1 [0047.824] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.824] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned="OSETUPUI.DLL" [0047.824] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" [0047.824] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="" [0047.824] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0b6300, ftCreationTime.dwHighDateTime=0x1ca9107, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2d0b6300, ftLastWriteTime.dwHighDateTime=0x1ca9107, nFileSizeHigh=0x0, nFileSizeLow=0x9339, dwReserved0=0x650063, dwReserved1=0x65002e, cFileName="PSCONFIG.CHM", cAlternateFileName="")) returned 1 [0047.824] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.824] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned="promointl.dll" [0047.824] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" [0047.824] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="" [0047.825] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a8bce00, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7a8bce00, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6931, dwReserved0=0x650063, dwReserved1=0x65002e, cFileName="PSS10O.CHM", cAlternateFileName="")) returned 1 [0047.825] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.825] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned="PSCONFIG.CHM" [0047.825] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" [0047.825] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="" [0047.825] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d4800, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa7d4800, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x650063, dwReserved1=0x65002e, cFileName="PSS10R.CHM", cAlternateFileName="")) returned 1 [0047.825] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.825] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned="PSS10O.CHM" [0047.825] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" [0047.825] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="" [0047.825] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49087c00, ftCreationTime.dwHighDateTime=0x1ca95c1, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49087c00, ftLastWriteTime.dwHighDateTime=0x1ca95c1, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x650063, dwReserved1=0x65002e, cFileName="SETUP.CHM", cAlternateFileName="")) returned 1 [0047.825] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.825] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned="PSS10R.CHM" [0047.825] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" [0047.825] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="" [0047.825] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x650063, dwReserved1=0x65002e, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0047.825] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.825] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned="SETUP.CHM" [0047.825] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" [0047.825] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned="" [0047.826] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x650063, dwReserved1=0x65002e, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0047.826] FindClose (in: hFindFile=0x2d8030 | out: hFindFile=0x2d8030) returned 1 [0047.826] FindNextFileA (in: hFindFile=0x2d80e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Office32.en-us", cAlternateFileName="OFFICE~2.EN-")) returned 1 [0047.826] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0047.826] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650063, dwReserved1=0x65002e, cFileName=".", cAlternateFileName="")) returned 0x2d8030 [0047.827] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x650000, cFileName="..", cAlternateFileName="")) returned 1 [0047.827] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Office32MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0047.827] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.827] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*") returned="*.*" [0047.827] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\" [0047.827] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\") returned="" [0047.834] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x2d8440, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0047.834] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.834] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned="Office32MUI.XML" [0047.834] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\" [0047.835] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\") returned="" [0047.835] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x2d8440, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0047.835] FindClose (in: hFindFile=0x2d8030 | out: hFindFile=0x2d8030) returned 1 [0047.835] FindNextFileA (in: hFindFile=0x2d80e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Office32.WW", cAlternateFileName="")) returned 1 [0047.835] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0047.835] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650063, dwReserved1=0x320033, cFileName=".", cAlternateFileName="")) returned 0x2d8030 [0047.836] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x320000, cFileName="..", cAlternateFileName="")) returned 1 [0047.836] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0047.836] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.836] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*.*") returned="*.*" [0047.836] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\" [0047.836] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\") returned="" [0047.837] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 0 [0047.837] FindClose (in: hFindFile=0x2d8030 | out: hFindFile=0x2d8030) returned 1 [0047.838] FindNextFileA (in: hFindFile=0x2d80e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="OneNote.en-us", cAlternateFileName="ONENOT~1.EN-")) returned 1 [0047.838] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0047.838] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8440, cFileName=".", cAlternateFileName="")) returned 0x2d8030 [0047.839] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.839] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="OneNoteMUI.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0047.839] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.839] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*") returned="*.*" [0047.839] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\" [0047.839] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\") returned="" [0047.842] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x2d8440, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0047.842] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.842] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned="OneNoteMUI.XML" [0047.842] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\" [0047.842] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\") returned="" [0047.842] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x2d8440, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0047.842] FindClose (in: hFindFile=0x2d8030 | out: hFindFile=0x2d8030) returned 1 [0047.842] FindNextFileA (in: hFindFile=0x2d80e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0047.842] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.842] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0047.843] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" [0047.843] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="" [0047.843] FindNextFileA (in: hFindFile=0x2d80e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0xb9a0, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName="OSetupPS.dll", cAlternateFileName="")) returned 1 [0047.843] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.843] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned="OSETUP.DLL" [0047.843] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" [0047.843] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="" [0047.843] FindNextFileA (in: hFindFile=0x2d80e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName="Outlook.en-us", cAlternateFileName="OUTLOO~1.EN-")) returned 1 [0047.843] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned="OSetupPS.dll" [0047.843] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d81f0, cFileName=".", cAlternateFileName="")) returned 0x2d8030 [0047.844] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.844] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0047.844] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.844] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*") returned="*.*" [0047.844] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\" [0047.844] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\") returned="" [0047.847] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x2d8440, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0047.847] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.847] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned="OutlookMUI.XML" [0047.847] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\" [0047.847] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\") returned="" [0047.847] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x2d8440, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0047.847] FindClose (in: hFindFile=0x2d8030 | out: hFindFile=0x2d8030) returned 1 [0047.848] FindNextFileA (in: hFindFile=0x2d80e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0047.848] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.848] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0047.848] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" [0047.848] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="" [0047.848] FindNextFileA (in: hFindFile=0x2d80e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17eefe00, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17eefe00, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0047.848] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.848] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned="pidgenx.dll" [0047.848] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" [0047.848] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="" [0047.848] FindNextFileA (in: hFindFile=0x2d80e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6904ef00, ftCreationTime.dwHighDateTime=0x1ca912c, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6904ef00, ftLastWriteTime.dwHighDateTime=0x1ca912c, nFileSizeHigh=0x0, nFileSizeLow=0x3d78, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1 [0047.848] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.848] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned="pkeyconfig-office.xrm-ms" [0047.848] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" [0047.848] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="" [0047.848] FindNextFileA (in: hFindFile=0x2d80e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName="PowerPoint.en-us", cAlternateFileName="POWERP~1.EN-")) returned 1 [0047.848] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned="pkeyconfig.companion.dll" [0047.848] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d81f0, cFileName=".", cAlternateFileName="")) returned 0x2d8030 [0047.849] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.849] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PowerPointMUI.XML", cAlternateFileName="POWERP~1.XML")) returned 1 [0047.849] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.849] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*") returned="*.*" [0047.849] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\" [0047.849] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\") returned="" [0047.853] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x2d8448, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0047.853] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.853] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned="PowerPointMUI.XML" [0047.853] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\" [0047.853] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\") returned="" [0047.853] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x2d8448, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0047.854] FindClose (in: hFindFile=0x2d8030 | out: hFindFile=0x2d8030) returned 1 [0047.854] FindNextFileA (in: hFindFile=0x2d80e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="PRJPROR", cAlternateFileName="")) returned 1 [0047.854] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0047.854] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x500072, dwReserved1=0x69006f, cFileName=".", cAlternateFileName="")) returned 0x2d8030 [0047.854] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x690000, cFileName="..", cAlternateFileName="")) returned 1 [0047.854] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PrjProrWW.XML", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0047.854] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.854] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*") returned="*.*" [0047.854] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\" [0047.854] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\") returned="" [0047.856] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x2d8438, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0047.856] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.856] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned="PrjProrWW.XML" [0047.856] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\" [0047.856] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\") returned="" [0047.856] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x2d8438, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0047.856] FindClose (in: hFindFile=0x2d8030 | out: hFindFile=0x2d8030) returned 1 [0047.856] FindNextFileA (in: hFindFile=0x2d80e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Project.en-us", cAlternateFileName="PROJEC~1.EN-")) returned 1 [0047.856] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0047.856] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f0052, dwReserved1=0x5c0052, cFileName=".", cAlternateFileName="")) returned 0x2d8030 [0047.862] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x5c0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.862] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ProjectMUI.XML", cAlternateFileName="PROJEC~1.XML")) returned 1 [0047.862] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.862] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*") returned="*.*" [0047.862] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\" [0047.862] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\") returned="" [0047.865] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x2d8440, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0047.865] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.865] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned="ProjectMUI.XML" [0047.865] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\" [0047.865] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\") returned="" [0047.866] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x2d8440, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0047.866] FindClose (in: hFindFile=0x2d8030 | out: hFindFile=0x2d8030) returned 1 [0047.866] FindNextFileA (in: hFindFile=0x2d80e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0047.866] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0047.866] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630065, dwReserved1=0x2e0074, cFileName=".", cAlternateFileName="")) returned 0x2d8030 [0047.867] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.867] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0047.867] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.867] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*.*") returned="*.*" [0047.867] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\" [0047.867] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\") returned="" [0047.868] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0047.868] FindClose (in: hFindFile=0x2d8030 | out: hFindFile=0x2d8030) returned 1 [0047.868] FindNextFileA (in: hFindFile=0x2d80e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0047.868] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0047.868] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8438, cFileName=".", cAlternateFileName="")) returned 0x2d8030 [0047.869] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.869] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0047.869] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.869] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*.*") returned="*.*" [0047.869] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\" [0047.869] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\") returned="" [0047.870] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0047.871] FindClose (in: hFindFile=0x2d8030 | out: hFindFile=0x2d8030) returned 1 [0047.871] FindNextFileA (in: hFindFile=0x2d80e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0047.871] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0047.871] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8438, cFileName=".", cAlternateFileName="")) returned 0x2d8030 [0047.872] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.872] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0047.872] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.872] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*.*") returned="*.*" [0047.872] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\" [0047.872] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\") returned="" [0047.873] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0047.873] FindClose (in: hFindFile=0x2d8030 | out: hFindFile=0x2d8030) returned 1 [0047.874] FindNextFileA (in: hFindFile=0x2d80e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Proofing.en-us", cAlternateFileName="PROOFI~1.EN-")) returned 1 [0047.874] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0047.874] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8438, cFileName=".", cAlternateFileName="")) returned 0x2d8030 [0047.874] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.874] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Proofing.XML", cAlternateFileName="")) returned 1 [0047.874] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.874] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*") returned="*.*" [0047.874] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\" [0047.874] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\") returned="" [0047.875] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x2d8440, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0047.875] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.875] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned="Proofing.XML" [0047.875] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\" [0047.875] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\") returned="" [0047.875] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x2d8440, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0047.875] FindClose (in: hFindFile=0x2d8030 | out: hFindFile=0x2d8030) returned 1 [0047.876] FindNextFileA (in: hFindFile=0x2d80e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="PROPLUSR", cAlternateFileName="")) returned 1 [0047.876] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0047.876] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690066, dwReserved1=0x67006e, cFileName=".", cAlternateFileName="")) returned 0x2d8030 [0047.877] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x670000, cFileName="..", cAlternateFileName="")) returned 1 [0047.877] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ProPlusrWW.XML", cAlternateFileName="PROPLU~1.XML")) returned 1 [0047.877] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.877] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*") returned="*.*" [0047.877] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\" [0047.877] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\") returned="" [0047.878] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x2d8438, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0047.878] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.878] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned="ProPlusrWW.XML" [0047.879] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\" [0047.879] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\") returned="" [0047.879] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x2d8438, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0047.879] FindClose (in: hFindFile=0x2d8030 | out: hFindFile=0x2d8030) returned 1 [0047.879] FindNextFileA (in: hFindFile=0x2d80e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Publisher.en-us", cAlternateFileName="PUBLIS~1.EN-")) returned 1 [0047.879] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0047.879] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x55004c, dwReserved1=0x520053, cFileName=".", cAlternateFileName="")) returned 0x2d8030 [0047.880] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x520000, cFileName="..", cAlternateFileName="")) returned 1 [0047.880] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PublisherMUI.XML", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0047.880] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.880] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*") returned="*.*" [0047.880] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\" [0047.880] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\") returned="" [0047.882] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x2d8448, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0047.882] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.882] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned="PublisherMUI.XML" [0047.882] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\" [0047.883] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\") returned="" [0047.883] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x2d8448, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0047.883] FindClose (in: hFindFile=0x2d8030 | out: hFindFile=0x2d8030) returned 1 [0047.883] FindNextFileA (in: hFindFile=0x2d80e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cba0700, ftCreationTime.dwHighDateTime=0x1cb7664, ftLastAccessTime.dwLowDateTime=0xd78c2600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8cba0700, ftLastWriteTime.dwHighDateTime=0x1cb7664, nFileSizeHigh=0x0, nFileSizeLow=0x150378, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0047.883] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.883] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0047.883] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" [0047.883] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned="" [0047.883] FindNextFileA (in: hFindFile=0x2d80e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName="Visio.en-us", cAlternateFileName="VISIO~1.EN-")) returned 1 [0047.883] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned="Setup.exe" [0047.883] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d81f0, cFileName=".", cAlternateFileName="")) returned 0x2d8030 [0047.885] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.885] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0047.885] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.885] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*") returned="*.*" [0047.885] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\" [0047.885] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\") returned="" [0047.887] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x2d8440, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 1 [0047.887] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.887] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned="SETUP.XML" [0047.887] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\" [0047.887] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\") returned="" [0047.887] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x2d8440, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 0 [0047.888] FindClose (in: hFindFile=0x2d8030 | out: hFindFile=0x2d8030) returned 1 [0047.888] FindNextFileA (in: hFindFile=0x2d80e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="VISIOR", cAlternateFileName="")) returned 1 [0047.888] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0047.888] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e006f, dwReserved1=0x6e0065, cFileName=".", cAlternateFileName="")) returned 0x2d8030 [0047.888] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x6e0000, cFileName="..", cAlternateFileName="")) returned 1 [0047.888] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0047.888] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.888] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*") returned="*.*" [0047.888] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\" [0047.888] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\") returned="" [0047.890] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x2d8430, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 1 [0047.890] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.890] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned="SETUP.XML" [0047.890] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\" [0047.890] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\") returned="" [0047.890] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x2d8430, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 0 [0047.890] FindClose (in: hFindFile=0x2d8030 | out: hFindFile=0x2d8030) returned 1 [0047.890] FindNextFileA (in: hFindFile=0x2d80e0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 1 [0047.890] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*") returned="*.*" [0047.890] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52004f, dwReserved1=0x48005c, cFileName=".", cAlternateFileName="")) returned 0x2d8030 [0047.891] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x480000, cFileName="..", cAlternateFileName="")) returned 1 [0047.891] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe076d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0047.891] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.891] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*") returned="*.*" [0047.891] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\" [0047.891] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\") returned="" [0047.899] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x2d8438, cFileName="WordMUI.XML", cAlternateFileName="")) returned 1 [0047.899] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.899] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned="SETUP.XML" [0047.899] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\" [0047.899] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\") returned="" [0047.900] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.900] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*") returned="*.*" [0047.900] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.900] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.900] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.900] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned="OFFREL.DLL" [0047.900] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.900] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.900] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.900] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned="OPHPROXY.DLL" [0047.900] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.900] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.900] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.900] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned="OPTINPS.DLL" [0047.900] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.900] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.900] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.900] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned="PJ11OD11.DLL" [0047.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.901] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.901] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.901] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned="PJRESC.DLL" [0047.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.901] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.901] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.901] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned="PRJRES.DLL" [0047.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.901] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.901] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.901] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned="RICHED20.DLL" [0047.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.901] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.901] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.901] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned="SERCONV.DLL" [0047.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.901] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.901] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.901] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned="USP10.DLL" [0047.902] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.902] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.902] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.902] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned="VBAJET32.DLL" [0047.902] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" [0047.902] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned="" [0047.902] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0047.902] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d80a0 [0047.903] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.903] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*") returned="*.*" [0047.903] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" [0047.903] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="" [0047.904] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.904] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned="OSPPC.DLL" [0047.904] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" [0047.904] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="" [0047.905] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.905] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned="OSPPCEXT.DLL" [0047.905] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" [0047.905] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="" [0047.905] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.905] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned="osppobjs-spp-plugin-manifest-signed.xrm-ms" [0047.905] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" [0047.905] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="" [0047.905] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.905] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned="OSPPOBJS.DLL" [0047.905] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" [0047.905] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="" [0047.905] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.905] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned="OSPPREARM.EXE" [0047.905] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" [0047.905] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="" [0047.905] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.905] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned="OSPPSVC.EXE" [0047.905] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" [0047.905] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="" [0047.906] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.906] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned="OSPPWMI.DLL" [0047.906] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" [0047.906] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned="" [0047.906] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0047.906] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.907] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.907] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*") returned="*.*" [0047.907] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\" [0047.907] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\") returned="" [0047.909] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.909] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned="MSLID.DLL" [0047.909] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\" [0047.909] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\") returned="" [0047.910] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.910] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned="MSWDS_EN.LEX" [0047.910] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\" [0047.910] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\") returned="" [0047.910] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.910] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned="MSWDS_ES.LEX" [0047.910] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\" [0047.910] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\") returned="" [0047.910] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0047.910] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d8078 [0047.912] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*") returned="*.*" [0047.912] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.913] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.913] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*") returned="*.*" [0047.913] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\" [0047.913] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\") returned="" [0047.916] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.916] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned="MCABOUT.HTM" [0047.916] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\" [0047.916] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\") returned="" [0047.916] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.916] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned="STINTL.DLL" [0047.916] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\" [0047.916] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\") returned="" [0047.916] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.916] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*") returned="*.*" [0047.916] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" [0047.916] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="" [0047.917] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.917] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned="FBIBLIO.DLL" [0047.917] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" [0047.917] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="" [0047.918] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\how to decrypt files.txt")) returned 0x20 [0047.918] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.918] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned="FDATE.DLL" [0047.918] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" [0047.918] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="" [0047.918] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.918] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned="FPERSON.DLL" [0047.918] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" [0047.919] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="" [0047.919] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.919] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned="FPLACE.DLL" [0047.919] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" [0047.919] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="" [0047.919] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.919] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned="FSTOCK.DLL" [0047.919] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" [0047.919] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="" [0047.919] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.919] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned="IETAG.DLL" [0047.919] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" [0047.919] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="" [0047.919] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned="IMCONTACT.DLL" [0047.919] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d815a, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.920] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*") returned="*.*" [0047.920] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2db3c0, dwReserved1=0x2db3bb, cFileName=".", cAlternateFileName="")) returned 0x2d8030 [0047.921] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.921] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*") returned="*.*" [0047.921] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" [0047.921] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned="" [0047.923] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.923] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned="DATES.XML" [0047.923] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" [0047.923] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned="" [0047.923] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.923] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned="PHONE.XML" [0047.923] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" [0047.924] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned="" [0047.924] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.924] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned="STOCKS.DAT" [0047.924] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" [0047.924] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned="" [0047.924] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0047.924] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned="STOCKS.XML" [0047.924] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" [0047.924] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned="" [0047.924] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.924] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*") returned="*.*" [0047.924] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\" [0047.924] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\") returned="" [0047.925] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.925] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*") returned="*.*" [0047.925] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" [0047.925] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="" [0047.925] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.926] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned="METCONV.DLL" [0047.926] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" [0047.926] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="" [0047.926] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.926] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned="METCONV.TXT" [0047.926] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" [0047.926] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="" [0047.926] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.926] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned="MOFL.DLL" [0047.926] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" [0047.926] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="" [0047.926] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.926] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned="MSTAG.TLB" [0047.926] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" [0047.926] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned="" [0047.926] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0047.927] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d8080 [0047.928] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.928] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*") returned="*.*" [0047.928] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\" [0047.928] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\") returned="" [0047.929] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0047.929] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d83a0, cFileName=".", cAlternateFileName="")) returned 0x2d8078 [0047.932] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.933] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*") returned="*.*" [0047.933] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0047.933] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0047.934] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.934] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned="Bears.htm" [0047.934] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0047.934] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0047.934] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.934] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned="Bears.jpg" [0047.934] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0047.934] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0047.935] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.935] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned="Blue_Gradient.jpg" [0047.935] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0047.935] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0047.935] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.935] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned="Cave_Drawings.gif" [0047.936] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0047.936] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0047.936] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.936] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned="Connectivity.gif" [0047.936] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0047.936] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0047.936] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.936] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned="Desktop.ini" [0047.936] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0047.936] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0047.936] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.936] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned="Dotted_Lines.emf" [0047.936] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0047.936] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0047.936] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.936] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned="Garden.htm" [0047.936] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0047.936] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0047.937] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.937] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned="Garden.jpg" [0047.937] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0047.937] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0047.937] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.937] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned="Genko_1.emf" [0047.937] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0047.937] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0047.937] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.937] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned="Genko_2.emf" [0047.937] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0047.937] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0047.937] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.937] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned="Graph.emf" [0047.937] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0047.937] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0047.937] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.937] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned="Green Bubbles.htm" [0047.937] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0047.937] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0047.938] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.938] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned="GreenBubbles.jpg" [0047.938] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0047.938] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0047.938] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.938] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned="grid_(cm).wmf" [0047.939] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0047.939] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0047.939] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.939] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned="grid_(inch).wmf" [0047.939] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0047.939] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0047.939] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.939] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned="Hand Prints.htm" [0047.939] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0047.939] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0047.939] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.939] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned="HandPrints.jpg" [0047.939] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0047.939] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0047.939] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.939] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned="Memo.emf" [0047.939] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" [0047.939] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned="" [0047.940] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.940] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.940] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.941] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.941] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.941] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.941] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.942] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.942] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.942] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.943] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.943] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.944] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.944] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.944] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.944] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.945] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.945] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.946] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.946] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.946] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.946] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.947] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.947] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.948] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.948] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.948] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.949] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.949] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d8158, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.949] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0047.950] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.952] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.952] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.952] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.953] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0047.953] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0047.983] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2d80c8 [0047.983] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.986] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.987] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.990] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.wannacry")) returned 1 [0047.991] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.991] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\") returned="" [0047.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0047.993] lstrlenA (lpString="*.zip") returned 5 [0047.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0047.993] lstrlenA (lpString="*.rar") returned 5 [0047.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0047.993] lstrlenA (lpString="*.7z") returned 4 [0047.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0047.993] lstrlenA (lpString="*.tar") returned 5 [0047.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0047.993] lstrlenA (lpString="*.gzip") returned 6 [0047.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0047.993] lstrlenA (lpString="*.jpg") returned 5 [0047.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0047.993] lstrlenA (lpString="*.jpeg") returned 6 [0047.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0047.993] lstrlenA (lpString="*.psd") returned 5 [0047.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0047.993] lstrlenA (lpString="*.gif") returned 5 [0047.993] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0047.994] lstrlenA (lpString="*.doc") returned 5 [0047.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0047.994] lstrlenA (lpString="*.docx") returned 6 [0047.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0047.994] lstrlenA (lpString="*.xls") returned 5 [0047.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0047.994] lstrlenA (lpString="*.xlsx") returned 6 [0047.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0047.994] lstrlenA (lpString="*.ppt") returned 5 [0047.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0047.994] lstrlenA (lpString="*.pptx") returned 6 [0047.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0047.994] lstrlenA (lpString="*.pdf") returned 5 [0047.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0047.994] lstrlenA (lpString="*.mov") returned 5 [0047.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0047.994] lstrlenA (lpString="*.m2v") returned 5 [0047.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0047.994] lstrlenA (lpString="*.3gp") returned 5 [0047.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0047.994] lstrlenA (lpString="*.mpeg") returned 6 [0047.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0047.994] lstrlenA (lpString="*.mpg") returned 5 [0047.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0047.994] lstrlenA (lpString="*.flv") returned 5 [0047.994] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0047.994] lstrlenA (lpString="*.avi") returned 5 [0047.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0047.995] lstrlenA (lpString="*.mp4") returned 5 [0047.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0047.995] lstrlenA (lpString="*.wmv") returned 5 [0047.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0047.995] lstrlenA (lpString="*.divx") returned 6 [0047.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0047.995] lstrlenA (lpString="*.mkv") returned 5 [0047.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0047.995] lstrlenA (lpString="*.mp3") returned 5 [0047.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0047.995] lstrlenA (lpString="*.wav") returned 5 [0047.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0047.995] lstrlenA (lpString="*.flac") returned 6 [0047.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0047.995] lstrlenA (lpString="*.ape") returned 5 [0047.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0047.995] lstrlenA (lpString="*.wma") returned 5 [0047.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0047.995] lstrlenA (lpString="*.ac3") returned 5 [0047.995] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0047.995] lstrlenA (lpString="*.mxf") returned 5 [0047.996] FindClose (in: hFindFile=0x2d80c8 | out: hFindFile=0x2d80c8) returned 1 [0047.996] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="ARCTIC" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC" [0047.996] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC") returned 62 [0047.996] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0047.998] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0047.998] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\" [0047.998] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\") returned="" [0047.998] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO DECRYPT FILES.txt" [0047.998] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\how to decrypt files.txt")) returned 0xffffffff [0047.998] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0047.999] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0047.999] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.000] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.000] CloseHandle (hObject=0x90) returned 1 [0048.000] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", lpString2="ARCTIC.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" [0048.000] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.zip") returned 0 [0048.000] lstrlenA (lpString="*.zip") returned 5 [0048.000] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.rar") returned 0 [0048.000] lstrlenA (lpString="*.rar") returned 5 [0048.000] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.7z") returned 0 [0048.001] lstrlenA (lpString="*.7z") returned 4 [0048.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.tar") returned 0 [0048.001] lstrlenA (lpString="*.tar") returned 5 [0048.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.gzip") returned 0 [0048.001] lstrlenA (lpString="*.gzip") returned 6 [0048.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.jpg") returned 0 [0048.001] lstrlenA (lpString="*.jpg") returned 5 [0048.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.jpeg") returned 0 [0048.001] lstrlenA (lpString="*.jpeg") returned 6 [0048.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.psd") returned 0 [0048.001] lstrlenA (lpString="*.psd") returned 5 [0048.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.gif") returned 0 [0048.001] lstrlenA (lpString="*.gif") returned 5 [0048.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.doc") returned 0 [0048.001] lstrlenA (lpString="*.doc") returned 5 [0048.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.docx") returned 0 [0048.001] lstrlenA (lpString="*.docx") returned 6 [0048.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.xls") returned 0 [0048.001] lstrlenA (lpString="*.xls") returned 5 [0048.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.xlsx") returned 0 [0048.001] lstrlenA (lpString="*.xlsx") returned 6 [0048.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.ppt") returned 0 [0048.001] lstrlenA (lpString="*.ppt") returned 5 [0048.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.pptx") returned 0 [0048.001] lstrlenA (lpString="*.pptx") returned 6 [0048.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.pdf") returned 0 [0048.001] lstrlenA (lpString="*.pdf") returned 5 [0048.001] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.mov") returned 0 [0048.002] lstrlenA (lpString="*.mov") returned 5 [0048.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.m2v") returned 0 [0048.002] lstrlenA (lpString="*.m2v") returned 5 [0048.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.3gp") returned 0 [0048.002] lstrlenA (lpString="*.3gp") returned 5 [0048.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.mpeg") returned 0 [0048.002] lstrlenA (lpString="*.mpeg") returned 6 [0048.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.mpg") returned 0 [0048.002] lstrlenA (lpString="*.mpg") returned 5 [0048.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.flv") returned 0 [0048.002] lstrlenA (lpString="*.flv") returned 5 [0048.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.avi") returned 0 [0048.002] lstrlenA (lpString="*.avi") returned 5 [0048.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.mp4") returned 0 [0048.002] lstrlenA (lpString="*.mp4") returned 5 [0048.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.wmv") returned 0 [0048.002] lstrlenA (lpString="*.wmv") returned 5 [0048.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.divx") returned 0 [0048.002] lstrlenA (lpString="*.divx") returned 6 [0048.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.mkv") returned 0 [0048.002] lstrlenA (lpString="*.mkv") returned 5 [0048.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.mp3") returned 0 [0048.002] lstrlenA (lpString="*.mp3") returned 5 [0048.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.wav") returned 0 [0048.002] lstrlenA (lpString="*.wav") returned 5 [0048.002] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.flac") returned 0 [0048.003] lstrlenA (lpString="*.flac") returned 6 [0048.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.ape") returned 0 [0048.003] lstrlenA (lpString="*.ape") returned 5 [0048.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.wma") returned 0 [0048.003] lstrlenA (lpString="*.wma") returned 5 [0048.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.ac3") returned 0 [0048.003] lstrlenA (lpString="*.ac3") returned 5 [0048.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", pszSpec="*.mxf") returned 0 [0048.003] lstrlenA (lpString="*.mxf") returned 5 [0048.003] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x2d83e0, cFileName="ARCTIC.INF", cAlternateFileName="")) returned 1 [0048.003] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.003] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ARCTIC.INF") returned 1 [0048.003] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ARCTIC.INF") returned 1 [0048.003] lstrcmpiA (lpString1="", lpString2="ARCTIC.INF") returned -1 [0048.003] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned="ARCTIC.ELM" [0048.003] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\" [0048.003] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\") returned="" [0048.003] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO DECRYPT FILES.txt" [0048.003] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\how to decrypt files.txt")) returned 0x20 [0048.003] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", lpString2="ARCTIC.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" [0048.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.zip") returned 0 [0048.003] lstrlenA (lpString="*.zip") returned 5 [0048.003] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.rar") returned 0 [0048.004] lstrlenA (lpString="*.rar") returned 5 [0048.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.7z") returned 0 [0048.004] lstrlenA (lpString="*.7z") returned 4 [0048.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.tar") returned 0 [0048.004] lstrlenA (lpString="*.tar") returned 5 [0048.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.gzip") returned 0 [0048.004] lstrlenA (lpString="*.gzip") returned 6 [0048.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.jpg") returned 0 [0048.004] lstrlenA (lpString="*.jpg") returned 5 [0048.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.jpeg") returned 0 [0048.004] lstrlenA (lpString="*.jpeg") returned 6 [0048.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.psd") returned 0 [0048.004] lstrlenA (lpString="*.psd") returned 5 [0048.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.gif") returned 0 [0048.004] lstrlenA (lpString="*.gif") returned 5 [0048.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.doc") returned 0 [0048.004] lstrlenA (lpString="*.doc") returned 5 [0048.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.docx") returned 0 [0048.004] lstrlenA (lpString="*.docx") returned 6 [0048.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.xls") returned 0 [0048.004] lstrlenA (lpString="*.xls") returned 5 [0048.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.xlsx") returned 0 [0048.004] lstrlenA (lpString="*.xlsx") returned 6 [0048.004] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.ppt") returned 0 [0048.004] lstrlenA (lpString="*.ppt") returned 5 [0048.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.pptx") returned 0 [0048.005] lstrlenA (lpString="*.pptx") returned 6 [0048.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.pdf") returned 0 [0048.005] lstrlenA (lpString="*.pdf") returned 5 [0048.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.mov") returned 0 [0048.005] lstrlenA (lpString="*.mov") returned 5 [0048.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.m2v") returned 0 [0048.005] lstrlenA (lpString="*.m2v") returned 5 [0048.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.3gp") returned 0 [0048.005] lstrlenA (lpString="*.3gp") returned 5 [0048.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.mpeg") returned 0 [0048.005] lstrlenA (lpString="*.mpeg") returned 6 [0048.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.mpg") returned 0 [0048.005] lstrlenA (lpString="*.mpg") returned 5 [0048.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.flv") returned 0 [0048.005] lstrlenA (lpString="*.flv") returned 5 [0048.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.avi") returned 0 [0048.005] lstrlenA (lpString="*.avi") returned 5 [0048.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.mp4") returned 0 [0048.005] lstrlenA (lpString="*.mp4") returned 5 [0048.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.wmv") returned 0 [0048.005] lstrlenA (lpString="*.wmv") returned 5 [0048.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.divx") returned 0 [0048.005] lstrlenA (lpString="*.divx") returned 6 [0048.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.mkv") returned 0 [0048.005] lstrlenA (lpString="*.mkv") returned 5 [0048.005] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.mp3") returned 0 [0048.006] lstrlenA (lpString="*.mp3") returned 5 [0048.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.wav") returned 0 [0048.006] lstrlenA (lpString="*.wav") returned 5 [0048.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.flac") returned 0 [0048.006] lstrlenA (lpString="*.flac") returned 6 [0048.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.ape") returned 0 [0048.006] lstrlenA (lpString="*.ape") returned 5 [0048.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.wma") returned 0 [0048.006] lstrlenA (lpString="*.wma") returned 5 [0048.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.ac3") returned 0 [0048.006] lstrlenA (lpString="*.ac3") returned 5 [0048.006] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", pszSpec="*.mxf") returned 0 [0048.006] lstrlenA (lpString="*.mxf") returned 5 [0048.006] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.006] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.006] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.006] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.006] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.006] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned="ARCTIC.INF" [0048.006] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\" [0048.006] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\") returned="" [0048.006] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO DECRYPT FILES.txt" [0048.006] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\how to decrypt files.txt")) returned 0x20 [0048.007] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" [0048.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.007] lstrlenA (lpString="*.zip") returned 5 [0048.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.007] lstrlenA (lpString="*.rar") returned 5 [0048.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.007] lstrlenA (lpString="*.7z") returned 4 [0048.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.007] lstrlenA (lpString="*.tar") returned 5 [0048.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.007] lstrlenA (lpString="*.gzip") returned 6 [0048.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.007] lstrlenA (lpString="*.jpg") returned 5 [0048.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.007] lstrlenA (lpString="*.jpeg") returned 6 [0048.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.007] lstrlenA (lpString="*.psd") returned 5 [0048.007] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.007] lstrlenA (lpString="*.gif") returned 5 [0048.007] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" [0048.007] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" [0048.007] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF." [0048.007] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.wannacry" [0048.007] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.009] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xba9 [0048.009] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8a79b700, dwHighDateTime=0x1c43125), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8a79b700, dwHighDateTime=0x1c43125)) returned 1 [0048.009] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.009] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xb2b, lpOverlapped=0x0) returned 1 [0048.011] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.011] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.011] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xb2b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xb2b, lpOverlapped=0x0) returned 1 [0048.011] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.011] CloseHandle (hObject=0x90) returned 1 [0048.018] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.wannacry")) returned 1 [0048.020] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.020] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.020] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.021] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.021] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.021] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.021] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\" [0048.021] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\") returned="" [0048.021] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO DECRYPT FILES.txt" [0048.021] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\how to decrypt files.txt")) returned 0x20 [0048.021] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" [0048.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.021] lstrlenA (lpString="*.zip") returned 5 [0048.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.021] lstrlenA (lpString="*.rar") returned 5 [0048.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.021] lstrlenA (lpString="*.7z") returned 4 [0048.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.021] lstrlenA (lpString="*.tar") returned 5 [0048.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.021] lstrlenA (lpString="*.gzip") returned 6 [0048.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.021] lstrlenA (lpString="*.jpg") returned 5 [0048.021] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.022] lstrlenA (lpString="*.jpeg") returned 6 [0048.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.022] lstrlenA (lpString="*.psd") returned 5 [0048.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.022] lstrlenA (lpString="*.gif") returned 5 [0048.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.022] lstrlenA (lpString="*.doc") returned 5 [0048.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.022] lstrlenA (lpString="*.docx") returned 6 [0048.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.022] lstrlenA (lpString="*.xls") returned 5 [0048.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.022] lstrlenA (lpString="*.xlsx") returned 6 [0048.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.022] lstrlenA (lpString="*.ppt") returned 5 [0048.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.022] lstrlenA (lpString="*.pptx") returned 6 [0048.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.022] lstrlenA (lpString="*.pdf") returned 5 [0048.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.022] lstrlenA (lpString="*.mov") returned 5 [0048.022] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.023] lstrlenA (lpString="*.m2v") returned 5 [0048.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.023] lstrlenA (lpString="*.3gp") returned 5 [0048.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.023] lstrlenA (lpString="*.mpeg") returned 6 [0048.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.023] lstrlenA (lpString="*.mpg") returned 5 [0048.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.023] lstrlenA (lpString="*.flv") returned 5 [0048.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.023] lstrlenA (lpString="*.avi") returned 5 [0048.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.023] lstrlenA (lpString="*.mp4") returned 5 [0048.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.023] lstrlenA (lpString="*.wmv") returned 5 [0048.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.023] lstrlenA (lpString="*.divx") returned 6 [0048.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.023] lstrlenA (lpString="*.mkv") returned 5 [0048.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.023] lstrlenA (lpString="*.mp3") returned 5 [0048.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.023] lstrlenA (lpString="*.wav") returned 5 [0048.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.023] lstrlenA (lpString="*.flac") returned 6 [0048.023] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.024] lstrlenA (lpString="*.ape") returned 5 [0048.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.024] lstrlenA (lpString="*.wma") returned 5 [0048.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.024] lstrlenA (lpString="*.ac3") returned 5 [0048.024] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.024] lstrlenA (lpString="*.mxf") returned 5 [0048.024] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.024] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0048.024] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="AXIS", cAlternateFileName="")) returned 1 [0048.024] lstrcmpA (lpString1=".", lpString2="AXIS") returned -1 [0048.024] lstrcmpA (lpString1="..", lpString2="AXIS") returned -1 [0048.024] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.024] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="AXIS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS" [0048.024] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS") returned 60 [0048.024] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0048.025] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.026] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.026] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.026] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.026] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AXIS.ELM", cAlternateFileName="")) returned 1 [0048.026] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.026] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AXIS.ELM") returned 1 [0048.026] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AXIS.ELM") returned 1 [0048.026] lstrcmpiA (lpString1="", lpString2="AXIS.ELM") returned -1 [0048.026] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*") returned="*.*" [0048.026] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\" [0048.026] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\") returned="" [0048.026] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\HOW TO DECRYPT FILES.txt" [0048.026] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\how to decrypt files.txt")) returned 0xffffffff [0048.026] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.027] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.027] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.028] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.028] CloseHandle (hObject=0x90) returned 1 [0048.028] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", lpString2="AXIS.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" [0048.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.zip") returned 0 [0048.029] lstrlenA (lpString="*.zip") returned 5 [0048.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.rar") returned 0 [0048.029] lstrlenA (lpString="*.rar") returned 5 [0048.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.7z") returned 0 [0048.029] lstrlenA (lpString="*.7z") returned 4 [0048.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.tar") returned 0 [0048.029] lstrlenA (lpString="*.tar") returned 5 [0048.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.gzip") returned 0 [0048.029] lstrlenA (lpString="*.gzip") returned 6 [0048.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.jpg") returned 0 [0048.029] lstrlenA (lpString="*.jpg") returned 5 [0048.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.jpeg") returned 0 [0048.029] lstrlenA (lpString="*.jpeg") returned 6 [0048.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.psd") returned 0 [0048.029] lstrlenA (lpString="*.psd") returned 5 [0048.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.gif") returned 0 [0048.029] lstrlenA (lpString="*.gif") returned 5 [0048.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.doc") returned 0 [0048.029] lstrlenA (lpString="*.doc") returned 5 [0048.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.docx") returned 0 [0048.029] lstrlenA (lpString="*.docx") returned 6 [0048.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.xls") returned 0 [0048.029] lstrlenA (lpString="*.xls") returned 5 [0048.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.xlsx") returned 0 [0048.030] lstrlenA (lpString="*.xlsx") returned 6 [0048.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.ppt") returned 0 [0048.030] lstrlenA (lpString="*.ppt") returned 5 [0048.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.pptx") returned 0 [0048.030] lstrlenA (lpString="*.pptx") returned 6 [0048.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.pdf") returned 0 [0048.030] lstrlenA (lpString="*.pdf") returned 5 [0048.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.mov") returned 0 [0048.030] lstrlenA (lpString="*.mov") returned 5 [0048.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.m2v") returned 0 [0048.030] lstrlenA (lpString="*.m2v") returned 5 [0048.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.3gp") returned 0 [0048.030] lstrlenA (lpString="*.3gp") returned 5 [0048.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.mpeg") returned 0 [0048.030] lstrlenA (lpString="*.mpeg") returned 6 [0048.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.mpg") returned 0 [0048.030] lstrlenA (lpString="*.mpg") returned 5 [0048.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.flv") returned 0 [0048.030] lstrlenA (lpString="*.flv") returned 5 [0048.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.avi") returned 0 [0048.030] lstrlenA (lpString="*.avi") returned 5 [0048.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.mp4") returned 0 [0048.030] lstrlenA (lpString="*.mp4") returned 5 [0048.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.wmv") returned 0 [0048.030] lstrlenA (lpString="*.wmv") returned 5 [0048.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.divx") returned 0 [0048.031] lstrlenA (lpString="*.divx") returned 6 [0048.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.mkv") returned 0 [0048.031] lstrlenA (lpString="*.mkv") returned 5 [0048.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.mp3") returned 0 [0048.031] lstrlenA (lpString="*.mp3") returned 5 [0048.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.wav") returned 0 [0048.031] lstrlenA (lpString="*.wav") returned 5 [0048.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.flac") returned 0 [0048.031] lstrlenA (lpString="*.flac") returned 6 [0048.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.ape") returned 0 [0048.031] lstrlenA (lpString="*.ape") returned 5 [0048.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.wma") returned 0 [0048.031] lstrlenA (lpString="*.wma") returned 5 [0048.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.ac3") returned 0 [0048.031] lstrlenA (lpString="*.ac3") returned 5 [0048.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", pszSpec="*.mxf") returned 0 [0048.031] lstrlenA (lpString="*.mxf") returned 5 [0048.031] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x2d83e0, cFileName="AXIS.INF", cAlternateFileName="")) returned 1 [0048.031] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.031] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AXIS.INF") returned 1 [0048.031] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AXIS.INF") returned 1 [0048.031] lstrcmpiA (lpString1="", lpString2="AXIS.INF") returned -1 [0048.031] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned="AXIS.ELM" [0048.032] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\" [0048.032] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\") returned="" [0048.032] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\HOW TO DECRYPT FILES.txt" [0048.032] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\how to decrypt files.txt")) returned 0x20 [0048.032] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", lpString2="AXIS.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" [0048.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.zip") returned 0 [0048.032] lstrlenA (lpString="*.zip") returned 5 [0048.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.rar") returned 0 [0048.032] lstrlenA (lpString="*.rar") returned 5 [0048.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.7z") returned 0 [0048.032] lstrlenA (lpString="*.7z") returned 4 [0048.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.tar") returned 0 [0048.032] lstrlenA (lpString="*.tar") returned 5 [0048.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.gzip") returned 0 [0048.032] lstrlenA (lpString="*.gzip") returned 6 [0048.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.jpg") returned 0 [0048.032] lstrlenA (lpString="*.jpg") returned 5 [0048.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.jpeg") returned 0 [0048.032] lstrlenA (lpString="*.jpeg") returned 6 [0048.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.psd") returned 0 [0048.033] lstrlenA (lpString="*.psd") returned 5 [0048.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.gif") returned 0 [0048.033] lstrlenA (lpString="*.gif") returned 5 [0048.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.doc") returned 0 [0048.033] lstrlenA (lpString="*.doc") returned 5 [0048.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.docx") returned 0 [0048.033] lstrlenA (lpString="*.docx") returned 6 [0048.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.xls") returned 0 [0048.033] lstrlenA (lpString="*.xls") returned 5 [0048.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.xlsx") returned 0 [0048.033] lstrlenA (lpString="*.xlsx") returned 6 [0048.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.ppt") returned 0 [0048.033] lstrlenA (lpString="*.ppt") returned 5 [0048.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.pptx") returned 0 [0048.033] lstrlenA (lpString="*.pptx") returned 6 [0048.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.pdf") returned 0 [0048.033] lstrlenA (lpString="*.pdf") returned 5 [0048.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.mov") returned 0 [0048.033] lstrlenA (lpString="*.mov") returned 5 [0048.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.m2v") returned 0 [0048.033] lstrlenA (lpString="*.m2v") returned 5 [0048.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.3gp") returned 0 [0048.033] lstrlenA (lpString="*.3gp") returned 5 [0048.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.mpeg") returned 0 [0048.034] lstrlenA (lpString="*.mpeg") returned 6 [0048.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.mpg") returned 0 [0048.034] lstrlenA (lpString="*.mpg") returned 5 [0048.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.flv") returned 0 [0048.034] lstrlenA (lpString="*.flv") returned 5 [0048.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.avi") returned 0 [0048.034] lstrlenA (lpString="*.avi") returned 5 [0048.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.mp4") returned 0 [0048.034] lstrlenA (lpString="*.mp4") returned 5 [0048.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.wmv") returned 0 [0048.034] lstrlenA (lpString="*.wmv") returned 5 [0048.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.divx") returned 0 [0048.034] lstrlenA (lpString="*.divx") returned 6 [0048.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.mkv") returned 0 [0048.034] lstrlenA (lpString="*.mkv") returned 5 [0048.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.mp3") returned 0 [0048.034] lstrlenA (lpString="*.mp3") returned 5 [0048.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.wav") returned 0 [0048.034] lstrlenA (lpString="*.wav") returned 5 [0048.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.flac") returned 0 [0048.034] lstrlenA (lpString="*.flac") returned 6 [0048.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.ape") returned 0 [0048.034] lstrlenA (lpString="*.ape") returned 5 [0048.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.wma") returned 0 [0048.035] lstrlenA (lpString="*.wma") returned 5 [0048.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.ac3") returned 0 [0048.035] lstrlenA (lpString="*.ac3") returned 5 [0048.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", pszSpec="*.mxf") returned 0 [0048.035] lstrlenA (lpString="*.mxf") returned 5 [0048.035] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x74, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.035] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.035] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.035] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.035] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.035] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned="AXIS.INF" [0048.035] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\" [0048.035] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\") returned="" [0048.035] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\HOW TO DECRYPT FILES.txt" [0048.035] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\how to decrypt files.txt")) returned 0x20 [0048.035] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" [0048.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.035] lstrlenA (lpString="*.zip") returned 5 [0048.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.035] lstrlenA (lpString="*.rar") returned 5 [0048.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.035] lstrlenA (lpString="*.7z") returned 4 [0048.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.036] lstrlenA (lpString="*.tar") returned 5 [0048.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.036] lstrlenA (lpString="*.gzip") returned 6 [0048.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.036] lstrlenA (lpString="*.jpg") returned 5 [0048.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.036] lstrlenA (lpString="*.jpeg") returned 6 [0048.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.036] lstrlenA (lpString="*.psd") returned 5 [0048.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.036] lstrlenA (lpString="*.gif") returned 5 [0048.036] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" [0048.036] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" [0048.036] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF." [0048.036] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.wannacry" [0048.036] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.037] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb20 [0048.037] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8baae400, dwHighDateTime=0x1c43125), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8baae400, dwHighDateTime=0x1c43125)) returned 1 [0048.037] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.037] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xaa2, lpOverlapped=0x0) returned 1 [0048.039] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.039] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.039] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xaa2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xaa2, lpOverlapped=0x0) returned 1 [0048.039] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.039] CloseHandle (hObject=0x90) returned 1 [0048.042] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.wannacry")) returned 1 [0048.045] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.045] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.045] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.045] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.045] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.045] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.045] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\" [0048.045] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\") returned="" [0048.045] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\HOW TO DECRYPT FILES.txt" [0048.045] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\how to decrypt files.txt")) returned 0x20 [0048.045] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" [0048.045] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.046] lstrlenA (lpString="*.zip") returned 5 [0048.046] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.046] lstrlenA (lpString="*.rar") returned 5 [0048.046] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.046] lstrlenA (lpString="*.7z") returned 4 [0048.046] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.046] lstrlenA (lpString="*.tar") returned 5 [0048.046] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.046] lstrlenA (lpString="*.gzip") returned 6 [0048.046] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.046] lstrlenA (lpString="*.jpg") returned 5 [0048.046] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.046] lstrlenA (lpString="*.jpeg") returned 6 [0048.046] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.046] lstrlenA (lpString="*.psd") returned 5 [0048.046] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.046] lstrlenA (lpString="*.gif") returned 5 [0048.046] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.047] lstrlenA (lpString="*.doc") returned 5 [0048.047] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.047] lstrlenA (lpString="*.docx") returned 6 [0048.047] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.047] lstrlenA (lpString="*.xls") returned 5 [0048.047] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.047] lstrlenA (lpString="*.xlsx") returned 6 [0048.047] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.047] lstrlenA (lpString="*.ppt") returned 5 [0048.047] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.047] lstrlenA (lpString="*.pptx") returned 6 [0048.047] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.047] lstrlenA (lpString="*.pdf") returned 5 [0048.047] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.047] lstrlenA (lpString="*.mov") returned 5 [0048.047] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.047] lstrlenA (lpString="*.m2v") returned 5 [0048.047] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.047] lstrlenA (lpString="*.3gp") returned 5 [0048.047] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.047] lstrlenA (lpString="*.mpeg") returned 6 [0048.047] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.047] lstrlenA (lpString="*.mpg") returned 5 [0048.047] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.048] lstrlenA (lpString="*.flv") returned 5 [0048.048] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.048] lstrlenA (lpString="*.avi") returned 5 [0048.048] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.048] lstrlenA (lpString="*.mp4") returned 5 [0048.048] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.048] lstrlenA (lpString="*.wmv") returned 5 [0048.048] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.048] lstrlenA (lpString="*.divx") returned 6 [0048.048] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.048] lstrlenA (lpString="*.mkv") returned 5 [0048.048] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.048] lstrlenA (lpString="*.mp3") returned 5 [0048.048] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.048] lstrlenA (lpString="*.wav") returned 5 [0048.048] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.048] lstrlenA (lpString="*.flac") returned 6 [0048.048] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.048] lstrlenA (lpString="*.ape") returned 5 [0048.048] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.048] lstrlenA (lpString="*.wma") returned 5 [0048.048] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.048] lstrlenA (lpString="*.ac3") returned 5 [0048.049] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.049] lstrlenA (lpString="*.mxf") returned 5 [0048.049] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.049] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0048.049] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0048.049] lstrcmpA (lpString1=".", lpString2="BLENDS") returned -1 [0048.049] lstrcmpA (lpString1="..", lpString2="BLENDS") returned -1 [0048.049] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.049] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="BLENDS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS" [0048.049] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS") returned 62 [0048.049] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0048.050] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.050] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.050] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.050] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.050] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32f2700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10db7, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BLENDS.ELM", cAlternateFileName="")) returned 1 [0048.050] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.051] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BLENDS.ELM") returned 1 [0048.051] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BLENDS.ELM") returned 1 [0048.051] lstrcmpiA (lpString1="", lpString2="BLENDS.ELM") returned -1 [0048.051] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*") returned="*.*" [0048.051] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\" [0048.051] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\") returned="" [0048.051] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO DECRYPT FILES.txt" [0048.051] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\how to decrypt files.txt")) returned 0xffffffff [0048.051] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.051] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.051] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.053] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.053] CloseHandle (hObject=0x90) returned 1 [0048.053] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", lpString2="BLENDS.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" [0048.053] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.zip") returned 0 [0048.053] lstrlenA (lpString="*.zip") returned 5 [0048.053] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.rar") returned 0 [0048.053] lstrlenA (lpString="*.rar") returned 5 [0048.053] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.7z") returned 0 [0048.053] lstrlenA (lpString="*.7z") returned 4 [0048.053] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.tar") returned 0 [0048.054] lstrlenA (lpString="*.tar") returned 5 [0048.054] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.gzip") returned 0 [0048.054] lstrlenA (lpString="*.gzip") returned 6 [0048.054] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.jpg") returned 0 [0048.054] lstrlenA (lpString="*.jpg") returned 5 [0048.054] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.jpeg") returned 0 [0048.054] lstrlenA (lpString="*.jpeg") returned 6 [0048.054] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.psd") returned 0 [0048.054] lstrlenA (lpString="*.psd") returned 5 [0048.054] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.gif") returned 0 [0048.054] lstrlenA (lpString="*.gif") returned 5 [0048.054] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.doc") returned 0 [0048.054] lstrlenA (lpString="*.doc") returned 5 [0048.054] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.docx") returned 0 [0048.054] lstrlenA (lpString="*.docx") returned 6 [0048.054] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.xls") returned 0 [0048.054] lstrlenA (lpString="*.xls") returned 5 [0048.054] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.xlsx") returned 0 [0048.054] lstrlenA (lpString="*.xlsx") returned 6 [0048.054] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.ppt") returned 0 [0048.054] lstrlenA (lpString="*.ppt") returned 5 [0048.054] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.pptx") returned 0 [0048.054] lstrlenA (lpString="*.pptx") returned 6 [0048.054] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.pdf") returned 0 [0048.054] lstrlenA (lpString="*.pdf") returned 5 [0048.054] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.mov") returned 0 [0048.055] lstrlenA (lpString="*.mov") returned 5 [0048.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.m2v") returned 0 [0048.055] lstrlenA (lpString="*.m2v") returned 5 [0048.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.3gp") returned 0 [0048.055] lstrlenA (lpString="*.3gp") returned 5 [0048.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.mpeg") returned 0 [0048.055] lstrlenA (lpString="*.mpeg") returned 6 [0048.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.mpg") returned 0 [0048.055] lstrlenA (lpString="*.mpg") returned 5 [0048.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.flv") returned 0 [0048.055] lstrlenA (lpString="*.flv") returned 5 [0048.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.avi") returned 0 [0048.055] lstrlenA (lpString="*.avi") returned 5 [0048.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.mp4") returned 0 [0048.055] lstrlenA (lpString="*.mp4") returned 5 [0048.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.wmv") returned 0 [0048.055] lstrlenA (lpString="*.wmv") returned 5 [0048.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.divx") returned 0 [0048.055] lstrlenA (lpString="*.divx") returned 6 [0048.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.mkv") returned 0 [0048.055] lstrlenA (lpString="*.mkv") returned 5 [0048.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.mp3") returned 0 [0048.055] lstrlenA (lpString="*.mp3") returned 5 [0048.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.wav") returned 0 [0048.055] lstrlenA (lpString="*.wav") returned 5 [0048.055] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.flac") returned 0 [0048.056] lstrlenA (lpString="*.flac") returned 6 [0048.056] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.ape") returned 0 [0048.056] lstrlenA (lpString="*.ape") returned 5 [0048.056] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.wma") returned 0 [0048.056] lstrlenA (lpString="*.wma") returned 5 [0048.056] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.ac3") returned 0 [0048.056] lstrlenA (lpString="*.ac3") returned 5 [0048.056] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", pszSpec="*.mxf") returned 0 [0048.056] lstrlenA (lpString="*.mxf") returned 5 [0048.056] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb59ad00, ftCreationTime.dwHighDateTime=0x1c4d794, ftLastAccessTime.dwLowDateTime=0x5f729350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb59ad00, ftLastWriteTime.dwHighDateTime=0x1c4d794, nFileSizeHigh=0x0, nFileSizeLow=0x216, dwReserved0=0x0, dwReserved1=0x2d83e0, cFileName="BLENDS.INF", cAlternateFileName="")) returned 1 [0048.056] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.056] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BLENDS.INF") returned 1 [0048.056] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BLENDS.INF") returned 1 [0048.056] lstrcmpiA (lpString1="", lpString2="BLENDS.INF") returned -1 [0048.056] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned="BLENDS.ELM" [0048.056] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\" [0048.056] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\") returned="" [0048.056] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO DECRYPT FILES.txt" [0048.056] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\how to decrypt files.txt")) returned 0x20 [0048.056] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", lpString2="BLENDS.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" [0048.056] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.zip") returned 0 [0048.056] lstrlenA (lpString="*.zip") returned 5 [0048.056] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.rar") returned 0 [0048.057] lstrlenA (lpString="*.rar") returned 5 [0048.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.7z") returned 0 [0048.057] lstrlenA (lpString="*.7z") returned 4 [0048.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.tar") returned 0 [0048.057] lstrlenA (lpString="*.tar") returned 5 [0048.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.gzip") returned 0 [0048.057] lstrlenA (lpString="*.gzip") returned 6 [0048.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.jpg") returned 0 [0048.057] lstrlenA (lpString="*.jpg") returned 5 [0048.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.jpeg") returned 0 [0048.057] lstrlenA (lpString="*.jpeg") returned 6 [0048.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.psd") returned 0 [0048.057] lstrlenA (lpString="*.psd") returned 5 [0048.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.gif") returned 0 [0048.057] lstrlenA (lpString="*.gif") returned 5 [0048.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.doc") returned 0 [0048.057] lstrlenA (lpString="*.doc") returned 5 [0048.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.docx") returned 0 [0048.057] lstrlenA (lpString="*.docx") returned 6 [0048.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.xls") returned 0 [0048.057] lstrlenA (lpString="*.xls") returned 5 [0048.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.xlsx") returned 0 [0048.057] lstrlenA (lpString="*.xlsx") returned 6 [0048.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.ppt") returned 0 [0048.057] lstrlenA (lpString="*.ppt") returned 5 [0048.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.pptx") returned 0 [0048.057] lstrlenA (lpString="*.pptx") returned 6 [0048.057] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.pdf") returned 0 [0048.058] lstrlenA (lpString="*.pdf") returned 5 [0048.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.mov") returned 0 [0048.058] lstrlenA (lpString="*.mov") returned 5 [0048.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.m2v") returned 0 [0048.058] lstrlenA (lpString="*.m2v") returned 5 [0048.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.3gp") returned 0 [0048.058] lstrlenA (lpString="*.3gp") returned 5 [0048.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.mpeg") returned 0 [0048.058] lstrlenA (lpString="*.mpeg") returned 6 [0048.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.mpg") returned 0 [0048.058] lstrlenA (lpString="*.mpg") returned 5 [0048.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.flv") returned 0 [0048.058] lstrlenA (lpString="*.flv") returned 5 [0048.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.avi") returned 0 [0048.058] lstrlenA (lpString="*.avi") returned 5 [0048.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.mp4") returned 0 [0048.058] lstrlenA (lpString="*.mp4") returned 5 [0048.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.wmv") returned 0 [0048.058] lstrlenA (lpString="*.wmv") returned 5 [0048.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.divx") returned 0 [0048.058] lstrlenA (lpString="*.divx") returned 6 [0048.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.mkv") returned 0 [0048.058] lstrlenA (lpString="*.mkv") returned 5 [0048.058] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.mp3") returned 0 [0048.058] lstrlenA (lpString="*.mp3") returned 5 [0048.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.wav") returned 0 [0048.059] lstrlenA (lpString="*.wav") returned 5 [0048.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.flac") returned 0 [0048.059] lstrlenA (lpString="*.flac") returned 6 [0048.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.ape") returned 0 [0048.059] lstrlenA (lpString="*.ape") returned 5 [0048.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.wma") returned 0 [0048.059] lstrlenA (lpString="*.wma") returned 5 [0048.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.ac3") returned 0 [0048.059] lstrlenA (lpString="*.ac3") returned 5 [0048.059] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", pszSpec="*.mxf") returned 0 [0048.059] lstrlenA (lpString="*.mxf") returned 5 [0048.059] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x885, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.059] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.059] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.059] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.059] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.059] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned="BLENDS.INF" [0048.059] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\" [0048.059] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\") returned="" [0048.059] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO DECRYPT FILES.txt" [0048.059] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\how to decrypt files.txt")) returned 0x20 [0048.060] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" [0048.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.060] lstrlenA (lpString="*.zip") returned 5 [0048.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.060] lstrlenA (lpString="*.rar") returned 5 [0048.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.060] lstrlenA (lpString="*.7z") returned 4 [0048.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.060] lstrlenA (lpString="*.tar") returned 5 [0048.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.060] lstrlenA (lpString="*.gzip") returned 6 [0048.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.060] lstrlenA (lpString="*.jpg") returned 5 [0048.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.060] lstrlenA (lpString="*.jpeg") returned 6 [0048.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.060] lstrlenA (lpString="*.psd") returned 5 [0048.060] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.060] lstrlenA (lpString="*.gif") returned 5 [0048.060] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" [0048.060] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" [0048.060] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF." [0048.060] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.wannacry" [0048.061] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.062] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x885 [0048.062] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6d2cd0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72)) returned 1 [0048.062] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.062] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x807, lpOverlapped=0x0) returned 1 [0048.064] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.064] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.064] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x807, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x807, lpOverlapped=0x0) returned 1 [0048.064] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.064] CloseHandle (hObject=0x90) returned 1 [0048.067] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.wannacry")) returned 1 [0048.069] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.069] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.069] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.069] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.069] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.069] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.069] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\" [0048.069] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\") returned="" [0048.069] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO DECRYPT FILES.txt" [0048.069] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\how to decrypt files.txt")) returned 0x20 [0048.069] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" [0048.070] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.070] lstrlenA (lpString="*.zip") returned 5 [0048.070] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.070] lstrlenA (lpString="*.rar") returned 5 [0048.070] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.070] lstrlenA (lpString="*.7z") returned 4 [0048.070] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.070] lstrlenA (lpString="*.tar") returned 5 [0048.070] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.070] lstrlenA (lpString="*.gzip") returned 6 [0048.070] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.070] lstrlenA (lpString="*.jpg") returned 5 [0048.070] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.070] lstrlenA (lpString="*.jpeg") returned 6 [0048.070] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.070] lstrlenA (lpString="*.psd") returned 5 [0048.070] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.070] lstrlenA (lpString="*.gif") returned 5 [0048.070] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.070] lstrlenA (lpString="*.doc") returned 5 [0048.070] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.070] lstrlenA (lpString="*.docx") returned 6 [0048.070] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.070] lstrlenA (lpString="*.xls") returned 5 [0048.070] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.070] lstrlenA (lpString="*.xlsx") returned 6 [0048.070] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.071] lstrlenA (lpString="*.ppt") returned 5 [0048.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.071] lstrlenA (lpString="*.pptx") returned 6 [0048.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.071] lstrlenA (lpString="*.pdf") returned 5 [0048.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.071] lstrlenA (lpString="*.mov") returned 5 [0048.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.071] lstrlenA (lpString="*.m2v") returned 5 [0048.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.071] lstrlenA (lpString="*.3gp") returned 5 [0048.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.071] lstrlenA (lpString="*.mpeg") returned 6 [0048.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.071] lstrlenA (lpString="*.mpg") returned 5 [0048.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.071] lstrlenA (lpString="*.flv") returned 5 [0048.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.071] lstrlenA (lpString="*.avi") returned 5 [0048.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.071] lstrlenA (lpString="*.mp4") returned 5 [0048.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.071] lstrlenA (lpString="*.wmv") returned 5 [0048.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.071] lstrlenA (lpString="*.divx") returned 6 [0048.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.071] lstrlenA (lpString="*.mkv") returned 5 [0048.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.072] lstrlenA (lpString="*.mp3") returned 5 [0048.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.072] lstrlenA (lpString="*.wav") returned 5 [0048.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.072] lstrlenA (lpString="*.flac") returned 6 [0048.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.072] lstrlenA (lpString="*.ape") returned 5 [0048.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.072] lstrlenA (lpString="*.wma") returned 5 [0048.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.072] lstrlenA (lpString="*.ac3") returned 5 [0048.072] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.072] lstrlenA (lpString="*.mxf") returned 5 [0048.072] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.072] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0048.072] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0048.072] lstrcmpA (lpString1=".", lpString2="BLUECALM") returned -1 [0048.072] lstrcmpA (lpString1="..", lpString2="BLUECALM") returned -1 [0048.072] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.072] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="BLUECALM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM" [0048.072] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM") returned 64 [0048.073] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2d80c8 [0048.073] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.073] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.073] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.073] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.073] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BLUECALM.ELM", cAlternateFileName="")) returned 1 [0048.073] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.073] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BLUECALM.ELM") returned 1 [0048.073] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BLUECALM.ELM") returned 1 [0048.073] lstrcmpiA (lpString1="", lpString2="BLUECALM.ELM") returned -1 [0048.073] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*") returned="*.*" [0048.073] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\" [0048.073] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\") returned="" [0048.073] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO DECRYPT FILES.txt" [0048.073] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\how to decrypt files.txt")) returned 0xffffffff [0048.074] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.077] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.077] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.078] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.078] CloseHandle (hObject=0x90) returned 1 [0048.078] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", lpString2="BLUECALM.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" [0048.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.zip") returned 0 [0048.078] lstrlenA (lpString="*.zip") returned 5 [0048.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.rar") returned 0 [0048.078] lstrlenA (lpString="*.rar") returned 5 [0048.078] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.7z") returned 0 [0048.078] lstrlenA (lpString="*.7z") returned 4 [0048.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.tar") returned 0 [0048.079] lstrlenA (lpString="*.tar") returned 5 [0048.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.gzip") returned 0 [0048.079] lstrlenA (lpString="*.gzip") returned 6 [0048.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.jpg") returned 0 [0048.079] lstrlenA (lpString="*.jpg") returned 5 [0048.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.jpeg") returned 0 [0048.079] lstrlenA (lpString="*.jpeg") returned 6 [0048.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.psd") returned 0 [0048.079] lstrlenA (lpString="*.psd") returned 5 [0048.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.gif") returned 0 [0048.079] lstrlenA (lpString="*.gif") returned 5 [0048.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.doc") returned 0 [0048.079] lstrlenA (lpString="*.doc") returned 5 [0048.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.docx") returned 0 [0048.079] lstrlenA (lpString="*.docx") returned 6 [0048.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.xls") returned 0 [0048.079] lstrlenA (lpString="*.xls") returned 5 [0048.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.xlsx") returned 0 [0048.079] lstrlenA (lpString="*.xlsx") returned 6 [0048.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.ppt") returned 0 [0048.079] lstrlenA (lpString="*.ppt") returned 5 [0048.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.pptx") returned 0 [0048.079] lstrlenA (lpString="*.pptx") returned 6 [0048.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.pdf") returned 0 [0048.079] lstrlenA (lpString="*.pdf") returned 5 [0048.079] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.mov") returned 0 [0048.080] lstrlenA (lpString="*.mov") returned 5 [0048.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.m2v") returned 0 [0048.080] lstrlenA (lpString="*.m2v") returned 5 [0048.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.3gp") returned 0 [0048.080] lstrlenA (lpString="*.3gp") returned 5 [0048.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.mpeg") returned 0 [0048.080] lstrlenA (lpString="*.mpeg") returned 6 [0048.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.mpg") returned 0 [0048.080] lstrlenA (lpString="*.mpg") returned 5 [0048.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.flv") returned 0 [0048.080] lstrlenA (lpString="*.flv") returned 5 [0048.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.avi") returned 0 [0048.080] lstrlenA (lpString="*.avi") returned 5 [0048.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.mp4") returned 0 [0048.080] lstrlenA (lpString="*.mp4") returned 5 [0048.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.wmv") returned 0 [0048.080] lstrlenA (lpString="*.wmv") returned 5 [0048.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.divx") returned 0 [0048.080] lstrlenA (lpString="*.divx") returned 6 [0048.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.mkv") returned 0 [0048.080] lstrlenA (lpString="*.mkv") returned 5 [0048.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.mp3") returned 0 [0048.080] lstrlenA (lpString="*.mp3") returned 5 [0048.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.wav") returned 0 [0048.080] lstrlenA (lpString="*.wav") returned 5 [0048.080] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.flac") returned 0 [0048.081] lstrlenA (lpString="*.flac") returned 6 [0048.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.ape") returned 0 [0048.081] lstrlenA (lpString="*.ape") returned 5 [0048.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.wma") returned 0 [0048.081] lstrlenA (lpString="*.wma") returned 5 [0048.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.ac3") returned 0 [0048.081] lstrlenA (lpString="*.ac3") returned 5 [0048.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", pszSpec="*.mxf") returned 0 [0048.081] lstrlenA (lpString="*.mxf") returned 5 [0048.081] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x2d83f0, cFileName="BLUECALM.INF", cAlternateFileName="")) returned 1 [0048.081] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.081] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BLUECALM.INF") returned 1 [0048.081] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BLUECALM.INF") returned 1 [0048.081] lstrcmpiA (lpString1="", lpString2="BLUECALM.INF") returned -1 [0048.081] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned="BLUECALM.ELM" [0048.081] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\" [0048.081] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\") returned="" [0048.081] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO DECRYPT FILES.txt" [0048.081] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\how to decrypt files.txt")) returned 0x20 [0048.081] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", lpString2="BLUECALM.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" [0048.081] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.zip") returned 0 [0048.081] lstrlenA (lpString="*.zip") returned 5 [0048.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.rar") returned 0 [0048.082] lstrlenA (lpString="*.rar") returned 5 [0048.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.7z") returned 0 [0048.082] lstrlenA (lpString="*.7z") returned 4 [0048.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.tar") returned 0 [0048.082] lstrlenA (lpString="*.tar") returned 5 [0048.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.gzip") returned 0 [0048.082] lstrlenA (lpString="*.gzip") returned 6 [0048.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.jpg") returned 0 [0048.082] lstrlenA (lpString="*.jpg") returned 5 [0048.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.jpeg") returned 0 [0048.082] lstrlenA (lpString="*.jpeg") returned 6 [0048.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.psd") returned 0 [0048.082] lstrlenA (lpString="*.psd") returned 5 [0048.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.gif") returned 0 [0048.082] lstrlenA (lpString="*.gif") returned 5 [0048.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.doc") returned 0 [0048.082] lstrlenA (lpString="*.doc") returned 5 [0048.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.docx") returned 0 [0048.082] lstrlenA (lpString="*.docx") returned 6 [0048.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.xls") returned 0 [0048.082] lstrlenA (lpString="*.xls") returned 5 [0048.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.xlsx") returned 0 [0048.082] lstrlenA (lpString="*.xlsx") returned 6 [0048.082] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.ppt") returned 0 [0048.082] lstrlenA (lpString="*.ppt") returned 5 [0048.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.pptx") returned 0 [0048.083] lstrlenA (lpString="*.pptx") returned 6 [0048.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.pdf") returned 0 [0048.083] lstrlenA (lpString="*.pdf") returned 5 [0048.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.mov") returned 0 [0048.083] lstrlenA (lpString="*.mov") returned 5 [0048.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.m2v") returned 0 [0048.083] lstrlenA (lpString="*.m2v") returned 5 [0048.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.3gp") returned 0 [0048.083] lstrlenA (lpString="*.3gp") returned 5 [0048.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.mpeg") returned 0 [0048.083] lstrlenA (lpString="*.mpeg") returned 6 [0048.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.mpg") returned 0 [0048.083] lstrlenA (lpString="*.mpg") returned 5 [0048.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.flv") returned 0 [0048.083] lstrlenA (lpString="*.flv") returned 5 [0048.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.avi") returned 0 [0048.083] lstrlenA (lpString="*.avi") returned 5 [0048.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.mp4") returned 0 [0048.083] lstrlenA (lpString="*.mp4") returned 5 [0048.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.wmv") returned 0 [0048.083] lstrlenA (lpString="*.wmv") returned 5 [0048.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.divx") returned 0 [0048.083] lstrlenA (lpString="*.divx") returned 6 [0048.083] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.mkv") returned 0 [0048.084] lstrlenA (lpString="*.mkv") returned 5 [0048.084] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.mp3") returned 0 [0048.084] lstrlenA (lpString="*.mp3") returned 5 [0048.084] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.wav") returned 0 [0048.084] lstrlenA (lpString="*.wav") returned 5 [0048.084] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.flac") returned 0 [0048.084] lstrlenA (lpString="*.flac") returned 6 [0048.084] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.ape") returned 0 [0048.084] lstrlenA (lpString="*.ape") returned 5 [0048.084] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.wma") returned 0 [0048.084] lstrlenA (lpString="*.wma") returned 5 [0048.084] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.ac3") returned 0 [0048.084] lstrlenA (lpString="*.ac3") returned 5 [0048.084] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", pszSpec="*.mxf") returned 0 [0048.084] lstrlenA (lpString="*.mxf") returned 5 [0048.084] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x618, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.084] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.084] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.084] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.084] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.084] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned="BLUECALM.INF" [0048.084] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\" [0048.084] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\") returned="" [0048.085] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO DECRYPT FILES.txt" [0048.085] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\how to decrypt files.txt")) returned 0x20 [0048.085] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" [0048.085] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.085] lstrlenA (lpString="*.zip") returned 5 [0048.085] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.085] lstrlenA (lpString="*.rar") returned 5 [0048.085] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.085] lstrlenA (lpString="*.7z") returned 4 [0048.085] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.085] lstrlenA (lpString="*.tar") returned 5 [0048.085] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.085] lstrlenA (lpString="*.gzip") returned 6 [0048.085] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.085] lstrlenA (lpString="*.jpg") returned 5 [0048.085] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.085] lstrlenA (lpString="*.jpeg") returned 6 [0048.085] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.085] lstrlenA (lpString="*.psd") returned 5 [0048.085] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.085] lstrlenA (lpString="*.gif") returned 5 [0048.085] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" [0048.086] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" [0048.086] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF." [0048.086] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.wannacry" [0048.086] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.086] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x618 [0048.086] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6d2cd0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72)) returned 1 [0048.086] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.086] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x59a, lpOverlapped=0x0) returned 1 [0048.088] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.088] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.088] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x59a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x59a, lpOverlapped=0x0) returned 1 [0048.089] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.089] CloseHandle (hObject=0x90) returned 1 [0048.091] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.wannacry")) returned 1 [0048.092] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.092] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.092] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.092] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.092] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.092] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.092] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\" [0048.092] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\") returned="" [0048.092] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO DECRYPT FILES.txt" [0048.092] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\how to decrypt files.txt")) returned 0x20 [0048.092] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" [0048.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.092] lstrlenA (lpString="*.zip") returned 5 [0048.092] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.093] lstrlenA (lpString="*.rar") returned 5 [0048.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.093] lstrlenA (lpString="*.7z") returned 4 [0048.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.093] lstrlenA (lpString="*.tar") returned 5 [0048.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.093] lstrlenA (lpString="*.gzip") returned 6 [0048.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.093] lstrlenA (lpString="*.jpg") returned 5 [0048.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.093] lstrlenA (lpString="*.jpeg") returned 6 [0048.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.093] lstrlenA (lpString="*.psd") returned 5 [0048.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.093] lstrlenA (lpString="*.gif") returned 5 [0048.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.093] lstrlenA (lpString="*.doc") returned 5 [0048.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.093] lstrlenA (lpString="*.docx") returned 6 [0048.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.093] lstrlenA (lpString="*.xls") returned 5 [0048.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.093] lstrlenA (lpString="*.xlsx") returned 6 [0048.093] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.094] lstrlenA (lpString="*.ppt") returned 5 [0048.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.094] lstrlenA (lpString="*.pptx") returned 6 [0048.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.094] lstrlenA (lpString="*.pdf") returned 5 [0048.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.094] lstrlenA (lpString="*.mov") returned 5 [0048.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.094] lstrlenA (lpString="*.m2v") returned 5 [0048.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.094] lstrlenA (lpString="*.3gp") returned 5 [0048.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.094] lstrlenA (lpString="*.mpeg") returned 6 [0048.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.094] lstrlenA (lpString="*.mpg") returned 5 [0048.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.094] lstrlenA (lpString="*.flv") returned 5 [0048.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.094] lstrlenA (lpString="*.avi") returned 5 [0048.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.094] lstrlenA (lpString="*.mp4") returned 5 [0048.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.094] lstrlenA (lpString="*.wmv") returned 5 [0048.094] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.094] lstrlenA (lpString="*.divx") returned 6 [0048.095] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.095] lstrlenA (lpString="*.mkv") returned 5 [0048.095] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.095] lstrlenA (lpString="*.mp3") returned 5 [0048.095] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.095] lstrlenA (lpString="*.wav") returned 5 [0048.095] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.095] lstrlenA (lpString="*.flac") returned 6 [0048.095] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.095] lstrlenA (lpString="*.ape") returned 5 [0048.095] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.095] lstrlenA (lpString="*.wma") returned 5 [0048.095] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.095] lstrlenA (lpString="*.ac3") returned 5 [0048.095] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.095] lstrlenA (lpString="*.mxf") returned 5 [0048.095] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.095] FindClose (in: hFindFile=0x2d80c8 | out: hFindFile=0x2d80c8) returned 1 [0048.095] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0048.095] lstrcmpA (lpString1=".", lpString2="BLUEPRNT") returned -1 [0048.095] lstrcmpA (lpString1="..", lpString2="BLUEPRNT") returned -1 [0048.095] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.096] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="BLUEPRNT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT" [0048.096] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT") returned 64 [0048.096] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x2d80c8 [0048.097] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.097] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x780000, cFileName="..", cAlternateFileName="")) returned 1 [0048.097] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.097] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.097] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BLUEPRNT.ELM", cAlternateFileName="")) returned 1 [0048.097] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.097] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BLUEPRNT.ELM") returned 1 [0048.097] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BLUEPRNT.ELM") returned 1 [0048.097] lstrcmpiA (lpString1="", lpString2="BLUEPRNT.ELM") returned -1 [0048.097] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*") returned="*.*" [0048.097] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\" [0048.097] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\") returned="" [0048.097] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO DECRYPT FILES.txt" [0048.097] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\how to decrypt files.txt")) returned 0xffffffff [0048.098] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.100] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.100] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.101] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.101] CloseHandle (hObject=0x90) returned 1 [0048.101] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", lpString2="BLUEPRNT.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" [0048.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.zip") returned 0 [0048.101] lstrlenA (lpString="*.zip") returned 5 [0048.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.rar") returned 0 [0048.101] lstrlenA (lpString="*.rar") returned 5 [0048.101] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.7z") returned 0 [0048.101] lstrlenA (lpString="*.7z") returned 4 [0048.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.tar") returned 0 [0048.102] lstrlenA (lpString="*.tar") returned 5 [0048.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.gzip") returned 0 [0048.102] lstrlenA (lpString="*.gzip") returned 6 [0048.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.jpg") returned 0 [0048.102] lstrlenA (lpString="*.jpg") returned 5 [0048.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.jpeg") returned 0 [0048.102] lstrlenA (lpString="*.jpeg") returned 6 [0048.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.psd") returned 0 [0048.102] lstrlenA (lpString="*.psd") returned 5 [0048.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.gif") returned 0 [0048.102] lstrlenA (lpString="*.gif") returned 5 [0048.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.doc") returned 0 [0048.102] lstrlenA (lpString="*.doc") returned 5 [0048.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.docx") returned 0 [0048.102] lstrlenA (lpString="*.docx") returned 6 [0048.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.xls") returned 0 [0048.102] lstrlenA (lpString="*.xls") returned 5 [0048.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.xlsx") returned 0 [0048.102] lstrlenA (lpString="*.xlsx") returned 6 [0048.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.ppt") returned 0 [0048.102] lstrlenA (lpString="*.ppt") returned 5 [0048.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.pptx") returned 0 [0048.102] lstrlenA (lpString="*.pptx") returned 6 [0048.102] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.pdf") returned 0 [0048.103] lstrlenA (lpString="*.pdf") returned 5 [0048.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.mov") returned 0 [0048.103] lstrlenA (lpString="*.mov") returned 5 [0048.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.m2v") returned 0 [0048.103] lstrlenA (lpString="*.m2v") returned 5 [0048.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.3gp") returned 0 [0048.103] lstrlenA (lpString="*.3gp") returned 5 [0048.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.mpeg") returned 0 [0048.103] lstrlenA (lpString="*.mpeg") returned 6 [0048.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.mpg") returned 0 [0048.103] lstrlenA (lpString="*.mpg") returned 5 [0048.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.flv") returned 0 [0048.103] lstrlenA (lpString="*.flv") returned 5 [0048.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.avi") returned 0 [0048.103] lstrlenA (lpString="*.avi") returned 5 [0048.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.mp4") returned 0 [0048.103] lstrlenA (lpString="*.mp4") returned 5 [0048.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.wmv") returned 0 [0048.103] lstrlenA (lpString="*.wmv") returned 5 [0048.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.divx") returned 0 [0048.103] lstrlenA (lpString="*.divx") returned 6 [0048.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.mkv") returned 0 [0048.103] lstrlenA (lpString="*.mkv") returned 5 [0048.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.mp3") returned 0 [0048.103] lstrlenA (lpString="*.mp3") returned 5 [0048.103] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.wav") returned 0 [0048.104] lstrlenA (lpString="*.wav") returned 5 [0048.104] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.flac") returned 0 [0048.104] lstrlenA (lpString="*.flac") returned 6 [0048.104] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.ape") returned 0 [0048.104] lstrlenA (lpString="*.ape") returned 5 [0048.104] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.wma") returned 0 [0048.104] lstrlenA (lpString="*.wma") returned 5 [0048.104] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.ac3") returned 0 [0048.104] lstrlenA (lpString="*.ac3") returned 5 [0048.104] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", pszSpec="*.mxf") returned 0 [0048.104] lstrlenA (lpString="*.mxf") returned 5 [0048.104] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5fbc5df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x2d83f0, cFileName="BLUEPRNT.INF", cAlternateFileName="")) returned 1 [0048.104] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.104] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BLUEPRNT.INF") returned 1 [0048.104] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BLUEPRNT.INF") returned 1 [0048.104] lstrcmpiA (lpString1="", lpString2="BLUEPRNT.INF") returned -1 [0048.104] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned="BLUEPRNT.ELM" [0048.104] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\" [0048.104] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\") returned="" [0048.104] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO DECRYPT FILES.txt" [0048.104] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\how to decrypt files.txt")) returned 0x20 [0048.105] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", lpString2="BLUEPRNT.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" [0048.105] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.zip") returned 0 [0048.105] lstrlenA (lpString="*.zip") returned 5 [0048.105] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.rar") returned 0 [0048.105] lstrlenA (lpString="*.rar") returned 5 [0048.105] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.7z") returned 0 [0048.105] lstrlenA (lpString="*.7z") returned 4 [0048.105] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.tar") returned 0 [0048.105] lstrlenA (lpString="*.tar") returned 5 [0048.105] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.gzip") returned 0 [0048.105] lstrlenA (lpString="*.gzip") returned 6 [0048.105] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.jpg") returned 0 [0048.106] lstrlenA (lpString="*.jpg") returned 5 [0048.106] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.jpeg") returned 0 [0048.106] lstrlenA (lpString="*.jpeg") returned 6 [0048.106] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.psd") returned 0 [0048.106] lstrlenA (lpString="*.psd") returned 5 [0048.106] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.gif") returned 0 [0048.106] lstrlenA (lpString="*.gif") returned 5 [0048.106] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.doc") returned 0 [0048.106] lstrlenA (lpString="*.doc") returned 5 [0048.106] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.docx") returned 0 [0048.106] lstrlenA (lpString="*.docx") returned 6 [0048.106] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.xls") returned 0 [0048.106] lstrlenA (lpString="*.xls") returned 5 [0048.106] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.xlsx") returned 0 [0048.106] lstrlenA (lpString="*.xlsx") returned 6 [0048.106] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.ppt") returned 0 [0048.106] lstrlenA (lpString="*.ppt") returned 5 [0048.106] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.pptx") returned 0 [0048.106] lstrlenA (lpString="*.pptx") returned 6 [0048.106] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.pdf") returned 0 [0048.106] lstrlenA (lpString="*.pdf") returned 5 [0048.106] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.mov") returned 0 [0048.106] lstrlenA (lpString="*.mov") returned 5 [0048.106] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.m2v") returned 0 [0048.106] lstrlenA (lpString="*.m2v") returned 5 [0048.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.3gp") returned 0 [0048.107] lstrlenA (lpString="*.3gp") returned 5 [0048.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.mpeg") returned 0 [0048.107] lstrlenA (lpString="*.mpeg") returned 6 [0048.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.mpg") returned 0 [0048.107] lstrlenA (lpString="*.mpg") returned 5 [0048.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.flv") returned 0 [0048.107] lstrlenA (lpString="*.flv") returned 5 [0048.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.avi") returned 0 [0048.107] lstrlenA (lpString="*.avi") returned 5 [0048.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.mp4") returned 0 [0048.107] lstrlenA (lpString="*.mp4") returned 5 [0048.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.wmv") returned 0 [0048.107] lstrlenA (lpString="*.wmv") returned 5 [0048.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.divx") returned 0 [0048.107] lstrlenA (lpString="*.divx") returned 6 [0048.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.mkv") returned 0 [0048.107] lstrlenA (lpString="*.mkv") returned 5 [0048.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.mp3") returned 0 [0048.107] lstrlenA (lpString="*.mp3") returned 5 [0048.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.wav") returned 0 [0048.107] lstrlenA (lpString="*.wav") returned 5 [0048.107] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.flac") returned 0 [0048.107] lstrlenA (lpString="*.flac") returned 6 [0048.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.ape") returned 0 [0048.108] lstrlenA (lpString="*.ape") returned 5 [0048.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.wma") returned 0 [0048.108] lstrlenA (lpString="*.wma") returned 5 [0048.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.ac3") returned 0 [0048.108] lstrlenA (lpString="*.ac3") returned 5 [0048.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", pszSpec="*.mxf") returned 0 [0048.108] lstrlenA (lpString="*.mxf") returned 5 [0048.108] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x785, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.108] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.108] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.108] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.108] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.108] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned="BLUEPRNT.INF" [0048.108] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\" [0048.108] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\") returned="" [0048.108] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO DECRYPT FILES.txt" [0048.108] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\how to decrypt files.txt")) returned 0x20 [0048.108] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" [0048.108] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.109] lstrlenA (lpString="*.zip") returned 5 [0048.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.109] lstrlenA (lpString="*.rar") returned 5 [0048.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.109] lstrlenA (lpString="*.7z") returned 4 [0048.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.109] lstrlenA (lpString="*.tar") returned 5 [0048.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.109] lstrlenA (lpString="*.gzip") returned 6 [0048.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.109] lstrlenA (lpString="*.jpg") returned 5 [0048.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.109] lstrlenA (lpString="*.jpeg") returned 6 [0048.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.109] lstrlenA (lpString="*.psd") returned 5 [0048.109] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.109] lstrlenA (lpString="*.gif") returned 5 [0048.109] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" [0048.109] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" [0048.109] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF." [0048.109] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.wannacry" [0048.109] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.110] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x785 [0048.110] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72)) returned 1 [0048.110] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.110] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x707, lpOverlapped=0x0) returned 1 [0048.112] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.112] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.112] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x707, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x707, lpOverlapped=0x0) returned 1 [0048.112] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.112] CloseHandle (hObject=0x90) returned 1 [0048.113] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.wannacry")) returned 1 [0048.114] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.114] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.114] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.114] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.114] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.114] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.114] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\" [0048.114] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\") returned="" [0048.114] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO DECRYPT FILES.txt" [0048.114] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\how to decrypt files.txt")) returned 0x20 [0048.115] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" [0048.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.115] lstrlenA (lpString="*.zip") returned 5 [0048.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.115] lstrlenA (lpString="*.rar") returned 5 [0048.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.115] lstrlenA (lpString="*.7z") returned 4 [0048.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.115] lstrlenA (lpString="*.tar") returned 5 [0048.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.115] lstrlenA (lpString="*.gzip") returned 6 [0048.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.115] lstrlenA (lpString="*.jpg") returned 5 [0048.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.115] lstrlenA (lpString="*.jpeg") returned 6 [0048.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.115] lstrlenA (lpString="*.psd") returned 5 [0048.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.115] lstrlenA (lpString="*.gif") returned 5 [0048.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.115] lstrlenA (lpString="*.doc") returned 5 [0048.115] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.115] lstrlenA (lpString="*.docx") returned 6 [0048.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.116] lstrlenA (lpString="*.xls") returned 5 [0048.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.116] lstrlenA (lpString="*.xlsx") returned 6 [0048.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.116] lstrlenA (lpString="*.ppt") returned 5 [0048.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.116] lstrlenA (lpString="*.pptx") returned 6 [0048.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.116] lstrlenA (lpString="*.pdf") returned 5 [0048.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.116] lstrlenA (lpString="*.mov") returned 5 [0048.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.116] lstrlenA (lpString="*.m2v") returned 5 [0048.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.116] lstrlenA (lpString="*.3gp") returned 5 [0048.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.116] lstrlenA (lpString="*.mpeg") returned 6 [0048.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.116] lstrlenA (lpString="*.mpg") returned 5 [0048.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.116] lstrlenA (lpString="*.flv") returned 5 [0048.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.116] lstrlenA (lpString="*.avi") returned 5 [0048.116] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.116] lstrlenA (lpString="*.mp4") returned 5 [0048.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.117] lstrlenA (lpString="*.wmv") returned 5 [0048.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.117] lstrlenA (lpString="*.divx") returned 6 [0048.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.117] lstrlenA (lpString="*.mkv") returned 5 [0048.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.117] lstrlenA (lpString="*.mp3") returned 5 [0048.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.117] lstrlenA (lpString="*.wav") returned 5 [0048.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.117] lstrlenA (lpString="*.flac") returned 6 [0048.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.117] lstrlenA (lpString="*.ape") returned 5 [0048.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.117] lstrlenA (lpString="*.wma") returned 5 [0048.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.117] lstrlenA (lpString="*.ac3") returned 5 [0048.117] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.117] lstrlenA (lpString="*.mxf") returned 5 [0048.117] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.117] FindClose (in: hFindFile=0x2d80c8 | out: hFindFile=0x2d80c8) returned 1 [0048.117] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0048.118] lstrcmpA (lpString1=".", lpString2="BOLDSTRI") returned -1 [0048.118] lstrcmpA (lpString1="..", lpString2="BOLDSTRI") returned -1 [0048.118] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.118] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="BOLDSTRI" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI" [0048.118] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI") returned 64 [0048.118] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x2d80c8 [0048.119] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.119] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x780000, cFileName="..", cAlternateFileName="")) returned 1 [0048.120] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.120] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.120] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9250800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xeafa, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BOLDSTRI.ELM", cAlternateFileName="")) returned 1 [0048.120] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.120] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BOLDSTRI.ELM") returned 1 [0048.120] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BOLDSTRI.ELM") returned 1 [0048.120] lstrcmpiA (lpString1="", lpString2="BOLDSTRI.ELM") returned -1 [0048.120] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*") returned="*.*" [0048.120] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\" [0048.120] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\") returned="" [0048.120] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO DECRYPT FILES.txt" [0048.120] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\how to decrypt files.txt")) returned 0xffffffff [0048.120] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.122] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.122] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.123] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.123] CloseHandle (hObject=0x90) returned 1 [0048.124] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", lpString2="BOLDSTRI.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" [0048.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.zip") returned 0 [0048.124] lstrlenA (lpString="*.zip") returned 5 [0048.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.rar") returned 0 [0048.124] lstrlenA (lpString="*.rar") returned 5 [0048.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.7z") returned 0 [0048.124] lstrlenA (lpString="*.7z") returned 4 [0048.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.tar") returned 0 [0048.124] lstrlenA (lpString="*.tar") returned 5 [0048.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.gzip") returned 0 [0048.124] lstrlenA (lpString="*.gzip") returned 6 [0048.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.jpg") returned 0 [0048.124] lstrlenA (lpString="*.jpg") returned 5 [0048.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.jpeg") returned 0 [0048.124] lstrlenA (lpString="*.jpeg") returned 6 [0048.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.psd") returned 0 [0048.124] lstrlenA (lpString="*.psd") returned 5 [0048.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.gif") returned 0 [0048.124] lstrlenA (lpString="*.gif") returned 5 [0048.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.doc") returned 0 [0048.124] lstrlenA (lpString="*.doc") returned 5 [0048.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.docx") returned 0 [0048.124] lstrlenA (lpString="*.docx") returned 6 [0048.124] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.xls") returned 0 [0048.124] lstrlenA (lpString="*.xls") returned 5 [0048.125] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.xlsx") returned 0 [0048.125] lstrlenA (lpString="*.xlsx") returned 6 [0048.125] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.ppt") returned 0 [0048.125] lstrlenA (lpString="*.ppt") returned 5 [0048.125] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.pptx") returned 0 [0048.125] lstrlenA (lpString="*.pptx") returned 6 [0048.125] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.pdf") returned 0 [0048.125] lstrlenA (lpString="*.pdf") returned 5 [0048.125] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.mov") returned 0 [0048.125] lstrlenA (lpString="*.mov") returned 5 [0048.125] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.m2v") returned 0 [0048.125] lstrlenA (lpString="*.m2v") returned 5 [0048.125] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.3gp") returned 0 [0048.125] lstrlenA (lpString="*.3gp") returned 5 [0048.125] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.mpeg") returned 0 [0048.125] lstrlenA (lpString="*.mpeg") returned 6 [0048.125] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.mpg") returned 0 [0048.125] lstrlenA (lpString="*.mpg") returned 5 [0048.125] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.flv") returned 0 [0048.125] lstrlenA (lpString="*.flv") returned 5 [0048.125] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.avi") returned 0 [0048.125] lstrlenA (lpString="*.avi") returned 5 [0048.125] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.mp4") returned 0 [0048.125] lstrlenA (lpString="*.mp4") returned 5 [0048.125] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.wmv") returned 0 [0048.125] lstrlenA (lpString="*.wmv") returned 5 [0048.125] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.divx") returned 0 [0048.125] lstrlenA (lpString="*.divx") returned 6 [0048.125] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.mkv") returned 0 [0048.126] lstrlenA (lpString="*.mkv") returned 5 [0048.126] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.mp3") returned 0 [0048.126] lstrlenA (lpString="*.mp3") returned 5 [0048.126] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.wav") returned 0 [0048.126] lstrlenA (lpString="*.wav") returned 5 [0048.126] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.flac") returned 0 [0048.126] lstrlenA (lpString="*.flac") returned 6 [0048.126] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.ape") returned 0 [0048.126] lstrlenA (lpString="*.ape") returned 5 [0048.126] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.wma") returned 0 [0048.126] lstrlenA (lpString="*.wma") returned 5 [0048.126] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.ac3") returned 0 [0048.126] lstrlenA (lpString="*.ac3") returned 5 [0048.126] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", pszSpec="*.mxf") returned 0 [0048.126] lstrlenA (lpString="*.mxf") returned 5 [0048.126] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x0, dwReserved1=0x2d83f0, cFileName="BOLDSTRI.INF", cAlternateFileName="")) returned 1 [0048.126] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.126] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BOLDSTRI.INF") returned 1 [0048.126] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BOLDSTRI.INF") returned 1 [0048.126] lstrcmpiA (lpString1="", lpString2="BOLDSTRI.INF") returned -1 [0048.126] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned="BOLDSTRI.ELM" [0048.126] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\" [0048.126] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\") returned="" [0048.126] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO DECRYPT FILES.txt" [0048.126] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\how to decrypt files.txt")) returned 0x20 [0048.127] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", lpString2="BOLDSTRI.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" [0048.127] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.zip") returned 0 [0048.127] lstrlenA (lpString="*.zip") returned 5 [0048.127] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.rar") returned 0 [0048.127] lstrlenA (lpString="*.rar") returned 5 [0048.127] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.7z") returned 0 [0048.127] lstrlenA (lpString="*.7z") returned 4 [0048.127] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.tar") returned 0 [0048.127] lstrlenA (lpString="*.tar") returned 5 [0048.127] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.gzip") returned 0 [0048.127] lstrlenA (lpString="*.gzip") returned 6 [0048.127] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.jpg") returned 0 [0048.127] lstrlenA (lpString="*.jpg") returned 5 [0048.127] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.jpeg") returned 0 [0048.127] lstrlenA (lpString="*.jpeg") returned 6 [0048.127] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.psd") returned 0 [0048.127] lstrlenA (lpString="*.psd") returned 5 [0048.127] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.gif") returned 0 [0048.127] lstrlenA (lpString="*.gif") returned 5 [0048.127] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.doc") returned 0 [0048.127] lstrlenA (lpString="*.doc") returned 5 [0048.127] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.docx") returned 0 [0048.127] lstrlenA (lpString="*.docx") returned 6 [0048.127] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.xls") returned 0 [0048.127] lstrlenA (lpString="*.xls") returned 5 [0048.127] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.xlsx") returned 0 [0048.127] lstrlenA (lpString="*.xlsx") returned 6 [0048.128] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.ppt") returned 0 [0048.128] lstrlenA (lpString="*.ppt") returned 5 [0048.128] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.pptx") returned 0 [0048.128] lstrlenA (lpString="*.pptx") returned 6 [0048.128] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.pdf") returned 0 [0048.128] lstrlenA (lpString="*.pdf") returned 5 [0048.128] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.mov") returned 0 [0048.128] lstrlenA (lpString="*.mov") returned 5 [0048.128] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.m2v") returned 0 [0048.128] lstrlenA (lpString="*.m2v") returned 5 [0048.128] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.3gp") returned 0 [0048.128] lstrlenA (lpString="*.3gp") returned 5 [0048.128] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.mpeg") returned 0 [0048.128] lstrlenA (lpString="*.mpeg") returned 6 [0048.128] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.mpg") returned 0 [0048.128] lstrlenA (lpString="*.mpg") returned 5 [0048.128] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.flv") returned 0 [0048.128] lstrlenA (lpString="*.flv") returned 5 [0048.128] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.avi") returned 0 [0048.128] lstrlenA (lpString="*.avi") returned 5 [0048.128] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.mp4") returned 0 [0048.128] lstrlenA (lpString="*.mp4") returned 5 [0048.128] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.wmv") returned 0 [0048.128] lstrlenA (lpString="*.wmv") returned 5 [0048.128] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.divx") returned 0 [0048.128] lstrlenA (lpString="*.divx") returned 6 [0048.128] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.mkv") returned 0 [0048.129] lstrlenA (lpString="*.mkv") returned 5 [0048.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.mp3") returned 0 [0048.129] lstrlenA (lpString="*.mp3") returned 5 [0048.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.wav") returned 0 [0048.129] lstrlenA (lpString="*.wav") returned 5 [0048.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.flac") returned 0 [0048.129] lstrlenA (lpString="*.flac") returned 6 [0048.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.ape") returned 0 [0048.129] lstrlenA (lpString="*.ape") returned 5 [0048.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.wma") returned 0 [0048.129] lstrlenA (lpString="*.wma") returned 5 [0048.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.ac3") returned 0 [0048.129] lstrlenA (lpString="*.ac3") returned 5 [0048.129] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", pszSpec="*.mxf") returned 0 [0048.129] lstrlenA (lpString="*.mxf") returned 5 [0048.129] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xd97, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.129] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.129] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.129] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.129] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.129] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned="BOLDSTRI.INF" [0048.129] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\" [0048.129] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\") returned="" [0048.129] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO DECRYPT FILES.txt" [0048.129] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\how to decrypt files.txt")) returned 0x20 [0048.130] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" [0048.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.130] lstrlenA (lpString="*.zip") returned 5 [0048.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.130] lstrlenA (lpString="*.rar") returned 5 [0048.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.130] lstrlenA (lpString="*.7z") returned 4 [0048.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.130] lstrlenA (lpString="*.tar") returned 5 [0048.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.130] lstrlenA (lpString="*.gzip") returned 6 [0048.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.130] lstrlenA (lpString="*.jpg") returned 5 [0048.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.130] lstrlenA (lpString="*.jpeg") returned 6 [0048.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.130] lstrlenA (lpString="*.psd") returned 5 [0048.130] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.130] lstrlenA (lpString="*.gif") returned 5 [0048.130] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" [0048.130] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" [0048.130] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF." [0048.130] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.wannacry" [0048.130] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.131] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd97 [0048.131] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72)) returned 1 [0048.131] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.131] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd19, lpOverlapped=0x0) returned 1 [0048.133] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.133] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.133] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd19, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd19, lpOverlapped=0x0) returned 1 [0048.133] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.133] CloseHandle (hObject=0x90) returned 1 [0048.134] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.wannacry")) returned 1 [0048.135] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.135] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.135] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.135] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.135] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.135] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.135] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\" [0048.135] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\") returned="" [0048.135] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO DECRYPT FILES.txt" [0048.135] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\how to decrypt files.txt")) returned 0x20 [0048.135] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" [0048.135] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.135] lstrlenA (lpString="*.zip") returned 5 [0048.135] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.135] lstrlenA (lpString="*.rar") returned 5 [0048.135] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.136] lstrlenA (lpString="*.7z") returned 4 [0048.136] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.136] lstrlenA (lpString="*.tar") returned 5 [0048.136] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.136] lstrlenA (lpString="*.gzip") returned 6 [0048.136] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.136] lstrlenA (lpString="*.jpg") returned 5 [0048.136] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.136] lstrlenA (lpString="*.jpeg") returned 6 [0048.136] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.136] lstrlenA (lpString="*.psd") returned 5 [0048.136] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.136] lstrlenA (lpString="*.gif") returned 5 [0048.136] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.136] lstrlenA (lpString="*.doc") returned 5 [0048.136] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.136] lstrlenA (lpString="*.docx") returned 6 [0048.136] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.136] lstrlenA (lpString="*.xls") returned 5 [0048.136] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.136] lstrlenA (lpString="*.xlsx") returned 6 [0048.136] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.137] lstrlenA (lpString="*.ppt") returned 5 [0048.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.137] lstrlenA (lpString="*.pptx") returned 6 [0048.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.137] lstrlenA (lpString="*.pdf") returned 5 [0048.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.137] lstrlenA (lpString="*.mov") returned 5 [0048.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.137] lstrlenA (lpString="*.m2v") returned 5 [0048.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.137] lstrlenA (lpString="*.3gp") returned 5 [0048.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.137] lstrlenA (lpString="*.mpeg") returned 6 [0048.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.137] lstrlenA (lpString="*.mpg") returned 5 [0048.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.137] lstrlenA (lpString="*.flv") returned 5 [0048.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.137] lstrlenA (lpString="*.avi") returned 5 [0048.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.137] lstrlenA (lpString="*.mp4") returned 5 [0048.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.137] lstrlenA (lpString="*.wmv") returned 5 [0048.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.137] lstrlenA (lpString="*.divx") returned 6 [0048.137] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.137] lstrlenA (lpString="*.mkv") returned 5 [0048.138] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.138] lstrlenA (lpString="*.mp3") returned 5 [0048.138] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.138] lstrlenA (lpString="*.wav") returned 5 [0048.138] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.138] lstrlenA (lpString="*.flac") returned 6 [0048.138] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.138] lstrlenA (lpString="*.ape") returned 5 [0048.138] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.138] lstrlenA (lpString="*.wma") returned 5 [0048.138] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.138] lstrlenA (lpString="*.ac3") returned 5 [0048.138] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.138] lstrlenA (lpString="*.mxf") returned 5 [0048.138] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.138] FindClose (in: hFindFile=0x2d80c8 | out: hFindFile=0x2d80c8) returned 1 [0048.138] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0048.138] lstrcmpA (lpString1=".", lpString2="BREEZE") returned -1 [0048.138] lstrcmpA (lpString1="..", lpString2="BREEZE") returned -1 [0048.138] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.138] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="BREEZE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE" [0048.138] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE") returned 62 [0048.138] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0048.139] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.139] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x780000, cFileName="..", cAlternateFileName="")) returned 1 [0048.139] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.139] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.139] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea563500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a537, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BREEZE.ELM", cAlternateFileName="")) returned 1 [0048.139] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.139] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BREEZE.ELM") returned 1 [0048.139] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BREEZE.ELM") returned 1 [0048.139] lstrcmpiA (lpString1="", lpString2="BREEZE.ELM") returned -1 [0048.139] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*") returned="*.*" [0048.139] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\" [0048.139] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\") returned="" [0048.139] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO DECRYPT FILES.txt" [0048.140] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\how to decrypt files.txt")) returned 0xffffffff [0048.140] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.140] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.140] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.141] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.141] CloseHandle (hObject=0x90) returned 1 [0048.141] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", lpString2="BREEZE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" [0048.141] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.zip") returned 0 [0048.141] lstrlenA (lpString="*.zip") returned 5 [0048.141] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.rar") returned 0 [0048.141] lstrlenA (lpString="*.rar") returned 5 [0048.141] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.7z") returned 0 [0048.141] lstrlenA (lpString="*.7z") returned 4 [0048.141] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.tar") returned 0 [0048.141] lstrlenA (lpString="*.tar") returned 5 [0048.141] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.gzip") returned 0 [0048.141] lstrlenA (lpString="*.gzip") returned 6 [0048.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.jpg") returned 0 [0048.142] lstrlenA (lpString="*.jpg") returned 5 [0048.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.jpeg") returned 0 [0048.142] lstrlenA (lpString="*.jpeg") returned 6 [0048.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.psd") returned 0 [0048.142] lstrlenA (lpString="*.psd") returned 5 [0048.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.gif") returned 0 [0048.142] lstrlenA (lpString="*.gif") returned 5 [0048.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.doc") returned 0 [0048.142] lstrlenA (lpString="*.doc") returned 5 [0048.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.docx") returned 0 [0048.142] lstrlenA (lpString="*.docx") returned 6 [0048.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.xls") returned 0 [0048.142] lstrlenA (lpString="*.xls") returned 5 [0048.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.xlsx") returned 0 [0048.142] lstrlenA (lpString="*.xlsx") returned 6 [0048.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.ppt") returned 0 [0048.142] lstrlenA (lpString="*.ppt") returned 5 [0048.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.pptx") returned 0 [0048.142] lstrlenA (lpString="*.pptx") returned 6 [0048.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.pdf") returned 0 [0048.142] lstrlenA (lpString="*.pdf") returned 5 [0048.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.mov") returned 0 [0048.142] lstrlenA (lpString="*.mov") returned 5 [0048.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.m2v") returned 0 [0048.142] lstrlenA (lpString="*.m2v") returned 5 [0048.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.3gp") returned 0 [0048.142] lstrlenA (lpString="*.3gp") returned 5 [0048.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.mpeg") returned 0 [0048.142] lstrlenA (lpString="*.mpeg") returned 6 [0048.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.mpg") returned 0 [0048.142] lstrlenA (lpString="*.mpg") returned 5 [0048.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.flv") returned 0 [0048.142] lstrlenA (lpString="*.flv") returned 5 [0048.142] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.avi") returned 0 [0048.142] lstrlenA (lpString="*.avi") returned 5 [0048.143] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.mp4") returned 0 [0048.143] lstrlenA (lpString="*.mp4") returned 5 [0048.143] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.wmv") returned 0 [0048.143] lstrlenA (lpString="*.wmv") returned 5 [0048.143] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.divx") returned 0 [0048.143] lstrlenA (lpString="*.divx") returned 6 [0048.143] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.mkv") returned 0 [0048.143] lstrlenA (lpString="*.mkv") returned 5 [0048.143] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.mp3") returned 0 [0048.143] lstrlenA (lpString="*.mp3") returned 5 [0048.143] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.wav") returned 0 [0048.143] lstrlenA (lpString="*.wav") returned 5 [0048.143] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.flac") returned 0 [0048.143] lstrlenA (lpString="*.flac") returned 6 [0048.143] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.ape") returned 0 [0048.143] lstrlenA (lpString="*.ape") returned 5 [0048.143] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.wma") returned 0 [0048.143] lstrlenA (lpString="*.wma") returned 5 [0048.143] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.ac3") returned 0 [0048.143] lstrlenA (lpString="*.ac3") returned 5 [0048.143] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", pszSpec="*.mxf") returned 0 [0048.143] lstrlenA (lpString="*.mxf") returned 5 [0048.143] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x2d83e0, cFileName="BREEZE.INF", cAlternateFileName="")) returned 1 [0048.143] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.143] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BREEZE.INF") returned 1 [0048.143] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BREEZE.INF") returned 1 [0048.143] lstrcmpiA (lpString1="", lpString2="BREEZE.INF") returned -1 [0048.143] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned="BREEZE.ELM" [0048.143] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\" [0048.143] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\") returned="" [0048.143] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO DECRYPT FILES.txt" [0048.143] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\how to decrypt files.txt")) returned 0x20 [0048.143] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", lpString2="BREEZE.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" [0048.144] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.zip") returned 0 [0048.144] lstrlenA (lpString="*.zip") returned 5 [0048.144] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.rar") returned 0 [0048.144] lstrlenA (lpString="*.rar") returned 5 [0048.144] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.7z") returned 0 [0048.144] lstrlenA (lpString="*.7z") returned 4 [0048.144] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.tar") returned 0 [0048.144] lstrlenA (lpString="*.tar") returned 5 [0048.144] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.gzip") returned 0 [0048.144] lstrlenA (lpString="*.gzip") returned 6 [0048.144] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.jpg") returned 0 [0048.144] lstrlenA (lpString="*.jpg") returned 5 [0048.144] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.jpeg") returned 0 [0048.144] lstrlenA (lpString="*.jpeg") returned 6 [0048.144] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.psd") returned 0 [0048.144] lstrlenA (lpString="*.psd") returned 5 [0048.144] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.gif") returned 0 [0048.144] lstrlenA (lpString="*.gif") returned 5 [0048.144] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.doc") returned 0 [0048.144] lstrlenA (lpString="*.doc") returned 5 [0048.144] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.docx") returned 0 [0048.144] lstrlenA (lpString="*.docx") returned 6 [0048.144] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.xls") returned 0 [0048.144] lstrlenA (lpString="*.xls") returned 5 [0048.144] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.xlsx") returned 0 [0048.144] lstrlenA (lpString="*.xlsx") returned 6 [0048.144] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.ppt") returned 0 [0048.144] lstrlenA (lpString="*.ppt") returned 5 [0048.144] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.pptx") returned 0 [0048.144] lstrlenA (lpString="*.pptx") returned 6 [0048.144] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.pdf") returned 0 [0048.144] lstrlenA (lpString="*.pdf") returned 5 [0048.144] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.mov") returned 0 [0048.144] lstrlenA (lpString="*.mov") returned 5 [0048.144] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.m2v") returned 0 [0048.144] lstrlenA (lpString="*.m2v") returned 5 [0048.145] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.3gp") returned 0 [0048.145] lstrlenA (lpString="*.3gp") returned 5 [0048.145] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.mpeg") returned 0 [0048.145] lstrlenA (lpString="*.mpeg") returned 6 [0048.145] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.mpg") returned 0 [0048.145] lstrlenA (lpString="*.mpg") returned 5 [0048.145] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.flv") returned 0 [0048.145] lstrlenA (lpString="*.flv") returned 5 [0048.145] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.avi") returned 0 [0048.145] lstrlenA (lpString="*.avi") returned 5 [0048.145] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.mp4") returned 0 [0048.145] lstrlenA (lpString="*.mp4") returned 5 [0048.145] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.wmv") returned 0 [0048.145] lstrlenA (lpString="*.wmv") returned 5 [0048.145] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.divx") returned 0 [0048.145] lstrlenA (lpString="*.divx") returned 6 [0048.145] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.mkv") returned 0 [0048.145] lstrlenA (lpString="*.mkv") returned 5 [0048.145] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.mp3") returned 0 [0048.145] lstrlenA (lpString="*.mp3") returned 5 [0048.145] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.wav") returned 0 [0048.145] lstrlenA (lpString="*.wav") returned 5 [0048.145] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.flac") returned 0 [0048.145] lstrlenA (lpString="*.flac") returned 6 [0048.145] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.ape") returned 0 [0048.145] lstrlenA (lpString="*.ape") returned 5 [0048.145] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.wma") returned 0 [0048.145] lstrlenA (lpString="*.wma") returned 5 [0048.145] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.ac3") returned 0 [0048.145] lstrlenA (lpString="*.ac3") returned 5 [0048.145] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", pszSpec="*.mxf") returned 0 [0048.145] lstrlenA (lpString="*.mxf") returned 5 [0048.145] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaa2, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.145] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.145] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.145] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.145] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.146] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned="BREEZE.INF" [0048.146] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\" [0048.146] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\") returned="" [0048.146] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO DECRYPT FILES.txt" [0048.146] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\how to decrypt files.txt")) returned 0x20 [0048.146] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" [0048.146] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.146] lstrlenA (lpString="*.zip") returned 5 [0048.146] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.146] lstrlenA (lpString="*.rar") returned 5 [0048.146] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.146] lstrlenA (lpString="*.7z") returned 4 [0048.146] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.146] lstrlenA (lpString="*.tar") returned 5 [0048.146] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.146] lstrlenA (lpString="*.gzip") returned 6 [0048.146] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.146] lstrlenA (lpString="*.jpg") returned 5 [0048.146] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.146] lstrlenA (lpString="*.jpeg") returned 6 [0048.146] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.146] lstrlenA (lpString="*.psd") returned 5 [0048.146] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.146] lstrlenA (lpString="*.gif") returned 5 [0048.146] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" [0048.146] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" [0048.146] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF." [0048.146] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.wannacry" [0048.146] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.147] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaa2 [0048.147] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6f8e30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72)) returned 1 [0048.148] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.148] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xa24, lpOverlapped=0x0) returned 1 [0048.149] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.149] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.149] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xa24, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xa24, lpOverlapped=0x0) returned 1 [0048.149] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.149] CloseHandle (hObject=0x90) returned 1 [0048.151] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.wannacry")) returned 1 [0048.153] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.153] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.153] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.153] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.153] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.153] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.153] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\" [0048.153] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\") returned="" [0048.153] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO DECRYPT FILES.txt" [0048.154] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\how to decrypt files.txt")) returned 0x20 [0048.154] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" [0048.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.154] lstrlenA (lpString="*.zip") returned 5 [0048.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.154] lstrlenA (lpString="*.rar") returned 5 [0048.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.154] lstrlenA (lpString="*.7z") returned 4 [0048.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.154] lstrlenA (lpString="*.tar") returned 5 [0048.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.154] lstrlenA (lpString="*.gzip") returned 6 [0048.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.154] lstrlenA (lpString="*.jpg") returned 5 [0048.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.154] lstrlenA (lpString="*.jpeg") returned 6 [0048.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.154] lstrlenA (lpString="*.psd") returned 5 [0048.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.154] lstrlenA (lpString="*.gif") returned 5 [0048.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.154] lstrlenA (lpString="*.doc") returned 5 [0048.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.154] lstrlenA (lpString="*.docx") returned 6 [0048.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.155] lstrlenA (lpString="*.xls") returned 5 [0048.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.155] lstrlenA (lpString="*.xlsx") returned 6 [0048.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.155] lstrlenA (lpString="*.ppt") returned 5 [0048.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.155] lstrlenA (lpString="*.pptx") returned 6 [0048.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.155] lstrlenA (lpString="*.pdf") returned 5 [0048.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.155] lstrlenA (lpString="*.mov") returned 5 [0048.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.155] lstrlenA (lpString="*.m2v") returned 5 [0048.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.155] lstrlenA (lpString="*.3gp") returned 5 [0048.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.155] lstrlenA (lpString="*.mpeg") returned 6 [0048.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.155] lstrlenA (lpString="*.mpg") returned 5 [0048.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.155] lstrlenA (lpString="*.flv") returned 5 [0048.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.155] lstrlenA (lpString="*.avi") returned 5 [0048.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.155] lstrlenA (lpString="*.mp4") returned 5 [0048.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.155] lstrlenA (lpString="*.wmv") returned 5 [0048.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.155] lstrlenA (lpString="*.divx") returned 6 [0048.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.156] lstrlenA (lpString="*.mkv") returned 5 [0048.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.156] lstrlenA (lpString="*.mp3") returned 5 [0048.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.156] lstrlenA (lpString="*.wav") returned 5 [0048.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.156] lstrlenA (lpString="*.flac") returned 6 [0048.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.156] lstrlenA (lpString="*.ape") returned 5 [0048.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.156] lstrlenA (lpString="*.wma") returned 5 [0048.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.156] lstrlenA (lpString="*.ac3") returned 5 [0048.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.156] lstrlenA (lpString="*.mxf") returned 5 [0048.156] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.156] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0048.156] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="CANYON", cAlternateFileName="")) returned 1 [0048.156] lstrcmpA (lpString1=".", lpString2="CANYON") returned -1 [0048.156] lstrcmpA (lpString1="..", lpString2="CANYON") returned -1 [0048.156] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.156] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="CANYON" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON" [0048.156] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON") returned 62 [0048.157] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0048.160] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.160] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.160] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.160] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.160] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb876200, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec9, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CANYON.ELM", cAlternateFileName="")) returned 1 [0048.160] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.161] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CANYON.ELM") returned 1 [0048.161] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CANYON.ELM") returned 1 [0048.161] lstrcmpiA (lpString1="", lpString2="CANYON.ELM") returned -1 [0048.161] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*") returned="*.*" [0048.161] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\" [0048.161] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\") returned="" [0048.161] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO DECRYPT FILES.txt" [0048.161] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\how to decrypt files.txt")) returned 0xffffffff [0048.161] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.161] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.161] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.163] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.163] CloseHandle (hObject=0x90) returned 1 [0048.163] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", lpString2="CANYON.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" [0048.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.zip") returned 0 [0048.163] lstrlenA (lpString="*.zip") returned 5 [0048.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.rar") returned 0 [0048.163] lstrlenA (lpString="*.rar") returned 5 [0048.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.7z") returned 0 [0048.163] lstrlenA (lpString="*.7z") returned 4 [0048.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.tar") returned 0 [0048.163] lstrlenA (lpString="*.tar") returned 5 [0048.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.gzip") returned 0 [0048.163] lstrlenA (lpString="*.gzip") returned 6 [0048.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.jpg") returned 0 [0048.163] lstrlenA (lpString="*.jpg") returned 5 [0048.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.jpeg") returned 0 [0048.163] lstrlenA (lpString="*.jpeg") returned 6 [0048.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.psd") returned 0 [0048.164] lstrlenA (lpString="*.psd") returned 5 [0048.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.gif") returned 0 [0048.164] lstrlenA (lpString="*.gif") returned 5 [0048.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.doc") returned 0 [0048.164] lstrlenA (lpString="*.doc") returned 5 [0048.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.docx") returned 0 [0048.164] lstrlenA (lpString="*.docx") returned 6 [0048.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.xls") returned 0 [0048.164] lstrlenA (lpString="*.xls") returned 5 [0048.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.xlsx") returned 0 [0048.164] lstrlenA (lpString="*.xlsx") returned 6 [0048.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.ppt") returned 0 [0048.164] lstrlenA (lpString="*.ppt") returned 5 [0048.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.pptx") returned 0 [0048.164] lstrlenA (lpString="*.pptx") returned 6 [0048.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.pdf") returned 0 [0048.164] lstrlenA (lpString="*.pdf") returned 5 [0048.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.mov") returned 0 [0048.164] lstrlenA (lpString="*.mov") returned 5 [0048.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.m2v") returned 0 [0048.164] lstrlenA (lpString="*.m2v") returned 5 [0048.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.3gp") returned 0 [0048.164] lstrlenA (lpString="*.3gp") returned 5 [0048.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.mpeg") returned 0 [0048.164] lstrlenA (lpString="*.mpeg") returned 6 [0048.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.mpg") returned 0 [0048.164] lstrlenA (lpString="*.mpg") returned 5 [0048.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.flv") returned 0 [0048.165] lstrlenA (lpString="*.flv") returned 5 [0048.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.avi") returned 0 [0048.165] lstrlenA (lpString="*.avi") returned 5 [0048.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.mp4") returned 0 [0048.165] lstrlenA (lpString="*.mp4") returned 5 [0048.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.wmv") returned 0 [0048.165] lstrlenA (lpString="*.wmv") returned 5 [0048.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.divx") returned 0 [0048.165] lstrlenA (lpString="*.divx") returned 6 [0048.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.mkv") returned 0 [0048.165] lstrlenA (lpString="*.mkv") returned 5 [0048.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.mp3") returned 0 [0048.165] lstrlenA (lpString="*.mp3") returned 5 [0048.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.wav") returned 0 [0048.165] lstrlenA (lpString="*.wav") returned 5 [0048.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.flac") returned 0 [0048.165] lstrlenA (lpString="*.flac") returned 6 [0048.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.ape") returned 0 [0048.165] lstrlenA (lpString="*.ape") returned 5 [0048.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.wma") returned 0 [0048.165] lstrlenA (lpString="*.wma") returned 5 [0048.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.ac3") returned 0 [0048.165] lstrlenA (lpString="*.ac3") returned 5 [0048.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", pszSpec="*.mxf") returned 0 [0048.165] lstrlenA (lpString="*.mxf") returned 5 [0048.165] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x0, dwReserved1=0x2d83e0, cFileName="CANYON.INF", cAlternateFileName="")) returned 1 [0048.166] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.166] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CANYON.INF") returned 1 [0048.166] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CANYON.INF") returned 1 [0048.166] lstrcmpiA (lpString1="", lpString2="CANYON.INF") returned -1 [0048.166] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned="CANYON.ELM" [0048.166] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\" [0048.166] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\") returned="" [0048.166] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO DECRYPT FILES.txt" [0048.166] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\how to decrypt files.txt")) returned 0x20 [0048.166] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", lpString2="CANYON.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" [0048.166] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.zip") returned 0 [0048.166] lstrlenA (lpString="*.zip") returned 5 [0048.166] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.rar") returned 0 [0048.166] lstrlenA (lpString="*.rar") returned 5 [0048.166] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.7z") returned 0 [0048.166] lstrlenA (lpString="*.7z") returned 4 [0048.166] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.tar") returned 0 [0048.166] lstrlenA (lpString="*.tar") returned 5 [0048.166] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.gzip") returned 0 [0048.166] lstrlenA (lpString="*.gzip") returned 6 [0048.166] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.jpg") returned 0 [0048.166] lstrlenA (lpString="*.jpg") returned 5 [0048.166] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.jpeg") returned 0 [0048.166] lstrlenA (lpString="*.jpeg") returned 6 [0048.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.psd") returned 0 [0048.167] lstrlenA (lpString="*.psd") returned 5 [0048.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.gif") returned 0 [0048.167] lstrlenA (lpString="*.gif") returned 5 [0048.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.doc") returned 0 [0048.167] lstrlenA (lpString="*.doc") returned 5 [0048.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.docx") returned 0 [0048.167] lstrlenA (lpString="*.docx") returned 6 [0048.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.xls") returned 0 [0048.167] lstrlenA (lpString="*.xls") returned 5 [0048.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.xlsx") returned 0 [0048.167] lstrlenA (lpString="*.xlsx") returned 6 [0048.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.ppt") returned 0 [0048.167] lstrlenA (lpString="*.ppt") returned 5 [0048.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.pptx") returned 0 [0048.167] lstrlenA (lpString="*.pptx") returned 6 [0048.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.pdf") returned 0 [0048.167] lstrlenA (lpString="*.pdf") returned 5 [0048.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.mov") returned 0 [0048.167] lstrlenA (lpString="*.mov") returned 5 [0048.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.m2v") returned 0 [0048.168] lstrlenA (lpString="*.m2v") returned 5 [0048.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.3gp") returned 0 [0048.168] lstrlenA (lpString="*.3gp") returned 5 [0048.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.mpeg") returned 0 [0048.168] lstrlenA (lpString="*.mpeg") returned 6 [0048.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.mpg") returned 0 [0048.168] lstrlenA (lpString="*.mpg") returned 5 [0048.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.flv") returned 0 [0048.168] lstrlenA (lpString="*.flv") returned 5 [0048.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.avi") returned 0 [0048.168] lstrlenA (lpString="*.avi") returned 5 [0048.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.mp4") returned 0 [0048.168] lstrlenA (lpString="*.mp4") returned 5 [0048.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.wmv") returned 0 [0048.168] lstrlenA (lpString="*.wmv") returned 5 [0048.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.divx") returned 0 [0048.168] lstrlenA (lpString="*.divx") returned 6 [0048.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.mkv") returned 0 [0048.168] lstrlenA (lpString="*.mkv") returned 5 [0048.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.mp3") returned 0 [0048.168] lstrlenA (lpString="*.mp3") returned 5 [0048.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.wav") returned 0 [0048.168] lstrlenA (lpString="*.wav") returned 5 [0048.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.flac") returned 0 [0048.168] lstrlenA (lpString="*.flac") returned 6 [0048.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.ape") returned 0 [0048.169] lstrlenA (lpString="*.ape") returned 5 [0048.169] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.wma") returned 0 [0048.169] lstrlenA (lpString="*.wma") returned 5 [0048.169] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.ac3") returned 0 [0048.169] lstrlenA (lpString="*.ac3") returned 5 [0048.169] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", pszSpec="*.mxf") returned 0 [0048.169] lstrlenA (lpString="*.mxf") returned 5 [0048.169] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3b1, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.169] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.169] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.169] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.169] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.169] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned="CANYON.INF" [0048.169] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\" [0048.169] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\") returned="" [0048.169] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO DECRYPT FILES.txt" [0048.169] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\how to decrypt files.txt")) returned 0x20 [0048.169] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" [0048.169] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.169] lstrlenA (lpString="*.zip") returned 5 [0048.169] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.169] lstrlenA (lpString="*.rar") returned 5 [0048.170] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.170] lstrlenA (lpString="*.7z") returned 4 [0048.170] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.170] lstrlenA (lpString="*.tar") returned 5 [0048.170] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.170] lstrlenA (lpString="*.gzip") returned 6 [0048.170] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.170] lstrlenA (lpString="*.jpg") returned 5 [0048.170] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.170] lstrlenA (lpString="*.jpeg") returned 6 [0048.170] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.170] lstrlenA (lpString="*.psd") returned 5 [0048.170] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.170] lstrlenA (lpString="*.gif") returned 5 [0048.170] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" [0048.170] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" [0048.170] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF." [0048.170] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.wannacry" [0048.170] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.171] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b1 [0048.171] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6f8e30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72)) returned 1 [0048.171] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.171] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x333, lpOverlapped=0x0) returned 1 [0048.173] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.173] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.173] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x333, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x333, lpOverlapped=0x0) returned 1 [0048.173] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.173] CloseHandle (hObject=0x90) returned 1 [0048.174] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.wannacry")) returned 1 [0048.177] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.177] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.177] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.177] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.177] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.177] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.177] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\" [0048.177] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\") returned="" [0048.177] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO DECRYPT FILES.txt" [0048.177] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\how to decrypt files.txt")) returned 0x20 [0048.177] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" [0048.177] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.177] lstrlenA (lpString="*.zip") returned 5 [0048.177] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.177] lstrlenA (lpString="*.rar") returned 5 [0048.177] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.177] lstrlenA (lpString="*.7z") returned 4 [0048.177] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.177] lstrlenA (lpString="*.tar") returned 5 [0048.177] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.178] lstrlenA (lpString="*.gzip") returned 6 [0048.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.178] lstrlenA (lpString="*.jpg") returned 5 [0048.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.178] lstrlenA (lpString="*.jpeg") returned 6 [0048.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.178] lstrlenA (lpString="*.psd") returned 5 [0048.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.178] lstrlenA (lpString="*.gif") returned 5 [0048.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.178] lstrlenA (lpString="*.doc") returned 5 [0048.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.178] lstrlenA (lpString="*.docx") returned 6 [0048.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.178] lstrlenA (lpString="*.xls") returned 5 [0048.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.178] lstrlenA (lpString="*.xlsx") returned 6 [0048.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.178] lstrlenA (lpString="*.ppt") returned 5 [0048.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.178] lstrlenA (lpString="*.pptx") returned 6 [0048.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.178] lstrlenA (lpString="*.pdf") returned 5 [0048.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.178] lstrlenA (lpString="*.mov") returned 5 [0048.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.179] lstrlenA (lpString="*.m2v") returned 5 [0048.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.179] lstrlenA (lpString="*.3gp") returned 5 [0048.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.179] lstrlenA (lpString="*.mpeg") returned 6 [0048.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.179] lstrlenA (lpString="*.mpg") returned 5 [0048.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.179] lstrlenA (lpString="*.flv") returned 5 [0048.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.179] lstrlenA (lpString="*.avi") returned 5 [0048.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.179] lstrlenA (lpString="*.mp4") returned 5 [0048.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.179] lstrlenA (lpString="*.wmv") returned 5 [0048.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.179] lstrlenA (lpString="*.divx") returned 6 [0048.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.179] lstrlenA (lpString="*.mkv") returned 5 [0048.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.179] lstrlenA (lpString="*.mp3") returned 5 [0048.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.179] lstrlenA (lpString="*.wav") returned 5 [0048.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.180] lstrlenA (lpString="*.flac") returned 6 [0048.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.180] lstrlenA (lpString="*.ape") returned 5 [0048.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.180] lstrlenA (lpString="*.wma") returned 5 [0048.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.180] lstrlenA (lpString="*.ac3") returned 5 [0048.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.180] lstrlenA (lpString="*.mxf") returned 5 [0048.180] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.180] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0048.180] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0048.180] lstrcmpA (lpString1=".", lpString2="CAPSULES") returned -1 [0048.180] lstrcmpA (lpString1="..", lpString2="CAPSULES") returned -1 [0048.180] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.180] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="CAPSULES" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES" [0048.180] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES") returned 64 [0048.180] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2d80c8 [0048.181] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.182] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.182] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.182] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.182] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb88f00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CAPSULES.ELM", cAlternateFileName="")) returned 1 [0048.182] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.182] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CAPSULES.ELM") returned 1 [0048.182] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CAPSULES.ELM") returned 1 [0048.182] lstrcmpiA (lpString1="", lpString2="CAPSULES.ELM") returned -1 [0048.182] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*") returned="*.*" [0048.182] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\" [0048.182] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\") returned="" [0048.182] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO DECRYPT FILES.txt" [0048.182] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\how to decrypt files.txt")) returned 0xffffffff [0048.182] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.184] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.184] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.185] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.185] CloseHandle (hObject=0x90) returned 1 [0048.186] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", lpString2="CAPSULES.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" [0048.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.zip") returned 0 [0048.186] lstrlenA (lpString="*.zip") returned 5 [0048.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.rar") returned 0 [0048.186] lstrlenA (lpString="*.rar") returned 5 [0048.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.7z") returned 0 [0048.186] lstrlenA (lpString="*.7z") returned 4 [0048.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.tar") returned 0 [0048.186] lstrlenA (lpString="*.tar") returned 5 [0048.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.gzip") returned 0 [0048.186] lstrlenA (lpString="*.gzip") returned 6 [0048.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.jpg") returned 0 [0048.186] lstrlenA (lpString="*.jpg") returned 5 [0048.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.jpeg") returned 0 [0048.186] lstrlenA (lpString="*.jpeg") returned 6 [0048.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.psd") returned 0 [0048.186] lstrlenA (lpString="*.psd") returned 5 [0048.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.gif") returned 0 [0048.186] lstrlenA (lpString="*.gif") returned 5 [0048.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.doc") returned 0 [0048.186] lstrlenA (lpString="*.doc") returned 5 [0048.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.docx") returned 0 [0048.186] lstrlenA (lpString="*.docx") returned 6 [0048.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.xls") returned 0 [0048.187] lstrlenA (lpString="*.xls") returned 5 [0048.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.xlsx") returned 0 [0048.187] lstrlenA (lpString="*.xlsx") returned 6 [0048.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.ppt") returned 0 [0048.187] lstrlenA (lpString="*.ppt") returned 5 [0048.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.pptx") returned 0 [0048.187] lstrlenA (lpString="*.pptx") returned 6 [0048.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.pdf") returned 0 [0048.187] lstrlenA (lpString="*.pdf") returned 5 [0048.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.mov") returned 0 [0048.187] lstrlenA (lpString="*.mov") returned 5 [0048.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.m2v") returned 0 [0048.187] lstrlenA (lpString="*.m2v") returned 5 [0048.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.3gp") returned 0 [0048.187] lstrlenA (lpString="*.3gp") returned 5 [0048.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.mpeg") returned 0 [0048.187] lstrlenA (lpString="*.mpeg") returned 6 [0048.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.mpg") returned 0 [0048.187] lstrlenA (lpString="*.mpg") returned 5 [0048.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.flv") returned 0 [0048.187] lstrlenA (lpString="*.flv") returned 5 [0048.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.avi") returned 0 [0048.187] lstrlenA (lpString="*.avi") returned 5 [0048.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.mp4") returned 0 [0048.187] lstrlenA (lpString="*.mp4") returned 5 [0048.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.wmv") returned 0 [0048.187] lstrlenA (lpString="*.wmv") returned 5 [0048.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.divx") returned 0 [0048.187] lstrlenA (lpString="*.divx") returned 6 [0048.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.mkv") returned 0 [0048.187] lstrlenA (lpString="*.mkv") returned 5 [0048.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.mp3") returned 0 [0048.188] lstrlenA (lpString="*.mp3") returned 5 [0048.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.wav") returned 0 [0048.188] lstrlenA (lpString="*.wav") returned 5 [0048.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.flac") returned 0 [0048.188] lstrlenA (lpString="*.flac") returned 6 [0048.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.ape") returned 0 [0048.188] lstrlenA (lpString="*.ape") returned 5 [0048.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.wma") returned 0 [0048.188] lstrlenA (lpString="*.wma") returned 5 [0048.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.ac3") returned 0 [0048.188] lstrlenA (lpString="*.ac3") returned 5 [0048.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", pszSpec="*.mxf") returned 0 [0048.188] lstrlenA (lpString="*.mxf") returned 5 [0048.188] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf86a7300, ftCreationTime.dwHighDateTime=0x1c47827, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf86a7300, ftLastWriteTime.dwHighDateTime=0x1c47827, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x2d83f0, cFileName="CAPSULES.INF", cAlternateFileName="")) returned 1 [0048.188] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.188] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CAPSULES.INF") returned 1 [0048.188] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CAPSULES.INF") returned 1 [0048.188] lstrcmpiA (lpString1="", lpString2="CAPSULES.INF") returned -1 [0048.188] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned="CAPSULES.ELM" [0048.188] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\" [0048.188] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\") returned="" [0048.188] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO DECRYPT FILES.txt" [0048.188] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\how to decrypt files.txt")) returned 0x20 [0048.188] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", lpString2="CAPSULES.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" [0048.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.zip") returned 0 [0048.188] lstrlenA (lpString="*.zip") returned 5 [0048.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.rar") returned 0 [0048.188] lstrlenA (lpString="*.rar") returned 5 [0048.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.7z") returned 0 [0048.188] lstrlenA (lpString="*.7z") returned 4 [0048.189] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.tar") returned 0 [0048.189] lstrlenA (lpString="*.tar") returned 5 [0048.189] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.gzip") returned 0 [0048.189] lstrlenA (lpString="*.gzip") returned 6 [0048.189] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.jpg") returned 0 [0048.189] lstrlenA (lpString="*.jpg") returned 5 [0048.189] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.jpeg") returned 0 [0048.189] lstrlenA (lpString="*.jpeg") returned 6 [0048.189] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.psd") returned 0 [0048.189] lstrlenA (lpString="*.psd") returned 5 [0048.189] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.gif") returned 0 [0048.189] lstrlenA (lpString="*.gif") returned 5 [0048.189] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.doc") returned 0 [0048.189] lstrlenA (lpString="*.doc") returned 5 [0048.189] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.docx") returned 0 [0048.189] lstrlenA (lpString="*.docx") returned 6 [0048.189] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.xls") returned 0 [0048.189] lstrlenA (lpString="*.xls") returned 5 [0048.189] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.xlsx") returned 0 [0048.189] lstrlenA (lpString="*.xlsx") returned 6 [0048.189] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.ppt") returned 0 [0048.189] lstrlenA (lpString="*.ppt") returned 5 [0048.189] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.pptx") returned 0 [0048.189] lstrlenA (lpString="*.pptx") returned 6 [0048.189] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.pdf") returned 0 [0048.189] lstrlenA (lpString="*.pdf") returned 5 [0048.189] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.mov") returned 0 [0048.189] lstrlenA (lpString="*.mov") returned 5 [0048.189] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.m2v") returned 0 [0048.189] lstrlenA (lpString="*.m2v") returned 5 [0048.189] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.3gp") returned 0 [0048.190] lstrlenA (lpString="*.3gp") returned 5 [0048.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.mpeg") returned 0 [0048.190] lstrlenA (lpString="*.mpeg") returned 6 [0048.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.mpg") returned 0 [0048.190] lstrlenA (lpString="*.mpg") returned 5 [0048.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.flv") returned 0 [0048.190] lstrlenA (lpString="*.flv") returned 5 [0048.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.avi") returned 0 [0048.190] lstrlenA (lpString="*.avi") returned 5 [0048.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.mp4") returned 0 [0048.190] lstrlenA (lpString="*.mp4") returned 5 [0048.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.wmv") returned 0 [0048.190] lstrlenA (lpString="*.wmv") returned 5 [0048.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.divx") returned 0 [0048.190] lstrlenA (lpString="*.divx") returned 6 [0048.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.mkv") returned 0 [0048.190] lstrlenA (lpString="*.mkv") returned 5 [0048.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.mp3") returned 0 [0048.190] lstrlenA (lpString="*.mp3") returned 5 [0048.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.wav") returned 0 [0048.190] lstrlenA (lpString="*.wav") returned 5 [0048.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.flac") returned 0 [0048.190] lstrlenA (lpString="*.flac") returned 6 [0048.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.ape") returned 0 [0048.190] lstrlenA (lpString="*.ape") returned 5 [0048.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.wma") returned 0 [0048.190] lstrlenA (lpString="*.wma") returned 5 [0048.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.ac3") returned 0 [0048.190] lstrlenA (lpString="*.ac3") returned 5 [0048.190] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", pszSpec="*.mxf") returned 0 [0048.190] lstrlenA (lpString="*.mxf") returned 5 [0048.191] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.191] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.191] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.191] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.191] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.191] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned="CAPSULES.INF" [0048.191] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\" [0048.191] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\") returned="" [0048.191] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO DECRYPT FILES.txt" [0048.191] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\how to decrypt files.txt")) returned 0x20 [0048.191] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" [0048.191] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.191] lstrlenA (lpString="*.zip") returned 5 [0048.191] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.191] lstrlenA (lpString="*.rar") returned 5 [0048.191] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.191] lstrlenA (lpString="*.7z") returned 4 [0048.191] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.191] lstrlenA (lpString="*.tar") returned 5 [0048.191] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.191] lstrlenA (lpString="*.gzip") returned 6 [0048.191] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.191] lstrlenA (lpString="*.jpg") returned 5 [0048.191] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.191] lstrlenA (lpString="*.jpeg") returned 6 [0048.191] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.191] lstrlenA (lpString="*.psd") returned 5 [0048.191] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.191] lstrlenA (lpString="*.gif") returned 5 [0048.192] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" [0048.192] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" [0048.192] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF." [0048.192] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.wannacry" [0048.192] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.193] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7fc [0048.193] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72)) returned 1 [0048.193] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.193] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x77e, lpOverlapped=0x0) returned 1 [0048.194] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.194] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.194] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x77e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x77e, lpOverlapped=0x0) returned 1 [0048.194] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.195] CloseHandle (hObject=0x90) returned 1 [0048.198] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.wannacry")) returned 1 [0048.199] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.199] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.199] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.199] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.199] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.199] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.199] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\" [0048.199] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\") returned="" [0048.199] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO DECRYPT FILES.txt" [0048.199] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\how to decrypt files.txt")) returned 0x20 [0048.199] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" [0048.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.199] lstrlenA (lpString="*.zip") returned 5 [0048.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.200] lstrlenA (lpString="*.rar") returned 5 [0048.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.200] lstrlenA (lpString="*.7z") returned 4 [0048.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.200] lstrlenA (lpString="*.tar") returned 5 [0048.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.200] lstrlenA (lpString="*.gzip") returned 6 [0048.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.200] lstrlenA (lpString="*.jpg") returned 5 [0048.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.200] lstrlenA (lpString="*.jpeg") returned 6 [0048.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.200] lstrlenA (lpString="*.psd") returned 5 [0048.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.200] lstrlenA (lpString="*.gif") returned 5 [0048.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.200] lstrlenA (lpString="*.doc") returned 5 [0048.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.200] lstrlenA (lpString="*.docx") returned 6 [0048.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.200] lstrlenA (lpString="*.xls") returned 5 [0048.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.200] lstrlenA (lpString="*.xlsx") returned 6 [0048.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.200] lstrlenA (lpString="*.ppt") returned 5 [0048.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.200] lstrlenA (lpString="*.pptx") returned 6 [0048.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.200] lstrlenA (lpString="*.pdf") returned 5 [0048.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.200] lstrlenA (lpString="*.mov") returned 5 [0048.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.200] lstrlenA (lpString="*.m2v") returned 5 [0048.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.201] lstrlenA (lpString="*.3gp") returned 5 [0048.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.201] lstrlenA (lpString="*.mpeg") returned 6 [0048.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.201] lstrlenA (lpString="*.mpg") returned 5 [0048.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.201] lstrlenA (lpString="*.flv") returned 5 [0048.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.201] lstrlenA (lpString="*.avi") returned 5 [0048.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.201] lstrlenA (lpString="*.mp4") returned 5 [0048.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.201] lstrlenA (lpString="*.wmv") returned 5 [0048.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.201] lstrlenA (lpString="*.divx") returned 6 [0048.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.201] lstrlenA (lpString="*.mkv") returned 5 [0048.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.201] lstrlenA (lpString="*.mp3") returned 5 [0048.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.201] lstrlenA (lpString="*.wav") returned 5 [0048.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.201] lstrlenA (lpString="*.flac") returned 6 [0048.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.201] lstrlenA (lpString="*.ape") returned 5 [0048.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.201] lstrlenA (lpString="*.wma") returned 5 [0048.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.201] lstrlenA (lpString="*.ac3") returned 5 [0048.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.201] lstrlenA (lpString="*.mxf") returned 5 [0048.201] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.201] FindClose (in: hFindFile=0x2d80c8 | out: hFindFile=0x2d80c8) returned 1 [0048.202] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0048.202] lstrcmpA (lpString1=".", lpString2="CASCADE") returned -1 [0048.202] lstrcmpA (lpString1="..", lpString2="CASCADE") returned -1 [0048.202] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.202] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="CASCADE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE" [0048.202] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE") returned 63 [0048.202] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0048.203] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.203] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x780000, cFileName="..", cAlternateFileName="")) returned 1 [0048.203] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.203] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.203] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xede9bc00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xba44, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CASCADE.ELM", cAlternateFileName="")) returned 1 [0048.203] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.203] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CASCADE.ELM") returned 1 [0048.203] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CASCADE.ELM") returned 1 [0048.203] lstrcmpiA (lpString1="", lpString2="CASCADE.ELM") returned -1 [0048.203] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*") returned="*.*" [0048.203] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\" [0048.203] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\") returned="" [0048.203] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO DECRYPT FILES.txt" [0048.203] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\how to decrypt files.txt")) returned 0xffffffff [0048.203] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.204] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.204] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.205] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.205] CloseHandle (hObject=0x90) returned 1 [0048.205] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", lpString2="CASCADE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" [0048.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.zip") returned 0 [0048.205] lstrlenA (lpString="*.zip") returned 5 [0048.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.rar") returned 0 [0048.205] lstrlenA (lpString="*.rar") returned 5 [0048.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.7z") returned 0 [0048.205] lstrlenA (lpString="*.7z") returned 4 [0048.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.tar") returned 0 [0048.206] lstrlenA (lpString="*.tar") returned 5 [0048.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.gzip") returned 0 [0048.206] lstrlenA (lpString="*.gzip") returned 6 [0048.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.jpg") returned 0 [0048.206] lstrlenA (lpString="*.jpg") returned 5 [0048.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.jpeg") returned 0 [0048.206] lstrlenA (lpString="*.jpeg") returned 6 [0048.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.psd") returned 0 [0048.206] lstrlenA (lpString="*.psd") returned 5 [0048.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.gif") returned 0 [0048.206] lstrlenA (lpString="*.gif") returned 5 [0048.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.doc") returned 0 [0048.206] lstrlenA (lpString="*.doc") returned 5 [0048.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.docx") returned 0 [0048.206] lstrlenA (lpString="*.docx") returned 6 [0048.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.xls") returned 0 [0048.206] lstrlenA (lpString="*.xls") returned 5 [0048.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.xlsx") returned 0 [0048.206] lstrlenA (lpString="*.xlsx") returned 6 [0048.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.ppt") returned 0 [0048.206] lstrlenA (lpString="*.ppt") returned 5 [0048.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.pptx") returned 0 [0048.206] lstrlenA (lpString="*.pptx") returned 6 [0048.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.pdf") returned 0 [0048.206] lstrlenA (lpString="*.pdf") returned 5 [0048.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.mov") returned 0 [0048.206] lstrlenA (lpString="*.mov") returned 5 [0048.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.m2v") returned 0 [0048.206] lstrlenA (lpString="*.m2v") returned 5 [0048.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.3gp") returned 0 [0048.206] lstrlenA (lpString="*.3gp") returned 5 [0048.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.mpeg") returned 0 [0048.206] lstrlenA (lpString="*.mpeg") returned 6 [0048.206] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.mpg") returned 0 [0048.206] lstrlenA (lpString="*.mpg") returned 5 [0048.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.flv") returned 0 [0048.207] lstrlenA (lpString="*.flv") returned 5 [0048.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.avi") returned 0 [0048.207] lstrlenA (lpString="*.avi") returned 5 [0048.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.mp4") returned 0 [0048.207] lstrlenA (lpString="*.mp4") returned 5 [0048.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.wmv") returned 0 [0048.207] lstrlenA (lpString="*.wmv") returned 5 [0048.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.divx") returned 0 [0048.207] lstrlenA (lpString="*.divx") returned 6 [0048.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.mkv") returned 0 [0048.207] lstrlenA (lpString="*.mkv") returned 5 [0048.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.mp3") returned 0 [0048.207] lstrlenA (lpString="*.mp3") returned 5 [0048.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.wav") returned 0 [0048.207] lstrlenA (lpString="*.wav") returned 5 [0048.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.flac") returned 0 [0048.207] lstrlenA (lpString="*.flac") returned 6 [0048.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.ape") returned 0 [0048.207] lstrlenA (lpString="*.ape") returned 5 [0048.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.wma") returned 0 [0048.207] lstrlenA (lpString="*.wma") returned 5 [0048.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.ac3") returned 0 [0048.207] lstrlenA (lpString="*.ac3") returned 5 [0048.207] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", pszSpec="*.mxf") returned 0 [0048.207] lstrlenA (lpString="*.mxf") returned 5 [0048.207] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x262, dwReserved0=0x0, dwReserved1=0x2d83e8, cFileName="CASCADE.INF", cAlternateFileName="")) returned 1 [0048.207] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.208] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CASCADE.INF") returned 1 [0048.208] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CASCADE.INF") returned 1 [0048.208] lstrcmpiA (lpString1="", lpString2="CASCADE.INF") returned -1 [0048.208] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned="CASCADE.ELM" [0048.208] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\" [0048.208] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\") returned="" [0048.208] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO DECRYPT FILES.txt" [0048.208] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\how to decrypt files.txt")) returned 0x20 [0048.208] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", lpString2="CASCADE.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" [0048.208] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.zip") returned 0 [0048.208] lstrlenA (lpString="*.zip") returned 5 [0048.208] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.rar") returned 0 [0048.208] lstrlenA (lpString="*.rar") returned 5 [0048.208] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.7z") returned 0 [0048.208] lstrlenA (lpString="*.7z") returned 4 [0048.208] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.tar") returned 0 [0048.208] lstrlenA (lpString="*.tar") returned 5 [0048.208] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.gzip") returned 0 [0048.208] lstrlenA (lpString="*.gzip") returned 6 [0048.208] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.jpg") returned 0 [0048.208] lstrlenA (lpString="*.jpg") returned 5 [0048.208] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.jpeg") returned 0 [0048.208] lstrlenA (lpString="*.jpeg") returned 6 [0048.208] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.psd") returned 0 [0048.208] lstrlenA (lpString="*.psd") returned 5 [0048.209] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.gif") returned 0 [0048.209] lstrlenA (lpString="*.gif") returned 5 [0048.209] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.doc") returned 0 [0048.209] lstrlenA (lpString="*.doc") returned 5 [0048.209] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.docx") returned 0 [0048.209] lstrlenA (lpString="*.docx") returned 6 [0048.209] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.xls") returned 0 [0048.209] lstrlenA (lpString="*.xls") returned 5 [0048.209] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.xlsx") returned 0 [0048.209] lstrlenA (lpString="*.xlsx") returned 6 [0048.209] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.ppt") returned 0 [0048.209] lstrlenA (lpString="*.ppt") returned 5 [0048.209] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.pptx") returned 0 [0048.209] lstrlenA (lpString="*.pptx") returned 6 [0048.209] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.pdf") returned 0 [0048.209] lstrlenA (lpString="*.pdf") returned 5 [0048.209] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.mov") returned 0 [0048.209] lstrlenA (lpString="*.mov") returned 5 [0048.209] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.m2v") returned 0 [0048.209] lstrlenA (lpString="*.m2v") returned 5 [0048.209] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.3gp") returned 0 [0048.209] lstrlenA (lpString="*.3gp") returned 5 [0048.209] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.mpeg") returned 0 [0048.209] lstrlenA (lpString="*.mpeg") returned 6 [0048.209] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.mpg") returned 0 [0048.209] lstrlenA (lpString="*.mpg") returned 5 [0048.209] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.flv") returned 0 [0048.209] lstrlenA (lpString="*.flv") returned 5 [0048.209] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.avi") returned 0 [0048.209] lstrlenA (lpString="*.avi") returned 5 [0048.209] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.mp4") returned 0 [0048.209] lstrlenA (lpString="*.mp4") returned 5 [0048.209] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.wmv") returned 0 [0048.209] lstrlenA (lpString="*.wmv") returned 5 [0048.209] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.divx") returned 0 [0048.209] lstrlenA (lpString="*.divx") returned 6 [0048.210] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.mkv") returned 0 [0048.210] lstrlenA (lpString="*.mkv") returned 5 [0048.210] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.mp3") returned 0 [0048.210] lstrlenA (lpString="*.mp3") returned 5 [0048.210] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.wav") returned 0 [0048.210] lstrlenA (lpString="*.wav") returned 5 [0048.210] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.flac") returned 0 [0048.210] lstrlenA (lpString="*.flac") returned 6 [0048.210] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.ape") returned 0 [0048.210] lstrlenA (lpString="*.ape") returned 5 [0048.210] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.wma") returned 0 [0048.210] lstrlenA (lpString="*.wma") returned 5 [0048.210] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.ac3") returned 0 [0048.210] lstrlenA (lpString="*.ac3") returned 5 [0048.210] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", pszSpec="*.mxf") returned 0 [0048.210] lstrlenA (lpString="*.mxf") returned 5 [0048.210] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x553, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.210] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.210] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.210] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.210] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.210] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned="CASCADE.INF" [0048.210] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\") returned="" [0048.210] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO DECRYPT FILES.txt" [0048.210] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\how to decrypt files.txt")) returned 0x20 [0048.210] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" [0048.210] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.210] lstrlenA (lpString="*.zip") returned 5 [0048.210] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.210] lstrlenA (lpString="*.rar") returned 5 [0048.210] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.211] lstrlenA (lpString="*.7z") returned 4 [0048.211] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.211] lstrlenA (lpString="*.tar") returned 5 [0048.211] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.211] lstrlenA (lpString="*.gzip") returned 6 [0048.211] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.211] lstrlenA (lpString="*.jpg") returned 5 [0048.211] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.211] lstrlenA (lpString="*.jpeg") returned 6 [0048.211] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.211] lstrlenA (lpString="*.psd") returned 5 [0048.211] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.211] lstrlenA (lpString="*.gif") returned 5 [0048.211] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.211] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x553 [0048.211] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72)) returned 1 [0048.211] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.211] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4d5, lpOverlapped=0x0) returned 1 [0048.215] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.215] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.215] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4d5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4d5, lpOverlapped=0x0) returned 1 [0048.215] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.215] CloseHandle (hObject=0x90) returned 1 [0048.216] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.wannacry")) returned 1 [0048.218] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.218] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.218] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.218] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.218] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.218] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.218] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\" [0048.218] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\") returned="" [0048.218] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO DECRYPT FILES.txt" [0048.218] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\how to decrypt files.txt")) returned 0x20 [0048.219] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" [0048.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.219] lstrlenA (lpString="*.zip") returned 5 [0048.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.219] lstrlenA (lpString="*.rar") returned 5 [0048.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.219] lstrlenA (lpString="*.7z") returned 4 [0048.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.219] lstrlenA (lpString="*.tar") returned 5 [0048.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.219] lstrlenA (lpString="*.gzip") returned 6 [0048.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.219] lstrlenA (lpString="*.jpg") returned 5 [0048.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.219] lstrlenA (lpString="*.jpeg") returned 6 [0048.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.219] lstrlenA (lpString="*.psd") returned 5 [0048.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.219] lstrlenA (lpString="*.gif") returned 5 [0048.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.219] lstrlenA (lpString="*.doc") returned 5 [0048.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.219] lstrlenA (lpString="*.docx") returned 6 [0048.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.219] lstrlenA (lpString="*.xls") returned 5 [0048.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.219] lstrlenA (lpString="*.xlsx") returned 6 [0048.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.219] lstrlenA (lpString="*.ppt") returned 5 [0048.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.219] lstrlenA (lpString="*.pptx") returned 6 [0048.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.219] lstrlenA (lpString="*.pdf") returned 5 [0048.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.220] lstrlenA (lpString="*.mov") returned 5 [0048.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.220] lstrlenA (lpString="*.m2v") returned 5 [0048.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.220] lstrlenA (lpString="*.3gp") returned 5 [0048.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.220] lstrlenA (lpString="*.mpeg") returned 6 [0048.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.220] lstrlenA (lpString="*.mpg") returned 5 [0048.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.220] lstrlenA (lpString="*.flv") returned 5 [0048.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.220] lstrlenA (lpString="*.avi") returned 5 [0048.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.220] lstrlenA (lpString="*.mp4") returned 5 [0048.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.220] lstrlenA (lpString="*.wmv") returned 5 [0048.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.220] lstrlenA (lpString="*.divx") returned 6 [0048.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.220] lstrlenA (lpString="*.mkv") returned 5 [0048.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.220] lstrlenA (lpString="*.mp3") returned 5 [0048.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.220] lstrlenA (lpString="*.wav") returned 5 [0048.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.220] lstrlenA (lpString="*.flac") returned 6 [0048.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.220] lstrlenA (lpString="*.ape") returned 5 [0048.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.220] lstrlenA (lpString="*.wma") returned 5 [0048.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.220] lstrlenA (lpString="*.ac3") returned 5 [0048.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.220] lstrlenA (lpString="*.mxf") returned 5 [0048.221] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.221] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0048.221] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="COMPASS", cAlternateFileName="")) returned 1 [0048.221] lstrcmpA (lpString1=".", lpString2="COMPASS") returned -1 [0048.221] lstrcmpA (lpString1="..", lpString2="COMPASS") returned -1 [0048.221] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.221] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="COMPASS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS" [0048.221] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS") returned 63 [0048.221] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0048.222] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.222] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x740000, cFileName="..", cAlternateFileName="")) returned 1 [0048.222] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.222] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.222] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17d4300, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf17d4300, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xd613, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="COMPASS.ELM", cAlternateFileName="")) returned 1 [0048.222] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.222] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="COMPASS.ELM") returned 1 [0048.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="COMPASS.ELM") returned 1 [0048.222] lstrcmpiA (lpString1="", lpString2="COMPASS.ELM") returned -1 [0048.222] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*") returned="*.*" [0048.222] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\" [0048.222] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\") returned="" [0048.222] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO DECRYPT FILES.txt" [0048.222] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\how to decrypt files.txt")) returned 0xffffffff [0048.223] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.223] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.223] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.226] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.226] CloseHandle (hObject=0x90) returned 1 [0048.226] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", lpString2="COMPASS.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" [0048.227] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.zip") returned 0 [0048.227] lstrlenA (lpString="*.zip") returned 5 [0048.227] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.rar") returned 0 [0048.227] lstrlenA (lpString="*.rar") returned 5 [0048.227] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.7z") returned 0 [0048.227] lstrlenA (lpString="*.7z") returned 4 [0048.227] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.tar") returned 0 [0048.227] lstrlenA (lpString="*.tar") returned 5 [0048.227] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.gzip") returned 0 [0048.227] lstrlenA (lpString="*.gzip") returned 6 [0048.227] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.jpg") returned 0 [0048.227] lstrlenA (lpString="*.jpg") returned 5 [0048.227] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.jpeg") returned 0 [0048.227] lstrlenA (lpString="*.jpeg") returned 6 [0048.227] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.psd") returned 0 [0048.227] lstrlenA (lpString="*.psd") returned 5 [0048.227] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.gif") returned 0 [0048.227] lstrlenA (lpString="*.gif") returned 5 [0048.227] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.doc") returned 0 [0048.227] lstrlenA (lpString="*.doc") returned 5 [0048.227] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.docx") returned 0 [0048.227] lstrlenA (lpString="*.docx") returned 6 [0048.227] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.xls") returned 0 [0048.227] lstrlenA (lpString="*.xls") returned 5 [0048.227] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.xlsx") returned 0 [0048.227] lstrlenA (lpString="*.xlsx") returned 6 [0048.227] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.ppt") returned 0 [0048.227] lstrlenA (lpString="*.ppt") returned 5 [0048.227] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.pptx") returned 0 [0048.227] lstrlenA (lpString="*.pptx") returned 6 [0048.227] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.pdf") returned 0 [0048.227] lstrlenA (lpString="*.pdf") returned 5 [0048.227] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.mov") returned 0 [0048.227] lstrlenA (lpString="*.mov") returned 5 [0048.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.m2v") returned 0 [0048.228] lstrlenA (lpString="*.m2v") returned 5 [0048.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.3gp") returned 0 [0048.228] lstrlenA (lpString="*.3gp") returned 5 [0048.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.mpeg") returned 0 [0048.228] lstrlenA (lpString="*.mpeg") returned 6 [0048.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.mpg") returned 0 [0048.228] lstrlenA (lpString="*.mpg") returned 5 [0048.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.flv") returned 0 [0048.228] lstrlenA (lpString="*.flv") returned 5 [0048.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.avi") returned 0 [0048.228] lstrlenA (lpString="*.avi") returned 5 [0048.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.mp4") returned 0 [0048.228] lstrlenA (lpString="*.mp4") returned 5 [0048.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.wmv") returned 0 [0048.228] lstrlenA (lpString="*.wmv") returned 5 [0048.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.divx") returned 0 [0048.228] lstrlenA (lpString="*.divx") returned 6 [0048.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.mkv") returned 0 [0048.228] lstrlenA (lpString="*.mkv") returned 5 [0048.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.mp3") returned 0 [0048.228] lstrlenA (lpString="*.mp3") returned 5 [0048.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.wav") returned 0 [0048.228] lstrlenA (lpString="*.wav") returned 5 [0048.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.flac") returned 0 [0048.228] lstrlenA (lpString="*.flac") returned 6 [0048.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.ape") returned 0 [0048.228] lstrlenA (lpString="*.ape") returned 5 [0048.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.wma") returned 0 [0048.228] lstrlenA (lpString="*.wma") returned 5 [0048.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.ac3") returned 0 [0048.228] lstrlenA (lpString="*.ac3") returned 5 [0048.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", pszSpec="*.mxf") returned 0 [0048.228] lstrlenA (lpString="*.mxf") returned 5 [0048.228] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x2d83e8, cFileName="COMPASS.INF", cAlternateFileName="")) returned 1 [0048.229] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.229] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="COMPASS.INF") returned 1 [0048.229] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="COMPASS.INF") returned 1 [0048.229] lstrcmpiA (lpString1="", lpString2="COMPASS.INF") returned -1 [0048.229] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned="COMPASS.ELM" [0048.229] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\" [0048.229] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\") returned="" [0048.229] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO DECRYPT FILES.txt" [0048.229] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\how to decrypt files.txt")) returned 0x20 [0048.229] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", lpString2="COMPASS.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" [0048.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.zip") returned 0 [0048.229] lstrlenA (lpString="*.zip") returned 5 [0048.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.rar") returned 0 [0048.229] lstrlenA (lpString="*.rar") returned 5 [0048.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.7z") returned 0 [0048.229] lstrlenA (lpString="*.7z") returned 4 [0048.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.tar") returned 0 [0048.229] lstrlenA (lpString="*.tar") returned 5 [0048.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.gzip") returned 0 [0048.229] lstrlenA (lpString="*.gzip") returned 6 [0048.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.jpg") returned 0 [0048.229] lstrlenA (lpString="*.jpg") returned 5 [0048.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.jpeg") returned 0 [0048.229] lstrlenA (lpString="*.jpeg") returned 6 [0048.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.psd") returned 0 [0048.229] lstrlenA (lpString="*.psd") returned 5 [0048.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.gif") returned 0 [0048.229] lstrlenA (lpString="*.gif") returned 5 [0048.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.doc") returned 0 [0048.229] lstrlenA (lpString="*.doc") returned 5 [0048.229] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.docx") returned 0 [0048.230] lstrlenA (lpString="*.docx") returned 6 [0048.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.xls") returned 0 [0048.230] lstrlenA (lpString="*.xls") returned 5 [0048.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.xlsx") returned 0 [0048.230] lstrlenA (lpString="*.xlsx") returned 6 [0048.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.ppt") returned 0 [0048.230] lstrlenA (lpString="*.ppt") returned 5 [0048.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.pptx") returned 0 [0048.230] lstrlenA (lpString="*.pptx") returned 6 [0048.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.pdf") returned 0 [0048.230] lstrlenA (lpString="*.pdf") returned 5 [0048.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.mov") returned 0 [0048.230] lstrlenA (lpString="*.mov") returned 5 [0048.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.m2v") returned 0 [0048.230] lstrlenA (lpString="*.m2v") returned 5 [0048.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.3gp") returned 0 [0048.230] lstrlenA (lpString="*.3gp") returned 5 [0048.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.mpeg") returned 0 [0048.230] lstrlenA (lpString="*.mpeg") returned 6 [0048.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.mpg") returned 0 [0048.230] lstrlenA (lpString="*.mpg") returned 5 [0048.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.flv") returned 0 [0048.230] lstrlenA (lpString="*.flv") returned 5 [0048.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.avi") returned 0 [0048.230] lstrlenA (lpString="*.avi") returned 5 [0048.230] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.mp4") returned 0 [0048.231] lstrlenA (lpString="*.mp4") returned 5 [0048.231] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.wmv") returned 0 [0048.231] lstrlenA (lpString="*.wmv") returned 5 [0048.231] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.divx") returned 0 [0048.231] lstrlenA (lpString="*.divx") returned 6 [0048.231] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.mkv") returned 0 [0048.231] lstrlenA (lpString="*.mkv") returned 5 [0048.231] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.mp3") returned 0 [0048.231] lstrlenA (lpString="*.mp3") returned 5 [0048.231] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.wav") returned 0 [0048.231] lstrlenA (lpString="*.wav") returned 5 [0048.231] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.flac") returned 0 [0048.231] lstrlenA (lpString="*.flac") returned 6 [0048.231] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.ape") returned 0 [0048.231] lstrlenA (lpString="*.ape") returned 5 [0048.231] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.wma") returned 0 [0048.231] lstrlenA (lpString="*.wma") returned 5 [0048.231] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.ac3") returned 0 [0048.231] lstrlenA (lpString="*.ac3") returned 5 [0048.231] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", pszSpec="*.mxf") returned 0 [0048.231] lstrlenA (lpString="*.mxf") returned 5 [0048.231] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x50d, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.231] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.231] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.231] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.231] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.231] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned="COMPASS.INF" [0048.231] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\" [0048.231] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\") returned="" [0048.231] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO DECRYPT FILES.txt" [0048.231] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\how to decrypt files.txt")) returned 0x20 [0048.232] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" [0048.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.232] lstrlenA (lpString="*.zip") returned 5 [0048.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.232] lstrlenA (lpString="*.rar") returned 5 [0048.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.232] lstrlenA (lpString="*.7z") returned 4 [0048.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.232] lstrlenA (lpString="*.tar") returned 5 [0048.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.232] lstrlenA (lpString="*.gzip") returned 6 [0048.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.232] lstrlenA (lpString="*.jpg") returned 5 [0048.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.232] lstrlenA (lpString="*.jpeg") returned 6 [0048.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.232] lstrlenA (lpString="*.psd") returned 5 [0048.232] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.232] lstrlenA (lpString="*.gif") returned 5 [0048.232] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" [0048.232] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" [0048.232] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF." [0048.232] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.wannacry" [0048.232] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.233] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50d [0048.233] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72)) returned 1 [0048.233] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.233] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x48f, lpOverlapped=0x0) returned 1 [0048.235] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.235] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.235] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x48f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x48f, lpOverlapped=0x0) returned 1 [0048.235] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.235] CloseHandle (hObject=0x90) returned 1 [0048.247] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.wannacry")) returned 1 [0048.249] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.249] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.249] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.250] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.250] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.250] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.250] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\" [0048.250] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\") returned="" [0048.250] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO DECRYPT FILES.txt" [0048.250] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\how to decrypt files.txt")) returned 0x20 [0048.250] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" [0048.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.250] lstrlenA (lpString="*.zip") returned 5 [0048.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.250] lstrlenA (lpString="*.rar") returned 5 [0048.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.250] lstrlenA (lpString="*.7z") returned 4 [0048.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.250] lstrlenA (lpString="*.tar") returned 5 [0048.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.250] lstrlenA (lpString="*.gzip") returned 6 [0048.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.250] lstrlenA (lpString="*.jpg") returned 5 [0048.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.250] lstrlenA (lpString="*.jpeg") returned 6 [0048.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.250] lstrlenA (lpString="*.psd") returned 5 [0048.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.250] lstrlenA (lpString="*.gif") returned 5 [0048.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.250] lstrlenA (lpString="*.doc") returned 5 [0048.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.250] lstrlenA (lpString="*.docx") returned 6 [0048.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.251] lstrlenA (lpString="*.xls") returned 5 [0048.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.251] lstrlenA (lpString="*.xlsx") returned 6 [0048.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.251] lstrlenA (lpString="*.ppt") returned 5 [0048.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.251] lstrlenA (lpString="*.pptx") returned 6 [0048.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.251] lstrlenA (lpString="*.pdf") returned 5 [0048.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.251] lstrlenA (lpString="*.mov") returned 5 [0048.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.251] lstrlenA (lpString="*.m2v") returned 5 [0048.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.251] lstrlenA (lpString="*.3gp") returned 5 [0048.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.251] lstrlenA (lpString="*.mpeg") returned 6 [0048.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.251] lstrlenA (lpString="*.mpg") returned 5 [0048.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.251] lstrlenA (lpString="*.flv") returned 5 [0048.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.251] lstrlenA (lpString="*.avi") returned 5 [0048.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.251] lstrlenA (lpString="*.mp4") returned 5 [0048.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.251] lstrlenA (lpString="*.wmv") returned 5 [0048.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.251] lstrlenA (lpString="*.divx") returned 6 [0048.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.251] lstrlenA (lpString="*.mkv") returned 5 [0048.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.251] lstrlenA (lpString="*.mp3") returned 5 [0048.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.252] lstrlenA (lpString="*.wav") returned 5 [0048.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.252] lstrlenA (lpString="*.flac") returned 6 [0048.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.252] lstrlenA (lpString="*.ape") returned 5 [0048.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.252] lstrlenA (lpString="*.wma") returned 5 [0048.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.252] lstrlenA (lpString="*.ac3") returned 5 [0048.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.252] lstrlenA (lpString="*.mxf") returned 5 [0048.252] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.252] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0048.252] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="CONCRETE", cAlternateFileName="")) returned 1 [0048.252] lstrcmpA (lpString1=".", lpString2="CONCRETE") returned -1 [0048.252] lstrcmpA (lpString1="..", lpString2="CONCRETE") returned -1 [0048.252] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.252] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="CONCRETE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE" [0048.252] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE") returned 64 [0048.252] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName=".", cAlternateFileName="")) returned 0x2d80c8 [0048.252] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.252] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x740000, cFileName="..", cAlternateFileName="")) returned 1 [0048.253] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.253] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.253] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ae7000, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ae7000, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb1d8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CONCRETE.ELM", cAlternateFileName="")) returned 1 [0048.253] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.253] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CONCRETE.ELM") returned 1 [0048.253] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CONCRETE.ELM") returned 1 [0048.253] lstrcmpiA (lpString1="", lpString2="CONCRETE.ELM") returned -1 [0048.253] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*") returned="*.*" [0048.253] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\" [0048.253] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\") returned="" [0048.253] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO DECRYPT FILES.txt" [0048.253] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\how to decrypt files.txt")) returned 0xffffffff [0048.253] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.255] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.255] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.256] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.256] CloseHandle (hObject=0x90) returned 1 [0048.257] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", lpString2="CONCRETE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" [0048.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.zip") returned 0 [0048.257] lstrlenA (lpString="*.zip") returned 5 [0048.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.rar") returned 0 [0048.257] lstrlenA (lpString="*.rar") returned 5 [0048.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.7z") returned 0 [0048.257] lstrlenA (lpString="*.7z") returned 4 [0048.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.tar") returned 0 [0048.257] lstrlenA (lpString="*.tar") returned 5 [0048.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.gzip") returned 0 [0048.257] lstrlenA (lpString="*.gzip") returned 6 [0048.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.jpg") returned 0 [0048.257] lstrlenA (lpString="*.jpg") returned 5 [0048.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.jpeg") returned 0 [0048.257] lstrlenA (lpString="*.jpeg") returned 6 [0048.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.psd") returned 0 [0048.257] lstrlenA (lpString="*.psd") returned 5 [0048.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.gif") returned 0 [0048.257] lstrlenA (lpString="*.gif") returned 5 [0048.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.doc") returned 0 [0048.257] lstrlenA (lpString="*.doc") returned 5 [0048.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.docx") returned 0 [0048.257] lstrlenA (lpString="*.docx") returned 6 [0048.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.xls") returned 0 [0048.257] lstrlenA (lpString="*.xls") returned 5 [0048.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.xlsx") returned 0 [0048.257] lstrlenA (lpString="*.xlsx") returned 6 [0048.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.ppt") returned 0 [0048.257] lstrlenA (lpString="*.ppt") returned 5 [0048.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.pptx") returned 0 [0048.258] lstrlenA (lpString="*.pptx") returned 6 [0048.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.pdf") returned 0 [0048.258] lstrlenA (lpString="*.pdf") returned 5 [0048.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.mov") returned 0 [0048.258] lstrlenA (lpString="*.mov") returned 5 [0048.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.m2v") returned 0 [0048.258] lstrlenA (lpString="*.m2v") returned 5 [0048.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.3gp") returned 0 [0048.258] lstrlenA (lpString="*.3gp") returned 5 [0048.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.mpeg") returned 0 [0048.258] lstrlenA (lpString="*.mpeg") returned 6 [0048.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.mpg") returned 0 [0048.258] lstrlenA (lpString="*.mpg") returned 5 [0048.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.flv") returned 0 [0048.258] lstrlenA (lpString="*.flv") returned 5 [0048.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.avi") returned 0 [0048.258] lstrlenA (lpString="*.avi") returned 5 [0048.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.mp4") returned 0 [0048.258] lstrlenA (lpString="*.mp4") returned 5 [0048.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.wmv") returned 0 [0048.258] lstrlenA (lpString="*.wmv") returned 5 [0048.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.divx") returned 0 [0048.258] lstrlenA (lpString="*.divx") returned 6 [0048.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.mkv") returned 0 [0048.258] lstrlenA (lpString="*.mkv") returned 5 [0048.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.mp3") returned 0 [0048.258] lstrlenA (lpString="*.mp3") returned 5 [0048.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.wav") returned 0 [0048.258] lstrlenA (lpString="*.wav") returned 5 [0048.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.flac") returned 0 [0048.258] lstrlenA (lpString="*.flac") returned 6 [0048.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.ape") returned 0 [0048.259] lstrlenA (lpString="*.ape") returned 5 [0048.259] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.wma") returned 0 [0048.259] lstrlenA (lpString="*.wma") returned 5 [0048.259] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.ac3") returned 0 [0048.259] lstrlenA (lpString="*.ac3") returned 5 [0048.259] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", pszSpec="*.mxf") returned 0 [0048.259] lstrlenA (lpString="*.mxf") returned 5 [0048.259] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x2d83f0, cFileName="CONCRETE.INF", cAlternateFileName="")) returned 1 [0048.259] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.259] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CONCRETE.INF") returned 1 [0048.259] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CONCRETE.INF") returned 1 [0048.259] lstrcmpiA (lpString1="", lpString2="CONCRETE.INF") returned -1 [0048.259] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned="CONCRETE.ELM" [0048.259] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\" [0048.259] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\") returned="" [0048.259] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO DECRYPT FILES.txt" [0048.259] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\how to decrypt files.txt")) returned 0x20 [0048.259] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", lpString2="CONCRETE.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" [0048.259] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.zip") returned 0 [0048.259] lstrlenA (lpString="*.zip") returned 5 [0048.259] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.rar") returned 0 [0048.259] lstrlenA (lpString="*.rar") returned 5 [0048.259] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.7z") returned 0 [0048.259] lstrlenA (lpString="*.7z") returned 4 [0048.259] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.tar") returned 0 [0048.259] lstrlenA (lpString="*.tar") returned 5 [0048.259] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.gzip") returned 0 [0048.259] lstrlenA (lpString="*.gzip") returned 6 [0048.259] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.jpg") returned 0 [0048.259] lstrlenA (lpString="*.jpg") returned 5 [0048.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.jpeg") returned 0 [0048.260] lstrlenA (lpString="*.jpeg") returned 6 [0048.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.psd") returned 0 [0048.260] lstrlenA (lpString="*.psd") returned 5 [0048.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.gif") returned 0 [0048.260] lstrlenA (lpString="*.gif") returned 5 [0048.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.doc") returned 0 [0048.260] lstrlenA (lpString="*.doc") returned 5 [0048.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.docx") returned 0 [0048.260] lstrlenA (lpString="*.docx") returned 6 [0048.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.xls") returned 0 [0048.260] lstrlenA (lpString="*.xls") returned 5 [0048.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.xlsx") returned 0 [0048.260] lstrlenA (lpString="*.xlsx") returned 6 [0048.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.ppt") returned 0 [0048.260] lstrlenA (lpString="*.ppt") returned 5 [0048.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.pptx") returned 0 [0048.260] lstrlenA (lpString="*.pptx") returned 6 [0048.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.pdf") returned 0 [0048.260] lstrlenA (lpString="*.pdf") returned 5 [0048.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.mov") returned 0 [0048.260] lstrlenA (lpString="*.mov") returned 5 [0048.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.m2v") returned 0 [0048.260] lstrlenA (lpString="*.m2v") returned 5 [0048.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.3gp") returned 0 [0048.260] lstrlenA (lpString="*.3gp") returned 5 [0048.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.mpeg") returned 0 [0048.260] lstrlenA (lpString="*.mpeg") returned 6 [0048.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.mpg") returned 0 [0048.260] lstrlenA (lpString="*.mpg") returned 5 [0048.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.flv") returned 0 [0048.260] lstrlenA (lpString="*.flv") returned 5 [0048.260] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.avi") returned 0 [0048.260] lstrlenA (lpString="*.avi") returned 5 [0048.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.mp4") returned 0 [0048.261] lstrlenA (lpString="*.mp4") returned 5 [0048.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.wmv") returned 0 [0048.261] lstrlenA (lpString="*.wmv") returned 5 [0048.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.divx") returned 0 [0048.261] lstrlenA (lpString="*.divx") returned 6 [0048.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.mkv") returned 0 [0048.261] lstrlenA (lpString="*.mkv") returned 5 [0048.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.mp3") returned 0 [0048.261] lstrlenA (lpString="*.mp3") returned 5 [0048.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.wav") returned 0 [0048.261] lstrlenA (lpString="*.wav") returned 5 [0048.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.flac") returned 0 [0048.261] lstrlenA (lpString="*.flac") returned 6 [0048.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.ape") returned 0 [0048.261] lstrlenA (lpString="*.ape") returned 5 [0048.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.wma") returned 0 [0048.261] lstrlenA (lpString="*.wma") returned 5 [0048.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.ac3") returned 0 [0048.261] lstrlenA (lpString="*.ac3") returned 5 [0048.261] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", pszSpec="*.mxf") returned 0 [0048.261] lstrlenA (lpString="*.mxf") returned 5 [0048.261] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x507, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.261] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.261] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.261] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.262] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.262] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned="CONCRETE.INF" [0048.262] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\" [0048.262] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\") returned="" [0048.262] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO DECRYPT FILES.txt" [0048.262] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\how to decrypt files.txt")) returned 0x20 [0048.262] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" [0048.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.262] lstrlenA (lpString="*.zip") returned 5 [0048.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.262] lstrlenA (lpString="*.rar") returned 5 [0048.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.262] lstrlenA (lpString="*.7z") returned 4 [0048.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.262] lstrlenA (lpString="*.tar") returned 5 [0048.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.262] lstrlenA (lpString="*.gzip") returned 6 [0048.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.262] lstrlenA (lpString="*.jpg") returned 5 [0048.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.262] lstrlenA (lpString="*.jpeg") returned 6 [0048.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.262] lstrlenA (lpString="*.psd") returned 5 [0048.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.262] lstrlenA (lpString="*.gif") returned 5 [0048.262] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" [0048.262] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" [0048.262] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF." [0048.262] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.wannacry" [0048.262] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.263] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x507 [0048.263] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x363aa000, dwHighDateTime=0x1c3ee72)) returned 1 [0048.263] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.263] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x489, lpOverlapped=0x0) returned 1 [0048.265] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.265] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.265] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x489, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x489, lpOverlapped=0x0) returned 1 [0048.265] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.265] CloseHandle (hObject=0x90) returned 1 [0048.267] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.wannacry")) returned 1 [0048.268] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.268] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.268] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.268] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.268] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.268] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\" [0048.268] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\") returned="" [0048.268] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO DECRYPT FILES.txt" [0048.268] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\how to decrypt files.txt")) returned 0x20 [0048.268] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" [0048.268] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.268] lstrlenA (lpString="*.zip") returned 5 [0048.269] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.269] lstrlenA (lpString="*.rar") returned 5 [0048.269] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.269] lstrlenA (lpString="*.7z") returned 4 [0048.269] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.269] lstrlenA (lpString="*.tar") returned 5 [0048.269] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.269] lstrlenA (lpString="*.gzip") returned 6 [0048.269] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.269] lstrlenA (lpString="*.jpg") returned 5 [0048.269] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.269] lstrlenA (lpString="*.jpeg") returned 6 [0048.269] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.269] lstrlenA (lpString="*.psd") returned 5 [0048.269] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.269] lstrlenA (lpString="*.gif") returned 5 [0048.269] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.269] lstrlenA (lpString="*.doc") returned 5 [0048.269] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.269] lstrlenA (lpString="*.docx") returned 6 [0048.269] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.269] lstrlenA (lpString="*.xls") returned 5 [0048.269] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.269] lstrlenA (lpString="*.xlsx") returned 6 [0048.269] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.269] lstrlenA (lpString="*.ppt") returned 5 [0048.269] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.270] lstrlenA (lpString="*.pptx") returned 6 [0048.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.270] lstrlenA (lpString="*.pdf") returned 5 [0048.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.270] lstrlenA (lpString="*.mov") returned 5 [0048.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.270] lstrlenA (lpString="*.m2v") returned 5 [0048.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.270] lstrlenA (lpString="*.3gp") returned 5 [0048.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.270] lstrlenA (lpString="*.mpeg") returned 6 [0048.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.270] lstrlenA (lpString="*.mpg") returned 5 [0048.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.270] lstrlenA (lpString="*.flv") returned 5 [0048.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.270] lstrlenA (lpString="*.avi") returned 5 [0048.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.270] lstrlenA (lpString="*.mp4") returned 5 [0048.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.270] lstrlenA (lpString="*.wmv") returned 5 [0048.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.270] lstrlenA (lpString="*.divx") returned 6 [0048.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.270] lstrlenA (lpString="*.mkv") returned 5 [0048.270] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.270] lstrlenA (lpString="*.mp3") returned 5 [0048.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.271] lstrlenA (lpString="*.wav") returned 5 [0048.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.271] lstrlenA (lpString="*.flac") returned 6 [0048.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.271] lstrlenA (lpString="*.ape") returned 5 [0048.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.271] lstrlenA (lpString="*.wma") returned 5 [0048.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.271] lstrlenA (lpString="*.ac3") returned 5 [0048.271] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.271] lstrlenA (lpString="*.mxf") returned 5 [0048.271] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.271] FindClose (in: hFindFile=0x2d80c8 | out: hFindFile=0x2d80c8) returned 1 [0048.271] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1 [0048.271] lstrcmpA (lpString1=".", lpString2="DEEPBLUE") returned -1 [0048.271] lstrcmpA (lpString1="..", lpString2="DEEPBLUE") returned -1 [0048.271] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.271] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="DEEPBLUE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE" [0048.271] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE") returned 64 [0048.271] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x2d80c8 [0048.272] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.272] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x780000, cFileName="..", cAlternateFileName="")) returned 1 [0048.272] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.272] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.272] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf641f700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf641f700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x116dc, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DEEPBLUE.ELM", cAlternateFileName="")) returned 1 [0048.272] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.272] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DEEPBLUE.ELM") returned 1 [0048.272] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DEEPBLUE.ELM") returned 1 [0048.272] lstrcmpiA (lpString1="", lpString2="DEEPBLUE.ELM") returned -1 [0048.272] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*") returned="*.*" [0048.272] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\" [0048.272] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\") returned="" [0048.272] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO DECRYPT FILES.txt" [0048.272] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\how to decrypt files.txt")) returned 0xffffffff [0048.272] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.278] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.278] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.279] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.279] CloseHandle (hObject=0x90) returned 1 [0048.279] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", lpString2="DEEPBLUE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" [0048.279] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.zip") returned 0 [0048.279] lstrlenA (lpString="*.zip") returned 5 [0048.279] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.rar") returned 0 [0048.279] lstrlenA (lpString="*.rar") returned 5 [0048.279] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.7z") returned 0 [0048.279] lstrlenA (lpString="*.7z") returned 4 [0048.279] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.tar") returned 0 [0048.280] lstrlenA (lpString="*.tar") returned 5 [0048.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.gzip") returned 0 [0048.280] lstrlenA (lpString="*.gzip") returned 6 [0048.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.jpg") returned 0 [0048.280] lstrlenA (lpString="*.jpg") returned 5 [0048.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.jpeg") returned 0 [0048.280] lstrlenA (lpString="*.jpeg") returned 6 [0048.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.psd") returned 0 [0048.280] lstrlenA (lpString="*.psd") returned 5 [0048.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.gif") returned 0 [0048.280] lstrlenA (lpString="*.gif") returned 5 [0048.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.doc") returned 0 [0048.280] lstrlenA (lpString="*.doc") returned 5 [0048.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.docx") returned 0 [0048.280] lstrlenA (lpString="*.docx") returned 6 [0048.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.xls") returned 0 [0048.280] lstrlenA (lpString="*.xls") returned 5 [0048.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.xlsx") returned 0 [0048.280] lstrlenA (lpString="*.xlsx") returned 6 [0048.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.ppt") returned 0 [0048.280] lstrlenA (lpString="*.ppt") returned 5 [0048.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.pptx") returned 0 [0048.280] lstrlenA (lpString="*.pptx") returned 6 [0048.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.pdf") returned 0 [0048.280] lstrlenA (lpString="*.pdf") returned 5 [0048.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.mov") returned 0 [0048.280] lstrlenA (lpString="*.mov") returned 5 [0048.280] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.m2v") returned 0 [0048.281] lstrlenA (lpString="*.m2v") returned 5 [0048.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.3gp") returned 0 [0048.281] lstrlenA (lpString="*.3gp") returned 5 [0048.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.mpeg") returned 0 [0048.281] lstrlenA (lpString="*.mpeg") returned 6 [0048.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.mpg") returned 0 [0048.281] lstrlenA (lpString="*.mpg") returned 5 [0048.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.flv") returned 0 [0048.281] lstrlenA (lpString="*.flv") returned 5 [0048.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.avi") returned 0 [0048.281] lstrlenA (lpString="*.avi") returned 5 [0048.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.mp4") returned 0 [0048.281] lstrlenA (lpString="*.mp4") returned 5 [0048.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.wmv") returned 0 [0048.281] lstrlenA (lpString="*.wmv") returned 5 [0048.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.divx") returned 0 [0048.281] lstrlenA (lpString="*.divx") returned 6 [0048.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.mkv") returned 0 [0048.281] lstrlenA (lpString="*.mkv") returned 5 [0048.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.mp3") returned 0 [0048.281] lstrlenA (lpString="*.mp3") returned 5 [0048.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.wav") returned 0 [0048.281] lstrlenA (lpString="*.wav") returned 5 [0048.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.flac") returned 0 [0048.281] lstrlenA (lpString="*.flac") returned 6 [0048.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.ape") returned 0 [0048.281] lstrlenA (lpString="*.ape") returned 5 [0048.281] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.wma") returned 0 [0048.282] lstrlenA (lpString="*.wma") returned 5 [0048.282] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.ac3") returned 0 [0048.282] lstrlenA (lpString="*.ac3") returned 5 [0048.282] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", pszSpec="*.mxf") returned 0 [0048.282] lstrlenA (lpString="*.mxf") returned 5 [0048.282] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x2d83f0, cFileName="DEEPBLUE.INF", cAlternateFileName="")) returned 1 [0048.282] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.282] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DEEPBLUE.INF") returned 1 [0048.282] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DEEPBLUE.INF") returned 1 [0048.282] lstrcmpiA (lpString1="", lpString2="DEEPBLUE.INF") returned -1 [0048.282] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned="DEEPBLUE.ELM" [0048.282] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\" [0048.282] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\") returned="" [0048.282] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO DECRYPT FILES.txt" [0048.282] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\how to decrypt files.txt")) returned 0x20 [0048.282] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", lpString2="DEEPBLUE.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" [0048.282] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.zip") returned 0 [0048.282] lstrlenA (lpString="*.zip") returned 5 [0048.282] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.rar") returned 0 [0048.282] lstrlenA (lpString="*.rar") returned 5 [0048.282] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.7z") returned 0 [0048.282] lstrlenA (lpString="*.7z") returned 4 [0048.283] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.tar") returned 0 [0048.283] lstrlenA (lpString="*.tar") returned 5 [0048.283] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.gzip") returned 0 [0048.283] lstrlenA (lpString="*.gzip") returned 6 [0048.283] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.jpg") returned 0 [0048.283] lstrlenA (lpString="*.jpg") returned 5 [0048.283] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.jpeg") returned 0 [0048.283] lstrlenA (lpString="*.jpeg") returned 6 [0048.283] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.psd") returned 0 [0048.283] lstrlenA (lpString="*.psd") returned 5 [0048.283] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.gif") returned 0 [0048.283] lstrlenA (lpString="*.gif") returned 5 [0048.283] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.doc") returned 0 [0048.283] lstrlenA (lpString="*.doc") returned 5 [0048.283] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.docx") returned 0 [0048.283] lstrlenA (lpString="*.docx") returned 6 [0048.283] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.xls") returned 0 [0048.283] lstrlenA (lpString="*.xls") returned 5 [0048.283] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.xlsx") returned 0 [0048.283] lstrlenA (lpString="*.xlsx") returned 6 [0048.283] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.ppt") returned 0 [0048.283] lstrlenA (lpString="*.ppt") returned 5 [0048.283] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.pptx") returned 0 [0048.283] lstrlenA (lpString="*.pptx") returned 6 [0048.283] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.pdf") returned 0 [0048.283] lstrlenA (lpString="*.pdf") returned 5 [0048.283] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.mov") returned 0 [0048.283] lstrlenA (lpString="*.mov") returned 5 [0048.283] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.m2v") returned 0 [0048.283] lstrlenA (lpString="*.m2v") returned 5 [0048.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.3gp") returned 0 [0048.284] lstrlenA (lpString="*.3gp") returned 5 [0048.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.mpeg") returned 0 [0048.284] lstrlenA (lpString="*.mpeg") returned 6 [0048.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.mpg") returned 0 [0048.284] lstrlenA (lpString="*.mpg") returned 5 [0048.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.flv") returned 0 [0048.284] lstrlenA (lpString="*.flv") returned 5 [0048.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.avi") returned 0 [0048.284] lstrlenA (lpString="*.avi") returned 5 [0048.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.mp4") returned 0 [0048.284] lstrlenA (lpString="*.mp4") returned 5 [0048.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.wmv") returned 0 [0048.284] lstrlenA (lpString="*.wmv") returned 5 [0048.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.divx") returned 0 [0048.284] lstrlenA (lpString="*.divx") returned 6 [0048.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.mkv") returned 0 [0048.284] lstrlenA (lpString="*.mkv") returned 5 [0048.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.mp3") returned 0 [0048.284] lstrlenA (lpString="*.mp3") returned 5 [0048.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.wav") returned 0 [0048.284] lstrlenA (lpString="*.wav") returned 5 [0048.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.flac") returned 0 [0048.284] lstrlenA (lpString="*.flac") returned 6 [0048.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.ape") returned 0 [0048.284] lstrlenA (lpString="*.ape") returned 5 [0048.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.wma") returned 0 [0048.284] lstrlenA (lpString="*.wma") returned 5 [0048.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.ac3") returned 0 [0048.285] lstrlenA (lpString="*.ac3") returned 5 [0048.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", pszSpec="*.mxf") returned 0 [0048.285] lstrlenA (lpString="*.mxf") returned 5 [0048.285] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf75, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.285] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.285] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.285] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.285] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.285] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned="DEEPBLUE.INF" [0048.285] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\" [0048.285] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\") returned="" [0048.285] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO DECRYPT FILES.txt" [0048.285] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\how to decrypt files.txt")) returned 0x20 [0048.285] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" [0048.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.285] lstrlenA (lpString="*.zip") returned 5 [0048.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.285] lstrlenA (lpString="*.rar") returned 5 [0048.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.285] lstrlenA (lpString="*.7z") returned 4 [0048.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.285] lstrlenA (lpString="*.tar") returned 5 [0048.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.285] lstrlenA (lpString="*.gzip") returned 6 [0048.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.286] lstrlenA (lpString="*.jpg") returned 5 [0048.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.286] lstrlenA (lpString="*.jpeg") returned 6 [0048.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.286] lstrlenA (lpString="*.psd") returned 5 [0048.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.286] lstrlenA (lpString="*.gif") returned 5 [0048.286] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" [0048.286] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" [0048.286] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF." [0048.286] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.wannacry" [0048.286] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.286] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf75 [0048.286] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6f8e30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1 [0048.287] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.287] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xef7, lpOverlapped=0x0) returned 1 [0048.292] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.292] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.292] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xef7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xef7, lpOverlapped=0x0) returned 1 [0048.292] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.292] CloseHandle (hObject=0x90) returned 1 [0048.295] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.wannacry")) returned 1 [0048.296] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.296] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.296] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.296] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.296] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.296] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.296] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\" [0048.296] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\") returned="" [0048.296] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO DECRYPT FILES.txt" [0048.296] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\how to decrypt files.txt")) returned 0x20 [0048.296] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" [0048.296] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.296] lstrlenA (lpString="*.zip") returned 5 [0048.296] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.296] lstrlenA (lpString="*.rar") returned 5 [0048.296] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.296] lstrlenA (lpString="*.7z") returned 4 [0048.296] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.296] lstrlenA (lpString="*.tar") returned 5 [0048.297] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.297] lstrlenA (lpString="*.gzip") returned 6 [0048.297] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.297] lstrlenA (lpString="*.jpg") returned 5 [0048.297] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.297] lstrlenA (lpString="*.jpeg") returned 6 [0048.297] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.297] lstrlenA (lpString="*.psd") returned 5 [0048.297] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.297] lstrlenA (lpString="*.gif") returned 5 [0048.297] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.297] lstrlenA (lpString="*.doc") returned 5 [0048.297] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.297] lstrlenA (lpString="*.docx") returned 6 [0048.297] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.297] lstrlenA (lpString="*.xls") returned 5 [0048.297] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.297] lstrlenA (lpString="*.xlsx") returned 6 [0048.297] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.297] lstrlenA (lpString="*.ppt") returned 5 [0048.297] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.297] lstrlenA (lpString="*.pptx") returned 6 [0048.297] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.297] lstrlenA (lpString="*.pdf") returned 5 [0048.297] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.297] lstrlenA (lpString="*.mov") returned 5 [0048.297] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.297] lstrlenA (lpString="*.m2v") returned 5 [0048.297] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.298] lstrlenA (lpString="*.3gp") returned 5 [0048.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.298] lstrlenA (lpString="*.mpeg") returned 6 [0048.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.298] lstrlenA (lpString="*.mpg") returned 5 [0048.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.298] lstrlenA (lpString="*.flv") returned 5 [0048.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.298] lstrlenA (lpString="*.avi") returned 5 [0048.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.298] lstrlenA (lpString="*.mp4") returned 5 [0048.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.298] lstrlenA (lpString="*.wmv") returned 5 [0048.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.298] lstrlenA (lpString="*.divx") returned 6 [0048.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.298] lstrlenA (lpString="*.mkv") returned 5 [0048.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.298] lstrlenA (lpString="*.mp3") returned 5 [0048.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.298] lstrlenA (lpString="*.wav") returned 5 [0048.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.298] lstrlenA (lpString="*.flac") returned 6 [0048.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.298] lstrlenA (lpString="*.ape") returned 5 [0048.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.298] lstrlenA (lpString="*.wma") returned 5 [0048.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.299] lstrlenA (lpString="*.ac3") returned 5 [0048.299] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.299] lstrlenA (lpString="*.mxf") returned 5 [0048.299] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.299] FindClose (in: hFindFile=0x2d80c8 | out: hFindFile=0x2d80c8) returned 1 [0048.299] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ECHO", cAlternateFileName="")) returned 1 [0048.299] lstrcmpA (lpString1=".", lpString2="ECHO") returned -1 [0048.299] lstrcmpA (lpString1="..", lpString2="ECHO") returned -1 [0048.299] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.299] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="ECHO" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO" [0048.299] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO") returned 60 [0048.299] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0048.300] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.300] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x780000, cFileName="..", cAlternateFileName="")) returned 1 [0048.301] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.301] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.301] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a45100, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8a45100, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb0ce, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ECHO.ELM", cAlternateFileName="")) returned 1 [0048.301] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.301] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ECHO.ELM") returned -1 [0048.301] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ECHO.ELM") returned 1 [0048.301] lstrcmpiA (lpString1="", lpString2="ECHO.ELM") returned -1 [0048.301] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*") returned="*.*" [0048.301] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\" [0048.301] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\") returned="" [0048.301] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO DECRYPT FILES.txt" [0048.301] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\how to decrypt files.txt")) returned 0xffffffff [0048.301] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.302] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.302] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.303] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.303] CloseHandle (hObject=0x90) returned 1 [0048.303] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", lpString2="ECHO.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" [0048.303] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.zip") returned 0 [0048.303] lstrlenA (lpString="*.zip") returned 5 [0048.303] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.rar") returned 0 [0048.303] lstrlenA (lpString="*.rar") returned 5 [0048.303] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.7z") returned 0 [0048.304] lstrlenA (lpString="*.7z") returned 4 [0048.304] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.tar") returned 0 [0048.304] lstrlenA (lpString="*.tar") returned 5 [0048.304] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.gzip") returned 0 [0048.304] lstrlenA (lpString="*.gzip") returned 6 [0048.304] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.jpg") returned 0 [0048.304] lstrlenA (lpString="*.jpg") returned 5 [0048.304] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.jpeg") returned 0 [0048.304] lstrlenA (lpString="*.jpeg") returned 6 [0048.304] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.psd") returned 0 [0048.304] lstrlenA (lpString="*.psd") returned 5 [0048.304] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.gif") returned 0 [0048.304] lstrlenA (lpString="*.gif") returned 5 [0048.304] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.doc") returned 0 [0048.304] lstrlenA (lpString="*.doc") returned 5 [0048.304] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.docx") returned 0 [0048.304] lstrlenA (lpString="*.docx") returned 6 [0048.304] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.xls") returned 0 [0048.304] lstrlenA (lpString="*.xls") returned 5 [0048.305] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.xlsx") returned 0 [0048.305] lstrlenA (lpString="*.xlsx") returned 6 [0048.305] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.ppt") returned 0 [0048.305] lstrlenA (lpString="*.ppt") returned 5 [0048.305] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.pptx") returned 0 [0048.305] lstrlenA (lpString="*.pptx") returned 6 [0048.305] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.pdf") returned 0 [0048.305] lstrlenA (lpString="*.pdf") returned 5 [0048.305] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.mov") returned 0 [0048.305] lstrlenA (lpString="*.mov") returned 5 [0048.305] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.m2v") returned 0 [0048.305] lstrlenA (lpString="*.m2v") returned 5 [0048.305] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.3gp") returned 0 [0048.305] lstrlenA (lpString="*.3gp") returned 5 [0048.305] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.mpeg") returned 0 [0048.305] lstrlenA (lpString="*.mpeg") returned 6 [0048.305] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.mpg") returned 0 [0048.305] lstrlenA (lpString="*.mpg") returned 5 [0048.305] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.flv") returned 0 [0048.305] lstrlenA (lpString="*.flv") returned 5 [0048.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.avi") returned 0 [0048.306] lstrlenA (lpString="*.avi") returned 5 [0048.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.mp4") returned 0 [0048.306] lstrlenA (lpString="*.mp4") returned 5 [0048.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.wmv") returned 0 [0048.306] lstrlenA (lpString="*.wmv") returned 5 [0048.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.divx") returned 0 [0048.306] lstrlenA (lpString="*.divx") returned 6 [0048.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.mkv") returned 0 [0048.306] lstrlenA (lpString="*.mkv") returned 5 [0048.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.mp3") returned 0 [0048.306] lstrlenA (lpString="*.mp3") returned 5 [0048.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.wav") returned 0 [0048.306] lstrlenA (lpString="*.wav") returned 5 [0048.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.flac") returned 0 [0048.306] lstrlenA (lpString="*.flac") returned 6 [0048.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.ape") returned 0 [0048.306] lstrlenA (lpString="*.ape") returned 5 [0048.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.wma") returned 0 [0048.307] lstrlenA (lpString="*.wma") returned 5 [0048.307] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.ac3") returned 0 [0048.307] lstrlenA (lpString="*.ac3") returned 5 [0048.307] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", pszSpec="*.mxf") returned 0 [0048.307] lstrlenA (lpString="*.mxf") returned 5 [0048.307] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x0, dwReserved1=0x2d83e0, cFileName="ECHO.INF", cAlternateFileName="")) returned 1 [0048.307] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.307] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ECHO.INF") returned -1 [0048.307] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ECHO.INF") returned 1 [0048.307] lstrcmpiA (lpString1="", lpString2="ECHO.INF") returned -1 [0048.307] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned="ECHO.ELM" [0048.307] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\" [0048.307] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\") returned="" [0048.307] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO DECRYPT FILES.txt" [0048.307] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\how to decrypt files.txt")) returned 0x20 [0048.308] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", lpString2="ECHO.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" [0048.308] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.zip") returned 0 [0048.308] lstrlenA (lpString="*.zip") returned 5 [0048.308] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.rar") returned 0 [0048.308] lstrlenA (lpString="*.rar") returned 5 [0048.308] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.7z") returned 0 [0048.308] lstrlenA (lpString="*.7z") returned 4 [0048.308] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.tar") returned 0 [0048.308] lstrlenA (lpString="*.tar") returned 5 [0048.308] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.gzip") returned 0 [0048.308] lstrlenA (lpString="*.gzip") returned 6 [0048.308] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.jpg") returned 0 [0048.308] lstrlenA (lpString="*.jpg") returned 5 [0048.308] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.jpeg") returned 0 [0048.308] lstrlenA (lpString="*.jpeg") returned 6 [0048.308] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.psd") returned 0 [0048.308] lstrlenA (lpString="*.psd") returned 5 [0048.308] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.gif") returned 0 [0048.309] lstrlenA (lpString="*.gif") returned 5 [0048.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.doc") returned 0 [0048.309] lstrlenA (lpString="*.doc") returned 5 [0048.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.docx") returned 0 [0048.309] lstrlenA (lpString="*.docx") returned 6 [0048.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.xls") returned 0 [0048.309] lstrlenA (lpString="*.xls") returned 5 [0048.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.xlsx") returned 0 [0048.309] lstrlenA (lpString="*.xlsx") returned 6 [0048.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.ppt") returned 0 [0048.309] lstrlenA (lpString="*.ppt") returned 5 [0048.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.pptx") returned 0 [0048.309] lstrlenA (lpString="*.pptx") returned 6 [0048.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.pdf") returned 0 [0048.309] lstrlenA (lpString="*.pdf") returned 5 [0048.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.mov") returned 0 [0048.309] lstrlenA (lpString="*.mov") returned 5 [0048.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.m2v") returned 0 [0048.309] lstrlenA (lpString="*.m2v") returned 5 [0048.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.3gp") returned 0 [0048.310] lstrlenA (lpString="*.3gp") returned 5 [0048.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.mpeg") returned 0 [0048.310] lstrlenA (lpString="*.mpeg") returned 6 [0048.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.mpg") returned 0 [0048.310] lstrlenA (lpString="*.mpg") returned 5 [0048.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.flv") returned 0 [0048.310] lstrlenA (lpString="*.flv") returned 5 [0048.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.avi") returned 0 [0048.310] lstrlenA (lpString="*.avi") returned 5 [0048.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.mp4") returned 0 [0048.310] lstrlenA (lpString="*.mp4") returned 5 [0048.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.wmv") returned 0 [0048.310] lstrlenA (lpString="*.wmv") returned 5 [0048.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.divx") returned 0 [0048.310] lstrlenA (lpString="*.divx") returned 6 [0048.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.mkv") returned 0 [0048.310] lstrlenA (lpString="*.mkv") returned 5 [0048.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.mp3") returned 0 [0048.311] lstrlenA (lpString="*.mp3") returned 5 [0048.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.wav") returned 0 [0048.311] lstrlenA (lpString="*.wav") returned 5 [0048.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.flac") returned 0 [0048.311] lstrlenA (lpString="*.flac") returned 6 [0048.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.ape") returned 0 [0048.311] lstrlenA (lpString="*.ape") returned 5 [0048.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.wma") returned 0 [0048.311] lstrlenA (lpString="*.wma") returned 5 [0048.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.ac3") returned 0 [0048.311] lstrlenA (lpString="*.ac3") returned 5 [0048.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", pszSpec="*.mxf") returned 0 [0048.311] lstrlenA (lpString="*.mxf") returned 5 [0048.311] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x74, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.311] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.311] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.311] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.311] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.312] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned="ECHO.INF" [0048.312] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\" [0048.312] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\") returned="" [0048.312] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO DECRYPT FILES.txt" [0048.312] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\how to decrypt files.txt")) returned 0x20 [0048.312] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" [0048.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.312] lstrlenA (lpString="*.zip") returned 5 [0048.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.312] lstrlenA (lpString="*.rar") returned 5 [0048.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.312] lstrlenA (lpString="*.7z") returned 4 [0048.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.312] lstrlenA (lpString="*.tar") returned 5 [0048.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.312] lstrlenA (lpString="*.gzip") returned 6 [0048.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.313] lstrlenA (lpString="*.jpg") returned 5 [0048.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.313] lstrlenA (lpString="*.jpeg") returned 6 [0048.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.313] lstrlenA (lpString="*.psd") returned 5 [0048.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.313] lstrlenA (lpString="*.gif") returned 5 [0048.313] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" [0048.313] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" [0048.313] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF." [0048.313] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.wannacry" [0048.313] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.314] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5ad [0048.314] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6f8e30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1 [0048.314] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.314] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x52f, lpOverlapped=0x0) returned 1 [0048.316] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.316] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.316] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x52f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x52f, lpOverlapped=0x0) returned 1 [0048.316] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.317] CloseHandle (hObject=0x90) returned 1 [0048.319] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.wannacry")) returned 1 [0048.321] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.321] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.321] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.321] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.321] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.321] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.321] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\" [0048.322] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\") returned="" [0048.322] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO DECRYPT FILES.txt" [0048.322] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\how to decrypt files.txt")) returned 0x20 [0048.322] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" [0048.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.322] lstrlenA (lpString="*.zip") returned 5 [0048.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.322] lstrlenA (lpString="*.rar") returned 5 [0048.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.322] lstrlenA (lpString="*.7z") returned 4 [0048.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.322] lstrlenA (lpString="*.tar") returned 5 [0048.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.322] lstrlenA (lpString="*.gzip") returned 6 [0048.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.322] lstrlenA (lpString="*.jpg") returned 5 [0048.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.322] lstrlenA (lpString="*.jpeg") returned 6 [0048.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.322] lstrlenA (lpString="*.psd") returned 5 [0048.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.322] lstrlenA (lpString="*.gif") returned 5 [0048.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.323] lstrlenA (lpString="*.doc") returned 5 [0048.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.323] lstrlenA (lpString="*.docx") returned 6 [0048.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.323] lstrlenA (lpString="*.xls") returned 5 [0048.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.323] lstrlenA (lpString="*.xlsx") returned 6 [0048.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.323] lstrlenA (lpString="*.ppt") returned 5 [0048.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.323] lstrlenA (lpString="*.pptx") returned 6 [0048.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.323] lstrlenA (lpString="*.pdf") returned 5 [0048.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.323] lstrlenA (lpString="*.mov") returned 5 [0048.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.323] lstrlenA (lpString="*.m2v") returned 5 [0048.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.324] lstrlenA (lpString="*.3gp") returned 5 [0048.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.324] lstrlenA (lpString="*.mpeg") returned 6 [0048.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.324] lstrlenA (lpString="*.mpg") returned 5 [0048.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.324] lstrlenA (lpString="*.flv") returned 5 [0048.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.324] lstrlenA (lpString="*.avi") returned 5 [0048.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.324] lstrlenA (lpString="*.mp4") returned 5 [0048.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.324] lstrlenA (lpString="*.wmv") returned 5 [0048.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.324] lstrlenA (lpString="*.divx") returned 6 [0048.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.325] lstrlenA (lpString="*.mkv") returned 5 [0048.325] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.325] lstrlenA (lpString="*.mp3") returned 5 [0048.325] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.325] lstrlenA (lpString="*.wav") returned 5 [0048.325] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.325] lstrlenA (lpString="*.flac") returned 6 [0048.325] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.325] lstrlenA (lpString="*.ape") returned 5 [0048.325] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.325] lstrlenA (lpString="*.wma") returned 5 [0048.325] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.325] lstrlenA (lpString="*.ac3") returned 5 [0048.325] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.325] lstrlenA (lpString="*.mxf") returned 5 [0048.325] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.325] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0048.325] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ECLIPSE", cAlternateFileName="")) returned 1 [0048.325] lstrcmpA (lpString1=".", lpString2="ECLIPSE") returned -1 [0048.325] lstrcmpA (lpString1="..", lpString2="ECLIPSE") returned -1 [0048.325] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.325] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="ECLIPSE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE" [0048.326] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE") returned 63 [0048.326] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0048.327] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.327] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.327] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.327] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.327] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d57e00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51eb22b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d57e00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1cf31, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ECLIPSE.ELM", cAlternateFileName="")) returned 1 [0048.327] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.327] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ECLIPSE.ELM") returned -1 [0048.327] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ECLIPSE.ELM") returned 1 [0048.327] lstrcmpiA (lpString1="", lpString2="ECLIPSE.ELM") returned -1 [0048.327] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*") returned="*.*" [0048.327] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\" [0048.327] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\") returned="" [0048.327] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO DECRYPT FILES.txt" [0048.327] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\how to decrypt files.txt")) returned 0xffffffff [0048.328] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.328] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.328] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.330] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.330] CloseHandle (hObject=0x90) returned 1 [0048.330] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", lpString2="ECLIPSE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" [0048.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.zip") returned 0 [0048.330] lstrlenA (lpString="*.zip") returned 5 [0048.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.rar") returned 0 [0048.330] lstrlenA (lpString="*.rar") returned 5 [0048.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.7z") returned 0 [0048.330] lstrlenA (lpString="*.7z") returned 4 [0048.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.tar") returned 0 [0048.330] lstrlenA (lpString="*.tar") returned 5 [0048.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.gzip") returned 0 [0048.330] lstrlenA (lpString="*.gzip") returned 6 [0048.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.jpg") returned 0 [0048.330] lstrlenA (lpString="*.jpg") returned 5 [0048.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.jpeg") returned 0 [0048.331] lstrlenA (lpString="*.jpeg") returned 6 [0048.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.psd") returned 0 [0048.331] lstrlenA (lpString="*.psd") returned 5 [0048.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.gif") returned 0 [0048.331] lstrlenA (lpString="*.gif") returned 5 [0048.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.doc") returned 0 [0048.331] lstrlenA (lpString="*.doc") returned 5 [0048.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.docx") returned 0 [0048.331] lstrlenA (lpString="*.docx") returned 6 [0048.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.xls") returned 0 [0048.331] lstrlenA (lpString="*.xls") returned 5 [0048.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.xlsx") returned 0 [0048.331] lstrlenA (lpString="*.xlsx") returned 6 [0048.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.ppt") returned 0 [0048.331] lstrlenA (lpString="*.ppt") returned 5 [0048.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.pptx") returned 0 [0048.331] lstrlenA (lpString="*.pptx") returned 6 [0048.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.pdf") returned 0 [0048.331] lstrlenA (lpString="*.pdf") returned 5 [0048.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.mov") returned 0 [0048.331] lstrlenA (lpString="*.mov") returned 5 [0048.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.m2v") returned 0 [0048.331] lstrlenA (lpString="*.m2v") returned 5 [0048.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.3gp") returned 0 [0048.331] lstrlenA (lpString="*.3gp") returned 5 [0048.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.mpeg") returned 0 [0048.332] lstrlenA (lpString="*.mpeg") returned 6 [0048.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.mpg") returned 0 [0048.332] lstrlenA (lpString="*.mpg") returned 5 [0048.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.flv") returned 0 [0048.332] lstrlenA (lpString="*.flv") returned 5 [0048.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.avi") returned 0 [0048.332] lstrlenA (lpString="*.avi") returned 5 [0048.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.mp4") returned 0 [0048.332] lstrlenA (lpString="*.mp4") returned 5 [0048.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.wmv") returned 0 [0048.332] lstrlenA (lpString="*.wmv") returned 5 [0048.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.divx") returned 0 [0048.332] lstrlenA (lpString="*.divx") returned 6 [0048.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.mkv") returned 0 [0048.332] lstrlenA (lpString="*.mkv") returned 5 [0048.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.mp3") returned 0 [0048.332] lstrlenA (lpString="*.mp3") returned 5 [0048.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.wav") returned 0 [0048.332] lstrlenA (lpString="*.wav") returned 5 [0048.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.flac") returned 0 [0048.332] lstrlenA (lpString="*.flac") returned 6 [0048.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.ape") returned 0 [0048.332] lstrlenA (lpString="*.ape") returned 5 [0048.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.wma") returned 0 [0048.332] lstrlenA (lpString="*.wma") returned 5 [0048.332] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.ac3") returned 0 [0048.333] lstrlenA (lpString="*.ac3") returned 5 [0048.333] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", pszSpec="*.mxf") returned 0 [0048.333] lstrlenA (lpString="*.mxf") returned 5 [0048.333] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x2d83e8, cFileName="ECLIPSE.INF", cAlternateFileName="")) returned 1 [0048.333] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.333] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ECLIPSE.INF") returned -1 [0048.333] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ECLIPSE.INF") returned 1 [0048.333] lstrcmpiA (lpString1="", lpString2="ECLIPSE.INF") returned -1 [0048.333] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned="ECLIPSE.ELM" [0048.333] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\" [0048.333] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\") returned="" [0048.333] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO DECRYPT FILES.txt" [0048.333] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\how to decrypt files.txt")) returned 0x20 [0048.333] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", lpString2="ECLIPSE.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" [0048.333] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.zip") returned 0 [0048.334] lstrlenA (lpString="*.zip") returned 5 [0048.334] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.rar") returned 0 [0048.334] lstrlenA (lpString="*.rar") returned 5 [0048.334] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.7z") returned 0 [0048.334] lstrlenA (lpString="*.7z") returned 4 [0048.334] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.tar") returned 0 [0048.334] lstrlenA (lpString="*.tar") returned 5 [0048.334] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.gzip") returned 0 [0048.334] lstrlenA (lpString="*.gzip") returned 6 [0048.334] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.jpg") returned 0 [0048.334] lstrlenA (lpString="*.jpg") returned 5 [0048.334] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.jpeg") returned 0 [0048.334] lstrlenA (lpString="*.jpeg") returned 6 [0048.334] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.psd") returned 0 [0048.334] lstrlenA (lpString="*.psd") returned 5 [0048.334] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.gif") returned 0 [0048.334] lstrlenA (lpString="*.gif") returned 5 [0048.334] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.doc") returned 0 [0048.334] lstrlenA (lpString="*.doc") returned 5 [0048.334] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.docx") returned 0 [0048.334] lstrlenA (lpString="*.docx") returned 6 [0048.334] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.xls") returned 0 [0048.334] lstrlenA (lpString="*.xls") returned 5 [0048.334] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.xlsx") returned 0 [0048.334] lstrlenA (lpString="*.xlsx") returned 6 [0048.334] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.ppt") returned 0 [0048.335] lstrlenA (lpString="*.ppt") returned 5 [0048.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.pptx") returned 0 [0048.335] lstrlenA (lpString="*.pptx") returned 6 [0048.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.pdf") returned 0 [0048.335] lstrlenA (lpString="*.pdf") returned 5 [0048.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.mov") returned 0 [0048.335] lstrlenA (lpString="*.mov") returned 5 [0048.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.m2v") returned 0 [0048.335] lstrlenA (lpString="*.m2v") returned 5 [0048.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.3gp") returned 0 [0048.335] lstrlenA (lpString="*.3gp") returned 5 [0048.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.mpeg") returned 0 [0048.335] lstrlenA (lpString="*.mpeg") returned 6 [0048.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.mpg") returned 0 [0048.335] lstrlenA (lpString="*.mpg") returned 5 [0048.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.flv") returned 0 [0048.335] lstrlenA (lpString="*.flv") returned 5 [0048.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.avi") returned 0 [0048.335] lstrlenA (lpString="*.avi") returned 5 [0048.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.mp4") returned 0 [0048.335] lstrlenA (lpString="*.mp4") returned 5 [0048.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.wmv") returned 0 [0048.335] lstrlenA (lpString="*.wmv") returned 5 [0048.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.divx") returned 0 [0048.335] lstrlenA (lpString="*.divx") returned 6 [0048.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.mkv") returned 0 [0048.335] lstrlenA (lpString="*.mkv") returned 5 [0048.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.mp3") returned 0 [0048.336] lstrlenA (lpString="*.mp3") returned 5 [0048.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.wav") returned 0 [0048.336] lstrlenA (lpString="*.wav") returned 5 [0048.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.flac") returned 0 [0048.336] lstrlenA (lpString="*.flac") returned 6 [0048.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.ape") returned 0 [0048.336] lstrlenA (lpString="*.ape") returned 5 [0048.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.wma") returned 0 [0048.336] lstrlenA (lpString="*.wma") returned 5 [0048.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.ac3") returned 0 [0048.336] lstrlenA (lpString="*.ac3") returned 5 [0048.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", pszSpec="*.mxf") returned 0 [0048.336] lstrlenA (lpString="*.mxf") returned 5 [0048.336] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.336] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.336] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.336] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.336] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.336] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned="ECLIPSE.INF" [0048.337] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\" [0048.337] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\") returned="" [0048.337] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO DECRYPT FILES.txt" [0048.337] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\how to decrypt files.txt")) returned 0x20 [0048.337] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" [0048.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.337] lstrlenA (lpString="*.zip") returned 5 [0048.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.337] lstrlenA (lpString="*.rar") returned 5 [0048.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.337] lstrlenA (lpString="*.7z") returned 4 [0048.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.337] lstrlenA (lpString="*.tar") returned 5 [0048.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.337] lstrlenA (lpString="*.gzip") returned 6 [0048.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.337] lstrlenA (lpString="*.jpg") returned 5 [0048.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.337] lstrlenA (lpString="*.jpeg") returned 6 [0048.338] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.338] lstrlenA (lpString="*.psd") returned 5 [0048.338] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.338] lstrlenA (lpString="*.gif") returned 5 [0048.338] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" [0048.338] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" [0048.338] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF." [0048.338] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.wannacry" [0048.338] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.339] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x543 [0048.339] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1 [0048.339] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.339] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4c5, lpOverlapped=0x0) returned 1 [0048.341] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.341] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.341] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4c5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4c5, lpOverlapped=0x0) returned 1 [0048.342] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.342] CloseHandle (hObject=0x90) returned 1 [0048.347] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.wannacry")) returned 1 [0048.350] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.350] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.350] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.350] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.350] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.350] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.350] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\" [0048.350] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\") returned="" [0048.350] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO DECRYPT FILES.txt" [0048.350] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\how to decrypt files.txt")) returned 0x20 [0048.350] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" [0048.350] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.350] lstrlenA (lpString="*.zip") returned 5 [0048.350] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.350] lstrlenA (lpString="*.rar") returned 5 [0048.351] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.351] lstrlenA (lpString="*.7z") returned 4 [0048.351] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.351] lstrlenA (lpString="*.tar") returned 5 [0048.351] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.351] lstrlenA (lpString="*.gzip") returned 6 [0048.351] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.351] lstrlenA (lpString="*.jpg") returned 5 [0048.351] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.351] lstrlenA (lpString="*.jpeg") returned 6 [0048.351] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.351] lstrlenA (lpString="*.psd") returned 5 [0048.351] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.351] lstrlenA (lpString="*.gif") returned 5 [0048.351] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.351] lstrlenA (lpString="*.doc") returned 5 [0048.351] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.351] lstrlenA (lpString="*.docx") returned 6 [0048.351] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.351] lstrlenA (lpString="*.xls") returned 5 [0048.351] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.351] lstrlenA (lpString="*.xlsx") returned 6 [0048.351] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.351] lstrlenA (lpString="*.ppt") returned 5 [0048.351] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.351] lstrlenA (lpString="*.pptx") returned 6 [0048.351] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.351] lstrlenA (lpString="*.pdf") returned 5 [0048.352] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.352] lstrlenA (lpString="*.mov") returned 5 [0048.352] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.352] lstrlenA (lpString="*.m2v") returned 5 [0048.352] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.352] lstrlenA (lpString="*.3gp") returned 5 [0048.352] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.352] lstrlenA (lpString="*.mpeg") returned 6 [0048.352] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.352] lstrlenA (lpString="*.mpg") returned 5 [0048.352] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.352] lstrlenA (lpString="*.flv") returned 5 [0048.352] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.352] lstrlenA (lpString="*.avi") returned 5 [0048.352] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.352] lstrlenA (lpString="*.mp4") returned 5 [0048.352] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.352] lstrlenA (lpString="*.wmv") returned 5 [0048.352] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.352] lstrlenA (lpString="*.divx") returned 6 [0048.352] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.352] lstrlenA (lpString="*.mkv") returned 5 [0048.352] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.352] lstrlenA (lpString="*.mp3") returned 5 [0048.352] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.352] lstrlenA (lpString="*.wav") returned 5 [0048.352] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.352] lstrlenA (lpString="*.flac") returned 6 [0048.353] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.353] lstrlenA (lpString="*.ape") returned 5 [0048.353] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.353] lstrlenA (lpString="*.wma") returned 5 [0048.353] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.353] lstrlenA (lpString="*.ac3") returned 5 [0048.353] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.353] lstrlenA (lpString="*.mxf") returned 5 [0048.353] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.353] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0048.353] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="EDGE", cAlternateFileName="")) returned 1 [0048.353] lstrcmpA (lpString1=".", lpString2="EDGE") returned -1 [0048.353] lstrcmpA (lpString1="..", lpString2="EDGE") returned -1 [0048.353] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.353] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="EDGE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE" [0048.353] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE") returned 60 [0048.353] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0048.374] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.374] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x740000, cFileName="..", cAlternateFileName="")) returned 1 [0048.374] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.374] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.374] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb06ab00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb06ab00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb8f8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="EDGE.ELM", cAlternateFileName="")) returned 1 [0048.374] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.374] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EDGE.ELM") returned -1 [0048.374] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EDGE.ELM") returned 1 [0048.374] lstrcmpiA (lpString1="", lpString2="EDGE.ELM") returned -1 [0048.374] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*") returned="*.*" [0048.374] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\" [0048.374] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\") returned="" [0048.375] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO DECRYPT FILES.txt" [0048.375] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\how to decrypt files.txt")) returned 0xffffffff [0048.375] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.375] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.375] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.377] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.377] CloseHandle (hObject=0x90) returned 1 [0048.377] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", lpString2="EDGE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" [0048.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.zip") returned 0 [0048.377] lstrlenA (lpString="*.zip") returned 5 [0048.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.rar") returned 0 [0048.377] lstrlenA (lpString="*.rar") returned 5 [0048.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.7z") returned 0 [0048.378] lstrlenA (lpString="*.7z") returned 4 [0048.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.tar") returned 0 [0048.378] lstrlenA (lpString="*.tar") returned 5 [0048.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.gzip") returned 0 [0048.378] lstrlenA (lpString="*.gzip") returned 6 [0048.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.jpg") returned 0 [0048.378] lstrlenA (lpString="*.jpg") returned 5 [0048.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.jpeg") returned 0 [0048.378] lstrlenA (lpString="*.jpeg") returned 6 [0048.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.psd") returned 0 [0048.378] lstrlenA (lpString="*.psd") returned 5 [0048.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.gif") returned 0 [0048.378] lstrlenA (lpString="*.gif") returned 5 [0048.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.doc") returned 0 [0048.378] lstrlenA (lpString="*.doc") returned 5 [0048.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.docx") returned 0 [0048.378] lstrlenA (lpString="*.docx") returned 6 [0048.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.xls") returned 0 [0048.378] lstrlenA (lpString="*.xls") returned 5 [0048.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.xlsx") returned 0 [0048.378] lstrlenA (lpString="*.xlsx") returned 6 [0048.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.ppt") returned 0 [0048.378] lstrlenA (lpString="*.ppt") returned 5 [0048.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.pptx") returned 0 [0048.379] lstrlenA (lpString="*.pptx") returned 6 [0048.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.pdf") returned 0 [0048.379] lstrlenA (lpString="*.pdf") returned 5 [0048.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.mov") returned 0 [0048.379] lstrlenA (lpString="*.mov") returned 5 [0048.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.m2v") returned 0 [0048.379] lstrlenA (lpString="*.m2v") returned 5 [0048.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.3gp") returned 0 [0048.379] lstrlenA (lpString="*.3gp") returned 5 [0048.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.mpeg") returned 0 [0048.379] lstrlenA (lpString="*.mpeg") returned 6 [0048.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.mpg") returned 0 [0048.379] lstrlenA (lpString="*.mpg") returned 5 [0048.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.flv") returned 0 [0048.379] lstrlenA (lpString="*.flv") returned 5 [0048.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.avi") returned 0 [0048.379] lstrlenA (lpString="*.avi") returned 5 [0048.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.mp4") returned 0 [0048.379] lstrlenA (lpString="*.mp4") returned 5 [0048.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.wmv") returned 0 [0048.379] lstrlenA (lpString="*.wmv") returned 5 [0048.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.divx") returned 0 [0048.379] lstrlenA (lpString="*.divx") returned 6 [0048.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.mkv") returned 0 [0048.379] lstrlenA (lpString="*.mkv") returned 5 [0048.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.mp3") returned 0 [0048.380] lstrlenA (lpString="*.mp3") returned 5 [0048.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.wav") returned 0 [0048.380] lstrlenA (lpString="*.wav") returned 5 [0048.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.flac") returned 0 [0048.380] lstrlenA (lpString="*.flac") returned 6 [0048.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.ape") returned 0 [0048.380] lstrlenA (lpString="*.ape") returned 5 [0048.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.wma") returned 0 [0048.380] lstrlenA (lpString="*.wma") returned 5 [0048.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.ac3") returned 0 [0048.380] lstrlenA (lpString="*.ac3") returned 5 [0048.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", pszSpec="*.mxf") returned 0 [0048.380] lstrlenA (lpString="*.mxf") returned 5 [0048.380] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x2d83e0, cFileName="EDGE.INF", cAlternateFileName="")) returned 1 [0048.380] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.380] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EDGE.INF") returned -1 [0048.380] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EDGE.INF") returned 1 [0048.380] lstrcmpiA (lpString1="", lpString2="EDGE.INF") returned -1 [0048.380] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned="EDGE.ELM" [0048.380] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\" [0048.380] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\") returned="" [0048.380] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO DECRYPT FILES.txt" [0048.381] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\how to decrypt files.txt")) returned 0x20 [0048.381] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", lpString2="EDGE.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" [0048.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.zip") returned 0 [0048.381] lstrlenA (lpString="*.zip") returned 5 [0048.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.rar") returned 0 [0048.381] lstrlenA (lpString="*.rar") returned 5 [0048.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.7z") returned 0 [0048.381] lstrlenA (lpString="*.7z") returned 4 [0048.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.tar") returned 0 [0048.381] lstrlenA (lpString="*.tar") returned 5 [0048.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.gzip") returned 0 [0048.381] lstrlenA (lpString="*.gzip") returned 6 [0048.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.jpg") returned 0 [0048.381] lstrlenA (lpString="*.jpg") returned 5 [0048.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.jpeg") returned 0 [0048.381] lstrlenA (lpString="*.jpeg") returned 6 [0048.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.psd") returned 0 [0048.381] lstrlenA (lpString="*.psd") returned 5 [0048.381] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.gif") returned 0 [0048.381] lstrlenA (lpString="*.gif") returned 5 [0048.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.doc") returned 0 [0048.382] lstrlenA (lpString="*.doc") returned 5 [0048.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.docx") returned 0 [0048.382] lstrlenA (lpString="*.docx") returned 6 [0048.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.xls") returned 0 [0048.382] lstrlenA (lpString="*.xls") returned 5 [0048.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.xlsx") returned 0 [0048.382] lstrlenA (lpString="*.xlsx") returned 6 [0048.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.ppt") returned 0 [0048.382] lstrlenA (lpString="*.ppt") returned 5 [0048.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.pptx") returned 0 [0048.382] lstrlenA (lpString="*.pptx") returned 6 [0048.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.pdf") returned 0 [0048.382] lstrlenA (lpString="*.pdf") returned 5 [0048.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.mov") returned 0 [0048.382] lstrlenA (lpString="*.mov") returned 5 [0048.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.m2v") returned 0 [0048.382] lstrlenA (lpString="*.m2v") returned 5 [0048.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.3gp") returned 0 [0048.382] lstrlenA (lpString="*.3gp") returned 5 [0048.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.mpeg") returned 0 [0048.382] lstrlenA (lpString="*.mpeg") returned 6 [0048.382] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.mpg") returned 0 [0048.383] lstrlenA (lpString="*.mpg") returned 5 [0048.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.flv") returned 0 [0048.383] lstrlenA (lpString="*.flv") returned 5 [0048.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.avi") returned 0 [0048.383] lstrlenA (lpString="*.avi") returned 5 [0048.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.mp4") returned 0 [0048.383] lstrlenA (lpString="*.mp4") returned 5 [0048.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.wmv") returned 0 [0048.383] lstrlenA (lpString="*.wmv") returned 5 [0048.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.divx") returned 0 [0048.383] lstrlenA (lpString="*.divx") returned 6 [0048.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.mkv") returned 0 [0048.383] lstrlenA (lpString="*.mkv") returned 5 [0048.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.mp3") returned 0 [0048.383] lstrlenA (lpString="*.mp3") returned 5 [0048.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.wav") returned 0 [0048.383] lstrlenA (lpString="*.wav") returned 5 [0048.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.flac") returned 0 [0048.383] lstrlenA (lpString="*.flac") returned 6 [0048.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.ape") returned 0 [0048.383] lstrlenA (lpString="*.ape") returned 5 [0048.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.wma") returned 0 [0048.383] lstrlenA (lpString="*.wma") returned 5 [0048.383] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.ac3") returned 0 [0048.384] lstrlenA (lpString="*.ac3") returned 5 [0048.384] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", pszSpec="*.mxf") returned 0 [0048.384] lstrlenA (lpString="*.mxf") returned 5 [0048.384] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x74, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.384] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.384] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.384] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.384] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.384] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned="EDGE.INF" [0048.384] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\" [0048.384] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\") returned="" [0048.384] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO DECRYPT FILES.txt" [0048.384] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\how to decrypt files.txt")) returned 0x20 [0048.384] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" [0048.384] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.384] lstrlenA (lpString="*.zip") returned 5 [0048.384] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.384] lstrlenA (lpString="*.rar") returned 5 [0048.384] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.384] lstrlenA (lpString="*.7z") returned 4 [0048.384] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.385] lstrlenA (lpString="*.tar") returned 5 [0048.385] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.385] lstrlenA (lpString="*.gzip") returned 6 [0048.385] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.385] lstrlenA (lpString="*.jpg") returned 5 [0048.385] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.385] lstrlenA (lpString="*.jpeg") returned 6 [0048.385] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.385] lstrlenA (lpString="*.psd") returned 5 [0048.385] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.385] lstrlenA (lpString="*.gif") returned 5 [0048.385] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" [0048.385] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" [0048.385] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF." [0048.385] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.wannacry" [0048.385] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.386] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x543 [0048.386] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1 [0048.386] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.386] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4c5, lpOverlapped=0x0) returned 1 [0048.389] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.389] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.389] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4c5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4c5, lpOverlapped=0x0) returned 1 [0048.389] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.389] CloseHandle (hObject=0x90) returned 1 [0048.395] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.wannacry")) returned 1 [0048.398] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.398] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.398] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.398] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.398] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.398] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.398] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\" [0048.398] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\") returned="" [0048.398] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO DECRYPT FILES.txt" [0048.398] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\how to decrypt files.txt")) returned 0x20 [0048.398] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" [0048.398] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.398] lstrlenA (lpString="*.zip") returned 5 [0048.398] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.398] lstrlenA (lpString="*.rar") returned 5 [0048.398] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.398] lstrlenA (lpString="*.7z") returned 4 [0048.398] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.398] lstrlenA (lpString="*.tar") returned 5 [0048.398] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.398] lstrlenA (lpString="*.gzip") returned 6 [0048.398] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.399] lstrlenA (lpString="*.jpg") returned 5 [0048.399] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.399] lstrlenA (lpString="*.jpeg") returned 6 [0048.399] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.399] lstrlenA (lpString="*.psd") returned 5 [0048.399] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.399] lstrlenA (lpString="*.gif") returned 5 [0048.399] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.399] lstrlenA (lpString="*.doc") returned 5 [0048.399] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.399] lstrlenA (lpString="*.docx") returned 6 [0048.399] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.399] lstrlenA (lpString="*.xls") returned 5 [0048.399] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.399] lstrlenA (lpString="*.xlsx") returned 6 [0048.399] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.399] lstrlenA (lpString="*.ppt") returned 5 [0048.399] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.399] lstrlenA (lpString="*.pptx") returned 6 [0048.399] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.399] lstrlenA (lpString="*.pdf") returned 5 [0048.399] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.399] lstrlenA (lpString="*.mov") returned 5 [0048.399] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.399] lstrlenA (lpString="*.m2v") returned 5 [0048.399] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.399] lstrlenA (lpString="*.3gp") returned 5 [0048.399] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.399] lstrlenA (lpString="*.mpeg") returned 6 [0048.399] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.399] lstrlenA (lpString="*.mpg") returned 5 [0048.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.400] lstrlenA (lpString="*.flv") returned 5 [0048.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.400] lstrlenA (lpString="*.avi") returned 5 [0048.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.400] lstrlenA (lpString="*.mp4") returned 5 [0048.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.400] lstrlenA (lpString="*.wmv") returned 5 [0048.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.400] lstrlenA (lpString="*.divx") returned 6 [0048.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.400] lstrlenA (lpString="*.mkv") returned 5 [0048.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.400] lstrlenA (lpString="*.mp3") returned 5 [0048.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.400] lstrlenA (lpString="*.wav") returned 5 [0048.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.400] lstrlenA (lpString="*.flac") returned 6 [0048.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.400] lstrlenA (lpString="*.ape") returned 5 [0048.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.400] lstrlenA (lpString="*.wma") returned 5 [0048.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.400] lstrlenA (lpString="*.ac3") returned 5 [0048.400] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.400] lstrlenA (lpString="*.mxf") returned 5 [0048.400] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.400] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0048.401] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="EVRGREEN", cAlternateFileName="")) returned 1 [0048.401] lstrcmpA (lpString1=".", lpString2="EVRGREEN") returned -1 [0048.401] lstrcmpA (lpString1="..", lpString2="EVRGREEN") returned -1 [0048.401] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.401] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="EVRGREEN" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN" [0048.401] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN") returned 64 [0048.401] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d80c8 [0048.402] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.402] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.402] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.402] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.402] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc37d800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x52008f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc37d800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x12dee, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="EVRGREEN.ELM", cAlternateFileName="")) returned 1 [0048.402] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.402] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EVRGREEN.ELM") returned -1 [0048.402] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EVRGREEN.ELM") returned 1 [0048.403] lstrcmpiA (lpString1="", lpString2="EVRGREEN.ELM") returned -1 [0048.403] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*") returned="*.*" [0048.403] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\" [0048.403] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\") returned="" [0048.403] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO DECRYPT FILES.txt" [0048.403] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\how to decrypt files.txt")) returned 0xffffffff [0048.403] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.405] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.405] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.406] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.406] CloseHandle (hObject=0x90) returned 1 [0048.406] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", lpString2="EVRGREEN.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" [0048.406] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.zip") returned 0 [0048.406] lstrlenA (lpString="*.zip") returned 5 [0048.406] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.rar") returned 0 [0048.406] lstrlenA (lpString="*.rar") returned 5 [0048.406] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.7z") returned 0 [0048.406] lstrlenA (lpString="*.7z") returned 4 [0048.406] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.tar") returned 0 [0048.406] lstrlenA (lpString="*.tar") returned 5 [0048.406] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.gzip") returned 0 [0048.406] lstrlenA (lpString="*.gzip") returned 6 [0048.406] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.jpg") returned 0 [0048.406] lstrlenA (lpString="*.jpg") returned 5 [0048.406] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.jpeg") returned 0 [0048.406] lstrlenA (lpString="*.jpeg") returned 6 [0048.406] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.psd") returned 0 [0048.406] lstrlenA (lpString="*.psd") returned 5 [0048.406] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.gif") returned 0 [0048.406] lstrlenA (lpString="*.gif") returned 5 [0048.406] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.doc") returned 0 [0048.407] lstrlenA (lpString="*.doc") returned 5 [0048.407] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.docx") returned 0 [0048.407] lstrlenA (lpString="*.docx") returned 6 [0048.407] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.xls") returned 0 [0048.407] lstrlenA (lpString="*.xls") returned 5 [0048.407] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.xlsx") returned 0 [0048.407] lstrlenA (lpString="*.xlsx") returned 6 [0048.407] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.ppt") returned 0 [0048.407] lstrlenA (lpString="*.ppt") returned 5 [0048.407] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.pptx") returned 0 [0048.407] lstrlenA (lpString="*.pptx") returned 6 [0048.407] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.pdf") returned 0 [0048.407] lstrlenA (lpString="*.pdf") returned 5 [0048.407] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.mov") returned 0 [0048.407] lstrlenA (lpString="*.mov") returned 5 [0048.407] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.m2v") returned 0 [0048.407] lstrlenA (lpString="*.m2v") returned 5 [0048.407] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.3gp") returned 0 [0048.407] lstrlenA (lpString="*.3gp") returned 5 [0048.407] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.mpeg") returned 0 [0048.407] lstrlenA (lpString="*.mpeg") returned 6 [0048.407] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.mpg") returned 0 [0048.407] lstrlenA (lpString="*.mpg") returned 5 [0048.407] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.flv") returned 0 [0048.407] lstrlenA (lpString="*.flv") returned 5 [0048.407] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.avi") returned 0 [0048.407] lstrlenA (lpString="*.avi") returned 5 [0048.407] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.mp4") returned 0 [0048.407] lstrlenA (lpString="*.mp4") returned 5 [0048.407] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.wmv") returned 0 [0048.407] lstrlenA (lpString="*.wmv") returned 5 [0048.407] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.divx") returned 0 [0048.407] lstrlenA (lpString="*.divx") returned 6 [0048.407] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.mkv") returned 0 [0048.407] lstrlenA (lpString="*.mkv") returned 5 [0048.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.mp3") returned 0 [0048.408] lstrlenA (lpString="*.mp3") returned 5 [0048.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.wav") returned 0 [0048.408] lstrlenA (lpString="*.wav") returned 5 [0048.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.flac") returned 0 [0048.408] lstrlenA (lpString="*.flac") returned 6 [0048.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.ape") returned 0 [0048.408] lstrlenA (lpString="*.ape") returned 5 [0048.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.wma") returned 0 [0048.408] lstrlenA (lpString="*.wma") returned 5 [0048.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.ac3") returned 0 [0048.408] lstrlenA (lpString="*.ac3") returned 5 [0048.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", pszSpec="*.mxf") returned 0 [0048.408] lstrlenA (lpString="*.mxf") returned 5 [0048.408] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x223, dwReserved0=0x0, dwReserved1=0x2d83f0, cFileName="EVRGREEN.INF", cAlternateFileName="")) returned 1 [0048.408] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.408] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EVRGREEN.INF") returned -1 [0048.408] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EVRGREEN.INF") returned 1 [0048.408] lstrcmpiA (lpString1="", lpString2="EVRGREEN.INF") returned -1 [0048.408] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned="EVRGREEN.ELM" [0048.408] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\" [0048.408] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\") returned="" [0048.408] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO DECRYPT FILES.txt" [0048.408] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\how to decrypt files.txt")) returned 0x20 [0048.408] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", lpString2="EVRGREEN.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" [0048.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.zip") returned 0 [0048.408] lstrlenA (lpString="*.zip") returned 5 [0048.408] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.rar") returned 0 [0048.408] lstrlenA (lpString="*.rar") returned 5 [0048.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.7z") returned 0 [0048.409] lstrlenA (lpString="*.7z") returned 4 [0048.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.tar") returned 0 [0048.409] lstrlenA (lpString="*.tar") returned 5 [0048.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.gzip") returned 0 [0048.409] lstrlenA (lpString="*.gzip") returned 6 [0048.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.jpg") returned 0 [0048.409] lstrlenA (lpString="*.jpg") returned 5 [0048.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.jpeg") returned 0 [0048.409] lstrlenA (lpString="*.jpeg") returned 6 [0048.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.psd") returned 0 [0048.409] lstrlenA (lpString="*.psd") returned 5 [0048.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.gif") returned 0 [0048.409] lstrlenA (lpString="*.gif") returned 5 [0048.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.doc") returned 0 [0048.409] lstrlenA (lpString="*.doc") returned 5 [0048.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.docx") returned 0 [0048.409] lstrlenA (lpString="*.docx") returned 6 [0048.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.xls") returned 0 [0048.409] lstrlenA (lpString="*.xls") returned 5 [0048.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.xlsx") returned 0 [0048.409] lstrlenA (lpString="*.xlsx") returned 6 [0048.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.ppt") returned 0 [0048.409] lstrlenA (lpString="*.ppt") returned 5 [0048.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.pptx") returned 0 [0048.409] lstrlenA (lpString="*.pptx") returned 6 [0048.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.pdf") returned 0 [0048.409] lstrlenA (lpString="*.pdf") returned 5 [0048.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.mov") returned 0 [0048.409] lstrlenA (lpString="*.mov") returned 5 [0048.409] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.m2v") returned 0 [0048.409] lstrlenA (lpString="*.m2v") returned 5 [0048.410] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.3gp") returned 0 [0048.410] lstrlenA (lpString="*.3gp") returned 5 [0048.410] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.mpeg") returned 0 [0048.410] lstrlenA (lpString="*.mpeg") returned 6 [0048.410] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.mpg") returned 0 [0048.410] lstrlenA (lpString="*.mpg") returned 5 [0048.410] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.flv") returned 0 [0048.410] lstrlenA (lpString="*.flv") returned 5 [0048.410] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.avi") returned 0 [0048.410] lstrlenA (lpString="*.avi") returned 5 [0048.410] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.mp4") returned 0 [0048.410] lstrlenA (lpString="*.mp4") returned 5 [0048.410] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.wmv") returned 0 [0048.410] lstrlenA (lpString="*.wmv") returned 5 [0048.410] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.divx") returned 0 [0048.410] lstrlenA (lpString="*.divx") returned 6 [0048.410] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.mkv") returned 0 [0048.410] lstrlenA (lpString="*.mkv") returned 5 [0048.410] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.mp3") returned 0 [0048.410] lstrlenA (lpString="*.mp3") returned 5 [0048.410] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.wav") returned 0 [0048.410] lstrlenA (lpString="*.wav") returned 5 [0048.410] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.flac") returned 0 [0048.410] lstrlenA (lpString="*.flac") returned 6 [0048.410] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.ape") returned 0 [0048.410] lstrlenA (lpString="*.ape") returned 5 [0048.410] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.wma") returned 0 [0048.410] lstrlenA (lpString="*.wma") returned 5 [0048.410] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.ac3") returned 0 [0048.410] lstrlenA (lpString="*.ac3") returned 5 [0048.410] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", pszSpec="*.mxf") returned 0 [0048.410] lstrlenA (lpString="*.mxf") returned 5 [0048.410] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54a, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.410] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.411] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.411] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.411] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.411] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned="EVRGREEN.INF" [0048.411] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\" [0048.411] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\") returned="" [0048.411] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO DECRYPT FILES.txt" [0048.411] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\how to decrypt files.txt")) returned 0x20 [0048.411] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" [0048.411] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.411] lstrlenA (lpString="*.zip") returned 5 [0048.411] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.411] lstrlenA (lpString="*.rar") returned 5 [0048.411] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.411] lstrlenA (lpString="*.7z") returned 4 [0048.411] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.411] lstrlenA (lpString="*.tar") returned 5 [0048.411] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.411] lstrlenA (lpString="*.gzip") returned 6 [0048.411] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.411] lstrlenA (lpString="*.jpg") returned 5 [0048.411] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.411] lstrlenA (lpString="*.jpeg") returned 6 [0048.411] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.411] lstrlenA (lpString="*.psd") returned 5 [0048.411] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.411] lstrlenA (lpString="*.gif") returned 5 [0048.411] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" [0048.411] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" [0048.411] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF." [0048.412] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.wannacry" [0048.412] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.412] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x54a [0048.412] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1 [0048.412] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.412] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4cc, lpOverlapped=0x0) returned 1 [0048.414] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.414] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.414] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4cc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4cc, lpOverlapped=0x0) returned 1 [0048.414] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.414] CloseHandle (hObject=0x90) returned 1 [0048.423] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.wannacry")) returned 1 [0048.424] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.424] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.424] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.424] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.424] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.424] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.424] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\" [0048.424] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\") returned="" [0048.424] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO DECRYPT FILES.txt" [0048.424] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\how to decrypt files.txt")) returned 0x20 [0048.424] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" [0048.424] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.424] lstrlenA (lpString="*.zip") returned 5 [0048.424] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.424] lstrlenA (lpString="*.rar") returned 5 [0048.424] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.424] lstrlenA (lpString="*.7z") returned 4 [0048.424] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.424] lstrlenA (lpString="*.tar") returned 5 [0048.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.425] lstrlenA (lpString="*.gzip") returned 6 [0048.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.425] lstrlenA (lpString="*.jpg") returned 5 [0048.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.425] lstrlenA (lpString="*.jpeg") returned 6 [0048.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.425] lstrlenA (lpString="*.psd") returned 5 [0048.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.425] lstrlenA (lpString="*.gif") returned 5 [0048.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.425] lstrlenA (lpString="*.doc") returned 5 [0048.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.425] lstrlenA (lpString="*.docx") returned 6 [0048.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.425] lstrlenA (lpString="*.xls") returned 5 [0048.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.425] lstrlenA (lpString="*.xlsx") returned 6 [0048.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.425] lstrlenA (lpString="*.ppt") returned 5 [0048.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.425] lstrlenA (lpString="*.pptx") returned 6 [0048.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.425] lstrlenA (lpString="*.pdf") returned 5 [0048.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.425] lstrlenA (lpString="*.mov") returned 5 [0048.425] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.426] lstrlenA (lpString="*.m2v") returned 5 [0048.426] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.426] lstrlenA (lpString="*.3gp") returned 5 [0048.426] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.426] lstrlenA (lpString="*.mpeg") returned 6 [0048.426] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.426] lstrlenA (lpString="*.mpg") returned 5 [0048.426] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.426] lstrlenA (lpString="*.flv") returned 5 [0048.426] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.426] lstrlenA (lpString="*.avi") returned 5 [0048.426] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.426] lstrlenA (lpString="*.mp4") returned 5 [0048.426] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.426] lstrlenA (lpString="*.wmv") returned 5 [0048.426] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.426] lstrlenA (lpString="*.divx") returned 6 [0048.426] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.426] lstrlenA (lpString="*.mkv") returned 5 [0048.426] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.426] lstrlenA (lpString="*.mp3") returned 5 [0048.426] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.426] lstrlenA (lpString="*.wav") returned 5 [0048.426] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.426] lstrlenA (lpString="*.flac") returned 6 [0048.426] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.426] lstrlenA (lpString="*.ape") returned 5 [0048.427] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.427] lstrlenA (lpString="*.wma") returned 5 [0048.427] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.427] lstrlenA (lpString="*.ac3") returned 5 [0048.427] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.427] lstrlenA (lpString="*.mxf") returned 5 [0048.427] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.427] FindClose (in: hFindFile=0x2d80c8 | out: hFindFile=0x2d80c8) returned 1 [0048.427] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="EXPEDITN", cAlternateFileName="")) returned 1 [0048.427] lstrcmpA (lpString1=".", lpString2="EXPEDITN") returned -1 [0048.427] lstrcmpA (lpString1="..", lpString2="EXPEDITN") returned -1 [0048.427] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.427] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="EXPEDITN" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN" [0048.427] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN") returned 64 [0048.427] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x2d80c8 [0048.428] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.428] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x780000, cFileName="..", cAlternateFileName="")) returned 1 [0048.428] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.428] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.428] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd690500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd690500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x19539, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="EXPEDITN.ELM", cAlternateFileName="")) returned 1 [0048.428] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.428] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EXPEDITN.ELM") returned -1 [0048.428] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXPEDITN.ELM") returned 1 [0048.428] lstrcmpiA (lpString1="", lpString2="EXPEDITN.ELM") returned -1 [0048.428] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*") returned="*.*" [0048.428] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\" [0048.428] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\") returned="" [0048.428] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO DECRYPT FILES.txt" [0048.428] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\how to decrypt files.txt")) returned 0xffffffff [0048.428] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.431] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.431] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.433] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.433] CloseHandle (hObject=0x90) returned 1 [0048.433] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", lpString2="EXPEDITN.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" [0048.433] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.zip") returned 0 [0048.433] lstrlenA (lpString="*.zip") returned 5 [0048.433] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.rar") returned 0 [0048.433] lstrlenA (lpString="*.rar") returned 5 [0048.433] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.7z") returned 0 [0048.433] lstrlenA (lpString="*.7z") returned 4 [0048.433] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.tar") returned 0 [0048.433] lstrlenA (lpString="*.tar") returned 5 [0048.433] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.gzip") returned 0 [0048.434] lstrlenA (lpString="*.gzip") returned 6 [0048.434] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.jpg") returned 0 [0048.434] lstrlenA (lpString="*.jpg") returned 5 [0048.434] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.jpeg") returned 0 [0048.434] lstrlenA (lpString="*.jpeg") returned 6 [0048.434] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.psd") returned 0 [0048.434] lstrlenA (lpString="*.psd") returned 5 [0048.434] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.gif") returned 0 [0048.434] lstrlenA (lpString="*.gif") returned 5 [0048.434] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.doc") returned 0 [0048.434] lstrlenA (lpString="*.doc") returned 5 [0048.434] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.docx") returned 0 [0048.434] lstrlenA (lpString="*.docx") returned 6 [0048.434] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.xls") returned 0 [0048.434] lstrlenA (lpString="*.xls") returned 5 [0048.434] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.xlsx") returned 0 [0048.434] lstrlenA (lpString="*.xlsx") returned 6 [0048.434] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.ppt") returned 0 [0048.434] lstrlenA (lpString="*.ppt") returned 5 [0048.434] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.pptx") returned 0 [0048.435] lstrlenA (lpString="*.pptx") returned 6 [0048.435] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.pdf") returned 0 [0048.435] lstrlenA (lpString="*.pdf") returned 5 [0048.435] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.mov") returned 0 [0048.435] lstrlenA (lpString="*.mov") returned 5 [0048.435] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.m2v") returned 0 [0048.435] lstrlenA (lpString="*.m2v") returned 5 [0048.435] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.3gp") returned 0 [0048.435] lstrlenA (lpString="*.3gp") returned 5 [0048.435] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.mpeg") returned 0 [0048.435] lstrlenA (lpString="*.mpeg") returned 6 [0048.435] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.mpg") returned 0 [0048.435] lstrlenA (lpString="*.mpg") returned 5 [0048.435] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.flv") returned 0 [0048.435] lstrlenA (lpString="*.flv") returned 5 [0048.435] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.avi") returned 0 [0048.435] lstrlenA (lpString="*.avi") returned 5 [0048.436] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.mp4") returned 0 [0048.436] lstrlenA (lpString="*.mp4") returned 5 [0048.436] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.wmv") returned 0 [0048.436] lstrlenA (lpString="*.wmv") returned 5 [0048.436] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.divx") returned 0 [0048.436] lstrlenA (lpString="*.divx") returned 6 [0048.436] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.mkv") returned 0 [0048.436] lstrlenA (lpString="*.mkv") returned 5 [0048.436] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.mp3") returned 0 [0048.436] lstrlenA (lpString="*.mp3") returned 5 [0048.436] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.wav") returned 0 [0048.436] lstrlenA (lpString="*.wav") returned 5 [0048.436] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.flac") returned 0 [0048.436] lstrlenA (lpString="*.flac") returned 6 [0048.436] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.ape") returned 0 [0048.436] lstrlenA (lpString="*.ape") returned 5 [0048.436] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.wma") returned 0 [0048.436] lstrlenA (lpString="*.wma") returned 5 [0048.436] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.ac3") returned 0 [0048.436] lstrlenA (lpString="*.ac3") returned 5 [0048.437] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", pszSpec="*.mxf") returned 0 [0048.437] lstrlenA (lpString="*.mxf") returned 5 [0048.437] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x2d83f0, cFileName="EXPEDITN.INF", cAlternateFileName="")) returned 1 [0048.437] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.437] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EXPEDITN.INF") returned -1 [0048.437] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXPEDITN.INF") returned 1 [0048.437] lstrcmpiA (lpString1="", lpString2="EXPEDITN.INF") returned -1 [0048.437] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned="EXPEDITN.ELM" [0048.437] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\" [0048.437] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\") returned="" [0048.437] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO DECRYPT FILES.txt" [0048.437] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\how to decrypt files.txt")) returned 0x20 [0048.437] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", lpString2="EXPEDITN.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" [0048.437] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.zip") returned 0 [0048.437] lstrlenA (lpString="*.zip") returned 5 [0048.437] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.rar") returned 0 [0048.437] lstrlenA (lpString="*.rar") returned 5 [0048.438] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.7z") returned 0 [0048.438] lstrlenA (lpString="*.7z") returned 4 [0048.438] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.tar") returned 0 [0048.438] lstrlenA (lpString="*.tar") returned 5 [0048.438] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.gzip") returned 0 [0048.438] lstrlenA (lpString="*.gzip") returned 6 [0048.438] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.jpg") returned 0 [0048.438] lstrlenA (lpString="*.jpg") returned 5 [0048.438] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.jpeg") returned 0 [0048.438] lstrlenA (lpString="*.jpeg") returned 6 [0048.438] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.psd") returned 0 [0048.438] lstrlenA (lpString="*.psd") returned 5 [0048.438] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.gif") returned 0 [0048.438] lstrlenA (lpString="*.gif") returned 5 [0048.438] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.doc") returned 0 [0048.438] lstrlenA (lpString="*.doc") returned 5 [0048.438] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.docx") returned 0 [0048.438] lstrlenA (lpString="*.docx") returned 6 [0048.438] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.xls") returned 0 [0048.438] lstrlenA (lpString="*.xls") returned 5 [0048.438] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.xlsx") returned 0 [0048.439] lstrlenA (lpString="*.xlsx") returned 6 [0048.439] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.ppt") returned 0 [0048.439] lstrlenA (lpString="*.ppt") returned 5 [0048.439] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.pptx") returned 0 [0048.439] lstrlenA (lpString="*.pptx") returned 6 [0048.439] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.pdf") returned 0 [0048.439] lstrlenA (lpString="*.pdf") returned 5 [0048.439] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.mov") returned 0 [0048.439] lstrlenA (lpString="*.mov") returned 5 [0048.439] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.m2v") returned 0 [0048.439] lstrlenA (lpString="*.m2v") returned 5 [0048.439] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.3gp") returned 0 [0048.439] lstrlenA (lpString="*.3gp") returned 5 [0048.439] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.mpeg") returned 0 [0048.439] lstrlenA (lpString="*.mpeg") returned 6 [0048.439] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.mpg") returned 0 [0048.439] lstrlenA (lpString="*.mpg") returned 5 [0048.439] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.flv") returned 0 [0048.439] lstrlenA (lpString="*.flv") returned 5 [0048.439] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.avi") returned 0 [0048.439] lstrlenA (lpString="*.avi") returned 5 [0048.439] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.mp4") returned 0 [0048.439] lstrlenA (lpString="*.mp4") returned 5 [0048.439] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.wmv") returned 0 [0048.439] lstrlenA (lpString="*.wmv") returned 5 [0048.439] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.divx") returned 0 [0048.440] lstrlenA (lpString="*.divx") returned 6 [0048.440] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.mkv") returned 0 [0048.440] lstrlenA (lpString="*.mkv") returned 5 [0048.440] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.mp3") returned 0 [0048.440] lstrlenA (lpString="*.mp3") returned 5 [0048.440] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.wav") returned 0 [0048.440] lstrlenA (lpString="*.wav") returned 5 [0048.440] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.flac") returned 0 [0048.440] lstrlenA (lpString="*.flac") returned 6 [0048.440] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.ape") returned 0 [0048.440] lstrlenA (lpString="*.ape") returned 5 [0048.440] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.wma") returned 0 [0048.440] lstrlenA (lpString="*.wma") returned 5 [0048.440] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.ac3") returned 0 [0048.440] lstrlenA (lpString="*.ac3") returned 5 [0048.440] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", pszSpec="*.mxf") returned 0 [0048.440] lstrlenA (lpString="*.mxf") returned 5 [0048.440] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.440] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.440] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.440] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.440] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.441] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned="EXPEDITN.INF" [0048.441] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\" [0048.441] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\") returned="" [0048.441] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO DECRYPT FILES.txt" [0048.441] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\how to decrypt files.txt")) returned 0x20 [0048.441] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" [0048.441] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.441] lstrlenA (lpString="*.zip") returned 5 [0048.441] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.441] lstrlenA (lpString="*.rar") returned 5 [0048.441] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.441] lstrlenA (lpString="*.7z") returned 4 [0048.441] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.441] lstrlenA (lpString="*.tar") returned 5 [0048.441] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.441] lstrlenA (lpString="*.gzip") returned 6 [0048.441] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.441] lstrlenA (lpString="*.jpg") returned 5 [0048.441] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.441] lstrlenA (lpString="*.jpeg") returned 6 [0048.441] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.441] lstrlenA (lpString="*.psd") returned 5 [0048.442] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.442] lstrlenA (lpString="*.gif") returned 5 [0048.442] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" [0048.442] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" [0048.442] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF." [0048.442] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.wannacry" [0048.442] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.442] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1400 [0048.442] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6f8e30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1 [0048.442] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.442] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1382, lpOverlapped=0x0) returned 1 [0048.445] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.445] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.445] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1382, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1382, lpOverlapped=0x0) returned 1 [0048.445] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.445] CloseHandle (hObject=0x90) returned 1 [0048.456] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.wannacry")) returned 1 [0048.457] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.457] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.457] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.457] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.457] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.457] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.457] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\" [0048.457] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\") returned="" [0048.457] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO DECRYPT FILES.txt" [0048.457] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\how to decrypt files.txt")) returned 0x20 [0048.457] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" [0048.457] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.457] lstrlenA (lpString="*.zip") returned 5 [0048.457] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.457] lstrlenA (lpString="*.rar") returned 5 [0048.457] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.457] lstrlenA (lpString="*.7z") returned 4 [0048.457] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.458] lstrlenA (lpString="*.tar") returned 5 [0048.458] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.458] lstrlenA (lpString="*.gzip") returned 6 [0048.458] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.458] lstrlenA (lpString="*.jpg") returned 5 [0048.458] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.458] lstrlenA (lpString="*.jpeg") returned 6 [0048.458] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.458] lstrlenA (lpString="*.psd") returned 5 [0048.458] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.458] lstrlenA (lpString="*.gif") returned 5 [0048.458] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.458] lstrlenA (lpString="*.doc") returned 5 [0048.458] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.458] lstrlenA (lpString="*.docx") returned 6 [0048.458] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.458] lstrlenA (lpString="*.xls") returned 5 [0048.458] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.458] lstrlenA (lpString="*.xlsx") returned 6 [0048.458] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.458] lstrlenA (lpString="*.ppt") returned 5 [0048.458] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.458] lstrlenA (lpString="*.pptx") returned 6 [0048.458] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.459] lstrlenA (lpString="*.pdf") returned 5 [0048.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.459] lstrlenA (lpString="*.mov") returned 5 [0048.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.459] lstrlenA (lpString="*.m2v") returned 5 [0048.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.459] lstrlenA (lpString="*.3gp") returned 5 [0048.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.459] lstrlenA (lpString="*.mpeg") returned 6 [0048.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.459] lstrlenA (lpString="*.mpg") returned 5 [0048.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.459] lstrlenA (lpString="*.flv") returned 5 [0048.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.459] lstrlenA (lpString="*.avi") returned 5 [0048.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.459] lstrlenA (lpString="*.mp4") returned 5 [0048.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.459] lstrlenA (lpString="*.wmv") returned 5 [0048.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.459] lstrlenA (lpString="*.divx") returned 6 [0048.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.459] lstrlenA (lpString="*.mkv") returned 5 [0048.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.459] lstrlenA (lpString="*.mp3") returned 5 [0048.459] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.460] lstrlenA (lpString="*.wav") returned 5 [0048.460] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.460] lstrlenA (lpString="*.flac") returned 6 [0048.460] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.460] lstrlenA (lpString="*.ape") returned 5 [0048.460] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.460] lstrlenA (lpString="*.wma") returned 5 [0048.460] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.460] lstrlenA (lpString="*.ac3") returned 5 [0048.460] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.460] lstrlenA (lpString="*.mxf") returned 5 [0048.460] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.460] FindClose (in: hFindFile=0x2d80c8 | out: hFindFile=0x2d80c8) returned 1 [0048.460] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ICE", cAlternateFileName="")) returned 1 [0048.460] lstrcmpA (lpString1=".", lpString2="ICE") returned -1 [0048.460] lstrcmpA (lpString1="..", lpString2="ICE") returned -1 [0048.460] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.460] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="ICE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE" [0048.460] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE") returned 59 [0048.461] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x2d80b8 [0048.462] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.462] FindNextFileA (in: hFindFile=0x2d80b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x780000, cFileName="..", cAlternateFileName="")) returned 1 [0048.462] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.462] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.462] FindNextFileA (in: hFindFile=0x2d80b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ee600, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35ee600, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x109d0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ICE.ELM", cAlternateFileName="")) returned 1 [0048.462] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.462] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ICE.ELM") returned -1 [0048.462] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ICE.ELM") returned -1 [0048.462] lstrcmpiA (lpString1="", lpString2="ICE.ELM") returned -1 [0048.462] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*") returned="*.*" [0048.462] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\" [0048.462] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\") returned="" [0048.462] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO DECRYPT FILES.txt" [0048.462] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\how to decrypt files.txt")) returned 0xffffffff [0048.463] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.463] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.463] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.466] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.466] CloseHandle (hObject=0x90) returned 1 [0048.466] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", lpString2="ICE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" [0048.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.zip") returned 0 [0048.466] lstrlenA (lpString="*.zip") returned 5 [0048.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.rar") returned 0 [0048.466] lstrlenA (lpString="*.rar") returned 5 [0048.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.7z") returned 0 [0048.466] lstrlenA (lpString="*.7z") returned 4 [0048.466] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.tar") returned 0 [0048.466] lstrlenA (lpString="*.tar") returned 5 [0048.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.gzip") returned 0 [0048.467] lstrlenA (lpString="*.gzip") returned 6 [0048.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.jpg") returned 0 [0048.467] lstrlenA (lpString="*.jpg") returned 5 [0048.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.jpeg") returned 0 [0048.467] lstrlenA (lpString="*.jpeg") returned 6 [0048.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.psd") returned 0 [0048.467] lstrlenA (lpString="*.psd") returned 5 [0048.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.gif") returned 0 [0048.467] lstrlenA (lpString="*.gif") returned 5 [0048.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.doc") returned 0 [0048.467] lstrlenA (lpString="*.doc") returned 5 [0048.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.docx") returned 0 [0048.467] lstrlenA (lpString="*.docx") returned 6 [0048.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.xls") returned 0 [0048.467] lstrlenA (lpString="*.xls") returned 5 [0048.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.xlsx") returned 0 [0048.467] lstrlenA (lpString="*.xlsx") returned 6 [0048.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.ppt") returned 0 [0048.467] lstrlenA (lpString="*.ppt") returned 5 [0048.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.pptx") returned 0 [0048.467] lstrlenA (lpString="*.pptx") returned 6 [0048.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.pdf") returned 0 [0048.467] lstrlenA (lpString="*.pdf") returned 5 [0048.467] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.mov") returned 0 [0048.467] lstrlenA (lpString="*.mov") returned 5 [0048.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.m2v") returned 0 [0048.468] lstrlenA (lpString="*.m2v") returned 5 [0048.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.3gp") returned 0 [0048.468] lstrlenA (lpString="*.3gp") returned 5 [0048.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.mpeg") returned 0 [0048.468] lstrlenA (lpString="*.mpeg") returned 6 [0048.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.mpg") returned 0 [0048.468] lstrlenA (lpString="*.mpg") returned 5 [0048.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.flv") returned 0 [0048.468] lstrlenA (lpString="*.flv") returned 5 [0048.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.avi") returned 0 [0048.468] lstrlenA (lpString="*.avi") returned 5 [0048.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.mp4") returned 0 [0048.468] lstrlenA (lpString="*.mp4") returned 5 [0048.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.wmv") returned 0 [0048.468] lstrlenA (lpString="*.wmv") returned 5 [0048.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.divx") returned 0 [0048.468] lstrlenA (lpString="*.divx") returned 6 [0048.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.mkv") returned 0 [0048.468] lstrlenA (lpString="*.mkv") returned 5 [0048.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.mp3") returned 0 [0048.468] lstrlenA (lpString="*.mp3") returned 5 [0048.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.wav") returned 0 [0048.468] lstrlenA (lpString="*.wav") returned 5 [0048.468] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.flac") returned 0 [0048.469] lstrlenA (lpString="*.flac") returned 6 [0048.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.ape") returned 0 [0048.469] lstrlenA (lpString="*.ape") returned 5 [0048.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.wma") returned 0 [0048.469] lstrlenA (lpString="*.wma") returned 5 [0048.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.ac3") returned 0 [0048.469] lstrlenA (lpString="*.ac3") returned 5 [0048.469] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", pszSpec="*.mxf") returned 0 [0048.469] lstrlenA (lpString="*.mxf") returned 5 [0048.469] FindNextFileA (in: hFindFile=0x2d80b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x2d83d8, cFileName="ICE.INF", cAlternateFileName="")) returned 1 [0048.469] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.469] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ICE.INF") returned -1 [0048.469] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ICE.INF") returned -1 [0048.469] lstrcmpiA (lpString1="", lpString2="ICE.INF") returned -1 [0048.469] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned="ICE.ELM" [0048.469] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\" [0048.469] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\") returned="" [0048.469] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO DECRYPT FILES.txt" [0048.469] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\how to decrypt files.txt")) returned 0x20 [0048.470] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", lpString2="ICE.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" [0048.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.zip") returned 0 [0048.470] lstrlenA (lpString="*.zip") returned 5 [0048.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.rar") returned 0 [0048.470] lstrlenA (lpString="*.rar") returned 5 [0048.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.7z") returned 0 [0048.470] lstrlenA (lpString="*.7z") returned 4 [0048.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.tar") returned 0 [0048.470] lstrlenA (lpString="*.tar") returned 5 [0048.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.gzip") returned 0 [0048.470] lstrlenA (lpString="*.gzip") returned 6 [0048.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.jpg") returned 0 [0048.470] lstrlenA (lpString="*.jpg") returned 5 [0048.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.jpeg") returned 0 [0048.470] lstrlenA (lpString="*.jpeg") returned 6 [0048.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.psd") returned 0 [0048.470] lstrlenA (lpString="*.psd") returned 5 [0048.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.gif") returned 0 [0048.470] lstrlenA (lpString="*.gif") returned 5 [0048.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.doc") returned 0 [0048.470] lstrlenA (lpString="*.doc") returned 5 [0048.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.docx") returned 0 [0048.470] lstrlenA (lpString="*.docx") returned 6 [0048.470] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.xls") returned 0 [0048.471] lstrlenA (lpString="*.xls") returned 5 [0048.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.xlsx") returned 0 [0048.471] lstrlenA (lpString="*.xlsx") returned 6 [0048.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.ppt") returned 0 [0048.471] lstrlenA (lpString="*.ppt") returned 5 [0048.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.pptx") returned 0 [0048.471] lstrlenA (lpString="*.pptx") returned 6 [0048.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.pdf") returned 0 [0048.471] lstrlenA (lpString="*.pdf") returned 5 [0048.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.mov") returned 0 [0048.471] lstrlenA (lpString="*.mov") returned 5 [0048.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.m2v") returned 0 [0048.471] lstrlenA (lpString="*.m2v") returned 5 [0048.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.3gp") returned 0 [0048.471] lstrlenA (lpString="*.3gp") returned 5 [0048.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.mpeg") returned 0 [0048.471] lstrlenA (lpString="*.mpeg") returned 6 [0048.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.mpg") returned 0 [0048.471] lstrlenA (lpString="*.mpg") returned 5 [0048.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.flv") returned 0 [0048.471] lstrlenA (lpString="*.flv") returned 5 [0048.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.avi") returned 0 [0048.471] lstrlenA (lpString="*.avi") returned 5 [0048.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.mp4") returned 0 [0048.471] lstrlenA (lpString="*.mp4") returned 5 [0048.471] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.wmv") returned 0 [0048.472] lstrlenA (lpString="*.wmv") returned 5 [0048.472] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.divx") returned 0 [0048.472] lstrlenA (lpString="*.divx") returned 6 [0048.472] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.mkv") returned 0 [0048.472] lstrlenA (lpString="*.mkv") returned 5 [0048.472] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.mp3") returned 0 [0048.472] lstrlenA (lpString="*.mp3") returned 5 [0048.472] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.wav") returned 0 [0048.472] lstrlenA (lpString="*.wav") returned 5 [0048.472] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.flac") returned 0 [0048.472] lstrlenA (lpString="*.flac") returned 6 [0048.472] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.ape") returned 0 [0048.472] lstrlenA (lpString="*.ape") returned 5 [0048.472] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.wma") returned 0 [0048.472] lstrlenA (lpString="*.wma") returned 5 [0048.472] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.ac3") returned 0 [0048.472] lstrlenA (lpString="*.ac3") returned 5 [0048.472] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", pszSpec="*.mxf") returned 0 [0048.472] lstrlenA (lpString="*.mxf") returned 5 [0048.472] FindNextFileA (in: hFindFile=0x2d80b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.472] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.472] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.472] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.472] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.472] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned="ICE.INF" [0048.472] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\" [0048.472] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\") returned="" [0048.473] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO DECRYPT FILES.txt" [0048.473] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\how to decrypt files.txt")) returned 0x20 [0048.473] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" [0048.473] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.473] lstrlenA (lpString="*.zip") returned 5 [0048.473] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.473] lstrlenA (lpString="*.rar") returned 5 [0048.473] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.473] lstrlenA (lpString="*.7z") returned 4 [0048.473] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.473] lstrlenA (lpString="*.tar") returned 5 [0048.473] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.473] lstrlenA (lpString="*.gzip") returned 6 [0048.473] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.473] lstrlenA (lpString="*.jpg") returned 5 [0048.473] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.473] lstrlenA (lpString="*.jpeg") returned 6 [0048.473] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.473] lstrlenA (lpString="*.psd") returned 5 [0048.473] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.473] lstrlenA (lpString="*.gif") returned 5 [0048.473] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" [0048.473] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" [0048.474] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF." [0048.474] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.wannacry" [0048.474] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.474] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9f8 [0048.474] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6f8e30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1 [0048.474] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.474] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x97a, lpOverlapped=0x0) returned 1 [0048.479] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.479] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.479] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x97a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x97a, lpOverlapped=0x0) returned 1 [0048.479] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.480] CloseHandle (hObject=0x90) returned 1 [0048.486] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.wannacry")) returned 1 [0048.490] FindNextFileA (in: hFindFile=0x2d80b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.491] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.491] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.491] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.491] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.491] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.491] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\" [0048.491] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\") returned="" [0048.491] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO DECRYPT FILES.txt" [0048.491] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\how to decrypt files.txt")) returned 0x20 [0048.491] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" [0048.491] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.491] lstrlenA (lpString="*.zip") returned 5 [0048.491] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.491] lstrlenA (lpString="*.rar") returned 5 [0048.491] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.491] lstrlenA (lpString="*.7z") returned 4 [0048.491] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.491] lstrlenA (lpString="*.tar") returned 5 [0048.491] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.491] lstrlenA (lpString="*.gzip") returned 6 [0048.491] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.491] lstrlenA (lpString="*.jpg") returned 5 [0048.492] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.492] lstrlenA (lpString="*.jpeg") returned 6 [0048.492] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.492] lstrlenA (lpString="*.psd") returned 5 [0048.492] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.492] lstrlenA (lpString="*.gif") returned 5 [0048.492] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.492] lstrlenA (lpString="*.doc") returned 5 [0048.492] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.492] lstrlenA (lpString="*.docx") returned 6 [0048.492] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.492] lstrlenA (lpString="*.xls") returned 5 [0048.492] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.492] lstrlenA (lpString="*.xlsx") returned 6 [0048.492] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.492] lstrlenA (lpString="*.ppt") returned 5 [0048.492] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.492] lstrlenA (lpString="*.pptx") returned 6 [0048.492] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.492] lstrlenA (lpString="*.pdf") returned 5 [0048.492] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.492] lstrlenA (lpString="*.mov") returned 5 [0048.492] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.492] lstrlenA (lpString="*.m2v") returned 5 [0048.492] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.492] lstrlenA (lpString="*.3gp") returned 5 [0048.492] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.493] lstrlenA (lpString="*.mpeg") returned 6 [0048.493] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.493] lstrlenA (lpString="*.mpg") returned 5 [0048.493] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.493] lstrlenA (lpString="*.flv") returned 5 [0048.493] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.493] lstrlenA (lpString="*.avi") returned 5 [0048.493] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.493] lstrlenA (lpString="*.mp4") returned 5 [0048.493] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.493] lstrlenA (lpString="*.wmv") returned 5 [0048.493] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.493] lstrlenA (lpString="*.divx") returned 6 [0048.493] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.493] lstrlenA (lpString="*.mkv") returned 5 [0048.493] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.493] lstrlenA (lpString="*.mp3") returned 5 [0048.493] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.493] lstrlenA (lpString="*.wav") returned 5 [0048.493] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.493] lstrlenA (lpString="*.flac") returned 6 [0048.493] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.493] lstrlenA (lpString="*.ape") returned 5 [0048.493] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.493] lstrlenA (lpString="*.wma") returned 5 [0048.493] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.494] lstrlenA (lpString="*.ac3") returned 5 [0048.494] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.494] lstrlenA (lpString="*.mxf") returned 5 [0048.494] FindNextFileA (in: hFindFile=0x2d80b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.494] FindClose (in: hFindFile=0x2d80b8 | out: hFindFile=0x2d80b8) returned 1 [0048.494] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="INDUST", cAlternateFileName="")) returned 1 [0048.494] lstrcmpA (lpString1=".", lpString2="INDUST") returned -1 [0048.494] lstrcmpA (lpString1="..", lpString2="INDUST") returned -1 [0048.494] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.494] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="INDUST" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST" [0048.494] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST") returned 62 [0048.494] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0048.495] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.495] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.495] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.496] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.496] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4901300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x539538d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4901300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x184e9, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="INDUST.ELM", cAlternateFileName="")) returned 1 [0048.496] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.496] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="INDUST.ELM") returned -1 [0048.496] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INDUST.ELM") returned -1 [0048.496] lstrcmpiA (lpString1="", lpString2="INDUST.ELM") returned -1 [0048.496] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*") returned="*.*" [0048.496] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\" [0048.496] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\") returned="" [0048.496] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO DECRYPT FILES.txt" [0048.496] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\how to decrypt files.txt")) returned 0xffffffff [0048.496] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.496] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.497] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.498] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.498] CloseHandle (hObject=0x90) returned 1 [0048.498] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", lpString2="INDUST.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" [0048.498] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.zip") returned 0 [0048.498] lstrlenA (lpString="*.zip") returned 5 [0048.498] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.rar") returned 0 [0048.498] lstrlenA (lpString="*.rar") returned 5 [0048.498] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.7z") returned 0 [0048.498] lstrlenA (lpString="*.7z") returned 4 [0048.498] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.tar") returned 0 [0048.498] lstrlenA (lpString="*.tar") returned 5 [0048.498] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.gzip") returned 0 [0048.499] lstrlenA (lpString="*.gzip") returned 6 [0048.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.jpg") returned 0 [0048.499] lstrlenA (lpString="*.jpg") returned 5 [0048.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.jpeg") returned 0 [0048.499] lstrlenA (lpString="*.jpeg") returned 6 [0048.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.psd") returned 0 [0048.499] lstrlenA (lpString="*.psd") returned 5 [0048.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.gif") returned 0 [0048.499] lstrlenA (lpString="*.gif") returned 5 [0048.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.doc") returned 0 [0048.499] lstrlenA (lpString="*.doc") returned 5 [0048.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.docx") returned 0 [0048.499] lstrlenA (lpString="*.docx") returned 6 [0048.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.xls") returned 0 [0048.499] lstrlenA (lpString="*.xls") returned 5 [0048.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.xlsx") returned 0 [0048.499] lstrlenA (lpString="*.xlsx") returned 6 [0048.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.ppt") returned 0 [0048.499] lstrlenA (lpString="*.ppt") returned 5 [0048.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.pptx") returned 0 [0048.499] lstrlenA (lpString="*.pptx") returned 6 [0048.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.pdf") returned 0 [0048.499] lstrlenA (lpString="*.pdf") returned 5 [0048.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.mov") returned 0 [0048.499] lstrlenA (lpString="*.mov") returned 5 [0048.499] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.m2v") returned 0 [0048.500] lstrlenA (lpString="*.m2v") returned 5 [0048.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.3gp") returned 0 [0048.500] lstrlenA (lpString="*.3gp") returned 5 [0048.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.mpeg") returned 0 [0048.500] lstrlenA (lpString="*.mpeg") returned 6 [0048.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.mpg") returned 0 [0048.500] lstrlenA (lpString="*.mpg") returned 5 [0048.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.flv") returned 0 [0048.500] lstrlenA (lpString="*.flv") returned 5 [0048.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.avi") returned 0 [0048.500] lstrlenA (lpString="*.avi") returned 5 [0048.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.mp4") returned 0 [0048.500] lstrlenA (lpString="*.mp4") returned 5 [0048.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.wmv") returned 0 [0048.500] lstrlenA (lpString="*.wmv") returned 5 [0048.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.divx") returned 0 [0048.500] lstrlenA (lpString="*.divx") returned 6 [0048.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.mkv") returned 0 [0048.500] lstrlenA (lpString="*.mkv") returned 5 [0048.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.mp3") returned 0 [0048.500] lstrlenA (lpString="*.mp3") returned 5 [0048.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.wav") returned 0 [0048.500] lstrlenA (lpString="*.wav") returned 5 [0048.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.flac") returned 0 [0048.500] lstrlenA (lpString="*.flac") returned 6 [0048.500] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.ape") returned 0 [0048.501] lstrlenA (lpString="*.ape") returned 5 [0048.501] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.wma") returned 0 [0048.501] lstrlenA (lpString="*.wma") returned 5 [0048.501] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.ac3") returned 0 [0048.501] lstrlenA (lpString="*.ac3") returned 5 [0048.501] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", pszSpec="*.mxf") returned 0 [0048.501] lstrlenA (lpString="*.mxf") returned 5 [0048.501] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x2d83e0, cFileName="INDUST.INF", cAlternateFileName="")) returned 1 [0048.501] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.501] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="INDUST.INF") returned -1 [0048.501] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INDUST.INF") returned -1 [0048.501] lstrcmpiA (lpString1="", lpString2="INDUST.INF") returned -1 [0048.501] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned="INDUST.ELM" [0048.501] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\" [0048.501] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\") returned="" [0048.501] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO DECRYPT FILES.txt" [0048.501] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\how to decrypt files.txt")) returned 0x20 [0048.501] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", lpString2="INDUST.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" [0048.501] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.zip") returned 0 [0048.501] lstrlenA (lpString="*.zip") returned 5 [0048.502] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.rar") returned 0 [0048.502] lstrlenA (lpString="*.rar") returned 5 [0048.502] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.7z") returned 0 [0048.502] lstrlenA (lpString="*.7z") returned 4 [0048.502] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.tar") returned 0 [0048.502] lstrlenA (lpString="*.tar") returned 5 [0048.502] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.gzip") returned 0 [0048.502] lstrlenA (lpString="*.gzip") returned 6 [0048.502] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.jpg") returned 0 [0048.502] lstrlenA (lpString="*.jpg") returned 5 [0048.502] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.jpeg") returned 0 [0048.502] lstrlenA (lpString="*.jpeg") returned 6 [0048.502] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.psd") returned 0 [0048.502] lstrlenA (lpString="*.psd") returned 5 [0048.502] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.gif") returned 0 [0048.502] lstrlenA (lpString="*.gif") returned 5 [0048.502] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.doc") returned 0 [0048.502] lstrlenA (lpString="*.doc") returned 5 [0048.502] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.docx") returned 0 [0048.502] lstrlenA (lpString="*.docx") returned 6 [0048.502] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.xls") returned 0 [0048.502] lstrlenA (lpString="*.xls") returned 5 [0048.502] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.xlsx") returned 0 [0048.502] lstrlenA (lpString="*.xlsx") returned 6 [0048.502] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.ppt") returned 0 [0048.502] lstrlenA (lpString="*.ppt") returned 5 [0048.503] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.pptx") returned 0 [0048.503] lstrlenA (lpString="*.pptx") returned 6 [0048.503] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.pdf") returned 0 [0048.503] lstrlenA (lpString="*.pdf") returned 5 [0048.503] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.mov") returned 0 [0048.503] lstrlenA (lpString="*.mov") returned 5 [0048.503] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.m2v") returned 0 [0048.503] lstrlenA (lpString="*.m2v") returned 5 [0048.503] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.3gp") returned 0 [0048.503] lstrlenA (lpString="*.3gp") returned 5 [0048.503] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.mpeg") returned 0 [0048.503] lstrlenA (lpString="*.mpeg") returned 6 [0048.503] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.mpg") returned 0 [0048.503] lstrlenA (lpString="*.mpg") returned 5 [0048.503] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.flv") returned 0 [0048.503] lstrlenA (lpString="*.flv") returned 5 [0048.503] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.avi") returned 0 [0048.503] lstrlenA (lpString="*.avi") returned 5 [0048.503] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.mp4") returned 0 [0048.503] lstrlenA (lpString="*.mp4") returned 5 [0048.503] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.wmv") returned 0 [0048.503] lstrlenA (lpString="*.wmv") returned 5 [0048.503] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.divx") returned 0 [0048.503] lstrlenA (lpString="*.divx") returned 6 [0048.503] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.mkv") returned 0 [0048.503] lstrlenA (lpString="*.mkv") returned 5 [0048.503] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.mp3") returned 0 [0048.504] lstrlenA (lpString="*.mp3") returned 5 [0048.504] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.wav") returned 0 [0048.504] lstrlenA (lpString="*.wav") returned 5 [0048.504] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.flac") returned 0 [0048.504] lstrlenA (lpString="*.flac") returned 6 [0048.504] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.ape") returned 0 [0048.504] lstrlenA (lpString="*.ape") returned 5 [0048.504] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.wma") returned 0 [0048.504] lstrlenA (lpString="*.wma") returned 5 [0048.504] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.ac3") returned 0 [0048.504] lstrlenA (lpString="*.ac3") returned 5 [0048.504] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", pszSpec="*.mxf") returned 0 [0048.504] lstrlenA (lpString="*.mxf") returned 5 [0048.504] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x143b, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.504] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.504] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.504] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.504] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.504] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned="INDUST.INF" [0048.504] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\" [0048.504] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\") returned="" [0048.504] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO DECRYPT FILES.txt" [0048.504] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\how to decrypt files.txt")) returned 0x20 [0048.505] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" [0048.505] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.505] lstrlenA (lpString="*.zip") returned 5 [0048.505] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.505] lstrlenA (lpString="*.rar") returned 5 [0048.505] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.505] lstrlenA (lpString="*.7z") returned 4 [0048.505] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.505] lstrlenA (lpString="*.tar") returned 5 [0048.505] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.505] lstrlenA (lpString="*.gzip") returned 6 [0048.505] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.505] lstrlenA (lpString="*.jpg") returned 5 [0048.505] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.505] lstrlenA (lpString="*.jpeg") returned 6 [0048.505] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.505] lstrlenA (lpString="*.psd") returned 5 [0048.505] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.505] lstrlenA (lpString="*.gif") returned 5 [0048.505] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" [0048.505] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" [0048.505] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF." [0048.505] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.wannacry" [0048.505] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.506] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x143b [0048.506] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6f8e30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1 [0048.506] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.506] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x13bd, lpOverlapped=0x0) returned 1 [0048.508] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.508] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.508] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x13bd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x13bd, lpOverlapped=0x0) returned 1 [0048.509] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.509] CloseHandle (hObject=0x90) returned 1 [0048.513] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.wannacry")) returned 1 [0048.516] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.516] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.516] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.516] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.516] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.516] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.516] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\" [0048.516] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\") returned="" [0048.516] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO DECRYPT FILES.txt" [0048.516] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\how to decrypt files.txt")) returned 0x20 [0048.516] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" [0048.516] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.516] lstrlenA (lpString="*.zip") returned 5 [0048.516] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.516] lstrlenA (lpString="*.rar") returned 5 [0048.516] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.516] lstrlenA (lpString="*.7z") returned 4 [0048.516] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.516] lstrlenA (lpString="*.tar") returned 5 [0048.516] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.516] lstrlenA (lpString="*.gzip") returned 6 [0048.516] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.517] lstrlenA (lpString="*.jpg") returned 5 [0048.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.517] lstrlenA (lpString="*.jpeg") returned 6 [0048.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.517] lstrlenA (lpString="*.psd") returned 5 [0048.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.517] lstrlenA (lpString="*.gif") returned 5 [0048.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.517] lstrlenA (lpString="*.doc") returned 5 [0048.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.517] lstrlenA (lpString="*.docx") returned 6 [0048.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.517] lstrlenA (lpString="*.xls") returned 5 [0048.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.517] lstrlenA (lpString="*.xlsx") returned 6 [0048.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.517] lstrlenA (lpString="*.ppt") returned 5 [0048.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.517] lstrlenA (lpString="*.pptx") returned 6 [0048.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.517] lstrlenA (lpString="*.pdf") returned 5 [0048.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.517] lstrlenA (lpString="*.mov") returned 5 [0048.517] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.518] lstrlenA (lpString="*.m2v") returned 5 [0048.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.518] lstrlenA (lpString="*.3gp") returned 5 [0048.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.518] lstrlenA (lpString="*.mpeg") returned 6 [0048.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.518] lstrlenA (lpString="*.mpg") returned 5 [0048.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.518] lstrlenA (lpString="*.flv") returned 5 [0048.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.518] lstrlenA (lpString="*.avi") returned 5 [0048.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.518] lstrlenA (lpString="*.mp4") returned 5 [0048.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.518] lstrlenA (lpString="*.wmv") returned 5 [0048.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.518] lstrlenA (lpString="*.divx") returned 6 [0048.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.518] lstrlenA (lpString="*.mkv") returned 5 [0048.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.518] lstrlenA (lpString="*.mp3") returned 5 [0048.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.518] lstrlenA (lpString="*.wav") returned 5 [0048.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.518] lstrlenA (lpString="*.flac") returned 6 [0048.518] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.519] lstrlenA (lpString="*.ape") returned 5 [0048.519] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.519] lstrlenA (lpString="*.wma") returned 5 [0048.519] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.519] lstrlenA (lpString="*.ac3") returned 5 [0048.519] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.519] lstrlenA (lpString="*.mxf") returned 5 [0048.519] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.519] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0048.519] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="IRIS", cAlternateFileName="")) returned 1 [0048.519] lstrcmpA (lpString1=".", lpString2="IRIS") returned -1 [0048.519] lstrcmpA (lpString1="..", lpString2="IRIS") returned -1 [0048.519] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.519] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="IRIS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS" [0048.519] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS") returned 60 [0048.519] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0048.519] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.520] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.520] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.520] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.520] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1015d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="IRIS.ELM", cAlternateFileName="")) returned 1 [0048.520] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.520] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IRIS.ELM") returned -1 [0048.520] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IRIS.ELM") returned -1 [0048.520] lstrcmpiA (lpString1="", lpString2="IRIS.ELM") returned -1 [0048.520] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*") returned="*.*" [0048.520] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\" [0048.520] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\") returned="" [0048.520] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO DECRYPT FILES.txt" [0048.520] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\how to decrypt files.txt")) returned 0xffffffff [0048.520] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.521] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.521] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.522] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.522] CloseHandle (hObject=0x90) returned 1 [0048.522] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", lpString2="IRIS.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" [0048.522] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.zip") returned 0 [0048.522] lstrlenA (lpString="*.zip") returned 5 [0048.522] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.rar") returned 0 [0048.522] lstrlenA (lpString="*.rar") returned 5 [0048.522] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.7z") returned 0 [0048.522] lstrlenA (lpString="*.7z") returned 4 [0048.522] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.tar") returned 0 [0048.523] lstrlenA (lpString="*.tar") returned 5 [0048.523] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.gzip") returned 0 [0048.523] lstrlenA (lpString="*.gzip") returned 6 [0048.523] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.jpg") returned 0 [0048.523] lstrlenA (lpString="*.jpg") returned 5 [0048.523] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.jpeg") returned 0 [0048.523] lstrlenA (lpString="*.jpeg") returned 6 [0048.523] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.psd") returned 0 [0048.523] lstrlenA (lpString="*.psd") returned 5 [0048.523] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.gif") returned 0 [0048.523] lstrlenA (lpString="*.gif") returned 5 [0048.523] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.doc") returned 0 [0048.523] lstrlenA (lpString="*.doc") returned 5 [0048.523] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.docx") returned 0 [0048.523] lstrlenA (lpString="*.docx") returned 6 [0048.523] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.xls") returned 0 [0048.523] lstrlenA (lpString="*.xls") returned 5 [0048.523] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.xlsx") returned 0 [0048.523] lstrlenA (lpString="*.xlsx") returned 6 [0048.523] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.ppt") returned 0 [0048.523] lstrlenA (lpString="*.ppt") returned 5 [0048.523] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.pptx") returned 0 [0048.523] lstrlenA (lpString="*.pptx") returned 6 [0048.523] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.pdf") returned 0 [0048.523] lstrlenA (lpString="*.pdf") returned 5 [0048.523] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.mov") returned 0 [0048.523] lstrlenA (lpString="*.mov") returned 5 [0048.523] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.m2v") returned 0 [0048.524] lstrlenA (lpString="*.m2v") returned 5 [0048.524] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.3gp") returned 0 [0048.524] lstrlenA (lpString="*.3gp") returned 5 [0048.524] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.mpeg") returned 0 [0048.524] lstrlenA (lpString="*.mpeg") returned 6 [0048.524] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.mpg") returned 0 [0048.524] lstrlenA (lpString="*.mpg") returned 5 [0048.524] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.flv") returned 0 [0048.524] lstrlenA (lpString="*.flv") returned 5 [0048.524] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.avi") returned 0 [0048.524] lstrlenA (lpString="*.avi") returned 5 [0048.524] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.mp4") returned 0 [0048.524] lstrlenA (lpString="*.mp4") returned 5 [0048.524] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.wmv") returned 0 [0048.524] lstrlenA (lpString="*.wmv") returned 5 [0048.524] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.divx") returned 0 [0048.524] lstrlenA (lpString="*.divx") returned 6 [0048.524] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.mkv") returned 0 [0048.524] lstrlenA (lpString="*.mkv") returned 5 [0048.524] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.mp3") returned 0 [0048.524] lstrlenA (lpString="*.mp3") returned 5 [0048.524] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.wav") returned 0 [0048.524] lstrlenA (lpString="*.wav") returned 5 [0048.524] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.flac") returned 0 [0048.524] lstrlenA (lpString="*.flac") returned 6 [0048.524] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.ape") returned 0 [0048.524] lstrlenA (lpString="*.ape") returned 5 [0048.525] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.wma") returned 0 [0048.525] lstrlenA (lpString="*.wma") returned 5 [0048.525] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.ac3") returned 0 [0048.525] lstrlenA (lpString="*.ac3") returned 5 [0048.525] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", pszSpec="*.mxf") returned 0 [0048.525] lstrlenA (lpString="*.mxf") returned 5 [0048.525] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x2d83e0, cFileName="IRIS.INF", cAlternateFileName="")) returned 1 [0048.525] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.525] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IRIS.INF") returned -1 [0048.525] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IRIS.INF") returned -1 [0048.525] lstrcmpiA (lpString1="", lpString2="IRIS.INF") returned -1 [0048.525] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned="IRIS.ELM" [0048.525] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\" [0048.525] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\") returned="" [0048.525] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO DECRYPT FILES.txt" [0048.525] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\how to decrypt files.txt")) returned 0x20 [0048.525] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", lpString2="IRIS.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" [0048.525] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.zip") returned 0 [0048.525] lstrlenA (lpString="*.zip") returned 5 [0048.525] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.rar") returned 0 [0048.525] lstrlenA (lpString="*.rar") returned 5 [0048.525] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.7z") returned 0 [0048.525] lstrlenA (lpString="*.7z") returned 4 [0048.526] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.tar") returned 0 [0048.526] lstrlenA (lpString="*.tar") returned 5 [0048.526] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.gzip") returned 0 [0048.526] lstrlenA (lpString="*.gzip") returned 6 [0048.526] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.jpg") returned 0 [0048.526] lstrlenA (lpString="*.jpg") returned 5 [0048.526] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.jpeg") returned 0 [0048.526] lstrlenA (lpString="*.jpeg") returned 6 [0048.526] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.psd") returned 0 [0048.526] lstrlenA (lpString="*.psd") returned 5 [0048.526] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.gif") returned 0 [0048.526] lstrlenA (lpString="*.gif") returned 5 [0048.527] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.doc") returned 0 [0048.527] lstrlenA (lpString="*.doc") returned 5 [0048.527] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.docx") returned 0 [0048.527] lstrlenA (lpString="*.docx") returned 6 [0048.527] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.xls") returned 0 [0048.527] lstrlenA (lpString="*.xls") returned 5 [0048.527] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.xlsx") returned 0 [0048.527] lstrlenA (lpString="*.xlsx") returned 6 [0048.527] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.ppt") returned 0 [0048.527] lstrlenA (lpString="*.ppt") returned 5 [0048.527] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.pptx") returned 0 [0048.527] lstrlenA (lpString="*.pptx") returned 6 [0048.527] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.pdf") returned 0 [0048.527] lstrlenA (lpString="*.pdf") returned 5 [0048.527] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.mov") returned 0 [0048.527] lstrlenA (lpString="*.mov") returned 5 [0048.527] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.m2v") returned 0 [0048.527] lstrlenA (lpString="*.m2v") returned 5 [0048.527] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.3gp") returned 0 [0048.527] lstrlenA (lpString="*.3gp") returned 5 [0048.527] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.mpeg") returned 0 [0048.527] lstrlenA (lpString="*.mpeg") returned 6 [0048.527] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.mpg") returned 0 [0048.527] lstrlenA (lpString="*.mpg") returned 5 [0048.527] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.flv") returned 0 [0048.527] lstrlenA (lpString="*.flv") returned 5 [0048.527] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.avi") returned 0 [0048.528] lstrlenA (lpString="*.avi") returned 5 [0048.528] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.mp4") returned 0 [0048.528] lstrlenA (lpString="*.mp4") returned 5 [0048.528] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.wmv") returned 0 [0048.528] lstrlenA (lpString="*.wmv") returned 5 [0048.528] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.divx") returned 0 [0048.528] lstrlenA (lpString="*.divx") returned 6 [0048.528] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.mkv") returned 0 [0048.528] lstrlenA (lpString="*.mkv") returned 5 [0048.528] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.mp3") returned 0 [0048.528] lstrlenA (lpString="*.mp3") returned 5 [0048.528] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.wav") returned 0 [0048.528] lstrlenA (lpString="*.wav") returned 5 [0048.528] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.flac") returned 0 [0048.528] lstrlenA (lpString="*.flac") returned 6 [0048.528] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.ape") returned 0 [0048.528] lstrlenA (lpString="*.ape") returned 5 [0048.528] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.wma") returned 0 [0048.528] lstrlenA (lpString="*.wma") returned 5 [0048.528] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.ac3") returned 0 [0048.528] lstrlenA (lpString="*.ac3") returned 5 [0048.528] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", pszSpec="*.mxf") returned 0 [0048.528] lstrlenA (lpString="*.mxf") returned 5 [0048.528] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9ac, dwReserved0=0x74, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.528] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.528] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.529] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.529] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.529] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned="IRIS.INF" [0048.529] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\" [0048.529] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\") returned="" [0048.529] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO DECRYPT FILES.txt" [0048.529] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\how to decrypt files.txt")) returned 0x20 [0048.529] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" [0048.529] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.529] lstrlenA (lpString="*.zip") returned 5 [0048.529] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.529] lstrlenA (lpString="*.rar") returned 5 [0048.529] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.529] lstrlenA (lpString="*.7z") returned 4 [0048.529] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.529] lstrlenA (lpString="*.tar") returned 5 [0048.529] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.529] lstrlenA (lpString="*.gzip") returned 6 [0048.529] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.529] lstrlenA (lpString="*.jpg") returned 5 [0048.529] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.529] lstrlenA (lpString="*.jpeg") returned 6 [0048.529] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.529] lstrlenA (lpString="*.psd") returned 5 [0048.530] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.530] lstrlenA (lpString="*.gif") returned 5 [0048.530] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" [0048.530] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" [0048.530] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF." [0048.530] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.wannacry" [0048.530] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.533] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9ac [0048.533] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6f8e30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1 [0048.533] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.533] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x92e, lpOverlapped=0x0) returned 1 [0048.535] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.535] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.535] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x92e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x92e, lpOverlapped=0x0) returned 1 [0048.536] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.536] CloseHandle (hObject=0x90) returned 1 [0048.543] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.wannacry")) returned 1 [0048.546] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.546] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.546] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.546] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.546] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.546] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.546] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\" [0048.546] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\") returned="" [0048.546] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO DECRYPT FILES.txt" [0048.546] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\how to decrypt files.txt")) returned 0x20 [0048.547] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" [0048.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.547] lstrlenA (lpString="*.zip") returned 5 [0048.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.547] lstrlenA (lpString="*.rar") returned 5 [0048.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.547] lstrlenA (lpString="*.7z") returned 4 [0048.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.547] lstrlenA (lpString="*.tar") returned 5 [0048.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.547] lstrlenA (lpString="*.gzip") returned 6 [0048.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.547] lstrlenA (lpString="*.jpg") returned 5 [0048.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.547] lstrlenA (lpString="*.jpeg") returned 6 [0048.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.547] lstrlenA (lpString="*.psd") returned 5 [0048.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.547] lstrlenA (lpString="*.gif") returned 5 [0048.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.547] lstrlenA (lpString="*.doc") returned 5 [0048.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.547] lstrlenA (lpString="*.docx") returned 6 [0048.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.547] lstrlenA (lpString="*.xls") returned 5 [0048.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.547] lstrlenA (lpString="*.xlsx") returned 6 [0048.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.548] lstrlenA (lpString="*.ppt") returned 5 [0048.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.548] lstrlenA (lpString="*.pptx") returned 6 [0048.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.548] lstrlenA (lpString="*.pdf") returned 5 [0048.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.548] lstrlenA (lpString="*.mov") returned 5 [0048.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.548] lstrlenA (lpString="*.m2v") returned 5 [0048.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.548] lstrlenA (lpString="*.3gp") returned 5 [0048.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.548] lstrlenA (lpString="*.mpeg") returned 6 [0048.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.548] lstrlenA (lpString="*.mpg") returned 5 [0048.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.548] lstrlenA (lpString="*.flv") returned 5 [0048.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.548] lstrlenA (lpString="*.avi") returned 5 [0048.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.548] lstrlenA (lpString="*.mp4") returned 5 [0048.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.548] lstrlenA (lpString="*.wmv") returned 5 [0048.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.548] lstrlenA (lpString="*.divx") returned 6 [0048.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.549] lstrlenA (lpString="*.mkv") returned 5 [0048.549] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.549] lstrlenA (lpString="*.mp3") returned 5 [0048.549] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.549] lstrlenA (lpString="*.wav") returned 5 [0048.549] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.549] lstrlenA (lpString="*.flac") returned 6 [0048.549] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.549] lstrlenA (lpString="*.ape") returned 5 [0048.549] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.549] lstrlenA (lpString="*.wma") returned 5 [0048.549] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.549] lstrlenA (lpString="*.ac3") returned 5 [0048.549] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.549] lstrlenA (lpString="*.mxf") returned 5 [0048.549] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.549] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0048.549] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="JOURNAL", cAlternateFileName="")) returned 1 [0048.549] lstrcmpA (lpString1=".", lpString2="JOURNAL") returned -1 [0048.549] lstrcmpA (lpString1="..", lpString2="JOURNAL") returned -1 [0048.549] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.549] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="JOURNAL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL" [0048.550] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL") returned 63 [0048.550] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0048.551] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.551] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.551] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.551] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.551] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8239a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8239a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xba32, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="JOURNAL.ELM", cAlternateFileName="")) returned 1 [0048.551] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.551] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="JOURNAL.ELM") returned -1 [0048.551] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="JOURNAL.ELM") returned -1 [0048.551] lstrcmpiA (lpString1="", lpString2="JOURNAL.ELM") returned -1 [0048.551] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*") returned="*.*" [0048.551] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\" [0048.551] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\") returned="" [0048.551] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO DECRYPT FILES.txt" [0048.551] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\how to decrypt files.txt")) returned 0xffffffff [0048.551] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.552] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.552] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.553] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.553] CloseHandle (hObject=0x90) returned 1 [0048.554] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", lpString2="JOURNAL.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" [0048.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.zip") returned 0 [0048.554] lstrlenA (lpString="*.zip") returned 5 [0048.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.rar") returned 0 [0048.554] lstrlenA (lpString="*.rar") returned 5 [0048.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.7z") returned 0 [0048.554] lstrlenA (lpString="*.7z") returned 4 [0048.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.tar") returned 0 [0048.554] lstrlenA (lpString="*.tar") returned 5 [0048.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.gzip") returned 0 [0048.554] lstrlenA (lpString="*.gzip") returned 6 [0048.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.jpg") returned 0 [0048.554] lstrlenA (lpString="*.jpg") returned 5 [0048.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.jpeg") returned 0 [0048.554] lstrlenA (lpString="*.jpeg") returned 6 [0048.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.psd") returned 0 [0048.554] lstrlenA (lpString="*.psd") returned 5 [0048.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.gif") returned 0 [0048.554] lstrlenA (lpString="*.gif") returned 5 [0048.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.doc") returned 0 [0048.554] lstrlenA (lpString="*.doc") returned 5 [0048.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.docx") returned 0 [0048.554] lstrlenA (lpString="*.docx") returned 6 [0048.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.xls") returned 0 [0048.554] lstrlenA (lpString="*.xls") returned 5 [0048.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.xlsx") returned 0 [0048.555] lstrlenA (lpString="*.xlsx") returned 6 [0048.555] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.ppt") returned 0 [0048.555] lstrlenA (lpString="*.ppt") returned 5 [0048.555] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.pptx") returned 0 [0048.555] lstrlenA (lpString="*.pptx") returned 6 [0048.555] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.pdf") returned 0 [0048.555] lstrlenA (lpString="*.pdf") returned 5 [0048.555] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.mov") returned 0 [0048.555] lstrlenA (lpString="*.mov") returned 5 [0048.555] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.m2v") returned 0 [0048.555] lstrlenA (lpString="*.m2v") returned 5 [0048.555] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.3gp") returned 0 [0048.555] lstrlenA (lpString="*.3gp") returned 5 [0048.555] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.mpeg") returned 0 [0048.555] lstrlenA (lpString="*.mpeg") returned 6 [0048.555] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.mpg") returned 0 [0048.555] lstrlenA (lpString="*.mpg") returned 5 [0048.555] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.flv") returned 0 [0048.555] lstrlenA (lpString="*.flv") returned 5 [0048.555] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.avi") returned 0 [0048.555] lstrlenA (lpString="*.avi") returned 5 [0048.555] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.mp4") returned 0 [0048.555] lstrlenA (lpString="*.mp4") returned 5 [0048.555] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.wmv") returned 0 [0048.555] lstrlenA (lpString="*.wmv") returned 5 [0048.555] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.divx") returned 0 [0048.556] lstrlenA (lpString="*.divx") returned 6 [0048.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.mkv") returned 0 [0048.556] lstrlenA (lpString="*.mkv") returned 5 [0048.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.mp3") returned 0 [0048.556] lstrlenA (lpString="*.mp3") returned 5 [0048.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.wav") returned 0 [0048.556] lstrlenA (lpString="*.wav") returned 5 [0048.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.flac") returned 0 [0048.556] lstrlenA (lpString="*.flac") returned 6 [0048.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.ape") returned 0 [0048.556] lstrlenA (lpString="*.ape") returned 5 [0048.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.wma") returned 0 [0048.556] lstrlenA (lpString="*.wma") returned 5 [0048.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.ac3") returned 0 [0048.556] lstrlenA (lpString="*.ac3") returned 5 [0048.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", pszSpec="*.mxf") returned 0 [0048.556] lstrlenA (lpString="*.mxf") returned 5 [0048.556] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f3, dwReserved0=0x0, dwReserved1=0x2d83e8, cFileName="JOURNAL.INF", cAlternateFileName="")) returned 1 [0048.556] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.556] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="JOURNAL.INF") returned -1 [0048.556] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="JOURNAL.INF") returned -1 [0048.556] lstrcmpiA (lpString1="", lpString2="JOURNAL.INF") returned -1 [0048.556] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned="JOURNAL.ELM" [0048.556] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\" [0048.556] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\") returned="" [0048.557] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO DECRYPT FILES.txt" [0048.557] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\how to decrypt files.txt")) returned 0x20 [0048.557] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", lpString2="JOURNAL.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" [0048.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.zip") returned 0 [0048.557] lstrlenA (lpString="*.zip") returned 5 [0048.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.rar") returned 0 [0048.557] lstrlenA (lpString="*.rar") returned 5 [0048.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.7z") returned 0 [0048.557] lstrlenA (lpString="*.7z") returned 4 [0048.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.tar") returned 0 [0048.557] lstrlenA (lpString="*.tar") returned 5 [0048.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.gzip") returned 0 [0048.557] lstrlenA (lpString="*.gzip") returned 6 [0048.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.jpg") returned 0 [0048.557] lstrlenA (lpString="*.jpg") returned 5 [0048.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.jpeg") returned 0 [0048.557] lstrlenA (lpString="*.jpeg") returned 6 [0048.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.psd") returned 0 [0048.557] lstrlenA (lpString="*.psd") returned 5 [0048.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.gif") returned 0 [0048.557] lstrlenA (lpString="*.gif") returned 5 [0048.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.doc") returned 0 [0048.558] lstrlenA (lpString="*.doc") returned 5 [0048.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.docx") returned 0 [0048.558] lstrlenA (lpString="*.docx") returned 6 [0048.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.xls") returned 0 [0048.558] lstrlenA (lpString="*.xls") returned 5 [0048.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.xlsx") returned 0 [0048.558] lstrlenA (lpString="*.xlsx") returned 6 [0048.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.ppt") returned 0 [0048.558] lstrlenA (lpString="*.ppt") returned 5 [0048.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.pptx") returned 0 [0048.558] lstrlenA (lpString="*.pptx") returned 6 [0048.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.pdf") returned 0 [0048.558] lstrlenA (lpString="*.pdf") returned 5 [0048.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.mov") returned 0 [0048.558] lstrlenA (lpString="*.mov") returned 5 [0048.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.m2v") returned 0 [0048.558] lstrlenA (lpString="*.m2v") returned 5 [0048.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.3gp") returned 0 [0048.558] lstrlenA (lpString="*.3gp") returned 5 [0048.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.mpeg") returned 0 [0048.558] lstrlenA (lpString="*.mpeg") returned 6 [0048.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.mpg") returned 0 [0048.558] lstrlenA (lpString="*.mpg") returned 5 [0048.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.flv") returned 0 [0048.558] lstrlenA (lpString="*.flv") returned 5 [0048.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.avi") returned 0 [0048.559] lstrlenA (lpString="*.avi") returned 5 [0048.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.mp4") returned 0 [0048.559] lstrlenA (lpString="*.mp4") returned 5 [0048.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.wmv") returned 0 [0048.559] lstrlenA (lpString="*.wmv") returned 5 [0048.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.divx") returned 0 [0048.559] lstrlenA (lpString="*.divx") returned 6 [0048.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.mkv") returned 0 [0048.559] lstrlenA (lpString="*.mkv") returned 5 [0048.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.mp3") returned 0 [0048.559] lstrlenA (lpString="*.mp3") returned 5 [0048.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.wav") returned 0 [0048.559] lstrlenA (lpString="*.wav") returned 5 [0048.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.flac") returned 0 [0048.559] lstrlenA (lpString="*.flac") returned 6 [0048.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.ape") returned 0 [0048.559] lstrlenA (lpString="*.ape") returned 5 [0048.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.wma") returned 0 [0048.559] lstrlenA (lpString="*.wma") returned 5 [0048.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.ac3") returned 0 [0048.559] lstrlenA (lpString="*.ac3") returned 5 [0048.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", pszSpec="*.mxf") returned 0 [0048.559] lstrlenA (lpString="*.mxf") returned 5 [0048.559] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.559] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.560] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.560] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.560] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.560] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned="JOURNAL.INF" [0048.560] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\" [0048.560] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\") returned="" [0048.560] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO DECRYPT FILES.txt" [0048.560] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\how to decrypt files.txt")) returned 0x20 [0048.560] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" [0048.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.560] lstrlenA (lpString="*.zip") returned 5 [0048.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.560] lstrlenA (lpString="*.rar") returned 5 [0048.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.560] lstrlenA (lpString="*.7z") returned 4 [0048.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.560] lstrlenA (lpString="*.tar") returned 5 [0048.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.560] lstrlenA (lpString="*.gzip") returned 6 [0048.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.560] lstrlenA (lpString="*.jpg") returned 5 [0048.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.560] lstrlenA (lpString="*.jpeg") returned 6 [0048.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.561] lstrlenA (lpString="*.psd") returned 5 [0048.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.561] lstrlenA (lpString="*.gif") returned 5 [0048.561] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" [0048.561] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" [0048.561] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF." [0048.561] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.wannacry" [0048.561] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.561] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4d0 [0048.561] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6f8e30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1 [0048.561] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.561] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x452, lpOverlapped=0x0) returned 1 [0048.564] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.564] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.564] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x452, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x452, lpOverlapped=0x0) returned 1 [0048.564] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.564] CloseHandle (hObject=0x90) returned 1 [0048.567] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.wannacry")) returned 1 [0048.569] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.569] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.569] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.570] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.570] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.570] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.570] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\" [0048.570] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\") returned="" [0048.570] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO DECRYPT FILES.txt" [0048.570] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\how to decrypt files.txt")) returned 0x20 [0048.570] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" [0048.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.570] lstrlenA (lpString="*.zip") returned 5 [0048.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.570] lstrlenA (lpString="*.rar") returned 5 [0048.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.570] lstrlenA (lpString="*.7z") returned 4 [0048.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.570] lstrlenA (lpString="*.tar") returned 5 [0048.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.570] lstrlenA (lpString="*.gzip") returned 6 [0048.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.570] lstrlenA (lpString="*.jpg") returned 5 [0048.570] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.571] lstrlenA (lpString="*.jpeg") returned 6 [0048.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.571] lstrlenA (lpString="*.psd") returned 5 [0048.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.571] lstrlenA (lpString="*.gif") returned 5 [0048.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.571] lstrlenA (lpString="*.doc") returned 5 [0048.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.571] lstrlenA (lpString="*.docx") returned 6 [0048.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.571] lstrlenA (lpString="*.xls") returned 5 [0048.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.571] lstrlenA (lpString="*.xlsx") returned 6 [0048.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.571] lstrlenA (lpString="*.ppt") returned 5 [0048.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.571] lstrlenA (lpString="*.pptx") returned 6 [0048.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.571] lstrlenA (lpString="*.pdf") returned 5 [0048.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.571] lstrlenA (lpString="*.mov") returned 5 [0048.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.571] lstrlenA (lpString="*.m2v") returned 5 [0048.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.571] lstrlenA (lpString="*.3gp") returned 5 [0048.571] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.571] lstrlenA (lpString="*.mpeg") returned 6 [0048.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.572] lstrlenA (lpString="*.mpg") returned 5 [0048.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.572] lstrlenA (lpString="*.flv") returned 5 [0048.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.572] lstrlenA (lpString="*.avi") returned 5 [0048.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.572] lstrlenA (lpString="*.mp4") returned 5 [0048.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.572] lstrlenA (lpString="*.wmv") returned 5 [0048.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.572] lstrlenA (lpString="*.divx") returned 6 [0048.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.572] lstrlenA (lpString="*.mkv") returned 5 [0048.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.572] lstrlenA (lpString="*.mp3") returned 5 [0048.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.572] lstrlenA (lpString="*.wav") returned 5 [0048.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.572] lstrlenA (lpString="*.flac") returned 6 [0048.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.572] lstrlenA (lpString="*.ape") returned 5 [0048.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.572] lstrlenA (lpString="*.wma") returned 5 [0048.572] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.573] lstrlenA (lpString="*.ac3") returned 5 [0048.573] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.573] lstrlenA (lpString="*.mxf") returned 5 [0048.573] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.573] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0048.573] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="LAYERS", cAlternateFileName="")) returned 1 [0048.573] lstrcmpA (lpString1=".", lpString2="LAYERS") returned -1 [0048.573] lstrcmpA (lpString1="..", lpString2="LAYERS") returned -1 [0048.573] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.573] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="LAYERS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS" [0048.573] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS") returned 62 [0048.573] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0048.575] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.575] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x740000, cFileName="..", cAlternateFileName="")) returned 1 [0048.575] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.575] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.575] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954c700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x954c700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe743, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="LAYERS.ELM", cAlternateFileName="")) returned 1 [0048.575] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.575] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LAYERS.ELM") returned -1 [0048.575] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LAYERS.ELM") returned -1 [0048.575] lstrcmpiA (lpString1="", lpString2="LAYERS.ELM") returned -1 [0048.575] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*") returned="*.*" [0048.575] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\" [0048.575] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\") returned="" [0048.575] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO DECRYPT FILES.txt" [0048.575] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\how to decrypt files.txt")) returned 0xffffffff [0048.575] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.576] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.576] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.577] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.577] CloseHandle (hObject=0x90) returned 1 [0048.578] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", lpString2="LAYERS.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" [0048.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.zip") returned 0 [0048.578] lstrlenA (lpString="*.zip") returned 5 [0048.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.rar") returned 0 [0048.578] lstrlenA (lpString="*.rar") returned 5 [0048.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.7z") returned 0 [0048.578] lstrlenA (lpString="*.7z") returned 4 [0048.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.tar") returned 0 [0048.578] lstrlenA (lpString="*.tar") returned 5 [0048.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.gzip") returned 0 [0048.578] lstrlenA (lpString="*.gzip") returned 6 [0048.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.jpg") returned 0 [0048.578] lstrlenA (lpString="*.jpg") returned 5 [0048.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.jpeg") returned 0 [0048.578] lstrlenA (lpString="*.jpeg") returned 6 [0048.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.psd") returned 0 [0048.578] lstrlenA (lpString="*.psd") returned 5 [0048.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.gif") returned 0 [0048.578] lstrlenA (lpString="*.gif") returned 5 [0048.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.doc") returned 0 [0048.578] lstrlenA (lpString="*.doc") returned 5 [0048.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.docx") returned 0 [0048.578] lstrlenA (lpString="*.docx") returned 6 [0048.578] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.xls") returned 0 [0048.579] lstrlenA (lpString="*.xls") returned 5 [0048.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.xlsx") returned 0 [0048.579] lstrlenA (lpString="*.xlsx") returned 6 [0048.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.ppt") returned 0 [0048.579] lstrlenA (lpString="*.ppt") returned 5 [0048.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.pptx") returned 0 [0048.579] lstrlenA (lpString="*.pptx") returned 6 [0048.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.pdf") returned 0 [0048.579] lstrlenA (lpString="*.pdf") returned 5 [0048.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.mov") returned 0 [0048.579] lstrlenA (lpString="*.mov") returned 5 [0048.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.m2v") returned 0 [0048.579] lstrlenA (lpString="*.m2v") returned 5 [0048.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.3gp") returned 0 [0048.579] lstrlenA (lpString="*.3gp") returned 5 [0048.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.mpeg") returned 0 [0048.579] lstrlenA (lpString="*.mpeg") returned 6 [0048.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.mpg") returned 0 [0048.579] lstrlenA (lpString="*.mpg") returned 5 [0048.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.flv") returned 0 [0048.579] lstrlenA (lpString="*.flv") returned 5 [0048.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.avi") returned 0 [0048.579] lstrlenA (lpString="*.avi") returned 5 [0048.579] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.mp4") returned 0 [0048.579] lstrlenA (lpString="*.mp4") returned 5 [0048.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.wmv") returned 0 [0048.580] lstrlenA (lpString="*.wmv") returned 5 [0048.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.divx") returned 0 [0048.580] lstrlenA (lpString="*.divx") returned 6 [0048.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.mkv") returned 0 [0048.580] lstrlenA (lpString="*.mkv") returned 5 [0048.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.mp3") returned 0 [0048.580] lstrlenA (lpString="*.mp3") returned 5 [0048.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.wav") returned 0 [0048.580] lstrlenA (lpString="*.wav") returned 5 [0048.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.flac") returned 0 [0048.580] lstrlenA (lpString="*.flac") returned 6 [0048.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.ape") returned 0 [0048.580] lstrlenA (lpString="*.ape") returned 5 [0048.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.wma") returned 0 [0048.580] lstrlenA (lpString="*.wma") returned 5 [0048.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.ac3") returned 0 [0048.580] lstrlenA (lpString="*.ac3") returned 5 [0048.580] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", pszSpec="*.mxf") returned 0 [0048.580] lstrlenA (lpString="*.mxf") returned 5 [0048.580] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x215, dwReserved0=0x0, dwReserved1=0x2d83e0, cFileName="LAYERS.INF", cAlternateFileName="")) returned 1 [0048.580] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.580] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LAYERS.INF") returned -1 [0048.580] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LAYERS.INF") returned -1 [0048.580] lstrcmpiA (lpString1="", lpString2="LAYERS.INF") returned -1 [0048.581] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned="LAYERS.ELM" [0048.581] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\" [0048.581] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\") returned="" [0048.581] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO DECRYPT FILES.txt" [0048.581] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\how to decrypt files.txt")) returned 0x20 [0048.581] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", lpString2="LAYERS.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" [0048.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.zip") returned 0 [0048.581] lstrlenA (lpString="*.zip") returned 5 [0048.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.rar") returned 0 [0048.581] lstrlenA (lpString="*.rar") returned 5 [0048.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.7z") returned 0 [0048.581] lstrlenA (lpString="*.7z") returned 4 [0048.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.tar") returned 0 [0048.581] lstrlenA (lpString="*.tar") returned 5 [0048.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.gzip") returned 0 [0048.581] lstrlenA (lpString="*.gzip") returned 6 [0048.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.jpg") returned 0 [0048.581] lstrlenA (lpString="*.jpg") returned 5 [0048.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.jpeg") returned 0 [0048.581] lstrlenA (lpString="*.jpeg") returned 6 [0048.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.psd") returned 0 [0048.581] lstrlenA (lpString="*.psd") returned 5 [0048.581] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.gif") returned 0 [0048.582] lstrlenA (lpString="*.gif") returned 5 [0048.582] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.doc") returned 0 [0048.582] lstrlenA (lpString="*.doc") returned 5 [0048.582] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.docx") returned 0 [0048.582] lstrlenA (lpString="*.docx") returned 6 [0048.582] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.xls") returned 0 [0048.582] lstrlenA (lpString="*.xls") returned 5 [0048.582] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.xlsx") returned 0 [0048.582] lstrlenA (lpString="*.xlsx") returned 6 [0048.582] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.ppt") returned 0 [0048.582] lstrlenA (lpString="*.ppt") returned 5 [0048.582] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.pptx") returned 0 [0048.582] lstrlenA (lpString="*.pptx") returned 6 [0048.582] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.pdf") returned 0 [0048.582] lstrlenA (lpString="*.pdf") returned 5 [0048.582] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.mov") returned 0 [0048.582] lstrlenA (lpString="*.mov") returned 5 [0048.582] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.m2v") returned 0 [0048.582] lstrlenA (lpString="*.m2v") returned 5 [0048.582] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.3gp") returned 0 [0048.582] lstrlenA (lpString="*.3gp") returned 5 [0048.582] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.mpeg") returned 0 [0048.582] lstrlenA (lpString="*.mpeg") returned 6 [0048.582] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.mpg") returned 0 [0048.582] lstrlenA (lpString="*.mpg") returned 5 [0048.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.flv") returned 0 [0048.583] lstrlenA (lpString="*.flv") returned 5 [0048.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.avi") returned 0 [0048.583] lstrlenA (lpString="*.avi") returned 5 [0048.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.mp4") returned 0 [0048.583] lstrlenA (lpString="*.mp4") returned 5 [0048.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.wmv") returned 0 [0048.583] lstrlenA (lpString="*.wmv") returned 5 [0048.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.divx") returned 0 [0048.583] lstrlenA (lpString="*.divx") returned 6 [0048.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.mkv") returned 0 [0048.583] lstrlenA (lpString="*.mkv") returned 5 [0048.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.mp3") returned 0 [0048.583] lstrlenA (lpString="*.mp3") returned 5 [0048.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.wav") returned 0 [0048.583] lstrlenA (lpString="*.wav") returned 5 [0048.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.flac") returned 0 [0048.583] lstrlenA (lpString="*.flac") returned 6 [0048.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.ape") returned 0 [0048.583] lstrlenA (lpString="*.ape") returned 5 [0048.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.wma") returned 0 [0048.583] lstrlenA (lpString="*.wma") returned 5 [0048.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.ac3") returned 0 [0048.583] lstrlenA (lpString="*.ac3") returned 5 [0048.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", pszSpec="*.mxf") returned 0 [0048.584] lstrlenA (lpString="*.mxf") returned 5 [0048.584] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x67b, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.584] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.584] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.584] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.584] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.584] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned="LAYERS.INF" [0048.584] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\" [0048.584] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\") returned="" [0048.584] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO DECRYPT FILES.txt" [0048.584] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\how to decrypt files.txt")) returned 0x20 [0048.584] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" [0048.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.584] lstrlenA (lpString="*.zip") returned 5 [0048.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.584] lstrlenA (lpString="*.rar") returned 5 [0048.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.584] lstrlenA (lpString="*.7z") returned 4 [0048.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.584] lstrlenA (lpString="*.tar") returned 5 [0048.584] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.584] lstrlenA (lpString="*.gzip") returned 6 [0048.585] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.585] lstrlenA (lpString="*.jpg") returned 5 [0048.585] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.585] lstrlenA (lpString="*.jpeg") returned 6 [0048.585] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.585] lstrlenA (lpString="*.psd") returned 5 [0048.585] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.585] lstrlenA (lpString="*.gif") returned 5 [0048.585] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" [0048.585] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" [0048.585] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF." [0048.585] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.wannacry" [0048.585] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.585] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x67b [0048.585] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6f8e30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1 [0048.586] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.586] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x5fd, lpOverlapped=0x0) returned 1 [0048.588] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.588] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.588] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x5fd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x5fd, lpOverlapped=0x0) returned 1 [0048.588] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.588] CloseHandle (hObject=0x90) returned 1 [0048.589] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.wannacry")) returned 1 [0048.592] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.592] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.592] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.592] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.592] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.592] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.592] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\" [0048.593] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\") returned="" [0048.593] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO DECRYPT FILES.txt" [0048.593] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\how to decrypt files.txt")) returned 0x20 [0048.593] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" [0048.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.593] lstrlenA (lpString="*.zip") returned 5 [0048.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.593] lstrlenA (lpString="*.rar") returned 5 [0048.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.593] lstrlenA (lpString="*.7z") returned 4 [0048.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.593] lstrlenA (lpString="*.tar") returned 5 [0048.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.593] lstrlenA (lpString="*.gzip") returned 6 [0048.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.593] lstrlenA (lpString="*.jpg") returned 5 [0048.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.593] lstrlenA (lpString="*.jpeg") returned 6 [0048.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.593] lstrlenA (lpString="*.psd") returned 5 [0048.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.593] lstrlenA (lpString="*.gif") returned 5 [0048.593] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.594] lstrlenA (lpString="*.doc") returned 5 [0048.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.594] lstrlenA (lpString="*.docx") returned 6 [0048.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.594] lstrlenA (lpString="*.xls") returned 5 [0048.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.594] lstrlenA (lpString="*.xlsx") returned 6 [0048.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.594] lstrlenA (lpString="*.ppt") returned 5 [0048.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.594] lstrlenA (lpString="*.pptx") returned 6 [0048.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.594] lstrlenA (lpString="*.pdf") returned 5 [0048.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.594] lstrlenA (lpString="*.mov") returned 5 [0048.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.594] lstrlenA (lpString="*.m2v") returned 5 [0048.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.594] lstrlenA (lpString="*.3gp") returned 5 [0048.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.594] lstrlenA (lpString="*.mpeg") returned 6 [0048.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.594] lstrlenA (lpString="*.mpg") returned 5 [0048.594] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.594] lstrlenA (lpString="*.flv") returned 5 [0048.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.595] lstrlenA (lpString="*.avi") returned 5 [0048.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.595] lstrlenA (lpString="*.mp4") returned 5 [0048.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.595] lstrlenA (lpString="*.wmv") returned 5 [0048.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.595] lstrlenA (lpString="*.divx") returned 6 [0048.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.595] lstrlenA (lpString="*.mkv") returned 5 [0048.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.595] lstrlenA (lpString="*.mp3") returned 5 [0048.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.595] lstrlenA (lpString="*.wav") returned 5 [0048.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.595] lstrlenA (lpString="*.flac") returned 6 [0048.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.595] lstrlenA (lpString="*.ape") returned 5 [0048.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.595] lstrlenA (lpString="*.wma") returned 5 [0048.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.595] lstrlenA (lpString="*.ac3") returned 5 [0048.595] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.595] lstrlenA (lpString="*.mxf") returned 5 [0048.595] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.596] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0048.596] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0048.596] lstrcmpA (lpString1=".", lpString2="LEVEL") returned -1 [0048.596] lstrcmpA (lpString1="..", lpString2="LEVEL") returned -1 [0048.596] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.596] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="LEVEL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL" [0048.596] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL") returned 61 [0048.596] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0048.596] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.596] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.596] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.596] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.596] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85f400, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa85f400, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe2ec, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="LEVEL.ELM", cAlternateFileName="")) returned 1 [0048.596] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.596] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LEVEL.ELM") returned -1 [0048.597] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LEVEL.ELM") returned -1 [0048.597] lstrcmpiA (lpString1="", lpString2="LEVEL.ELM") returned -1 [0048.597] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*") returned="*.*" [0048.597] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\" [0048.597] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\") returned="" [0048.597] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO DECRYPT FILES.txt" [0048.597] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\how to decrypt files.txt")) returned 0xffffffff [0048.597] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.597] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.597] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.598] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.599] CloseHandle (hObject=0x90) returned 1 [0048.599] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", lpString2="LEVEL.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" [0048.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.zip") returned 0 [0048.599] lstrlenA (lpString="*.zip") returned 5 [0048.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.rar") returned 0 [0048.599] lstrlenA (lpString="*.rar") returned 5 [0048.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.7z") returned 0 [0048.599] lstrlenA (lpString="*.7z") returned 4 [0048.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.tar") returned 0 [0048.599] lstrlenA (lpString="*.tar") returned 5 [0048.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.gzip") returned 0 [0048.599] lstrlenA (lpString="*.gzip") returned 6 [0048.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.jpg") returned 0 [0048.599] lstrlenA (lpString="*.jpg") returned 5 [0048.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.jpeg") returned 0 [0048.599] lstrlenA (lpString="*.jpeg") returned 6 [0048.599] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.psd") returned 0 [0048.599] lstrlenA (lpString="*.psd") returned 5 [0048.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.gif") returned 0 [0048.600] lstrlenA (lpString="*.gif") returned 5 [0048.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.doc") returned 0 [0048.600] lstrlenA (lpString="*.doc") returned 5 [0048.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.docx") returned 0 [0048.600] lstrlenA (lpString="*.docx") returned 6 [0048.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.xls") returned 0 [0048.600] lstrlenA (lpString="*.xls") returned 5 [0048.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.xlsx") returned 0 [0048.600] lstrlenA (lpString="*.xlsx") returned 6 [0048.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.ppt") returned 0 [0048.600] lstrlenA (lpString="*.ppt") returned 5 [0048.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.pptx") returned 0 [0048.600] lstrlenA (lpString="*.pptx") returned 6 [0048.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.pdf") returned 0 [0048.600] lstrlenA (lpString="*.pdf") returned 5 [0048.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.mov") returned 0 [0048.600] lstrlenA (lpString="*.mov") returned 5 [0048.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.m2v") returned 0 [0048.600] lstrlenA (lpString="*.m2v") returned 5 [0048.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.3gp") returned 0 [0048.600] lstrlenA (lpString="*.3gp") returned 5 [0048.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.mpeg") returned 0 [0048.600] lstrlenA (lpString="*.mpeg") returned 6 [0048.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.mpg") returned 0 [0048.600] lstrlenA (lpString="*.mpg") returned 5 [0048.600] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.flv") returned 0 [0048.600] lstrlenA (lpString="*.flv") returned 5 [0048.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.avi") returned 0 [0048.601] lstrlenA (lpString="*.avi") returned 5 [0048.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.mp4") returned 0 [0048.601] lstrlenA (lpString="*.mp4") returned 5 [0048.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.wmv") returned 0 [0048.601] lstrlenA (lpString="*.wmv") returned 5 [0048.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.divx") returned 0 [0048.601] lstrlenA (lpString="*.divx") returned 6 [0048.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.mkv") returned 0 [0048.601] lstrlenA (lpString="*.mkv") returned 5 [0048.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.mp3") returned 0 [0048.601] lstrlenA (lpString="*.mp3") returned 5 [0048.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.wav") returned 0 [0048.601] lstrlenA (lpString="*.wav") returned 5 [0048.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.flac") returned 0 [0048.601] lstrlenA (lpString="*.flac") returned 6 [0048.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.ape") returned 0 [0048.601] lstrlenA (lpString="*.ape") returned 5 [0048.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.wma") returned 0 [0048.601] lstrlenA (lpString="*.wma") returned 5 [0048.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.ac3") returned 0 [0048.601] lstrlenA (lpString="*.ac3") returned 5 [0048.601] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", pszSpec="*.mxf") returned 0 [0048.601] lstrlenA (lpString="*.mxf") returned 5 [0048.601] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x20e, dwReserved0=0x0, dwReserved1=0x2d83e0, cFileName="LEVEL.INF", cAlternateFileName="")) returned 1 [0048.601] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.601] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LEVEL.INF") returned -1 [0048.601] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LEVEL.INF") returned -1 [0048.602] lstrcmpiA (lpString1="", lpString2="LEVEL.INF") returned -1 [0048.602] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned="LEVEL.ELM" [0048.602] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\" [0048.602] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\") returned="" [0048.602] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO DECRYPT FILES.txt" [0048.602] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\how to decrypt files.txt")) returned 0x20 [0048.602] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", lpString2="LEVEL.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" [0048.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.zip") returned 0 [0048.602] lstrlenA (lpString="*.zip") returned 5 [0048.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.rar") returned 0 [0048.602] lstrlenA (lpString="*.rar") returned 5 [0048.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.7z") returned 0 [0048.602] lstrlenA (lpString="*.7z") returned 4 [0048.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.tar") returned 0 [0048.602] lstrlenA (lpString="*.tar") returned 5 [0048.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.gzip") returned 0 [0048.602] lstrlenA (lpString="*.gzip") returned 6 [0048.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.jpg") returned 0 [0048.602] lstrlenA (lpString="*.jpg") returned 5 [0048.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.jpeg") returned 0 [0048.602] lstrlenA (lpString="*.jpeg") returned 6 [0048.602] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.psd") returned 0 [0048.602] lstrlenA (lpString="*.psd") returned 5 [0048.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.gif") returned 0 [0048.603] lstrlenA (lpString="*.gif") returned 5 [0048.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.doc") returned 0 [0048.603] lstrlenA (lpString="*.doc") returned 5 [0048.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.docx") returned 0 [0048.603] lstrlenA (lpString="*.docx") returned 6 [0048.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.xls") returned 0 [0048.603] lstrlenA (lpString="*.xls") returned 5 [0048.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.xlsx") returned 0 [0048.603] lstrlenA (lpString="*.xlsx") returned 6 [0048.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.ppt") returned 0 [0048.603] lstrlenA (lpString="*.ppt") returned 5 [0048.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.pptx") returned 0 [0048.603] lstrlenA (lpString="*.pptx") returned 6 [0048.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.pdf") returned 0 [0048.603] lstrlenA (lpString="*.pdf") returned 5 [0048.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.mov") returned 0 [0048.603] lstrlenA (lpString="*.mov") returned 5 [0048.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.m2v") returned 0 [0048.603] lstrlenA (lpString="*.m2v") returned 5 [0048.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.3gp") returned 0 [0048.603] lstrlenA (lpString="*.3gp") returned 5 [0048.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.mpeg") returned 0 [0048.603] lstrlenA (lpString="*.mpeg") returned 6 [0048.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.mpg") returned 0 [0048.603] lstrlenA (lpString="*.mpg") returned 5 [0048.603] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.flv") returned 0 [0048.604] lstrlenA (lpString="*.flv") returned 5 [0048.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.avi") returned 0 [0048.604] lstrlenA (lpString="*.avi") returned 5 [0048.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.mp4") returned 0 [0048.604] lstrlenA (lpString="*.mp4") returned 5 [0048.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.wmv") returned 0 [0048.604] lstrlenA (lpString="*.wmv") returned 5 [0048.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.divx") returned 0 [0048.604] lstrlenA (lpString="*.divx") returned 6 [0048.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.mkv") returned 0 [0048.604] lstrlenA (lpString="*.mkv") returned 5 [0048.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.mp3") returned 0 [0048.604] lstrlenA (lpString="*.mp3") returned 5 [0048.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.wav") returned 0 [0048.604] lstrlenA (lpString="*.wav") returned 5 [0048.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.flac") returned 0 [0048.604] lstrlenA (lpString="*.flac") returned 6 [0048.604] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.ape") returned 0 [0048.604] lstrlenA (lpString="*.ape") returned 5 [0048.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.wma") returned 0 [0048.605] lstrlenA (lpString="*.wma") returned 5 [0048.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.ac3") returned 0 [0048.605] lstrlenA (lpString="*.ac3") returned 5 [0048.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", pszSpec="*.mxf") returned 0 [0048.605] lstrlenA (lpString="*.mxf") returned 5 [0048.605] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x740078, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.605] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.605] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.605] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.605] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.605] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned="LEVEL.INF" [0048.605] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\" [0048.605] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\") returned="" [0048.605] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO DECRYPT FILES.txt" [0048.605] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\how to decrypt files.txt")) returned 0x20 [0048.605] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" [0048.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.605] lstrlenA (lpString="*.zip") returned 5 [0048.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.605] lstrlenA (lpString="*.rar") returned 5 [0048.605] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.605] lstrlenA (lpString="*.7z") returned 4 [0048.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.606] lstrlenA (lpString="*.tar") returned 5 [0048.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.606] lstrlenA (lpString="*.gzip") returned 6 [0048.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.606] lstrlenA (lpString="*.jpg") returned 5 [0048.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.606] lstrlenA (lpString="*.jpeg") returned 6 [0048.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.606] lstrlenA (lpString="*.psd") returned 5 [0048.606] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.606] lstrlenA (lpString="*.gif") returned 5 [0048.606] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" [0048.606] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" [0048.606] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF." [0048.606] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.wannacry" [0048.606] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.607] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x563 [0048.607] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6f8e30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1 [0048.607] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.608] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4e5, lpOverlapped=0x0) returned 1 [0048.610] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.610] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.610] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4e5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4e5, lpOverlapped=0x0) returned 1 [0048.610] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.610] CloseHandle (hObject=0x90) returned 1 [0048.614] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.wannacry")) returned 1 [0048.616] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.616] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.616] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.616] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.616] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.617] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.617] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\" [0048.617] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\") returned="" [0048.617] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO DECRYPT FILES.txt" [0048.617] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\how to decrypt files.txt")) returned 0x20 [0048.617] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" [0048.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.617] lstrlenA (lpString="*.zip") returned 5 [0048.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.617] lstrlenA (lpString="*.rar") returned 5 [0048.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.617] lstrlenA (lpString="*.7z") returned 4 [0048.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.617] lstrlenA (lpString="*.tar") returned 5 [0048.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.617] lstrlenA (lpString="*.gzip") returned 6 [0048.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.617] lstrlenA (lpString="*.jpg") returned 5 [0048.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.617] lstrlenA (lpString="*.jpeg") returned 6 [0048.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.617] lstrlenA (lpString="*.psd") returned 5 [0048.617] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.618] lstrlenA (lpString="*.gif") returned 5 [0048.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.618] lstrlenA (lpString="*.doc") returned 5 [0048.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.618] lstrlenA (lpString="*.docx") returned 6 [0048.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.618] lstrlenA (lpString="*.xls") returned 5 [0048.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.618] lstrlenA (lpString="*.xlsx") returned 6 [0048.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.618] lstrlenA (lpString="*.ppt") returned 5 [0048.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.618] lstrlenA (lpString="*.pptx") returned 6 [0048.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.618] lstrlenA (lpString="*.pdf") returned 5 [0048.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.618] lstrlenA (lpString="*.mov") returned 5 [0048.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.618] lstrlenA (lpString="*.m2v") returned 5 [0048.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.618] lstrlenA (lpString="*.3gp") returned 5 [0048.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.618] lstrlenA (lpString="*.mpeg") returned 6 [0048.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.618] lstrlenA (lpString="*.mpg") returned 5 [0048.618] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.619] lstrlenA (lpString="*.flv") returned 5 [0048.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.619] lstrlenA (lpString="*.avi") returned 5 [0048.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.619] lstrlenA (lpString="*.mp4") returned 5 [0048.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.619] lstrlenA (lpString="*.wmv") returned 5 [0048.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.619] lstrlenA (lpString="*.divx") returned 6 [0048.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.619] lstrlenA (lpString="*.mkv") returned 5 [0048.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.619] lstrlenA (lpString="*.mp3") returned 5 [0048.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.619] lstrlenA (lpString="*.wav") returned 5 [0048.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.619] lstrlenA (lpString="*.flac") returned 6 [0048.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.619] lstrlenA (lpString="*.ape") returned 5 [0048.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.619] lstrlenA (lpString="*.wma") returned 5 [0048.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.619] lstrlenA (lpString="*.ac3") returned 5 [0048.619] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.619] lstrlenA (lpString="*.mxf") returned 5 [0048.619] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.628] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0048.628] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0048.628] lstrcmpA (lpString1=".", lpString2="NETWORK") returned -1 [0048.628] lstrcmpA (lpString1="..", lpString2="NETWORK") returned -1 [0048.628] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.628] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="NETWORK" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK" [0048.628] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK") returned 63 [0048.628] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740078, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0048.629] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.629] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.629] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.629] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.629] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107bd500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x107bd500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xc649, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="NETWORK.ELM", cAlternateFileName="")) returned 1 [0048.629] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.629] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NETWORK.ELM") returned -1 [0048.629] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NETWORK.ELM") returned -1 [0048.629] lstrcmpiA (lpString1="", lpString2="NETWORK.ELM") returned -1 [0048.629] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*") returned="*.*" [0048.629] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\" [0048.629] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\") returned="" [0048.629] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO DECRYPT FILES.txt" [0048.629] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\how to decrypt files.txt")) returned 0xffffffff [0048.629] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.630] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.630] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.631] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.631] CloseHandle (hObject=0x90) returned 1 [0048.632] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", lpString2="NETWORK.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" [0048.632] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.zip") returned 0 [0048.632] lstrlenA (lpString="*.zip") returned 5 [0048.632] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.rar") returned 0 [0048.632] lstrlenA (lpString="*.rar") returned 5 [0048.632] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.7z") returned 0 [0048.632] lstrlenA (lpString="*.7z") returned 4 [0048.632] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.tar") returned 0 [0048.632] lstrlenA (lpString="*.tar") returned 5 [0048.632] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.gzip") returned 0 [0048.632] lstrlenA (lpString="*.gzip") returned 6 [0048.632] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.jpg") returned 0 [0048.632] lstrlenA (lpString="*.jpg") returned 5 [0048.632] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.jpeg") returned 0 [0048.632] lstrlenA (lpString="*.jpeg") returned 6 [0048.632] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.psd") returned 0 [0048.632] lstrlenA (lpString="*.psd") returned 5 [0048.632] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.gif") returned 0 [0048.632] lstrlenA (lpString="*.gif") returned 5 [0048.632] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.doc") returned 0 [0048.632] lstrlenA (lpString="*.doc") returned 5 [0048.632] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.docx") returned 0 [0048.633] lstrlenA (lpString="*.docx") returned 6 [0048.633] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.xls") returned 0 [0048.633] lstrlenA (lpString="*.xls") returned 5 [0048.633] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.xlsx") returned 0 [0048.633] lstrlenA (lpString="*.xlsx") returned 6 [0048.633] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.ppt") returned 0 [0048.633] lstrlenA (lpString="*.ppt") returned 5 [0048.633] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.pptx") returned 0 [0048.633] lstrlenA (lpString="*.pptx") returned 6 [0048.633] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.pdf") returned 0 [0048.633] lstrlenA (lpString="*.pdf") returned 5 [0048.633] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.mov") returned 0 [0048.633] lstrlenA (lpString="*.mov") returned 5 [0048.633] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.m2v") returned 0 [0048.633] lstrlenA (lpString="*.m2v") returned 5 [0048.633] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.3gp") returned 0 [0048.633] lstrlenA (lpString="*.3gp") returned 5 [0048.633] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.mpeg") returned 0 [0048.633] lstrlenA (lpString="*.mpeg") returned 6 [0048.633] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.mpg") returned 0 [0048.633] lstrlenA (lpString="*.mpg") returned 5 [0048.633] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.flv") returned 0 [0048.634] lstrlenA (lpString="*.flv") returned 5 [0048.634] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.avi") returned 0 [0048.634] lstrlenA (lpString="*.avi") returned 5 [0048.634] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.mp4") returned 0 [0048.634] lstrlenA (lpString="*.mp4") returned 5 [0048.634] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.wmv") returned 0 [0048.634] lstrlenA (lpString="*.wmv") returned 5 [0048.634] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.divx") returned 0 [0048.634] lstrlenA (lpString="*.divx") returned 6 [0048.634] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.mkv") returned 0 [0048.634] lstrlenA (lpString="*.mkv") returned 5 [0048.634] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.mp3") returned 0 [0048.634] lstrlenA (lpString="*.mp3") returned 5 [0048.634] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.wav") returned 0 [0048.634] lstrlenA (lpString="*.wav") returned 5 [0048.634] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.flac") returned 0 [0048.634] lstrlenA (lpString="*.flac") returned 6 [0048.634] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.ape") returned 0 [0048.634] lstrlenA (lpString="*.ape") returned 5 [0048.634] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.wma") returned 0 [0048.634] lstrlenA (lpString="*.wma") returned 5 [0048.634] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.ac3") returned 0 [0048.634] lstrlenA (lpString="*.ac3") returned 5 [0048.635] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", pszSpec="*.mxf") returned 0 [0048.635] lstrlenA (lpString="*.mxf") returned 5 [0048.635] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x2d83e8, cFileName="NETWORK.INF", cAlternateFileName="")) returned 1 [0048.635] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.635] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NETWORK.INF") returned -1 [0048.635] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NETWORK.INF") returned -1 [0048.635] lstrcmpiA (lpString1="", lpString2="NETWORK.INF") returned -1 [0048.635] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned="NETWORK.ELM" [0048.635] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\" [0048.635] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\") returned="" [0048.635] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO DECRYPT FILES.txt" [0048.635] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\how to decrypt files.txt")) returned 0x20 [0048.636] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", lpString2="NETWORK.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" [0048.636] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.zip") returned 0 [0048.636] lstrlenA (lpString="*.zip") returned 5 [0048.636] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.rar") returned 0 [0048.636] lstrlenA (lpString="*.rar") returned 5 [0048.636] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.7z") returned 0 [0048.636] lstrlenA (lpString="*.7z") returned 4 [0048.636] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.tar") returned 0 [0048.636] lstrlenA (lpString="*.tar") returned 5 [0048.636] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.gzip") returned 0 [0048.636] lstrlenA (lpString="*.gzip") returned 6 [0048.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.jpg") returned 0 [0048.637] lstrlenA (lpString="*.jpg") returned 5 [0048.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.jpeg") returned 0 [0048.637] lstrlenA (lpString="*.jpeg") returned 6 [0048.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.psd") returned 0 [0048.637] lstrlenA (lpString="*.psd") returned 5 [0048.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.gif") returned 0 [0048.637] lstrlenA (lpString="*.gif") returned 5 [0048.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.doc") returned 0 [0048.637] lstrlenA (lpString="*.doc") returned 5 [0048.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.docx") returned 0 [0048.637] lstrlenA (lpString="*.docx") returned 6 [0048.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.xls") returned 0 [0048.637] lstrlenA (lpString="*.xls") returned 5 [0048.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.xlsx") returned 0 [0048.637] lstrlenA (lpString="*.xlsx") returned 6 [0048.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.ppt") returned 0 [0048.637] lstrlenA (lpString="*.ppt") returned 5 [0048.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.pptx") returned 0 [0048.637] lstrlenA (lpString="*.pptx") returned 6 [0048.637] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.pdf") returned 0 [0048.638] lstrlenA (lpString="*.pdf") returned 5 [0048.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.mov") returned 0 [0048.638] lstrlenA (lpString="*.mov") returned 5 [0048.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.m2v") returned 0 [0048.638] lstrlenA (lpString="*.m2v") returned 5 [0048.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.3gp") returned 0 [0048.638] lstrlenA (lpString="*.3gp") returned 5 [0048.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.mpeg") returned 0 [0048.638] lstrlenA (lpString="*.mpeg") returned 6 [0048.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.mpg") returned 0 [0048.638] lstrlenA (lpString="*.mpg") returned 5 [0048.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.flv") returned 0 [0048.638] lstrlenA (lpString="*.flv") returned 5 [0048.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.avi") returned 0 [0048.638] lstrlenA (lpString="*.avi") returned 5 [0048.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.mp4") returned 0 [0048.638] lstrlenA (lpString="*.mp4") returned 5 [0048.638] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.wmv") returned 0 [0048.638] lstrlenA (lpString="*.wmv") returned 5 [0048.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.divx") returned 0 [0048.639] lstrlenA (lpString="*.divx") returned 6 [0048.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.mkv") returned 0 [0048.639] lstrlenA (lpString="*.mkv") returned 5 [0048.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.mp3") returned 0 [0048.639] lstrlenA (lpString="*.mp3") returned 5 [0048.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.wav") returned 0 [0048.639] lstrlenA (lpString="*.wav") returned 5 [0048.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.flac") returned 0 [0048.639] lstrlenA (lpString="*.flac") returned 6 [0048.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.ape") returned 0 [0048.639] lstrlenA (lpString="*.ape") returned 5 [0048.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.wma") returned 0 [0048.639] lstrlenA (lpString="*.wma") returned 5 [0048.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.ac3") returned 0 [0048.639] lstrlenA (lpString="*.ac3") returned 5 [0048.639] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", pszSpec="*.mxf") returned 0 [0048.639] lstrlenA (lpString="*.mxf") returned 5 [0048.639] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.639] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.639] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.639] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.640] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.640] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned="NETWORK.INF" [0048.640] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\" [0048.640] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\") returned="" [0048.640] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO DECRYPT FILES.txt" [0048.640] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\how to decrypt files.txt")) returned 0x20 [0048.640] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" [0048.640] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.640] lstrlenA (lpString="*.zip") returned 5 [0048.640] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.640] lstrlenA (lpString="*.rar") returned 5 [0048.640] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.640] lstrlenA (lpString="*.7z") returned 4 [0048.640] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.640] lstrlenA (lpString="*.tar") returned 5 [0048.640] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.641] lstrlenA (lpString="*.gzip") returned 6 [0048.641] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.641] lstrlenA (lpString="*.jpg") returned 5 [0048.641] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.641] lstrlenA (lpString="*.jpeg") returned 6 [0048.641] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.641] lstrlenA (lpString="*.psd") returned 5 [0048.641] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.641] lstrlenA (lpString="*.gif") returned 5 [0048.641] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" [0048.641] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" [0048.642] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF." [0048.642] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.wannacry" [0048.642] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.642] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x554 [0048.642] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6f8e30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1 [0048.642] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.642] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4d6, lpOverlapped=0x0) returned 1 [0048.644] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.644] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.644] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4d6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4d6, lpOverlapped=0x0) returned 1 [0048.644] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.644] CloseHandle (hObject=0x90) returned 1 [0048.655] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.wannacry")) returned 1 [0048.658] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.658] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.658] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.659] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.659] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.659] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.659] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\" [0048.659] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\") returned="" [0048.659] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO DECRYPT FILES.txt" [0048.659] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\how to decrypt files.txt")) returned 0x20 [0048.659] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" [0048.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.659] lstrlenA (lpString="*.zip") returned 5 [0048.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.659] lstrlenA (lpString="*.rar") returned 5 [0048.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.659] lstrlenA (lpString="*.7z") returned 4 [0048.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.659] lstrlenA (lpString="*.tar") returned 5 [0048.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.659] lstrlenA (lpString="*.gzip") returned 6 [0048.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.659] lstrlenA (lpString="*.jpg") returned 5 [0048.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.660] lstrlenA (lpString="*.jpeg") returned 6 [0048.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.660] lstrlenA (lpString="*.psd") returned 5 [0048.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.660] lstrlenA (lpString="*.gif") returned 5 [0048.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.660] lstrlenA (lpString="*.doc") returned 5 [0048.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.660] lstrlenA (lpString="*.docx") returned 6 [0048.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.660] lstrlenA (lpString="*.xls") returned 5 [0048.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.660] lstrlenA (lpString="*.xlsx") returned 6 [0048.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.660] lstrlenA (lpString="*.ppt") returned 5 [0048.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.660] lstrlenA (lpString="*.pptx") returned 6 [0048.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.660] lstrlenA (lpString="*.pdf") returned 5 [0048.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.660] lstrlenA (lpString="*.mov") returned 5 [0048.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.660] lstrlenA (lpString="*.m2v") returned 5 [0048.660] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.660] lstrlenA (lpString="*.3gp") returned 5 [0048.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.661] lstrlenA (lpString="*.mpeg") returned 6 [0048.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.661] lstrlenA (lpString="*.mpg") returned 5 [0048.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.661] lstrlenA (lpString="*.flv") returned 5 [0048.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.661] lstrlenA (lpString="*.avi") returned 5 [0048.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.661] lstrlenA (lpString="*.mp4") returned 5 [0048.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.661] lstrlenA (lpString="*.wmv") returned 5 [0048.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.661] lstrlenA (lpString="*.divx") returned 6 [0048.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.661] lstrlenA (lpString="*.mkv") returned 5 [0048.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.661] lstrlenA (lpString="*.mp3") returned 5 [0048.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.661] lstrlenA (lpString="*.wav") returned 5 [0048.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.661] lstrlenA (lpString="*.flac") returned 6 [0048.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.661] lstrlenA (lpString="*.ape") returned 5 [0048.661] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.662] lstrlenA (lpString="*.wma") returned 5 [0048.662] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.662] lstrlenA (lpString="*.ac3") returned 5 [0048.662] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.662] lstrlenA (lpString="*.mxf") returned 5 [0048.662] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.662] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0048.662] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="PAPYRUS", cAlternateFileName="")) returned 1 [0048.662] lstrcmpA (lpString1=".", lpString2="PAPYRUS") returned -1 [0048.662] lstrcmpA (lpString1="..", lpString2="PAPYRUS") returned -1 [0048.662] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.662] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="PAPYRUS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS" [0048.662] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS") returned 63 [0048.662] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0048.664] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.664] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x740000, cFileName="..", cAlternateFileName="")) returned 1 [0048.664] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.664] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.664] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x140f5c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x140f5c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x166d5, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PAPYRUS.ELM", cAlternateFileName="")) returned 1 [0048.664] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.664] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PAPYRUS.ELM") returned -1 [0048.664] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PAPYRUS.ELM") returned -1 [0048.664] lstrcmpiA (lpString1="", lpString2="PAPYRUS.ELM") returned -1 [0048.664] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*") returned="*.*" [0048.664] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\" [0048.664] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\") returned="" [0048.664] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO DECRYPT FILES.txt" [0048.664] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\how to decrypt files.txt")) returned 0xffffffff [0048.664] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.665] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.665] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.666] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.666] CloseHandle (hObject=0x90) returned 1 [0048.666] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", lpString2="PAPYRUS.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" [0048.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.zip") returned 0 [0048.667] lstrlenA (lpString="*.zip") returned 5 [0048.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.rar") returned 0 [0048.667] lstrlenA (lpString="*.rar") returned 5 [0048.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.7z") returned 0 [0048.667] lstrlenA (lpString="*.7z") returned 4 [0048.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.tar") returned 0 [0048.667] lstrlenA (lpString="*.tar") returned 5 [0048.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.gzip") returned 0 [0048.667] lstrlenA (lpString="*.gzip") returned 6 [0048.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.jpg") returned 0 [0048.667] lstrlenA (lpString="*.jpg") returned 5 [0048.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.jpeg") returned 0 [0048.667] lstrlenA (lpString="*.jpeg") returned 6 [0048.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.psd") returned 0 [0048.667] lstrlenA (lpString="*.psd") returned 5 [0048.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.gif") returned 0 [0048.667] lstrlenA (lpString="*.gif") returned 5 [0048.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.doc") returned 0 [0048.667] lstrlenA (lpString="*.doc") returned 5 [0048.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.docx") returned 0 [0048.667] lstrlenA (lpString="*.docx") returned 6 [0048.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.xls") returned 0 [0048.667] lstrlenA (lpString="*.xls") returned 5 [0048.667] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.xlsx") returned 0 [0048.668] lstrlenA (lpString="*.xlsx") returned 6 [0048.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.ppt") returned 0 [0048.668] lstrlenA (lpString="*.ppt") returned 5 [0048.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.pptx") returned 0 [0048.668] lstrlenA (lpString="*.pptx") returned 6 [0048.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.pdf") returned 0 [0048.668] lstrlenA (lpString="*.pdf") returned 5 [0048.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.mov") returned 0 [0048.668] lstrlenA (lpString="*.mov") returned 5 [0048.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.m2v") returned 0 [0048.668] lstrlenA (lpString="*.m2v") returned 5 [0048.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.3gp") returned 0 [0048.668] lstrlenA (lpString="*.3gp") returned 5 [0048.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.mpeg") returned 0 [0048.668] lstrlenA (lpString="*.mpeg") returned 6 [0048.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.mpg") returned 0 [0048.668] lstrlenA (lpString="*.mpg") returned 5 [0048.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.flv") returned 0 [0048.668] lstrlenA (lpString="*.flv") returned 5 [0048.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.avi") returned 0 [0048.668] lstrlenA (lpString="*.avi") returned 5 [0048.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.mp4") returned 0 [0048.668] lstrlenA (lpString="*.mp4") returned 5 [0048.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.wmv") returned 0 [0048.668] lstrlenA (lpString="*.wmv") returned 5 [0048.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.divx") returned 0 [0048.668] lstrlenA (lpString="*.divx") returned 6 [0048.668] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.mkv") returned 0 [0048.669] lstrlenA (lpString="*.mkv") returned 5 [0048.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.mp3") returned 0 [0048.669] lstrlenA (lpString="*.mp3") returned 5 [0048.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.wav") returned 0 [0048.669] lstrlenA (lpString="*.wav") returned 5 [0048.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.flac") returned 0 [0048.669] lstrlenA (lpString="*.flac") returned 6 [0048.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.ape") returned 0 [0048.669] lstrlenA (lpString="*.ape") returned 5 [0048.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.wma") returned 0 [0048.669] lstrlenA (lpString="*.wma") returned 5 [0048.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.ac3") returned 0 [0048.669] lstrlenA (lpString="*.ac3") returned 5 [0048.669] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", pszSpec="*.mxf") returned 0 [0048.669] lstrlenA (lpString="*.mxf") returned 5 [0048.669] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x2d83e8, cFileName="PAPYRUS.INF", cAlternateFileName="")) returned 1 [0048.669] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.669] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PAPYRUS.INF") returned -1 [0048.669] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PAPYRUS.INF") returned -1 [0048.669] lstrcmpiA (lpString1="", lpString2="PAPYRUS.INF") returned -1 [0048.669] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned="PAPYRUS.ELM" [0048.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\" [0048.669] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\") returned="" [0048.669] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO DECRYPT FILES.txt" [0048.670] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\how to decrypt files.txt")) returned 0x20 [0048.670] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", lpString2="PAPYRUS.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" [0048.670] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.zip") returned 0 [0048.670] lstrlenA (lpString="*.zip") returned 5 [0048.670] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.rar") returned 0 [0048.670] lstrlenA (lpString="*.rar") returned 5 [0048.670] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.7z") returned 0 [0048.670] lstrlenA (lpString="*.7z") returned 4 [0048.670] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.tar") returned 0 [0048.670] lstrlenA (lpString="*.tar") returned 5 [0048.670] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.gzip") returned 0 [0048.670] lstrlenA (lpString="*.gzip") returned 6 [0048.670] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.jpg") returned 0 [0048.670] lstrlenA (lpString="*.jpg") returned 5 [0048.670] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.jpeg") returned 0 [0048.670] lstrlenA (lpString="*.jpeg") returned 6 [0048.670] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.psd") returned 0 [0048.670] lstrlenA (lpString="*.psd") returned 5 [0048.670] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.gif") returned 0 [0048.670] lstrlenA (lpString="*.gif") returned 5 [0048.670] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.doc") returned 0 [0048.670] lstrlenA (lpString="*.doc") returned 5 [0048.670] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.docx") returned 0 [0048.671] lstrlenA (lpString="*.docx") returned 6 [0048.671] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.xls") returned 0 [0048.671] lstrlenA (lpString="*.xls") returned 5 [0048.671] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.xlsx") returned 0 [0048.671] lstrlenA (lpString="*.xlsx") returned 6 [0048.671] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.ppt") returned 0 [0048.671] lstrlenA (lpString="*.ppt") returned 5 [0048.671] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.pptx") returned 0 [0048.671] lstrlenA (lpString="*.pptx") returned 6 [0048.671] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.pdf") returned 0 [0048.671] lstrlenA (lpString="*.pdf") returned 5 [0048.671] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.mov") returned 0 [0048.671] lstrlenA (lpString="*.mov") returned 5 [0048.671] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.m2v") returned 0 [0048.671] lstrlenA (lpString="*.m2v") returned 5 [0048.671] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.3gp") returned 0 [0048.671] lstrlenA (lpString="*.3gp") returned 5 [0048.671] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.mpeg") returned 0 [0048.671] lstrlenA (lpString="*.mpeg") returned 6 [0048.671] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.mpg") returned 0 [0048.671] lstrlenA (lpString="*.mpg") returned 5 [0048.671] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.flv") returned 0 [0048.671] lstrlenA (lpString="*.flv") returned 5 [0048.671] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.avi") returned 0 [0048.671] lstrlenA (lpString="*.avi") returned 5 [0048.671] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.mp4") returned 0 [0048.671] lstrlenA (lpString="*.mp4") returned 5 [0048.672] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.wmv") returned 0 [0048.672] lstrlenA (lpString="*.wmv") returned 5 [0048.672] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.divx") returned 0 [0048.672] lstrlenA (lpString="*.divx") returned 6 [0048.672] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.mkv") returned 0 [0048.672] lstrlenA (lpString="*.mkv") returned 5 [0048.672] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.mp3") returned 0 [0048.672] lstrlenA (lpString="*.mp3") returned 5 [0048.672] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.wav") returned 0 [0048.672] lstrlenA (lpString="*.wav") returned 5 [0048.672] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.flac") returned 0 [0048.672] lstrlenA (lpString="*.flac") returned 6 [0048.672] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.ape") returned 0 [0048.672] lstrlenA (lpString="*.ape") returned 5 [0048.672] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.wma") returned 0 [0048.672] lstrlenA (lpString="*.wma") returned 5 [0048.672] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.ac3") returned 0 [0048.672] lstrlenA (lpString="*.ac3") returned 5 [0048.672] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", pszSpec="*.mxf") returned 0 [0048.672] lstrlenA (lpString="*.mxf") returned 5 [0048.672] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa0e, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.672] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.672] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.672] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.672] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.672] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned="PAPYRUS.INF" [0048.673] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\" [0048.673] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\") returned="" [0048.673] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO DECRYPT FILES.txt" [0048.673] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\how to decrypt files.txt")) returned 0x20 [0048.673] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" [0048.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.673] lstrlenA (lpString="*.zip") returned 5 [0048.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.673] lstrlenA (lpString="*.rar") returned 5 [0048.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.673] lstrlenA (lpString="*.7z") returned 4 [0048.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.673] lstrlenA (lpString="*.tar") returned 5 [0048.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.673] lstrlenA (lpString="*.gzip") returned 6 [0048.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.673] lstrlenA (lpString="*.jpg") returned 5 [0048.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.673] lstrlenA (lpString="*.jpeg") returned 6 [0048.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.673] lstrlenA (lpString="*.psd") returned 5 [0048.673] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.674] lstrlenA (lpString="*.gif") returned 5 [0048.674] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" [0048.674] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" [0048.674] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF." [0048.674] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.wannacry" [0048.674] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.674] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa0e [0048.674] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6f8e30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1 [0048.674] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.674] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x990, lpOverlapped=0x0) returned 1 [0048.676] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.676] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.676] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x990, lpOverlapped=0x0) returned 1 [0048.677] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.677] CloseHandle (hObject=0x90) returned 1 [0048.679] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.wannacry")) returned 1 [0048.682] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.682] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.682] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.682] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.682] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.682] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.682] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\" [0048.682] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\") returned="" [0048.682] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO DECRYPT FILES.txt" [0048.682] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\how to decrypt files.txt")) returned 0x20 [0048.682] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" [0048.682] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.682] lstrlenA (lpString="*.zip") returned 5 [0048.682] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.683] lstrlenA (lpString="*.rar") returned 5 [0048.683] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.683] lstrlenA (lpString="*.7z") returned 4 [0048.683] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.683] lstrlenA (lpString="*.tar") returned 5 [0048.683] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.683] lstrlenA (lpString="*.gzip") returned 6 [0048.683] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.683] lstrlenA (lpString="*.jpg") returned 5 [0048.683] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.683] lstrlenA (lpString="*.jpeg") returned 6 [0048.683] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.683] lstrlenA (lpString="*.psd") returned 5 [0048.683] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.683] lstrlenA (lpString="*.gif") returned 5 [0048.683] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.683] lstrlenA (lpString="*.doc") returned 5 [0048.683] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.683] lstrlenA (lpString="*.docx") returned 6 [0048.683] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.683] lstrlenA (lpString="*.xls") returned 5 [0048.683] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.683] lstrlenA (lpString="*.xlsx") returned 6 [0048.683] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.683] lstrlenA (lpString="*.ppt") returned 5 [0048.683] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.683] lstrlenA (lpString="*.pptx") returned 6 [0048.684] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.684] lstrlenA (lpString="*.pdf") returned 5 [0048.684] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.684] lstrlenA (lpString="*.mov") returned 5 [0048.684] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.684] lstrlenA (lpString="*.m2v") returned 5 [0048.684] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.684] lstrlenA (lpString="*.3gp") returned 5 [0048.684] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.684] lstrlenA (lpString="*.mpeg") returned 6 [0048.684] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.684] lstrlenA (lpString="*.mpg") returned 5 [0048.684] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.684] lstrlenA (lpString="*.flv") returned 5 [0048.684] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.684] lstrlenA (lpString="*.avi") returned 5 [0048.684] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.684] lstrlenA (lpString="*.mp4") returned 5 [0048.684] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.684] lstrlenA (lpString="*.wmv") returned 5 [0048.684] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.684] lstrlenA (lpString="*.divx") returned 6 [0048.685] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.685] lstrlenA (lpString="*.mkv") returned 5 [0048.685] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.685] lstrlenA (lpString="*.mp3") returned 5 [0048.685] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.685] lstrlenA (lpString="*.wav") returned 5 [0048.685] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.685] lstrlenA (lpString="*.flac") returned 6 [0048.685] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.685] lstrlenA (lpString="*.ape") returned 5 [0048.685] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.685] lstrlenA (lpString="*.wma") returned 5 [0048.685] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.685] lstrlenA (lpString="*.ac3") returned 5 [0048.685] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.685] lstrlenA (lpString="*.mxf") returned 5 [0048.685] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.685] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0048.685] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="PIXEL", cAlternateFileName="")) returned 1 [0048.686] lstrcmpA (lpString1=".", lpString2="PIXEL") returned -1 [0048.686] lstrcmpA (lpString1="..", lpString2="PIXEL") returned -1 [0048.686] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.686] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="PIXEL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL" [0048.686] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL") returned 61 [0048.686] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0048.686] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.686] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x740000, cFileName="..", cAlternateFileName="")) returned 1 [0048.686] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.686] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.686] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a2e300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a2e300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd0e5, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PIXEL.ELM", cAlternateFileName="")) returned 1 [0048.686] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.686] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PIXEL.ELM") returned -1 [0048.686] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PIXEL.ELM") returned -1 [0048.687] lstrcmpiA (lpString1="", lpString2="PIXEL.ELM") returned -1 [0048.687] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*") returned="*.*" [0048.687] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\" [0048.687] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\") returned="" [0048.687] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO DECRYPT FILES.txt" [0048.687] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\how to decrypt files.txt")) returned 0xffffffff [0048.687] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.687] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.687] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.689] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.689] CloseHandle (hObject=0x90) returned 1 [0048.689] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", lpString2="PIXEL.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" [0048.689] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.zip") returned 0 [0048.689] lstrlenA (lpString="*.zip") returned 5 [0048.689] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.rar") returned 0 [0048.689] lstrlenA (lpString="*.rar") returned 5 [0048.689] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.7z") returned 0 [0048.689] lstrlenA (lpString="*.7z") returned 4 [0048.689] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.tar") returned 0 [0048.689] lstrlenA (lpString="*.tar") returned 5 [0048.690] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.gzip") returned 0 [0048.690] lstrlenA (lpString="*.gzip") returned 6 [0048.690] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.jpg") returned 0 [0048.690] lstrlenA (lpString="*.jpg") returned 5 [0048.690] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.jpeg") returned 0 [0048.690] lstrlenA (lpString="*.jpeg") returned 6 [0048.690] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.psd") returned 0 [0048.690] lstrlenA (lpString="*.psd") returned 5 [0048.690] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.gif") returned 0 [0048.690] lstrlenA (lpString="*.gif") returned 5 [0048.690] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.doc") returned 0 [0048.690] lstrlenA (lpString="*.doc") returned 5 [0048.690] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.docx") returned 0 [0048.690] lstrlenA (lpString="*.docx") returned 6 [0048.690] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.xls") returned 0 [0048.690] lstrlenA (lpString="*.xls") returned 5 [0048.690] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.xlsx") returned 0 [0048.690] lstrlenA (lpString="*.xlsx") returned 6 [0048.690] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.ppt") returned 0 [0048.690] lstrlenA (lpString="*.ppt") returned 5 [0048.690] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.pptx") returned 0 [0048.690] lstrlenA (lpString="*.pptx") returned 6 [0048.690] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.pdf") returned 0 [0048.690] lstrlenA (lpString="*.pdf") returned 5 [0048.690] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.mov") returned 0 [0048.691] lstrlenA (lpString="*.mov") returned 5 [0048.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.m2v") returned 0 [0048.691] lstrlenA (lpString="*.m2v") returned 5 [0048.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.3gp") returned 0 [0048.691] lstrlenA (lpString="*.3gp") returned 5 [0048.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.mpeg") returned 0 [0048.691] lstrlenA (lpString="*.mpeg") returned 6 [0048.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.mpg") returned 0 [0048.691] lstrlenA (lpString="*.mpg") returned 5 [0048.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.flv") returned 0 [0048.691] lstrlenA (lpString="*.flv") returned 5 [0048.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.avi") returned 0 [0048.691] lstrlenA (lpString="*.avi") returned 5 [0048.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.mp4") returned 0 [0048.691] lstrlenA (lpString="*.mp4") returned 5 [0048.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.wmv") returned 0 [0048.691] lstrlenA (lpString="*.wmv") returned 5 [0048.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.divx") returned 0 [0048.691] lstrlenA (lpString="*.divx") returned 6 [0048.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.mkv") returned 0 [0048.691] lstrlenA (lpString="*.mkv") returned 5 [0048.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.mp3") returned 0 [0048.691] lstrlenA (lpString="*.mp3") returned 5 [0048.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.wav") returned 0 [0048.691] lstrlenA (lpString="*.wav") returned 5 [0048.691] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.flac") returned 0 [0048.691] lstrlenA (lpString="*.flac") returned 6 [0048.692] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.ape") returned 0 [0048.692] lstrlenA (lpString="*.ape") returned 5 [0048.692] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.wma") returned 0 [0048.692] lstrlenA (lpString="*.wma") returned 5 [0048.692] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.ac3") returned 0 [0048.692] lstrlenA (lpString="*.ac3") returned 5 [0048.692] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", pszSpec="*.mxf") returned 0 [0048.692] lstrlenA (lpString="*.mxf") returned 5 [0048.692] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x0, dwReserved1=0x2d83e0, cFileName="PIXEL.INF", cAlternateFileName="")) returned 1 [0048.692] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.692] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PIXEL.INF") returned -1 [0048.692] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PIXEL.INF") returned -1 [0048.692] lstrcmpiA (lpString1="", lpString2="PIXEL.INF") returned -1 [0048.692] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned="PIXEL.ELM" [0048.692] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\" [0048.692] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\") returned="" [0048.692] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO DECRYPT FILES.txt" [0048.692] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\how to decrypt files.txt")) returned 0x20 [0048.692] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", lpString2="PIXEL.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" [0048.692] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.zip") returned 0 [0048.692] lstrlenA (lpString="*.zip") returned 5 [0048.692] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.rar") returned 0 [0048.693] lstrlenA (lpString="*.rar") returned 5 [0048.693] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.7z") returned 0 [0048.693] lstrlenA (lpString="*.7z") returned 4 [0048.693] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.tar") returned 0 [0048.693] lstrlenA (lpString="*.tar") returned 5 [0048.693] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.gzip") returned 0 [0048.693] lstrlenA (lpString="*.gzip") returned 6 [0048.693] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.jpg") returned 0 [0048.693] lstrlenA (lpString="*.jpg") returned 5 [0048.693] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.jpeg") returned 0 [0048.693] lstrlenA (lpString="*.jpeg") returned 6 [0048.693] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.psd") returned 0 [0048.693] lstrlenA (lpString="*.psd") returned 5 [0048.693] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.gif") returned 0 [0048.693] lstrlenA (lpString="*.gif") returned 5 [0048.693] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.doc") returned 0 [0048.693] lstrlenA (lpString="*.doc") returned 5 [0048.693] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.docx") returned 0 [0048.693] lstrlenA (lpString="*.docx") returned 6 [0048.693] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.xls") returned 0 [0048.693] lstrlenA (lpString="*.xls") returned 5 [0048.693] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.xlsx") returned 0 [0048.693] lstrlenA (lpString="*.xlsx") returned 6 [0048.693] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.ppt") returned 0 [0048.693] lstrlenA (lpString="*.ppt") returned 5 [0048.693] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.pptx") returned 0 [0048.693] lstrlenA (lpString="*.pptx") returned 6 [0048.693] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.pdf") returned 0 [0048.694] lstrlenA (lpString="*.pdf") returned 5 [0048.694] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.mov") returned 0 [0048.694] lstrlenA (lpString="*.mov") returned 5 [0048.694] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.m2v") returned 0 [0048.694] lstrlenA (lpString="*.m2v") returned 5 [0048.694] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.3gp") returned 0 [0048.694] lstrlenA (lpString="*.3gp") returned 5 [0048.694] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.mpeg") returned 0 [0048.694] lstrlenA (lpString="*.mpeg") returned 6 [0048.694] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.mpg") returned 0 [0048.694] lstrlenA (lpString="*.mpg") returned 5 [0048.694] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.flv") returned 0 [0048.694] lstrlenA (lpString="*.flv") returned 5 [0048.694] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.avi") returned 0 [0048.694] lstrlenA (lpString="*.avi") returned 5 [0048.694] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.mp4") returned 0 [0048.694] lstrlenA (lpString="*.mp4") returned 5 [0048.694] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.wmv") returned 0 [0048.694] lstrlenA (lpString="*.wmv") returned 5 [0048.694] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.divx") returned 0 [0048.694] lstrlenA (lpString="*.divx") returned 6 [0048.694] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.mkv") returned 0 [0048.694] lstrlenA (lpString="*.mkv") returned 5 [0048.694] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.mp3") returned 0 [0048.694] lstrlenA (lpString="*.mp3") returned 5 [0048.694] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.wav") returned 0 [0048.694] lstrlenA (lpString="*.wav") returned 5 [0048.695] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.flac") returned 0 [0048.695] lstrlenA (lpString="*.flac") returned 6 [0048.695] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.ape") returned 0 [0048.695] lstrlenA (lpString="*.ape") returned 5 [0048.695] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.wma") returned 0 [0048.695] lstrlenA (lpString="*.wma") returned 5 [0048.695] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.ac3") returned 0 [0048.695] lstrlenA (lpString="*.ac3") returned 5 [0048.695] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", pszSpec="*.mxf") returned 0 [0048.695] lstrlenA (lpString="*.mxf") returned 5 [0048.695] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x639, dwReserved0=0x740078, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.695] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.695] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.695] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.695] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.695] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned="PIXEL.INF" [0048.695] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\" [0048.695] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\") returned="" [0048.695] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO DECRYPT FILES.txt" [0048.695] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\how to decrypt files.txt")) returned 0x20 [0048.695] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" [0048.695] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.695] lstrlenA (lpString="*.zip") returned 5 [0048.696] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.696] lstrlenA (lpString="*.rar") returned 5 [0048.696] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.696] lstrlenA (lpString="*.7z") returned 4 [0048.696] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.696] lstrlenA (lpString="*.tar") returned 5 [0048.696] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.696] lstrlenA (lpString="*.gzip") returned 6 [0048.696] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.696] lstrlenA (lpString="*.jpg") returned 5 [0048.696] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.696] lstrlenA (lpString="*.jpeg") returned 6 [0048.696] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.696] lstrlenA (lpString="*.psd") returned 5 [0048.696] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.696] lstrlenA (lpString="*.gif") returned 5 [0048.696] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" [0048.696] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" [0048.696] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF." [0048.696] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.wannacry" [0048.696] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.697] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x639 [0048.697] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1 [0048.697] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.697] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x5bb, lpOverlapped=0x0) returned 1 [0048.699] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.699] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.699] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x5bb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x5bb, lpOverlapped=0x0) returned 1 [0048.700] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.700] CloseHandle (hObject=0x90) returned 1 [0048.702] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.wannacry")) returned 1 [0048.705] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.706] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.706] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.706] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.706] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.706] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.706] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\" [0048.706] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\") returned="" [0048.706] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO DECRYPT FILES.txt" [0048.706] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\how to decrypt files.txt")) returned 0x20 [0048.706] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" [0048.706] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.706] lstrlenA (lpString="*.zip") returned 5 [0048.706] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.706] lstrlenA (lpString="*.rar") returned 5 [0048.706] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.706] lstrlenA (lpString="*.7z") returned 4 [0048.706] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.706] lstrlenA (lpString="*.tar") returned 5 [0048.706] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.706] lstrlenA (lpString="*.gzip") returned 6 [0048.706] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.707] lstrlenA (lpString="*.jpg") returned 5 [0048.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.707] lstrlenA (lpString="*.jpeg") returned 6 [0048.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.707] lstrlenA (lpString="*.psd") returned 5 [0048.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.707] lstrlenA (lpString="*.gif") returned 5 [0048.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.707] lstrlenA (lpString="*.doc") returned 5 [0048.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.707] lstrlenA (lpString="*.docx") returned 6 [0048.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.707] lstrlenA (lpString="*.xls") returned 5 [0048.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.707] lstrlenA (lpString="*.xlsx") returned 6 [0048.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.707] lstrlenA (lpString="*.ppt") returned 5 [0048.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.707] lstrlenA (lpString="*.pptx") returned 6 [0048.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.707] lstrlenA (lpString="*.pdf") returned 5 [0048.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.707] lstrlenA (lpString="*.mov") returned 5 [0048.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.707] lstrlenA (lpString="*.m2v") returned 5 [0048.707] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.708] lstrlenA (lpString="*.3gp") returned 5 [0048.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.708] lstrlenA (lpString="*.mpeg") returned 6 [0048.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.708] lstrlenA (lpString="*.mpg") returned 5 [0048.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.708] lstrlenA (lpString="*.flv") returned 5 [0048.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.708] lstrlenA (lpString="*.avi") returned 5 [0048.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.708] lstrlenA (lpString="*.mp4") returned 5 [0048.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.708] lstrlenA (lpString="*.wmv") returned 5 [0048.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.708] lstrlenA (lpString="*.divx") returned 6 [0048.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.708] lstrlenA (lpString="*.mkv") returned 5 [0048.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.708] lstrlenA (lpString="*.mp3") returned 5 [0048.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.708] lstrlenA (lpString="*.wav") returned 5 [0048.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.708] lstrlenA (lpString="*.flac") returned 6 [0048.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.708] lstrlenA (lpString="*.ape") returned 5 [0048.708] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.709] lstrlenA (lpString="*.wma") returned 5 [0048.709] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.709] lstrlenA (lpString="*.ac3") returned 5 [0048.709] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.709] lstrlenA (lpString="*.mxf") returned 5 [0048.709] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.709] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0048.709] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="PROFILE", cAlternateFileName="")) returned 1 [0048.709] lstrcmpA (lpString1=".", lpString2="PROFILE") returned -1 [0048.709] lstrcmpA (lpString1="..", lpString2="PROFILE") returned -1 [0048.709] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.709] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="PROFILE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE" [0048.709] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE") returned 63 [0048.709] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740078, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0048.710] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.710] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.710] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.710] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.710] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x53b, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.710] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.710] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.710] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.710] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.710] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*") returned="*.*" [0048.710] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\" [0048.710] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\") returned="" [0048.710] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO DECRYPT FILES.txt" [0048.710] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\how to decrypt files.txt")) returned 0xffffffff [0048.710] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.711] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.711] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.712] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.712] CloseHandle (hObject=0x90) returned 1 [0048.712] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" [0048.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.712] lstrlenA (lpString="*.zip") returned 5 [0048.712] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.712] lstrlenA (lpString="*.rar") returned 5 [0048.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.713] lstrlenA (lpString="*.7z") returned 4 [0048.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.713] lstrlenA (lpString="*.tar") returned 5 [0048.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.713] lstrlenA (lpString="*.gzip") returned 6 [0048.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.713] lstrlenA (lpString="*.jpg") returned 5 [0048.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.713] lstrlenA (lpString="*.jpeg") returned 6 [0048.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.713] lstrlenA (lpString="*.psd") returned 5 [0048.713] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.713] lstrlenA (lpString="*.gif") returned 5 [0048.713] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" [0048.713] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" [0048.714] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF." [0048.714] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.wannacry" [0048.714] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.715] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x53b [0048.715] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a6f8e30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1 [0048.715] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.715] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4bd, lpOverlapped=0x0) returned 1 [0048.717] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.717] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.717] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4bd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4bd, lpOverlapped=0x0) returned 1 [0048.717] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.717] CloseHandle (hObject=0x90) returned 1 [0048.719] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.wannacry")) returned 1 [0048.721] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a053d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a053d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb20e, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="PROFILE.ELM", cAlternateFileName="")) returned 1 [0048.722] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.722] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PROFILE.ELM") returned -1 [0048.722] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PROFILE.ELM") returned -1 [0048.722] lstrcmpiA (lpString1="", lpString2="PROFILE.ELM") returned -1 [0048.722] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.722] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\" [0048.722] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\") returned="" [0048.722] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO DECRYPT FILES.txt" [0048.722] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\how to decrypt files.txt")) returned 0x20 [0048.722] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", lpString2="PROFILE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" [0048.722] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.zip") returned 0 [0048.722] lstrlenA (lpString="*.zip") returned 5 [0048.722] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.rar") returned 0 [0048.722] lstrlenA (lpString="*.rar") returned 5 [0048.722] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.7z") returned 0 [0048.722] lstrlenA (lpString="*.7z") returned 4 [0048.722] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.tar") returned 0 [0048.722] lstrlenA (lpString="*.tar") returned 5 [0048.722] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.gzip") returned 0 [0048.722] lstrlenA (lpString="*.gzip") returned 6 [0048.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.jpg") returned 0 [0048.723] lstrlenA (lpString="*.jpg") returned 5 [0048.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.jpeg") returned 0 [0048.723] lstrlenA (lpString="*.jpeg") returned 6 [0048.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.psd") returned 0 [0048.723] lstrlenA (lpString="*.psd") returned 5 [0048.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.gif") returned 0 [0048.723] lstrlenA (lpString="*.gif") returned 5 [0048.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.doc") returned 0 [0048.723] lstrlenA (lpString="*.doc") returned 5 [0048.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.docx") returned 0 [0048.723] lstrlenA (lpString="*.docx") returned 6 [0048.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.xls") returned 0 [0048.723] lstrlenA (lpString="*.xls") returned 5 [0048.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.xlsx") returned 0 [0048.723] lstrlenA (lpString="*.xlsx") returned 6 [0048.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.ppt") returned 0 [0048.723] lstrlenA (lpString="*.ppt") returned 5 [0048.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.pptx") returned 0 [0048.723] lstrlenA (lpString="*.pptx") returned 6 [0048.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.pdf") returned 0 [0048.723] lstrlenA (lpString="*.pdf") returned 5 [0048.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.mov") returned 0 [0048.723] lstrlenA (lpString="*.mov") returned 5 [0048.723] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.m2v") returned 0 [0048.724] lstrlenA (lpString="*.m2v") returned 5 [0048.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.3gp") returned 0 [0048.724] lstrlenA (lpString="*.3gp") returned 5 [0048.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.mpeg") returned 0 [0048.724] lstrlenA (lpString="*.mpeg") returned 6 [0048.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.mpg") returned 0 [0048.724] lstrlenA (lpString="*.mpg") returned 5 [0048.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.flv") returned 0 [0048.724] lstrlenA (lpString="*.flv") returned 5 [0048.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.avi") returned 0 [0048.724] lstrlenA (lpString="*.avi") returned 5 [0048.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.mp4") returned 0 [0048.724] lstrlenA (lpString="*.mp4") returned 5 [0048.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.wmv") returned 0 [0048.724] lstrlenA (lpString="*.wmv") returned 5 [0048.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.divx") returned 0 [0048.724] lstrlenA (lpString="*.divx") returned 6 [0048.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.mkv") returned 0 [0048.724] lstrlenA (lpString="*.mkv") returned 5 [0048.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.mp3") returned 0 [0048.724] lstrlenA (lpString="*.mp3") returned 5 [0048.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.wav") returned 0 [0048.724] lstrlenA (lpString="*.wav") returned 5 [0048.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.flac") returned 0 [0048.724] lstrlenA (lpString="*.flac") returned 6 [0048.724] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.ape") returned 0 [0048.724] lstrlenA (lpString="*.ape") returned 5 [0048.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.wma") returned 0 [0048.725] lstrlenA (lpString="*.wma") returned 5 [0048.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.ac3") returned 0 [0048.725] lstrlenA (lpString="*.ac3") returned 5 [0048.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", pszSpec="*.mxf") returned 0 [0048.725] lstrlenA (lpString="*.mxf") returned 5 [0048.725] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName="PROFILE.INF", cAlternateFileName="")) returned 1 [0048.725] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.725] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PROFILE.INF") returned -1 [0048.725] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PROFILE.INF") returned -1 [0048.725] lstrcmpiA (lpString1="", lpString2="PROFILE.INF") returned -1 [0048.725] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned="PROFILE.ELM" [0048.725] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\" [0048.725] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\") returned="" [0048.725] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO DECRYPT FILES.txt" [0048.725] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\how to decrypt files.txt")) returned 0x20 [0048.725] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", lpString2="PROFILE.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" [0048.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.zip") returned 0 [0048.725] lstrlenA (lpString="*.zip") returned 5 [0048.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.rar") returned 0 [0048.725] lstrlenA (lpString="*.rar") returned 5 [0048.725] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.7z") returned 0 [0048.726] lstrlenA (lpString="*.7z") returned 4 [0048.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.tar") returned 0 [0048.726] lstrlenA (lpString="*.tar") returned 5 [0048.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.gzip") returned 0 [0048.726] lstrlenA (lpString="*.gzip") returned 6 [0048.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.jpg") returned 0 [0048.726] lstrlenA (lpString="*.jpg") returned 5 [0048.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.jpeg") returned 0 [0048.726] lstrlenA (lpString="*.jpeg") returned 6 [0048.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.psd") returned 0 [0048.726] lstrlenA (lpString="*.psd") returned 5 [0048.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.gif") returned 0 [0048.726] lstrlenA (lpString="*.gif") returned 5 [0048.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.doc") returned 0 [0048.726] lstrlenA (lpString="*.doc") returned 5 [0048.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.docx") returned 0 [0048.726] lstrlenA (lpString="*.docx") returned 6 [0048.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.xls") returned 0 [0048.726] lstrlenA (lpString="*.xls") returned 5 [0048.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.xlsx") returned 0 [0048.726] lstrlenA (lpString="*.xlsx") returned 6 [0048.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.ppt") returned 0 [0048.726] lstrlenA (lpString="*.ppt") returned 5 [0048.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.pptx") returned 0 [0048.726] lstrlenA (lpString="*.pptx") returned 6 [0048.726] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.pdf") returned 0 [0048.727] lstrlenA (lpString="*.pdf") returned 5 [0048.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.mov") returned 0 [0048.727] lstrlenA (lpString="*.mov") returned 5 [0048.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.m2v") returned 0 [0048.727] lstrlenA (lpString="*.m2v") returned 5 [0048.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.3gp") returned 0 [0048.727] lstrlenA (lpString="*.3gp") returned 5 [0048.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.mpeg") returned 0 [0048.727] lstrlenA (lpString="*.mpeg") returned 6 [0048.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.mpg") returned 0 [0048.727] lstrlenA (lpString="*.mpg") returned 5 [0048.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.flv") returned 0 [0048.727] lstrlenA (lpString="*.flv") returned 5 [0048.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.avi") returned 0 [0048.727] lstrlenA (lpString="*.avi") returned 5 [0048.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.mp4") returned 0 [0048.727] lstrlenA (lpString="*.mp4") returned 5 [0048.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.wmv") returned 0 [0048.727] lstrlenA (lpString="*.wmv") returned 5 [0048.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.divx") returned 0 [0048.727] lstrlenA (lpString="*.divx") returned 6 [0048.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.mkv") returned 0 [0048.727] lstrlenA (lpString="*.mkv") returned 5 [0048.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.mp3") returned 0 [0048.727] lstrlenA (lpString="*.mp3") returned 5 [0048.727] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.wav") returned 0 [0048.728] lstrlenA (lpString="*.wav") returned 5 [0048.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.flac") returned 0 [0048.728] lstrlenA (lpString="*.flac") returned 6 [0048.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.ape") returned 0 [0048.728] lstrlenA (lpString="*.ape") returned 5 [0048.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.wma") returned 0 [0048.728] lstrlenA (lpString="*.wma") returned 5 [0048.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.ac3") returned 0 [0048.728] lstrlenA (lpString="*.ac3") returned 5 [0048.728] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", pszSpec="*.mxf") returned 0 [0048.728] lstrlenA (lpString="*.mxf") returned 5 [0048.728] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.728] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.728] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.728] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.728] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.728] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned="PROFILE.INF" [0048.729] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\" [0048.729] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\") returned="" [0048.729] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO DECRYPT FILES.txt" [0048.729] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\how to decrypt files.txt")) returned 0x20 [0048.729] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" [0048.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.729] lstrlenA (lpString="*.zip") returned 5 [0048.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.729] lstrlenA (lpString="*.rar") returned 5 [0048.729] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.730] lstrlenA (lpString="*.7z") returned 4 [0048.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.730] lstrlenA (lpString="*.tar") returned 5 [0048.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.730] lstrlenA (lpString="*.gzip") returned 6 [0048.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.730] lstrlenA (lpString="*.jpg") returned 5 [0048.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.730] lstrlenA (lpString="*.jpeg") returned 6 [0048.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.730] lstrlenA (lpString="*.psd") returned 5 [0048.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.730] lstrlenA (lpString="*.gif") returned 5 [0048.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.730] lstrlenA (lpString="*.doc") returned 5 [0048.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.730] lstrlenA (lpString="*.docx") returned 6 [0048.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.730] lstrlenA (lpString="*.xls") returned 5 [0048.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.730] lstrlenA (lpString="*.xlsx") returned 6 [0048.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.730] lstrlenA (lpString="*.ppt") returned 5 [0048.730] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.731] lstrlenA (lpString="*.pptx") returned 6 [0048.731] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.731] lstrlenA (lpString="*.pdf") returned 5 [0048.731] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.731] lstrlenA (lpString="*.mov") returned 5 [0048.731] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.731] lstrlenA (lpString="*.m2v") returned 5 [0048.731] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.731] lstrlenA (lpString="*.3gp") returned 5 [0048.731] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.731] lstrlenA (lpString="*.mpeg") returned 6 [0048.731] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.731] lstrlenA (lpString="*.mpg") returned 5 [0048.731] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.731] lstrlenA (lpString="*.flv") returned 5 [0048.731] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.731] lstrlenA (lpString="*.avi") returned 5 [0048.731] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.731] lstrlenA (lpString="*.mp4") returned 5 [0048.731] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.731] lstrlenA (lpString="*.wmv") returned 5 [0048.731] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.731] lstrlenA (lpString="*.divx") returned 6 [0048.731] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.732] lstrlenA (lpString="*.mkv") returned 5 [0048.732] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.732] lstrlenA (lpString="*.mp3") returned 5 [0048.732] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.732] lstrlenA (lpString="*.wav") returned 5 [0048.732] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.732] lstrlenA (lpString="*.flac") returned 6 [0048.732] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.732] lstrlenA (lpString="*.ape") returned 5 [0048.732] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.732] lstrlenA (lpString="*.wma") returned 5 [0048.732] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.732] lstrlenA (lpString="*.ac3") returned 5 [0048.732] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.732] lstrlenA (lpString="*.mxf") returned 5 [0048.732] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.732] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0048.732] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="QUAD", cAlternateFileName="")) returned 1 [0048.732] lstrcmpA (lpString1=".", lpString2="QUAD") returned -1 [0048.733] lstrcmpA (lpString1="..", lpString2="QUAD") returned -1 [0048.733] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.733] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="QUAD" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD" [0048.733] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD") returned 60 [0048.733] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0048.733] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.733] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x740000, cFileName="..", cAlternateFileName="")) returned 1 [0048.733] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.733] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.733] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.733] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.733] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.733] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.733] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.734] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*") returned="*.*" [0048.734] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\" [0048.734] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\") returned="" [0048.734] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO DECRYPT FILES.txt" [0048.734] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\how to decrypt files.txt")) returned 0xffffffff [0048.734] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.734] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.734] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.735] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.736] CloseHandle (hObject=0x90) returned 1 [0048.736] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" [0048.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.736] lstrlenA (lpString="*.zip") returned 5 [0048.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.736] lstrlenA (lpString="*.rar") returned 5 [0048.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.736] lstrlenA (lpString="*.7z") returned 4 [0048.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.736] lstrlenA (lpString="*.tar") returned 5 [0048.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.736] lstrlenA (lpString="*.gzip") returned 6 [0048.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.736] lstrlenA (lpString="*.jpg") returned 5 [0048.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.736] lstrlenA (lpString="*.jpeg") returned 6 [0048.736] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.737] lstrlenA (lpString="*.psd") returned 5 [0048.737] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.737] lstrlenA (lpString="*.gif") returned 5 [0048.737] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" [0048.737] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" [0048.737] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF." [0048.737] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.wannacry" [0048.737] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.737] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x59f [0048.737] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a71ef90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1 [0048.737] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.737] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x521, lpOverlapped=0x0) returned 1 [0048.740] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.740] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.740] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x521, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x521, lpOverlapped=0x0) returned 1 [0048.740] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.740] CloseHandle (hObject=0x90) returned 1 [0048.743] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.wannacry")) returned 1 [0048.746] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b366a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a8037d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b366a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbba7, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="QUAD.ELM", cAlternateFileName="")) returned 1 [0048.746] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.746] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QUAD.ELM") returned -1 [0048.746] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QUAD.ELM") returned -1 [0048.746] lstrcmpiA (lpString1="", lpString2="QUAD.ELM") returned -1 [0048.746] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.746] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\" [0048.746] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\") returned="" [0048.746] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO DECRYPT FILES.txt" [0048.746] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\how to decrypt files.txt")) returned 0x20 [0048.746] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", lpString2="QUAD.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" [0048.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.zip") returned 0 [0048.746] lstrlenA (lpString="*.zip") returned 5 [0048.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.rar") returned 0 [0048.746] lstrlenA (lpString="*.rar") returned 5 [0048.746] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.7z") returned 0 [0048.747] lstrlenA (lpString="*.7z") returned 4 [0048.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.tar") returned 0 [0048.747] lstrlenA (lpString="*.tar") returned 5 [0048.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.gzip") returned 0 [0048.747] lstrlenA (lpString="*.gzip") returned 6 [0048.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.jpg") returned 0 [0048.747] lstrlenA (lpString="*.jpg") returned 5 [0048.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.jpeg") returned 0 [0048.747] lstrlenA (lpString="*.jpeg") returned 6 [0048.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.psd") returned 0 [0048.747] lstrlenA (lpString="*.psd") returned 5 [0048.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.gif") returned 0 [0048.747] lstrlenA (lpString="*.gif") returned 5 [0048.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.doc") returned 0 [0048.747] lstrlenA (lpString="*.doc") returned 5 [0048.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.docx") returned 0 [0048.747] lstrlenA (lpString="*.docx") returned 6 [0048.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.xls") returned 0 [0048.747] lstrlenA (lpString="*.xls") returned 5 [0048.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.xlsx") returned 0 [0048.747] lstrlenA (lpString="*.xlsx") returned 6 [0048.747] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.ppt") returned 0 [0048.747] lstrlenA (lpString="*.ppt") returned 5 [0048.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.pptx") returned 0 [0048.748] lstrlenA (lpString="*.pptx") returned 6 [0048.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.pdf") returned 0 [0048.748] lstrlenA (lpString="*.pdf") returned 5 [0048.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.mov") returned 0 [0048.748] lstrlenA (lpString="*.mov") returned 5 [0048.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.m2v") returned 0 [0048.748] lstrlenA (lpString="*.m2v") returned 5 [0048.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.3gp") returned 0 [0048.748] lstrlenA (lpString="*.3gp") returned 5 [0048.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.mpeg") returned 0 [0048.748] lstrlenA (lpString="*.mpeg") returned 6 [0048.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.mpg") returned 0 [0048.748] lstrlenA (lpString="*.mpg") returned 5 [0048.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.flv") returned 0 [0048.748] lstrlenA (lpString="*.flv") returned 5 [0048.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.avi") returned 0 [0048.748] lstrlenA (lpString="*.avi") returned 5 [0048.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.mp4") returned 0 [0048.748] lstrlenA (lpString="*.mp4") returned 5 [0048.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.wmv") returned 0 [0048.748] lstrlenA (lpString="*.wmv") returned 5 [0048.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.divx") returned 0 [0048.748] lstrlenA (lpString="*.divx") returned 6 [0048.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.mkv") returned 0 [0048.748] lstrlenA (lpString="*.mkv") returned 5 [0048.748] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.mp3") returned 0 [0048.749] lstrlenA (lpString="*.mp3") returned 5 [0048.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.wav") returned 0 [0048.749] lstrlenA (lpString="*.wav") returned 5 [0048.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.flac") returned 0 [0048.749] lstrlenA (lpString="*.flac") returned 6 [0048.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.ape") returned 0 [0048.749] lstrlenA (lpString="*.ape") returned 5 [0048.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.wma") returned 0 [0048.749] lstrlenA (lpString="*.wma") returned 5 [0048.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.ac3") returned 0 [0048.749] lstrlenA (lpString="*.ac3") returned 5 [0048.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", pszSpec="*.mxf") returned 0 [0048.749] lstrlenA (lpString="*.mxf") returned 5 [0048.749] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x74, dwReserved1=0x0, cFileName="QUAD.INF", cAlternateFileName="")) returned 1 [0048.749] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.749] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QUAD.INF") returned -1 [0048.749] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QUAD.INF") returned -1 [0048.749] lstrcmpiA (lpString1="", lpString2="QUAD.INF") returned -1 [0048.749] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned="QUAD.ELM" [0048.749] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\" [0048.749] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\") returned="" [0048.749] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO DECRYPT FILES.txt" [0048.749] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\how to decrypt files.txt")) returned 0x20 [0048.749] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", lpString2="QUAD.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" [0048.749] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.zip") returned 0 [0048.749] lstrlenA (lpString="*.zip") returned 5 [0048.750] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.rar") returned 0 [0048.750] lstrlenA (lpString="*.rar") returned 5 [0048.750] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.7z") returned 0 [0048.750] lstrlenA (lpString="*.7z") returned 4 [0048.750] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.tar") returned 0 [0048.750] lstrlenA (lpString="*.tar") returned 5 [0048.750] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.gzip") returned 0 [0048.750] lstrlenA (lpString="*.gzip") returned 6 [0048.750] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.jpg") returned 0 [0048.750] lstrlenA (lpString="*.jpg") returned 5 [0048.750] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.jpeg") returned 0 [0048.750] lstrlenA (lpString="*.jpeg") returned 6 [0048.750] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.psd") returned 0 [0048.750] lstrlenA (lpString="*.psd") returned 5 [0048.750] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.gif") returned 0 [0048.750] lstrlenA (lpString="*.gif") returned 5 [0048.750] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.doc") returned 0 [0048.750] lstrlenA (lpString="*.doc") returned 5 [0048.750] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.docx") returned 0 [0048.750] lstrlenA (lpString="*.docx") returned 6 [0048.750] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.xls") returned 0 [0048.750] lstrlenA (lpString="*.xls") returned 5 [0048.750] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.xlsx") returned 0 [0048.750] lstrlenA (lpString="*.xlsx") returned 6 [0048.750] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.ppt") returned 0 [0048.750] lstrlenA (lpString="*.ppt") returned 5 [0048.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.pptx") returned 0 [0048.751] lstrlenA (lpString="*.pptx") returned 6 [0048.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.pdf") returned 0 [0048.751] lstrlenA (lpString="*.pdf") returned 5 [0048.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.mov") returned 0 [0048.751] lstrlenA (lpString="*.mov") returned 5 [0048.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.m2v") returned 0 [0048.751] lstrlenA (lpString="*.m2v") returned 5 [0048.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.3gp") returned 0 [0048.751] lstrlenA (lpString="*.3gp") returned 5 [0048.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.mpeg") returned 0 [0048.751] lstrlenA (lpString="*.mpeg") returned 6 [0048.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.mpg") returned 0 [0048.751] lstrlenA (lpString="*.mpg") returned 5 [0048.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.flv") returned 0 [0048.751] lstrlenA (lpString="*.flv") returned 5 [0048.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.avi") returned 0 [0048.751] lstrlenA (lpString="*.avi") returned 5 [0048.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.mp4") returned 0 [0048.751] lstrlenA (lpString="*.mp4") returned 5 [0048.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.wmv") returned 0 [0048.751] lstrlenA (lpString="*.wmv") returned 5 [0048.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.divx") returned 0 [0048.751] lstrlenA (lpString="*.divx") returned 6 [0048.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.mkv") returned 0 [0048.751] lstrlenA (lpString="*.mkv") returned 5 [0048.751] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.mp3") returned 0 [0048.752] lstrlenA (lpString="*.mp3") returned 5 [0048.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.wav") returned 0 [0048.752] lstrlenA (lpString="*.wav") returned 5 [0048.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.flac") returned 0 [0048.752] lstrlenA (lpString="*.flac") returned 6 [0048.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.ape") returned 0 [0048.752] lstrlenA (lpString="*.ape") returned 5 [0048.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.wma") returned 0 [0048.752] lstrlenA (lpString="*.wma") returned 5 [0048.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.ac3") returned 0 [0048.752] lstrlenA (lpString="*.ac3") returned 5 [0048.752] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", pszSpec="*.mxf") returned 0 [0048.752] lstrlenA (lpString="*.mxf") returned 5 [0048.752] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x74, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.752] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.752] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.752] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.752] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.752] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned="QUAD.INF" [0048.752] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\" [0048.752] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\") returned="" [0048.752] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO DECRYPT FILES.txt" [0048.752] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\how to decrypt files.txt")) returned 0x20 [0048.752] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" [0048.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.753] lstrlenA (lpString="*.zip") returned 5 [0048.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.753] lstrlenA (lpString="*.rar") returned 5 [0048.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.753] lstrlenA (lpString="*.7z") returned 4 [0048.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.753] lstrlenA (lpString="*.tar") returned 5 [0048.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.753] lstrlenA (lpString="*.gzip") returned 6 [0048.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.753] lstrlenA (lpString="*.jpg") returned 5 [0048.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.753] lstrlenA (lpString="*.jpeg") returned 6 [0048.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.753] lstrlenA (lpString="*.psd") returned 5 [0048.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.753] lstrlenA (lpString="*.gif") returned 5 [0048.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.753] lstrlenA (lpString="*.doc") returned 5 [0048.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.753] lstrlenA (lpString="*.docx") returned 6 [0048.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.753] lstrlenA (lpString="*.xls") returned 5 [0048.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.753] lstrlenA (lpString="*.xlsx") returned 6 [0048.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.753] lstrlenA (lpString="*.ppt") returned 5 [0048.753] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.754] lstrlenA (lpString="*.pptx") returned 6 [0048.754] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.754] lstrlenA (lpString="*.pdf") returned 5 [0048.754] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.754] lstrlenA (lpString="*.mov") returned 5 [0048.754] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.754] lstrlenA (lpString="*.m2v") returned 5 [0048.754] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.754] lstrlenA (lpString="*.3gp") returned 5 [0048.754] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.754] lstrlenA (lpString="*.mpeg") returned 6 [0048.754] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.754] lstrlenA (lpString="*.mpg") returned 5 [0048.754] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.754] lstrlenA (lpString="*.flv") returned 5 [0048.754] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.754] lstrlenA (lpString="*.avi") returned 5 [0048.754] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.754] lstrlenA (lpString="*.mp4") returned 5 [0048.754] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.754] lstrlenA (lpString="*.wmv") returned 5 [0048.754] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.754] lstrlenA (lpString="*.divx") returned 6 [0048.754] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.754] lstrlenA (lpString="*.mkv") returned 5 [0048.754] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.754] lstrlenA (lpString="*.mp3") returned 5 [0048.755] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.755] lstrlenA (lpString="*.wav") returned 5 [0048.755] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.755] lstrlenA (lpString="*.flac") returned 6 [0048.755] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.755] lstrlenA (lpString="*.ape") returned 5 [0048.755] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.755] lstrlenA (lpString="*.wma") returned 5 [0048.755] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.755] lstrlenA (lpString="*.ac3") returned 5 [0048.755] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.755] lstrlenA (lpString="*.mxf") returned 5 [0048.755] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x74, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.755] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0048.755] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0048.755] lstrcmpA (lpString1=".", lpString2="RADIAL") returned -1 [0048.755] lstrcmpA (lpString1="..", lpString2="RADIAL") returned -1 [0048.755] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.755] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="RADIAL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL" [0048.755] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL") returned 62 [0048.755] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0048.757] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.757] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.757] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.757] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.757] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x682, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.757] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.757] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.757] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.757] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.757] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*") returned="*.*" [0048.757] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\" [0048.757] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\") returned="" [0048.757] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO DECRYPT FILES.txt" [0048.757] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\how to decrypt files.txt")) returned 0xffffffff [0048.757] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.758] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.758] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.759] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.759] CloseHandle (hObject=0x90) returned 1 [0048.760] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" [0048.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.760] lstrlenA (lpString="*.zip") returned 5 [0048.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.760] lstrlenA (lpString="*.rar") returned 5 [0048.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.760] lstrlenA (lpString="*.7z") returned 4 [0048.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.760] lstrlenA (lpString="*.tar") returned 5 [0048.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.760] lstrlenA (lpString="*.gzip") returned 6 [0048.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.760] lstrlenA (lpString="*.jpg") returned 5 [0048.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.760] lstrlenA (lpString="*.jpeg") returned 6 [0048.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.760] lstrlenA (lpString="*.psd") returned 5 [0048.760] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.760] lstrlenA (lpString="*.gif") returned 5 [0048.760] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" [0048.760] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" [0048.760] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF." [0048.760] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.wannacry" [0048.760] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.762] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x682 [0048.762] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1 [0048.762] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.762] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x604, lpOverlapped=0x0) returned 1 [0048.764] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.764] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.764] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x604, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x604, lpOverlapped=0x0) returned 1 [0048.764] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.764] CloseHandle (hObject=0x90) returned 1 [0048.766] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.wannacry")) returned 1 [0048.772] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c679700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c679700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb75e, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="RADIAL.ELM", cAlternateFileName="")) returned 1 [0048.772] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.772] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RADIAL.ELM") returned -1 [0048.772] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RADIAL.ELM") returned -1 [0048.772] lstrcmpiA (lpString1="", lpString2="RADIAL.ELM") returned -1 [0048.772] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.772] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\" [0048.772] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\") returned="" [0048.772] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO DECRYPT FILES.txt" [0048.772] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\how to decrypt files.txt")) returned 0x20 [0048.772] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", lpString2="RADIAL.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" [0048.772] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.zip") returned 0 [0048.773] lstrlenA (lpString="*.zip") returned 5 [0048.773] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.rar") returned 0 [0048.773] lstrlenA (lpString="*.rar") returned 5 [0048.773] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.7z") returned 0 [0048.773] lstrlenA (lpString="*.7z") returned 4 [0048.773] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.tar") returned 0 [0048.773] lstrlenA (lpString="*.tar") returned 5 [0048.773] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.gzip") returned 0 [0048.773] lstrlenA (lpString="*.gzip") returned 6 [0048.773] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.jpg") returned 0 [0048.773] lstrlenA (lpString="*.jpg") returned 5 [0048.773] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.jpeg") returned 0 [0048.773] lstrlenA (lpString="*.jpeg") returned 6 [0048.773] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.psd") returned 0 [0048.773] lstrlenA (lpString="*.psd") returned 5 [0048.773] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.gif") returned 0 [0048.773] lstrlenA (lpString="*.gif") returned 5 [0048.773] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.doc") returned 0 [0048.773] lstrlenA (lpString="*.doc") returned 5 [0048.773] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.docx") returned 0 [0048.773] lstrlenA (lpString="*.docx") returned 6 [0048.773] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.xls") returned 0 [0048.773] lstrlenA (lpString="*.xls") returned 5 [0048.773] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.xlsx") returned 0 [0048.773] lstrlenA (lpString="*.xlsx") returned 6 [0048.773] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.ppt") returned 0 [0048.774] lstrlenA (lpString="*.ppt") returned 5 [0048.774] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.pptx") returned 0 [0048.774] lstrlenA (lpString="*.pptx") returned 6 [0048.774] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.pdf") returned 0 [0048.774] lstrlenA (lpString="*.pdf") returned 5 [0048.774] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.mov") returned 0 [0048.774] lstrlenA (lpString="*.mov") returned 5 [0048.774] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.m2v") returned 0 [0048.774] lstrlenA (lpString="*.m2v") returned 5 [0048.774] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.3gp") returned 0 [0048.774] lstrlenA (lpString="*.3gp") returned 5 [0048.774] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.mpeg") returned 0 [0048.774] lstrlenA (lpString="*.mpeg") returned 6 [0048.774] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.mpg") returned 0 [0048.774] lstrlenA (lpString="*.mpg") returned 5 [0048.774] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.flv") returned 0 [0048.774] lstrlenA (lpString="*.flv") returned 5 [0048.774] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.avi") returned 0 [0048.774] lstrlenA (lpString="*.avi") returned 5 [0048.775] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.mp4") returned 0 [0048.775] lstrlenA (lpString="*.mp4") returned 5 [0048.775] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.wmv") returned 0 [0048.775] lstrlenA (lpString="*.wmv") returned 5 [0048.775] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.divx") returned 0 [0048.775] lstrlenA (lpString="*.divx") returned 6 [0048.775] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.mkv") returned 0 [0048.775] lstrlenA (lpString="*.mkv") returned 5 [0048.775] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.mp3") returned 0 [0048.775] lstrlenA (lpString="*.mp3") returned 5 [0048.775] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.wav") returned 0 [0048.775] lstrlenA (lpString="*.wav") returned 5 [0048.775] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.flac") returned 0 [0048.775] lstrlenA (lpString="*.flac") returned 6 [0048.775] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.ape") returned 0 [0048.775] lstrlenA (lpString="*.ape") returned 5 [0048.775] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.wma") returned 0 [0048.775] lstrlenA (lpString="*.wma") returned 5 [0048.775] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.ac3") returned 0 [0048.775] lstrlenA (lpString="*.ac3") returned 5 [0048.775] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", pszSpec="*.mxf") returned 0 [0048.775] lstrlenA (lpString="*.mxf") returned 5 [0048.775] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x780074, dwReserved1=0x74, cFileName="RADIAL.INF", cAlternateFileName="")) returned 1 [0048.775] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.775] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RADIAL.INF") returned -1 [0048.775] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RADIAL.INF") returned -1 [0048.776] lstrcmpiA (lpString1="", lpString2="RADIAL.INF") returned -1 [0048.776] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned="RADIAL.ELM" [0048.776] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\" [0048.776] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\") returned="" [0048.776] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO DECRYPT FILES.txt" [0048.776] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\how to decrypt files.txt")) returned 0x20 [0048.776] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", lpString2="RADIAL.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" [0048.776] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.zip") returned 0 [0048.776] lstrlenA (lpString="*.zip") returned 5 [0048.776] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.rar") returned 0 [0048.776] lstrlenA (lpString="*.rar") returned 5 [0048.776] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.7z") returned 0 [0048.776] lstrlenA (lpString="*.7z") returned 4 [0048.776] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.tar") returned 0 [0048.776] lstrlenA (lpString="*.tar") returned 5 [0048.776] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.gzip") returned 0 [0048.776] lstrlenA (lpString="*.gzip") returned 6 [0048.777] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.jpg") returned 0 [0048.777] lstrlenA (lpString="*.jpg") returned 5 [0048.777] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.jpeg") returned 0 [0048.777] lstrlenA (lpString="*.jpeg") returned 6 [0048.777] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.psd") returned 0 [0048.777] lstrlenA (lpString="*.psd") returned 5 [0048.777] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.gif") returned 0 [0048.777] lstrlenA (lpString="*.gif") returned 5 [0048.777] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.doc") returned 0 [0048.777] lstrlenA (lpString="*.doc") returned 5 [0048.777] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.docx") returned 0 [0048.777] lstrlenA (lpString="*.docx") returned 6 [0048.777] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.xls") returned 0 [0048.777] lstrlenA (lpString="*.xls") returned 5 [0048.777] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.xlsx") returned 0 [0048.777] lstrlenA (lpString="*.xlsx") returned 6 [0048.777] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.ppt") returned 0 [0048.777] lstrlenA (lpString="*.ppt") returned 5 [0048.777] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.pptx") returned 0 [0048.777] lstrlenA (lpString="*.pptx") returned 6 [0048.777] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.pdf") returned 0 [0048.777] lstrlenA (lpString="*.pdf") returned 5 [0048.777] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.mov") returned 0 [0048.777] lstrlenA (lpString="*.mov") returned 5 [0048.777] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.m2v") returned 0 [0048.777] lstrlenA (lpString="*.m2v") returned 5 [0048.777] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.3gp") returned 0 [0048.777] lstrlenA (lpString="*.3gp") returned 5 [0048.778] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.mpeg") returned 0 [0048.778] lstrlenA (lpString="*.mpeg") returned 6 [0048.778] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.mpg") returned 0 [0048.778] lstrlenA (lpString="*.mpg") returned 5 [0048.778] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.flv") returned 0 [0048.778] lstrlenA (lpString="*.flv") returned 5 [0048.778] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.avi") returned 0 [0048.778] lstrlenA (lpString="*.avi") returned 5 [0048.778] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.mp4") returned 0 [0048.778] lstrlenA (lpString="*.mp4") returned 5 [0048.778] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.wmv") returned 0 [0048.778] lstrlenA (lpString="*.wmv") returned 5 [0048.778] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.divx") returned 0 [0048.778] lstrlenA (lpString="*.divx") returned 6 [0048.778] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.mkv") returned 0 [0048.778] lstrlenA (lpString="*.mkv") returned 5 [0048.778] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.mp3") returned 0 [0048.778] lstrlenA (lpString="*.mp3") returned 5 [0048.778] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.wav") returned 0 [0048.778] lstrlenA (lpString="*.wav") returned 5 [0048.778] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.flac") returned 0 [0048.778] lstrlenA (lpString="*.flac") returned 6 [0048.778] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.ape") returned 0 [0048.778] lstrlenA (lpString="*.ape") returned 5 [0048.778] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.wma") returned 0 [0048.778] lstrlenA (lpString="*.wma") returned 5 [0048.778] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.ac3") returned 0 [0048.779] lstrlenA (lpString="*.ac3") returned 5 [0048.779] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", pszSpec="*.mxf") returned 0 [0048.779] lstrlenA (lpString="*.mxf") returned 5 [0048.779] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x780074, dwReserved1=0x74, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.779] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.779] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.779] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.779] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.779] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned="RADIAL.INF" [0048.779] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\" [0048.779] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\") returned="" [0048.779] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO DECRYPT FILES.txt" [0048.779] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\how to decrypt files.txt")) returned 0x20 [0048.779] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" [0048.779] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.779] lstrlenA (lpString="*.zip") returned 5 [0048.779] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.779] lstrlenA (lpString="*.rar") returned 5 [0048.779] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.779] lstrlenA (lpString="*.7z") returned 4 [0048.779] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.779] lstrlenA (lpString="*.tar") returned 5 [0048.779] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.780] lstrlenA (lpString="*.gzip") returned 6 [0048.780] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.780] lstrlenA (lpString="*.jpg") returned 5 [0048.780] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.780] lstrlenA (lpString="*.jpeg") returned 6 [0048.780] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.780] lstrlenA (lpString="*.psd") returned 5 [0048.780] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.780] lstrlenA (lpString="*.gif") returned 5 [0048.780] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.780] lstrlenA (lpString="*.doc") returned 5 [0048.780] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.780] lstrlenA (lpString="*.docx") returned 6 [0048.780] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.780] lstrlenA (lpString="*.xls") returned 5 [0048.780] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.780] lstrlenA (lpString="*.xlsx") returned 6 [0048.780] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.780] lstrlenA (lpString="*.ppt") returned 5 [0048.780] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.780] lstrlenA (lpString="*.pptx") returned 6 [0048.780] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.780] lstrlenA (lpString="*.pdf") returned 5 [0048.780] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.780] lstrlenA (lpString="*.mov") returned 5 [0048.780] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.780] lstrlenA (lpString="*.m2v") returned 5 [0048.780] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.780] lstrlenA (lpString="*.3gp") returned 5 [0048.781] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.781] lstrlenA (lpString="*.mpeg") returned 6 [0048.781] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.781] lstrlenA (lpString="*.mpg") returned 5 [0048.781] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.781] lstrlenA (lpString="*.flv") returned 5 [0048.781] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.781] lstrlenA (lpString="*.avi") returned 5 [0048.781] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.781] lstrlenA (lpString="*.mp4") returned 5 [0048.781] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.781] lstrlenA (lpString="*.wmv") returned 5 [0048.781] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.781] lstrlenA (lpString="*.divx") returned 6 [0048.781] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.781] lstrlenA (lpString="*.mkv") returned 5 [0048.781] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.781] lstrlenA (lpString="*.mp3") returned 5 [0048.781] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.781] lstrlenA (lpString="*.wav") returned 5 [0048.781] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.781] lstrlenA (lpString="*.flac") returned 6 [0048.781] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.781] lstrlenA (lpString="*.ape") returned 5 [0048.781] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.781] lstrlenA (lpString="*.wma") returned 5 [0048.781] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.781] lstrlenA (lpString="*.ac3") returned 5 [0048.782] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.782] lstrlenA (lpString="*.mxf") returned 5 [0048.782] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x780074, dwReserved1=0x74, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.782] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0048.782] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="REFINED", cAlternateFileName="")) returned 1 [0048.782] lstrcmpA (lpString1=".", lpString2="REFINED") returned -1 [0048.782] lstrcmpA (lpString1="..", lpString2="REFINED") returned -1 [0048.782] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.782] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="REFINED" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED" [0048.782] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED") returned 63 [0048.782] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0048.783] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.783] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.783] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.783] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.783] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.783] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.783] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.783] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.783] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.783] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*") returned="*.*" [0048.783] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\" [0048.783] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\") returned="" [0048.783] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO DECRYPT FILES.txt" [0048.783] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\how to decrypt files.txt")) returned 0xffffffff [0048.783] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.784] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.784] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.785] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.785] CloseHandle (hObject=0x90) returned 1 [0048.785] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" [0048.785] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.785] lstrlenA (lpString="*.zip") returned 5 [0048.786] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.786] lstrlenA (lpString="*.rar") returned 5 [0048.786] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.786] lstrlenA (lpString="*.7z") returned 4 [0048.786] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.786] lstrlenA (lpString="*.tar") returned 5 [0048.786] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.786] lstrlenA (lpString="*.gzip") returned 6 [0048.786] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.786] lstrlenA (lpString="*.jpg") returned 5 [0048.786] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.786] lstrlenA (lpString="*.jpeg") returned 6 [0048.786] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.786] lstrlenA (lpString="*.psd") returned 5 [0048.786] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.786] lstrlenA (lpString="*.gif") returned 5 [0048.786] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" [0048.786] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" [0048.786] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF." [0048.786] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.wannacry" [0048.786] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.787] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x58f [0048.787] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1 [0048.787] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.787] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x511, lpOverlapped=0x0) returned 1 [0048.789] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.789] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.789] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x511, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x511, lpOverlapped=0x0) returned 1 [0048.789] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.789] CloseHandle (hObject=0x90) returned 1 [0048.791] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.wannacry")) returned 1 [0048.793] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec9f100, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec9f100, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb30e, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="REFINED.ELM", cAlternateFileName="")) returned 1 [0048.793] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.793] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="REFINED.ELM") returned -1 [0048.793] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="REFINED.ELM") returned -1 [0048.793] lstrcmpiA (lpString1="", lpString2="REFINED.ELM") returned -1 [0048.793] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.793] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\" [0048.794] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\") returned="" [0048.794] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO DECRYPT FILES.txt" [0048.794] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\how to decrypt files.txt")) returned 0x20 [0048.794] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", lpString2="REFINED.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" [0048.794] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.zip") returned 0 [0048.794] lstrlenA (lpString="*.zip") returned 5 [0048.794] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.rar") returned 0 [0048.794] lstrlenA (lpString="*.rar") returned 5 [0048.794] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.7z") returned 0 [0048.794] lstrlenA (lpString="*.7z") returned 4 [0048.794] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.tar") returned 0 [0048.794] lstrlenA (lpString="*.tar") returned 5 [0048.794] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.gzip") returned 0 [0048.794] lstrlenA (lpString="*.gzip") returned 6 [0048.794] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.jpg") returned 0 [0048.794] lstrlenA (lpString="*.jpg") returned 5 [0048.794] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.jpeg") returned 0 [0048.794] lstrlenA (lpString="*.jpeg") returned 6 [0048.794] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.psd") returned 0 [0048.794] lstrlenA (lpString="*.psd") returned 5 [0048.794] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.gif") returned 0 [0048.794] lstrlenA (lpString="*.gif") returned 5 [0048.794] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.doc") returned 0 [0048.794] lstrlenA (lpString="*.doc") returned 5 [0048.794] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.docx") returned 0 [0048.794] lstrlenA (lpString="*.docx") returned 6 [0048.794] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.xls") returned 0 [0048.794] lstrlenA (lpString="*.xls") returned 5 [0048.794] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.xlsx") returned 0 [0048.795] lstrlenA (lpString="*.xlsx") returned 6 [0048.795] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.ppt") returned 0 [0048.795] lstrlenA (lpString="*.ppt") returned 5 [0048.795] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.pptx") returned 0 [0048.795] lstrlenA (lpString="*.pptx") returned 6 [0048.795] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.pdf") returned 0 [0048.795] lstrlenA (lpString="*.pdf") returned 5 [0048.795] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.mov") returned 0 [0048.795] lstrlenA (lpString="*.mov") returned 5 [0048.795] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.m2v") returned 0 [0048.795] lstrlenA (lpString="*.m2v") returned 5 [0048.795] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.3gp") returned 0 [0048.795] lstrlenA (lpString="*.3gp") returned 5 [0048.795] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.mpeg") returned 0 [0048.795] lstrlenA (lpString="*.mpeg") returned 6 [0048.795] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.mpg") returned 0 [0048.795] lstrlenA (lpString="*.mpg") returned 5 [0048.795] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.flv") returned 0 [0048.795] lstrlenA (lpString="*.flv") returned 5 [0048.795] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.avi") returned 0 [0048.795] lstrlenA (lpString="*.avi") returned 5 [0048.795] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.mp4") returned 0 [0048.795] lstrlenA (lpString="*.mp4") returned 5 [0048.795] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.wmv") returned 0 [0048.795] lstrlenA (lpString="*.wmv") returned 5 [0048.795] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.divx") returned 0 [0048.795] lstrlenA (lpString="*.divx") returned 6 [0048.795] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.mkv") returned 0 [0048.795] lstrlenA (lpString="*.mkv") returned 5 [0048.795] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.mp3") returned 0 [0048.795] lstrlenA (lpString="*.mp3") returned 5 [0048.795] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.wav") returned 0 [0048.795] lstrlenA (lpString="*.wav") returned 5 [0048.795] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.flac") returned 0 [0048.795] lstrlenA (lpString="*.flac") returned 6 [0048.796] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.ape") returned 0 [0048.796] lstrlenA (lpString="*.ape") returned 5 [0048.796] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.wma") returned 0 [0048.796] lstrlenA (lpString="*.wma") returned 5 [0048.796] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.ac3") returned 0 [0048.796] lstrlenA (lpString="*.ac3") returned 5 [0048.796] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", pszSpec="*.mxf") returned 0 [0048.796] lstrlenA (lpString="*.mxf") returned 5 [0048.796] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName="REFINED.INF", cAlternateFileName="")) returned 1 [0048.796] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.796] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="REFINED.INF") returned -1 [0048.796] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="REFINED.INF") returned -1 [0048.796] lstrcmpiA (lpString1="", lpString2="REFINED.INF") returned -1 [0048.796] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned="REFINED.ELM" [0048.796] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\" [0048.796] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\") returned="" [0048.796] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO DECRYPT FILES.txt" [0048.796] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\how to decrypt files.txt")) returned 0x20 [0048.796] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", lpString2="REFINED.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" [0048.796] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.zip") returned 0 [0048.796] lstrlenA (lpString="*.zip") returned 5 [0048.796] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.rar") returned 0 [0048.796] lstrlenA (lpString="*.rar") returned 5 [0048.797] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.7z") returned 0 [0048.797] lstrlenA (lpString="*.7z") returned 4 [0048.797] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.tar") returned 0 [0048.797] lstrlenA (lpString="*.tar") returned 5 [0048.797] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.gzip") returned 0 [0048.797] lstrlenA (lpString="*.gzip") returned 6 [0048.797] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.jpg") returned 0 [0048.797] lstrlenA (lpString="*.jpg") returned 5 [0048.797] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.jpeg") returned 0 [0048.797] lstrlenA (lpString="*.jpeg") returned 6 [0048.797] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.psd") returned 0 [0048.797] lstrlenA (lpString="*.psd") returned 5 [0048.797] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.gif") returned 0 [0048.797] lstrlenA (lpString="*.gif") returned 5 [0048.797] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.doc") returned 0 [0048.797] lstrlenA (lpString="*.doc") returned 5 [0048.797] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.docx") returned 0 [0048.797] lstrlenA (lpString="*.docx") returned 6 [0048.797] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.xls") returned 0 [0048.797] lstrlenA (lpString="*.xls") returned 5 [0048.797] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.xlsx") returned 0 [0048.797] lstrlenA (lpString="*.xlsx") returned 6 [0048.797] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.ppt") returned 0 [0048.797] lstrlenA (lpString="*.ppt") returned 5 [0048.797] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.pptx") returned 0 [0048.798] lstrlenA (lpString="*.pptx") returned 6 [0048.798] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.pdf") returned 0 [0048.798] lstrlenA (lpString="*.pdf") returned 5 [0048.798] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.mov") returned 0 [0048.798] lstrlenA (lpString="*.mov") returned 5 [0048.798] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.m2v") returned 0 [0048.798] lstrlenA (lpString="*.m2v") returned 5 [0048.798] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.3gp") returned 0 [0048.798] lstrlenA (lpString="*.3gp") returned 5 [0048.798] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.mpeg") returned 0 [0048.798] lstrlenA (lpString="*.mpeg") returned 6 [0048.798] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.mpg") returned 0 [0048.798] lstrlenA (lpString="*.mpg") returned 5 [0048.798] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.flv") returned 0 [0048.798] lstrlenA (lpString="*.flv") returned 5 [0048.798] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.avi") returned 0 [0048.798] lstrlenA (lpString="*.avi") returned 5 [0048.798] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.mp4") returned 0 [0048.798] lstrlenA (lpString="*.mp4") returned 5 [0048.798] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.wmv") returned 0 [0048.798] lstrlenA (lpString="*.wmv") returned 5 [0048.798] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.divx") returned 0 [0048.798] lstrlenA (lpString="*.divx") returned 6 [0048.798] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.mkv") returned 0 [0048.798] lstrlenA (lpString="*.mkv") returned 5 [0048.799] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.mp3") returned 0 [0048.799] lstrlenA (lpString="*.mp3") returned 5 [0048.799] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.wav") returned 0 [0048.799] lstrlenA (lpString="*.wav") returned 5 [0048.799] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.flac") returned 0 [0048.799] lstrlenA (lpString="*.flac") returned 6 [0048.799] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.ape") returned 0 [0048.799] lstrlenA (lpString="*.ape") returned 5 [0048.799] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.wma") returned 0 [0048.799] lstrlenA (lpString="*.wma") returned 5 [0048.799] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.ac3") returned 0 [0048.799] lstrlenA (lpString="*.ac3") returned 5 [0048.799] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", pszSpec="*.mxf") returned 0 [0048.799] lstrlenA (lpString="*.mxf") returned 5 [0048.799] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.799] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.799] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.799] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.799] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.799] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned="REFINED.INF" [0048.799] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\" [0048.799] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\") returned="" [0048.799] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO DECRYPT FILES.txt" [0048.799] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\how to decrypt files.txt")) returned 0x20 [0048.800] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" [0048.800] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.800] lstrlenA (lpString="*.zip") returned 5 [0048.800] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.800] lstrlenA (lpString="*.rar") returned 5 [0048.800] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.800] lstrlenA (lpString="*.7z") returned 4 [0048.800] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.800] lstrlenA (lpString="*.tar") returned 5 [0048.800] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.800] lstrlenA (lpString="*.gzip") returned 6 [0048.800] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.800] lstrlenA (lpString="*.jpg") returned 5 [0048.800] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.800] lstrlenA (lpString="*.jpeg") returned 6 [0048.800] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.800] lstrlenA (lpString="*.psd") returned 5 [0048.800] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.800] lstrlenA (lpString="*.gif") returned 5 [0048.800] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.800] lstrlenA (lpString="*.doc") returned 5 [0048.800] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.800] lstrlenA (lpString="*.docx") returned 6 [0048.800] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.801] lstrlenA (lpString="*.xls") returned 5 [0048.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.801] lstrlenA (lpString="*.xlsx") returned 6 [0048.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.801] lstrlenA (lpString="*.ppt") returned 5 [0048.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.801] lstrlenA (lpString="*.pptx") returned 6 [0048.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.801] lstrlenA (lpString="*.pdf") returned 5 [0048.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.801] lstrlenA (lpString="*.mov") returned 5 [0048.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.801] lstrlenA (lpString="*.m2v") returned 5 [0048.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.801] lstrlenA (lpString="*.3gp") returned 5 [0048.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.801] lstrlenA (lpString="*.mpeg") returned 6 [0048.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.801] lstrlenA (lpString="*.mpg") returned 5 [0048.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.801] lstrlenA (lpString="*.flv") returned 5 [0048.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.801] lstrlenA (lpString="*.avi") returned 5 [0048.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.801] lstrlenA (lpString="*.mp4") returned 5 [0048.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.801] lstrlenA (lpString="*.wmv") returned 5 [0048.801] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.802] lstrlenA (lpString="*.divx") returned 6 [0048.802] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.802] lstrlenA (lpString="*.mkv") returned 5 [0048.802] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.802] lstrlenA (lpString="*.mp3") returned 5 [0048.802] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.802] lstrlenA (lpString="*.wav") returned 5 [0048.802] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.802] lstrlenA (lpString="*.flac") returned 6 [0048.802] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.802] lstrlenA (lpString="*.ape") returned 5 [0048.802] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.802] lstrlenA (lpString="*.wma") returned 5 [0048.802] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.802] lstrlenA (lpString="*.ac3") returned 5 [0048.802] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.802] lstrlenA (lpString="*.mxf") returned 5 [0048.802] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.802] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0048.802] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0048.802] lstrcmpA (lpString1=".", lpString2="RICEPAPR") returned -1 [0048.802] lstrcmpA (lpString1="..", lpString2="RICEPAPR") returned -1 [0048.803] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.803] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="RICEPAPR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR" [0048.803] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR") returned 64 [0048.803] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName=".", cAlternateFileName="")) returned 0x2d80c8 [0048.817] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.817] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x740000, cFileName="..", cAlternateFileName="")) returned 1 [0048.817] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.817] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.818] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.818] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.818] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.818] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.818] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.818] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*") returned="*.*" [0048.818] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\" [0048.818] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\") returned="" [0048.818] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO DECRYPT FILES.txt" [0048.818] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\how to decrypt files.txt")) returned 0xffffffff [0048.818] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.820] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.820] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.821] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.821] CloseHandle (hObject=0x90) returned 1 [0048.821] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" [0048.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.821] lstrlenA (lpString="*.zip") returned 5 [0048.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.821] lstrlenA (lpString="*.rar") returned 5 [0048.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.821] lstrlenA (lpString="*.7z") returned 4 [0048.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.822] lstrlenA (lpString="*.tar") returned 5 [0048.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.822] lstrlenA (lpString="*.gzip") returned 6 [0048.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.822] lstrlenA (lpString="*.jpg") returned 5 [0048.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.822] lstrlenA (lpString="*.jpeg") returned 6 [0048.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.822] lstrlenA (lpString="*.psd") returned 5 [0048.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.822] lstrlenA (lpString="*.gif") returned 5 [0048.822] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" [0048.822] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" [0048.822] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF." [0048.822] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.wannacry" [0048.822] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.822] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf82 [0048.822] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1 [0048.823] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.823] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xf04, lpOverlapped=0x0) returned 1 [0048.825] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.825] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.825] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xf04, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xf04, lpOverlapped=0x0) returned 1 [0048.825] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.825] CloseHandle (hObject=0x90) returned 1 [0048.827] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.wannacry")) returned 1 [0048.827] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ffb1e00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ffb1e00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1205e, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="RICEPAPR.ELM", cAlternateFileName="")) returned 1 [0048.828] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.828] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RICEPAPR.ELM") returned -1 [0048.828] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RICEPAPR.ELM") returned -1 [0048.828] lstrcmpiA (lpString1="", lpString2="RICEPAPR.ELM") returned -1 [0048.828] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.828] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\" [0048.828] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\") returned="" [0048.828] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO DECRYPT FILES.txt" [0048.828] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\how to decrypt files.txt")) returned 0x20 [0048.828] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", lpString2="RICEPAPR.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" [0048.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.zip") returned 0 [0048.828] lstrlenA (lpString="*.zip") returned 5 [0048.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.rar") returned 0 [0048.828] lstrlenA (lpString="*.rar") returned 5 [0048.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.7z") returned 0 [0048.828] lstrlenA (lpString="*.7z") returned 4 [0048.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.tar") returned 0 [0048.828] lstrlenA (lpString="*.tar") returned 5 [0048.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.gzip") returned 0 [0048.828] lstrlenA (lpString="*.gzip") returned 6 [0048.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.jpg") returned 0 [0048.828] lstrlenA (lpString="*.jpg") returned 5 [0048.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.jpeg") returned 0 [0048.828] lstrlenA (lpString="*.jpeg") returned 6 [0048.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.psd") returned 0 [0048.828] lstrlenA (lpString="*.psd") returned 5 [0048.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.gif") returned 0 [0048.829] lstrlenA (lpString="*.gif") returned 5 [0048.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.doc") returned 0 [0048.829] lstrlenA (lpString="*.doc") returned 5 [0048.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.docx") returned 0 [0048.829] lstrlenA (lpString="*.docx") returned 6 [0048.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.xls") returned 0 [0048.829] lstrlenA (lpString="*.xls") returned 5 [0048.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.xlsx") returned 0 [0048.829] lstrlenA (lpString="*.xlsx") returned 6 [0048.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.ppt") returned 0 [0048.829] lstrlenA (lpString="*.ppt") returned 5 [0048.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.pptx") returned 0 [0048.829] lstrlenA (lpString="*.pptx") returned 6 [0048.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.pdf") returned 0 [0048.829] lstrlenA (lpString="*.pdf") returned 5 [0048.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.mov") returned 0 [0048.829] lstrlenA (lpString="*.mov") returned 5 [0048.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.m2v") returned 0 [0048.829] lstrlenA (lpString="*.m2v") returned 5 [0048.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.3gp") returned 0 [0048.829] lstrlenA (lpString="*.3gp") returned 5 [0048.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.mpeg") returned 0 [0048.829] lstrlenA (lpString="*.mpeg") returned 6 [0048.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.mpg") returned 0 [0048.829] lstrlenA (lpString="*.mpg") returned 5 [0048.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.flv") returned 0 [0048.829] lstrlenA (lpString="*.flv") returned 5 [0048.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.avi") returned 0 [0048.830] lstrlenA (lpString="*.avi") returned 5 [0048.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.mp4") returned 0 [0048.830] lstrlenA (lpString="*.mp4") returned 5 [0048.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.wmv") returned 0 [0048.830] lstrlenA (lpString="*.wmv") returned 5 [0048.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.divx") returned 0 [0048.830] lstrlenA (lpString="*.divx") returned 6 [0048.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.mkv") returned 0 [0048.830] lstrlenA (lpString="*.mkv") returned 5 [0048.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.mp3") returned 0 [0048.830] lstrlenA (lpString="*.mp3") returned 5 [0048.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.wav") returned 0 [0048.830] lstrlenA (lpString="*.wav") returned 5 [0048.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.flac") returned 0 [0048.830] lstrlenA (lpString="*.flac") returned 6 [0048.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.ape") returned 0 [0048.830] lstrlenA (lpString="*.ape") returned 5 [0048.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.wma") returned 0 [0048.830] lstrlenA (lpString="*.wma") returned 5 [0048.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.ac3") returned 0 [0048.830] lstrlenA (lpString="*.ac3") returned 5 [0048.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", pszSpec="*.mxf") returned 0 [0048.830] lstrlenA (lpString="*.mxf") returned 5 [0048.830] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="RICEPAPR.INF", cAlternateFileName="")) returned 1 [0048.830] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.830] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RICEPAPR.INF") returned -1 [0048.830] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RICEPAPR.INF") returned -1 [0048.831] lstrcmpiA (lpString1="", lpString2="RICEPAPR.INF") returned -1 [0048.831] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned="RICEPAPR.ELM" [0048.831] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\" [0048.831] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\") returned="" [0048.831] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO DECRYPT FILES.txt" [0048.831] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\how to decrypt files.txt")) returned 0x20 [0048.831] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", lpString2="RICEPAPR.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" [0048.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.zip") returned 0 [0048.831] lstrlenA (lpString="*.zip") returned 5 [0048.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.rar") returned 0 [0048.831] lstrlenA (lpString="*.rar") returned 5 [0048.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.7z") returned 0 [0048.831] lstrlenA (lpString="*.7z") returned 4 [0048.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.tar") returned 0 [0048.831] lstrlenA (lpString="*.tar") returned 5 [0048.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.gzip") returned 0 [0048.831] lstrlenA (lpString="*.gzip") returned 6 [0048.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.jpg") returned 0 [0048.831] lstrlenA (lpString="*.jpg") returned 5 [0048.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.jpeg") returned 0 [0048.831] lstrlenA (lpString="*.jpeg") returned 6 [0048.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.psd") returned 0 [0048.831] lstrlenA (lpString="*.psd") returned 5 [0048.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.gif") returned 0 [0048.831] lstrlenA (lpString="*.gif") returned 5 [0048.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.doc") returned 0 [0048.831] lstrlenA (lpString="*.doc") returned 5 [0048.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.docx") returned 0 [0048.831] lstrlenA (lpString="*.docx") returned 6 [0048.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.xls") returned 0 [0048.832] lstrlenA (lpString="*.xls") returned 5 [0048.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.xlsx") returned 0 [0048.832] lstrlenA (lpString="*.xlsx") returned 6 [0048.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.ppt") returned 0 [0048.832] lstrlenA (lpString="*.ppt") returned 5 [0048.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.pptx") returned 0 [0048.832] lstrlenA (lpString="*.pptx") returned 6 [0048.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.pdf") returned 0 [0048.832] lstrlenA (lpString="*.pdf") returned 5 [0048.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.mov") returned 0 [0048.832] lstrlenA (lpString="*.mov") returned 5 [0048.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.m2v") returned 0 [0048.832] lstrlenA (lpString="*.m2v") returned 5 [0048.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.3gp") returned 0 [0048.832] lstrlenA (lpString="*.3gp") returned 5 [0048.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.mpeg") returned 0 [0048.832] lstrlenA (lpString="*.mpeg") returned 6 [0048.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.mpg") returned 0 [0048.832] lstrlenA (lpString="*.mpg") returned 5 [0048.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.flv") returned 0 [0048.832] lstrlenA (lpString="*.flv") returned 5 [0048.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.avi") returned 0 [0048.832] lstrlenA (lpString="*.avi") returned 5 [0048.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.mp4") returned 0 [0048.832] lstrlenA (lpString="*.mp4") returned 5 [0048.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.wmv") returned 0 [0048.832] lstrlenA (lpString="*.wmv") returned 5 [0048.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.divx") returned 0 [0048.832] lstrlenA (lpString="*.divx") returned 6 [0048.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.mkv") returned 0 [0048.832] lstrlenA (lpString="*.mkv") returned 5 [0048.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.mp3") returned 0 [0048.833] lstrlenA (lpString="*.mp3") returned 5 [0048.833] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.wav") returned 0 [0048.833] lstrlenA (lpString="*.wav") returned 5 [0048.833] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.flac") returned 0 [0048.833] lstrlenA (lpString="*.flac") returned 6 [0048.833] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.ape") returned 0 [0048.833] lstrlenA (lpString="*.ape") returned 5 [0048.833] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.wma") returned 0 [0048.833] lstrlenA (lpString="*.wma") returned 5 [0048.833] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.ac3") returned 0 [0048.833] lstrlenA (lpString="*.ac3") returned 5 [0048.833] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", pszSpec="*.mxf") returned 0 [0048.833] lstrlenA (lpString="*.mxf") returned 5 [0048.833] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.833] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.833] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.833] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.833] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.833] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned="RICEPAPR.INF" [0048.833] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\" [0048.833] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\") returned="" [0048.833] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO DECRYPT FILES.txt" [0048.833] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\how to decrypt files.txt")) returned 0x20 [0048.833] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" [0048.833] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.833] lstrlenA (lpString="*.zip") returned 5 [0048.833] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.834] lstrlenA (lpString="*.rar") returned 5 [0048.834] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.834] lstrlenA (lpString="*.7z") returned 4 [0048.834] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.834] lstrlenA (lpString="*.tar") returned 5 [0048.834] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.834] lstrlenA (lpString="*.gzip") returned 6 [0048.834] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.834] lstrlenA (lpString="*.jpg") returned 5 [0048.834] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.834] lstrlenA (lpString="*.jpeg") returned 6 [0048.834] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.834] lstrlenA (lpString="*.psd") returned 5 [0048.834] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.834] lstrlenA (lpString="*.gif") returned 5 [0048.834] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.834] lstrlenA (lpString="*.doc") returned 5 [0048.834] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.834] lstrlenA (lpString="*.docx") returned 6 [0048.834] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.834] lstrlenA (lpString="*.xls") returned 5 [0048.834] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.834] lstrlenA (lpString="*.xlsx") returned 6 [0048.834] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.834] lstrlenA (lpString="*.ppt") returned 5 [0048.834] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.834] lstrlenA (lpString="*.pptx") returned 6 [0048.834] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.834] lstrlenA (lpString="*.pdf") returned 5 [0048.834] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.835] lstrlenA (lpString="*.mov") returned 5 [0048.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.835] lstrlenA (lpString="*.m2v") returned 5 [0048.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.835] lstrlenA (lpString="*.3gp") returned 5 [0048.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.835] lstrlenA (lpString="*.mpeg") returned 6 [0048.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.835] lstrlenA (lpString="*.mpg") returned 5 [0048.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.835] lstrlenA (lpString="*.flv") returned 5 [0048.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.835] lstrlenA (lpString="*.avi") returned 5 [0048.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.835] lstrlenA (lpString="*.mp4") returned 5 [0048.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.835] lstrlenA (lpString="*.wmv") returned 5 [0048.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.835] lstrlenA (lpString="*.divx") returned 6 [0048.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.835] lstrlenA (lpString="*.mkv") returned 5 [0048.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.835] lstrlenA (lpString="*.mp3") returned 5 [0048.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.835] lstrlenA (lpString="*.wav") returned 5 [0048.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.835] lstrlenA (lpString="*.flac") returned 6 [0048.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.835] lstrlenA (lpString="*.ape") returned 5 [0048.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.835] lstrlenA (lpString="*.wma") returned 5 [0048.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.835] lstrlenA (lpString="*.ac3") returned 5 [0048.835] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.836] lstrlenA (lpString="*.mxf") returned 5 [0048.836] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.836] FindClose (in: hFindFile=0x2d80c8 | out: hFindFile=0x2d80c8) returned 1 [0048.836] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0048.836] lstrcmpA (lpString1=".", lpString2="RIPPLE") returned -1 [0048.836] lstrcmpA (lpString1="..", lpString2="RIPPLE") returned -1 [0048.836] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.836] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="RIPPLE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE" [0048.836] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE") returned 62 [0048.836] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0048.836] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.836] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x780000, cFileName="..", cAlternateFileName="")) returned 1 [0048.836] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.836] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.836] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.836] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.836] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.837] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.837] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.837] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*") returned="*.*" [0048.837] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\" [0048.837] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\") returned="" [0048.837] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\HOW TO DECRYPT FILES.txt" [0048.837] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\how to decrypt files.txt")) returned 0xffffffff [0048.837] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.837] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.837] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.839] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.839] CloseHandle (hObject=0x90) returned 1 [0048.839] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" [0048.839] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.839] lstrlenA (lpString="*.zip") returned 5 [0048.839] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.839] lstrlenA (lpString="*.rar") returned 5 [0048.839] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.839] lstrlenA (lpString="*.7z") returned 4 [0048.839] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.840] lstrlenA (lpString="*.tar") returned 5 [0048.840] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.840] lstrlenA (lpString="*.gzip") returned 6 [0048.840] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.840] lstrlenA (lpString="*.jpg") returned 5 [0048.840] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.840] lstrlenA (lpString="*.jpeg") returned 6 [0048.840] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.840] lstrlenA (lpString="*.psd") returned 5 [0048.840] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.840] lstrlenA (lpString="*.gif") returned 5 [0048.840] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" [0048.840] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" [0048.840] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF." [0048.840] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.wannacry" [0048.840] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.842] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa2c [0048.842] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a71ef90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1 [0048.842] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.842] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x9ae, lpOverlapped=0x0) returned 1 [0048.844] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.844] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.844] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x9ae, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x9ae, lpOverlapped=0x0) returned 1 [0048.844] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.844] CloseHandle (hObject=0x90) returned 1 [0048.851] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.wannacry")) returned 1 [0048.854] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x212c4b00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x212c4b00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101e0, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="RIPPLE.ELM", cAlternateFileName="")) returned 1 [0048.854] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.854] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RIPPLE.ELM") returned -1 [0048.854] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RIPPLE.ELM") returned -1 [0048.855] lstrcmpiA (lpString1="", lpString2="RIPPLE.ELM") returned -1 [0048.855] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.855] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\" [0048.855] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\") returned="" [0048.855] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\how to decrypt files.txt")) returned 0x20 [0048.855] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.zip") returned 0 [0048.855] lstrlenA (lpString="*.zip") returned 5 [0048.855] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.rar") returned 0 [0048.855] lstrlenA (lpString="*.rar") returned 5 [0048.855] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.7z") returned 0 [0048.855] lstrlenA (lpString="*.7z") returned 4 [0048.855] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.tar") returned 0 [0048.855] lstrlenA (lpString="*.tar") returned 5 [0048.855] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.gzip") returned 0 [0048.855] lstrlenA (lpString="*.gzip") returned 6 [0048.855] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.jpg") returned 0 [0048.855] lstrlenA (lpString="*.jpg") returned 5 [0048.855] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.jpeg") returned 0 [0048.855] lstrlenA (lpString="*.jpeg") returned 6 [0048.855] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.psd") returned 0 [0048.855] lstrlenA (lpString="*.psd") returned 5 [0048.856] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.gif") returned 0 [0048.856] lstrlenA (lpString="*.gif") returned 5 [0048.856] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.doc") returned 0 [0048.856] lstrlenA (lpString="*.doc") returned 5 [0048.856] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.docx") returned 0 [0048.856] lstrlenA (lpString="*.docx") returned 6 [0048.856] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.xls") returned 0 [0048.856] lstrlenA (lpString="*.xls") returned 5 [0048.856] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.xlsx") returned 0 [0048.856] lstrlenA (lpString="*.xlsx") returned 6 [0048.856] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.ppt") returned 0 [0048.856] lstrlenA (lpString="*.ppt") returned 5 [0048.856] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.pptx") returned 0 [0048.856] lstrlenA (lpString="*.pptx") returned 6 [0048.856] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.pdf") returned 0 [0048.856] lstrlenA (lpString="*.pdf") returned 5 [0048.856] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.mov") returned 0 [0048.856] lstrlenA (lpString="*.mov") returned 5 [0048.856] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.m2v") returned 0 [0048.856] lstrlenA (lpString="*.m2v") returned 5 [0048.856] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.3gp") returned 0 [0048.856] lstrlenA (lpString="*.3gp") returned 5 [0048.856] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.mpeg") returned 0 [0048.856] lstrlenA (lpString="*.mpeg") returned 6 [0048.856] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.mpg") returned 0 [0048.856] lstrlenA (lpString="*.mpg") returned 5 [0048.856] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.flv") returned 0 [0048.857] lstrlenA (lpString="*.flv") returned 5 [0048.857] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.avi") returned 0 [0048.857] lstrlenA (lpString="*.avi") returned 5 [0048.857] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.mp4") returned 0 [0048.857] lstrlenA (lpString="*.mp4") returned 5 [0048.857] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.wmv") returned 0 [0048.857] lstrlenA (lpString="*.wmv") returned 5 [0048.857] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.divx") returned 0 [0048.857] lstrlenA (lpString="*.divx") returned 6 [0048.857] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.mkv") returned 0 [0048.857] lstrlenA (lpString="*.mkv") returned 5 [0048.857] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.mp3") returned 0 [0048.857] lstrlenA (lpString="*.mp3") returned 5 [0048.857] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.wav") returned 0 [0048.857] lstrlenA (lpString="*.wav") returned 5 [0048.857] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.flac") returned 0 [0048.857] lstrlenA (lpString="*.flac") returned 6 [0048.857] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.ape") returned 0 [0048.857] lstrlenA (lpString="*.ape") returned 5 [0048.857] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.wma") returned 0 [0048.857] lstrlenA (lpString="*.wma") returned 5 [0048.857] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.ac3") returned 0 [0048.857] lstrlenA (lpString="*.ac3") returned 5 [0048.857] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", pszSpec="*.mxf") returned 0 [0048.857] lstrlenA (lpString="*.mxf") returned 5 [0048.858] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e7, dwReserved0=0x780074, dwReserved1=0x74, cFileName="RIPPLE.INF", cAlternateFileName="")) returned 1 [0048.858] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.858] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RIPPLE.INF") returned -1 [0048.858] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RIPPLE.INF") returned -1 [0048.858] lstrcmpiA (lpString1="", lpString2="RIPPLE.INF") returned -1 [0048.858] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned="RIPPLE.ELM" [0048.858] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\" [0048.858] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\") returned="" [0048.858] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\how to decrypt files.txt")) returned 0x20 [0048.858] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.zip") returned 0 [0048.858] lstrlenA (lpString="*.zip") returned 5 [0048.858] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.rar") returned 0 [0048.858] lstrlenA (lpString="*.rar") returned 5 [0048.858] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.7z") returned 0 [0048.858] lstrlenA (lpString="*.7z") returned 4 [0048.858] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.tar") returned 0 [0048.858] lstrlenA (lpString="*.tar") returned 5 [0048.858] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.gzip") returned 0 [0048.858] lstrlenA (lpString="*.gzip") returned 6 [0048.858] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.jpg") returned 0 [0048.859] lstrlenA (lpString="*.jpg") returned 5 [0048.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.jpeg") returned 0 [0048.859] lstrlenA (lpString="*.jpeg") returned 6 [0048.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.psd") returned 0 [0048.859] lstrlenA (lpString="*.psd") returned 5 [0048.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.gif") returned 0 [0048.859] lstrlenA (lpString="*.gif") returned 5 [0048.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.doc") returned 0 [0048.859] lstrlenA (lpString="*.doc") returned 5 [0048.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.docx") returned 0 [0048.859] lstrlenA (lpString="*.docx") returned 6 [0048.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.xls") returned 0 [0048.859] lstrlenA (lpString="*.xls") returned 5 [0048.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.xlsx") returned 0 [0048.859] lstrlenA (lpString="*.xlsx") returned 6 [0048.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.ppt") returned 0 [0048.859] lstrlenA (lpString="*.ppt") returned 5 [0048.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.pptx") returned 0 [0048.859] lstrlenA (lpString="*.pptx") returned 6 [0048.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.pdf") returned 0 [0048.859] lstrlenA (lpString="*.pdf") returned 5 [0048.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.mov") returned 0 [0048.859] lstrlenA (lpString="*.mov") returned 5 [0048.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.m2v") returned 0 [0048.859] lstrlenA (lpString="*.m2v") returned 5 [0048.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.3gp") returned 0 [0048.859] lstrlenA (lpString="*.3gp") returned 5 [0048.859] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.mpeg") returned 0 [0048.860] lstrlenA (lpString="*.mpeg") returned 6 [0048.860] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.mpg") returned 0 [0048.860] lstrlenA (lpString="*.mpg") returned 5 [0048.860] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.flv") returned 0 [0048.860] lstrlenA (lpString="*.flv") returned 5 [0048.860] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.avi") returned 0 [0048.860] lstrlenA (lpString="*.avi") returned 5 [0048.860] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.mp4") returned 0 [0048.860] lstrlenA (lpString="*.mp4") returned 5 [0048.860] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.wmv") returned 0 [0048.860] lstrlenA (lpString="*.wmv") returned 5 [0048.860] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.divx") returned 0 [0048.860] lstrlenA (lpString="*.divx") returned 6 [0048.860] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.mkv") returned 0 [0048.860] lstrlenA (lpString="*.mkv") returned 5 [0048.860] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.mp3") returned 0 [0048.860] lstrlenA (lpString="*.mp3") returned 5 [0048.860] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.wav") returned 0 [0048.860] lstrlenA (lpString="*.wav") returned 5 [0048.860] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.flac") returned 0 [0048.860] lstrlenA (lpString="*.flac") returned 6 [0048.860] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.ape") returned 0 [0048.860] lstrlenA (lpString="*.ape") returned 5 [0048.860] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.wma") returned 0 [0048.860] lstrlenA (lpString="*.wma") returned 5 [0048.860] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.ac3") returned 0 [0048.860] lstrlenA (lpString="*.ac3") returned 5 [0048.861] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", pszSpec="*.mxf") returned 0 [0048.861] lstrlenA (lpString="*.mxf") returned 5 [0048.861] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x780074, dwReserved1=0x74, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.861] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.861] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.861] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.861] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.861] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned="RIPPLE.INF" [0048.861] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\" [0048.861] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\") returned="" [0048.861] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\how to decrypt files.txt")) returned 0x20 [0048.861] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.861] lstrlenA (lpString="*.zip") returned 5 [0048.861] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.861] lstrlenA (lpString="*.rar") returned 5 [0048.861] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.861] lstrlenA (lpString="*.7z") returned 4 [0048.861] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.861] lstrlenA (lpString="*.tar") returned 5 [0048.861] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.862] lstrlenA (lpString="*.gzip") returned 6 [0048.862] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.862] lstrlenA (lpString="*.jpg") returned 5 [0048.862] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.862] lstrlenA (lpString="*.jpeg") returned 6 [0048.862] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.862] lstrlenA (lpString="*.psd") returned 5 [0048.862] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.862] lstrlenA (lpString="*.gif") returned 5 [0048.862] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.862] lstrlenA (lpString="*.doc") returned 5 [0048.862] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.862] lstrlenA (lpString="*.docx") returned 6 [0048.862] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.862] lstrlenA (lpString="*.xls") returned 5 [0048.862] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.862] lstrlenA (lpString="*.xlsx") returned 6 [0048.862] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.862] lstrlenA (lpString="*.ppt") returned 5 [0048.862] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.862] lstrlenA (lpString="*.pptx") returned 6 [0048.862] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.862] lstrlenA (lpString="*.pdf") returned 5 [0048.862] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.862] lstrlenA (lpString="*.mov") returned 5 [0048.862] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.863] lstrlenA (lpString="*.m2v") returned 5 [0048.863] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.863] lstrlenA (lpString="*.3gp") returned 5 [0048.863] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.863] lstrlenA (lpString="*.mpeg") returned 6 [0048.863] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.863] lstrlenA (lpString="*.mpg") returned 5 [0048.863] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.863] lstrlenA (lpString="*.flv") returned 5 [0048.863] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.863] lstrlenA (lpString="*.avi") returned 5 [0048.863] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.863] lstrlenA (lpString="*.mp4") returned 5 [0048.863] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.863] lstrlenA (lpString="*.wmv") returned 5 [0048.863] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.863] lstrlenA (lpString="*.divx") returned 6 [0048.863] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.863] lstrlenA (lpString="*.mkv") returned 5 [0048.863] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.863] lstrlenA (lpString="*.mp3") returned 5 [0048.863] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.863] lstrlenA (lpString="*.wav") returned 5 [0048.863] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.863] lstrlenA (lpString="*.flac") returned 6 [0048.863] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.864] lstrlenA (lpString="*.ape") returned 5 [0048.864] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.864] lstrlenA (lpString="*.wma") returned 5 [0048.864] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.864] lstrlenA (lpString="*.ac3") returned 5 [0048.864] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.864] lstrlenA (lpString="*.mxf") returned 5 [0048.864] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x780074, dwReserved1=0x74, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.864] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0048.864] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0048.864] lstrcmpA (lpString1=".", lpString2="RMNSQUE") returned -1 [0048.864] lstrcmpA (lpString1="..", lpString2="RMNSQUE") returned -1 [0048.864] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.864] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE") returned 63 [0048.864] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0048.865] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.865] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.865] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.865] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.865] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.865] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.865] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.865] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.865] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.865] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*") returned="*.*" [0048.865] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\" [0048.865] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\") returned="" [0048.865] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\how to decrypt files.txt")) returned 0xffffffff [0048.865] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.866] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.866] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.867] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.867] CloseHandle (hObject=0x90) returned 1 [0048.868] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" [0048.868] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.868] lstrlenA (lpString="*.zip") returned 5 [0048.868] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.868] lstrlenA (lpString="*.rar") returned 5 [0048.868] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.868] lstrlenA (lpString="*.7z") returned 4 [0048.868] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.868] lstrlenA (lpString="*.tar") returned 5 [0048.868] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.868] lstrlenA (lpString="*.gzip") returned 6 [0048.868] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.868] lstrlenA (lpString="*.jpg") returned 5 [0048.868] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.868] lstrlenA (lpString="*.jpeg") returned 6 [0048.868] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.868] lstrlenA (lpString="*.psd") returned 5 [0048.868] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.868] lstrlenA (lpString="*.gif") returned 5 [0048.868] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" [0048.868] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" [0048.868] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF." [0048.868] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.wannacry" [0048.869] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.869] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1004 [0048.869] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a71ef90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1 [0048.869] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.869] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xf86, lpOverlapped=0x0) returned 1 [0048.871] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.872] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.872] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xf86, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xf86, lpOverlapped=0x0) returned 1 [0048.872] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.872] CloseHandle (hObject=0x90) returned 1 [0048.875] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.wannacry")) returned 1 [0048.880] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x225d7800, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x225d7800, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x11e37, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="RMNSQUE.ELM", cAlternateFileName="")) returned 1 [0048.880] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.880] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RMNSQUE.ELM") returned -1 [0048.881] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RMNSQUE.ELM") returned -1 [0048.881] lstrcmpiA (lpString1="", lpString2="RMNSQUE.ELM") returned -1 [0048.881] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.881] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\" [0048.881] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\") returned="" [0048.881] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW TO DECRYPT FILES.txt" [0048.881] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\how to decrypt files.txt")) returned 0x20 [0048.881] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", lpString2="RMNSQUE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" [0048.881] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.zip") returned 0 [0048.881] lstrlenA (lpString="*.zip") returned 5 [0048.881] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.rar") returned 0 [0048.881] lstrlenA (lpString="*.rar") returned 5 [0048.881] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.7z") returned 0 [0048.881] lstrlenA (lpString="*.7z") returned 4 [0048.881] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.tar") returned 0 [0048.881] lstrlenA (lpString="*.tar") returned 5 [0048.881] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.gzip") returned 0 [0048.881] lstrlenA (lpString="*.gzip") returned 6 [0048.881] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.jpg") returned 0 [0048.881] lstrlenA (lpString="*.jpg") returned 5 [0048.881] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.jpeg") returned 0 [0048.881] lstrlenA (lpString="*.jpeg") returned 6 [0048.882] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.psd") returned 0 [0048.882] lstrlenA (lpString="*.psd") returned 5 [0048.882] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.gif") returned 0 [0048.882] lstrlenA (lpString="*.gif") returned 5 [0048.882] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.doc") returned 0 [0048.882] lstrlenA (lpString="*.doc") returned 5 [0048.882] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.docx") returned 0 [0048.882] lstrlenA (lpString="*.docx") returned 6 [0048.882] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.xls") returned 0 [0048.882] lstrlenA (lpString="*.xls") returned 5 [0048.882] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.xlsx") returned 0 [0048.882] lstrlenA (lpString="*.xlsx") returned 6 [0048.882] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.ppt") returned 0 [0048.882] lstrlenA (lpString="*.ppt") returned 5 [0048.882] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.pptx") returned 0 [0048.882] lstrlenA (lpString="*.pptx") returned 6 [0048.882] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.pdf") returned 0 [0048.882] lstrlenA (lpString="*.pdf") returned 5 [0048.882] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.mov") returned 0 [0048.882] lstrlenA (lpString="*.mov") returned 5 [0048.882] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.m2v") returned 0 [0048.882] lstrlenA (lpString="*.m2v") returned 5 [0048.882] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.3gp") returned 0 [0048.882] lstrlenA (lpString="*.3gp") returned 5 [0048.882] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.mpeg") returned 0 [0048.882] lstrlenA (lpString="*.mpeg") returned 6 [0048.882] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.mpg") returned 0 [0048.883] lstrlenA (lpString="*.mpg") returned 5 [0048.883] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.flv") returned 0 [0048.883] lstrlenA (lpString="*.flv") returned 5 [0048.883] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.avi") returned 0 [0048.883] lstrlenA (lpString="*.avi") returned 5 [0048.883] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.mp4") returned 0 [0048.883] lstrlenA (lpString="*.mp4") returned 5 [0048.883] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.wmv") returned 0 [0048.883] lstrlenA (lpString="*.wmv") returned 5 [0048.883] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.divx") returned 0 [0048.883] lstrlenA (lpString="*.divx") returned 6 [0048.883] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.mkv") returned 0 [0048.883] lstrlenA (lpString="*.mkv") returned 5 [0048.883] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.mp3") returned 0 [0048.883] lstrlenA (lpString="*.mp3") returned 5 [0048.883] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.wav") returned 0 [0048.883] lstrlenA (lpString="*.wav") returned 5 [0048.883] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.flac") returned 0 [0048.883] lstrlenA (lpString="*.flac") returned 6 [0048.883] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.ape") returned 0 [0048.883] lstrlenA (lpString="*.ape") returned 5 [0048.883] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.wma") returned 0 [0048.883] lstrlenA (lpString="*.wma") returned 5 [0048.883] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.ac3") returned 0 [0048.883] lstrlenA (lpString="*.ac3") returned 5 [0048.883] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", pszSpec="*.mxf") returned 0 [0048.883] lstrlenA (lpString="*.mxf") returned 5 [0048.883] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName="RMNSQUE.INF", cAlternateFileName="")) returned 1 [0048.884] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.884] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RMNSQUE.INF") returned -1 [0048.884] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RMNSQUE.INF") returned -1 [0048.884] lstrcmpiA (lpString1="", lpString2="RMNSQUE.INF") returned -1 [0048.884] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned="RMNSQUE.ELM" [0048.884] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\" [0048.884] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\") returned="" [0048.884] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW TO DECRYPT FILES.txt" [0048.884] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\how to decrypt files.txt")) returned 0x20 [0048.884] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", lpString2="RMNSQUE.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" [0048.884] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.zip") returned 0 [0048.884] lstrlenA (lpString="*.zip") returned 5 [0048.884] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.rar") returned 0 [0048.884] lstrlenA (lpString="*.rar") returned 5 [0048.884] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.7z") returned 0 [0048.884] lstrlenA (lpString="*.7z") returned 4 [0048.884] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.tar") returned 0 [0048.884] lstrlenA (lpString="*.tar") returned 5 [0048.884] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.gzip") returned 0 [0048.884] lstrlenA (lpString="*.gzip") returned 6 [0048.884] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.jpg") returned 0 [0048.884] lstrlenA (lpString="*.jpg") returned 5 [0048.885] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.jpeg") returned 0 [0048.885] lstrlenA (lpString="*.jpeg") returned 6 [0048.885] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.psd") returned 0 [0048.885] lstrlenA (lpString="*.psd") returned 5 [0048.885] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.gif") returned 0 [0048.885] lstrlenA (lpString="*.gif") returned 5 [0048.885] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.doc") returned 0 [0048.885] lstrlenA (lpString="*.doc") returned 5 [0048.885] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.docx") returned 0 [0048.885] lstrlenA (lpString="*.docx") returned 6 [0048.885] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.xls") returned 0 [0048.885] lstrlenA (lpString="*.xls") returned 5 [0048.885] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.xlsx") returned 0 [0048.885] lstrlenA (lpString="*.xlsx") returned 6 [0048.885] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.ppt") returned 0 [0048.885] lstrlenA (lpString="*.ppt") returned 5 [0048.885] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.pptx") returned 0 [0048.885] lstrlenA (lpString="*.pptx") returned 6 [0048.885] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.pdf") returned 0 [0048.885] lstrlenA (lpString="*.pdf") returned 5 [0048.885] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.mov") returned 0 [0048.885] lstrlenA (lpString="*.mov") returned 5 [0048.886] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.m2v") returned 0 [0048.886] lstrlenA (lpString="*.m2v") returned 5 [0048.886] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.3gp") returned 0 [0048.886] lstrlenA (lpString="*.3gp") returned 5 [0048.886] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.mpeg") returned 0 [0048.886] lstrlenA (lpString="*.mpeg") returned 6 [0048.886] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.mpg") returned 0 [0048.886] lstrlenA (lpString="*.mpg") returned 5 [0048.886] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.flv") returned 0 [0048.886] lstrlenA (lpString="*.flv") returned 5 [0048.886] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.avi") returned 0 [0048.886] lstrlenA (lpString="*.avi") returned 5 [0048.886] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.mp4") returned 0 [0048.886] lstrlenA (lpString="*.mp4") returned 5 [0048.886] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.wmv") returned 0 [0048.886] lstrlenA (lpString="*.wmv") returned 5 [0048.886] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.divx") returned 0 [0048.886] lstrlenA (lpString="*.divx") returned 6 [0048.886] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.mkv") returned 0 [0048.886] lstrlenA (lpString="*.mkv") returned 5 [0048.886] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.mp3") returned 0 [0048.886] lstrlenA (lpString="*.mp3") returned 5 [0048.886] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.wav") returned 0 [0048.886] lstrlenA (lpString="*.wav") returned 5 [0048.886] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.flac") returned 0 [0048.886] lstrlenA (lpString="*.flac") returned 6 [0048.887] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.ape") returned 0 [0048.887] lstrlenA (lpString="*.ape") returned 5 [0048.887] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.wma") returned 0 [0048.887] lstrlenA (lpString="*.wma") returned 5 [0048.887] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.ac3") returned 0 [0048.887] lstrlenA (lpString="*.ac3") returned 5 [0048.887] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", pszSpec="*.mxf") returned 0 [0048.887] lstrlenA (lpString="*.mxf") returned 5 [0048.887] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.887] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.887] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.887] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.887] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.887] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned="RMNSQUE.INF" [0048.887] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\" [0048.887] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\") returned="" [0048.887] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW TO DECRYPT FILES.txt" [0048.887] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\how to decrypt files.txt")) returned 0x20 [0048.887] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" [0048.887] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.887] lstrlenA (lpString="*.zip") returned 5 [0048.887] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.887] lstrlenA (lpString="*.rar") returned 5 [0048.888] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.888] lstrlenA (lpString="*.7z") returned 4 [0048.888] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.888] lstrlenA (lpString="*.tar") returned 5 [0048.888] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.888] lstrlenA (lpString="*.gzip") returned 6 [0048.888] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.888] lstrlenA (lpString="*.jpg") returned 5 [0048.888] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.888] lstrlenA (lpString="*.jpeg") returned 6 [0048.888] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.888] lstrlenA (lpString="*.psd") returned 5 [0048.888] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.888] lstrlenA (lpString="*.gif") returned 5 [0048.888] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.888] lstrlenA (lpString="*.doc") returned 5 [0048.888] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.888] lstrlenA (lpString="*.docx") returned 6 [0048.888] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.888] lstrlenA (lpString="*.xls") returned 5 [0048.888] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.888] lstrlenA (lpString="*.xlsx") returned 6 [0048.888] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.888] lstrlenA (lpString="*.ppt") returned 5 [0048.888] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.888] lstrlenA (lpString="*.pptx") returned 6 [0048.888] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.889] lstrlenA (lpString="*.pdf") returned 5 [0048.889] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.889] lstrlenA (lpString="*.mov") returned 5 [0048.889] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.889] lstrlenA (lpString="*.m2v") returned 5 [0048.889] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.889] lstrlenA (lpString="*.3gp") returned 5 [0048.889] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.889] lstrlenA (lpString="*.mpeg") returned 6 [0048.889] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.889] lstrlenA (lpString="*.mpg") returned 5 [0048.889] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.889] lstrlenA (lpString="*.flv") returned 5 [0048.889] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.889] lstrlenA (lpString="*.avi") returned 5 [0048.889] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.889] lstrlenA (lpString="*.mp4") returned 5 [0048.889] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.889] lstrlenA (lpString="*.wmv") returned 5 [0048.889] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.889] lstrlenA (lpString="*.divx") returned 6 [0048.889] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.889] lstrlenA (lpString="*.mkv") returned 5 [0048.889] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.889] lstrlenA (lpString="*.mp3") returned 5 [0048.889] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.889] lstrlenA (lpString="*.wav") returned 5 [0048.890] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.890] lstrlenA (lpString="*.flac") returned 6 [0048.890] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.890] lstrlenA (lpString="*.ape") returned 5 [0048.890] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.890] lstrlenA (lpString="*.wma") returned 5 [0048.890] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.890] lstrlenA (lpString="*.ac3") returned 5 [0048.890] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.890] lstrlenA (lpString="*.mxf") returned 5 [0048.890] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.890] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0048.890] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="SATIN", cAlternateFileName="")) returned 1 [0048.890] lstrcmpA (lpString1=".", lpString2="SATIN") returned -1 [0048.890] lstrcmpA (lpString1="..", lpString2="SATIN") returned -1 [0048.890] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.890] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="SATIN" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN" [0048.890] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN") returned 61 [0048.890] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0048.891] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.891] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x740000, cFileName="..", cAlternateFileName="")) returned 1 [0048.891] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.891] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.891] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.891] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.891] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.891] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.891] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.891] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*") returned="*.*" [0048.891] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\" [0048.891] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\") returned="" [0048.891] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO DECRYPT FILES.txt" [0048.891] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\how to decrypt files.txt")) returned 0xffffffff [0048.892] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.892] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.892] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.893] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.893] CloseHandle (hObject=0x90) returned 1 [0048.894] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" [0048.894] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.894] lstrlenA (lpString="*.zip") returned 5 [0048.894] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.894] lstrlenA (lpString="*.rar") returned 5 [0048.894] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.894] lstrlenA (lpString="*.7z") returned 4 [0048.894] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.894] lstrlenA (lpString="*.tar") returned 5 [0048.894] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.894] lstrlenA (lpString="*.gzip") returned 6 [0048.894] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.894] lstrlenA (lpString="*.jpg") returned 5 [0048.894] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.894] lstrlenA (lpString="*.jpeg") returned 6 [0048.894] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.894] lstrlenA (lpString="*.psd") returned 5 [0048.894] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.894] lstrlenA (lpString="*.gif") returned 5 [0048.894] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" [0048.895] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" [0048.895] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF." [0048.895] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.wannacry" [0048.895] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.896] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe1b [0048.896] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a71ef90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1 [0048.896] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.896] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd9d, lpOverlapped=0x0) returned 1 [0048.898] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.898] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.898] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd9d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd9d, lpOverlapped=0x0) returned 1 [0048.899] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.899] CloseHandle (hObject=0x90) returned 1 [0048.904] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.wannacry")) returned 1 [0048.906] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bfd200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bfd200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1936f, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="SATIN.ELM", cAlternateFileName="")) returned 1 [0048.907] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.907] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SATIN.ELM") returned -1 [0048.907] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SATIN.ELM") returned -1 [0048.907] lstrcmpiA (lpString1="", lpString2="SATIN.ELM") returned -1 [0048.907] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.907] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\" [0048.907] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\") returned="" [0048.907] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO DECRYPT FILES.txt" [0048.907] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\how to decrypt files.txt")) returned 0x20 [0048.907] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", lpString2="SATIN.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" [0048.907] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.zip") returned 0 [0048.907] lstrlenA (lpString="*.zip") returned 5 [0048.907] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.rar") returned 0 [0048.907] lstrlenA (lpString="*.rar") returned 5 [0048.907] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.7z") returned 0 [0048.907] lstrlenA (lpString="*.7z") returned 4 [0048.908] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.tar") returned 0 [0048.908] lstrlenA (lpString="*.tar") returned 5 [0048.908] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.gzip") returned 0 [0048.908] lstrlenA (lpString="*.gzip") returned 6 [0048.908] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.jpg") returned 0 [0048.908] lstrlenA (lpString="*.jpg") returned 5 [0048.908] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.jpeg") returned 0 [0048.908] lstrlenA (lpString="*.jpeg") returned 6 [0048.908] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.psd") returned 0 [0048.908] lstrlenA (lpString="*.psd") returned 5 [0048.908] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.gif") returned 0 [0048.908] lstrlenA (lpString="*.gif") returned 5 [0048.908] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.doc") returned 0 [0048.908] lstrlenA (lpString="*.doc") returned 5 [0048.908] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.docx") returned 0 [0048.908] lstrlenA (lpString="*.docx") returned 6 [0048.908] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.xls") returned 0 [0048.908] lstrlenA (lpString="*.xls") returned 5 [0048.908] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.xlsx") returned 0 [0048.908] lstrlenA (lpString="*.xlsx") returned 6 [0048.908] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.ppt") returned 0 [0048.908] lstrlenA (lpString="*.ppt") returned 5 [0048.908] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.pptx") returned 0 [0048.908] lstrlenA (lpString="*.pptx") returned 6 [0048.908] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.pdf") returned 0 [0048.908] lstrlenA (lpString="*.pdf") returned 5 [0048.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.mov") returned 0 [0048.909] lstrlenA (lpString="*.mov") returned 5 [0048.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.m2v") returned 0 [0048.909] lstrlenA (lpString="*.m2v") returned 5 [0048.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.3gp") returned 0 [0048.909] lstrlenA (lpString="*.3gp") returned 5 [0048.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.mpeg") returned 0 [0048.909] lstrlenA (lpString="*.mpeg") returned 6 [0048.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.mpg") returned 0 [0048.909] lstrlenA (lpString="*.mpg") returned 5 [0048.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.flv") returned 0 [0048.909] lstrlenA (lpString="*.flv") returned 5 [0048.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.avi") returned 0 [0048.909] lstrlenA (lpString="*.avi") returned 5 [0048.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.mp4") returned 0 [0048.909] lstrlenA (lpString="*.mp4") returned 5 [0048.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.wmv") returned 0 [0048.909] lstrlenA (lpString="*.wmv") returned 5 [0048.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.divx") returned 0 [0048.909] lstrlenA (lpString="*.divx") returned 6 [0048.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.mkv") returned 0 [0048.909] lstrlenA (lpString="*.mkv") returned 5 [0048.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.mp3") returned 0 [0048.909] lstrlenA (lpString="*.mp3") returned 5 [0048.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.wav") returned 0 [0048.909] lstrlenA (lpString="*.wav") returned 5 [0048.909] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.flac") returned 0 [0048.910] lstrlenA (lpString="*.flac") returned 6 [0048.910] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.ape") returned 0 [0048.910] lstrlenA (lpString="*.ape") returned 5 [0048.910] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.wma") returned 0 [0048.910] lstrlenA (lpString="*.wma") returned 5 [0048.910] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.ac3") returned 0 [0048.910] lstrlenA (lpString="*.ac3") returned 5 [0048.910] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", pszSpec="*.mxf") returned 0 [0048.910] lstrlenA (lpString="*.mxf") returned 5 [0048.910] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x740078, dwReserved1=0x0, cFileName="SATIN.INF", cAlternateFileName="")) returned 1 [0048.910] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.910] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SATIN.INF") returned -1 [0048.910] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SATIN.INF") returned -1 [0048.910] lstrcmpiA (lpString1="", lpString2="SATIN.INF") returned -1 [0048.910] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned="SATIN.ELM" [0048.910] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\" [0048.910] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\") returned="" [0048.910] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO DECRYPT FILES.txt" [0048.910] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\how to decrypt files.txt")) returned 0x20 [0048.910] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", lpString2="SATIN.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" [0048.910] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.zip") returned 0 [0048.911] lstrlenA (lpString="*.zip") returned 5 [0048.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.rar") returned 0 [0048.911] lstrlenA (lpString="*.rar") returned 5 [0048.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.7z") returned 0 [0048.911] lstrlenA (lpString="*.7z") returned 4 [0048.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.tar") returned 0 [0048.911] lstrlenA (lpString="*.tar") returned 5 [0048.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.gzip") returned 0 [0048.911] lstrlenA (lpString="*.gzip") returned 6 [0048.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.jpg") returned 0 [0048.911] lstrlenA (lpString="*.jpg") returned 5 [0048.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.jpeg") returned 0 [0048.911] lstrlenA (lpString="*.jpeg") returned 6 [0048.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.psd") returned 0 [0048.911] lstrlenA (lpString="*.psd") returned 5 [0048.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.gif") returned 0 [0048.911] lstrlenA (lpString="*.gif") returned 5 [0048.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.doc") returned 0 [0048.911] lstrlenA (lpString="*.doc") returned 5 [0048.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.docx") returned 0 [0048.911] lstrlenA (lpString="*.docx") returned 6 [0048.911] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.xls") returned 0 [0048.911] lstrlenA (lpString="*.xls") returned 5 [0048.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.xlsx") returned 0 [0048.912] lstrlenA (lpString="*.xlsx") returned 6 [0048.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.ppt") returned 0 [0048.912] lstrlenA (lpString="*.ppt") returned 5 [0048.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.pptx") returned 0 [0048.912] lstrlenA (lpString="*.pptx") returned 6 [0048.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.pdf") returned 0 [0048.912] lstrlenA (lpString="*.pdf") returned 5 [0048.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.mov") returned 0 [0048.912] lstrlenA (lpString="*.mov") returned 5 [0048.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.m2v") returned 0 [0048.912] lstrlenA (lpString="*.m2v") returned 5 [0048.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.3gp") returned 0 [0048.912] lstrlenA (lpString="*.3gp") returned 5 [0048.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.mpeg") returned 0 [0048.912] lstrlenA (lpString="*.mpeg") returned 6 [0048.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.mpg") returned 0 [0048.912] lstrlenA (lpString="*.mpg") returned 5 [0048.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.flv") returned 0 [0048.912] lstrlenA (lpString="*.flv") returned 5 [0048.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.avi") returned 0 [0048.912] lstrlenA (lpString="*.avi") returned 5 [0048.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.mp4") returned 0 [0048.912] lstrlenA (lpString="*.mp4") returned 5 [0048.912] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.wmv") returned 0 [0048.913] lstrlenA (lpString="*.wmv") returned 5 [0048.913] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.divx") returned 0 [0048.913] lstrlenA (lpString="*.divx") returned 6 [0048.913] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.mkv") returned 0 [0048.913] lstrlenA (lpString="*.mkv") returned 5 [0048.913] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.mp3") returned 0 [0048.913] lstrlenA (lpString="*.mp3") returned 5 [0048.913] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.wav") returned 0 [0048.913] lstrlenA (lpString="*.wav") returned 5 [0048.913] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.flac") returned 0 [0048.913] lstrlenA (lpString="*.flac") returned 6 [0048.913] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.ape") returned 0 [0048.913] lstrlenA (lpString="*.ape") returned 5 [0048.913] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.wma") returned 0 [0048.913] lstrlenA (lpString="*.wma") returned 5 [0048.913] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.ac3") returned 0 [0048.913] lstrlenA (lpString="*.ac3") returned 5 [0048.913] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", pszSpec="*.mxf") returned 0 [0048.913] lstrlenA (lpString="*.mxf") returned 5 [0048.913] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x740078, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.913] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.913] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.913] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.914] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.914] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned="SATIN.INF" [0048.914] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\" [0048.914] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\") returned="" [0048.914] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO DECRYPT FILES.txt" [0048.914] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\how to decrypt files.txt")) returned 0x20 [0048.914] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" [0048.914] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.914] lstrlenA (lpString="*.zip") returned 5 [0048.914] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.914] lstrlenA (lpString="*.rar") returned 5 [0048.914] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.914] lstrlenA (lpString="*.7z") returned 4 [0048.914] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.914] lstrlenA (lpString="*.tar") returned 5 [0048.914] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.914] lstrlenA (lpString="*.gzip") returned 6 [0048.914] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.914] lstrlenA (lpString="*.jpg") returned 5 [0048.914] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.914] lstrlenA (lpString="*.jpeg") returned 6 [0048.915] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.915] lstrlenA (lpString="*.psd") returned 5 [0048.915] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.915] lstrlenA (lpString="*.gif") returned 5 [0048.915] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.915] lstrlenA (lpString="*.doc") returned 5 [0048.915] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.915] lstrlenA (lpString="*.docx") returned 6 [0048.915] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.915] lstrlenA (lpString="*.xls") returned 5 [0048.915] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.915] lstrlenA (lpString="*.xlsx") returned 6 [0048.915] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.915] lstrlenA (lpString="*.ppt") returned 5 [0048.915] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.915] lstrlenA (lpString="*.pptx") returned 6 [0048.915] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.915] lstrlenA (lpString="*.pdf") returned 5 [0048.915] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.915] lstrlenA (lpString="*.mov") returned 5 [0048.915] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.915] lstrlenA (lpString="*.m2v") returned 5 [0048.915] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.915] lstrlenA (lpString="*.3gp") returned 5 [0048.915] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.915] lstrlenA (lpString="*.mpeg") returned 6 [0048.916] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.916] lstrlenA (lpString="*.mpg") returned 5 [0048.916] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.916] lstrlenA (lpString="*.flv") returned 5 [0048.916] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.916] lstrlenA (lpString="*.avi") returned 5 [0048.916] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.916] lstrlenA (lpString="*.mp4") returned 5 [0048.916] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.916] lstrlenA (lpString="*.wmv") returned 5 [0048.916] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.916] lstrlenA (lpString="*.divx") returned 6 [0048.916] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.916] lstrlenA (lpString="*.mkv") returned 5 [0048.916] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.916] lstrlenA (lpString="*.mp3") returned 5 [0048.916] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.916] lstrlenA (lpString="*.wav") returned 5 [0048.916] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.917] lstrlenA (lpString="*.flac") returned 6 [0048.917] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.917] lstrlenA (lpString="*.ape") returned 5 [0048.917] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.917] lstrlenA (lpString="*.wma") returned 5 [0048.917] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.917] lstrlenA (lpString="*.ac3") returned 5 [0048.917] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.917] lstrlenA (lpString="*.mxf") returned 5 [0048.917] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x740078, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.917] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0048.917] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="SKY", cAlternateFileName="")) returned 1 [0048.917] lstrcmpA (lpString1=".", lpString2="SKY") returned -1 [0048.917] lstrcmpA (lpString1="..", lpString2="SKY") returned -1 [0048.917] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.917] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="SKY" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY" [0048.917] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY") returned 59 [0048.918] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740078, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d80b8 [0048.919] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.919] FindNextFileA (in: hFindFile=0x2d80b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.919] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.919] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.919] FindNextFileA (in: hFindFile=0x2d80b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.919] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.919] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.919] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.919] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.919] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*") returned="*.*" [0048.919] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\" [0048.919] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\") returned="" [0048.919] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO DECRYPT FILES.txt" [0048.919] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\how to decrypt files.txt")) returned 0xffffffff [0048.919] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.920] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.920] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.921] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.921] CloseHandle (hObject=0x90) returned 1 [0048.922] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" [0048.922] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.922] lstrlenA (lpString="*.zip") returned 5 [0048.922] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.922] lstrlenA (lpString="*.rar") returned 5 [0048.922] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.922] lstrlenA (lpString="*.7z") returned 4 [0048.922] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.922] lstrlenA (lpString="*.tar") returned 5 [0048.922] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.922] lstrlenA (lpString="*.gzip") returned 6 [0048.922] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.922] lstrlenA (lpString="*.jpg") returned 5 [0048.922] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.922] lstrlenA (lpString="*.jpeg") returned 6 [0048.922] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.922] lstrlenA (lpString="*.psd") returned 5 [0048.922] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.922] lstrlenA (lpString="*.gif") returned 5 [0048.922] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" [0048.923] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" [0048.923] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF." [0048.923] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.wannacry" [0048.923] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.923] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a9 [0048.923] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d05ead0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1 [0048.923] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.923] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x32b, lpOverlapped=0x0) returned 1 [0048.925] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.925] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.925] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x32b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x32b, lpOverlapped=0x0) returned 1 [0048.925] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.925] CloseHandle (hObject=0x90) returned 1 [0048.931] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.wannacry")) returned 1 [0048.934] FindNextFileA (in: hFindFile=0x2d80b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f0ff00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25f0ff00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1413d, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="SKY.ELM", cAlternateFileName="")) returned 1 [0048.934] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.934] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SKY.ELM") returned -1 [0048.934] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SKY.ELM") returned -1 [0048.935] lstrcmpiA (lpString1="", lpString2="SKY.ELM") returned -1 [0048.935] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.935] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\" [0048.935] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\") returned="" [0048.935] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO DECRYPT FILES.txt" [0048.935] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\how to decrypt files.txt")) returned 0x20 [0048.935] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", lpString2="SKY.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" [0048.935] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.zip") returned 0 [0048.935] lstrlenA (lpString="*.zip") returned 5 [0048.935] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.rar") returned 0 [0048.935] lstrlenA (lpString="*.rar") returned 5 [0048.935] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.7z") returned 0 [0048.935] lstrlenA (lpString="*.7z") returned 4 [0048.935] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.tar") returned 0 [0048.935] lstrlenA (lpString="*.tar") returned 5 [0048.935] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.gzip") returned 0 [0048.935] lstrlenA (lpString="*.gzip") returned 6 [0048.935] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.jpg") returned 0 [0048.935] lstrlenA (lpString="*.jpg") returned 5 [0048.935] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.jpeg") returned 0 [0048.935] lstrlenA (lpString="*.jpeg") returned 6 [0048.935] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.psd") returned 0 [0048.935] lstrlenA (lpString="*.psd") returned 5 [0048.936] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.gif") returned 0 [0048.936] lstrlenA (lpString="*.gif") returned 5 [0048.936] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.doc") returned 0 [0048.936] lstrlenA (lpString="*.doc") returned 5 [0048.936] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.docx") returned 0 [0048.936] lstrlenA (lpString="*.docx") returned 6 [0048.936] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.xls") returned 0 [0048.936] lstrlenA (lpString="*.xls") returned 5 [0048.936] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.xlsx") returned 0 [0048.936] lstrlenA (lpString="*.xlsx") returned 6 [0048.936] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.ppt") returned 0 [0048.936] lstrlenA (lpString="*.ppt") returned 5 [0048.936] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.pptx") returned 0 [0048.936] lstrlenA (lpString="*.pptx") returned 6 [0048.936] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.pdf") returned 0 [0048.936] lstrlenA (lpString="*.pdf") returned 5 [0048.936] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.mov") returned 0 [0048.936] lstrlenA (lpString="*.mov") returned 5 [0048.936] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.m2v") returned 0 [0048.936] lstrlenA (lpString="*.m2v") returned 5 [0048.936] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.3gp") returned 0 [0048.936] lstrlenA (lpString="*.3gp") returned 5 [0048.936] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.mpeg") returned 0 [0048.936] lstrlenA (lpString="*.mpeg") returned 6 [0048.936] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.mpg") returned 0 [0048.936] lstrlenA (lpString="*.mpg") returned 5 [0048.936] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.flv") returned 0 [0048.937] lstrlenA (lpString="*.flv") returned 5 [0048.937] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.avi") returned 0 [0048.937] lstrlenA (lpString="*.avi") returned 5 [0048.937] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.mp4") returned 0 [0048.937] lstrlenA (lpString="*.mp4") returned 5 [0048.937] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.wmv") returned 0 [0048.937] lstrlenA (lpString="*.wmv") returned 5 [0048.937] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.divx") returned 0 [0048.937] lstrlenA (lpString="*.divx") returned 6 [0048.937] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.mkv") returned 0 [0048.937] lstrlenA (lpString="*.mkv") returned 5 [0048.937] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.mp3") returned 0 [0048.937] lstrlenA (lpString="*.mp3") returned 5 [0048.937] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.wav") returned 0 [0048.937] lstrlenA (lpString="*.wav") returned 5 [0048.937] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.flac") returned 0 [0048.937] lstrlenA (lpString="*.flac") returned 6 [0048.937] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.ape") returned 0 [0048.937] lstrlenA (lpString="*.ape") returned 5 [0048.937] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.wma") returned 0 [0048.937] lstrlenA (lpString="*.wma") returned 5 [0048.937] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.ac3") returned 0 [0048.937] lstrlenA (lpString="*.ac3") returned 5 [0048.937] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", pszSpec="*.mxf") returned 0 [0048.937] lstrlenA (lpString="*.mxf") returned 5 [0048.937] FindNextFileA (in: hFindFile=0x2d80b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.INF", cAlternateFileName="")) returned 1 [0048.938] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.938] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SKY.INF") returned -1 [0048.938] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SKY.INF") returned -1 [0048.938] lstrcmpiA (lpString1="", lpString2="SKY.INF") returned -1 [0048.938] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned="SKY.ELM" [0048.938] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\" [0048.938] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\") returned="" [0048.938] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO DECRYPT FILES.txt" [0048.938] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\how to decrypt files.txt")) returned 0x20 [0048.938] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", lpString2="SKY.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" [0048.938] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.zip") returned 0 [0048.938] lstrlenA (lpString="*.zip") returned 5 [0048.938] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.rar") returned 0 [0048.938] lstrlenA (lpString="*.rar") returned 5 [0048.938] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.7z") returned 0 [0048.938] lstrlenA (lpString="*.7z") returned 4 [0048.938] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.tar") returned 0 [0048.938] lstrlenA (lpString="*.tar") returned 5 [0048.938] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.gzip") returned 0 [0048.939] lstrlenA (lpString="*.gzip") returned 6 [0048.939] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.jpg") returned 0 [0048.939] lstrlenA (lpString="*.jpg") returned 5 [0048.939] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.jpeg") returned 0 [0048.939] lstrlenA (lpString="*.jpeg") returned 6 [0048.939] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.psd") returned 0 [0048.939] lstrlenA (lpString="*.psd") returned 5 [0048.939] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.gif") returned 0 [0048.939] lstrlenA (lpString="*.gif") returned 5 [0048.939] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.doc") returned 0 [0048.939] lstrlenA (lpString="*.doc") returned 5 [0048.939] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.docx") returned 0 [0048.939] lstrlenA (lpString="*.docx") returned 6 [0048.939] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.xls") returned 0 [0048.939] lstrlenA (lpString="*.xls") returned 5 [0048.939] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.xlsx") returned 0 [0048.939] lstrlenA (lpString="*.xlsx") returned 6 [0048.939] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.ppt") returned 0 [0048.939] lstrlenA (lpString="*.ppt") returned 5 [0048.939] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.pptx") returned 0 [0048.939] lstrlenA (lpString="*.pptx") returned 6 [0048.939] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.pdf") returned 0 [0048.939] lstrlenA (lpString="*.pdf") returned 5 [0048.939] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.mov") returned 0 [0048.939] lstrlenA (lpString="*.mov") returned 5 [0048.939] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.m2v") returned 0 [0048.939] lstrlenA (lpString="*.m2v") returned 5 [0048.939] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.3gp") returned 0 [0048.940] lstrlenA (lpString="*.3gp") returned 5 [0048.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.mpeg") returned 0 [0048.940] lstrlenA (lpString="*.mpeg") returned 6 [0048.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.mpg") returned 0 [0048.940] lstrlenA (lpString="*.mpg") returned 5 [0048.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.flv") returned 0 [0048.940] lstrlenA (lpString="*.flv") returned 5 [0048.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.avi") returned 0 [0048.940] lstrlenA (lpString="*.avi") returned 5 [0048.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.mp4") returned 0 [0048.940] lstrlenA (lpString="*.mp4") returned 5 [0048.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.wmv") returned 0 [0048.940] lstrlenA (lpString="*.wmv") returned 5 [0048.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.divx") returned 0 [0048.940] lstrlenA (lpString="*.divx") returned 6 [0048.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.mkv") returned 0 [0048.940] lstrlenA (lpString="*.mkv") returned 5 [0048.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.mp3") returned 0 [0048.940] lstrlenA (lpString="*.mp3") returned 5 [0048.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.wav") returned 0 [0048.940] lstrlenA (lpString="*.wav") returned 5 [0048.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.flac") returned 0 [0048.940] lstrlenA (lpString="*.flac") returned 6 [0048.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.ape") returned 0 [0048.940] lstrlenA (lpString="*.ape") returned 5 [0048.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.wma") returned 0 [0048.940] lstrlenA (lpString="*.wma") returned 5 [0048.940] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.ac3") returned 0 [0048.941] lstrlenA (lpString="*.ac3") returned 5 [0048.941] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", pszSpec="*.mxf") returned 0 [0048.941] lstrlenA (lpString="*.mxf") returned 5 [0048.941] FindNextFileA (in: hFindFile=0x2d80b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.941] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.941] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.941] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.941] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.941] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned="SKY.INF" [0048.941] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\" [0048.941] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\") returned="" [0048.941] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO DECRYPT FILES.txt" [0048.941] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\how to decrypt files.txt")) returned 0x20 [0048.941] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" [0048.941] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.941] lstrlenA (lpString="*.zip") returned 5 [0048.941] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.941] lstrlenA (lpString="*.rar") returned 5 [0048.941] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.941] lstrlenA (lpString="*.7z") returned 4 [0048.941] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.941] lstrlenA (lpString="*.tar") returned 5 [0048.941] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.942] lstrlenA (lpString="*.gzip") returned 6 [0048.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.942] lstrlenA (lpString="*.jpg") returned 5 [0048.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.942] lstrlenA (lpString="*.jpeg") returned 6 [0048.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.942] lstrlenA (lpString="*.psd") returned 5 [0048.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.942] lstrlenA (lpString="*.gif") returned 5 [0048.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.942] lstrlenA (lpString="*.doc") returned 5 [0048.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.942] lstrlenA (lpString="*.docx") returned 6 [0048.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.942] lstrlenA (lpString="*.xls") returned 5 [0048.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.942] lstrlenA (lpString="*.xlsx") returned 6 [0048.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.942] lstrlenA (lpString="*.ppt") returned 5 [0048.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.942] lstrlenA (lpString="*.pptx") returned 6 [0048.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.942] lstrlenA (lpString="*.pdf") returned 5 [0048.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.942] lstrlenA (lpString="*.mov") returned 5 [0048.942] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.942] lstrlenA (lpString="*.m2v") returned 5 [0048.943] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.943] lstrlenA (lpString="*.3gp") returned 5 [0048.943] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.943] lstrlenA (lpString="*.mpeg") returned 6 [0048.943] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.943] lstrlenA (lpString="*.mpg") returned 5 [0048.943] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.943] lstrlenA (lpString="*.flv") returned 5 [0048.943] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.943] lstrlenA (lpString="*.avi") returned 5 [0048.943] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.943] lstrlenA (lpString="*.mp4") returned 5 [0048.943] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.943] lstrlenA (lpString="*.wmv") returned 5 [0048.943] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.943] lstrlenA (lpString="*.divx") returned 6 [0048.943] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.943] lstrlenA (lpString="*.mkv") returned 5 [0048.943] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.943] lstrlenA (lpString="*.mp3") returned 5 [0048.943] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.943] lstrlenA (lpString="*.wav") returned 5 [0048.943] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.943] lstrlenA (lpString="*.flac") returned 6 [0048.943] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.943] lstrlenA (lpString="*.ape") returned 5 [0048.943] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.943] lstrlenA (lpString="*.wma") returned 5 [0048.944] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.944] lstrlenA (lpString="*.ac3") returned 5 [0048.944] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.944] lstrlenA (lpString="*.mxf") returned 5 [0048.944] FindNextFileA (in: hFindFile=0x2d80b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.944] FindClose (in: hFindFile=0x2d80b8 | out: hFindFile=0x2d80b8) returned 1 [0048.944] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="SLATE", cAlternateFileName="")) returned 1 [0048.944] lstrcmpA (lpString1=".", lpString2="SLATE") returned -1 [0048.944] lstrcmpA (lpString1="..", lpString2="SLATE") returned -1 [0048.944] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.944] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="SLATE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE" [0048.944] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE") returned 61 [0048.944] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0048.946] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0048.946] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.946] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0048.946] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0048.946] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3f1, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0048.946] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.946] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0048.946] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0048.946] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0048.946] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*") returned="*.*" [0048.946] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\" [0048.947] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\") returned="" [0048.947] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO DECRYPT FILES.txt" [0048.947] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\how to decrypt files.txt")) returned 0xffffffff [0048.947] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.947] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0048.947] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0048.949] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0048.949] CloseHandle (hObject=0x90) returned 1 [0048.949] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" [0048.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0048.949] lstrlenA (lpString="*.zip") returned 5 [0048.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0048.949] lstrlenA (lpString="*.rar") returned 5 [0048.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0048.949] lstrlenA (lpString="*.7z") returned 4 [0048.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0048.949] lstrlenA (lpString="*.tar") returned 5 [0048.949] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0048.950] lstrlenA (lpString="*.gzip") returned 6 [0048.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0048.950] lstrlenA (lpString="*.jpg") returned 5 [0048.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0048.950] lstrlenA (lpString="*.jpeg") returned 6 [0048.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0048.950] lstrlenA (lpString="*.psd") returned 5 [0048.950] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0048.950] lstrlenA (lpString="*.gif") returned 5 [0048.950] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" [0048.950] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" [0048.950] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF." [0048.950] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.wannacry" [0048.950] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0048.951] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f1 [0048.951] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d084c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1 [0048.951] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.951] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x373, lpOverlapped=0x0) returned 1 [0048.953] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.953] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0048.954] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x373, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x373, lpOverlapped=0x0) returned 1 [0048.954] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0048.954] CloseHandle (hObject=0x90) returned 1 [0048.963] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.wannacry")) returned 1 [0048.966] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27222c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27222c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="SLATE.ELM", cAlternateFileName="")) returned 1 [0048.966] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.966] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SLATE.ELM") returned -1 [0048.966] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SLATE.ELM") returned -1 [0048.966] lstrcmpiA (lpString1="", lpString2="SLATE.ELM") returned -1 [0048.966] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0048.966] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\" [0048.966] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\") returned="" [0048.966] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO DECRYPT FILES.txt" [0048.966] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\how to decrypt files.txt")) returned 0x20 [0048.966] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", lpString2="SLATE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" [0048.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.zip") returned 0 [0048.966] lstrlenA (lpString="*.zip") returned 5 [0048.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.rar") returned 0 [0048.966] lstrlenA (lpString="*.rar") returned 5 [0048.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.7z") returned 0 [0048.966] lstrlenA (lpString="*.7z") returned 4 [0048.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.tar") returned 0 [0048.966] lstrlenA (lpString="*.tar") returned 5 [0048.966] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.gzip") returned 0 [0048.967] lstrlenA (lpString="*.gzip") returned 6 [0048.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.jpg") returned 0 [0048.967] lstrlenA (lpString="*.jpg") returned 5 [0048.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.jpeg") returned 0 [0048.967] lstrlenA (lpString="*.jpeg") returned 6 [0048.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.psd") returned 0 [0048.967] lstrlenA (lpString="*.psd") returned 5 [0048.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.gif") returned 0 [0048.967] lstrlenA (lpString="*.gif") returned 5 [0048.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.doc") returned 0 [0048.967] lstrlenA (lpString="*.doc") returned 5 [0048.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.docx") returned 0 [0048.967] lstrlenA (lpString="*.docx") returned 6 [0048.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.xls") returned 0 [0048.967] lstrlenA (lpString="*.xls") returned 5 [0048.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.xlsx") returned 0 [0048.967] lstrlenA (lpString="*.xlsx") returned 6 [0048.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.ppt") returned 0 [0048.967] lstrlenA (lpString="*.ppt") returned 5 [0048.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.pptx") returned 0 [0048.967] lstrlenA (lpString="*.pptx") returned 6 [0048.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.pdf") returned 0 [0048.967] lstrlenA (lpString="*.pdf") returned 5 [0048.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.mov") returned 0 [0048.967] lstrlenA (lpString="*.mov") returned 5 [0048.967] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.m2v") returned 0 [0048.968] lstrlenA (lpString="*.m2v") returned 5 [0048.968] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.3gp") returned 0 [0048.968] lstrlenA (lpString="*.3gp") returned 5 [0048.968] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.mpeg") returned 0 [0048.968] lstrlenA (lpString="*.mpeg") returned 6 [0048.968] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.mpg") returned 0 [0048.968] lstrlenA (lpString="*.mpg") returned 5 [0048.968] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.flv") returned 0 [0048.968] lstrlenA (lpString="*.flv") returned 5 [0048.968] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.avi") returned 0 [0048.968] lstrlenA (lpString="*.avi") returned 5 [0048.968] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.mp4") returned 0 [0048.968] lstrlenA (lpString="*.mp4") returned 5 [0048.968] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.wmv") returned 0 [0048.968] lstrlenA (lpString="*.wmv") returned 5 [0048.968] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.divx") returned 0 [0048.968] lstrlenA (lpString="*.divx") returned 6 [0048.968] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.mkv") returned 0 [0048.968] lstrlenA (lpString="*.mkv") returned 5 [0048.968] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.mp3") returned 0 [0048.968] lstrlenA (lpString="*.mp3") returned 5 [0048.968] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.wav") returned 0 [0048.968] lstrlenA (lpString="*.wav") returned 5 [0048.968] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.flac") returned 0 [0048.968] lstrlenA (lpString="*.flac") returned 6 [0048.968] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.ape") returned 0 [0048.969] lstrlenA (lpString="*.ape") returned 5 [0048.969] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.wma") returned 0 [0048.969] lstrlenA (lpString="*.wma") returned 5 [0048.969] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.ac3") returned 0 [0048.969] lstrlenA (lpString="*.ac3") returned 5 [0048.969] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", pszSpec="*.mxf") returned 0 [0048.969] lstrlenA (lpString="*.mxf") returned 5 [0048.969] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x740078, dwReserved1=0x0, cFileName="SLATE.INF", cAlternateFileName="")) returned 1 [0048.969] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.969] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SLATE.INF") returned -1 [0048.969] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SLATE.INF") returned -1 [0048.969] lstrcmpiA (lpString1="", lpString2="SLATE.INF") returned -1 [0048.969] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned="SLATE.ELM" [0048.969] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\" [0048.969] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\") returned="" [0048.969] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO DECRYPT FILES.txt" [0048.969] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\how to decrypt files.txt")) returned 0x20 [0048.969] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", lpString2="SLATE.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" [0048.969] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.zip") returned 0 [0048.969] lstrlenA (lpString="*.zip") returned 5 [0048.969] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.rar") returned 0 [0048.969] lstrlenA (lpString="*.rar") returned 5 [0048.969] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.7z") returned 0 [0048.970] lstrlenA (lpString="*.7z") returned 4 [0048.970] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.tar") returned 0 [0048.970] lstrlenA (lpString="*.tar") returned 5 [0048.970] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.gzip") returned 0 [0048.970] lstrlenA (lpString="*.gzip") returned 6 [0048.970] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.jpg") returned 0 [0048.970] lstrlenA (lpString="*.jpg") returned 5 [0048.970] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.jpeg") returned 0 [0048.970] lstrlenA (lpString="*.jpeg") returned 6 [0048.970] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.psd") returned 0 [0048.970] lstrlenA (lpString="*.psd") returned 5 [0048.970] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.gif") returned 0 [0048.970] lstrlenA (lpString="*.gif") returned 5 [0048.970] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.doc") returned 0 [0048.970] lstrlenA (lpString="*.doc") returned 5 [0048.970] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.docx") returned 0 [0048.970] lstrlenA (lpString="*.docx") returned 6 [0048.970] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.xls") returned 0 [0048.970] lstrlenA (lpString="*.xls") returned 5 [0048.970] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.xlsx") returned 0 [0048.970] lstrlenA (lpString="*.xlsx") returned 6 [0048.970] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.ppt") returned 0 [0048.970] lstrlenA (lpString="*.ppt") returned 5 [0048.970] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.pptx") returned 0 [0048.970] lstrlenA (lpString="*.pptx") returned 6 [0048.970] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.pdf") returned 0 [0048.970] lstrlenA (lpString="*.pdf") returned 5 [0048.970] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.mov") returned 0 [0048.971] lstrlenA (lpString="*.mov") returned 5 [0048.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.m2v") returned 0 [0048.971] lstrlenA (lpString="*.m2v") returned 5 [0048.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.3gp") returned 0 [0048.971] lstrlenA (lpString="*.3gp") returned 5 [0048.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.mpeg") returned 0 [0048.971] lstrlenA (lpString="*.mpeg") returned 6 [0048.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.mpg") returned 0 [0048.971] lstrlenA (lpString="*.mpg") returned 5 [0048.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.flv") returned 0 [0048.971] lstrlenA (lpString="*.flv") returned 5 [0048.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.avi") returned 0 [0048.971] lstrlenA (lpString="*.avi") returned 5 [0048.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.mp4") returned 0 [0048.971] lstrlenA (lpString="*.mp4") returned 5 [0048.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.wmv") returned 0 [0048.971] lstrlenA (lpString="*.wmv") returned 5 [0048.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.divx") returned 0 [0048.971] lstrlenA (lpString="*.divx") returned 6 [0048.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.mkv") returned 0 [0048.971] lstrlenA (lpString="*.mkv") returned 5 [0048.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.mp3") returned 0 [0048.971] lstrlenA (lpString="*.mp3") returned 5 [0048.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.wav") returned 0 [0048.971] lstrlenA (lpString="*.wav") returned 5 [0048.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.flac") returned 0 [0048.971] lstrlenA (lpString="*.flac") returned 6 [0048.971] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.ape") returned 0 [0048.972] lstrlenA (lpString="*.ape") returned 5 [0048.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.wma") returned 0 [0048.972] lstrlenA (lpString="*.wma") returned 5 [0048.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.ac3") returned 0 [0048.972] lstrlenA (lpString="*.ac3") returned 5 [0048.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", pszSpec="*.mxf") returned 0 [0048.972] lstrlenA (lpString="*.mxf") returned 5 [0048.972] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x740078, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0048.972] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0048.972] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.972] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0048.972] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0048.972] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned="SLATE.INF" [0048.972] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\" [0048.972] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\") returned="" [0048.972] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO DECRYPT FILES.txt" [0048.972] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\how to decrypt files.txt")) returned 0x20 [0048.972] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" [0048.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0048.972] lstrlenA (lpString="*.zip") returned 5 [0048.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0048.972] lstrlenA (lpString="*.rar") returned 5 [0048.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0048.972] lstrlenA (lpString="*.7z") returned 4 [0048.972] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0048.973] lstrlenA (lpString="*.tar") returned 5 [0048.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0048.973] lstrlenA (lpString="*.gzip") returned 6 [0048.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0048.973] lstrlenA (lpString="*.jpg") returned 5 [0048.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0048.973] lstrlenA (lpString="*.jpeg") returned 6 [0048.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0048.973] lstrlenA (lpString="*.psd") returned 5 [0048.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0048.973] lstrlenA (lpString="*.gif") returned 5 [0048.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0048.973] lstrlenA (lpString="*.doc") returned 5 [0048.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0048.973] lstrlenA (lpString="*.docx") returned 6 [0048.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0048.973] lstrlenA (lpString="*.xls") returned 5 [0048.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0048.973] lstrlenA (lpString="*.xlsx") returned 6 [0048.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0048.973] lstrlenA (lpString="*.ppt") returned 5 [0048.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0048.973] lstrlenA (lpString="*.pptx") returned 6 [0048.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0048.973] lstrlenA (lpString="*.pdf") returned 5 [0048.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0048.973] lstrlenA (lpString="*.mov") returned 5 [0048.973] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0048.974] lstrlenA (lpString="*.m2v") returned 5 [0048.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0048.974] lstrlenA (lpString="*.3gp") returned 5 [0048.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0048.974] lstrlenA (lpString="*.mpeg") returned 6 [0048.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0048.974] lstrlenA (lpString="*.mpg") returned 5 [0048.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0048.974] lstrlenA (lpString="*.flv") returned 5 [0048.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0048.974] lstrlenA (lpString="*.avi") returned 5 [0048.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0048.974] lstrlenA (lpString="*.mp4") returned 5 [0048.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0048.974] lstrlenA (lpString="*.wmv") returned 5 [0048.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0048.974] lstrlenA (lpString="*.divx") returned 6 [0048.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0048.974] lstrlenA (lpString="*.mkv") returned 5 [0048.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0048.974] lstrlenA (lpString="*.mp3") returned 5 [0048.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0048.974] lstrlenA (lpString="*.wav") returned 5 [0048.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0048.974] lstrlenA (lpString="*.flac") returned 6 [0048.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0048.974] lstrlenA (lpString="*.ape") returned 5 [0048.974] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0048.975] lstrlenA (lpString="*.wma") returned 5 [0048.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0048.975] lstrlenA (lpString="*.ac3") returned 5 [0048.975] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0048.975] lstrlenA (lpString="*.mxf") returned 5 [0048.975] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x740078, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0048.975] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0048.975] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="SONORA", cAlternateFileName="")) returned 1 [0048.975] lstrcmpA (lpString1=".", lpString2="SONORA") returned -1 [0048.975] lstrcmpA (lpString1="..", lpString2="SONORA") returned -1 [0048.975] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0048.975] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="SONORA" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA" [0048.975] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA") returned 62 [0048.975] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740078, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0049.067] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.067] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.067] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.067] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.067] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0049.067] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.067] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0049.067] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0049.067] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0049.067] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*") returned="*.*" [0049.067] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\" [0049.067] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\") returned="" [0049.067] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO DECRYPT FILES.txt" [0049.067] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\how to decrypt files.txt")) returned 0xffffffff [0049.068] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.068] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0049.068] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0049.070] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.070] CloseHandle (hObject=0x90) returned 1 [0049.070] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" [0049.070] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0049.070] lstrlenA (lpString="*.zip") returned 5 [0049.070] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0049.070] lstrlenA (lpString="*.rar") returned 5 [0049.070] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0049.070] lstrlenA (lpString="*.7z") returned 4 [0049.070] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0049.070] lstrlenA (lpString="*.tar") returned 5 [0049.070] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0049.070] lstrlenA (lpString="*.gzip") returned 6 [0049.070] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0049.070] lstrlenA (lpString="*.jpg") returned 5 [0049.070] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0049.071] lstrlenA (lpString="*.jpeg") returned 6 [0049.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0049.071] lstrlenA (lpString="*.psd") returned 5 [0049.071] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0049.071] lstrlenA (lpString="*.gif") returned 5 [0049.071] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" [0049.071] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" [0049.071] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF." [0049.071] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.wannacry" [0049.071] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.071] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8a1 [0049.071] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d084c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1 [0049.071] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0049.071] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x823, lpOverlapped=0x0) returned 1 [0049.148] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned="PREVIEW.GIF" [0049.148] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0049.148] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x823, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x823, lpOverlapped=0x0) returned 1 [0049.148] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0049.148] CloseHandle (hObject=0x90) returned 1 [0049.149] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.wannacry")) returned 1 [0049.152] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28535900, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28535900, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd59f, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="SONORA.ELM", cAlternateFileName="")) returned 1 [0049.152] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.152] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SONORA.ELM") returned -1 [0049.152] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SONORA.ELM") returned -1 [0049.152] lstrcmpiA (lpString1="", lpString2="SONORA.ELM") returned -1 [0049.152] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned="PREVIEW.GIF" [0049.152] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\" [0049.152] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\") returned="" [0049.152] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO DECRYPT FILES.txt" [0049.152] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\how to decrypt files.txt")) returned 0x20 [0049.152] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", lpString2="SONORA.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" [0049.152] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.zip") returned 0 [0049.152] lstrlenA (lpString="*.zip") returned 5 [0049.152] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.rar") returned 0 [0049.152] lstrlenA (lpString="*.rar") returned 5 [0049.152] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.7z") returned 0 [0049.152] lstrlenA (lpString="*.7z") returned 4 [0049.152] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.tar") returned 0 [0049.152] lstrlenA (lpString="*.tar") returned 5 [0049.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.gzip") returned 0 [0049.153] lstrlenA (lpString="*.gzip") returned 6 [0049.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.jpg") returned 0 [0049.153] lstrlenA (lpString="*.jpg") returned 5 [0049.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.jpeg") returned 0 [0049.153] lstrlenA (lpString="*.jpeg") returned 6 [0049.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.psd") returned 0 [0049.153] lstrlenA (lpString="*.psd") returned 5 [0049.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.gif") returned 0 [0049.153] lstrlenA (lpString="*.gif") returned 5 [0049.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.doc") returned 0 [0049.153] lstrlenA (lpString="*.doc") returned 5 [0049.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.docx") returned 0 [0049.153] lstrlenA (lpString="*.docx") returned 6 [0049.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.xls") returned 0 [0049.153] lstrlenA (lpString="*.xls") returned 5 [0049.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.xlsx") returned 0 [0049.153] lstrlenA (lpString="*.xlsx") returned 6 [0049.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.ppt") returned 0 [0049.153] lstrlenA (lpString="*.ppt") returned 5 [0049.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.pptx") returned 0 [0049.153] lstrlenA (lpString="*.pptx") returned 6 [0049.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.pdf") returned 0 [0049.153] lstrlenA (lpString="*.pdf") returned 5 [0049.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.mov") returned 0 [0049.153] lstrlenA (lpString="*.mov") returned 5 [0049.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.m2v") returned 0 [0049.153] lstrlenA (lpString="*.m2v") returned 5 [0049.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.3gp") returned 0 [0049.154] lstrlenA (lpString="*.3gp") returned 5 [0049.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.mpeg") returned 0 [0049.154] lstrlenA (lpString="*.mpeg") returned 6 [0049.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.mpg") returned 0 [0049.154] lstrlenA (lpString="*.mpg") returned 5 [0049.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.flv") returned 0 [0049.154] lstrlenA (lpString="*.flv") returned 5 [0049.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.avi") returned 0 [0049.154] lstrlenA (lpString="*.avi") returned 5 [0049.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.mp4") returned 0 [0049.154] lstrlenA (lpString="*.mp4") returned 5 [0049.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.wmv") returned 0 [0049.154] lstrlenA (lpString="*.wmv") returned 5 [0049.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.divx") returned 0 [0049.154] lstrlenA (lpString="*.divx") returned 6 [0049.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.mkv") returned 0 [0049.154] lstrlenA (lpString="*.mkv") returned 5 [0049.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.mp3") returned 0 [0049.154] lstrlenA (lpString="*.mp3") returned 5 [0049.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.wav") returned 0 [0049.154] lstrlenA (lpString="*.wav") returned 5 [0049.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.flac") returned 0 [0049.154] lstrlenA (lpString="*.flac") returned 6 [0049.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.ape") returned 0 [0049.154] lstrlenA (lpString="*.ape") returned 5 [0049.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.wma") returned 0 [0049.154] lstrlenA (lpString="*.wma") returned 5 [0049.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.ac3") returned 0 [0049.155] lstrlenA (lpString="*.ac3") returned 5 [0049.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", pszSpec="*.mxf") returned 0 [0049.155] lstrlenA (lpString="*.mxf") returned 5 [0049.155] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e4, dwReserved0=0x780074, dwReserved1=0x74, cFileName="SONORA.INF", cAlternateFileName="")) returned 1 [0049.155] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.155] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SONORA.INF") returned -1 [0049.155] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SONORA.INF") returned -1 [0049.155] lstrcmpiA (lpString1="", lpString2="SONORA.INF") returned -1 [0049.155] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned="SONORA.ELM" [0049.155] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\" [0049.155] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\") returned="" [0049.155] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO DECRYPT FILES.txt" [0049.155] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\how to decrypt files.txt")) returned 0x20 [0049.155] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", lpString2="SONORA.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" [0049.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.zip") returned 0 [0049.155] lstrlenA (lpString="*.zip") returned 5 [0049.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.rar") returned 0 [0049.155] lstrlenA (lpString="*.rar") returned 5 [0049.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.7z") returned 0 [0049.155] lstrlenA (lpString="*.7z") returned 4 [0049.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.tar") returned 0 [0049.155] lstrlenA (lpString="*.tar") returned 5 [0049.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.gzip") returned 0 [0049.155] lstrlenA (lpString="*.gzip") returned 6 [0049.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.jpg") returned 0 [0049.155] lstrlenA (lpString="*.jpg") returned 5 [0049.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.jpeg") returned 0 [0049.156] lstrlenA (lpString="*.jpeg") returned 6 [0049.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.psd") returned 0 [0049.156] lstrlenA (lpString="*.psd") returned 5 [0049.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.gif") returned 0 [0049.156] lstrlenA (lpString="*.gif") returned 5 [0049.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.doc") returned 0 [0049.156] lstrlenA (lpString="*.doc") returned 5 [0049.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.docx") returned 0 [0049.156] lstrlenA (lpString="*.docx") returned 6 [0049.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.xls") returned 0 [0049.156] lstrlenA (lpString="*.xls") returned 5 [0049.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.xlsx") returned 0 [0049.156] lstrlenA (lpString="*.xlsx") returned 6 [0049.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.ppt") returned 0 [0049.156] lstrlenA (lpString="*.ppt") returned 5 [0049.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.pptx") returned 0 [0049.156] lstrlenA (lpString="*.pptx") returned 6 [0049.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.pdf") returned 0 [0049.156] lstrlenA (lpString="*.pdf") returned 5 [0049.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.mov") returned 0 [0049.156] lstrlenA (lpString="*.mov") returned 5 [0049.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.m2v") returned 0 [0049.156] lstrlenA (lpString="*.m2v") returned 5 [0049.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.3gp") returned 0 [0049.156] lstrlenA (lpString="*.3gp") returned 5 [0049.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.mpeg") returned 0 [0049.156] lstrlenA (lpString="*.mpeg") returned 6 [0049.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.mpg") returned 0 [0049.157] lstrlenA (lpString="*.mpg") returned 5 [0049.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.flv") returned 0 [0049.157] lstrlenA (lpString="*.flv") returned 5 [0049.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.avi") returned 0 [0049.157] lstrlenA (lpString="*.avi") returned 5 [0049.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.mp4") returned 0 [0049.157] lstrlenA (lpString="*.mp4") returned 5 [0049.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.wmv") returned 0 [0049.157] lstrlenA (lpString="*.wmv") returned 5 [0049.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.divx") returned 0 [0049.157] lstrlenA (lpString="*.divx") returned 6 [0049.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.mkv") returned 0 [0049.157] lstrlenA (lpString="*.mkv") returned 5 [0049.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.mp3") returned 0 [0049.157] lstrlenA (lpString="*.mp3") returned 5 [0049.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.wav") returned 0 [0049.157] lstrlenA (lpString="*.wav") returned 5 [0049.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.flac") returned 0 [0049.157] lstrlenA (lpString="*.flac") returned 6 [0049.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.ape") returned 0 [0049.157] lstrlenA (lpString="*.ape") returned 5 [0049.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.wma") returned 0 [0049.157] lstrlenA (lpString="*.wma") returned 5 [0049.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.ac3") returned 0 [0049.157] lstrlenA (lpString="*.ac3") returned 5 [0049.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", pszSpec="*.mxf") returned 0 [0049.157] lstrlenA (lpString="*.mxf") returned 5 [0049.157] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x780074, dwReserved1=0x74, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0049.157] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.158] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0049.158] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0049.158] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0049.158] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned="SONORA.INF" [0049.158] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\" [0049.158] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\") returned="" [0049.158] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO DECRYPT FILES.txt" [0049.158] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\how to decrypt files.txt")) returned 0x20 [0049.158] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" [0049.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0049.158] lstrlenA (lpString="*.zip") returned 5 [0049.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0049.158] lstrlenA (lpString="*.rar") returned 5 [0049.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0049.158] lstrlenA (lpString="*.7z") returned 4 [0049.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0049.158] lstrlenA (lpString="*.tar") returned 5 [0049.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0049.158] lstrlenA (lpString="*.gzip") returned 6 [0049.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0049.158] lstrlenA (lpString="*.jpg") returned 5 [0049.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0049.158] lstrlenA (lpString="*.jpeg") returned 6 [0049.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0049.159] lstrlenA (lpString="*.psd") returned 5 [0049.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0049.159] lstrlenA (lpString="*.gif") returned 5 [0049.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0049.159] lstrlenA (lpString="*.doc") returned 5 [0049.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0049.159] lstrlenA (lpString="*.docx") returned 6 [0049.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0049.159] lstrlenA (lpString="*.xls") returned 5 [0049.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0049.159] lstrlenA (lpString="*.xlsx") returned 6 [0049.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0049.159] lstrlenA (lpString="*.ppt") returned 5 [0049.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0049.159] lstrlenA (lpString="*.pptx") returned 6 [0049.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0049.159] lstrlenA (lpString="*.pdf") returned 5 [0049.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0049.159] lstrlenA (lpString="*.mov") returned 5 [0049.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0049.159] lstrlenA (lpString="*.m2v") returned 5 [0049.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0049.159] lstrlenA (lpString="*.3gp") returned 5 [0049.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0049.159] lstrlenA (lpString="*.mpeg") returned 6 [0049.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0049.159] lstrlenA (lpString="*.mpg") returned 5 [0049.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0049.160] lstrlenA (lpString="*.flv") returned 5 [0049.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0049.160] lstrlenA (lpString="*.avi") returned 5 [0049.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0049.160] lstrlenA (lpString="*.mp4") returned 5 [0049.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0049.160] lstrlenA (lpString="*.wmv") returned 5 [0049.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0049.160] lstrlenA (lpString="*.divx") returned 6 [0049.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0049.160] lstrlenA (lpString="*.mkv") returned 5 [0049.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0049.160] lstrlenA (lpString="*.mp3") returned 5 [0049.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0049.160] lstrlenA (lpString="*.wav") returned 5 [0049.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0049.160] lstrlenA (lpString="*.flac") returned 6 [0049.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0049.160] lstrlenA (lpString="*.ape") returned 5 [0049.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0049.160] lstrlenA (lpString="*.wma") returned 5 [0049.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0049.160] lstrlenA (lpString="*.ac3") returned 5 [0049.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0049.160] lstrlenA (lpString="*.mxf") returned 5 [0049.160] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x780074, dwReserved1=0x74, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0049.160] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0049.161] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="SPRING", cAlternateFileName="")) returned 1 [0049.161] lstrcmpA (lpString1=".", lpString2="SPRING") returned -1 [0049.161] lstrcmpA (lpString1="..", lpString2="SPRING") returned -1 [0049.161] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0049.161] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="SPRING" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING" [0049.161] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING") returned 62 [0049.161] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0049.161] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.161] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.161] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.161] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.161] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0049.161] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.161] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0049.161] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0049.162] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0049.162] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*") returned="*.*" [0049.162] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\" [0049.162] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\") returned="" [0049.162] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO DECRYPT FILES.txt" [0049.162] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\how to decrypt files.txt")) returned 0xffffffff [0049.162] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.162] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0049.162] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0049.164] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.164] CloseHandle (hObject=0x90) returned 1 [0049.164] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" [0049.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0049.164] lstrlenA (lpString="*.zip") returned 5 [0049.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0049.164] lstrlenA (lpString="*.rar") returned 5 [0049.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0049.164] lstrlenA (lpString="*.7z") returned 4 [0049.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0049.164] lstrlenA (lpString="*.tar") returned 5 [0049.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0049.164] lstrlenA (lpString="*.gzip") returned 6 [0049.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0049.164] lstrlenA (lpString="*.jpg") returned 5 [0049.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0049.164] lstrlenA (lpString="*.jpeg") returned 6 [0049.164] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0049.164] lstrlenA (lpString="*.psd") returned 5 [0049.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0049.165] lstrlenA (lpString="*.gif") returned 5 [0049.165] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" [0049.165] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" [0049.165] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF." [0049.165] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.wannacry" [0049.165] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.165] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9df [0049.165] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a71ef90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1 [0049.165] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0049.165] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x961, lpOverlapped=0x0) returned 1 [0049.168] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned="PREVIEW.GIF" [0049.168] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0049.168] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x961, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x961, lpOverlapped=0x0) returned 1 [0049.168] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0049.168] CloseHandle (hObject=0x90) returned 1 [0049.169] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.wannacry")) returned 1 [0049.172] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab5b300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2ab5b300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x10af1, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="SPRING.ELM", cAlternateFileName="")) returned 1 [0049.172] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.172] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SPRING.ELM") returned -1 [0049.172] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SPRING.ELM") returned -1 [0049.172] lstrcmpiA (lpString1="", lpString2="SPRING.ELM") returned -1 [0049.172] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned="PREVIEW.GIF" [0049.172] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\" [0049.172] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\") returned="" [0049.172] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO DECRYPT FILES.txt" [0049.172] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\how to decrypt files.txt")) returned 0x20 [0049.172] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", lpString2="SPRING.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" [0049.172] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.zip") returned 0 [0049.172] lstrlenA (lpString="*.zip") returned 5 [0049.172] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.rar") returned 0 [0049.172] lstrlenA (lpString="*.rar") returned 5 [0049.172] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.7z") returned 0 [0049.172] lstrlenA (lpString="*.7z") returned 4 [0049.172] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.tar") returned 0 [0049.172] lstrlenA (lpString="*.tar") returned 5 [0049.172] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.gzip") returned 0 [0049.172] lstrlenA (lpString="*.gzip") returned 6 [0049.173] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.jpg") returned 0 [0049.173] lstrlenA (lpString="*.jpg") returned 5 [0049.173] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.jpeg") returned 0 [0049.173] lstrlenA (lpString="*.jpeg") returned 6 [0049.173] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.psd") returned 0 [0049.173] lstrlenA (lpString="*.psd") returned 5 [0049.173] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.gif") returned 0 [0049.173] lstrlenA (lpString="*.gif") returned 5 [0049.173] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.doc") returned 0 [0049.173] lstrlenA (lpString="*.doc") returned 5 [0049.173] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.docx") returned 0 [0049.173] lstrlenA (lpString="*.docx") returned 6 [0049.173] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.xls") returned 0 [0049.173] lstrlenA (lpString="*.xls") returned 5 [0049.173] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.xlsx") returned 0 [0049.173] lstrlenA (lpString="*.xlsx") returned 6 [0049.173] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.ppt") returned 0 [0049.173] lstrlenA (lpString="*.ppt") returned 5 [0049.173] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.pptx") returned 0 [0049.173] lstrlenA (lpString="*.pptx") returned 6 [0049.173] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.pdf") returned 0 [0049.173] lstrlenA (lpString="*.pdf") returned 5 [0049.173] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.mov") returned 0 [0049.173] lstrlenA (lpString="*.mov") returned 5 [0049.173] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.m2v") returned 0 [0049.173] lstrlenA (lpString="*.m2v") returned 5 [0049.173] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.3gp") returned 0 [0049.173] lstrlenA (lpString="*.3gp") returned 5 [0049.173] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.mpeg") returned 0 [0049.174] lstrlenA (lpString="*.mpeg") returned 6 [0049.174] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.mpg") returned 0 [0049.174] lstrlenA (lpString="*.mpg") returned 5 [0049.174] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.flv") returned 0 [0049.174] lstrlenA (lpString="*.flv") returned 5 [0049.174] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.avi") returned 0 [0049.174] lstrlenA (lpString="*.avi") returned 5 [0049.174] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.mp4") returned 0 [0049.174] lstrlenA (lpString="*.mp4") returned 5 [0049.174] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.wmv") returned 0 [0049.174] lstrlenA (lpString="*.wmv") returned 5 [0049.174] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.divx") returned 0 [0049.174] lstrlenA (lpString="*.divx") returned 6 [0049.174] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.mkv") returned 0 [0049.174] lstrlenA (lpString="*.mkv") returned 5 [0049.174] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.mp3") returned 0 [0049.174] lstrlenA (lpString="*.mp3") returned 5 [0049.174] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.wav") returned 0 [0049.174] lstrlenA (lpString="*.wav") returned 5 [0049.174] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.flac") returned 0 [0049.174] lstrlenA (lpString="*.flac") returned 6 [0049.174] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.ape") returned 0 [0049.174] lstrlenA (lpString="*.ape") returned 5 [0049.174] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.wma") returned 0 [0049.174] lstrlenA (lpString="*.wma") returned 5 [0049.174] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.ac3") returned 0 [0049.174] lstrlenA (lpString="*.ac3") returned 5 [0049.174] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", pszSpec="*.mxf") returned 0 [0049.175] lstrlenA (lpString="*.mxf") returned 5 [0049.175] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x780074, dwReserved1=0x74, cFileName="SPRING.INF", cAlternateFileName="")) returned 1 [0049.175] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.175] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SPRING.INF") returned -1 [0049.175] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SPRING.INF") returned -1 [0049.175] lstrcmpiA (lpString1="", lpString2="SPRING.INF") returned -1 [0049.175] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned="SPRING.ELM" [0049.175] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\" [0049.175] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\") returned="" [0049.175] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO DECRYPT FILES.txt" [0049.175] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\how to decrypt files.txt")) returned 0x20 [0049.175] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", lpString2="SPRING.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" [0049.175] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.zip") returned 0 [0049.175] lstrlenA (lpString="*.zip") returned 5 [0049.175] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.rar") returned 0 [0049.175] lstrlenA (lpString="*.rar") returned 5 [0049.175] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.7z") returned 0 [0049.175] lstrlenA (lpString="*.7z") returned 4 [0049.175] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.tar") returned 0 [0049.175] lstrlenA (lpString="*.tar") returned 5 [0049.175] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.gzip") returned 0 [0049.175] lstrlenA (lpString="*.gzip") returned 6 [0049.175] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.jpg") returned 0 [0049.175] lstrlenA (lpString="*.jpg") returned 5 [0049.175] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.jpeg") returned 0 [0049.175] lstrlenA (lpString="*.jpeg") returned 6 [0049.176] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.psd") returned 0 [0049.176] lstrlenA (lpString="*.psd") returned 5 [0049.176] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.gif") returned 0 [0049.176] lstrlenA (lpString="*.gif") returned 5 [0049.176] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.doc") returned 0 [0049.176] lstrlenA (lpString="*.doc") returned 5 [0049.176] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.docx") returned 0 [0049.176] lstrlenA (lpString="*.docx") returned 6 [0049.176] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.xls") returned 0 [0049.176] lstrlenA (lpString="*.xls") returned 5 [0049.176] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.xlsx") returned 0 [0049.176] lstrlenA (lpString="*.xlsx") returned 6 [0049.176] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.ppt") returned 0 [0049.176] lstrlenA (lpString="*.ppt") returned 5 [0049.176] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.pptx") returned 0 [0049.176] lstrlenA (lpString="*.pptx") returned 6 [0049.176] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.pdf") returned 0 [0049.176] lstrlenA (lpString="*.pdf") returned 5 [0049.176] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.mov") returned 0 [0049.176] lstrlenA (lpString="*.mov") returned 5 [0049.176] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.m2v") returned 0 [0049.176] lstrlenA (lpString="*.m2v") returned 5 [0049.176] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.3gp") returned 0 [0049.176] lstrlenA (lpString="*.3gp") returned 5 [0049.176] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.mpeg") returned 0 [0049.176] lstrlenA (lpString="*.mpeg") returned 6 [0049.176] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.mpg") returned 0 [0049.176] lstrlenA (lpString="*.mpg") returned 5 [0049.177] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.flv") returned 0 [0049.177] lstrlenA (lpString="*.flv") returned 5 [0049.177] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.avi") returned 0 [0049.177] lstrlenA (lpString="*.avi") returned 5 [0049.177] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.mp4") returned 0 [0049.177] lstrlenA (lpString="*.mp4") returned 5 [0049.177] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.wmv") returned 0 [0049.177] lstrlenA (lpString="*.wmv") returned 5 [0049.177] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.divx") returned 0 [0049.177] lstrlenA (lpString="*.divx") returned 6 [0049.177] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.mkv") returned 0 [0049.177] lstrlenA (lpString="*.mkv") returned 5 [0049.177] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.mp3") returned 0 [0049.177] lstrlenA (lpString="*.mp3") returned 5 [0049.177] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.wav") returned 0 [0049.177] lstrlenA (lpString="*.wav") returned 5 [0049.177] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.flac") returned 0 [0049.177] lstrlenA (lpString="*.flac") returned 6 [0049.177] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.ape") returned 0 [0049.177] lstrlenA (lpString="*.ape") returned 5 [0049.177] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.wma") returned 0 [0049.177] lstrlenA (lpString="*.wma") returned 5 [0049.177] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.ac3") returned 0 [0049.177] lstrlenA (lpString="*.ac3") returned 5 [0049.177] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", pszSpec="*.mxf") returned 0 [0049.177] lstrlenA (lpString="*.mxf") returned 5 [0049.177] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x780074, dwReserved1=0x74, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0049.177] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.178] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0049.178] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0049.178] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0049.178] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned="SPRING.INF" [0049.178] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\" [0049.178] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\") returned="" [0049.178] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO DECRYPT FILES.txt" [0049.178] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\how to decrypt files.txt")) returned 0x20 [0049.178] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" [0049.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0049.178] lstrlenA (lpString="*.zip") returned 5 [0049.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0049.178] lstrlenA (lpString="*.rar") returned 5 [0049.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0049.178] lstrlenA (lpString="*.7z") returned 4 [0049.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0049.178] lstrlenA (lpString="*.tar") returned 5 [0049.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0049.178] lstrlenA (lpString="*.gzip") returned 6 [0049.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0049.178] lstrlenA (lpString="*.jpg") returned 5 [0049.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0049.178] lstrlenA (lpString="*.jpeg") returned 6 [0049.178] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0049.178] lstrlenA (lpString="*.psd") returned 5 [0049.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0049.179] lstrlenA (lpString="*.gif") returned 5 [0049.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0049.179] lstrlenA (lpString="*.doc") returned 5 [0049.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0049.179] lstrlenA (lpString="*.docx") returned 6 [0049.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0049.179] lstrlenA (lpString="*.xls") returned 5 [0049.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0049.179] lstrlenA (lpString="*.xlsx") returned 6 [0049.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0049.179] lstrlenA (lpString="*.ppt") returned 5 [0049.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0049.179] lstrlenA (lpString="*.pptx") returned 6 [0049.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0049.179] lstrlenA (lpString="*.pdf") returned 5 [0049.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0049.179] lstrlenA (lpString="*.mov") returned 5 [0049.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0049.179] lstrlenA (lpString="*.m2v") returned 5 [0049.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0049.179] lstrlenA (lpString="*.3gp") returned 5 [0049.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0049.179] lstrlenA (lpString="*.mpeg") returned 6 [0049.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0049.179] lstrlenA (lpString="*.mpg") returned 5 [0049.179] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0049.179] lstrlenA (lpString="*.flv") returned 5 [0049.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0049.180] lstrlenA (lpString="*.avi") returned 5 [0049.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0049.180] lstrlenA (lpString="*.mp4") returned 5 [0049.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0049.180] lstrlenA (lpString="*.wmv") returned 5 [0049.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0049.180] lstrlenA (lpString="*.divx") returned 6 [0049.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0049.180] lstrlenA (lpString="*.mkv") returned 5 [0049.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0049.180] lstrlenA (lpString="*.mp3") returned 5 [0049.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0049.180] lstrlenA (lpString="*.wav") returned 5 [0049.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0049.180] lstrlenA (lpString="*.flac") returned 6 [0049.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0049.180] lstrlenA (lpString="*.ape") returned 5 [0049.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0049.180] lstrlenA (lpString="*.wma") returned 5 [0049.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0049.180] lstrlenA (lpString="*.ac3") returned 5 [0049.180] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0049.180] lstrlenA (lpString="*.mxf") returned 5 [0049.180] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x780074, dwReserved1=0x74, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0049.180] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0049.181] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0049.181] lstrcmpA (lpString1=".", lpString2="STRTEDGE") returned -1 [0049.181] lstrcmpA (lpString1="..", lpString2="STRTEDGE") returned -1 [0049.181] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0049.181] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="STRTEDGE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE" [0049.181] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE") returned 64 [0049.181] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2d80c8 [0049.182] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.182] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.182] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.182] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.182] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0049.182] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.182] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0049.182] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0049.182] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0049.182] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*") returned="*.*" [0049.182] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\" [0049.182] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\") returned="" [0049.182] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO DECRYPT FILES.txt" [0049.183] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\how to decrypt files.txt")) returned 0xffffffff [0049.183] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.185] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0049.185] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0049.186] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.186] CloseHandle (hObject=0x90) returned 1 [0049.186] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" [0049.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0049.186] lstrlenA (lpString="*.zip") returned 5 [0049.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0049.186] lstrlenA (lpString="*.rar") returned 5 [0049.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0049.186] lstrlenA (lpString="*.7z") returned 4 [0049.186] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0049.186] lstrlenA (lpString="*.tar") returned 5 [0049.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0049.187] lstrlenA (lpString="*.gzip") returned 6 [0049.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0049.187] lstrlenA (lpString="*.jpg") returned 5 [0049.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0049.187] lstrlenA (lpString="*.jpeg") returned 6 [0049.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0049.187] lstrlenA (lpString="*.psd") returned 5 [0049.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0049.187] lstrlenA (lpString="*.gif") returned 5 [0049.187] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" [0049.187] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" [0049.187] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF." [0049.187] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.wannacry" [0049.187] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.187] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6c9 [0049.187] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d084c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x376bcd00, dwHighDateTime=0x1c3ee72)) returned 1 [0049.188] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0049.188] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x64b, lpOverlapped=0x0) returned 1 [0049.190] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0049.190] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0049.190] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x64b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x64b, lpOverlapped=0x0) returned 1 [0049.190] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0049.190] CloseHandle (hObject=0x90) returned 1 [0049.192] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.wannacry")) returned 1 [0049.192] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d180d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d180d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe232, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="STRTEDGE.ELM", cAlternateFileName="")) returned 1 [0049.192] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.192] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="STRTEDGE.ELM") returned -1 [0049.192] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="STRTEDGE.ELM") returned -1 [0049.192] lstrcmpiA (lpString1="", lpString2="STRTEDGE.ELM") returned -1 [0049.193] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0049.193] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\" [0049.193] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\") returned="" [0049.193] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO DECRYPT FILES.txt" [0049.193] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\how to decrypt files.txt")) returned 0x20 [0049.193] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", lpString2="STRTEDGE.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" [0049.193] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.zip") returned 0 [0049.193] lstrlenA (lpString="*.zip") returned 5 [0049.193] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.rar") returned 0 [0049.193] lstrlenA (lpString="*.rar") returned 5 [0049.193] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.7z") returned 0 [0049.193] lstrlenA (lpString="*.7z") returned 4 [0049.193] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.tar") returned 0 [0049.193] lstrlenA (lpString="*.tar") returned 5 [0049.193] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.gzip") returned 0 [0049.193] lstrlenA (lpString="*.gzip") returned 6 [0049.193] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.jpg") returned 0 [0049.193] lstrlenA (lpString="*.jpg") returned 5 [0049.193] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.jpeg") returned 0 [0049.193] lstrlenA (lpString="*.jpeg") returned 6 [0049.193] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.psd") returned 0 [0049.193] lstrlenA (lpString="*.psd") returned 5 [0049.193] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.gif") returned 0 [0049.193] lstrlenA (lpString="*.gif") returned 5 [0049.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.doc") returned 0 [0049.194] lstrlenA (lpString="*.doc") returned 5 [0049.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.docx") returned 0 [0049.194] lstrlenA (lpString="*.docx") returned 6 [0049.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.xls") returned 0 [0049.194] lstrlenA (lpString="*.xls") returned 5 [0049.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.xlsx") returned 0 [0049.194] lstrlenA (lpString="*.xlsx") returned 6 [0049.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.ppt") returned 0 [0049.194] lstrlenA (lpString="*.ppt") returned 5 [0049.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.pptx") returned 0 [0049.194] lstrlenA (lpString="*.pptx") returned 6 [0049.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.pdf") returned 0 [0049.194] lstrlenA (lpString="*.pdf") returned 5 [0049.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.mov") returned 0 [0049.194] lstrlenA (lpString="*.mov") returned 5 [0049.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.m2v") returned 0 [0049.194] lstrlenA (lpString="*.m2v") returned 5 [0049.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.3gp") returned 0 [0049.194] lstrlenA (lpString="*.3gp") returned 5 [0049.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.mpeg") returned 0 [0049.194] lstrlenA (lpString="*.mpeg") returned 6 [0049.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.mpg") returned 0 [0049.194] lstrlenA (lpString="*.mpg") returned 5 [0049.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.flv") returned 0 [0049.194] lstrlenA (lpString="*.flv") returned 5 [0049.194] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.avi") returned 0 [0049.194] lstrlenA (lpString="*.avi") returned 5 [0049.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.mp4") returned 0 [0049.195] lstrlenA (lpString="*.mp4") returned 5 [0049.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.wmv") returned 0 [0049.195] lstrlenA (lpString="*.wmv") returned 5 [0049.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.divx") returned 0 [0049.195] lstrlenA (lpString="*.divx") returned 6 [0049.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.mkv") returned 0 [0049.195] lstrlenA (lpString="*.mkv") returned 5 [0049.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.mp3") returned 0 [0049.195] lstrlenA (lpString="*.mp3") returned 5 [0049.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.wav") returned 0 [0049.195] lstrlenA (lpString="*.wav") returned 5 [0049.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.flac") returned 0 [0049.195] lstrlenA (lpString="*.flac") returned 6 [0049.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.ape") returned 0 [0049.195] lstrlenA (lpString="*.ape") returned 5 [0049.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.wma") returned 0 [0049.195] lstrlenA (lpString="*.wma") returned 5 [0049.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.ac3") returned 0 [0049.195] lstrlenA (lpString="*.ac3") returned 5 [0049.195] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", pszSpec="*.mxf") returned 0 [0049.195] lstrlenA (lpString="*.mxf") returned 5 [0049.195] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="STRTEDGE.INF", cAlternateFileName="")) returned 1 [0049.195] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.195] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="STRTEDGE.INF") returned -1 [0049.195] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="STRTEDGE.INF") returned -1 [0049.195] lstrcmpiA (lpString1="", lpString2="STRTEDGE.INF") returned -1 [0049.195] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned="STRTEDGE.ELM" [0049.196] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\" [0049.196] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\") returned="" [0049.196] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO DECRYPT FILES.txt" [0049.196] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\how to decrypt files.txt")) returned 0x20 [0049.196] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", lpString2="STRTEDGE.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" [0049.196] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.zip") returned 0 [0049.196] lstrlenA (lpString="*.zip") returned 5 [0049.196] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.rar") returned 0 [0049.196] lstrlenA (lpString="*.rar") returned 5 [0049.196] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.7z") returned 0 [0049.196] lstrlenA (lpString="*.7z") returned 4 [0049.196] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.tar") returned 0 [0049.196] lstrlenA (lpString="*.tar") returned 5 [0049.196] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.gzip") returned 0 [0049.196] lstrlenA (lpString="*.gzip") returned 6 [0049.196] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.jpg") returned 0 [0049.196] lstrlenA (lpString="*.jpg") returned 5 [0049.196] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.jpeg") returned 0 [0049.196] lstrlenA (lpString="*.jpeg") returned 6 [0049.196] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.psd") returned 0 [0049.196] lstrlenA (lpString="*.psd") returned 5 [0049.196] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.gif") returned 0 [0049.196] lstrlenA (lpString="*.gif") returned 5 [0049.196] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.doc") returned 0 [0049.196] lstrlenA (lpString="*.doc") returned 5 [0049.197] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.docx") returned 0 [0049.197] lstrlenA (lpString="*.docx") returned 6 [0049.197] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.xls") returned 0 [0049.197] lstrlenA (lpString="*.xls") returned 5 [0049.197] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.xlsx") returned 0 [0049.197] lstrlenA (lpString="*.xlsx") returned 6 [0049.197] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.ppt") returned 0 [0049.197] lstrlenA (lpString="*.ppt") returned 5 [0049.197] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.pptx") returned 0 [0049.197] lstrlenA (lpString="*.pptx") returned 6 [0049.197] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.pdf") returned 0 [0049.197] lstrlenA (lpString="*.pdf") returned 5 [0049.197] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.mov") returned 0 [0049.197] lstrlenA (lpString="*.mov") returned 5 [0049.197] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.m2v") returned 0 [0049.197] lstrlenA (lpString="*.m2v") returned 5 [0049.197] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.3gp") returned 0 [0049.197] lstrlenA (lpString="*.3gp") returned 5 [0049.197] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.mpeg") returned 0 [0049.197] lstrlenA (lpString="*.mpeg") returned 6 [0049.197] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.mpg") returned 0 [0049.197] lstrlenA (lpString="*.mpg") returned 5 [0049.197] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.flv") returned 0 [0049.198] lstrlenA (lpString="*.flv") returned 5 [0049.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.avi") returned 0 [0049.198] lstrlenA (lpString="*.avi") returned 5 [0049.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.mp4") returned 0 [0049.198] lstrlenA (lpString="*.mp4") returned 5 [0049.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.wmv") returned 0 [0049.198] lstrlenA (lpString="*.wmv") returned 5 [0049.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.divx") returned 0 [0049.198] lstrlenA (lpString="*.divx") returned 6 [0049.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.mkv") returned 0 [0049.198] lstrlenA (lpString="*.mkv") returned 5 [0049.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.mp3") returned 0 [0049.198] lstrlenA (lpString="*.mp3") returned 5 [0049.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.wav") returned 0 [0049.198] lstrlenA (lpString="*.wav") returned 5 [0049.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.flac") returned 0 [0049.198] lstrlenA (lpString="*.flac") returned 6 [0049.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.ape") returned 0 [0049.198] lstrlenA (lpString="*.ape") returned 5 [0049.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.wma") returned 0 [0049.198] lstrlenA (lpString="*.wma") returned 5 [0049.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.ac3") returned 0 [0049.198] lstrlenA (lpString="*.ac3") returned 5 [0049.198] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", pszSpec="*.mxf") returned 0 [0049.198] lstrlenA (lpString="*.mxf") returned 5 [0049.198] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0049.198] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.198] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0049.199] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0049.199] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0049.199] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned="STRTEDGE.INF" [0049.199] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\" [0049.199] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\") returned="" [0049.199] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO DECRYPT FILES.txt" [0049.199] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\how to decrypt files.txt")) returned 0x20 [0049.199] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" [0049.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0049.199] lstrlenA (lpString="*.zip") returned 5 [0049.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0049.199] lstrlenA (lpString="*.rar") returned 5 [0049.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0049.199] lstrlenA (lpString="*.7z") returned 4 [0049.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0049.199] lstrlenA (lpString="*.tar") returned 5 [0049.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0049.199] lstrlenA (lpString="*.gzip") returned 6 [0049.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0049.199] lstrlenA (lpString="*.jpg") returned 5 [0049.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0049.199] lstrlenA (lpString="*.jpeg") returned 6 [0049.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0049.199] lstrlenA (lpString="*.psd") returned 5 [0049.199] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0049.199] lstrlenA (lpString="*.gif") returned 5 [0049.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0049.200] lstrlenA (lpString="*.doc") returned 5 [0049.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0049.200] lstrlenA (lpString="*.docx") returned 6 [0049.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0049.200] lstrlenA (lpString="*.xls") returned 5 [0049.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0049.200] lstrlenA (lpString="*.xlsx") returned 6 [0049.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0049.200] lstrlenA (lpString="*.ppt") returned 5 [0049.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0049.200] lstrlenA (lpString="*.pptx") returned 6 [0049.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0049.200] lstrlenA (lpString="*.pdf") returned 5 [0049.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0049.200] lstrlenA (lpString="*.mov") returned 5 [0049.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0049.200] lstrlenA (lpString="*.m2v") returned 5 [0049.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0049.200] lstrlenA (lpString="*.3gp") returned 5 [0049.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0049.200] lstrlenA (lpString="*.mpeg") returned 6 [0049.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0049.200] lstrlenA (lpString="*.mpg") returned 5 [0049.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0049.200] lstrlenA (lpString="*.flv") returned 5 [0049.200] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0049.200] lstrlenA (lpString="*.avi") returned 5 [0049.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0049.201] lstrlenA (lpString="*.mp4") returned 5 [0049.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0049.201] lstrlenA (lpString="*.wmv") returned 5 [0049.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0049.201] lstrlenA (lpString="*.divx") returned 6 [0049.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0049.201] lstrlenA (lpString="*.mkv") returned 5 [0049.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0049.201] lstrlenA (lpString="*.mp3") returned 5 [0049.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0049.201] lstrlenA (lpString="*.wav") returned 5 [0049.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0049.201] lstrlenA (lpString="*.flac") returned 6 [0049.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0049.201] lstrlenA (lpString="*.ape") returned 5 [0049.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0049.201] lstrlenA (lpString="*.wma") returned 5 [0049.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0049.201] lstrlenA (lpString="*.ac3") returned 5 [0049.201] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0049.201] lstrlenA (lpString="*.mxf") returned 5 [0049.201] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0049.201] FindClose (in: hFindFile=0x2d80c8 | out: hFindFile=0x2d80c8) returned 1 [0049.201] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0049.202] lstrcmpA (lpString1=".", lpString2="STUDIO") returned -1 [0049.202] lstrcmpA (lpString1="..", lpString2="STUDIO") returned -1 [0049.202] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0049.202] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="STUDIO" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO" [0049.202] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO") returned 62 [0049.202] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0049.202] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.202] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x780000, cFileName="..", cAlternateFileName="")) returned 1 [0049.202] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.202] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.202] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x68b, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0049.202] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.202] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0049.202] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0049.202] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0049.202] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*") returned="*.*" [0049.202] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\" [0049.202] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\") returned="" [0049.203] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO DECRYPT FILES.txt" [0049.203] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\how to decrypt files.txt")) returned 0xffffffff [0049.203] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.203] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0049.203] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0049.204] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.204] CloseHandle (hObject=0x90) returned 1 [0049.205] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" [0049.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0049.205] lstrlenA (lpString="*.zip") returned 5 [0049.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0049.205] lstrlenA (lpString="*.rar") returned 5 [0049.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0049.205] lstrlenA (lpString="*.7z") returned 4 [0049.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0049.205] lstrlenA (lpString="*.tar") returned 5 [0049.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0049.205] lstrlenA (lpString="*.gzip") returned 6 [0049.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0049.205] lstrlenA (lpString="*.jpg") returned 5 [0049.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0049.205] lstrlenA (lpString="*.jpeg") returned 6 [0049.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0049.205] lstrlenA (lpString="*.psd") returned 5 [0049.205] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0049.205] lstrlenA (lpString="*.gif") returned 5 [0049.205] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" [0049.205] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" [0049.205] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF." [0049.205] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.wannacry" [0049.206] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.207] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x68b [0049.207] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x389cfa00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a71ef90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x389cfa00, dwHighDateTime=0x1c3ee72)) returned 1 [0049.207] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0049.207] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60d, lpOverlapped=0x0) returned 1 [0049.209] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned="PREVIEW.GIF" [0049.209] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0049.209] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60d, lpOverlapped=0x0) returned 1 [0049.209] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0049.209] CloseHandle (hObject=0x90) returned 1 [0049.210] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.wannacry")) returned 1 [0049.213] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e493a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e493a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfed, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="STUDIO.ELM", cAlternateFileName="")) returned 1 [0049.213] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.213] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="STUDIO.ELM") returned -1 [0049.213] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="STUDIO.ELM") returned -1 [0049.213] lstrcmpiA (lpString1="", lpString2="STUDIO.ELM") returned -1 [0049.213] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned="PREVIEW.GIF" [0049.213] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\" [0049.213] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\") returned="" [0049.213] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO DECRYPT FILES.txt" [0049.213] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\how to decrypt files.txt")) returned 0x20 [0049.213] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", lpString2="STUDIO.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" [0049.213] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.zip") returned 0 [0049.213] lstrlenA (lpString="*.zip") returned 5 [0049.213] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.rar") returned 0 [0049.213] lstrlenA (lpString="*.rar") returned 5 [0049.214] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.7z") returned 0 [0049.214] lstrlenA (lpString="*.7z") returned 4 [0049.214] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.tar") returned 0 [0049.214] lstrlenA (lpString="*.tar") returned 5 [0049.214] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.gzip") returned 0 [0049.214] lstrlenA (lpString="*.gzip") returned 6 [0049.214] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.jpg") returned 0 [0049.214] lstrlenA (lpString="*.jpg") returned 5 [0049.214] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.jpeg") returned 0 [0049.214] lstrlenA (lpString="*.jpeg") returned 6 [0049.214] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.psd") returned 0 [0049.214] lstrlenA (lpString="*.psd") returned 5 [0049.214] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.gif") returned 0 [0049.214] lstrlenA (lpString="*.gif") returned 5 [0049.214] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.doc") returned 0 [0049.214] lstrlenA (lpString="*.doc") returned 5 [0049.214] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.docx") returned 0 [0049.214] lstrlenA (lpString="*.docx") returned 6 [0049.214] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.xls") returned 0 [0049.214] lstrlenA (lpString="*.xls") returned 5 [0049.214] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.xlsx") returned 0 [0049.214] lstrlenA (lpString="*.xlsx") returned 6 [0049.214] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.ppt") returned 0 [0049.214] lstrlenA (lpString="*.ppt") returned 5 [0049.214] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.pptx") returned 0 [0049.214] lstrlenA (lpString="*.pptx") returned 6 [0049.214] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.pdf") returned 0 [0049.215] lstrlenA (lpString="*.pdf") returned 5 [0049.215] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.mov") returned 0 [0049.215] lstrlenA (lpString="*.mov") returned 5 [0049.215] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.m2v") returned 0 [0049.215] lstrlenA (lpString="*.m2v") returned 5 [0049.215] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.3gp") returned 0 [0049.215] lstrlenA (lpString="*.3gp") returned 5 [0049.215] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.mpeg") returned 0 [0049.215] lstrlenA (lpString="*.mpeg") returned 6 [0049.215] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.mpg") returned 0 [0049.215] lstrlenA (lpString="*.mpg") returned 5 [0049.215] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.flv") returned 0 [0049.215] lstrlenA (lpString="*.flv") returned 5 [0049.215] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.avi") returned 0 [0049.215] lstrlenA (lpString="*.avi") returned 5 [0049.215] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.mp4") returned 0 [0049.215] lstrlenA (lpString="*.mp4") returned 5 [0049.215] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.wmv") returned 0 [0049.215] lstrlenA (lpString="*.wmv") returned 5 [0049.215] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.divx") returned 0 [0049.215] lstrlenA (lpString="*.divx") returned 6 [0049.215] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.mkv") returned 0 [0049.215] lstrlenA (lpString="*.mkv") returned 5 [0049.215] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.mp3") returned 0 [0049.215] lstrlenA (lpString="*.mp3") returned 5 [0049.215] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.wav") returned 0 [0049.215] lstrlenA (lpString="*.wav") returned 5 [0049.215] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.flac") returned 0 [0049.216] lstrlenA (lpString="*.flac") returned 6 [0049.216] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.ape") returned 0 [0049.216] lstrlenA (lpString="*.ape") returned 5 [0049.216] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.wma") returned 0 [0049.216] lstrlenA (lpString="*.wma") returned 5 [0049.216] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.ac3") returned 0 [0049.216] lstrlenA (lpString="*.ac3") returned 5 [0049.216] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", pszSpec="*.mxf") returned 0 [0049.216] lstrlenA (lpString="*.mxf") returned 5 [0049.216] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x780074, dwReserved1=0x74, cFileName="STUDIO.INF", cAlternateFileName="")) returned 1 [0049.216] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.216] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="STUDIO.INF") returned -1 [0049.216] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="STUDIO.INF") returned -1 [0049.216] lstrcmpiA (lpString1="", lpString2="STUDIO.INF") returned -1 [0049.216] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM") returned="STUDIO.ELM" [0049.216] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\" [0049.216] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\") returned="" [0049.216] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO DECRYPT FILES.txt" [0049.216] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\how to decrypt files.txt")) returned 0x20 [0049.216] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", lpString2="STUDIO.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" [0049.216] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.zip") returned 0 [0049.216] lstrlenA (lpString="*.zip") returned 5 [0049.216] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.rar") returned 0 [0049.216] lstrlenA (lpString="*.rar") returned 5 [0049.216] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.7z") returned 0 [0049.217] lstrlenA (lpString="*.7z") returned 4 [0049.217] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.tar") returned 0 [0049.217] lstrlenA (lpString="*.tar") returned 5 [0049.217] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.gzip") returned 0 [0049.217] lstrlenA (lpString="*.gzip") returned 6 [0049.217] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.jpg") returned 0 [0049.217] lstrlenA (lpString="*.jpg") returned 5 [0049.217] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.jpeg") returned 0 [0049.217] lstrlenA (lpString="*.jpeg") returned 6 [0049.217] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.psd") returned 0 [0049.217] lstrlenA (lpString="*.psd") returned 5 [0049.217] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.gif") returned 0 [0049.217] lstrlenA (lpString="*.gif") returned 5 [0049.217] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.doc") returned 0 [0049.217] lstrlenA (lpString="*.doc") returned 5 [0049.217] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.docx") returned 0 [0049.217] lstrlenA (lpString="*.docx") returned 6 [0049.217] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.xls") returned 0 [0049.217] lstrlenA (lpString="*.xls") returned 5 [0049.217] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.xlsx") returned 0 [0049.217] lstrlenA (lpString="*.xlsx") returned 6 [0049.217] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.ppt") returned 0 [0049.217] lstrlenA (lpString="*.ppt") returned 5 [0049.217] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.pptx") returned 0 [0049.217] lstrlenA (lpString="*.pptx") returned 6 [0049.217] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.pdf") returned 0 [0049.217] lstrlenA (lpString="*.pdf") returned 5 [0049.217] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.mov") returned 0 [0049.218] lstrlenA (lpString="*.mov") returned 5 [0049.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.m2v") returned 0 [0049.218] lstrlenA (lpString="*.m2v") returned 5 [0049.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.3gp") returned 0 [0049.218] lstrlenA (lpString="*.3gp") returned 5 [0049.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.mpeg") returned 0 [0049.218] lstrlenA (lpString="*.mpeg") returned 6 [0049.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.mpg") returned 0 [0049.218] lstrlenA (lpString="*.mpg") returned 5 [0049.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.flv") returned 0 [0049.218] lstrlenA (lpString="*.flv") returned 5 [0049.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.avi") returned 0 [0049.218] lstrlenA (lpString="*.avi") returned 5 [0049.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.mp4") returned 0 [0049.218] lstrlenA (lpString="*.mp4") returned 5 [0049.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.wmv") returned 0 [0049.218] lstrlenA (lpString="*.wmv") returned 5 [0049.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.divx") returned 0 [0049.218] lstrlenA (lpString="*.divx") returned 6 [0049.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.mkv") returned 0 [0049.218] lstrlenA (lpString="*.mkv") returned 5 [0049.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.mp3") returned 0 [0049.218] lstrlenA (lpString="*.mp3") returned 5 [0049.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.wav") returned 0 [0049.218] lstrlenA (lpString="*.wav") returned 5 [0049.218] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.flac") returned 0 [0049.218] lstrlenA (lpString="*.flac") returned 6 [0049.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.ape") returned 0 [0049.219] lstrlenA (lpString="*.ape") returned 5 [0049.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.wma") returned 0 [0049.219] lstrlenA (lpString="*.wma") returned 5 [0049.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.ac3") returned 0 [0049.219] lstrlenA (lpString="*.ac3") returned 5 [0049.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", pszSpec="*.mxf") returned 0 [0049.219] lstrlenA (lpString="*.mxf") returned 5 [0049.219] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x780074, dwReserved1=0x74, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0049.219] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.219] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0049.219] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0049.219] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0049.219] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned="STUDIO.INF" [0049.219] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\" [0049.219] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\") returned="" [0049.219] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO DECRYPT FILES.txt" [0049.219] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\how to decrypt files.txt")) returned 0x20 [0049.219] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" [0049.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0049.219] lstrlenA (lpString="*.zip") returned 5 [0049.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0049.219] lstrlenA (lpString="*.rar") returned 5 [0049.219] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0049.220] lstrlenA (lpString="*.7z") returned 4 [0049.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0049.220] lstrlenA (lpString="*.tar") returned 5 [0049.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0049.220] lstrlenA (lpString="*.gzip") returned 6 [0049.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0049.220] lstrlenA (lpString="*.jpg") returned 5 [0049.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0049.220] lstrlenA (lpString="*.jpeg") returned 6 [0049.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0049.220] lstrlenA (lpString="*.psd") returned 5 [0049.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0049.220] lstrlenA (lpString="*.gif") returned 5 [0049.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0049.220] lstrlenA (lpString="*.doc") returned 5 [0049.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0049.220] lstrlenA (lpString="*.docx") returned 6 [0049.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0049.220] lstrlenA (lpString="*.xls") returned 5 [0049.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0049.220] lstrlenA (lpString="*.xlsx") returned 6 [0049.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0049.220] lstrlenA (lpString="*.ppt") returned 5 [0049.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0049.220] lstrlenA (lpString="*.pptx") returned 6 [0049.220] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0049.220] lstrlenA (lpString="*.pdf") returned 5 [0049.221] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0049.221] lstrlenA (lpString="*.mov") returned 5 [0049.221] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0049.221] lstrlenA (lpString="*.m2v") returned 5 [0049.221] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0049.221] lstrlenA (lpString="*.3gp") returned 5 [0049.221] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0049.221] lstrlenA (lpString="*.mpeg") returned 6 [0049.221] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0049.221] lstrlenA (lpString="*.mpg") returned 5 [0049.221] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0049.221] lstrlenA (lpString="*.flv") returned 5 [0049.221] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0049.221] lstrlenA (lpString="*.avi") returned 5 [0049.221] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0049.221] lstrlenA (lpString="*.mp4") returned 5 [0049.221] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0049.221] lstrlenA (lpString="*.wmv") returned 5 [0049.221] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0049.221] lstrlenA (lpString="*.divx") returned 6 [0049.221] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0049.221] lstrlenA (lpString="*.mkv") returned 5 [0049.221] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0049.221] lstrlenA (lpString="*.mp3") returned 5 [0049.221] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0049.221] lstrlenA (lpString="*.wav") returned 5 [0049.221] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0049.222] lstrlenA (lpString="*.flac") returned 6 [0049.222] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0049.222] lstrlenA (lpString="*.ape") returned 5 [0049.222] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0049.222] lstrlenA (lpString="*.wma") returned 5 [0049.222] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0049.222] lstrlenA (lpString="*.ac3") returned 5 [0049.222] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0049.222] lstrlenA (lpString="*.mxf") returned 5 [0049.222] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x780074, dwReserved1=0x74, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0049.222] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0049.222] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0049.222] lstrcmpA (lpString1=".", lpString2="SUMIPNTG") returned -1 [0049.222] lstrcmpA (lpString1="..", lpString2="SUMIPNTG") returned -1 [0049.222] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0049.222] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="SUMIPNTG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG" [0049.222] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG") returned 64 [0049.222] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2d80c8 [0049.223] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.223] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.223] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.223] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.223] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0049.223] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.223] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0049.223] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0049.223] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0049.223] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*") returned="*.*" [0049.223] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\" [0049.223] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\") returned="" [0049.223] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO DECRYPT FILES.txt" [0049.223] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\how to decrypt files.txt")) returned 0xffffffff [0049.223] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.225] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0049.226] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0049.227] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.227] CloseHandle (hObject=0x90) returned 1 [0049.227] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" [0049.227] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0049.227] lstrlenA (lpString="*.zip") returned 5 [0049.227] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0049.227] lstrlenA (lpString="*.rar") returned 5 [0049.227] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0049.227] lstrlenA (lpString="*.7z") returned 4 [0049.227] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0049.227] lstrlenA (lpString="*.tar") returned 5 [0049.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0049.228] lstrlenA (lpString="*.gzip") returned 6 [0049.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0049.228] lstrlenA (lpString="*.jpg") returned 5 [0049.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0049.228] lstrlenA (lpString="*.jpeg") returned 6 [0049.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0049.228] lstrlenA (lpString="*.psd") returned 5 [0049.228] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0049.228] lstrlenA (lpString="*.gif") returned 5 [0049.228] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" [0049.228] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" [0049.228] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF." [0049.228] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.wannacry" [0049.228] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.229] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x137f [0049.229] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x389cfa00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a71ef90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x389cfa00, dwHighDateTime=0x1c3ee72)) returned 1 [0049.229] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0049.229] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1301, lpOverlapped=0x0) returned 1 [0049.243] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned="PREVIEW.GIF" [0049.243] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0049.243] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1301, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1301, lpOverlapped=0x0) returned 1 [0049.244] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0049.244] CloseHandle (hObject=0x90) returned 1 [0049.248] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.wannacry")) returned 1 [0049.249] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7a6700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f7a6700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x19e14, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="SUMIPNTG.ELM", cAlternateFileName="")) returned 1 [0049.249] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.249] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SUMIPNTG.ELM") returned -1 [0049.249] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SUMIPNTG.ELM") returned -1 [0049.249] lstrcmpiA (lpString1="", lpString2="SUMIPNTG.ELM") returned -1 [0049.249] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned="PREVIEW.GIF" [0049.249] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\" [0049.249] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\") returned="" [0049.249] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO DECRYPT FILES.txt" [0049.249] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\how to decrypt files.txt")) returned 0x20 [0049.250] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", lpString2="SUMIPNTG.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" [0049.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.zip") returned 0 [0049.250] lstrlenA (lpString="*.zip") returned 5 [0049.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.rar") returned 0 [0049.250] lstrlenA (lpString="*.rar") returned 5 [0049.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.7z") returned 0 [0049.250] lstrlenA (lpString="*.7z") returned 4 [0049.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.tar") returned 0 [0049.250] lstrlenA (lpString="*.tar") returned 5 [0049.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.gzip") returned 0 [0049.250] lstrlenA (lpString="*.gzip") returned 6 [0049.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.jpg") returned 0 [0049.250] lstrlenA (lpString="*.jpg") returned 5 [0049.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.jpeg") returned 0 [0049.250] lstrlenA (lpString="*.jpeg") returned 6 [0049.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.psd") returned 0 [0049.250] lstrlenA (lpString="*.psd") returned 5 [0049.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.gif") returned 0 [0049.250] lstrlenA (lpString="*.gif") returned 5 [0049.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.doc") returned 0 [0049.250] lstrlenA (lpString="*.doc") returned 5 [0049.250] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.docx") returned 0 [0049.250] lstrlenA (lpString="*.docx") returned 6 [0049.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.xls") returned 0 [0049.251] lstrlenA (lpString="*.xls") returned 5 [0049.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.xlsx") returned 0 [0049.251] lstrlenA (lpString="*.xlsx") returned 6 [0049.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.ppt") returned 0 [0049.251] lstrlenA (lpString="*.ppt") returned 5 [0049.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.pptx") returned 0 [0049.251] lstrlenA (lpString="*.pptx") returned 6 [0049.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.pdf") returned 0 [0049.251] lstrlenA (lpString="*.pdf") returned 5 [0049.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.mov") returned 0 [0049.251] lstrlenA (lpString="*.mov") returned 5 [0049.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.m2v") returned 0 [0049.251] lstrlenA (lpString="*.m2v") returned 5 [0049.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.3gp") returned 0 [0049.251] lstrlenA (lpString="*.3gp") returned 5 [0049.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.mpeg") returned 0 [0049.251] lstrlenA (lpString="*.mpeg") returned 6 [0049.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.mpg") returned 0 [0049.251] lstrlenA (lpString="*.mpg") returned 5 [0049.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.flv") returned 0 [0049.251] lstrlenA (lpString="*.flv") returned 5 [0049.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.avi") returned 0 [0049.251] lstrlenA (lpString="*.avi") returned 5 [0049.251] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.mp4") returned 0 [0049.252] lstrlenA (lpString="*.mp4") returned 5 [0049.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.wmv") returned 0 [0049.252] lstrlenA (lpString="*.wmv") returned 5 [0049.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.divx") returned 0 [0049.252] lstrlenA (lpString="*.divx") returned 6 [0049.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.mkv") returned 0 [0049.252] lstrlenA (lpString="*.mkv") returned 5 [0049.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.mp3") returned 0 [0049.252] lstrlenA (lpString="*.mp3") returned 5 [0049.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.wav") returned 0 [0049.252] lstrlenA (lpString="*.wav") returned 5 [0049.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.flac") returned 0 [0049.252] lstrlenA (lpString="*.flac") returned 6 [0049.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.ape") returned 0 [0049.252] lstrlenA (lpString="*.ape") returned 5 [0049.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.wma") returned 0 [0049.252] lstrlenA (lpString="*.wma") returned 5 [0049.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.ac3") returned 0 [0049.252] lstrlenA (lpString="*.ac3") returned 5 [0049.252] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", pszSpec="*.mxf") returned 0 [0049.252] lstrlenA (lpString="*.mxf") returned 5 [0049.252] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="SUMIPNTG.INF", cAlternateFileName="")) returned 1 [0049.252] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.252] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SUMIPNTG.INF") returned -1 [0049.252] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SUMIPNTG.INF") returned -1 [0049.253] lstrcmpiA (lpString1="", lpString2="SUMIPNTG.INF") returned -1 [0049.253] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned="SUMIPNTG.ELM" [0049.253] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\" [0049.253] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\") returned="" [0049.253] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO DECRYPT FILES.txt" [0049.253] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\how to decrypt files.txt")) returned 0x20 [0049.253] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", lpString2="SUMIPNTG.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" [0049.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.zip") returned 0 [0049.253] lstrlenA (lpString="*.zip") returned 5 [0049.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.rar") returned 0 [0049.253] lstrlenA (lpString="*.rar") returned 5 [0049.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.7z") returned 0 [0049.253] lstrlenA (lpString="*.7z") returned 4 [0049.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.tar") returned 0 [0049.253] lstrlenA (lpString="*.tar") returned 5 [0049.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.gzip") returned 0 [0049.253] lstrlenA (lpString="*.gzip") returned 6 [0049.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.jpg") returned 0 [0049.253] lstrlenA (lpString="*.jpg") returned 5 [0049.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.jpeg") returned 0 [0049.253] lstrlenA (lpString="*.jpeg") returned 6 [0049.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.psd") returned 0 [0049.253] lstrlenA (lpString="*.psd") returned 5 [0049.253] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.gif") returned 0 [0049.254] lstrlenA (lpString="*.gif") returned 5 [0049.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.doc") returned 0 [0049.254] lstrlenA (lpString="*.doc") returned 5 [0049.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.docx") returned 0 [0049.254] lstrlenA (lpString="*.docx") returned 6 [0049.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.xls") returned 0 [0049.254] lstrlenA (lpString="*.xls") returned 5 [0049.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.xlsx") returned 0 [0049.254] lstrlenA (lpString="*.xlsx") returned 6 [0049.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.ppt") returned 0 [0049.254] lstrlenA (lpString="*.ppt") returned 5 [0049.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.pptx") returned 0 [0049.254] lstrlenA (lpString="*.pptx") returned 6 [0049.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.pdf") returned 0 [0049.254] lstrlenA (lpString="*.pdf") returned 5 [0049.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.mov") returned 0 [0049.254] lstrlenA (lpString="*.mov") returned 5 [0049.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.m2v") returned 0 [0049.254] lstrlenA (lpString="*.m2v") returned 5 [0049.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.3gp") returned 0 [0049.254] lstrlenA (lpString="*.3gp") returned 5 [0049.254] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.mpeg") returned 0 [0049.254] lstrlenA (lpString="*.mpeg") returned 6 [0049.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.mpg") returned 0 [0049.255] lstrlenA (lpString="*.mpg") returned 5 [0049.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.flv") returned 0 [0049.255] lstrlenA (lpString="*.flv") returned 5 [0049.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.avi") returned 0 [0049.255] lstrlenA (lpString="*.avi") returned 5 [0049.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.mp4") returned 0 [0049.255] lstrlenA (lpString="*.mp4") returned 5 [0049.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.wmv") returned 0 [0049.255] lstrlenA (lpString="*.wmv") returned 5 [0049.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.divx") returned 0 [0049.255] lstrlenA (lpString="*.divx") returned 6 [0049.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.mkv") returned 0 [0049.255] lstrlenA (lpString="*.mkv") returned 5 [0049.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.mp3") returned 0 [0049.255] lstrlenA (lpString="*.mp3") returned 5 [0049.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.wav") returned 0 [0049.255] lstrlenA (lpString="*.wav") returned 5 [0049.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.flac") returned 0 [0049.255] lstrlenA (lpString="*.flac") returned 6 [0049.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.ape") returned 0 [0049.255] lstrlenA (lpString="*.ape") returned 5 [0049.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.wma") returned 0 [0049.255] lstrlenA (lpString="*.wma") returned 5 [0049.255] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.ac3") returned 0 [0049.256] lstrlenA (lpString="*.ac3") returned 5 [0049.256] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", pszSpec="*.mxf") returned 0 [0049.256] lstrlenA (lpString="*.mxf") returned 5 [0049.256] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0049.256] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.256] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0049.256] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0049.256] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0049.256] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned="SUMIPNTG.INF" [0049.256] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\" [0049.256] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\") returned="" [0049.256] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO DECRYPT FILES.txt" [0049.256] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\how to decrypt files.txt")) returned 0x20 [0049.256] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" [0049.256] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0049.256] lstrlenA (lpString="*.zip") returned 5 [0049.256] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0049.256] lstrlenA (lpString="*.rar") returned 5 [0049.256] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0049.256] lstrlenA (lpString="*.7z") returned 4 [0049.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0049.257] lstrlenA (lpString="*.tar") returned 5 [0049.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0049.257] lstrlenA (lpString="*.gzip") returned 6 [0049.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0049.257] lstrlenA (lpString="*.jpg") returned 5 [0049.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0049.257] lstrlenA (lpString="*.jpeg") returned 6 [0049.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0049.257] lstrlenA (lpString="*.psd") returned 5 [0049.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0049.257] lstrlenA (lpString="*.gif") returned 5 [0049.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0049.257] lstrlenA (lpString="*.doc") returned 5 [0049.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0049.257] lstrlenA (lpString="*.docx") returned 6 [0049.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0049.257] lstrlenA (lpString="*.xls") returned 5 [0049.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0049.257] lstrlenA (lpString="*.xlsx") returned 6 [0049.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0049.257] lstrlenA (lpString="*.ppt") returned 5 [0049.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0049.257] lstrlenA (lpString="*.pptx") returned 6 [0049.257] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0049.257] lstrlenA (lpString="*.pdf") returned 5 [0049.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0049.258] lstrlenA (lpString="*.mov") returned 5 [0049.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0049.258] lstrlenA (lpString="*.m2v") returned 5 [0049.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0049.258] lstrlenA (lpString="*.3gp") returned 5 [0049.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0049.258] lstrlenA (lpString="*.mpeg") returned 6 [0049.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0049.258] lstrlenA (lpString="*.mpg") returned 5 [0049.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0049.258] lstrlenA (lpString="*.flv") returned 5 [0049.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0049.258] lstrlenA (lpString="*.avi") returned 5 [0049.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0049.258] lstrlenA (lpString="*.mp4") returned 5 [0049.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0049.258] lstrlenA (lpString="*.wmv") returned 5 [0049.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0049.258] lstrlenA (lpString="*.divx") returned 6 [0049.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0049.258] lstrlenA (lpString="*.mkv") returned 5 [0049.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0049.258] lstrlenA (lpString="*.mp3") returned 5 [0049.258] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0049.258] lstrlenA (lpString="*.wav") returned 5 [0049.259] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0049.259] lstrlenA (lpString="*.flac") returned 6 [0049.259] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0049.259] lstrlenA (lpString="*.ape") returned 5 [0049.259] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0049.259] lstrlenA (lpString="*.wma") returned 5 [0049.259] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0049.259] lstrlenA (lpString="*.ac3") returned 5 [0049.259] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0049.259] lstrlenA (lpString="*.mxf") returned 5 [0049.259] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0049.259] FindClose (in: hFindFile=0x2d80c8 | out: hFindFile=0x2d80c8) returned 1 [0049.259] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24e4f00, ftLastWriteTime.dwHighDateTime=0x1c06b0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0049.259] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.259] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THEMES.INF") returned -1 [0049.259] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THEMES.INF") returned -1 [0049.260] lstrcmpiA (lpString1="", lpString2="THEMES.INF") returned -1 [0049.260] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0049.260] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\" [0049.260] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\") returned="" [0049.260] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\HOW TO DECRYPT FILES.txt" [0049.260] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\how to decrypt files.txt")) returned 0xffffffff [0049.260] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0049.260] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0049.260] WriteFile (in: hFile=0x8c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0049.262] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.262] CloseHandle (hObject=0x8c) returned 1 [0049.262] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="THEMES.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" [0049.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.zip") returned 0 [0049.262] lstrlenA (lpString="*.zip") returned 5 [0049.262] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.rar") returned 0 [0049.262] lstrlenA (lpString="*.rar") returned 5 [0049.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.7z") returned 0 [0049.263] lstrlenA (lpString="*.7z") returned 4 [0049.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.tar") returned 0 [0049.263] lstrlenA (lpString="*.tar") returned 5 [0049.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.gzip") returned 0 [0049.263] lstrlenA (lpString="*.gzip") returned 6 [0049.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.jpg") returned 0 [0049.263] lstrlenA (lpString="*.jpg") returned 5 [0049.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.jpeg") returned 0 [0049.263] lstrlenA (lpString="*.jpeg") returned 6 [0049.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.psd") returned 0 [0049.263] lstrlenA (lpString="*.psd") returned 5 [0049.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.gif") returned 0 [0049.263] lstrlenA (lpString="*.gif") returned 5 [0049.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.doc") returned 0 [0049.263] lstrlenA (lpString="*.doc") returned 5 [0049.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.docx") returned 0 [0049.263] lstrlenA (lpString="*.docx") returned 6 [0049.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.xls") returned 0 [0049.263] lstrlenA (lpString="*.xls") returned 5 [0049.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.xlsx") returned 0 [0049.263] lstrlenA (lpString="*.xlsx") returned 6 [0049.263] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.ppt") returned 0 [0049.263] lstrlenA (lpString="*.ppt") returned 5 [0049.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.pptx") returned 0 [0049.264] lstrlenA (lpString="*.pptx") returned 6 [0049.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.pdf") returned 0 [0049.264] lstrlenA (lpString="*.pdf") returned 5 [0049.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.mov") returned 0 [0049.264] lstrlenA (lpString="*.mov") returned 5 [0049.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.m2v") returned 0 [0049.264] lstrlenA (lpString="*.m2v") returned 5 [0049.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.3gp") returned 0 [0049.264] lstrlenA (lpString="*.3gp") returned 5 [0049.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.mpeg") returned 0 [0049.264] lstrlenA (lpString="*.mpeg") returned 6 [0049.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.mpg") returned 0 [0049.264] lstrlenA (lpString="*.mpg") returned 5 [0049.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.flv") returned 0 [0049.264] lstrlenA (lpString="*.flv") returned 5 [0049.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.avi") returned 0 [0049.264] lstrlenA (lpString="*.avi") returned 5 [0049.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.mp4") returned 0 [0049.264] lstrlenA (lpString="*.mp4") returned 5 [0049.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.wmv") returned 0 [0049.264] lstrlenA (lpString="*.wmv") returned 5 [0049.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.divx") returned 0 [0049.264] lstrlenA (lpString="*.divx") returned 6 [0049.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.mkv") returned 0 [0049.264] lstrlenA (lpString="*.mkv") returned 5 [0049.264] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.mp3") returned 0 [0049.265] lstrlenA (lpString="*.mp3") returned 5 [0049.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.wav") returned 0 [0049.265] lstrlenA (lpString="*.wav") returned 5 [0049.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.flac") returned 0 [0049.265] lstrlenA (lpString="*.flac") returned 6 [0049.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.ape") returned 0 [0049.265] lstrlenA (lpString="*.ape") returned 5 [0049.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.wma") returned 0 [0049.265] lstrlenA (lpString="*.wma") returned 5 [0049.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.ac3") returned 0 [0049.265] lstrlenA (lpString="*.ac3") returned 5 [0049.265] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", pszSpec="*.mxf") returned 0 [0049.265] lstrlenA (lpString="*.mxf") returned 5 [0049.265] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8308, cFileName="WATER", cAlternateFileName="")) returned 1 [0049.265] lstrcmpA (lpString1=".", lpString2="WATER") returned -1 [0049.265] lstrcmpA (lpString1="..", lpString2="WATER") returned -1 [0049.265] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned="THEMES.INF" [0049.265] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="WATER" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER" [0049.265] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER") returned 61 [0049.265] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d80d0, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0049.270] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.270] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.270] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.270] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.270] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0049.270] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.270] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0049.270] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0049.270] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0049.270] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*") returned="*.*" [0049.270] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\" [0049.270] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\") returned="" [0049.270] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO DECRYPT FILES.txt" [0049.270] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\how to decrypt files.txt")) returned 0xffffffff [0049.270] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.271] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0049.271] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0049.272] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.273] CloseHandle (hObject=0x90) returned 1 [0049.273] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" [0049.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0049.273] lstrlenA (lpString="*.zip") returned 5 [0049.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0049.273] lstrlenA (lpString="*.rar") returned 5 [0049.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0049.273] lstrlenA (lpString="*.7z") returned 4 [0049.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0049.273] lstrlenA (lpString="*.tar") returned 5 [0049.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0049.273] lstrlenA (lpString="*.gzip") returned 6 [0049.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0049.273] lstrlenA (lpString="*.jpg") returned 5 [0049.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0049.273] lstrlenA (lpString="*.jpeg") returned 6 [0049.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0049.273] lstrlenA (lpString="*.psd") returned 5 [0049.273] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0049.274] lstrlenA (lpString="*.gif") returned 5 [0049.274] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" [0049.274] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" [0049.274] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF." [0049.274] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.wannacry" [0049.274] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.274] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa6c [0049.274] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x389cfa00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d084c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x389cfa00, dwHighDateTime=0x1c3ee72)) returned 1 [0049.274] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0049.274] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x9ee, lpOverlapped=0x0) returned 1 [0049.277] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned="PREVIEW.GIF" [0049.277] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0049.277] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x9ee, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x9ee, lpOverlapped=0x0) returned 1 [0049.277] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0049.277] CloseHandle (hObject=0x90) returned 1 [0049.280] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.wannacry")) returned 1 [0049.282] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa5d5, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0049.282] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.282] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0049.282] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0049.283] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0049.283] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned="PREVIEW.GIF" [0049.283] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\" [0049.283] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\") returned="" [0049.283] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO DECRYPT FILES.txt" [0049.283] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\how to decrypt files.txt")) returned 0x20 [0049.283] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" [0049.283] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0049.283] lstrlenA (lpString="*.zip") returned 5 [0049.283] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0049.283] lstrlenA (lpString="*.rar") returned 5 [0049.283] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0049.283] lstrlenA (lpString="*.7z") returned 4 [0049.283] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0049.283] lstrlenA (lpString="*.tar") returned 5 [0049.283] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0049.283] lstrlenA (lpString="*.gzip") returned 6 [0049.283] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0049.283] lstrlenA (lpString="*.jpg") returned 5 [0049.283] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0049.283] lstrlenA (lpString="*.jpeg") returned 6 [0049.283] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0049.283] lstrlenA (lpString="*.psd") returned 5 [0049.283] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0049.284] lstrlenA (lpString="*.gif") returned 5 [0049.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0049.284] lstrlenA (lpString="*.doc") returned 5 [0049.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0049.284] lstrlenA (lpString="*.docx") returned 6 [0049.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0049.284] lstrlenA (lpString="*.xls") returned 5 [0049.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0049.284] lstrlenA (lpString="*.xlsx") returned 6 [0049.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0049.284] lstrlenA (lpString="*.ppt") returned 5 [0049.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0049.284] lstrlenA (lpString="*.pptx") returned 6 [0049.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0049.284] lstrlenA (lpString="*.pdf") returned 5 [0049.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0049.284] lstrlenA (lpString="*.mov") returned 5 [0049.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0049.284] lstrlenA (lpString="*.m2v") returned 5 [0049.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0049.284] lstrlenA (lpString="*.3gp") returned 5 [0049.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0049.284] lstrlenA (lpString="*.mpeg") returned 6 [0049.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0049.284] lstrlenA (lpString="*.mpg") returned 5 [0049.284] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0049.284] lstrlenA (lpString="*.flv") returned 5 [0049.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0049.285] lstrlenA (lpString="*.avi") returned 5 [0049.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0049.285] lstrlenA (lpString="*.mp4") returned 5 [0049.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0049.285] lstrlenA (lpString="*.wmv") returned 5 [0049.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0049.285] lstrlenA (lpString="*.divx") returned 6 [0049.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0049.285] lstrlenA (lpString="*.mkv") returned 5 [0049.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0049.285] lstrlenA (lpString="*.mp3") returned 5 [0049.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0049.285] lstrlenA (lpString="*.wav") returned 5 [0049.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0049.285] lstrlenA (lpString="*.flac") returned 6 [0049.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0049.285] lstrlenA (lpString="*.ape") returned 5 [0049.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0049.285] lstrlenA (lpString="*.wma") returned 5 [0049.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0049.285] lstrlenA (lpString="*.ac3") returned 5 [0049.285] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0049.285] lstrlenA (lpString="*.mxf") returned 5 [0049.285] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a17500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36a17500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101cc, dwReserved0=0x740078, dwReserved1=0x0, cFileName="WATER.ELM", cAlternateFileName="")) returned 1 [0049.285] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.285] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WATER.ELM") returned -1 [0049.285] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WATER.ELM") returned -1 [0049.286] lstrcmpiA (lpString1="", lpString2="WATER.ELM") returned -1 [0049.286] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned="THMBNAIL.PNG" [0049.286] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\" [0049.286] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\") returned="" [0049.286] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO DECRYPT FILES.txt" [0049.286] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\how to decrypt files.txt")) returned 0x20 [0049.286] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", lpString2="WATER.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" [0049.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.zip") returned 0 [0049.286] lstrlenA (lpString="*.zip") returned 5 [0049.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.rar") returned 0 [0049.286] lstrlenA (lpString="*.rar") returned 5 [0049.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.7z") returned 0 [0049.286] lstrlenA (lpString="*.7z") returned 4 [0049.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.tar") returned 0 [0049.286] lstrlenA (lpString="*.tar") returned 5 [0049.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.gzip") returned 0 [0049.286] lstrlenA (lpString="*.gzip") returned 6 [0049.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.jpg") returned 0 [0049.286] lstrlenA (lpString="*.jpg") returned 5 [0049.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.jpeg") returned 0 [0049.286] lstrlenA (lpString="*.jpeg") returned 6 [0049.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.psd") returned 0 [0049.286] lstrlenA (lpString="*.psd") returned 5 [0049.286] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.gif") returned 0 [0049.286] lstrlenA (lpString="*.gif") returned 5 [0049.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.doc") returned 0 [0049.287] lstrlenA (lpString="*.doc") returned 5 [0049.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.docx") returned 0 [0049.287] lstrlenA (lpString="*.docx") returned 6 [0049.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.xls") returned 0 [0049.287] lstrlenA (lpString="*.xls") returned 5 [0049.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.xlsx") returned 0 [0049.287] lstrlenA (lpString="*.xlsx") returned 6 [0049.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.ppt") returned 0 [0049.287] lstrlenA (lpString="*.ppt") returned 5 [0049.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.pptx") returned 0 [0049.287] lstrlenA (lpString="*.pptx") returned 6 [0049.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.pdf") returned 0 [0049.287] lstrlenA (lpString="*.pdf") returned 5 [0049.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.mov") returned 0 [0049.287] lstrlenA (lpString="*.mov") returned 5 [0049.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.m2v") returned 0 [0049.287] lstrlenA (lpString="*.m2v") returned 5 [0049.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.3gp") returned 0 [0049.287] lstrlenA (lpString="*.3gp") returned 5 [0049.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.mpeg") returned 0 [0049.287] lstrlenA (lpString="*.mpeg") returned 6 [0049.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.mpg") returned 0 [0049.287] lstrlenA (lpString="*.mpg") returned 5 [0049.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.flv") returned 0 [0049.287] lstrlenA (lpString="*.flv") returned 5 [0049.287] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.avi") returned 0 [0049.288] lstrlenA (lpString="*.avi") returned 5 [0049.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.mp4") returned 0 [0049.288] lstrlenA (lpString="*.mp4") returned 5 [0049.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.wmv") returned 0 [0049.288] lstrlenA (lpString="*.wmv") returned 5 [0049.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.divx") returned 0 [0049.288] lstrlenA (lpString="*.divx") returned 6 [0049.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.mkv") returned 0 [0049.288] lstrlenA (lpString="*.mkv") returned 5 [0049.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.mp3") returned 0 [0049.288] lstrlenA (lpString="*.mp3") returned 5 [0049.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.wav") returned 0 [0049.288] lstrlenA (lpString="*.wav") returned 5 [0049.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.flac") returned 0 [0049.288] lstrlenA (lpString="*.flac") returned 6 [0049.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.ape") returned 0 [0049.288] lstrlenA (lpString="*.ape") returned 5 [0049.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.wma") returned 0 [0049.288] lstrlenA (lpString="*.wma") returned 5 [0049.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.ac3") returned 0 [0049.288] lstrlenA (lpString="*.ac3") returned 5 [0049.288] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", pszSpec="*.mxf") returned 0 [0049.288] lstrlenA (lpString="*.mxf") returned 5 [0049.288] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x740078, dwReserved1=0x0, cFileName="WATER.INF", cAlternateFileName="")) returned 1 [0049.288] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.288] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WATER.INF") returned -1 [0049.288] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WATER.INF") returned -1 [0049.289] lstrcmpiA (lpString1="", lpString2="WATER.INF") returned -1 [0049.289] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned="WATER.ELM" [0049.289] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\" [0049.289] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\") returned="" [0049.289] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO DECRYPT FILES.txt" [0049.289] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\how to decrypt files.txt")) returned 0x20 [0049.289] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", lpString2="WATER.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" [0049.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.zip") returned 0 [0049.289] lstrlenA (lpString="*.zip") returned 5 [0049.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.rar") returned 0 [0049.289] lstrlenA (lpString="*.rar") returned 5 [0049.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.7z") returned 0 [0049.289] lstrlenA (lpString="*.7z") returned 4 [0049.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.tar") returned 0 [0049.289] lstrlenA (lpString="*.tar") returned 5 [0049.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.gzip") returned 0 [0049.289] lstrlenA (lpString="*.gzip") returned 6 [0049.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.jpg") returned 0 [0049.289] lstrlenA (lpString="*.jpg") returned 5 [0049.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.jpeg") returned 0 [0049.289] lstrlenA (lpString="*.jpeg") returned 6 [0049.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.psd") returned 0 [0049.289] lstrlenA (lpString="*.psd") returned 5 [0049.289] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.gif") returned 0 [0049.290] lstrlenA (lpString="*.gif") returned 5 [0049.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.doc") returned 0 [0049.290] lstrlenA (lpString="*.doc") returned 5 [0049.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.docx") returned 0 [0049.290] lstrlenA (lpString="*.docx") returned 6 [0049.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.xls") returned 0 [0049.290] lstrlenA (lpString="*.xls") returned 5 [0049.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.xlsx") returned 0 [0049.290] lstrlenA (lpString="*.xlsx") returned 6 [0049.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.ppt") returned 0 [0049.290] lstrlenA (lpString="*.ppt") returned 5 [0049.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.pptx") returned 0 [0049.290] lstrlenA (lpString="*.pptx") returned 6 [0049.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.pdf") returned 0 [0049.290] lstrlenA (lpString="*.pdf") returned 5 [0049.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.mov") returned 0 [0049.290] lstrlenA (lpString="*.mov") returned 5 [0049.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.m2v") returned 0 [0049.290] lstrlenA (lpString="*.m2v") returned 5 [0049.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.3gp") returned 0 [0049.290] lstrlenA (lpString="*.3gp") returned 5 [0049.290] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.mpeg") returned 0 [0049.291] lstrlenA (lpString="*.mpeg") returned 6 [0049.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.mpg") returned 0 [0049.291] lstrlenA (lpString="*.mpg") returned 5 [0049.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.flv") returned 0 [0049.291] lstrlenA (lpString="*.flv") returned 5 [0049.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.avi") returned 0 [0049.291] lstrlenA (lpString="*.avi") returned 5 [0049.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.mp4") returned 0 [0049.291] lstrlenA (lpString="*.mp4") returned 5 [0049.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.wmv") returned 0 [0049.291] lstrlenA (lpString="*.wmv") returned 5 [0049.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.divx") returned 0 [0049.291] lstrlenA (lpString="*.divx") returned 6 [0049.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.mkv") returned 0 [0049.291] lstrlenA (lpString="*.mkv") returned 5 [0049.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.mp3") returned 0 [0049.291] lstrlenA (lpString="*.mp3") returned 5 [0049.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.wav") returned 0 [0049.291] lstrlenA (lpString="*.wav") returned 5 [0049.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.flac") returned 0 [0049.291] lstrlenA (lpString="*.flac") returned 6 [0049.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.ape") returned 0 [0049.291] lstrlenA (lpString="*.ape") returned 5 [0049.291] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.wma") returned 0 [0049.292] lstrlenA (lpString="*.wma") returned 5 [0049.292] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.ac3") returned 0 [0049.292] lstrlenA (lpString="*.ac3") returned 5 [0049.292] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", pszSpec="*.mxf") returned 0 [0049.292] lstrlenA (lpString="*.mxf") returned 5 [0049.292] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x740078, dwReserved1=0x0, cFileName="WATER.INF", cAlternateFileName="")) returned 0 [0049.292] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0049.292] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0049.292] lstrcmpA (lpString1=".", lpString2="WATERMAR") returned -1 [0049.292] lstrcmpA (lpString1="..", lpString2="WATERMAR") returned -1 [0049.292] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0049.292] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", lpString2="WATERMAR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR" [0049.292] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR") returned 64 [0049.292] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740078, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d80c8 [0049.292] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.293] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.293] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.293] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.293] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x623, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0049.293] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.293] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PREVIEW.GIF") returned -1 [0049.293] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0049.293] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0049.293] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*") returned="*.*" [0049.293] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\" [0049.293] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\") returned="" [0049.293] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO DECRYPT FILES.txt" [0049.293] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\how to decrypt files.txt")) returned 0xffffffff [0049.293] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.296] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0049.296] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0049.297] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.297] CloseHandle (hObject=0x90) returned 1 [0049.297] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", lpString2="PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" [0049.297] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", pszSpec="*.zip") returned 0 [0049.297] lstrlenA (lpString="*.zip") returned 5 [0049.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", pszSpec="*.rar") returned 0 [0049.298] lstrlenA (lpString="*.rar") returned 5 [0049.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", pszSpec="*.7z") returned 0 [0049.298] lstrlenA (lpString="*.7z") returned 4 [0049.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", pszSpec="*.tar") returned 0 [0049.298] lstrlenA (lpString="*.tar") returned 5 [0049.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", pszSpec="*.gzip") returned 0 [0049.298] lstrlenA (lpString="*.gzip") returned 6 [0049.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", pszSpec="*.jpg") returned 0 [0049.298] lstrlenA (lpString="*.jpg") returned 5 [0049.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", pszSpec="*.jpeg") returned 0 [0049.298] lstrlenA (lpString="*.jpeg") returned 6 [0049.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", pszSpec="*.psd") returned 0 [0049.298] lstrlenA (lpString="*.psd") returned 5 [0049.298] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", pszSpec="*.gif") returned 1 [0049.298] lstrlenA (lpString="*.gif") returned 5 [0049.298] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" [0049.298] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" [0049.298] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF." [0049.298] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.wannacry") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.wannacry" [0049.298] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.299] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x623 [0049.299] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x389cfa00, dwHighDateTime=0x1c3ee72), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a71ef90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x389cfa00, dwHighDateTime=0x1c3ee72)) returned 1 [0049.300] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0049.300] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x5a5, lpOverlapped=0x0) returned 1 [0049.302] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned="PREVIEW.GIF" [0049.302] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0049.302] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x5a5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x5a5, lpOverlapped=0x0) returned 1 [0049.302] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0049.302] CloseHandle (hObject=0x90) returned 1 [0049.304] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.wannacry" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.wannacry")) returned 1 [0049.305] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x75da, dwReserved0=0x2000002, dwReserved1=0x2d8030, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0049.305] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.305] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THMBNAIL.PNG") returned -1 [0049.305] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0049.305] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0049.305] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned="PREVIEW.GIF" [0049.305] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\" [0049.305] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\") returned="" [0049.305] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO DECRYPT FILES.txt" [0049.305] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\how to decrypt files.txt")) returned 0x20 [0049.305] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", lpString2="THMBNAIL.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" [0049.305] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.zip") returned 0 [0049.305] lstrlenA (lpString="*.zip") returned 5 [0049.305] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.rar") returned 0 [0049.305] lstrlenA (lpString="*.rar") returned 5 [0049.305] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.7z") returned 0 [0049.305] lstrlenA (lpString="*.7z") returned 4 [0049.305] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.tar") returned 0 [0049.305] lstrlenA (lpString="*.tar") returned 5 [0049.305] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.gzip") returned 0 [0049.305] lstrlenA (lpString="*.gzip") returned 6 [0049.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.jpg") returned 0 [0049.306] lstrlenA (lpString="*.jpg") returned 5 [0049.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.jpeg") returned 0 [0049.306] lstrlenA (lpString="*.jpeg") returned 6 [0049.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.psd") returned 0 [0049.306] lstrlenA (lpString="*.psd") returned 5 [0049.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.gif") returned 0 [0049.306] lstrlenA (lpString="*.gif") returned 5 [0049.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.doc") returned 0 [0049.306] lstrlenA (lpString="*.doc") returned 5 [0049.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.docx") returned 0 [0049.306] lstrlenA (lpString="*.docx") returned 6 [0049.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.xls") returned 0 [0049.306] lstrlenA (lpString="*.xls") returned 5 [0049.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.xlsx") returned 0 [0049.306] lstrlenA (lpString="*.xlsx") returned 6 [0049.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.ppt") returned 0 [0049.306] lstrlenA (lpString="*.ppt") returned 5 [0049.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.pptx") returned 0 [0049.306] lstrlenA (lpString="*.pptx") returned 6 [0049.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.pdf") returned 0 [0049.306] lstrlenA (lpString="*.pdf") returned 5 [0049.306] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.mov") returned 0 [0049.307] lstrlenA (lpString="*.mov") returned 5 [0049.307] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.m2v") returned 0 [0049.307] lstrlenA (lpString="*.m2v") returned 5 [0049.307] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.3gp") returned 0 [0049.307] lstrlenA (lpString="*.3gp") returned 5 [0049.307] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.mpeg") returned 0 [0049.307] lstrlenA (lpString="*.mpeg") returned 6 [0049.307] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.mpg") returned 0 [0049.307] lstrlenA (lpString="*.mpg") returned 5 [0049.307] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.flv") returned 0 [0049.307] lstrlenA (lpString="*.flv") returned 5 [0049.307] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.avi") returned 0 [0049.307] lstrlenA (lpString="*.avi") returned 5 [0049.307] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.mp4") returned 0 [0049.307] lstrlenA (lpString="*.mp4") returned 5 [0049.307] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.wmv") returned 0 [0049.307] lstrlenA (lpString="*.wmv") returned 5 [0049.307] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.divx") returned 0 [0049.307] lstrlenA (lpString="*.divx") returned 6 [0049.307] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.mkv") returned 0 [0049.307] lstrlenA (lpString="*.mkv") returned 5 [0049.307] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.mp3") returned 0 [0049.307] lstrlenA (lpString="*.mp3") returned 5 [0049.307] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.wav") returned 0 [0049.307] lstrlenA (lpString="*.wav") returned 5 [0049.307] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.flac") returned 0 [0049.307] lstrlenA (lpString="*.flac") returned 6 [0049.308] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.ape") returned 0 [0049.308] lstrlenA (lpString="*.ape") returned 5 [0049.308] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.wma") returned 0 [0049.308] lstrlenA (lpString="*.wma") returned 5 [0049.308] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.ac3") returned 0 [0049.308] lstrlenA (lpString="*.ac3") returned 5 [0049.308] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", pszSpec="*.mxf") returned 0 [0049.308] lstrlenA (lpString="*.mxf") returned 5 [0049.308] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37d2a200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37d2a200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfc6, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="WATERMAR.ELM", cAlternateFileName="")) returned 1 [0049.308] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.308] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WATERMAR.ELM") returned -1 [0049.308] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WATERMAR.ELM") returned -1 [0049.308] lstrcmpiA (lpString1="", lpString2="WATERMAR.ELM") returned -1 [0049.308] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned="THMBNAIL.PNG" [0049.308] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\" [0049.308] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\") returned="" [0049.308] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO DECRYPT FILES.txt" [0049.308] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\how to decrypt files.txt")) returned 0x20 [0049.308] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", lpString2="WATERMAR.ELM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" [0049.308] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.zip") returned 0 [0049.308] lstrlenA (lpString="*.zip") returned 5 [0049.308] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.rar") returned 0 [0049.308] lstrlenA (lpString="*.rar") returned 5 [0049.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.7z") returned 0 [0049.309] lstrlenA (lpString="*.7z") returned 4 [0049.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.tar") returned 0 [0049.309] lstrlenA (lpString="*.tar") returned 5 [0049.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.gzip") returned 0 [0049.309] lstrlenA (lpString="*.gzip") returned 6 [0049.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.jpg") returned 0 [0049.309] lstrlenA (lpString="*.jpg") returned 5 [0049.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.jpeg") returned 0 [0049.309] lstrlenA (lpString="*.jpeg") returned 6 [0049.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.psd") returned 0 [0049.309] lstrlenA (lpString="*.psd") returned 5 [0049.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.gif") returned 0 [0049.309] lstrlenA (lpString="*.gif") returned 5 [0049.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.doc") returned 0 [0049.309] lstrlenA (lpString="*.doc") returned 5 [0049.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.docx") returned 0 [0049.309] lstrlenA (lpString="*.docx") returned 6 [0049.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.xls") returned 0 [0049.309] lstrlenA (lpString="*.xls") returned 5 [0049.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.xlsx") returned 0 [0049.309] lstrlenA (lpString="*.xlsx") returned 6 [0049.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.ppt") returned 0 [0049.309] lstrlenA (lpString="*.ppt") returned 5 [0049.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.pptx") returned 0 [0049.309] lstrlenA (lpString="*.pptx") returned 6 [0049.309] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.pdf") returned 0 [0049.310] lstrlenA (lpString="*.pdf") returned 5 [0049.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.mov") returned 0 [0049.310] lstrlenA (lpString="*.mov") returned 5 [0049.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.m2v") returned 0 [0049.310] lstrlenA (lpString="*.m2v") returned 5 [0049.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.3gp") returned 0 [0049.310] lstrlenA (lpString="*.3gp") returned 5 [0049.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.mpeg") returned 0 [0049.310] lstrlenA (lpString="*.mpeg") returned 6 [0049.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.mpg") returned 0 [0049.310] lstrlenA (lpString="*.mpg") returned 5 [0049.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.flv") returned 0 [0049.310] lstrlenA (lpString="*.flv") returned 5 [0049.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.avi") returned 0 [0049.310] lstrlenA (lpString="*.avi") returned 5 [0049.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.mp4") returned 0 [0049.310] lstrlenA (lpString="*.mp4") returned 5 [0049.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.wmv") returned 0 [0049.310] lstrlenA (lpString="*.wmv") returned 5 [0049.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.divx") returned 0 [0049.310] lstrlenA (lpString="*.divx") returned 6 [0049.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.mkv") returned 0 [0049.310] lstrlenA (lpString="*.mkv") returned 5 [0049.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.mp3") returned 0 [0049.310] lstrlenA (lpString="*.mp3") returned 5 [0049.310] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.wav") returned 0 [0049.310] lstrlenA (lpString="*.wav") returned 5 [0049.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.flac") returned 0 [0049.311] lstrlenA (lpString="*.flac") returned 6 [0049.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.ape") returned 0 [0049.311] lstrlenA (lpString="*.ape") returned 5 [0049.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.wma") returned 0 [0049.311] lstrlenA (lpString="*.wma") returned 5 [0049.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.ac3") returned 0 [0049.311] lstrlenA (lpString="*.ac3") returned 5 [0049.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", pszSpec="*.mxf") returned 0 [0049.311] lstrlenA (lpString="*.mxf") returned 5 [0049.311] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 1 [0049.311] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.311] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WATERMAR.INF") returned -1 [0049.311] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WATERMAR.INF") returned -1 [0049.311] lstrcmpiA (lpString1="", lpString2="WATERMAR.INF") returned -1 [0049.311] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned="WATERMAR.ELM" [0049.311] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\" [0049.311] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\") returned="" [0049.311] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO DECRYPT FILES.txt" [0049.311] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\how to decrypt files.txt")) returned 0x20 [0049.311] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", lpString2="WATERMAR.INF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" [0049.311] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.zip") returned 0 [0049.311] lstrlenA (lpString="*.zip") returned 5 [0049.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.rar") returned 0 [0049.312] lstrlenA (lpString="*.rar") returned 5 [0049.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.7z") returned 0 [0049.312] lstrlenA (lpString="*.7z") returned 4 [0049.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.tar") returned 0 [0049.312] lstrlenA (lpString="*.tar") returned 5 [0049.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.gzip") returned 0 [0049.312] lstrlenA (lpString="*.gzip") returned 6 [0049.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.jpg") returned 0 [0049.312] lstrlenA (lpString="*.jpg") returned 5 [0049.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.jpeg") returned 0 [0049.312] lstrlenA (lpString="*.jpeg") returned 6 [0049.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.psd") returned 0 [0049.312] lstrlenA (lpString="*.psd") returned 5 [0049.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.gif") returned 0 [0049.312] lstrlenA (lpString="*.gif") returned 5 [0049.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.doc") returned 0 [0049.312] lstrlenA (lpString="*.doc") returned 5 [0049.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.docx") returned 0 [0049.312] lstrlenA (lpString="*.docx") returned 6 [0049.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.xls") returned 0 [0049.312] lstrlenA (lpString="*.xls") returned 5 [0049.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.xlsx") returned 0 [0049.312] lstrlenA (lpString="*.xlsx") returned 6 [0049.312] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.ppt") returned 0 [0049.312] lstrlenA (lpString="*.ppt") returned 5 [0049.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.pptx") returned 0 [0049.313] lstrlenA (lpString="*.pptx") returned 6 [0049.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.pdf") returned 0 [0049.313] lstrlenA (lpString="*.pdf") returned 5 [0049.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.mov") returned 0 [0049.313] lstrlenA (lpString="*.mov") returned 5 [0049.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.m2v") returned 0 [0049.313] lstrlenA (lpString="*.m2v") returned 5 [0049.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.3gp") returned 0 [0049.313] lstrlenA (lpString="*.3gp") returned 5 [0049.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.mpeg") returned 0 [0049.313] lstrlenA (lpString="*.mpeg") returned 6 [0049.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.mpg") returned 0 [0049.313] lstrlenA (lpString="*.mpg") returned 5 [0049.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.flv") returned 0 [0049.313] lstrlenA (lpString="*.flv") returned 5 [0049.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.avi") returned 0 [0049.313] lstrlenA (lpString="*.avi") returned 5 [0049.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.mp4") returned 0 [0049.313] lstrlenA (lpString="*.mp4") returned 5 [0049.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.wmv") returned 0 [0049.313] lstrlenA (lpString="*.wmv") returned 5 [0049.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.divx") returned 0 [0049.313] lstrlenA (lpString="*.divx") returned 6 [0049.313] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.mkv") returned 0 [0049.313] lstrlenA (lpString="*.mkv") returned 5 [0049.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.mp3") returned 0 [0049.314] lstrlenA (lpString="*.mp3") returned 5 [0049.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.wav") returned 0 [0049.314] lstrlenA (lpString="*.wav") returned 5 [0049.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.flac") returned 0 [0049.314] lstrlenA (lpString="*.flac") returned 6 [0049.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.ape") returned 0 [0049.314] lstrlenA (lpString="*.ape") returned 5 [0049.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.wma") returned 0 [0049.314] lstrlenA (lpString="*.wma") returned 5 [0049.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.ac3") returned 0 [0049.314] lstrlenA (lpString="*.ac3") returned 5 [0049.314] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", pszSpec="*.mxf") returned 0 [0049.314] lstrlenA (lpString="*.mxf") returned 5 [0049.314] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 0 [0049.314] FindClose (in: hFindFile=0x2d80c8 | out: hFindFile=0x2d80c8) returned 1 [0049.314] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="WATERMAR", cAlternateFileName="")) returned 0 [0049.314] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0049.314] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0049.314] lstrcmpA (lpString1=".", lpString2="TRANSLAT") returned -1 [0049.314] lstrcmpA (lpString1="..", lpString2="TRANSLAT") returned -1 [0049.315] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0049.315] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="TRANSLAT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT" [0049.315] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT") returned 55 [0049.315] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0049.317] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.317] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.317] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.317] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.317] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ARFR", cAlternateFileName="")) returned 1 [0049.317] lstrcmpA (lpString1=".", lpString2="ARFR") returned -1 [0049.317] lstrcmpA (lpString1="..", lpString2="ARFR") returned -1 [0049.317] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*") returned="*.*" [0049.317] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="ARFR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR" [0049.318] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR") returned 60 [0049.318] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0049.319] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.319] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.319] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.319] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.319] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 1 [0049.319] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.319] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSB1ARFR.ITS") returned -1 [0049.319] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1ARFR.ITS") returned -1 [0049.319] lstrcmpiA (lpString1="", lpString2="MSB1ARFR.ITS") returned -1 [0049.319] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*.*") returned="*.*" [0049.319] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\" [0049.319] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\") returned="" [0049.319] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\HOW TO DECRYPT FILES.txt" [0049.319] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\how to decrypt files.txt")) returned 0xffffffff [0049.319] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.320] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0049.320] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0049.321] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.321] CloseHandle (hObject=0x90) returned 1 [0049.321] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", lpString2="MSB1ARFR.ITS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" [0049.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.zip") returned 0 [0049.321] lstrlenA (lpString="*.zip") returned 5 [0049.321] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.rar") returned 0 [0049.321] lstrlenA (lpString="*.rar") returned 5 [0049.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.7z") returned 0 [0049.322] lstrlenA (lpString="*.7z") returned 4 [0049.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.tar") returned 0 [0049.322] lstrlenA (lpString="*.tar") returned 5 [0049.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.gzip") returned 0 [0049.322] lstrlenA (lpString="*.gzip") returned 6 [0049.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.jpg") returned 0 [0049.322] lstrlenA (lpString="*.jpg") returned 5 [0049.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.jpeg") returned 0 [0049.322] lstrlenA (lpString="*.jpeg") returned 6 [0049.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.psd") returned 0 [0049.322] lstrlenA (lpString="*.psd") returned 5 [0049.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.gif") returned 0 [0049.322] lstrlenA (lpString="*.gif") returned 5 [0049.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.doc") returned 0 [0049.322] lstrlenA (lpString="*.doc") returned 5 [0049.322] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.docx") returned 0 [0049.322] lstrlenA (lpString="*.docx") returned 6 [0049.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.xls") returned 0 [0049.323] lstrlenA (lpString="*.xls") returned 5 [0049.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.xlsx") returned 0 [0049.323] lstrlenA (lpString="*.xlsx") returned 6 [0049.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.ppt") returned 0 [0049.323] lstrlenA (lpString="*.ppt") returned 5 [0049.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.pptx") returned 0 [0049.323] lstrlenA (lpString="*.pptx") returned 6 [0049.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.pdf") returned 0 [0049.323] lstrlenA (lpString="*.pdf") returned 5 [0049.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.mov") returned 0 [0049.323] lstrlenA (lpString="*.mov") returned 5 [0049.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.m2v") returned 0 [0049.323] lstrlenA (lpString="*.m2v") returned 5 [0049.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.3gp") returned 0 [0049.323] lstrlenA (lpString="*.3gp") returned 5 [0049.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.mpeg") returned 0 [0049.323] lstrlenA (lpString="*.mpeg") returned 6 [0049.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.mpg") returned 0 [0049.323] lstrlenA (lpString="*.mpg") returned 5 [0049.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.flv") returned 0 [0049.323] lstrlenA (lpString="*.flv") returned 5 [0049.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.avi") returned 0 [0049.323] lstrlenA (lpString="*.avi") returned 5 [0049.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.mp4") returned 0 [0049.323] lstrlenA (lpString="*.mp4") returned 5 [0049.323] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.wmv") returned 0 [0049.324] lstrlenA (lpString="*.wmv") returned 5 [0049.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.divx") returned 0 [0049.324] lstrlenA (lpString="*.divx") returned 6 [0049.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.mkv") returned 0 [0049.324] lstrlenA (lpString="*.mkv") returned 5 [0049.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.mp3") returned 0 [0049.324] lstrlenA (lpString="*.mp3") returned 5 [0049.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.wav") returned 0 [0049.324] lstrlenA (lpString="*.wav") returned 5 [0049.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.flac") returned 0 [0049.324] lstrlenA (lpString="*.flac") returned 6 [0049.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.ape") returned 0 [0049.324] lstrlenA (lpString="*.ape") returned 5 [0049.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.wma") returned 0 [0049.324] lstrlenA (lpString="*.wma") returned 5 [0049.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.ac3") returned 0 [0049.324] lstrlenA (lpString="*.ac3") returned 5 [0049.324] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", pszSpec="*.mxf") returned 0 [0049.324] lstrlenA (lpString="*.mxf") returned 5 [0049.324] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 0 [0049.324] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0049.325] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ENES", cAlternateFileName="")) returned 1 [0049.325] lstrcmpA (lpString1=".", lpString2="ENES") returned -1 [0049.325] lstrcmpA (lpString1="..", lpString2="ENES") returned -1 [0049.325] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*") returned="*.*" [0049.325] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="ENES" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES" [0049.325] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES") returned 60 [0049.325] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d83e0, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0049.326] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.326] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.326] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.326] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.326] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 1 [0049.326] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.326] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSB1ENES.ITS") returned -1 [0049.326] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1ENES.ITS") returned -1 [0049.326] lstrcmpiA (lpString1="", lpString2="MSB1ENES.ITS") returned -1 [0049.326] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*") returned="*.*" [0049.326] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\" [0049.326] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\") returned="" [0049.326] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\HOW TO DECRYPT FILES.txt" [0049.326] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\how to decrypt files.txt")) returned 0xffffffff [0049.327] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.327] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0049.327] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0049.329] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.329] CloseHandle (hObject=0x90) returned 1 [0049.329] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", lpString2="MSB1ENES.ITS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" [0049.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.zip") returned 0 [0049.329] lstrlenA (lpString="*.zip") returned 5 [0049.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.rar") returned 0 [0049.329] lstrlenA (lpString="*.rar") returned 5 [0049.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.7z") returned 0 [0049.329] lstrlenA (lpString="*.7z") returned 4 [0049.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.tar") returned 0 [0049.329] lstrlenA (lpString="*.tar") returned 5 [0049.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.gzip") returned 0 [0049.329] lstrlenA (lpString="*.gzip") returned 6 [0049.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.jpg") returned 0 [0049.329] lstrlenA (lpString="*.jpg") returned 5 [0049.329] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.jpeg") returned 0 [0049.330] lstrlenA (lpString="*.jpeg") returned 6 [0049.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.psd") returned 0 [0049.330] lstrlenA (lpString="*.psd") returned 5 [0049.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.gif") returned 0 [0049.330] lstrlenA (lpString="*.gif") returned 5 [0049.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.doc") returned 0 [0049.330] lstrlenA (lpString="*.doc") returned 5 [0049.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.docx") returned 0 [0049.330] lstrlenA (lpString="*.docx") returned 6 [0049.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.xls") returned 0 [0049.330] lstrlenA (lpString="*.xls") returned 5 [0049.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.xlsx") returned 0 [0049.330] lstrlenA (lpString="*.xlsx") returned 6 [0049.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.ppt") returned 0 [0049.330] lstrlenA (lpString="*.ppt") returned 5 [0049.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.pptx") returned 0 [0049.330] lstrlenA (lpString="*.pptx") returned 6 [0049.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.pdf") returned 0 [0049.330] lstrlenA (lpString="*.pdf") returned 5 [0049.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.mov") returned 0 [0049.330] lstrlenA (lpString="*.mov") returned 5 [0049.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.m2v") returned 0 [0049.330] lstrlenA (lpString="*.m2v") returned 5 [0049.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.3gp") returned 0 [0049.330] lstrlenA (lpString="*.3gp") returned 5 [0049.330] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.mpeg") returned 0 [0049.330] lstrlenA (lpString="*.mpeg") returned 6 [0049.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.mpg") returned 0 [0049.331] lstrlenA (lpString="*.mpg") returned 5 [0049.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.flv") returned 0 [0049.331] lstrlenA (lpString="*.flv") returned 5 [0049.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.avi") returned 0 [0049.331] lstrlenA (lpString="*.avi") returned 5 [0049.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.mp4") returned 0 [0049.331] lstrlenA (lpString="*.mp4") returned 5 [0049.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.wmv") returned 0 [0049.331] lstrlenA (lpString="*.wmv") returned 5 [0049.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.divx") returned 0 [0049.331] lstrlenA (lpString="*.divx") returned 6 [0049.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.mkv") returned 0 [0049.331] lstrlenA (lpString="*.mkv") returned 5 [0049.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.mp3") returned 0 [0049.331] lstrlenA (lpString="*.mp3") returned 5 [0049.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.wav") returned 0 [0049.331] lstrlenA (lpString="*.wav") returned 5 [0049.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.flac") returned 0 [0049.331] lstrlenA (lpString="*.flac") returned 6 [0049.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.ape") returned 0 [0049.331] lstrlenA (lpString="*.ape") returned 5 [0049.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.wma") returned 0 [0049.331] lstrlenA (lpString="*.wma") returned 5 [0049.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.ac3") returned 0 [0049.331] lstrlenA (lpString="*.ac3") returned 5 [0049.331] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", pszSpec="*.mxf") returned 0 [0049.332] lstrlenA (lpString="*.mxf") returned 5 [0049.332] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 0 [0049.332] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0049.332] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ENFR", cAlternateFileName="")) returned 1 [0049.332] lstrcmpA (lpString1=".", lpString2="ENFR") returned -1 [0049.332] lstrcmpA (lpString1="..", lpString2="ENFR") returned -1 [0049.332] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*") returned="*.*" [0049.332] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="ENFR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR" [0049.332] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR") returned 60 [0049.332] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d83e0, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0049.332] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.332] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.332] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.332] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.332] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 1 [0049.333] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.333] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSB1ENFR.ITS") returned -1 [0049.333] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1ENFR.ITS") returned -1 [0049.333] lstrcmpiA (lpString1="", lpString2="MSB1ENFR.ITS") returned -1 [0049.333] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*") returned="*.*" [0049.333] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\" [0049.333] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\") returned="" [0049.333] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\HOW TO DECRYPT FILES.txt" [0049.333] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\how to decrypt files.txt")) returned 0xffffffff [0049.333] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.333] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0049.333] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0049.335] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.335] CloseHandle (hObject=0x90) returned 1 [0049.335] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", lpString2="MSB1ENFR.ITS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" [0049.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.zip") returned 0 [0049.335] lstrlenA (lpString="*.zip") returned 5 [0049.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.rar") returned 0 [0049.335] lstrlenA (lpString="*.rar") returned 5 [0049.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.7z") returned 0 [0049.335] lstrlenA (lpString="*.7z") returned 4 [0049.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.tar") returned 0 [0049.335] lstrlenA (lpString="*.tar") returned 5 [0049.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.gzip") returned 0 [0049.335] lstrlenA (lpString="*.gzip") returned 6 [0049.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.jpg") returned 0 [0049.335] lstrlenA (lpString="*.jpg") returned 5 [0049.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.jpeg") returned 0 [0049.335] lstrlenA (lpString="*.jpeg") returned 6 [0049.335] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.psd") returned 0 [0049.335] lstrlenA (lpString="*.psd") returned 5 [0049.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.gif") returned 0 [0049.336] lstrlenA (lpString="*.gif") returned 5 [0049.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.doc") returned 0 [0049.336] lstrlenA (lpString="*.doc") returned 5 [0049.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.docx") returned 0 [0049.336] lstrlenA (lpString="*.docx") returned 6 [0049.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.xls") returned 0 [0049.336] lstrlenA (lpString="*.xls") returned 5 [0049.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.xlsx") returned 0 [0049.336] lstrlenA (lpString="*.xlsx") returned 6 [0049.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.ppt") returned 0 [0049.336] lstrlenA (lpString="*.ppt") returned 5 [0049.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.pptx") returned 0 [0049.336] lstrlenA (lpString="*.pptx") returned 6 [0049.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.pdf") returned 0 [0049.336] lstrlenA (lpString="*.pdf") returned 5 [0049.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.mov") returned 0 [0049.336] lstrlenA (lpString="*.mov") returned 5 [0049.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.m2v") returned 0 [0049.336] lstrlenA (lpString="*.m2v") returned 5 [0049.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.3gp") returned 0 [0049.336] lstrlenA (lpString="*.3gp") returned 5 [0049.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.mpeg") returned 0 [0049.336] lstrlenA (lpString="*.mpeg") returned 6 [0049.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.mpg") returned 0 [0049.336] lstrlenA (lpString="*.mpg") returned 5 [0049.336] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.flv") returned 0 [0049.336] lstrlenA (lpString="*.flv") returned 5 [0049.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.avi") returned 0 [0049.337] lstrlenA (lpString="*.avi") returned 5 [0049.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.mp4") returned 0 [0049.337] lstrlenA (lpString="*.mp4") returned 5 [0049.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.wmv") returned 0 [0049.337] lstrlenA (lpString="*.wmv") returned 5 [0049.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.divx") returned 0 [0049.337] lstrlenA (lpString="*.divx") returned 6 [0049.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.mkv") returned 0 [0049.337] lstrlenA (lpString="*.mkv") returned 5 [0049.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.mp3") returned 0 [0049.337] lstrlenA (lpString="*.mp3") returned 5 [0049.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.wav") returned 0 [0049.337] lstrlenA (lpString="*.wav") returned 5 [0049.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.flac") returned 0 [0049.337] lstrlenA (lpString="*.flac") returned 6 [0049.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.ape") returned 0 [0049.337] lstrlenA (lpString="*.ape") returned 5 [0049.337] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.wma") returned 0 [0049.337] lstrlenA (lpString="*.wma") returned 5 [0049.338] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.ac3") returned 0 [0049.338] lstrlenA (lpString="*.ac3") returned 5 [0049.338] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", pszSpec="*.mxf") returned 0 [0049.338] lstrlenA (lpString="*.mxf") returned 5 [0049.338] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 0 [0049.338] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0049.338] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ESEN", cAlternateFileName="")) returned 1 [0049.338] lstrcmpA (lpString1=".", lpString2="ESEN") returned -1 [0049.338] lstrcmpA (lpString1="..", lpString2="ESEN") returned -1 [0049.338] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*") returned="*.*" [0049.338] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="ESEN" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN" [0049.338] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN") returned 60 [0049.338] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d83e0, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0049.338] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.339] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.339] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.339] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.339] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9890c900, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x54a7f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9890c900, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSB1ESEN.DLL", cAlternateFileName="")) returned 1 [0049.339] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.339] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSB1ESEN.DLL") returned -1 [0049.339] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1ESEN.DLL") returned -1 [0049.339] lstrcmpiA (lpString1="", lpString2="MSB1ESEN.DLL") returned -1 [0049.339] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*") returned="*.*" [0049.339] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\" [0049.339] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\") returned="" [0049.339] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt" [0049.339] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\how to decrypt files.txt")) returned 0xffffffff [0049.339] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.340] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0049.340] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0049.341] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.341] CloseHandle (hObject=0x90) returned 1 [0049.341] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", lpString2="MSB1ESEN.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" [0049.341] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.zip") returned 0 [0049.341] lstrlenA (lpString="*.zip") returned 5 [0049.341] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.rar") returned 0 [0049.342] lstrlenA (lpString="*.rar") returned 5 [0049.342] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.7z") returned 0 [0049.342] lstrlenA (lpString="*.7z") returned 4 [0049.342] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.tar") returned 0 [0049.342] lstrlenA (lpString="*.tar") returned 5 [0049.342] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.gzip") returned 0 [0049.342] lstrlenA (lpString="*.gzip") returned 6 [0049.342] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.jpg") returned 0 [0049.342] lstrlenA (lpString="*.jpg") returned 5 [0049.342] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.jpeg") returned 0 [0049.342] lstrlenA (lpString="*.jpeg") returned 6 [0049.342] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.psd") returned 0 [0049.342] lstrlenA (lpString="*.psd") returned 5 [0049.342] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.gif") returned 0 [0049.342] lstrlenA (lpString="*.gif") returned 5 [0049.342] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.doc") returned 0 [0049.342] lstrlenA (lpString="*.doc") returned 5 [0049.342] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.docx") returned 0 [0049.342] lstrlenA (lpString="*.docx") returned 6 [0049.342] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.xls") returned 0 [0049.342] lstrlenA (lpString="*.xls") returned 5 [0049.342] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.xlsx") returned 0 [0049.342] lstrlenA (lpString="*.xlsx") returned 6 [0049.342] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.ppt") returned 0 [0049.342] lstrlenA (lpString="*.ppt") returned 5 [0049.342] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.pptx") returned 0 [0049.342] lstrlenA (lpString="*.pptx") returned 6 [0049.343] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.pdf") returned 0 [0049.343] lstrlenA (lpString="*.pdf") returned 5 [0049.343] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.mov") returned 0 [0049.343] lstrlenA (lpString="*.mov") returned 5 [0049.343] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.m2v") returned 0 [0049.343] lstrlenA (lpString="*.m2v") returned 5 [0049.343] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.3gp") returned 0 [0049.343] lstrlenA (lpString="*.3gp") returned 5 [0049.343] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.mpeg") returned 0 [0049.343] lstrlenA (lpString="*.mpeg") returned 6 [0049.343] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.mpg") returned 0 [0049.343] lstrlenA (lpString="*.mpg") returned 5 [0049.343] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.flv") returned 0 [0049.343] lstrlenA (lpString="*.flv") returned 5 [0049.343] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.avi") returned 0 [0049.343] lstrlenA (lpString="*.avi") returned 5 [0049.343] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.mp4") returned 0 [0049.343] lstrlenA (lpString="*.mp4") returned 5 [0049.343] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.wmv") returned 0 [0049.343] lstrlenA (lpString="*.wmv") returned 5 [0049.343] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.divx") returned 0 [0049.343] lstrlenA (lpString="*.divx") returned 6 [0049.343] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.mkv") returned 0 [0049.343] lstrlenA (lpString="*.mkv") returned 5 [0049.343] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.mp3") returned 0 [0049.344] lstrlenA (lpString="*.mp3") returned 5 [0049.344] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.wav") returned 0 [0049.344] lstrlenA (lpString="*.wav") returned 5 [0049.344] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.flac") returned 0 [0049.344] lstrlenA (lpString="*.flac") returned 6 [0049.344] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.ape") returned 0 [0049.344] lstrlenA (lpString="*.ape") returned 5 [0049.344] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.wma") returned 0 [0049.344] lstrlenA (lpString="*.wma") returned 5 [0049.344] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.ac3") returned 0 [0049.344] lstrlenA (lpString="*.ac3") returned 5 [0049.344] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", pszSpec="*.mxf") returned 0 [0049.344] lstrlenA (lpString="*.mxf") returned 5 [0049.344] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22595900, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22595900, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xff7f2, dwReserved0=0x0, dwReserved1=0x2d83e0, cFileName="MSB1ESEN.ITS", cAlternateFileName="")) returned 1 [0049.344] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.344] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSB1ESEN.ITS") returned -1 [0049.344] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1ESEN.ITS") returned -1 [0049.344] lstrcmpiA (lpString1="", lpString2="MSB1ESEN.ITS") returned -1 [0049.344] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned="MSB1ESEN.DLL" [0049.344] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\" [0049.344] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\") returned="" [0049.344] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt" [0049.344] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\how to decrypt files.txt")) returned 0x20 [0049.344] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", lpString2="MSB1ESEN.ITS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" [0049.345] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.zip") returned 0 [0049.345] lstrlenA (lpString="*.zip") returned 5 [0049.345] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.rar") returned 0 [0049.345] lstrlenA (lpString="*.rar") returned 5 [0049.345] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.7z") returned 0 [0049.345] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.tar") returned 0 [0049.345] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.gzip") returned 0 [0049.345] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.jpg") returned 0 [0049.345] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.jpeg") returned 0 [0049.345] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.psd") returned 0 [0049.345] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.gif") returned 0 [0049.345] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.doc") returned 0 [0049.345] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.docx") returned 0 [0049.345] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.xls") returned 0 [0049.345] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.xlsx") returned 0 [0049.345] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.ppt") returned 0 [0049.345] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.pptx") returned 0 [0049.345] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.pdf") returned 0 [0049.345] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.mov") returned 0 [0049.346] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.m2v") returned 0 [0049.346] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.3gp") returned 0 [0049.346] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.mpeg") returned 0 [0049.346] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.mpg") returned 0 [0049.346] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.flv") returned 0 [0049.346] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.avi") returned 0 [0049.346] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.mp4") returned 0 [0049.346] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.wmv") returned 0 [0049.346] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.divx") returned 0 [0049.346] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.mkv") returned 0 [0049.346] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.mp3") returned 0 [0049.346] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.wav") returned 0 [0049.346] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.flac") returned 0 [0049.346] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.ape") returned 0 [0049.346] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.wma") returned 0 [0049.346] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.ac3") returned 0 [0049.346] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", pszSpec="*.mxf") returned 0 [0049.346] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 1 [0049.347] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.347] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WT61ES.LEX") returned -1 [0049.347] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WT61ES.LEX") returned -1 [0049.347] lstrcmpiA (lpString1="", lpString2="WT61ES.LEX") returned -1 [0049.347] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned="MSB1ESEN.ITS" [0049.347] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\" [0049.347] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\") returned="" [0049.347] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt" [0049.347] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\how to decrypt files.txt")) returned 0x20 [0049.347] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", lpString2="WT61ES.LEX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" [0049.347] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.zip") returned 0 [0049.347] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.rar") returned 0 [0049.347] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.7z") returned 0 [0049.347] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.tar") returned 0 [0049.347] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.gzip") returned 0 [0049.347] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.jpg") returned 0 [0049.347] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.jpeg") returned 0 [0049.347] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.psd") returned 0 [0049.347] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.gif") returned 0 [0049.347] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.doc") returned 0 [0049.348] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.docx") returned 0 [0049.348] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.xls") returned 0 [0049.348] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.xlsx") returned 0 [0049.348] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.ppt") returned 0 [0049.348] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.pptx") returned 0 [0049.348] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.pdf") returned 0 [0049.348] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.mov") returned 0 [0049.348] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.m2v") returned 0 [0049.348] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.3gp") returned 0 [0049.348] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.mpeg") returned 0 [0049.348] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.mpg") returned 0 [0049.348] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.flv") returned 0 [0049.348] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.avi") returned 0 [0049.348] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.mp4") returned 0 [0049.348] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.wmv") returned 0 [0049.348] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.divx") returned 0 [0049.348] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.mkv") returned 0 [0049.348] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.mp3") returned 0 [0049.349] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.wav") returned 0 [0049.349] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.flac") returned 0 [0049.349] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.ape") returned 0 [0049.349] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.wma") returned 0 [0049.349] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.ac3") returned 0 [0049.349] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", pszSpec="*.mxf") returned 0 [0049.349] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 0 [0049.349] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0049.349] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="FRAR", cAlternateFileName="")) returned 1 [0049.349] lstrcmpA (lpString1=".", lpString2="FRAR") returned -1 [0049.349] lstrcmpA (lpString1="..", lpString2="FRAR") returned -1 [0049.349] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*") returned="*.*" [0049.349] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="FRAR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR" [0049.349] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0049.351] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.351] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.351] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.351] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.351] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 1 [0049.351] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.351] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSB1FRAR.ITS") returned -1 [0049.351] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1FRAR.ITS") returned -1 [0049.351] lstrcmpiA (lpString1="", lpString2="MSB1FRAR.ITS") returned -1 [0049.351] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*") returned="*.*" [0049.351] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\" [0049.351] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\") returned="" [0049.351] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\HOW TO DECRYPT FILES.txt" [0049.351] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\how to decrypt files.txt")) returned 0xffffffff [0049.351] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.352] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0049.353] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.353] CloseHandle (hObject=0x90) returned 1 [0049.353] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", lpString2="MSB1FRAR.ITS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" [0049.353] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.zip") returned 0 [0049.353] lstrlenA (lpString="*.zip") returned 5 [0049.353] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.rar") returned 0 [0049.353] lstrlenA (lpString="*.rar") returned 5 [0049.353] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.7z") returned 0 [0049.353] lstrlenA (lpString="*.7z") returned 4 [0049.354] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.tar") returned 0 [0049.354] lstrlenA (lpString="*.tar") returned 5 [0049.354] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.gzip") returned 0 [0049.354] lstrlenA (lpString="*.gzip") returned 6 [0049.354] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.jpg") returned 0 [0049.354] lstrlenA (lpString="*.jpg") returned 5 [0049.354] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.jpeg") returned 0 [0049.354] lstrlenA (lpString="*.jpeg") returned 6 [0049.354] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.psd") returned 0 [0049.354] lstrlenA (lpString="*.psd") returned 5 [0049.354] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.gif") returned 0 [0049.354] lstrlenA (lpString="*.gif") returned 5 [0049.354] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.doc") returned 0 [0049.354] lstrlenA (lpString="*.doc") returned 5 [0049.354] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.docx") returned 0 [0049.354] lstrlenA (lpString="*.docx") returned 6 [0049.354] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.xls") returned 0 [0049.354] lstrlenA (lpString="*.xls") returned 5 [0049.354] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.xlsx") returned 0 [0049.354] lstrlenA (lpString="*.xlsx") returned 6 [0049.354] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.ppt") returned 0 [0049.354] lstrlenA (lpString="*.ppt") returned 5 [0049.354] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.pptx") returned 0 [0049.354] lstrlenA (lpString="*.pptx") returned 6 [0049.354] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.pdf") returned 0 [0049.354] lstrlenA (lpString="*.pdf") returned 5 [0049.354] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.mov") returned 0 [0049.355] lstrlenA (lpString="*.mov") returned 5 [0049.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.m2v") returned 0 [0049.355] lstrlenA (lpString="*.m2v") returned 5 [0049.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.3gp") returned 0 [0049.355] lstrlenA (lpString="*.3gp") returned 5 [0049.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.mpeg") returned 0 [0049.355] lstrlenA (lpString="*.mpeg") returned 6 [0049.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.mpg") returned 0 [0049.355] lstrlenA (lpString="*.mpg") returned 5 [0049.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.flv") returned 0 [0049.355] lstrlenA (lpString="*.flv") returned 5 [0049.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.avi") returned 0 [0049.355] lstrlenA (lpString="*.avi") returned 5 [0049.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.mp4") returned 0 [0049.355] lstrlenA (lpString="*.mp4") returned 5 [0049.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.wmv") returned 0 [0049.355] lstrlenA (lpString="*.wmv") returned 5 [0049.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.divx") returned 0 [0049.355] lstrlenA (lpString="*.divx") returned 6 [0049.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.mkv") returned 0 [0049.355] lstrlenA (lpString="*.mkv") returned 5 [0049.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.mp3") returned 0 [0049.355] lstrlenA (lpString="*.mp3") returned 5 [0049.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.wav") returned 0 [0049.355] lstrlenA (lpString="*.wav") returned 5 [0049.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.flac") returned 0 [0049.355] lstrlenA (lpString="*.flac") returned 6 [0049.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.ape") returned 0 [0049.355] lstrlenA (lpString="*.ape") returned 5 [0049.355] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.wma") returned 0 [0049.356] lstrlenA (lpString="*.wma") returned 5 [0049.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.ac3") returned 0 [0049.356] lstrlenA (lpString="*.ac3") returned 5 [0049.356] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", pszSpec="*.mxf") returned 0 [0049.356] lstrlenA (lpString="*.mxf") returned 5 [0049.356] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 0 [0049.356] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0049.356] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="FREN", cAlternateFileName="")) returned 1 [0049.356] lstrcmpA (lpString1=".", lpString2="FREN") returned -1 [0049.356] lstrcmpA (lpString1="..", lpString2="FREN") returned -1 [0049.356] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*") returned="*.*" [0049.356] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="FREN" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN" [0049.356] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN") returned 60 [0049.356] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d83e0, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0049.358] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.358] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.358] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.358] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.358] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb22e200, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb22e200, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSB1FREN.DLL", cAlternateFileName="")) returned 1 [0049.358] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.358] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSB1FREN.DLL") returned -1 [0049.358] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1FREN.DLL") returned -1 [0049.358] lstrcmpiA (lpString1="", lpString2="MSB1FREN.DLL") returned -1 [0049.358] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*") returned="*.*" [0049.358] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\" [0049.358] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\") returned="" [0049.358] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt" [0049.358] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\how to decrypt files.txt")) returned 0xffffffff [0049.359] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.359] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0049.359] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0049.360] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.360] CloseHandle (hObject=0x90) returned 1 [0049.360] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", lpString2="MSB1FREN.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL" [0049.360] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.zip") returned 0 [0049.360] lstrlenA (lpString="*.zip") returned 5 [0049.360] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.rar") returned 0 [0049.360] lstrlenA (lpString="*.rar") returned 5 [0049.360] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.7z") returned 0 [0049.360] lstrlenA (lpString="*.7z") returned 4 [0049.360] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.tar") returned 0 [0049.360] lstrlenA (lpString="*.tar") returned 5 [0049.360] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.gzip") returned 0 [0049.360] lstrlenA (lpString="*.gzip") returned 6 [0049.360] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.jpg") returned 0 [0049.361] lstrlenA (lpString="*.jpg") returned 5 [0049.361] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.jpeg") returned 0 [0049.361] lstrlenA (lpString="*.jpeg") returned 6 [0049.361] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.psd") returned 0 [0049.361] lstrlenA (lpString="*.psd") returned 5 [0049.361] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.gif") returned 0 [0049.361] lstrlenA (lpString="*.gif") returned 5 [0049.361] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.doc") returned 0 [0049.361] lstrlenA (lpString="*.doc") returned 5 [0049.361] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.docx") returned 0 [0049.361] lstrlenA (lpString="*.docx") returned 6 [0049.361] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.xls") returned 0 [0049.361] lstrlenA (lpString="*.xls") returned 5 [0049.361] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.xlsx") returned 0 [0049.361] lstrlenA (lpString="*.xlsx") returned 6 [0049.361] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.ppt") returned 0 [0049.361] lstrlenA (lpString="*.ppt") returned 5 [0049.361] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.pptx") returned 0 [0049.361] lstrlenA (lpString="*.pptx") returned 6 [0049.361] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.pdf") returned 0 [0049.361] lstrlenA (lpString="*.pdf") returned 5 [0049.361] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.mov") returned 0 [0049.361] lstrlenA (lpString="*.mov") returned 5 [0049.361] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.m2v") returned 0 [0049.361] lstrlenA (lpString="*.m2v") returned 5 [0049.361] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.3gp") returned 0 [0049.361] lstrlenA (lpString="*.3gp") returned 5 [0049.361] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.mpeg") returned 0 [0049.361] lstrlenA (lpString="*.mpeg") returned 6 [0049.361] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.mpg") returned 0 [0049.361] lstrlenA (lpString="*.mpg") returned 5 [0049.361] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.flv") returned 0 [0049.362] lstrlenA (lpString="*.flv") returned 5 [0049.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.avi") returned 0 [0049.362] lstrlenA (lpString="*.avi") returned 5 [0049.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.mp4") returned 0 [0049.362] lstrlenA (lpString="*.mp4") returned 5 [0049.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.wmv") returned 0 [0049.362] lstrlenA (lpString="*.wmv") returned 5 [0049.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.divx") returned 0 [0049.362] lstrlenA (lpString="*.divx") returned 6 [0049.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.mkv") returned 0 [0049.362] lstrlenA (lpString="*.mkv") returned 5 [0049.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.mp3") returned 0 [0049.362] lstrlenA (lpString="*.mp3") returned 5 [0049.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.wav") returned 0 [0049.362] lstrlenA (lpString="*.wav") returned 5 [0049.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.flac") returned 0 [0049.362] lstrlenA (lpString="*.flac") returned 6 [0049.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.ape") returned 0 [0049.362] lstrlenA (lpString="*.ape") returned 5 [0049.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.wma") returned 0 [0049.362] lstrlenA (lpString="*.wma") returned 5 [0049.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.ac3") returned 0 [0049.362] lstrlenA (lpString="*.ac3") returned 5 [0049.362] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", pszSpec="*.mxf") returned 0 [0049.362] lstrlenA (lpString="*.mxf") returned 5 [0049.362] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x238a8600, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x238a8600, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xcd2ac, dwReserved0=0x0, dwReserved1=0x2d83e0, cFileName="MSB1FREN.ITS", cAlternateFileName="")) returned 1 [0049.362] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.362] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSB1FREN.ITS") returned -1 [0049.362] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1FREN.ITS") returned -1 [0049.362] lstrcmpiA (lpString1="", lpString2="MSB1FREN.ITS") returned -1 [0049.362] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned="MSB1FREN.DLL" [0049.362] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\" [0049.362] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\") returned="" [0049.363] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt" [0049.363] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\how to decrypt files.txt")) returned 0x20 [0049.363] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", lpString2="MSB1FREN.ITS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" [0049.363] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.zip") returned 0 [0049.363] lstrlenA (lpString="*.zip") returned 5 [0049.363] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.rar") returned 0 [0049.363] lstrlenA (lpString="*.rar") returned 5 [0049.363] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.7z") returned 0 [0049.363] lstrlenA (lpString="*.7z") returned 4 [0049.363] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.tar") returned 0 [0049.363] lstrlenA (lpString="*.tar") returned 5 [0049.363] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.gzip") returned 0 [0049.363] lstrlenA (lpString="*.gzip") returned 6 [0049.363] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.jpg") returned 0 [0049.363] lstrlenA (lpString="*.jpg") returned 5 [0049.363] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.jpeg") returned 0 [0049.363] lstrlenA (lpString="*.jpeg") returned 6 [0049.363] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.psd") returned 0 [0049.363] lstrlenA (lpString="*.psd") returned 5 [0049.363] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.gif") returned 0 [0049.363] lstrlenA (lpString="*.gif") returned 5 [0049.363] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.doc") returned 0 [0049.363] lstrlenA (lpString="*.doc") returned 5 [0049.363] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.docx") returned 0 [0049.363] lstrlenA (lpString="*.docx") returned 6 [0049.363] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.xls") returned 0 [0049.363] lstrlenA (lpString="*.xls") returned 5 [0049.363] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.xlsx") returned 0 [0049.363] lstrlenA (lpString="*.xlsx") returned 6 [0049.363] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.ppt") returned 0 [0049.363] lstrlenA (lpString="*.ppt") returned 5 [0049.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.pptx") returned 0 [0049.364] lstrlenA (lpString="*.pptx") returned 6 [0049.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.pdf") returned 0 [0049.364] lstrlenA (lpString="*.pdf") returned 5 [0049.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.mov") returned 0 [0049.364] lstrlenA (lpString="*.mov") returned 5 [0049.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.m2v") returned 0 [0049.364] lstrlenA (lpString="*.m2v") returned 5 [0049.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.3gp") returned 0 [0049.364] lstrlenA (lpString="*.3gp") returned 5 [0049.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.mpeg") returned 0 [0049.364] lstrlenA (lpString="*.mpeg") returned 6 [0049.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.mpg") returned 0 [0049.364] lstrlenA (lpString="*.mpg") returned 5 [0049.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.flv") returned 0 [0049.364] lstrlenA (lpString="*.flv") returned 5 [0049.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.avi") returned 0 [0049.364] lstrlenA (lpString="*.avi") returned 5 [0049.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.mp4") returned 0 [0049.364] lstrlenA (lpString="*.mp4") returned 5 [0049.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.wmv") returned 0 [0049.364] lstrlenA (lpString="*.wmv") returned 5 [0049.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.divx") returned 0 [0049.364] lstrlenA (lpString="*.divx") returned 6 [0049.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.mkv") returned 0 [0049.364] lstrlenA (lpString="*.mkv") returned 5 [0049.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.mp3") returned 0 [0049.364] lstrlenA (lpString="*.mp3") returned 5 [0049.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.wav") returned 0 [0049.364] lstrlenA (lpString="*.wav") returned 5 [0049.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.flac") returned 0 [0049.364] lstrlenA (lpString="*.flac") returned 6 [0049.364] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.ape") returned 0 [0049.365] lstrlenA (lpString="*.ape") returned 5 [0049.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.wma") returned 0 [0049.365] lstrlenA (lpString="*.wma") returned 5 [0049.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.ac3") returned 0 [0049.365] lstrlenA (lpString="*.ac3") returned 5 [0049.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", pszSpec="*.mxf") returned 0 [0049.365] lstrlenA (lpString="*.mxf") returned 5 [0049.365] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 1 [0049.365] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.365] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WT61FR.LEX") returned -1 [0049.365] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WT61FR.LEX") returned -1 [0049.365] lstrcmpiA (lpString1="", lpString2="WT61FR.LEX") returned -1 [0049.365] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned="MSB1FREN.ITS" [0049.365] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\" [0049.365] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\") returned="" [0049.365] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt" [0049.365] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\how to decrypt files.txt")) returned 0x20 [0049.365] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", lpString2="WT61FR.LEX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" [0049.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.zip") returned 0 [0049.365] lstrlenA (lpString="*.zip") returned 5 [0049.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.rar") returned 0 [0049.365] lstrlenA (lpString="*.rar") returned 5 [0049.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.7z") returned 0 [0049.365] lstrlenA (lpString="*.7z") returned 4 [0049.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.tar") returned 0 [0049.365] lstrlenA (lpString="*.tar") returned 5 [0049.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.gzip") returned 0 [0049.365] lstrlenA (lpString="*.gzip") returned 6 [0049.365] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.jpg") returned 0 [0049.365] lstrlenA (lpString="*.jpg") returned 5 [0049.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.jpeg") returned 0 [0049.366] lstrlenA (lpString="*.jpeg") returned 6 [0049.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.psd") returned 0 [0049.366] lstrlenA (lpString="*.psd") returned 5 [0049.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.gif") returned 0 [0049.366] lstrlenA (lpString="*.gif") returned 5 [0049.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.doc") returned 0 [0049.366] lstrlenA (lpString="*.doc") returned 5 [0049.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.docx") returned 0 [0049.366] lstrlenA (lpString="*.docx") returned 6 [0049.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.xls") returned 0 [0049.366] lstrlenA (lpString="*.xls") returned 5 [0049.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.xlsx") returned 0 [0049.366] lstrlenA (lpString="*.xlsx") returned 6 [0049.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.ppt") returned 0 [0049.366] lstrlenA (lpString="*.ppt") returned 5 [0049.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.pptx") returned 0 [0049.366] lstrlenA (lpString="*.pptx") returned 6 [0049.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.pdf") returned 0 [0049.366] lstrlenA (lpString="*.pdf") returned 5 [0049.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.mov") returned 0 [0049.366] lstrlenA (lpString="*.mov") returned 5 [0049.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.m2v") returned 0 [0049.366] lstrlenA (lpString="*.m2v") returned 5 [0049.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.3gp") returned 0 [0049.366] lstrlenA (lpString="*.3gp") returned 5 [0049.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.mpeg") returned 0 [0049.366] lstrlenA (lpString="*.mpeg") returned 6 [0049.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.mpg") returned 0 [0049.366] lstrlenA (lpString="*.mpg") returned 5 [0049.366] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.flv") returned 0 [0049.366] lstrlenA (lpString="*.flv") returned 5 [0049.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.avi") returned 0 [0049.367] lstrlenA (lpString="*.avi") returned 5 [0049.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.mp4") returned 0 [0049.367] lstrlenA (lpString="*.mp4") returned 5 [0049.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.wmv") returned 0 [0049.367] lstrlenA (lpString="*.wmv") returned 5 [0049.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.divx") returned 0 [0049.367] lstrlenA (lpString="*.divx") returned 6 [0049.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.mkv") returned 0 [0049.367] lstrlenA (lpString="*.mkv") returned 5 [0049.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.mp3") returned 0 [0049.367] lstrlenA (lpString="*.mp3") returned 5 [0049.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.wav") returned 0 [0049.367] lstrlenA (lpString="*.wav") returned 5 [0049.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.flac") returned 0 [0049.367] lstrlenA (lpString="*.flac") returned 6 [0049.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.ape") returned 0 [0049.367] lstrlenA (lpString="*.ape") returned 5 [0049.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.wma") returned 0 [0049.367] lstrlenA (lpString="*.wma") returned 5 [0049.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.ac3") returned 0 [0049.367] lstrlenA (lpString="*.ac3") returned 5 [0049.367] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", pszSpec="*.mxf") returned 0 [0049.367] lstrlenA (lpString="*.mxf") returned 5 [0049.367] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 0 [0049.367] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0049.367] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd541900, ftCreationTime.dwHighDateTime=0x1c911ec, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd541900, ftLastWriteTime.dwHighDateTime=0x1c911ec, nFileSizeHigh=0x0, nFileSizeLow=0x205b0b, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="MSB1AR.LEX", cAlternateFileName="")) returned 1 [0049.367] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.367] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSB1AR.LEX") returned -1 [0049.368] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1AR.LEX") returned -1 [0049.368] lstrcmpiA (lpString1="", lpString2="MSB1AR.LEX") returned -1 [0049.368] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*") returned="*.*" [0049.368] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" [0049.368] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="" [0049.368] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" [0049.368] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\how to decrypt files.txt")) returned 0xffffffff [0049.368] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0049.368] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0049.368] WriteFile (in: hFile=0x8c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0049.369] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.369] CloseHandle (hObject=0x8c) returned 1 [0049.370] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="MSB1AR.LEX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" [0049.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.zip") returned 0 [0049.370] lstrlenA (lpString="*.zip") returned 5 [0049.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.rar") returned 0 [0049.370] lstrlenA (lpString="*.rar") returned 5 [0049.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.7z") returned 0 [0049.370] lstrlenA (lpString="*.7z") returned 4 [0049.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.tar") returned 0 [0049.370] lstrlenA (lpString="*.tar") returned 5 [0049.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.gzip") returned 0 [0049.370] lstrlenA (lpString="*.gzip") returned 6 [0049.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.jpg") returned 0 [0049.370] lstrlenA (lpString="*.jpg") returned 5 [0049.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.jpeg") returned 0 [0049.370] lstrlenA (lpString="*.jpeg") returned 6 [0049.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.psd") returned 0 [0049.370] lstrlenA (lpString="*.psd") returned 5 [0049.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.gif") returned 0 [0049.370] lstrlenA (lpString="*.gif") returned 5 [0049.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.doc") returned 0 [0049.370] lstrlenA (lpString="*.doc") returned 5 [0049.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.docx") returned 0 [0049.370] lstrlenA (lpString="*.docx") returned 6 [0049.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.xls") returned 0 [0049.370] lstrlenA (lpString="*.xls") returned 5 [0049.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.xlsx") returned 0 [0049.370] lstrlenA (lpString="*.xlsx") returned 6 [0049.370] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.ppt") returned 0 [0049.370] lstrlenA (lpString="*.ppt") returned 5 [0049.371] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.pptx") returned 0 [0049.371] lstrlenA (lpString="*.pptx") returned 6 [0049.371] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.pdf") returned 0 [0049.371] lstrlenA (lpString="*.pdf") returned 5 [0049.371] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.mov") returned 0 [0049.371] lstrlenA (lpString="*.mov") returned 5 [0049.371] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.m2v") returned 0 [0049.371] lstrlenA (lpString="*.m2v") returned 5 [0049.371] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.3gp") returned 0 [0049.371] lstrlenA (lpString="*.3gp") returned 5 [0049.371] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.mpeg") returned 0 [0049.371] lstrlenA (lpString="*.mpeg") returned 6 [0049.371] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.mpg") returned 0 [0049.371] lstrlenA (lpString="*.mpg") returned 5 [0049.371] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.flv") returned 0 [0049.371] lstrlenA (lpString="*.flv") returned 5 [0049.371] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.avi") returned 0 [0049.371] lstrlenA (lpString="*.avi") returned 5 [0049.371] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.mp4") returned 0 [0049.371] lstrlenA (lpString="*.mp4") returned 5 [0049.371] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.wmv") returned 0 [0049.371] lstrlenA (lpString="*.wmv") returned 5 [0049.371] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.divx") returned 0 [0049.371] lstrlenA (lpString="*.divx") returned 6 [0049.371] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.mkv") returned 0 [0049.371] lstrlenA (lpString="*.mkv") returned 5 [0049.371] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.mp3") returned 0 [0049.371] lstrlenA (lpString="*.mp3") returned 5 [0049.371] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.wav") returned 0 [0049.371] lstrlenA (lpString="*.wav") returned 5 [0049.371] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.flac") returned 0 [0049.371] lstrlenA (lpString="*.flac") returned 6 [0049.372] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.ape") returned 0 [0049.372] lstrlenA (lpString="*.ape") returned 5 [0049.372] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.wma") returned 0 [0049.372] lstrlenA (lpString="*.wma") returned 5 [0049.372] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.ac3") returned 0 [0049.372] lstrlenA (lpString="*.ac3") returned 5 [0049.372] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", pszSpec="*.mxf") returned 0 [0049.372] lstrlenA (lpString="*.mxf") returned 5 [0049.372] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7780a100, ftCreationTime.dwHighDateTime=0x1c4d75f, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7780a100, ftLastWriteTime.dwHighDateTime=0x1c4d75f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x2d8308, cFileName="MSB1CACH.LEX", cAlternateFileName="")) returned 1 [0049.372] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.372] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSB1CACH.LEX") returned -1 [0049.372] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1CACH.LEX") returned -1 [0049.372] lstrcmpiA (lpString1="", lpString2="MSB1CACH.LEX") returned -1 [0049.372] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned="MSB1AR.LEX" [0049.372] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" [0049.372] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="" [0049.372] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" [0049.372] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\how to decrypt files.txt")) returned 0x20 [0049.372] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="MSB1CACH.LEX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" [0049.372] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.zip") returned 0 [0049.372] lstrlenA (lpString="*.zip") returned 5 [0049.372] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.rar") returned 0 [0049.372] lstrlenA (lpString="*.rar") returned 5 [0049.372] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.7z") returned 0 [0049.372] lstrlenA (lpString="*.7z") returned 4 [0049.372] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.tar") returned 0 [0049.372] lstrlenA (lpString="*.tar") returned 5 [0049.372] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.gzip") returned 0 [0049.372] lstrlenA (lpString="*.gzip") returned 6 [0049.373] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.jpg") returned 0 [0049.373] lstrlenA (lpString="*.jpg") returned 5 [0049.373] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.jpeg") returned 0 [0049.373] lstrlenA (lpString="*.jpeg") returned 6 [0049.373] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.psd") returned 0 [0049.373] lstrlenA (lpString="*.psd") returned 5 [0049.373] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.gif") returned 0 [0049.373] lstrlenA (lpString="*.gif") returned 5 [0049.373] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.doc") returned 0 [0049.373] lstrlenA (lpString="*.doc") returned 5 [0049.373] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.docx") returned 0 [0049.373] lstrlenA (lpString="*.docx") returned 6 [0049.373] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.xls") returned 0 [0049.373] lstrlenA (lpString="*.xls") returned 5 [0049.373] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.xlsx") returned 0 [0049.373] lstrlenA (lpString="*.xlsx") returned 6 [0049.373] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.ppt") returned 0 [0049.373] lstrlenA (lpString="*.ppt") returned 5 [0049.373] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.pptx") returned 0 [0049.373] lstrlenA (lpString="*.pptx") returned 6 [0049.373] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.pdf") returned 0 [0049.373] lstrlenA (lpString="*.pdf") returned 5 [0049.373] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.mov") returned 0 [0049.373] lstrlenA (lpString="*.mov") returned 5 [0049.373] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.m2v") returned 0 [0049.373] lstrlenA (lpString="*.m2v") returned 5 [0049.373] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.3gp") returned 0 [0049.373] lstrlenA (lpString="*.3gp") returned 5 [0049.373] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.mpeg") returned 0 [0049.374] lstrlenA (lpString="*.mpeg") returned 6 [0049.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.mpg") returned 0 [0049.374] lstrlenA (lpString="*.mpg") returned 5 [0049.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.flv") returned 0 [0049.374] lstrlenA (lpString="*.flv") returned 5 [0049.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.avi") returned 0 [0049.374] lstrlenA (lpString="*.avi") returned 5 [0049.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.mp4") returned 0 [0049.374] lstrlenA (lpString="*.mp4") returned 5 [0049.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.wmv") returned 0 [0049.374] lstrlenA (lpString="*.wmv") returned 5 [0049.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.divx") returned 0 [0049.374] lstrlenA (lpString="*.divx") returned 6 [0049.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.mkv") returned 0 [0049.374] lstrlenA (lpString="*.mkv") returned 5 [0049.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.mp3") returned 0 [0049.374] lstrlenA (lpString="*.mp3") returned 5 [0049.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.wav") returned 0 [0049.374] lstrlenA (lpString="*.wav") returned 5 [0049.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.flac") returned 0 [0049.374] lstrlenA (lpString="*.flac") returned 6 [0049.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.ape") returned 0 [0049.374] lstrlenA (lpString="*.ape") returned 5 [0049.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.wma") returned 0 [0049.374] lstrlenA (lpString="*.wma") returned 5 [0049.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.ac3") returned 0 [0049.374] lstrlenA (lpString="*.ac3") returned 5 [0049.374] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", pszSpec="*.mxf") returned 0 [0049.375] lstrlenA (lpString="*.mxf") returned 5 [0049.375] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c6bc00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c6bc00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x2b990, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1CORE.DLL", cAlternateFileName="")) returned 1 [0049.375] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.375] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSB1CORE.DLL") returned -1 [0049.375] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1CORE.DLL") returned -1 [0049.375] lstrcmpiA (lpString1="", lpString2="MSB1CORE.DLL") returned -1 [0049.375] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned="MSB1CACH.LEX" [0049.375] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" [0049.375] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="" [0049.375] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" [0049.375] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\how to decrypt files.txt")) returned 0x20 [0049.375] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="MSB1CORE.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL" [0049.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.zip") returned 0 [0049.375] lstrlenA (lpString="*.zip") returned 5 [0049.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.rar") returned 0 [0049.375] lstrlenA (lpString="*.rar") returned 5 [0049.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.7z") returned 0 [0049.375] lstrlenA (lpString="*.7z") returned 4 [0049.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.tar") returned 0 [0049.375] lstrlenA (lpString="*.tar") returned 5 [0049.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.gzip") returned 0 [0049.375] lstrlenA (lpString="*.gzip") returned 6 [0049.375] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.jpg") returned 0 [0049.375] lstrlenA (lpString="*.jpg") returned 5 [0049.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.jpeg") returned 0 [0049.376] lstrlenA (lpString="*.jpeg") returned 6 [0049.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.psd") returned 0 [0049.376] lstrlenA (lpString="*.psd") returned 5 [0049.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.gif") returned 0 [0049.376] lstrlenA (lpString="*.gif") returned 5 [0049.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.doc") returned 0 [0049.376] lstrlenA (lpString="*.doc") returned 5 [0049.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.docx") returned 0 [0049.376] lstrlenA (lpString="*.docx") returned 6 [0049.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.xls") returned 0 [0049.376] lstrlenA (lpString="*.xls") returned 5 [0049.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.xlsx") returned 0 [0049.376] lstrlenA (lpString="*.xlsx") returned 6 [0049.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.ppt") returned 0 [0049.376] lstrlenA (lpString="*.ppt") returned 5 [0049.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.pptx") returned 0 [0049.376] lstrlenA (lpString="*.pptx") returned 6 [0049.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.pdf") returned 0 [0049.376] lstrlenA (lpString="*.pdf") returned 5 [0049.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.mov") returned 0 [0049.376] lstrlenA (lpString="*.mov") returned 5 [0049.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.m2v") returned 0 [0049.376] lstrlenA (lpString="*.m2v") returned 5 [0049.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.3gp") returned 0 [0049.376] lstrlenA (lpString="*.3gp") returned 5 [0049.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.mpeg") returned 0 [0049.376] lstrlenA (lpString="*.mpeg") returned 6 [0049.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.mpg") returned 0 [0049.376] lstrlenA (lpString="*.mpg") returned 5 [0049.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.flv") returned 0 [0049.376] lstrlenA (lpString="*.flv") returned 5 [0049.376] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.avi") returned 0 [0049.377] lstrlenA (lpString="*.avi") returned 5 [0049.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.mp4") returned 0 [0049.377] lstrlenA (lpString="*.mp4") returned 5 [0049.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.wmv") returned 0 [0049.377] lstrlenA (lpString="*.wmv") returned 5 [0049.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.divx") returned 0 [0049.377] lstrlenA (lpString="*.divx") returned 6 [0049.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.mkv") returned 0 [0049.377] lstrlenA (lpString="*.mkv") returned 5 [0049.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.mp3") returned 0 [0049.377] lstrlenA (lpString="*.mp3") returned 5 [0049.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.wav") returned 0 [0049.377] lstrlenA (lpString="*.wav") returned 5 [0049.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.flac") returned 0 [0049.377] lstrlenA (lpString="*.flac") returned 6 [0049.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.ape") returned 0 [0049.377] lstrlenA (lpString="*.ape") returned 5 [0049.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.wma") returned 0 [0049.377] lstrlenA (lpString="*.wma") returned 5 [0049.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.ac3") returned 0 [0049.377] lstrlenA (lpString="*.ac3") returned 5 [0049.377] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", pszSpec="*.mxf") returned 0 [0049.377] lstrlenA (lpString="*.mxf") returned 5 [0049.377] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38c6e400, ftCreationTime.dwHighDateTime=0x1ca6d6a, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38c6e400, ftLastWriteTime.dwHighDateTime=0x1ca6d6a, nFileSizeHigh=0x0, nFileSizeLow=0x40f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1STAR.DLL", cAlternateFileName="")) returned 1 [0049.377] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.377] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSB1STAR.DLL") returned -1 [0049.377] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1STAR.DLL") returned -1 [0049.377] lstrcmpiA (lpString1="", lpString2="MSB1STAR.DLL") returned -1 [0049.377] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL") returned="MSB1CORE.DLL" [0049.377] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" [0049.377] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="" [0049.377] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" [0049.377] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\how to decrypt files.txt")) returned 0x20 [0049.378] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="MSB1STAR.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL" [0049.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.zip") returned 0 [0049.378] lstrlenA (lpString="*.zip") returned 5 [0049.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.rar") returned 0 [0049.378] lstrlenA (lpString="*.rar") returned 5 [0049.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.7z") returned 0 [0049.378] lstrlenA (lpString="*.7z") returned 4 [0049.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.tar") returned 0 [0049.378] lstrlenA (lpString="*.tar") returned 5 [0049.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.gzip") returned 0 [0049.378] lstrlenA (lpString="*.gzip") returned 6 [0049.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.jpg") returned 0 [0049.378] lstrlenA (lpString="*.jpg") returned 5 [0049.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.jpeg") returned 0 [0049.378] lstrlenA (lpString="*.jpeg") returned 6 [0049.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.psd") returned 0 [0049.378] lstrlenA (lpString="*.psd") returned 5 [0049.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.gif") returned 0 [0049.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.doc") returned 0 [0049.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.docx") returned 0 [0049.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.xls") returned 0 [0049.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.xlsx") returned 0 [0049.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.ppt") returned 0 [0049.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.pptx") returned 0 [0049.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.pdf") returned 0 [0049.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.mov") returned 0 [0049.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.m2v") returned 0 [0049.378] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.3gp") returned 0 [0049.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.mpeg") returned 0 [0049.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.mpg") returned 0 [0049.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.flv") returned 0 [0049.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.avi") returned 0 [0049.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.mp4") returned 0 [0049.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.wmv") returned 0 [0049.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.divx") returned 0 [0049.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.mkv") returned 0 [0049.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.mp3") returned 0 [0049.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.wav") returned 0 [0049.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.flac") returned 0 [0049.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.ape") returned 0 [0049.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.wma") returned 0 [0049.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.ac3") returned 0 [0049.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", pszSpec="*.mxf") returned 0 [0049.379] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4958f00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4958f00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x11390, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1XTOR.DLL", cAlternateFileName="")) returned 1 [0049.379] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.379] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSB1XTOR.DLL") returned -1 [0049.379] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSB1XTOR.DLL") returned -1 [0049.379] lstrcmpiA (lpString1="", lpString2="MSB1XTOR.DLL") returned -1 [0049.379] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL") returned="MSB1STAR.DLL" [0049.379] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" [0049.379] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="" [0049.379] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" [0049.379] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\how to decrypt files.txt")) returned 0x20 [0049.379] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="MSB1XTOR.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" [0049.379] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", pszSpec="*.zip") returned 0 [0049.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", pszSpec="*.rar") returned 0 [0049.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", pszSpec="*.7z") returned 0 [0049.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", pszSpec="*.tar") returned 0 [0049.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", pszSpec="*.gzip") returned 0 [0049.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", pszSpec="*.jpg") returned 0 [0049.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", pszSpec="*.jpeg") returned 0 [0049.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", pszSpec="*.psd") returned 0 [0049.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", pszSpec="*.gif") returned 0 [0049.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", pszSpec="*.doc") returned 0 [0049.380] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", pszSpec="*.docx") returned 0 [0049.380] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 1 [0049.380] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.380] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WTSP61MS.DLL") returned -1 [0049.380] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WTSP61MS.DLL") returned -1 [0049.380] lstrcmpiA (lpString1="", lpString2="WTSP61MS.DLL") returned -1 [0049.380] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned="MSB1XTOR.DLL" [0049.380] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" [0049.380] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned="" [0049.380] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" [0049.380] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\how to decrypt files.txt")) returned 0x20 [0049.381] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", lpString2="WTSP61MS.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL" [0049.381] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 0 [0049.381] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0049.381] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Triedit", cAlternateFileName="")) returned 1 [0049.381] lstrcmpA (lpString1=".", lpString2="Triedit") returned -1 [0049.381] lstrcmpA (lpString1="..", lpString2="Triedit") returned -1 [0049.381] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0049.381] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="Triedit" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit" [0049.381] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0049.381] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.381] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.381] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.382] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.382] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0049.382] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0049.382] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0049.382] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*") returned="*.*" [0049.382] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US" [0049.382] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2d80c0 [0049.383] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.383] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.383] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.383] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.383] FindNextFileA (in: hFindFile=0x2d80c0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 0 [0049.383] FindClose (in: hFindFile=0x2d80c0 | out: hFindFile=0x2d80c0) returned 1 [0049.383] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0049.383] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0049.383] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720054, dwReserved1=0x3, cFileName="VBA", cAlternateFileName="")) returned 1 [0049.383] lstrcmpA (lpString1=".", lpString2="VBA") returned -1 [0049.384] lstrcmpA (lpString1="..", lpString2="VBA") returned -1 [0049.384] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0049.384] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="VBA" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA" [0049.384] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e0065, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2d8068 [0049.385] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.385] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.385] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.385] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.385] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 1 [0049.385] lstrcmpA (lpString1=".", lpString2="VBA7") returned -1 [0049.385] lstrcmpA (lpString1="..", lpString2="VBA7") returned -1 [0049.385] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*") returned="*.*" [0049.385] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", lpString2="VBA7" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7" [0049.385] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0049.385] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.385] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.385] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.385] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.385] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0049.385] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0049.385] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0049.386] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*") returned="*.*" [0049.386] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", lpString2="1033" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033" [0049.386] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2db3c0, dwReserved1=0x2db3bb, cFileName=".", cAlternateFileName="")) returned 0x2d8138 [0049.405] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.405] FindNextFileA (in: hFindFile=0x2d8138, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.405] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.405] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.405] FindNextFileA (in: hFindFile=0x2d8138, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1574f00, ftCreationTime.dwHighDateTime=0x1be23e3, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1574f00, ftLastWriteTime.dwHighDateTime=0x1be23e3, nFileSizeHigh=0x0, nFileSizeLow=0x51a5b, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="FM20.CHM", cAlternateFileName="")) returned 1 [0049.405] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0049.406] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FM20.CHM") returned -1 [0049.406] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FM20.CHM") returned 1 [0049.406] lstrcmpiA (lpString1="", lpString2="FM20.CHM") returned -1 [0049.406] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*") returned="*.*" [0049.406] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" [0049.406] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="" [0049.406] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt" [0049.406] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\how to decrypt files.txt")) returned 0xffffffff [0049.406] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0049.412] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.412] CloseHandle (hObject=0x94) returned 1 [0049.412] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="FM20.CHM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" [0049.412] FindNextFileA (in: hFindFile=0x2d8138, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edd8500, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6edd8500, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1ac96, dwReserved0=0x0, dwReserved1=0x2d8458, cFileName="VBCN6.CHM", cAlternateFileName="")) returned 1 [0049.412] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0049.412] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VBCN6.CHM") returned -1 [0049.412] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VBCN6.CHM") returned -1 [0049.412] lstrcmpiA (lpString1="", lpString2="VBCN6.CHM") returned -1 [0049.412] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned="FM20.CHM" [0049.412] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" [0049.412] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="" [0049.412] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt" [0049.412] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\how to decrypt files.txt")) returned 0x20 [0049.413] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="VBCN6.CHM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" [0049.413] FindNextFileA (in: hFindFile=0x2d8138, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f2be900, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f2be900, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x25d50, dwReserved0=0x74, dwReserved1=0x0, cFileName="VBE7INTL.DLL", cAlternateFileName="")) returned 1 [0049.413] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0049.413] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VBE7INTL.DLL") returned -1 [0049.413] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VBE7INTL.DLL") returned -1 [0049.413] lstrcmpiA (lpString1="", lpString2="VBE7INTL.DLL") returned -1 [0049.413] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned="VBCN6.CHM" [0049.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" [0049.413] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="" [0049.413] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt" [0049.413] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\how to decrypt files.txt")) returned 0x20 [0049.413] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="VBE7INTL.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL" [0049.413] FindNextFileA (in: hFindFile=0x2d8138, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d2ba100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7d2ba100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1195f, dwReserved0=0x74, dwReserved1=0x0, cFileName="VBENDF98.CHM", cAlternateFileName="")) returned 1 [0049.413] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0049.413] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VBENDF98.CHM") returned -1 [0049.413] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VBENDF98.CHM") returned -1 [0049.413] lstrcmpiA (lpString1="", lpString2="VBENDF98.CHM") returned -1 [0049.413] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned="VBE7INTL.DLL" [0049.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" [0049.413] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="" [0049.413] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt" [0049.413] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\how to decrypt files.txt")) returned 0x20 [0049.413] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="VBENDF98.CHM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" [0049.414] FindNextFileA (in: hFindFile=0x2d8138, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8583dc00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8583dc00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe2aa, dwReserved0=0x74, dwReserved1=0x0, cFileName="VBHW6.CHM", cAlternateFileName="")) returned 1 [0049.414] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0049.414] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VBHW6.CHM") returned -1 [0049.414] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VBHW6.CHM") returned -1 [0049.414] lstrcmpiA (lpString1="", lpString2="VBHW6.CHM") returned -1 [0049.414] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned="VBENDF98.CHM" [0049.414] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" [0049.414] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="" [0049.414] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt" [0049.414] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\how to decrypt files.txt")) returned 0x20 [0049.414] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="VBHW6.CHM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" [0049.414] FindNextFileA (in: hFindFile=0x2d8138, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903e7100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x903e7100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe6b62, dwReserved0=0x74, dwReserved1=0x0, cFileName="VBLR6.CHM", cAlternateFileName="")) returned 1 [0049.414] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0049.414] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VBLR6.CHM") returned -1 [0049.414] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VBLR6.CHM") returned -1 [0049.414] lstrcmpiA (lpString1="", lpString2="VBLR6.CHM") returned -1 [0049.414] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned="VBHW6.CHM" [0049.414] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" [0049.414] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="" [0049.414] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt" [0049.414] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\how to decrypt files.txt")) returned 0x20 [0049.414] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="VBLR6.CHM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" [0049.414] FindNextFileA (in: hFindFile=0x2d8138, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9896ac00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9896ac00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1e434, dwReserved0=0x74, dwReserved1=0x0, cFileName="VBOB6.CHM", cAlternateFileName="")) returned 1 [0049.414] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0049.414] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VBOB6.CHM") returned -1 [0049.415] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VBOB6.CHM") returned -1 [0049.415] lstrcmpiA (lpString1="", lpString2="VBOB6.CHM") returned -1 [0049.415] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned="VBLR6.CHM" [0049.415] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" [0049.415] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="" [0049.415] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt" [0049.415] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\how to decrypt files.txt")) returned 0x20 [0049.415] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="VBOB6.CHM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" [0049.415] FindNextFileA (in: hFindFile=0x2d8138, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x74, dwReserved1=0x0, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 1 [0049.415] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0049.415] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VBUI6.CHM") returned -1 [0049.415] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VBUI6.CHM") returned -1 [0049.415] lstrcmpiA (lpString1="", lpString2="VBUI6.CHM") returned -1 [0049.415] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned="VBOB6.CHM" [0049.415] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" [0049.415] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned="" [0049.415] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt" [0049.415] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\how to decrypt files.txt")) returned 0x20 [0049.416] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", lpString2="VBUI6.CHM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" [0049.416] FindNextFileA (in: hFindFile=0x2d8138, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x74, dwReserved1=0x0, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 0 [0049.416] FindClose (in: hFindFile=0x2d8138 | out: hFindFile=0x2d8138) returned 1 [0049.416] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1 [0049.416] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.416] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VBE7.DLL") returned -1 [0049.416] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VBE7.DLL") returned -1 [0049.416] lstrcmpiA (lpString1="", lpString2="VBE7.DLL") returned -1 [0049.416] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*") returned="*.*" [0049.416] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\" [0049.416] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\") returned="" [0049.416] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\HOW TO DECRYPT FILES.txt" [0049.416] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\how to decrypt files.txt")) returned 0xffffffff [0049.417] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.418] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.418] CloseHandle (hObject=0x90) returned 1 [0049.419] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", lpString2="VBE7.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" [0049.419] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="VBE7.DLL", cAlternateFileName="")) returned 0 [0049.419] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0049.419] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 0 [0049.419] FindClose (in: hFindFile=0x2d8068 | out: hFindFile=0x2d8068) returned 1 [0049.419] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x420056, dwReserved1=0x3, cFileName="VC", cAlternateFileName="")) returned 1 [0049.419] lstrcmpA (lpString1=".", lpString2="VC") returned -1 [0049.419] lstrcmpA (lpString1="..", lpString2="VC") returned -1 [0049.419] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0049.419] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="VC" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VC" [0049.419] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2d8068 [0049.435] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.435] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.435] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.435] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.435] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ef3e00, ftCreationTime.dwHighDateTime=0x1cbd033, ftLastAccessTime.dwLowDateTime=0xd2618ca0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc9ef3e00, ftLastWriteTime.dwHighDateTime=0x1cbd033, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0049.435] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.435] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msdia100.dll") returned -1 [0049.435] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdia100.dll") returned -1 [0049.435] lstrcmpiA (lpString1="", lpString2="msdia100.dll") returned -1 [0049.435] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*") returned="*.*" [0049.435] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\" [0049.435] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\") returned="" [0049.435] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\HOW TO DECRYPT FILES.txt" [0049.435] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\how to decrypt files.txt")) returned 0xffffffff [0049.436] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0049.437] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.437] CloseHandle (hObject=0x8c) returned 1 [0049.438] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", lpString2="msdia100.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll" [0049.438] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x2d8370, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0049.438] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.438] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msdia90.dll") returned -1 [0049.438] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdia90.dll") returned -1 [0049.438] lstrcmpiA (lpString1="", lpString2="msdia90.dll") returned -1 [0049.438] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned="msdia100.dll" [0049.438] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\" [0049.438] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\") returned="" [0049.438] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\HOW TO DECRYPT FILES.txt" [0049.438] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\how to decrypt files.txt")) returned 0x20 [0049.438] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", lpString2="msdia90.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll" [0049.438] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x2d8370, cFileName="msdia90.dll", cAlternateFileName="")) returned 0 [0049.438] FindClose (in: hFindFile=0x2d8068 | out: hFindFile=0x2d8068) returned 1 [0049.439] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="VGX", cAlternateFileName="")) returned 1 [0049.439] lstrcmpA (lpString1=".", lpString2="VGX") returned -1 [0049.439] lstrcmpA (lpString1="..", lpString2="VGX") returned -1 [0049.439] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0049.439] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="VGX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX" [0049.439] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d8068 [0049.439] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.439] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.439] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.439] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.439] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0049.439] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.439] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VGX.dll") returned -1 [0049.439] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VGX.dll") returned -1 [0049.440] lstrcmpiA (lpString1="", lpString2="VGX.dll") returned -1 [0049.440] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*") returned="*.*" [0049.440] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\" [0049.440] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\") returned="" [0049.440] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\HOW TO DECRYPT FILES.txt" [0049.440] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\how to decrypt files.txt")) returned 0xffffffff [0049.440] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0049.441] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.441] CloseHandle (hObject=0x8c) returned 1 [0049.442] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", lpString2="VGX.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll" [0049.442] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 0 [0049.442] FindClose (in: hFindFile=0x2d8068 | out: hFindFile=0x2d8068) returned 1 [0049.442] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0049.442] lstrcmpA (lpString1=".", lpString2="Visio Shared") returned -1 [0049.442] lstrcmpA (lpString1="..", lpString2="Visio Shared") returned -1 [0049.442] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0049.442] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="Visio Shared" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared" [0049.442] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8370, cFileName=".", cAlternateFileName="")) returned 0x2d8078 [0049.443] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.443] FindNextFileA (in: hFindFile=0x2d8078, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.443] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.443] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.443] FindNextFileA (in: hFindFile=0x2d8078, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0049.443] lstrcmpA (lpString1=".", lpString2="Fonts") returned -1 [0049.443] lstrcmpA (lpString1="..", lpString2="Fonts") returned -1 [0049.443] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*") returned="*.*" [0049.443] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", lpString2="Fonts" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts" [0049.443] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0049.446] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.446] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.446] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.446] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.446] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x4f2ea, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BIGFONT.SHX", cAlternateFileName="")) returned 1 [0049.446] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.446] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BIGFONT.SHX") returned 1 [0049.446] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BIGFONT.SHX") returned 1 [0049.446] lstrcmpiA (lpString1="", lpString2="BIGFONT.SHX") returned -1 [0049.446] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*") returned="*.*" [0049.446] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" [0049.446] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="" [0049.446] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" [0049.446] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to decrypt files.txt")) returned 0xffffffff [0049.446] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.448] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.448] CloseHandle (hObject=0x90) returned 1 [0049.448] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="BIGFONT.SHX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" [0049.448] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81c076e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xa261d, dwReserved0=0x0, dwReserved1=0x2d83a0, cFileName="CHINESET.SHX", cAlternateFileName="")) returned 1 [0049.448] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.448] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CHINESET.SHX") returned 1 [0049.449] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CHINESET.SHX") returned 1 [0049.449] lstrcmpiA (lpString1="", lpString2="CHINESET.SHX") returned -1 [0049.449] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned="BIGFONT.SHX" [0049.449] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" [0049.449] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="" [0049.449] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" [0049.449] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to decrypt files.txt")) returned 0x20 [0049.449] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="CHINESET.SHX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" [0049.449] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81eb4fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x6a9e6, dwReserved0=0x530045, dwReserved1=0x74002e, cFileName="EXTFONT.SHX", cAlternateFileName="")) returned 1 [0049.449] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.449] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EXTFONT.SHX") returned -1 [0049.449] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXTFONT.SHX") returned 1 [0049.449] lstrcmpiA (lpString1="", lpString2="EXTFONT.SHX") returned -1 [0049.449] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned="CHINESET.SHX" [0049.449] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" [0049.449] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="" [0049.449] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" [0049.449] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to decrypt files.txt")) returned 0x20 [0049.449] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="EXTFONT.SHX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" [0049.450] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8207e020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdc6b9, dwReserved0=0x530045, dwReserved1=0x74002e, cFileName="GBCBIG.SHX", cAlternateFileName="")) returned 1 [0049.450] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.450] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GBCBIG.SHX") returned -1 [0049.450] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GBCBIG.SHX") returned 1 [0049.450] lstrcmpiA (lpString1="", lpString2="GBCBIG.SHX") returned -1 [0049.450] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned="EXTFONT.SHX" [0049.450] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" [0049.450] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="" [0049.450] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" [0049.450] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to decrypt files.txt")) returned 0x20 [0049.450] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="GBCBIG.SHX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" [0049.450] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2656900, ftCreationTime.dwHighDateTime=0x1c2706c, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2656900, ftLastWriteTime.dwHighDateTime=0x1c2706c, nFileSizeHigh=0x0, nFileSizeLow=0x2b01, dwReserved0=0x530045, dwReserved1=0x74002e, cFileName="IC-TXT.SHX", cAlternateFileName="")) returned 1 [0049.450] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.450] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IC-TXT.SHX") returned -1 [0049.450] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IC-TXT.SHX") returned -1 [0049.450] lstrcmpiA (lpString1="", lpString2="IC-TXT.SHX") returned -1 [0049.450] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned="GBCBIG.SHX" [0049.450] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" [0049.450] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="" [0049.450] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" [0049.450] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to decrypt files.txt")) returned 0x20 [0049.451] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="IC-TXT.SHX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" [0049.451] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8f60300, ftCreationTime.dwHighDateTime=0x1c324cc, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc8f60300, ftLastWriteTime.dwHighDateTime=0x1c324cc, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x530045, dwReserved1=0x74002e, cFileName="ICAD.FMP", cAlternateFileName="")) returned 1 [0049.451] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.451] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ICAD.FMP") returned -1 [0049.451] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ICAD.FMP") returned -1 [0049.451] lstrcmpiA (lpString1="", lpString2="ICAD.FMP") returned -1 [0049.451] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned="IC-TXT.SHX" [0049.451] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" [0049.451] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="" [0049.451] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" [0049.451] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to decrypt files.txt")) returned 0x20 [0049.451] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="ICAD.FMP" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" [0049.451] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x369d3, dwReserved0=0x530045, dwReserved1=0x74002e, cFileName="WHGDTXT.SHX", cAlternateFileName="")) returned 1 [0049.451] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.451] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WHGDTXT.SHX") returned -1 [0049.451] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WHGDTXT.SHX") returned -1 [0049.451] lstrcmpiA (lpString1="", lpString2="WHGDTXT.SHX") returned -1 [0049.451] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned="ICAD.FMP" [0049.451] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" [0049.452] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="" [0049.452] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" [0049.452] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to decrypt files.txt")) returned 0x20 [0049.452] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="WHGDTXT.SHX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" [0049.452] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x2fde5, dwReserved0=0x530045, dwReserved1=0x74002e, cFileName="WHGTXT.SHX", cAlternateFileName="")) returned 1 [0049.452] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.452] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WHGTXT.SHX") returned -1 [0049.452] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WHGTXT.SHX") returned -1 [0049.452] lstrcmpiA (lpString1="", lpString2="WHGTXT.SHX") returned -1 [0049.452] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned="WHGDTXT.SHX" [0049.452] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" [0049.452] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="" [0049.452] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" [0049.452] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to decrypt files.txt")) returned 0x20 [0049.452] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="WHGTXT.SHX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" [0049.452] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x9e413, dwReserved0=0x530045, dwReserved1=0x74002e, cFileName="WHTGTXT.SHX", cAlternateFileName="")) returned 1 [0049.452] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.452] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WHTGTXT.SHX") returned -1 [0049.452] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WHTGTXT.SHX") returned -1 [0049.453] lstrcmpiA (lpString1="", lpString2="WHTGTXT.SHX") returned -1 [0049.453] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned="WHGTXT.SHX" [0049.453] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" [0049.453] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="" [0049.453] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" [0049.453] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to decrypt files.txt")) returned 0x20 [0049.453] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="WHTGTXT.SHX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" [0049.453] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x530045, dwReserved1=0x74002e, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 1 [0049.453] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.453] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WHTMTXT.SHX") returned -1 [0049.453] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WHTMTXT.SHX") returned -1 [0049.453] lstrcmpiA (lpString1="", lpString2="WHTMTXT.SHX") returned -1 [0049.453] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned="WHTGTXT.SHX" [0049.453] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" [0049.453] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned="" [0049.453] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" [0049.453] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\how to decrypt files.txt")) returned 0x20 [0049.453] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", lpString2="WHTMTXT.SHX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" [0049.454] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x530045, dwReserved1=0x74002e, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 0 [0049.454] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0049.454] FindNextFileA (in: hFindFile=0x2d8078, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 0 [0049.454] FindClose (in: hFindFile=0x2d8078 | out: hFindFile=0x2d8078) returned 1 [0049.454] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690056, dwReserved1=0x3, cFileName="VSTO", cAlternateFileName="")) returned 1 [0049.454] lstrcmpA (lpString1=".", lpString2="VSTO") returned -1 [0049.454] lstrcmpA (lpString1="..", lpString2="VSTO") returned -1 [0049.454] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0049.454] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="VSTO" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO" [0049.454] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2d8068 [0049.455] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.456] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.456] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.456] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.456] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0049.456] lstrcmpA (lpString1=".", lpString2="10.0") returned -1 [0049.456] lstrcmpA (lpString1="..", lpString2="10.0") returned -1 [0049.456] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*") returned="*.*" [0049.456] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", lpString2="10.0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0" [0049.456] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0049.459] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.459] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.459] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.459] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.459] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0049.459] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0049.459] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0049.459] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*") returned="*.*" [0049.459] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", lpString2="1033" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033" [0049.459] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2db3c0, dwReserved1=0x2db3bb, cFileName=".", cAlternateFileName="")) returned 0x2d8138 [0049.469] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.470] FindNextFileA (in: hFindFile=0x2d8138, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.470] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.470] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.470] FindNextFileA (in: hFindFile=0x2d8138, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5024ea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2760, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0049.470] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0049.470] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VSTOInstallerUI.dll") returned -1 [0049.470] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VSTOInstallerUI.dll") returned -1 [0049.470] lstrcmpiA (lpString1="", lpString2="VSTOInstallerUI.dll") returned -1 [0049.470] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*") returned="*.*" [0049.470] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\" [0049.470] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\") returned="" [0049.470] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\HOW TO DECRYPT FILES.txt" [0049.470] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\how to decrypt files.txt")) returned 0xffffffff [0049.470] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0049.479] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.479] CloseHandle (hObject=0x94) returned 1 [0049.480] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", lpString2="VSTOInstallerUI.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" [0049.480] FindNextFileA (in: hFindFile=0x2d8138, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x2d8458, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0049.480] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0049.480] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VSTOLoaderUI.dll") returned -1 [0049.480] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VSTOLoaderUI.dll") returned -1 [0049.480] lstrcmpiA (lpString1="", lpString2="VSTOLoaderUI.dll") returned -1 [0049.480] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned="VSTOInstallerUI.dll" [0049.480] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\" [0049.480] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\") returned="" [0049.480] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\HOW TO DECRYPT FILES.txt" [0049.481] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\how to decrypt files.txt")) returned 0x20 [0049.481] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", lpString2="VSTOLoaderUI.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" [0049.481] FindNextFileA (in: hFindFile=0x2d8138, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x2d8458, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 0 [0049.481] FindClose (in: hFindFile=0x2d8138 | out: hFindFile=0x2d8138) returned 1 [0049.481] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc251dc00, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc251dc00, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="VSTOInstaller.config", cAlternateFileName="VSTOIN~1.CON")) returned 1 [0049.481] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.481] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VSTOInstaller.config") returned -1 [0049.481] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VSTOInstaller.config") returned -1 [0049.481] lstrcmpiA (lpString1="", lpString2="VSTOInstaller.config") returned -1 [0049.481] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*") returned="*.*" [0049.481] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" [0049.481] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\") returned="" [0049.481] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\HOW TO DECRYPT FILES.txt" [0049.482] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\how to decrypt files.txt")) returned 0xffffffff [0049.482] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.483] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.483] CloseHandle (hObject=0x90) returned 1 [0049.484] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", lpString2="VSTOInstaller.config" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" [0049.484] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d27ac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x18558, dwReserved0=0x0, dwReserved1=0x2d8380, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0049.484] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.484] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VSTOInstaller.exe") returned -1 [0049.484] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VSTOInstaller.exe") returned -1 [0049.484] lstrcmpiA (lpString1="", lpString2="VSTOInstaller.exe") returned -1 [0049.484] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned="VSTOInstaller.config" [0049.484] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" [0049.484] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\") returned="" [0049.484] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\HOW TO DECRYPT FILES.txt" [0049.484] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\how to decrypt files.txt")) returned 0x20 [0049.484] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", lpString2="VSTOInstaller.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe" [0049.484] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5e950, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoader.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0049.484] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.485] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VSTOLoader.dll") returned -1 [0049.485] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VSTOLoader.dll") returned -1 [0049.485] lstrcmpiA (lpString1="", lpString2="VSTOLoader.dll") returned -1 [0049.485] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned="VSTOInstaller.exe" [0049.485] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" [0049.485] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\") returned="" [0049.485] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\HOW TO DECRYPT FILES.txt" [0049.485] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\how to decrypt files.txt")) returned 0x20 [0049.485] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", lpString2="VSTOLoader.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll" [0049.485] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 1 [0049.485] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.485] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VSTOMessageProvider.dll") returned -1 [0049.485] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VSTOMessageProvider.dll") returned -1 [0049.485] lstrcmpiA (lpString1="", lpString2="VSTOMessageProvider.dll") returned -1 [0049.485] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned="VSTOLoader.dll" [0049.485] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" [0049.485] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\") returned="" [0049.485] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\HOW TO DECRYPT FILES.txt" [0049.485] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\how to decrypt files.txt")) returned 0x20 [0049.485] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", lpString2="VSTOMessageProvider.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll" [0049.486] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 0 [0049.486] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0049.486] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2d148, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0049.486] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.486] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="vstoee.dll") returned -1 [0049.486] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="vstoee.dll") returned -1 [0049.486] lstrcmpiA (lpString1="", lpString2="vstoee.dll") returned -1 [0049.486] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*") returned="*.*" [0049.486] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\" [0049.486] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\") returned="" [0049.486] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\HOW TO DECRYPT FILES.txt" [0049.486] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\how to decrypt files.txt")) returned 0xffffffff [0049.486] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0049.490] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.491] CloseHandle (hObject=0x8c) returned 1 [0049.491] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", lpString2="vstoee.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll" [0049.491] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c693e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x3f50, dwReserved0=0x0, dwReserved1=0x2d8378, cFileName="vstoee100.tlb", cAlternateFileName="VSTOEE~1.TLB")) returned 1 [0049.491] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.491] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="vstoee100.tlb") returned -1 [0049.491] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="vstoee100.tlb") returned -1 [0049.491] lstrcmpiA (lpString1="", lpString2="vstoee100.tlb") returned -1 [0049.491] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll") returned="vstoee.dll" [0049.491] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\" [0049.491] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\") returned="" [0049.491] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\HOW TO DECRYPT FILES.txt" [0049.491] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\how to decrypt files.txt")) returned 0x20 [0049.491] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", lpString2="vstoee100.tlb" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" [0049.492] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1 [0049.492] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.492] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="vstoee90.tlb") returned -1 [0049.492] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="vstoee90.tlb") returned -1 [0049.492] lstrcmpiA (lpString1="", lpString2="vstoee90.tlb") returned -1 [0049.492] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") returned="vstoee100.tlb" [0049.492] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\" [0049.492] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\") returned="" [0049.492] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\HOW TO DECRYPT FILES.txt" [0049.492] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\how to decrypt files.txt")) returned 0x20 [0049.492] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", lpString2="vstoee90.tlb" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" [0049.492] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 0 [0049.492] FindClose (in: hFindFile=0x2d8068 | out: hFindFile=0x2d8068) returned 1 [0049.492] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Web Folders", cAlternateFileName="WEBFOL~1")) returned 1 [0049.492] lstrcmpA (lpString1=".", lpString2="Web Folders") returned -1 [0049.492] lstrcmpA (lpString1="..", lpString2="Web Folders") returned -1 [0049.492] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0049.492] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="Web Folders" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders" [0049.492] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d8078 [0049.494] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.494] FindNextFileA (in: hFindFile=0x2d8078, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.494] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.494] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.494] FindNextFileA (in: hFindFile=0x2d8078, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0049.494] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0049.494] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0049.494] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*") returned="*.*" [0049.494] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", lpString2="1033" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033" [0049.494] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0049.494] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.494] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.495] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.495] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.495] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 1 [0049.495] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.495] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOSVINT.DLL") returned -1 [0049.495] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOSVINT.DLL") returned -1 [0049.495] lstrcmpiA (lpString1="", lpString2="MSOSVINT.DLL") returned -1 [0049.495] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*") returned="*.*" [0049.495] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\" [0049.495] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\") returned="" [0049.495] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\HOW TO DECRYPT FILES.txt" [0049.495] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\how to decrypt files.txt")) returned 0xffffffff [0049.495] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.496] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.497] CloseHandle (hObject=0x90) returned 1 [0049.497] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", lpString2="MSOSVINT.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL" [0049.497] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 0 [0049.497] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0049.497] FindNextFileA (in: hFindFile=0x2d8078, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 1 [0049.497] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.497] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOSV.DLL") returned -1 [0049.497] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOSV.DLL") returned -1 [0049.497] lstrcmpiA (lpString1="", lpString2="MSOSV.DLL") returned -1 [0049.497] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*") returned="*.*" [0049.497] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\" [0049.497] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\") returned="" [0049.498] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\HOW TO DECRYPT FILES.txt" [0049.498] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\how to decrypt files.txt")) returned 0xffffffff [0049.498] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0049.499] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.499] CloseHandle (hObject=0x8c) returned 1 [0049.499] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", lpString2="MSOSV.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL" [0049.499] FindNextFileA (in: hFindFile=0x2d8078, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 0 [0049.500] FindClose (in: hFindFile=0x2d8078 | out: hFindFile=0x2d8078) returned 1 [0049.500] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0049.500] lstrcmpA (lpString1=".", lpString2="Web Server Extensions") returned -1 [0049.500] lstrcmpA (lpString1="..", lpString2="Web Server Extensions") returned -1 [0049.500] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0049.500] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="Web Server Extensions" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions" [0049.500] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8390, cFileName=".", cAlternateFileName="")) returned 0x2d8090 [0049.501] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.501] FindNextFileA (in: hFindFile=0x2d8090, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.501] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.501] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.501] FindNextFileA (in: hFindFile=0x2d8090, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0049.501] lstrcmpA (lpString1=".", lpString2="14") returned -1 [0049.501] lstrcmpA (lpString1="..", lpString2="14") returned -1 [0049.501] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*") returned="*.*" [0049.501] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", lpString2="14" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14" [0049.501] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2d80d0 [0049.502] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.502] FindNextFileA (in: hFindFile=0x2d80d0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.502] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.502] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.502] FindNextFileA (in: hFindFile=0x2d80d0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 1 [0049.502] lstrcmpA (lpString1=".", lpString2="BIN") returned -1 [0049.502] lstrcmpA (lpString1="..", lpString2="BIN") returned -1 [0049.502] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*") returned="*.*" [0049.502] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", lpString2="BIN" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN" [0049.502] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2db3c0, dwReserved1=0x2db3bb, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0049.503] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.503] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.503] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.503] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.503] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0049.503] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0049.503] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0049.503] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*") returned="*.*" [0049.503] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", lpString2="1033" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033" [0049.503] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dc3c8, dwReserved1=0x2dc3c3, cFileName=".", cAlternateFileName="")) returned 0x2d8030 [0049.504] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.504] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.504] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.504] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.504] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 1 [0049.504] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0049.504] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FPEXT.MSG") returned -1 [0049.504] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FPEXT.MSG") returned 1 [0049.504] lstrcmpiA (lpString1="", lpString2="FPEXT.MSG") returned -1 [0049.504] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*") returned="*.*" [0049.504] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\" [0049.504] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\") returned="" [0049.504] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\HOW TO DECRYPT FILES.txt" [0049.504] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\how to decrypt files.txt")) returned 0xffffffff [0049.504] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0049.506] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.506] CloseHandle (hObject=0x98) returned 1 [0049.506] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", lpString2="FPEXT.MSG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" [0049.506] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 0 [0049.506] FindClose (in: hFindFile=0x2d8030 | out: hFindFile=0x2d8030) returned 1 [0049.507] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c366f00, ftCreationTime.dwHighDateTime=0x1cac0be, ftLastAccessTime.dwLowDateTime=0x6193ae30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c366f00, ftLastWriteTime.dwHighDateTime=0x1cac0be, nFileSizeHigh=0x0, nFileSizeLow=0x267d78, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0049.507] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0049.507] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FPSRVUTL.DLL") returned -1 [0049.507] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FPSRVUTL.DLL") returned 1 [0049.507] lstrcmpiA (lpString1="", lpString2="FPSRVUTL.DLL") returned -1 [0049.507] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*") returned="*.*" [0049.507] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\" [0049.507] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\") returned="" [0049.507] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\HOW TO DECRYPT FILES.txt" [0049.507] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\how to decrypt files.txt")) returned 0xffffffff [0049.507] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0049.508] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.508] CloseHandle (hObject=0x94) returned 1 [0049.509] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", lpString2="FPSRVUTL.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" [0049.509] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x2d8410, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 1 [0049.509] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0049.509] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FPWEC.DLL") returned -1 [0049.509] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FPWEC.DLL") returned 1 [0049.509] lstrcmpiA (lpString1="", lpString2="FPWEC.DLL") returned -1 [0049.509] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned="FPSRVUTL.DLL" [0049.509] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\" [0049.509] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\" | out: pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\") returned="" [0049.509] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\HOW TO DECRYPT FILES.txt" [0049.510] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\how to decrypt files.txt")) returned 0x20 [0049.510] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x2d8410, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 0 [0049.510] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0049.510] FindNextFileA (in: hFindFile=0x2d80d0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0 [0049.510] FindClose (in: hFindFile=0x2d80d0 | out: hFindFile=0x2d80d0) returned 1 [0049.510] FindNextFileA (in: hFindFile=0x2d8090, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0049.510] FindClose (in: hFindFile=0x2d8090 | out: hFindFile=0x2d8090) returned 1 [0049.510] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0049.510] FindClose (in: hFindFile=0x2d6f58 | out: hFindFile=0x2d6f58) returned 1 [0049.510] FindNextFileA (in: hFindFile=0x2d6fa8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x3, cFileName="Services", cAlternateFileName="")) returned 1 [0049.510] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0049.511] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0049.511] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\*.*") returned="*.*" [0049.511] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650057, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2d6f58 [0049.511] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.511] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.511] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.511] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.511] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0049.511] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0049.511] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="verisign.bmp") returned -1 [0049.511] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="verisign.bmp") returned -1 [0049.511] lstrcmpiA (lpString1="", lpString2="verisign.bmp") returned -1 [0049.511] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Services\\*.*") returned="*.*" [0049.511] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\Services\\" | out: lpString1="C:\\Program Files\\Common Files\\Services\\") returned="C:\\Program Files\\Common Files\\Services\\" [0049.511] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\Services\\" | out: pszPath="C:\\Program Files\\Common Files\\Services\\") returned="" [0049.514] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.515] CloseHandle (hObject=0x88) returned 1 [0049.515] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0049.515] FindClose (in: hFindFile=0x2d6f58 | out: hFindFile=0x2d6f58) returned 1 [0049.515] FindNextFileA (in: hFindFile=0x2d6fa8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddbfb20, ftCreationTime.dwHighDateTime=0x1d5abd2, ftLastAccessTime.dwLowDateTime=0x7a2f6540, ftLastAccessTime.dwHighDateTime=0x1d5a63d, ftLastWriteTime.dwLowDateTime=0x7a2f6540, ftLastWriteTime.dwHighDateTime=0x1d5a63d, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="skype.exe", cAlternateFileName="")) returned 1 [0049.515] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0049.515] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="skype.exe") returned -1 [0049.515] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="skype.exe") returned -1 [0049.515] lstrcmpiA (lpString1="", lpString2="skype.exe") returned -1 [0049.515] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\*.*") returned="*.*" [0049.515] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\" | out: lpString1="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0049.515] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\" | out: pszPath="C:\\Program Files\\Common Files\\") returned="" [0049.515] FindNextFileA (in: hFindFile=0x2d6fa8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0049.516] lstrcmpA (lpString1=".", lpString2="SpeechEngines") returned -1 [0049.516] lstrcmpA (lpString1="..", lpString2="SpeechEngines") returned -1 [0049.516] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\skype.exe") returned="skype.exe" [0049.516] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x2d805c, cFileName=".", cAlternateFileName="")) returned 0x2d6f58 [0049.516] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.516] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.516] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.516] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.516] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0049.516] lstrcmpA (lpString1=".", lpString2="Microsoft") returned -1 [0049.516] lstrcmpA (lpString1="..", lpString2="Microsoft") returned -1 [0049.516] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\*.*") returned="*.*" [0049.516] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0049.517] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.517] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.517] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.518] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.518] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 1 [0049.518] lstrcmpA (lpString1=".", lpString2="TTS20") returned -1 [0049.518] lstrcmpA (lpString1="..", lpString2="TTS20") returned -1 [0049.518] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*") returned="*.*" [0049.518] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2d80b8 [0049.518] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.518] FindNextFileA (in: hFindFile=0x2d80b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.518] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.518] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.518] FindNextFileA (in: hFindFile=0x2d80b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0049.518] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0049.518] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0049.518] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*") returned="*.*" [0049.518] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2db3c0, dwReserved1=0x2db3bb, cFileName=".", cAlternateFileName="")) returned 0x2d8030 [0049.519] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.519] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.519] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.519] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.519] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="enu-dsk", cAlternateFileName="")) returned 1 [0049.519] lstrcmpA (lpString1=".", lpString2="enu-dsk") returned -1 [0049.519] lstrcmpA (lpString1="..", lpString2="enu-dsk") returned -1 [0049.519] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*") returned="*.*" [0049.519] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2dc3c8, dwReserved1=0x2dc3c3, cFileName=".", cAlternateFileName="")) returned 0x2d8070 [0049.519] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.519] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.519] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.519] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.519] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 0 [0049.520] FindClose (in: hFindFile=0x2d8070 | out: hFindFile=0x2d8070) returned 1 [0049.520] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84877a0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc84877a0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5b400, dwReserved0=0x6e0065, dwReserved1=0x3, cFileName="MSTTSFrontendENU.dll", cAlternateFileName="")) returned 1 [0049.520] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0049.520] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSTTSFrontendENU.dll") returned -1 [0049.520] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTTSFrontendENU.dll") returned -1 [0049.520] lstrcmpiA (lpString1="", lpString2="MSTTSFrontendENU.dll") returned -1 [0049.520] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*") returned="*.*" [0049.520] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" [0049.520] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned="" [0049.521] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0049.521] CloseHandle (hObject=0xffffffff) returned 0 [0049.521] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x2d83e0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 1 [0049.521] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0049.521] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSTTSLoc.dll.mui") returned -1 [0049.521] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTTSLoc.dll.mui") returned -1 [0049.521] lstrcmpiA (lpString1="", lpString2="MSTTSLoc.dll.mui") returned -1 [0049.521] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned="MSTTSFrontendENU.dll" [0049.521] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" [0049.521] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned="" [0049.521] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0049.521] CloseHandle (hObject=0xffffffff) returned 0 [0049.521] FindNextFileA (in: hFindFile=0x2d8030, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x2d83e0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 0 [0049.521] FindClose (in: hFindFile=0x2d8030 | out: hFindFile=0x2d8030) returned 1 [0049.522] FindNextFileA (in: hFindFile=0x2d80b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc536f5be, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc536f5be, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x36fbb600, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="MSTTSCommon.dll", cAlternateFileName="")) returned 1 [0049.522] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.523] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSTTSCommon.dll") returned -1 [0049.523] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTTSCommon.dll") returned -1 [0049.523] lstrcmpiA (lpString1="", lpString2="MSTTSCommon.dll") returned -1 [0049.523] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*") returned="*.*" [0049.523] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" [0049.523] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="" [0049.523] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0049.523] CloseHandle (hObject=0xffffffff) returned 0 [0049.523] FindNextFileA (in: hFindFile=0x2d80b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc982ab94, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc982ab94, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3702e1f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0x0, dwReserved1=0x2d83d8, cFileName="MSTTSEngine.dll", cAlternateFileName="")) returned 1 [0049.523] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.523] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSTTSEngine.dll") returned -1 [0049.523] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTTSEngine.dll") returned -1 [0049.523] lstrcmpiA (lpString1="", lpString2="MSTTSEngine.dll") returned -1 [0049.523] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll") returned="MSTTSCommon.dll" [0049.523] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" [0049.523] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="" [0049.524] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0049.524] CloseHandle (hObject=0xffffffff) returned 0 [0049.524] FindNextFileA (in: hFindFile=0x2d80b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2d83d8, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 1 [0049.524] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.524] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSTTSLoc.dll") returned -1 [0049.524] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTTSLoc.dll") returned -1 [0049.524] lstrcmpiA (lpString1="", lpString2="MSTTSLoc.dll") returned -1 [0049.524] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll") returned="MSTTSEngine.dll" [0049.524] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: lpString1="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" [0049.524] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" | out: pszPath="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="" [0049.524] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0049.524] CloseHandle (hObject=0xffffffff) returned 0 [0049.524] FindNextFileA (in: hFindFile=0x2d80b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2d83d8, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 0 [0049.525] FindClose (in: hFindFile=0x2d80b8 | out: hFindFile=0x2d80b8) returned 1 [0049.525] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 0 [0049.525] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0049.525] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0049.525] FindClose (in: hFindFile=0x2d6f58 | out: hFindFile=0x2d6f58) returned 1 [0049.525] FindNextFileA (in: hFindFile=0x2d6fa8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x700053, dwReserved1=0x3, cFileName="System", cAlternateFileName="")) returned 1 [0049.525] lstrcmpA (lpString1=".", lpString2="System") returned -1 [0049.525] lstrcmpA (lpString1="..", lpString2="System") returned -1 [0049.525] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\*.*") returned="*.*" [0049.525] lstrlenA (lpString="C:\\Program Files\\Common Files\\System") returned 36 [0049.525] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2d6f58 [0049.532] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.532] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.532] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.532] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.532] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1 [0049.532] lstrcmpA (lpString1=".", lpString2="ado") returned -1 [0049.532] lstrcmpA (lpString1="..", lpString2="ado") returned -1 [0049.532] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\*.*") returned="*.*" [0049.532] lstrlenA (lpString="C:\\Program Files\\Common Files\\System\\ado") returned 40 [0049.532] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2d8058 [0049.534] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.534] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.534] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.534] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.534] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c91ed4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4c91ed4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa06f97f7, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0049.534] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.541] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="adojavas.inc") returned 1 [0049.541] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="adojavas.inc") returned 1 [0049.541] lstrcmpiA (lpString1="", lpString2="adojavas.inc") returned -1 [0049.541] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\*.*") returned="*.*" [0049.541] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0049.541] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0049.541] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0xffffffff [0049.541] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0049.542] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0049.542] WriteFile (in: hFile=0x8c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0049.543] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.543] CloseHandle (hObject=0x8c) returned 1 [0049.543] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="adojavas.inc" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" [0049.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.zip") returned 0 [0049.543] lstrlenA (lpString="*.zip") returned 5 [0049.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.rar") returned 0 [0049.543] lstrlenA (lpString="*.rar") returned 5 [0049.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.7z") returned 0 [0049.543] lstrlenA (lpString="*.7z") returned 4 [0049.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.tar") returned 0 [0049.544] lstrlenA (lpString="*.tar") returned 5 [0049.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.gzip") returned 0 [0049.544] lstrlenA (lpString="*.gzip") returned 6 [0049.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.jpg") returned 0 [0049.544] lstrlenA (lpString="*.jpg") returned 5 [0049.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.jpeg") returned 0 [0049.544] lstrlenA (lpString="*.jpeg") returned 6 [0049.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.psd") returned 0 [0049.544] lstrlenA (lpString="*.psd") returned 5 [0049.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.gif") returned 0 [0049.544] lstrlenA (lpString="*.gif") returned 5 [0049.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.doc") returned 0 [0049.544] lstrlenA (lpString="*.doc") returned 5 [0049.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.docx") returned 0 [0049.544] lstrlenA (lpString="*.docx") returned 6 [0049.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.xls") returned 0 [0049.544] lstrlenA (lpString="*.xls") returned 5 [0049.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.xlsx") returned 0 [0049.544] lstrlenA (lpString="*.xlsx") returned 6 [0049.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.ppt") returned 0 [0049.544] lstrlenA (lpString="*.ppt") returned 5 [0049.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.pptx") returned 0 [0049.544] lstrlenA (lpString="*.pptx") returned 6 [0049.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.pdf") returned 0 [0049.544] lstrlenA (lpString="*.pdf") returned 5 [0049.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.mov") returned 0 [0049.544] lstrlenA (lpString="*.mov") returned 5 [0049.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.m2v") returned 0 [0049.545] lstrlenA (lpString="*.m2v") returned 5 [0049.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.3gp") returned 0 [0049.545] lstrlenA (lpString="*.3gp") returned 5 [0049.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.mpeg") returned 0 [0049.545] lstrlenA (lpString="*.mpeg") returned 6 [0049.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.mpg") returned 0 [0049.545] lstrlenA (lpString="*.mpg") returned 5 [0049.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.flv") returned 0 [0049.545] lstrlenA (lpString="*.flv") returned 5 [0049.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.avi") returned 0 [0049.545] lstrlenA (lpString="*.avi") returned 5 [0049.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.mp4") returned 0 [0049.545] lstrlenA (lpString="*.mp4") returned 5 [0049.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.wmv") returned 0 [0049.545] lstrlenA (lpString="*.wmv") returned 5 [0049.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.divx") returned 0 [0049.545] lstrlenA (lpString="*.divx") returned 6 [0049.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.mkv") returned 0 [0049.545] lstrlenA (lpString="*.mkv") returned 5 [0049.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.mp3") returned 0 [0049.545] lstrlenA (lpString="*.mp3") returned 5 [0049.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.wav") returned 0 [0049.545] lstrlenA (lpString="*.wav") returned 5 [0049.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.flac") returned 0 [0049.545] lstrlenA (lpString="*.flac") returned 6 [0049.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.ape") returned 0 [0049.545] lstrlenA (lpString="*.ape") returned 5 [0049.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.wma") returned 0 [0049.546] lstrlenA (lpString="*.wma") returned 5 [0049.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.ac3") returned 0 [0049.546] lstrlenA (lpString="*.ac3") returned 5 [0049.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", pszSpec="*.mxf") returned 0 [0049.546] lstrlenA (lpString="*.mxf") returned 5 [0049.546] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4085067, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4085067, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa0661283, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3a67, dwReserved0=0x0, dwReserved1=0x2d8350, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0049.546] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.546] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="adovbs.inc") returned 1 [0049.546] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="adovbs.inc") returned 1 [0049.546] lstrcmpiA (lpString1="", lpString2="adovbs.inc") returned -1 [0049.546] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned="adojavas.inc" [0049.546] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0049.546] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0049.546] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0049.546] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0049.546] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="adovbs.inc" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" [0049.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.zip") returned 0 [0049.546] lstrlenA (lpString="*.zip") returned 5 [0049.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.rar") returned 0 [0049.546] lstrlenA (lpString="*.rar") returned 5 [0049.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.7z") returned 0 [0049.546] lstrlenA (lpString="*.7z") returned 4 [0049.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.tar") returned 0 [0049.547] lstrlenA (lpString="*.tar") returned 5 [0049.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.gzip") returned 0 [0049.547] lstrlenA (lpString="*.gzip") returned 6 [0049.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.jpg") returned 0 [0049.547] lstrlenA (lpString="*.jpg") returned 5 [0049.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.jpeg") returned 0 [0049.547] lstrlenA (lpString="*.jpeg") returned 6 [0049.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.psd") returned 0 [0049.547] lstrlenA (lpString="*.psd") returned 5 [0049.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.gif") returned 0 [0049.547] lstrlenA (lpString="*.gif") returned 5 [0049.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.doc") returned 0 [0049.547] lstrlenA (lpString="*.doc") returned 5 [0049.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.docx") returned 0 [0049.547] lstrlenA (lpString="*.docx") returned 6 [0049.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.xls") returned 0 [0049.547] lstrlenA (lpString="*.xls") returned 5 [0049.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.xlsx") returned 0 [0049.547] lstrlenA (lpString="*.xlsx") returned 6 [0049.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.ppt") returned 0 [0049.547] lstrlenA (lpString="*.ppt") returned 5 [0049.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.pptx") returned 0 [0049.547] lstrlenA (lpString="*.pptx") returned 6 [0049.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.pdf") returned 0 [0049.547] lstrlenA (lpString="*.pdf") returned 5 [0049.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.mov") returned 0 [0049.547] lstrlenA (lpString="*.mov") returned 5 [0049.547] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.m2v") returned 0 [0049.547] lstrlenA (lpString="*.m2v") returned 5 [0049.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.3gp") returned 0 [0049.548] lstrlenA (lpString="*.3gp") returned 5 [0049.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.mpeg") returned 0 [0049.548] lstrlenA (lpString="*.mpeg") returned 6 [0049.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.mpg") returned 0 [0049.548] lstrlenA (lpString="*.mpg") returned 5 [0049.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.flv") returned 0 [0049.548] lstrlenA (lpString="*.flv") returned 5 [0049.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.avi") returned 0 [0049.548] lstrlenA (lpString="*.avi") returned 5 [0049.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.mp4") returned 0 [0049.548] lstrlenA (lpString="*.mp4") returned 5 [0049.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.wmv") returned 0 [0049.548] lstrlenA (lpString="*.wmv") returned 5 [0049.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.divx") returned 0 [0049.548] lstrlenA (lpString="*.divx") returned 6 [0049.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.mkv") returned 0 [0049.548] lstrlenA (lpString="*.mkv") returned 5 [0049.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.mp3") returned 0 [0049.548] lstrlenA (lpString="*.mp3") returned 5 [0049.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.wav") returned 0 [0049.548] lstrlenA (lpString="*.wav") returned 5 [0049.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.flac") returned 0 [0049.548] lstrlenA (lpString="*.flac") returned 6 [0049.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.ape") returned 0 [0049.548] lstrlenA (lpString="*.ape") returned 5 [0049.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.wma") returned 0 [0049.548] lstrlenA (lpString="*.wma") returned 5 [0049.548] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.ac3") returned 0 [0049.548] lstrlenA (lpString="*.ac3") returned 5 [0049.549] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", pszSpec="*.mxf") returned 0 [0049.549] lstrlenA (lpString="*.mxf") returned 5 [0049.549] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0049.549] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0049.549] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0049.549] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned="adovbs.inc" [0049.549] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\en-US") returned="C:\\Program Files\\Common Files\\System\\ado\\en-US" [0049.549] lstrlenA (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US") returned 46 [0049.549] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d811a, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0049.549] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.549] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.549] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.549] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.549] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0049.549] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.549] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msader15.dll.mui") returned -1 [0049.549] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msader15.dll.mui") returned -1 [0049.549] lstrcmpiA (lpString1="", lpString2="msader15.dll.mui") returned -1 [0049.550] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*") returned="*.*" [0049.550] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\ado\\en-US\\" [0049.550] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\en-US\\") returned="" [0049.550] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\en-US\\HOW TO DECRYPT FILES.txt" [0049.550] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0049.550] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.550] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0049.550] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0049.552] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.552] CloseHandle (hObject=0x90) returned 1 [0049.552] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", lpString2="msader15.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" [0049.552] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.zip") returned 0 [0049.552] lstrlenA (lpString="*.zip") returned 5 [0049.552] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.rar") returned 0 [0049.552] lstrlenA (lpString="*.rar") returned 5 [0049.552] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.7z") returned 0 [0049.552] lstrlenA (lpString="*.7z") returned 4 [0049.552] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.tar") returned 0 [0049.553] lstrlenA (lpString="*.tar") returned 5 [0049.553] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.gzip") returned 0 [0049.553] lstrlenA (lpString="*.gzip") returned 6 [0049.553] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.jpg") returned 0 [0049.553] lstrlenA (lpString="*.jpg") returned 5 [0049.553] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.jpeg") returned 0 [0049.553] lstrlenA (lpString="*.jpeg") returned 6 [0049.553] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.psd") returned 0 [0049.553] lstrlenA (lpString="*.psd") returned 5 [0049.553] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.gif") returned 0 [0049.553] lstrlenA (lpString="*.gif") returned 5 [0049.553] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.doc") returned 0 [0049.553] lstrlenA (lpString="*.doc") returned 5 [0049.553] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.docx") returned 0 [0049.553] lstrlenA (lpString="*.docx") returned 6 [0049.553] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.xls") returned 0 [0049.553] lstrlenA (lpString="*.xls") returned 5 [0049.553] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.xlsx") returned 0 [0049.553] lstrlenA (lpString="*.xlsx") returned 6 [0049.553] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.ppt") returned 0 [0049.553] lstrlenA (lpString="*.ppt") returned 5 [0049.553] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.pptx") returned 0 [0049.553] lstrlenA (lpString="*.pptx") returned 6 [0049.553] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.pdf") returned 0 [0049.553] lstrlenA (lpString="*.pdf") returned 5 [0049.553] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.mov") returned 0 [0049.553] lstrlenA (lpString="*.mov") returned 5 [0049.553] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.m2v") returned 0 [0049.553] lstrlenA (lpString="*.m2v") returned 5 [0049.553] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.3gp") returned 0 [0049.554] lstrlenA (lpString="*.3gp") returned 5 [0049.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.mpeg") returned 0 [0049.554] lstrlenA (lpString="*.mpeg") returned 6 [0049.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.mpg") returned 0 [0049.554] lstrlenA (lpString="*.mpg") returned 5 [0049.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.flv") returned 0 [0049.554] lstrlenA (lpString="*.flv") returned 5 [0049.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.avi") returned 0 [0049.554] lstrlenA (lpString="*.avi") returned 5 [0049.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.mp4") returned 0 [0049.554] lstrlenA (lpString="*.mp4") returned 5 [0049.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.wmv") returned 0 [0049.554] lstrlenA (lpString="*.wmv") returned 5 [0049.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.divx") returned 0 [0049.554] lstrlenA (lpString="*.divx") returned 6 [0049.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.mkv") returned 0 [0049.554] lstrlenA (lpString="*.mkv") returned 5 [0049.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.mp3") returned 0 [0049.554] lstrlenA (lpString="*.mp3") returned 5 [0049.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.wav") returned 0 [0049.554] lstrlenA (lpString="*.wav") returned 5 [0049.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.flac") returned 0 [0049.554] lstrlenA (lpString="*.flac") returned 6 [0049.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.ape") returned 0 [0049.554] lstrlenA (lpString="*.ape") returned 5 [0049.554] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.wma") returned 0 [0049.554] lstrlenA (lpString="*.wma") returned 5 [0049.555] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.ac3") returned 0 [0049.555] lstrlenA (lpString="*.ac3") returned 5 [0049.555] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", pszSpec="*.mxf") returned 0 [0049.555] lstrlenA (lpString="*.mxf") returned 5 [0049.555] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0 [0049.555] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0049.555] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6129cc5, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x6129cc5, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x80fe7780, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0049.555] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.555] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msader15.dll") returned -1 [0049.555] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msader15.dll") returned -1 [0049.555] lstrcmpiA (lpString1="", lpString2="msader15.dll") returned -1 [0049.555] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\*.*") returned="*.*" [0049.555] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0049.555] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0049.555] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0049.555] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0049.555] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msader15.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" [0049.555] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.zip") returned 0 [0049.556] lstrlenA (lpString="*.zip") returned 5 [0049.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.rar") returned 0 [0049.556] lstrlenA (lpString="*.rar") returned 5 [0049.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.7z") returned 0 [0049.556] lstrlenA (lpString="*.7z") returned 4 [0049.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.tar") returned 0 [0049.556] lstrlenA (lpString="*.tar") returned 5 [0049.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.gzip") returned 0 [0049.556] lstrlenA (lpString="*.gzip") returned 6 [0049.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.jpg") returned 0 [0049.556] lstrlenA (lpString="*.jpg") returned 5 [0049.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.jpeg") returned 0 [0049.556] lstrlenA (lpString="*.jpeg") returned 6 [0049.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.psd") returned 0 [0049.556] lstrlenA (lpString="*.psd") returned 5 [0049.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.gif") returned 0 [0049.556] lstrlenA (lpString="*.gif") returned 5 [0049.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.doc") returned 0 [0049.556] lstrlenA (lpString="*.doc") returned 5 [0049.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.docx") returned 0 [0049.556] lstrlenA (lpString="*.docx") returned 6 [0049.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.xls") returned 0 [0049.556] lstrlenA (lpString="*.xls") returned 5 [0049.556] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.xlsx") returned 0 [0049.556] lstrlenA (lpString="*.xlsx") returned 6 [0049.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.ppt") returned 0 [0049.557] lstrlenA (lpString="*.ppt") returned 5 [0049.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.pptx") returned 0 [0049.557] lstrlenA (lpString="*.pptx") returned 6 [0049.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.pdf") returned 0 [0049.557] lstrlenA (lpString="*.pdf") returned 5 [0049.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.mov") returned 0 [0049.557] lstrlenA (lpString="*.mov") returned 5 [0049.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.m2v") returned 0 [0049.557] lstrlenA (lpString="*.m2v") returned 5 [0049.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.3gp") returned 0 [0049.557] lstrlenA (lpString="*.3gp") returned 5 [0049.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.mpeg") returned 0 [0049.557] lstrlenA (lpString="*.mpeg") returned 6 [0049.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.mpg") returned 0 [0049.557] lstrlenA (lpString="*.mpg") returned 5 [0049.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.flv") returned 0 [0049.557] lstrlenA (lpString="*.flv") returned 5 [0049.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.avi") returned 0 [0049.557] lstrlenA (lpString="*.avi") returned 5 [0049.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.mp4") returned 0 [0049.557] lstrlenA (lpString="*.mp4") returned 5 [0049.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.wmv") returned 0 [0049.557] lstrlenA (lpString="*.wmv") returned 5 [0049.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.divx") returned 0 [0049.557] lstrlenA (lpString="*.divx") returned 6 [0049.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.mkv") returned 0 [0049.557] lstrlenA (lpString="*.mkv") returned 5 [0049.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.mp3") returned 0 [0049.557] lstrlenA (lpString="*.mp3") returned 5 [0049.557] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.wav") returned 0 [0049.558] lstrlenA (lpString="*.wav") returned 5 [0049.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.flac") returned 0 [0049.558] lstrlenA (lpString="*.flac") returned 6 [0049.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.ape") returned 0 [0049.558] lstrlenA (lpString="*.ape") returned 5 [0049.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.wma") returned 0 [0049.558] lstrlenA (lpString="*.wma") returned 5 [0049.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.ac3") returned 0 [0049.558] lstrlenA (lpString="*.ac3") returned 5 [0049.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", pszSpec="*.mxf") returned 0 [0049.558] lstrlenA (lpString="*.mxf") returned 5 [0049.558] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7da10b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f7da10b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f80026c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0049.558] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.558] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msado15.dll") returned -1 [0049.558] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msado15.dll") returned -1 [0049.558] lstrcmpiA (lpString1="", lpString2="msado15.dll") returned -1 [0049.558] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned="msader15.dll" [0049.558] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0049.558] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0049.558] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0049.558] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0049.558] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msado15.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" [0049.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.zip") returned 0 [0049.558] lstrlenA (lpString="*.zip") returned 5 [0049.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.rar") returned 0 [0049.558] lstrlenA (lpString="*.rar") returned 5 [0049.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.7z") returned 0 [0049.558] lstrlenA (lpString="*.7z") returned 4 [0049.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.tar") returned 0 [0049.558] lstrlenA (lpString="*.tar") returned 5 [0049.558] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.gzip") returned 0 [0049.559] lstrlenA (lpString="*.gzip") returned 6 [0049.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.jpg") returned 0 [0049.559] lstrlenA (lpString="*.jpg") returned 5 [0049.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.jpeg") returned 0 [0049.559] lstrlenA (lpString="*.jpeg") returned 6 [0049.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.psd") returned 0 [0049.559] lstrlenA (lpString="*.psd") returned 5 [0049.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.gif") returned 0 [0049.559] lstrlenA (lpString="*.gif") returned 5 [0049.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.doc") returned 0 [0049.559] lstrlenA (lpString="*.doc") returned 5 [0049.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.docx") returned 0 [0049.559] lstrlenA (lpString="*.docx") returned 6 [0049.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.xls") returned 0 [0049.559] lstrlenA (lpString="*.xls") returned 5 [0049.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.xlsx") returned 0 [0049.559] lstrlenA (lpString="*.xlsx") returned 6 [0049.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.ppt") returned 0 [0049.559] lstrlenA (lpString="*.ppt") returned 5 [0049.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.pptx") returned 0 [0049.559] lstrlenA (lpString="*.pptx") returned 6 [0049.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.pdf") returned 0 [0049.559] lstrlenA (lpString="*.pdf") returned 5 [0049.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.mov") returned 0 [0049.559] lstrlenA (lpString="*.mov") returned 5 [0049.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.m2v") returned 0 [0049.559] lstrlenA (lpString="*.m2v") returned 5 [0049.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.3gp") returned 0 [0049.559] lstrlenA (lpString="*.3gp") returned 5 [0049.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.mpeg") returned 0 [0049.559] lstrlenA (lpString="*.mpeg") returned 6 [0049.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.mpg") returned 0 [0049.559] lstrlenA (lpString="*.mpg") returned 5 [0049.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.flv") returned 0 [0049.559] lstrlenA (lpString="*.flv") returned 5 [0049.559] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.avi") returned 0 [0049.559] lstrlenA (lpString="*.avi") returned 5 [0049.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.mp4") returned 0 [0049.560] lstrlenA (lpString="*.mp4") returned 5 [0049.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.wmv") returned 0 [0049.560] lstrlenA (lpString="*.wmv") returned 5 [0049.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.divx") returned 0 [0049.560] lstrlenA (lpString="*.divx") returned 6 [0049.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.mkv") returned 0 [0049.560] lstrlenA (lpString="*.mkv") returned 5 [0049.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.mp3") returned 0 [0049.560] lstrlenA (lpString="*.mp3") returned 5 [0049.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.wav") returned 0 [0049.560] lstrlenA (lpString="*.wav") returned 5 [0049.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.flac") returned 0 [0049.560] lstrlenA (lpString="*.flac") returned 6 [0049.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.ape") returned 0 [0049.560] lstrlenA (lpString="*.ape") returned 5 [0049.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.wma") returned 0 [0049.560] lstrlenA (lpString="*.wma") returned 5 [0049.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.ac3") returned 0 [0049.560] lstrlenA (lpString="*.ac3") returned 5 [0049.560] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", pszSpec="*.mxf") returned 0 [0049.560] lstrlenA (lpString="*.mxf") returned 5 [0049.560] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0049.560] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.560] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msado20.tlb") returned -1 [0049.560] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msado20.tlb") returned -1 [0049.560] lstrcmpiA (lpString1="", lpString2="msado20.tlb") returned -1 [0049.560] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned="msado15.dll" [0049.560] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0049.560] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0049.560] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0049.560] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0049.560] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msado20.tlb" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" [0049.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.zip") returned 0 [0049.561] lstrlenA (lpString="*.zip") returned 5 [0049.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.rar") returned 0 [0049.561] lstrlenA (lpString="*.rar") returned 5 [0049.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.7z") returned 0 [0049.561] lstrlenA (lpString="*.7z") returned 4 [0049.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.tar") returned 0 [0049.561] lstrlenA (lpString="*.tar") returned 5 [0049.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.gzip") returned 0 [0049.561] lstrlenA (lpString="*.gzip") returned 6 [0049.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.jpg") returned 0 [0049.561] lstrlenA (lpString="*.jpg") returned 5 [0049.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.jpeg") returned 0 [0049.561] lstrlenA (lpString="*.jpeg") returned 6 [0049.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.psd") returned 0 [0049.561] lstrlenA (lpString="*.psd") returned 5 [0049.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.gif") returned 0 [0049.561] lstrlenA (lpString="*.gif") returned 5 [0049.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.doc") returned 0 [0049.561] lstrlenA (lpString="*.doc") returned 5 [0049.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.docx") returned 0 [0049.561] lstrlenA (lpString="*.docx") returned 6 [0049.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.xls") returned 0 [0049.561] lstrlenA (lpString="*.xls") returned 5 [0049.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.xlsx") returned 0 [0049.561] lstrlenA (lpString="*.xlsx") returned 6 [0049.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.ppt") returned 0 [0049.561] lstrlenA (lpString="*.ppt") returned 5 [0049.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.pptx") returned 0 [0049.561] lstrlenA (lpString="*.pptx") returned 6 [0049.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.pdf") returned 0 [0049.561] lstrlenA (lpString="*.pdf") returned 5 [0049.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.mov") returned 0 [0049.561] lstrlenA (lpString="*.mov") returned 5 [0049.561] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.m2v") returned 0 [0049.562] lstrlenA (lpString="*.m2v") returned 5 [0049.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.3gp") returned 0 [0049.562] lstrlenA (lpString="*.3gp") returned 5 [0049.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.mpeg") returned 0 [0049.562] lstrlenA (lpString="*.mpeg") returned 6 [0049.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.mpg") returned 0 [0049.562] lstrlenA (lpString="*.mpg") returned 5 [0049.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.flv") returned 0 [0049.562] lstrlenA (lpString="*.flv") returned 5 [0049.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.avi") returned 0 [0049.562] lstrlenA (lpString="*.avi") returned 5 [0049.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.mp4") returned 0 [0049.562] lstrlenA (lpString="*.mp4") returned 5 [0049.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.wmv") returned 0 [0049.562] lstrlenA (lpString="*.wmv") returned 5 [0049.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.divx") returned 0 [0049.562] lstrlenA (lpString="*.divx") returned 6 [0049.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.mkv") returned 0 [0049.562] lstrlenA (lpString="*.mkv") returned 5 [0049.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.mp3") returned 0 [0049.562] lstrlenA (lpString="*.mp3") returned 5 [0049.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.wav") returned 0 [0049.562] lstrlenA (lpString="*.wav") returned 5 [0049.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.flac") returned 0 [0049.562] lstrlenA (lpString="*.flac") returned 6 [0049.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.ape") returned 0 [0049.562] lstrlenA (lpString="*.ape") returned 5 [0049.562] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.wma") returned 0 [0049.562] lstrlenA (lpString="*.wma") returned 5 [0049.563] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.ac3") returned 0 [0049.563] lstrlenA (lpString="*.ac3") returned 5 [0049.563] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", pszSpec="*.mxf") returned 0 [0049.563] lstrlenA (lpString="*.mxf") returned 5 [0049.563] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x12000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0049.563] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.563] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msado21.tlb") returned -1 [0049.563] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msado21.tlb") returned -1 [0049.563] lstrcmpiA (lpString1="", lpString2="msado21.tlb") returned -1 [0049.563] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned="msado20.tlb" [0049.563] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0049.563] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0049.563] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0049.563] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0049.563] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msado21.tlb" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" [0049.563] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.zip") returned 0 [0049.563] lstrlenA (lpString="*.zip") returned 5 [0049.563] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.rar") returned 0 [0049.563] lstrlenA (lpString="*.rar") returned 5 [0049.563] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.7z") returned 0 [0049.563] lstrlenA (lpString="*.7z") returned 4 [0049.563] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.tar") returned 0 [0049.563] lstrlenA (lpString="*.tar") returned 5 [0049.563] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.gzip") returned 0 [0049.563] lstrlenA (lpString="*.gzip") returned 6 [0049.563] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.jpg") returned 0 [0049.564] lstrlenA (lpString="*.jpg") returned 5 [0049.564] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.jpeg") returned 0 [0049.564] lstrlenA (lpString="*.jpeg") returned 6 [0049.564] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.psd") returned 0 [0049.564] lstrlenA (lpString="*.psd") returned 5 [0049.564] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.gif") returned 0 [0049.564] lstrlenA (lpString="*.gif") returned 5 [0049.564] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.doc") returned 0 [0049.564] lstrlenA (lpString="*.doc") returned 5 [0049.564] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.docx") returned 0 [0049.564] lstrlenA (lpString="*.docx") returned 6 [0049.564] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.xls") returned 0 [0049.564] lstrlenA (lpString="*.xls") returned 5 [0049.564] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.xlsx") returned 0 [0049.564] lstrlenA (lpString="*.xlsx") returned 6 [0049.564] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.ppt") returned 0 [0049.564] lstrlenA (lpString="*.ppt") returned 5 [0049.564] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.pptx") returned 0 [0049.564] lstrlenA (lpString="*.pptx") returned 6 [0049.564] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.pdf") returned 0 [0049.564] lstrlenA (lpString="*.pdf") returned 5 [0049.564] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.mov") returned 0 [0049.564] lstrlenA (lpString="*.mov") returned 5 [0049.564] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.m2v") returned 0 [0049.564] lstrlenA (lpString="*.m2v") returned 5 [0049.564] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.3gp") returned 0 [0049.564] lstrlenA (lpString="*.3gp") returned 5 [0049.564] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.mpeg") returned 0 [0049.564] lstrlenA (lpString="*.mpeg") returned 6 [0049.564] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.mpg") returned 0 [0049.565] lstrlenA (lpString="*.mpg") returned 5 [0049.565] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.flv") returned 0 [0049.565] lstrlenA (lpString="*.flv") returned 5 [0049.565] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.avi") returned 0 [0049.565] lstrlenA (lpString="*.avi") returned 5 [0049.565] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.mp4") returned 0 [0049.565] lstrlenA (lpString="*.mp4") returned 5 [0049.565] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.wmv") returned 0 [0049.565] lstrlenA (lpString="*.wmv") returned 5 [0049.565] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.divx") returned 0 [0049.565] lstrlenA (lpString="*.divx") returned 6 [0049.565] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.mkv") returned 0 [0049.565] lstrlenA (lpString="*.mkv") returned 5 [0049.565] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.mp3") returned 0 [0049.565] lstrlenA (lpString="*.mp3") returned 5 [0049.565] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.wav") returned 0 [0049.565] lstrlenA (lpString="*.wav") returned 5 [0049.565] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.flac") returned 0 [0049.565] lstrlenA (lpString="*.flac") returned 6 [0049.565] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.ape") returned 0 [0049.565] lstrlenA (lpString="*.ape") returned 5 [0049.565] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.wma") returned 0 [0049.565] lstrlenA (lpString="*.wma") returned 5 [0049.565] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.ac3") returned 0 [0049.565] lstrlenA (lpString="*.ac3") returned 5 [0049.565] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", pszSpec="*.mxf") returned 0 [0049.565] lstrlenA (lpString="*.mxf") returned 5 [0049.565] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0049.565] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.565] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msado25.tlb") returned -1 [0049.565] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msado25.tlb") returned -1 [0049.565] lstrcmpiA (lpString1="", lpString2="msado25.tlb") returned -1 [0049.565] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned="msado21.tlb" [0049.565] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0049.565] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0049.565] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0049.566] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0049.566] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msado25.tlb" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" [0049.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb", pszSpec="*.zip") returned 0 [0049.566] lstrlenA (lpString="*.zip") returned 5 [0049.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb", pszSpec="*.rar") returned 0 [0049.566] lstrlenA (lpString="*.rar") returned 5 [0049.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb", pszSpec="*.7z") returned 0 [0049.566] lstrlenA (lpString="*.7z") returned 4 [0049.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb", pszSpec="*.tar") returned 0 [0049.566] lstrlenA (lpString="*.tar") returned 5 [0049.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb", pszSpec="*.gzip") returned 0 [0049.566] lstrlenA (lpString="*.gzip") returned 6 [0049.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb", pszSpec="*.jpg") returned 0 [0049.566] lstrlenA (lpString="*.jpg") returned 5 [0049.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb", pszSpec="*.jpeg") returned 0 [0049.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb", pszSpec="*.psd") returned 0 [0049.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb", pszSpec="*.gif") returned 0 [0049.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb", pszSpec="*.doc") returned 0 [0049.566] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb", pszSpec="*.docx") returned 0 [0049.566] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0049.566] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.567] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msado26.tlb") returned -1 [0049.567] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msado26.tlb") returned -1 [0049.567] lstrcmpiA (lpString1="", lpString2="msado26.tlb") returned -1 [0049.567] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned="msado25.tlb" [0049.567] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0049.567] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0049.567] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0049.567] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0049.567] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msado26.tlb" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" [0049.567] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83436f83, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83436f83, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8345d0e3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0049.567] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.567] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msado27.tlb") returned -1 [0049.567] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msado27.tlb") returned -1 [0049.567] lstrcmpiA (lpString1="", lpString2="msado27.tlb") returned -1 [0049.567] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned="msado26.tlb" [0049.567] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0049.567] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0049.567] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0049.567] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0049.567] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msado27.tlb" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" [0049.567] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83483244, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0049.567] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.567] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msado28.tlb") returned -1 [0049.567] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msado28.tlb") returned -1 [0049.567] lstrcmpiA (lpString1="", lpString2="msado28.tlb") returned -1 [0049.567] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned="msado27.tlb" [0049.567] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0049.568] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0049.568] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0049.568] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0049.568] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msado28.tlb" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" [0049.568] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec495ee, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ec495ee, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ec6f74e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x72000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0049.568] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.568] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msadomd.dll") returned -1 [0049.568] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadomd.dll") returned -1 [0049.568] lstrcmpiA (lpString1="", lpString2="msadomd.dll") returned -1 [0049.568] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned="msado28.tlb" [0049.568] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0049.568] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0049.568] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0049.568] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0049.568] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msadomd.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" [0049.568] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a6a67, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x62a6a67, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x625a7ad, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0049.568] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.568] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msadomd28.tlb") returned -1 [0049.568] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadomd28.tlb") returned -1 [0049.568] lstrcmpiA (lpString1="", lpString2="msadomd28.tlb") returned -1 [0049.568] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned="msadomd.dll" [0049.568] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0049.568] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0049.568] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0049.568] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0049.568] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msadomd28.tlb" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" [0049.569] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad50fa2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ad50fa2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad50fa2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0049.569] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.569] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msador15.dll") returned -1 [0049.569] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msador15.dll") returned -1 [0049.569] lstrcmpiA (lpString1="", lpString2="msador15.dll") returned -1 [0049.569] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned="msadomd28.tlb" [0049.569] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0049.569] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0049.569] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0049.569] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0049.569] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msador15.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" [0049.569] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9debf8b5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9debf8b5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9dee5a15, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0049.569] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.569] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msadox.dll") returned -1 [0049.569] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadox.dll") returned -1 [0049.569] lstrcmpiA (lpString1="", lpString2="msadox.dll") returned -1 [0049.569] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned="msador15.dll" [0049.569] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0049.569] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0049.569] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0049.569] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0049.569] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msadox.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" [0049.569] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fd3080, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x5fd3080, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x5f60c69, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0049.569] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.570] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msadox28.tlb") returned -1 [0049.570] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadox28.tlb") returned -1 [0049.570] lstrcmpiA (lpString1="", lpString2="msadox28.tlb") returned -1 [0049.570] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned="msadox.dll" [0049.570] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0049.570] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0049.570] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0049.570] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0049.570] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msadox28.tlb" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" [0049.570] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0049.570] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.570] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msadrh15.dll") returned -1 [0049.570] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadrh15.dll") returned -1 [0049.570] lstrcmpiA (lpString1="", lpString2="msadrh15.dll") returned -1 [0049.570] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned="msadox28.tlb" [0049.570] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\ado\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\") returned="C:\\Program Files\\Common Files\\System\\ado\\" [0049.570] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\ado\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\ado\\") returned="" [0049.570] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" [0049.570] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ado\\how to decrypt files.txt")) returned 0x20 [0049.570] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\ado\\", lpString2="msadrh15.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll") returned="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" [0049.570] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 0 [0049.570] FindClose (in: hFindFile=0x2d8058 | out: hFindFile=0x2d8058) returned 1 [0049.571] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4f1c09, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf4f1c09, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x128ffb00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0049.571] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0049.571] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DirectDB.dll") returned 1 [0049.571] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DirectDB.dll") returned 1 [0049.571] lstrcmpiA (lpString1="", lpString2="DirectDB.dll") returned -1 [0049.571] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\*.*") returned="*.*" [0049.571] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\") returned="C:\\Program Files\\Common Files\\System\\" [0049.571] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\") returned="" [0049.571] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\HOW TO DECRYPT FILES.txt" [0049.571] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\how to decrypt files.txt")) returned 0xffffffff [0049.571] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0049.574] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.574] CloseHandle (hObject=0x88) returned 1 [0049.575] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\", lpString2="DirectDB.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned="C:\\Program Files\\Common Files\\System\\DirectDB.dll" [0049.575] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d82a0, cFileName="en-US", cAlternateFileName="")) returned 1 [0049.575] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0049.575] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0049.575] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned="DirectDB.dll" [0049.575] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Common Files\\System\\en-US") returned="C:\\Program Files\\Common Files\\System\\en-US" [0049.575] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d806a, cFileName=".", cAlternateFileName="")) returned 0x2d8058 [0049.575] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.575] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.575] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.575] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.575] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0049.575] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.575] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="wab32res.dll.mui") returned -1 [0049.575] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wab32res.dll.mui") returned -1 [0049.575] lstrcmpiA (lpString1="", lpString2="wab32res.dll.mui") returned -1 [0049.575] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\en-US\\*.*") returned="*.*" [0049.576] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\en-US\\" [0049.576] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\en-US\\") returned="" [0049.576] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\en-US\\HOW TO DECRYPT FILES.txt" [0049.576] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0049.576] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0049.577] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.577] CloseHandle (hObject=0x8c) returned 1 [0049.577] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\en-US\\", lpString2="wab32res.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" [0049.577] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0049.577] FindClose (in: hFindFile=0x2d8058 | out: hFindFile=0x2d8058) returned 1 [0049.577] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="msadc", cAlternateFileName="")) returned 1 [0049.577] lstrcmpA (lpString1=".", lpString2="msadc") returned -1 [0049.577] lstrcmpA (lpString1="..", lpString2="msadc") returned -1 [0049.577] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\*.*") returned="*.*" [0049.578] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\", lpString2="msadc" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc") returned="C:\\Program Files\\Common Files\\System\\msadc" [0049.578] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8350, cFileName=".", cAlternateFileName="")) returned 0x2d8058 [0049.592] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.592] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.592] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.592] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.592] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34c44b4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34c44b4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa05a2bb2, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0049.592] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.592] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="adcjavas.inc") returned 1 [0049.592] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="adcjavas.inc") returned 1 [0049.592] lstrcmpiA (lpString1="", lpString2="adcjavas.inc") returned -1 [0049.592] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\*.*") returned="*.*" [0049.592] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0049.592] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0049.592] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0049.592] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0xffffffff [0049.592] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0049.597] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.597] CloseHandle (hObject=0x8c) returned 1 [0049.598] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="adcjavas.inc" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" [0049.598] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34ea611, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34ea611, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa063b126, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x2d8350, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0049.598] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.598] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="adcvbs.inc") returned 1 [0049.598] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="adcvbs.inc") returned 1 [0049.598] lstrcmpiA (lpString1="", lpString2="adcvbs.inc") returned -1 [0049.598] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned="adcjavas.inc" [0049.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0049.598] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0049.598] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0049.598] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0049.598] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="adcvbs.inc" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" [0049.598] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0049.598] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0049.598] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0049.599] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned="adcvbs.inc" [0049.599] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US" [0049.599] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d811e, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0049.600] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.600] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.601] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.601] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.601] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9351968, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9351968, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0049.601] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.601] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msadcer.dll.mui") returned -1 [0049.601] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadcer.dll.mui") returned -1 [0049.601] lstrcmpiA (lpString1="", lpString2="msadcer.dll.mui") returned -1 [0049.601] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*") returned="*.*" [0049.601] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" [0049.601] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="" [0049.601] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" [0049.601] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0049.601] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.603] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.603] CloseHandle (hObject=0x90) returned 1 [0049.603] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="msadcer.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" [0049.603] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32e361, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc32e361, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x2d8360, cFileName="msadcfr.dll.mui", cAlternateFileName="")) returned 1 [0049.603] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.603] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msadcfr.dll.mui") returned -1 [0049.603] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadcfr.dll.mui") returned -1 [0049.603] lstrcmpiA (lpString1="", lpString2="msadcfr.dll.mui") returned -1 [0049.603] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned="msadcer.dll.mui" [0049.603] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" [0049.603] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="" [0049.603] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" [0049.604] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\how to decrypt files.txt")) returned 0x20 [0049.604] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="msadcfr.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui" [0049.604] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a073ed, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9a073ed, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0049.604] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.604] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msadcor.dll.mui") returned -1 [0049.604] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadcor.dll.mui") returned -1 [0049.604] lstrcmpiA (lpString1="", lpString2="msadcor.dll.mui") returned -1 [0049.604] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui") returned="msadcfr.dll.mui" [0049.604] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" [0049.604] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="" [0049.604] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" [0049.604] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\how to decrypt files.txt")) returned 0x20 [0049.604] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="msadcor.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" [0049.604] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93053f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x93053f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0049.604] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.604] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msaddsr.dll.mui") returned -1 [0049.604] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msaddsr.dll.mui") returned -1 [0049.604] lstrcmpiA (lpString1="", lpString2="msaddsr.dll.mui") returned -1 [0049.604] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned="msadcor.dll.mui" [0049.604] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" [0049.604] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="" [0049.604] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" [0049.605] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\how to decrypt files.txt")) returned 0x20 [0049.605] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="msaddsr.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" [0049.605] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0049.605] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.605] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msdaprsr.dll.mui") returned -1 [0049.605] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdaprsr.dll.mui") returned -1 [0049.605] lstrcmpiA (lpString1="", lpString2="msdaprsr.dll.mui") returned -1 [0049.605] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui") returned="msaddsr.dll.mui" [0049.605] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" [0049.605] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="" [0049.605] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" [0049.605] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\how to decrypt files.txt")) returned 0x20 [0049.605] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="msdaprsr.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" [0049.605] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0049.605] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.605] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msdaremr.dll.mui") returned -1 [0049.605] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msdaremr.dll.mui") returned -1 [0049.605] lstrcmpiA (lpString1="", lpString2="msdaremr.dll.mui") returned -1 [0049.605] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned="msdaprsr.dll.mui" [0049.605] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" [0049.605] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned="" [0049.605] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" [0049.605] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\how to decrypt files.txt")) returned 0x20 [0049.606] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", lpString2="msdaremr.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui") returned="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" [0049.606] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 0 [0049.606] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0049.606] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cac9e93, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0x2cac9e93, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0x2cac9e93, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="handler.reg", cAlternateFileName="")) returned 1 [0049.606] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.606] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="handler.reg") returned -1 [0049.606] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="handler.reg") returned 1 [0049.606] lstrcmpiA (lpString1="", lpString2="handler.reg") returned -1 [0049.606] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\*.*") returned="*.*" [0049.606] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0049.606] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0049.606] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0049.606] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0049.606] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="handler.reg" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg") returned="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" [0049.606] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x2d63e7d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x0, cFileName="handsafe.reg", cAlternateFileName="")) returned 1 [0049.606] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.606] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="handsafe.reg") returned -1 [0049.606] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="handsafe.reg") returned 1 [0049.606] lstrcmpiA (lpString1="", lpString2="handsafe.reg") returned -1 [0049.606] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg") returned="handler.reg" [0049.606] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0049.607] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0049.607] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0049.607] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0049.607] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="handsafe.reg" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg") returned="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" [0049.607] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b36a80d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b36a80d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b6180d2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0049.607] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.607] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msadce.dll") returned -1 [0049.607] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadce.dll") returned -1 [0049.607] lstrcmpiA (lpString1="", lpString2="msadce.dll") returned -1 [0049.607] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg") returned="handsafe.reg" [0049.607] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0049.607] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0049.607] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0049.607] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0049.607] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msadce.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" [0049.607] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc13c33e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc13c33e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e1eed0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0049.607] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.607] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msadcer.dll") returned -1 [0049.607] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msadcer.dll") returned -1 [0049.607] lstrcmpiA (lpString1="", lpString2="msadcer.dll") returned -1 [0049.607] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll") returned="msadce.dll" [0049.607] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0049.607] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0049.608] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0049.608] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0049.608] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msadcer.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" [0049.608] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9e4ffc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9e4ffc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcf.dll", cAlternateFileName="")) returned 1 [0049.608] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.608] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll") returned="msadcer.dll" [0049.608] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0049.608] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0049.608] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0049.608] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0049.608] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msadcf.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll" [0049.608] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf732e2, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfbf732e2, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e6a9c0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll", cAlternateFileName="")) returned 1 [0049.608] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.608] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll") returned="msadcf.dll" [0049.608] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0049.608] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0049.608] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0049.608] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0049.609] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msadcfr.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll" [0049.609] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0049.609] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.609] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll") returned="msadcfr.dll" [0049.609] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0049.609] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0049.609] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0049.609] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0049.609] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msadco.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" [0049.609] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0a3dca, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc0a3dca, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80edd5b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0049.609] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.609] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll") returned="msadco.dll" [0049.609] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0049.609] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0049.609] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0049.609] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0049.609] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msadcor.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" [0049.609] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84872aa8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84872aa8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84872aa8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcs.dll", cAlternateFileName="")) returned 1 [0049.609] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.609] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll") returned="msadcor.dll" [0049.609] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0049.609] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0049.610] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0049.610] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0049.610] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msadcs.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll" [0049.610] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3801e6, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc3801e6, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x345eeb10, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0049.610] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.610] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll") returned="msadcs.dll" [0049.610] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0049.610] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0049.610] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0049.610] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0049.610] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msadds.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" [0049.610] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfce53b36, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfce53b36, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80fc2d90, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0049.610] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.610] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll") returned="msadds.dll" [0049.610] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0049.610] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0049.610] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0049.610] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0049.610] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msaddsr.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" [0049.610] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7d9276, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd7d9276, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x81dbdf30, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0049.610] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.611] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll") returned="msaddsr.dll" [0049.611] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0049.611] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0049.611] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0049.611] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0049.611] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msdaprsr.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" [0049.611] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0d295c, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc0d295c, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3497fc70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0049.611] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.611] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll") returned="msdaprsr.dll" [0049.611] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0049.611] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0049.611] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0049.611] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0049.611] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msdaprst.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" [0049.611] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93fdbb10, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93fdbb10, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94001c70, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0049.611] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.611] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll") returned="msdaprst.dll" [0049.611] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0049.611] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0049.611] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0049.611] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0049.611] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msdarem.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" [0049.611] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd6a878e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd6a878e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x835d7620, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0049.612] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.612] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll") returned="msdarem.dll" [0049.612] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0049.612] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0049.612] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0049.612] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0049.612] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msdaremr.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" [0049.612] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0049.612] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.612] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned="msdaremr.dll" [0049.612] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\msadc\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\") returned="C:\\Program Files\\Common Files\\System\\msadc\\" [0049.612] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\msadc\\") returned="" [0049.612] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" [0049.612] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\how to decrypt files.txt")) returned 0x20 [0049.612] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\", lpString2="msdfmap.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" [0049.612] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 0 [0049.612] FindClose (in: hFindFile=0x2d8058 | out: hFindFile=0x2d8058) returned 1 [0049.612] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="MSMAPI", cAlternateFileName="")) returned 1 [0049.612] lstrcmpA (lpString1=".", lpString2="MSMAPI") returned -1 [0049.612] lstrcmpA (lpString1="..", lpString2="MSMAPI") returned -1 [0049.612] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\*.*") returned="*.*" [0049.612] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\", lpString2="MSMAPI" | out: lpString1="C:\\Program Files\\Common Files\\System\\MSMAPI") returned="C:\\Program Files\\Common Files\\System\\MSMAPI" [0049.612] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d8058 [0049.614] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.614] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.614] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.614] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.614] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0049.614] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0049.614] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0049.614] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*") returned="*.*" [0049.614] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\MSMAPI\\", lpString2="1033" | out: lpString1="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033") returned="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033" [0049.614] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0049.614] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.614] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.614] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.614] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.614] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 1 [0049.614] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.614] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*") returned="*.*" [0049.615] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\") returned="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\" [0049.615] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\") returned="" [0049.615] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\HOW TO DECRYPT FILES.txt" [0049.615] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\how to decrypt files.txt")) returned 0xffffffff [0049.615] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.616] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.616] CloseHandle (hObject=0x90) returned 1 [0049.616] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", lpString2="MSMAPI32.DLL" | out: lpString1="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL" [0049.616] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 0 [0049.616] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0049.617] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0049.617] FindClose (in: hFindFile=0x2d8058 | out: hFindFile=0x2d8058) returned 1 [0049.617] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53004d, dwReserved1=0x3, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0049.617] lstrcmpA (lpString1=".", lpString2="Ole DB") returned -1 [0049.617] lstrcmpA (lpString1="..", lpString2="Ole DB") returned -1 [0049.617] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\*.*") returned="*.*" [0049.617] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\", lpString2="Ole DB" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB") returned="C:\\Program Files\\Common Files\\System\\Ole DB" [0049.617] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2d8058 [0049.637] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.637] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.637] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.637] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.637] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0049.637] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0049.637] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0049.637] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\*.*") returned="*.*" [0049.637] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US" [0049.637] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2d7ff0 [0049.638] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.638] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.638] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.638] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.638] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0049.638] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.638] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*") returned="*.*" [0049.638] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" [0049.638] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="" [0049.638] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\HOW TO DECRYPT FILES.txt" [0049.638] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0049.638] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.641] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.641] CloseHandle (hObject=0x90) returned 1 [0049.642] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpString2="msdasqlr.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" [0049.642] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aabb7e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8aabb7e, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x0, dwReserved1=0x2d8360, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1 [0049.642] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.642] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned="msdasqlr.dll.mui" [0049.642] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" [0049.642] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="" [0049.642] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\HOW TO DECRYPT FILES.txt" [0049.642] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\how to decrypt files.txt")) returned 0x20 [0049.642] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpString2="oledb32r.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" [0049.642] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb93886, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb93886, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1 [0049.642] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.642] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned="oledb32r.dll.mui" [0049.642] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" [0049.642] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="" [0049.642] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\HOW TO DECRYPT FILES.txt" [0049.643] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\how to decrypt files.txt")) returned 0x20 [0049.643] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpString2="sqloledb.rll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" [0049.643] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1 [0049.643] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.643] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned="sqloledb.rll.mui" [0049.643] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" [0049.643] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned="" [0049.643] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\HOW TO DECRYPT FILES.txt" [0049.643] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\how to decrypt files.txt")) returned 0x20 [0049.643] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", lpString2="sqlxmlx.rll.mui" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" [0049.643] FindNextFileA (in: hFindFile=0x2d7ff0, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 0 [0049.643] FindClose (in: hFindFile=0x2d7ff0 | out: hFindFile=0x2d7ff0) returned 1 [0049.643] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad34e79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ad34e79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ad5afda, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0049.643] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.643] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\*.*") returned="*.*" [0049.643] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0049.643] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0049.643] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0049.643] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0xffffffff [0049.644] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0049.645] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.645] CloseHandle (hObject=0x8c) returned 1 [0049.645] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="msdaosp.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" [0049.645] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14cd0c35, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14cd0c35, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x349a6d70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6a000, dwReserved0=0x0, dwReserved1=0x2d8358, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0049.645] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.645] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned="msdaosp.dll" [0049.645] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0049.645] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0049.645] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0049.645] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0049.646] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="msdaps.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" [0049.646] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c0138a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86c0138a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86c0138a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0049.646] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.646] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned="msdaps.dll" [0049.646] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0049.646] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0049.646] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0049.646] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0049.646] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="msdasql.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" [0049.646] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab69cf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x2ab69cf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x838ac7b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0049.646] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.646] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned="msdasql.dll" [0049.646] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0049.646] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0049.646] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0049.646] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0049.646] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="msdasqlr.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" [0049.646] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3c3a6b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc3c3a6b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x349f2860, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1 [0049.647] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.647] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned="msdasqlr.dll" [0049.647] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0049.647] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0049.647] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0049.647] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0049.647] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="msdatl3.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" [0049.647] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d2cdc0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x1d2cdc0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x383128c0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msxactps.dll", cAlternateFileName="")) returned 1 [0049.647] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.647] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned="msdatl3.dll" [0049.647] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0049.647] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0049.647] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0049.647] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0049.647] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="msxactps.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" [0049.647] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c2ad0f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84c2ad0f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84c50e6f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32.dll", cAlternateFileName="")) returned 1 [0049.647] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.647] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned="msxactps.dll" [0049.647] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0049.647] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0049.647] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0049.647] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0049.647] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="oledb32.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" [0049.648] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfabf604b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfabf604b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xdf9a48f0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1 [0049.648] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.648] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned="oledb32.dll" [0049.648] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0049.648] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0049.648] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0049.648] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0049.648] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="oledb32r.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" [0049.648] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa4ffde2f, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1 [0049.648] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.648] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned="oledb32r.dll" [0049.648] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0049.648] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0049.648] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0049.648] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0049.648] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="oledbjvs.inc" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" [0049.648] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa52d1816, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1 [0049.648] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.648] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned="oledbjvs.inc" [0049.648] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0049.648] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0049.649] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0049.649] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0049.649] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="oledbvbs.inc" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" [0049.649] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f0bf91, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f0bf91, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92f320f1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x128000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0049.649] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.649] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned="oledbvbs.inc" [0049.649] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0049.649] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0049.649] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0049.649] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0049.649] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="sqloledb.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" [0049.649] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9350f, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xcc9350f, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xcc210f8, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0049.649] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.649] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned="sqloledb.dll" [0049.649] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0049.649] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0049.649] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0049.650] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0049.650] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="sqloledb.rll" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" [0049.650] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f7e4bf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14f7e4bf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x44773fc0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x59000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0049.650] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.650] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned="sqloledb.rll" [0049.650] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0049.650] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0049.650] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0049.650] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0049.650] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="sqlxmlx.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" [0049.650] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e5c85, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc9e5c85, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xc97386e, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0049.650] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.650] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll") returned="sqlxmlx.dll" [0049.650] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0049.650] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0049.650] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0049.650] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0049.650] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="sqlxmlx.rll" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" [0049.650] FindNextFileA (in: hFindFile=0x2d8058, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x44e18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrw.dll", cAlternateFileName="")) returned 1 [0049.650] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.650] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll") returned="sqlxmlx.rll" [0049.650] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0049.650] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0049.651] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0049.651] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0049.651] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="xmlrw.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll" [0049.651] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.651] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll") returned="xmlrw.dll" [0049.651] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\" [0049.651] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned="" [0049.651] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" [0049.651] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\how to decrypt files.txt")) returned 0x20 [0049.651] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\", lpString2="xmlrwbin.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll" [0049.651] FindClose (in: hFindFile=0x2d8058 | out: hFindFile=0x2d8058) returned 1 [0049.651] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0049.651] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\*.*") returned="*.*" [0049.651] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\") returned="C:\\Program Files\\Common Files\\System\\" [0049.652] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\") returned="" [0049.652] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\HOW TO DECRYPT FILES.txt" [0049.652] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\how to decrypt files.txt")) returned 0x20 [0049.652] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\", lpString2="wab32.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\wab32.dll") returned="C:\\Program Files\\Common Files\\System\\wab32.dll" [0049.652] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0049.652] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\System\\wab32.dll") returned="wab32.dll" [0049.652] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Common Files\\System\\" | out: lpString1="C:\\Program Files\\Common Files\\System\\") returned="C:\\Program Files\\Common Files\\System\\" [0049.652] PathAddBackslashA (in: pszPath="C:\\Program Files\\Common Files\\System\\" | out: pszPath="C:\\Program Files\\Common Files\\System\\") returned="" [0049.652] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Common Files\\System\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Common Files\\System\\HOW TO DECRYPT FILES.txt" [0049.652] GetFileAttributesA (lpFileName="C:\\Program Files\\Common Files\\System\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\common files\\system\\how to decrypt files.txt")) returned 0x20 [0049.652] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\System\\", lpString2="wab32res.dll" | out: lpString1="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned="C:\\Program Files\\Common Files\\System\\wab32res.dll" [0049.652] FindClose (in: hFindFile=0x2d6f58 | out: hFindFile=0x2d6f58) returned 1 [0049.652] FindClose (in: hFindFile=0x2d6fa8 | out: hFindFile=0x2d6fa8) returned 1 [0049.652] PeekMessageA (in: lpMsg=0x18fcc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fcc4) returned 0 [0049.652] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*" [0049.652] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0049.652] PathAddBackslashA (in: pszPath="C:\\Program Files\\" | out: pszPath="C:\\Program Files\\") returned="" [0049.652] lstrcatA (in: lpString1="C:\\Program Files\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\HOW TO DECRYPT FILES.txt" [0049.652] GetFileAttributesA (lpFileName="C:\\Program Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\how to decrypt files.txt")) returned 0xffffffff [0049.653] CreateFileA (lpFileName="C:\\Program Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x74 [0049.654] SetFileTime (hFile=0x74, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.654] CloseHandle (hObject=0x74) returned 1 [0049.654] lstrcatA (in: lpString1="C:\\Program Files\\", lpString2="desktop.ini" | out: lpString1="C:\\Program Files\\desktop.ini") returned="C:\\Program Files\\desktop.ini" [0049.654] lstrcmpA (lpString1=".", lpString2="DVD Maker") returned -1 [0049.654] lstrcmpA (lpString1="..", lpString2="DVD Maker") returned -1 [0049.654] PathFindFileNameA (pszPath="C:\\Program Files\\desktop.ini") returned="desktop.ini" [0049.654] lstrcatA (in: lpString1="C:\\Program Files\\", lpString2="DVD Maker" | out: lpString1="C:\\Program Files\\DVD Maker") returned="C:\\Program Files\\DVD Maker" [0049.654] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdd72bba0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd72bba0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d6faa, cFileName=".", cAlternateFileName="")) returned 0x2d6fa0 [0049.655] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.655] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.655] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.655] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0049.655] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\*.*") returned="*.*" [0049.655] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0049.655] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned="" [0049.655] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" [0049.655] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt")) returned 0xffffffff [0049.655] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x84 [0049.656] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.656] CloseHandle (hObject=0x84) returned 1 [0049.657] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="audiodepthconverter.ax" | out: lpString1="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" [0049.657] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0049.657] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned="audiodepthconverter.ax" [0049.657] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0049.657] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned="" [0049.657] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" [0049.657] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt")) returned 0x20 [0049.657] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="bod_r.TTF" | out: lpString1="C:\\Program Files\\DVD Maker\\bod_r.TTF") returned="C:\\Program Files\\DVD Maker\\bod_r.TTF" [0049.657] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0049.657] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\bod_r.TTF") returned="bod_r.TTF" [0049.657] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0049.657] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned="" [0049.657] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" [0049.657] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt")) returned 0x20 [0049.657] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="directshowtap.ax" | out: lpString1="C:\\Program Files\\DVD Maker\\directshowtap.ax") returned="C:\\Program Files\\DVD Maker\\directshowtap.ax" [0049.657] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0049.657] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\directshowtap.ax") returned="directshowtap.ax" [0049.658] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0049.658] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned="" [0049.658] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" [0049.658] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt")) returned 0x20 [0049.658] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="DVDMaker.exe" | out: lpString1="C:\\Program Files\\DVD Maker\\DVDMaker.exe") returned="C:\\Program Files\\DVD Maker\\DVDMaker.exe" [0049.658] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0049.658] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0049.658] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\DVDMaker.exe") returned="DVDMaker.exe" [0049.658] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\DVD Maker\\en-US") returned="C:\\Program Files\\DVD Maker\\en-US" [0049.658] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x2d804e, cFileName=".", cAlternateFileName="")) returned 0x2d6f58 [0049.658] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.658] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.658] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.658] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0049.658] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\en-US\\*.*") returned="*.*" [0049.658] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\en-US\\" | out: lpString1="C:\\Program Files\\DVD Maker\\en-US\\") returned="C:\\Program Files\\DVD Maker\\en-US\\" [0049.658] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\en-US\\" | out: pszPath="C:\\Program Files\\DVD Maker\\en-US\\") returned="" [0049.658] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\en-US\\HOW TO DECRYPT FILES.txt" [0049.659] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\en-us\\how to decrypt files.txt")) returned 0xffffffff [0049.659] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\en-us\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0049.660] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.660] CloseHandle (hObject=0x88) returned 1 [0049.660] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\en-US\\", lpString2="DVDMaker.exe.mui" | out: lpString1="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui") returned="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui" [0049.660] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0049.660] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui") returned="DVDMaker.exe.mui" [0049.660] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\en-US\\" | out: lpString1="C:\\Program Files\\DVD Maker\\en-US\\") returned="C:\\Program Files\\DVD Maker\\en-US\\" [0049.660] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\en-US\\" | out: pszPath="C:\\Program Files\\DVD Maker\\en-US\\") returned="" [0049.660] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\en-US\\HOW TO DECRYPT FILES.txt" [0049.660] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\en-us\\how to decrypt files.txt")) returned 0x20 [0049.660] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\en-US\\", lpString2="OmdProject.dll.mui" | out: lpString1="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" [0049.660] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0049.660] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned="OmdProject.dll.mui" [0049.660] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\en-US\\" | out: lpString1="C:\\Program Files\\DVD Maker\\en-US\\") returned="C:\\Program Files\\DVD Maker\\en-US\\" [0049.660] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\en-US\\" | out: pszPath="C:\\Program Files\\DVD Maker\\en-US\\") returned="" [0049.660] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\en-US\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\en-US\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\en-US\\HOW TO DECRYPT FILES.txt" [0049.661] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\en-us\\how to decrypt files.txt")) returned 0x20 [0049.661] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\en-US\\", lpString2="WMM2CLIP.dll.mui" | out: lpString1="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" [0049.661] FindClose (in: hFindFile=0x2d6f58 | out: hFindFile=0x2d6f58) returned 1 [0049.661] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0049.661] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\*.*") returned="*.*" [0049.661] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0049.661] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned="" [0049.661] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" [0049.661] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt")) returned 0x20 [0049.661] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="Eurosti.TTF" | out: lpString1="C:\\Program Files\\DVD Maker\\Eurosti.TTF") returned="C:\\Program Files\\DVD Maker\\Eurosti.TTF" [0049.661] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0049.661] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Eurosti.TTF") returned="Eurosti.TTF" [0049.661] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0049.661] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned="" [0049.661] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" [0049.661] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt")) returned 0x20 [0049.661] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="fieldswitch.ax" | out: lpString1="C:\\Program Files\\DVD Maker\\fieldswitch.ax") returned="C:\\Program Files\\DVD Maker\\fieldswitch.ax" [0049.661] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0049.661] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\fieldswitch.ax") returned="fieldswitch.ax" [0049.661] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0049.661] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned="" [0049.662] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" [0049.662] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt")) returned 0x20 [0049.662] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="offset.ax" | out: lpString1="C:\\Program Files\\DVD Maker\\offset.ax") returned="C:\\Program Files\\DVD Maker\\offset.ax" [0049.662] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0049.662] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\offset.ax") returned="offset.ax" [0049.662] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0049.662] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned="" [0049.662] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" [0049.662] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt")) returned 0x20 [0049.662] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="OmdBase.dll" | out: lpString1="C:\\Program Files\\DVD Maker\\OmdBase.dll") returned="C:\\Program Files\\DVD Maker\\OmdBase.dll" [0049.662] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0049.662] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\OmdBase.dll") returned="OmdBase.dll" [0049.662] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0049.662] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned="" [0049.662] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" [0049.662] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt")) returned 0x20 [0049.662] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="OmdProject.dll" | out: lpString1="C:\\Program Files\\DVD Maker\\OmdProject.dll") returned="C:\\Program Files\\DVD Maker\\OmdProject.dll" [0049.662] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0049.662] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\OmdProject.dll") returned="OmdProject.dll" [0049.662] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0049.662] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned="" [0049.662] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" [0049.662] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt")) returned 0x20 [0049.663] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="Pipeline.dll" | out: lpString1="C:\\Program Files\\DVD Maker\\Pipeline.dll") returned="C:\\Program Files\\DVD Maker\\Pipeline.dll" [0049.663] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0049.663] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Pipeline.dll") returned="Pipeline.dll" [0049.663] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0049.663] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned="" [0049.663] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" [0049.663] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt")) returned 0x20 [0049.663] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="PipeTran.dll" | out: lpString1="C:\\Program Files\\DVD Maker\\PipeTran.dll") returned="C:\\Program Files\\DVD Maker\\PipeTran.dll" [0049.663] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0049.663] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\PipeTran.dll") returned="PipeTran.dll" [0049.663] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0049.663] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned="" [0049.663] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" [0049.663] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt")) returned 0x20 [0049.663] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="rtstreamsink.ax" | out: lpString1="C:\\Program Files\\DVD Maker\\rtstreamsink.ax") returned="C:\\Program Files\\DVD Maker\\rtstreamsink.ax" [0049.663] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0049.663] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\rtstreamsink.ax") returned="rtstreamsink.ax" [0049.663] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0049.663] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned="" [0049.663] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" [0049.663] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt")) returned 0x20 [0049.664] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="rtstreamsource.ax" | out: lpString1="C:\\Program Files\\DVD Maker\\rtstreamsource.ax") returned="C:\\Program Files\\DVD Maker\\rtstreamsource.ax" [0049.664] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0049.664] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\rtstreamsource.ax") returned="rtstreamsource.ax" [0049.664] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\" | out: lpString1="C:\\Program Files\\DVD Maker\\") returned="C:\\Program Files\\DVD Maker\\" [0049.664] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\" | out: pszPath="C:\\Program Files\\DVD Maker\\") returned="" [0049.664] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" [0049.664] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\how to decrypt files.txt")) returned 0x20 [0049.664] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="SecretST.TTF" | out: lpString1="C:\\Program Files\\DVD Maker\\SecretST.TTF") returned="C:\\Program Files\\DVD Maker\\SecretST.TTF" [0049.664] lstrcmpA (lpString1=".", lpString2="Shared") returned -1 [0049.664] lstrcmpA (lpString1="..", lpString2="Shared") returned -1 [0049.664] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\SecretST.TTF") returned="SecretST.TTF" [0049.664] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\", lpString2="Shared" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared") returned="C:\\Program Files\\DVD Maker\\Shared" [0049.664] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x2d804e, cFileName=".", cAlternateFileName="")) returned 0x2d6f58 [0049.667] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.667] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.667] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.667] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0049.667] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\*.*") returned="*.*" [0049.667] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\") returned="C:\\Program Files\\DVD Maker\\Shared\\" [0049.667] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\") returned="" [0049.667] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\HOW TO DECRYPT FILES.txt" [0049.667] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\how to decrypt files.txt")) returned 0xffffffff [0049.667] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0049.669] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.669] CloseHandle (hObject=0x88) returned 1 [0049.669] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\", lpString2="Common.fxh" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh") returned="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" [0049.669] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0049.669] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh") returned="Common.fxh" [0049.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\") returned="C:\\Program Files\\DVD Maker\\Shared\\" [0049.669] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\") returned="" [0049.669] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\HOW TO DECRYPT FILES.txt" [0049.669] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\how to decrypt files.txt")) returned 0x20 [0049.670] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\", lpString2="DissolveAnother.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" [0049.670] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0049.670] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned="DissolveAnother.png" [0049.670] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\") returned="C:\\Program Files\\DVD Maker\\Shared\\" [0049.670] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\") returned="" [0049.670] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\HOW TO DECRYPT FILES.txt" [0049.670] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\how to decrypt files.txt")) returned 0x20 [0049.670] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\", lpString2="DissolveNoise.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" [0049.670] lstrcmpA (lpString1=".", lpString2="DvdStyles") returned -1 [0049.670] lstrcmpA (lpString1="..", lpString2="DvdStyles") returned -1 [0049.670] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned="DissolveNoise.png" [0049.670] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\", lpString2="DvdStyles" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles" [0049.670] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2d1294, cFileName=".", cAlternateFileName="")) returned 0x2d8050 [0049.672] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.674] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.674] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.674] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.674] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*") returned="*.*" [0049.674] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0049.674] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="" [0049.674] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" [0049.674] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\how to decrypt files.txt")) returned 0xffffffff [0049.674] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0049.675] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.676] CloseHandle (hObject=0x8c) returned 1 [0049.676] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="16to9Squareframe_Buttongraphic.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" [0049.676] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.676] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned="16to9Squareframe_Buttongraphic.png" [0049.676] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0049.676] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="" [0049.676] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" [0049.676] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\how to decrypt files.txt")) returned 0x20 [0049.676] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="16to9Squareframe_SelectionSubpicture.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" [0049.676] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.676] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned="16to9Squareframe_SelectionSubpicture.png" [0049.676] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0049.676] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="" [0049.676] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" [0049.676] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\how to decrypt files.txt")) returned 0x20 [0049.676] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="16to9Squareframe_VideoInset.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" [0049.676] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.677] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned="16to9Squareframe_VideoInset.png" [0049.677] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0049.677] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="" [0049.677] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" [0049.677] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\how to decrypt files.txt")) returned 0x20 [0049.677] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="4to3Squareframe_Buttongraphic.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" [0049.677] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.677] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned="4to3Squareframe_Buttongraphic.png" [0049.677] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0049.677] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="" [0049.677] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" [0049.677] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\how to decrypt files.txt")) returned 0x20 [0049.677] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="4to3Squareframe_SelectionSubpicture.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" [0049.677] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.677] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned="4to3Squareframe_SelectionSubpicture.png" [0049.677] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0049.677] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="" [0049.677] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" [0049.677] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\how to decrypt files.txt")) returned 0x20 [0049.677] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="4to3Squareframe_VideoInset.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" [0049.677] lstrcmpA (lpString1=".", lpString2="BabyBoy") returned -1 [0049.677] lstrcmpA (lpString1="..", lpString2="BabyBoy") returned -1 [0049.677] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned="4to3Squareframe_VideoInset.png" [0049.677] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="BabyBoy" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy" [0049.678] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d8118, cFileName=".", cAlternateFileName="")) returned 0x2d7fe8 [0049.680] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.680] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.680] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.680] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.680] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*") returned="*.*" [0049.680] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0049.680] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0049.680] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" [0049.680] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\how to decrypt files.txt")) returned 0xffffffff [0049.681] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.681] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0049.681] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0049.682] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.682] CloseHandle (hObject=0x90) returned 1 [0049.682] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="babyblue.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" [0049.682] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.zip") returned 0 [0049.683] lstrlenA (lpString="*.zip") returned 5 [0049.683] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.rar") returned 0 [0049.683] lstrlenA (lpString="*.rar") returned 5 [0049.683] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.7z") returned 0 [0049.683] lstrlenA (lpString="*.7z") returned 4 [0049.683] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.tar") returned 0 [0049.683] lstrlenA (lpString="*.tar") returned 5 [0049.683] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.gzip") returned 0 [0049.683] lstrlenA (lpString="*.gzip") returned 6 [0049.683] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.jpg") returned 0 [0049.683] lstrlenA (lpString="*.jpg") returned 5 [0049.683] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.jpeg") returned 0 [0049.683] lstrlenA (lpString="*.jpeg") returned 6 [0049.683] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.psd") returned 0 [0049.683] lstrlenA (lpString="*.psd") returned 5 [0049.683] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.gif") returned 0 [0049.683] lstrlenA (lpString="*.gif") returned 5 [0049.683] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.doc") returned 0 [0049.683] lstrlenA (lpString="*.doc") returned 5 [0049.683] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.docx") returned 0 [0049.683] lstrlenA (lpString="*.docx") returned 6 [0049.683] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.xls") returned 0 [0049.683] lstrlenA (lpString="*.xls") returned 5 [0049.683] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.xlsx") returned 0 [0049.683] lstrlenA (lpString="*.xlsx") returned 6 [0049.683] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.ppt") returned 0 [0049.683] lstrlenA (lpString="*.ppt") returned 5 [0049.683] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.pptx") returned 0 [0049.683] lstrlenA (lpString="*.pptx") returned 6 [0049.683] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.pdf") returned 0 [0049.683] lstrlenA (lpString="*.pdf") returned 5 [0049.683] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.mov") returned 0 [0049.684] lstrlenA (lpString="*.mov") returned 5 [0049.684] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.m2v") returned 0 [0049.684] lstrlenA (lpString="*.m2v") returned 5 [0049.684] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.3gp") returned 0 [0049.684] lstrlenA (lpString="*.3gp") returned 5 [0049.684] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.mpeg") returned 0 [0049.684] lstrlenA (lpString="*.mpeg") returned 6 [0049.684] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.mpg") returned 0 [0049.684] lstrlenA (lpString="*.mpg") returned 5 [0049.684] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.flv") returned 0 [0049.684] lstrlenA (lpString="*.flv") returned 5 [0049.684] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.avi") returned 0 [0049.684] lstrlenA (lpString="*.avi") returned 5 [0049.684] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.mp4") returned 0 [0049.684] lstrlenA (lpString="*.mp4") returned 5 [0049.684] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.wmv") returned 0 [0049.684] lstrlenA (lpString="*.wmv") returned 5 [0049.684] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.divx") returned 0 [0049.684] lstrlenA (lpString="*.divx") returned 6 [0049.684] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.mkv") returned 0 [0049.684] lstrlenA (lpString="*.mkv") returned 5 [0049.684] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.mp3") returned 0 [0049.684] lstrlenA (lpString="*.mp3") returned 5 [0049.684] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.wav") returned 0 [0049.684] lstrlenA (lpString="*.wav") returned 5 [0049.684] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.flac") returned 0 [0049.684] lstrlenA (lpString="*.flac") returned 6 [0049.684] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.ape") returned 0 [0049.684] lstrlenA (lpString="*.ape") returned 5 [0049.684] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.wma") returned 0 [0049.685] lstrlenA (lpString="*.wma") returned 5 [0049.685] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.ac3") returned 0 [0049.685] lstrlenA (lpString="*.ac3") returned 5 [0049.685] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", pszSpec="*.mxf") returned 0 [0049.685] lstrlenA (lpString="*.mxf") returned 5 [0049.685] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d1f29a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d1f29a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5354a, dwReserved0=0x0, dwReserved1=0x2d8360, cFileName="BabyBoyMainBackground.wmv", cAlternateFileName="")) returned 1 [0049.685] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.685] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BabyBoyMainBackground.wmv") returned 1 [0049.685] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BabyBoyMainBackground.wmv") returned 1 [0049.685] lstrcmpiA (lpString1="", lpString2="BabyBoyMainBackground.wmv") returned -1 [0049.685] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned="babyblue.png" [0049.685] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0049.685] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0049.685] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" [0049.685] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\how to decrypt files.txt")) returned 0x20 [0049.685] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="BabyBoyMainBackground.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" [0049.685] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", pszSpec="*.zip") returned 0 [0049.685] lstrlenA (lpString="*.zip") returned 5 [0049.685] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", pszSpec="*.rar") returned 0 [0049.685] lstrlenA (lpString="*.rar") returned 5 [0049.685] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", pszSpec="*.7z") returned 0 [0049.685] lstrlenA (lpString="*.7z") returned 4 [0049.685] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", pszSpec="*.tar") returned 0 [0049.685] lstrlenA (lpString="*.tar") returned 5 [0049.685] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", pszSpec="*.gzip") returned 0 [0049.685] lstrlenA (lpString="*.gzip") returned 6 [0049.685] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", pszSpec="*.jpg") returned 0 [0049.685] lstrlenA (lpString="*.jpg") returned 5 [0049.686] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", pszSpec="*.jpeg") returned 0 [0049.686] lstrlenA (lpString="*.jpeg") returned 6 [0049.686] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", pszSpec="*.psd") returned 0 [0049.686] lstrlenA (lpString="*.psd") returned 5 [0049.686] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", pszSpec="*.gif") returned 0 [0049.686] lstrlenA (lpString="*.gif") returned 5 [0049.686] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", pszSpec="*.doc") returned 0 [0049.686] lstrlenA (lpString="*.doc") returned 5 [0049.686] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", pszSpec="*.docx") returned 0 [0049.686] lstrlenA (lpString="*.docx") returned 6 [0049.686] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", pszSpec="*.xls") returned 0 [0049.686] lstrlenA (lpString="*.xls") returned 5 [0049.686] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", pszSpec="*.xlsx") returned 0 [0049.686] lstrlenA (lpString="*.xlsx") returned 6 [0049.686] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", pszSpec="*.ppt") returned 0 [0049.686] lstrlenA (lpString="*.ppt") returned 5 [0049.686] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", pszSpec="*.pptx") returned 0 [0049.686] lstrlenA (lpString="*.pptx") returned 6 [0049.686] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", pszSpec="*.pdf") returned 0 [0049.686] lstrlenA (lpString="*.pdf") returned 5 [0049.686] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", pszSpec="*.mov") returned 0 [0049.686] lstrlenA (lpString="*.mov") returned 5 [0049.686] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", pszSpec="*.m2v") returned 0 [0049.686] lstrlenA (lpString="*.m2v") returned 5 [0049.686] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", pszSpec="*.3gp") returned 0 [0049.686] lstrlenA (lpString="*.3gp") returned 5 [0049.686] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", pszSpec="*.mpeg") returned 0 [0049.686] lstrlenA (lpString="*.mpeg") returned 6 [0049.686] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", pszSpec="*.mpg") returned 0 [0049.686] lstrlenA (lpString="*.mpg") returned 5 [0049.686] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", pszSpec="*.flv") returned 0 [0049.686] lstrlenA (lpString="*.flv") returned 5 [0049.687] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", pszSpec="*.avi") returned 0 [0049.687] lstrlenA (lpString="*.avi") returned 5 [0049.687] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", pszSpec="*.mp4") returned 0 [0049.687] lstrlenA (lpString="*.mp4") returned 5 [0049.687] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", pszSpec="*.wmv") returned 1 [0049.687] lstrlenA (lpString="*.wmv") returned 5 [0049.687] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" [0049.687] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" [0049.687] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", lpString2="." | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv.") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv." [0049.687] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv.wannacry") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv.wannacry" [0049.687] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.689] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d6b554, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d6b554, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6ca, dwReserved0=0x2d8130, dwReserved1=0x0, cFileName="BabyBoyMainBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0049.689] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.689] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BabyBoyMainBackground_PAL.wmv") returned 1 [0049.689] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BabyBoyMainBackground_PAL.wmv") returned 1 [0049.689] lstrcmpiA (lpString1="", lpString2="BabyBoyMainBackground_PAL.wmv") returned -1 [0049.689] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned="BabyBoyMainBackground.wmv" [0049.689] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0049.689] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0049.689] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" [0049.689] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\how to decrypt files.txt")) returned 0x20 [0049.689] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="BabyBoyMainBackground_PAL.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" [0049.689] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", pszSpec="*.zip") returned 0 [0049.689] lstrlenA (lpString="*.zip") returned 5 [0049.689] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", pszSpec="*.rar") returned 0 [0049.689] lstrlenA (lpString="*.rar") returned 5 [0049.689] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", pszSpec="*.7z") returned 0 [0049.689] lstrlenA (lpString="*.7z") returned 4 [0049.690] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", pszSpec="*.tar") returned 0 [0049.690] lstrlenA (lpString="*.tar") returned 5 [0049.690] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", pszSpec="*.gzip") returned 0 [0049.690] lstrlenA (lpString="*.gzip") returned 6 [0049.690] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", pszSpec="*.jpg") returned 0 [0049.690] lstrlenA (lpString="*.jpg") returned 5 [0049.690] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", pszSpec="*.jpeg") returned 0 [0049.690] lstrlenA (lpString="*.jpeg") returned 6 [0049.690] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", pszSpec="*.psd") returned 0 [0049.690] lstrlenA (lpString="*.psd") returned 5 [0049.690] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", pszSpec="*.gif") returned 0 [0049.690] lstrlenA (lpString="*.gif") returned 5 [0049.690] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", pszSpec="*.doc") returned 0 [0049.690] lstrlenA (lpString="*.doc") returned 5 [0049.690] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", pszSpec="*.docx") returned 0 [0049.690] lstrlenA (lpString="*.docx") returned 6 [0049.690] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", pszSpec="*.xls") returned 0 [0049.690] lstrlenA (lpString="*.xls") returned 5 [0049.690] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", pszSpec="*.xlsx") returned 0 [0049.690] lstrlenA (lpString="*.xlsx") returned 6 [0049.690] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", pszSpec="*.ppt") returned 0 [0049.690] lstrlenA (lpString="*.ppt") returned 5 [0049.690] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", pszSpec="*.pptx") returned 0 [0049.690] lstrlenA (lpString="*.pptx") returned 6 [0049.690] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", pszSpec="*.pdf") returned 0 [0049.690] lstrlenA (lpString="*.pdf") returned 5 [0049.690] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", pszSpec="*.mov") returned 0 [0049.690] lstrlenA (lpString="*.mov") returned 5 [0049.690] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", pszSpec="*.m2v") returned 0 [0049.690] lstrlenA (lpString="*.m2v") returned 5 [0049.690] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", pszSpec="*.3gp") returned 0 [0049.690] lstrlenA (lpString="*.3gp") returned 5 [0049.690] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", pszSpec="*.mpeg") returned 0 [0049.691] lstrlenA (lpString="*.mpeg") returned 6 [0049.691] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", pszSpec="*.mpg") returned 0 [0049.691] lstrlenA (lpString="*.mpg") returned 5 [0049.691] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", pszSpec="*.flv") returned 0 [0049.691] lstrlenA (lpString="*.flv") returned 5 [0049.691] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", pszSpec="*.avi") returned 0 [0049.691] lstrlenA (lpString="*.avi") returned 5 [0049.691] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", pszSpec="*.mp4") returned 0 [0049.691] lstrlenA (lpString="*.mp4") returned 5 [0049.691] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", pszSpec="*.wmv") returned 1 [0049.691] lstrlenA (lpString="*.wmv") returned 5 [0049.691] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" [0049.691] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" [0049.691] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", lpString2="." | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv.") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv." [0049.691] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv.wannacry") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv.wannacry" [0049.691] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.691] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e03ac8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e03ac8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49d12255, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x2d8138, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground.wmv", cAlternateFileName="")) returned 1 [0049.691] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.691] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BabyBoyMainToNotesBackground.wmv") returned 1 [0049.691] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BabyBoyMainToNotesBackground.wmv") returned 1 [0049.691] lstrcmpiA (lpString1="", lpString2="BabyBoyMainToNotesBackground.wmv") returned -1 [0049.691] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned="BabyBoyMainBackground_PAL.wmv" [0049.691] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0049.691] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0049.691] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" [0049.691] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\how to decrypt files.txt")) returned 0x20 [0049.691] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="BabyBoyMainToNotesBackground.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" [0049.692] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", pszSpec="*.zip") returned 0 [0049.692] lstrlenA (lpString="*.zip") returned 5 [0049.692] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", pszSpec="*.rar") returned 0 [0049.692] lstrlenA (lpString="*.rar") returned 5 [0049.692] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", pszSpec="*.7z") returned 0 [0049.692] lstrlenA (lpString="*.7z") returned 4 [0049.692] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", pszSpec="*.tar") returned 0 [0049.692] lstrlenA (lpString="*.tar") returned 5 [0049.692] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", pszSpec="*.gzip") returned 0 [0049.692] lstrlenA (lpString="*.gzip") returned 6 [0049.692] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", pszSpec="*.jpg") returned 0 [0049.692] lstrlenA (lpString="*.jpg") returned 5 [0049.692] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", pszSpec="*.jpeg") returned 0 [0049.692] lstrlenA (lpString="*.jpeg") returned 6 [0049.692] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", pszSpec="*.psd") returned 0 [0049.692] lstrlenA (lpString="*.psd") returned 5 [0049.692] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", pszSpec="*.gif") returned 0 [0049.692] lstrlenA (lpString="*.gif") returned 5 [0049.692] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", pszSpec="*.doc") returned 0 [0049.692] lstrlenA (lpString="*.doc") returned 5 [0049.692] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", pszSpec="*.docx") returned 0 [0049.692] lstrlenA (lpString="*.docx") returned 6 [0049.692] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", pszSpec="*.xls") returned 0 [0049.692] lstrlenA (lpString="*.xls") returned 5 [0049.692] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", pszSpec="*.xlsx") returned 0 [0049.692] lstrlenA (lpString="*.xlsx") returned 6 [0049.692] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", pszSpec="*.ppt") returned 0 [0049.692] lstrlenA (lpString="*.ppt") returned 5 [0049.692] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", pszSpec="*.pptx") returned 0 [0049.692] lstrlenA (lpString="*.pptx") returned 6 [0049.692] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", pszSpec="*.pdf") returned 0 [0049.692] lstrlenA (lpString="*.pdf") returned 5 [0049.693] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", pszSpec="*.mov") returned 0 [0049.693] lstrlenA (lpString="*.mov") returned 5 [0049.693] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", pszSpec="*.m2v") returned 0 [0049.693] lstrlenA (lpString="*.m2v") returned 5 [0049.693] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", pszSpec="*.3gp") returned 0 [0049.693] lstrlenA (lpString="*.3gp") returned 5 [0049.693] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", pszSpec="*.mpeg") returned 0 [0049.693] lstrlenA (lpString="*.mpeg") returned 6 [0049.693] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", pszSpec="*.mpg") returned 0 [0049.693] lstrlenA (lpString="*.mpg") returned 5 [0049.693] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", pszSpec="*.flv") returned 0 [0049.693] lstrlenA (lpString="*.flv") returned 5 [0049.693] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", pszSpec="*.avi") returned 0 [0049.693] lstrlenA (lpString="*.avi") returned 5 [0049.693] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", pszSpec="*.mp4") returned 0 [0049.693] lstrlenA (lpString="*.mp4") returned 5 [0049.693] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", pszSpec="*.wmv") returned 1 [0049.693] lstrlenA (lpString="*.wmv") returned 5 [0049.693] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" [0049.693] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" [0049.693] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", lpString2="." | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv.") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv." [0049.693] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv.wannacry") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv.wannacry" [0049.693] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.693] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e29c25, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e29c25, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2661e, dwReserved0=0x2d8140, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0049.693] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.693] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BabyBoyMainToNotesBackground_PAL.wmv") returned 1 [0049.693] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BabyBoyMainToNotesBackground_PAL.wmv") returned 1 [0049.693] lstrcmpiA (lpString1="", lpString2="BabyBoyMainToNotesBackground_PAL.wmv") returned -1 [0049.693] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned="BabyBoyMainToNotesBackground.wmv" [0049.693] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0049.693] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0049.694] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" [0049.694] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\how to decrypt files.txt")) returned 0x20 [0049.694] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="BabyBoyMainToNotesBackground_PAL.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" [0049.694] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", pszSpec="*.zip") returned 0 [0049.694] lstrlenA (lpString="*.zip") returned 5 [0049.694] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", pszSpec="*.rar") returned 0 [0049.694] lstrlenA (lpString="*.rar") returned 5 [0049.694] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", pszSpec="*.7z") returned 0 [0049.694] lstrlenA (lpString="*.7z") returned 4 [0049.694] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", pszSpec="*.tar") returned 0 [0049.694] lstrlenA (lpString="*.tar") returned 5 [0049.694] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", pszSpec="*.gzip") returned 0 [0049.694] lstrlenA (lpString="*.gzip") returned 6 [0049.694] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", pszSpec="*.jpg") returned 0 [0049.694] lstrlenA (lpString="*.jpg") returned 5 [0049.694] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", pszSpec="*.jpeg") returned 0 [0049.694] lstrlenA (lpString="*.jpeg") returned 6 [0049.694] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", pszSpec="*.psd") returned 0 [0049.694] lstrlenA (lpString="*.psd") returned 5 [0049.694] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", pszSpec="*.gif") returned 0 [0049.694] lstrlenA (lpString="*.gif") returned 5 [0049.694] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", pszSpec="*.doc") returned 0 [0049.694] lstrlenA (lpString="*.doc") returned 5 [0049.694] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", pszSpec="*.docx") returned 0 [0049.694] lstrlenA (lpString="*.docx") returned 6 [0049.694] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", pszSpec="*.xls") returned 0 [0049.694] lstrlenA (lpString="*.xls") returned 5 [0049.694] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", pszSpec="*.xlsx") returned 0 [0049.694] lstrlenA (lpString="*.xlsx") returned 6 [0049.694] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", pszSpec="*.ppt") returned 0 [0049.694] lstrlenA (lpString="*.ppt") returned 5 [0049.694] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", pszSpec="*.pptx") returned 0 [0049.695] lstrlenA (lpString="*.pptx") returned 6 [0049.695] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", pszSpec="*.pdf") returned 0 [0049.695] lstrlenA (lpString="*.pdf") returned 5 [0049.695] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", pszSpec="*.mov") returned 0 [0049.695] lstrlenA (lpString="*.mov") returned 5 [0049.695] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", pszSpec="*.m2v") returned 0 [0049.695] lstrlenA (lpString="*.m2v") returned 5 [0049.695] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", pszSpec="*.3gp") returned 0 [0049.695] lstrlenA (lpString="*.3gp") returned 5 [0049.695] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", pszSpec="*.mpeg") returned 0 [0049.695] lstrlenA (lpString="*.mpeg") returned 6 [0049.695] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", pszSpec="*.mpg") returned 0 [0049.695] lstrlenA (lpString="*.mpg") returned 5 [0049.695] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", pszSpec="*.flv") returned 0 [0049.695] lstrlenA (lpString="*.flv") returned 5 [0049.695] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", pszSpec="*.avi") returned 0 [0049.695] lstrlenA (lpString="*.avi") returned 5 [0049.695] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", pszSpec="*.mp4") returned 0 [0049.695] lstrlenA (lpString="*.mp4") returned 5 [0049.695] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", pszSpec="*.wmv") returned 1 [0049.695] lstrlenA (lpString="*.wmv") returned 5 [0049.695] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" [0049.695] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" [0049.695] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", lpString2="." | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv.") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv." [0049.695] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv.wannacry") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv.wannacry" [0049.695] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.696] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c9de, dwReserved0=0x2d8148, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground.wmv", cAlternateFileName="")) returned 1 [0049.696] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.696] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BabyBoyMainToScenesBackground.wmv") returned 1 [0049.696] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BabyBoyMainToScenesBackground.wmv") returned 1 [0049.696] lstrcmpiA (lpString1="", lpString2="BabyBoyMainToScenesBackground.wmv") returned -1 [0049.696] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned="BabyBoyMainToNotesBackground_PAL.wmv" [0049.696] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0049.696] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0049.696] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" [0049.696] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\how to decrypt files.txt")) returned 0x20 [0049.696] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="BabyBoyMainToScenesBackground.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" [0049.696] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", pszSpec="*.zip") returned 0 [0049.696] lstrlenA (lpString="*.zip") returned 5 [0049.696] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", pszSpec="*.rar") returned 0 [0049.697] lstrlenA (lpString="*.rar") returned 5 [0049.697] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", pszSpec="*.7z") returned 0 [0049.697] lstrlenA (lpString="*.7z") returned 4 [0049.697] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", pszSpec="*.tar") returned 0 [0049.697] lstrlenA (lpString="*.tar") returned 5 [0049.697] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", pszSpec="*.gzip") returned 0 [0049.697] lstrlenA (lpString="*.gzip") returned 6 [0049.697] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", pszSpec="*.jpg") returned 0 [0049.697] lstrlenA (lpString="*.jpg") returned 5 [0049.697] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", pszSpec="*.jpeg") returned 0 [0049.697] lstrlenA (lpString="*.jpeg") returned 6 [0049.697] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", pszSpec="*.psd") returned 0 [0049.697] lstrlenA (lpString="*.psd") returned 5 [0049.697] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", pszSpec="*.gif") returned 0 [0049.697] lstrlenA (lpString="*.gif") returned 5 [0049.697] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", pszSpec="*.doc") returned 0 [0049.697] lstrlenA (lpString="*.doc") returned 5 [0049.697] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", pszSpec="*.docx") returned 0 [0049.697] lstrlenA (lpString="*.docx") returned 6 [0049.697] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", pszSpec="*.xls") returned 0 [0049.697] lstrlenA (lpString="*.xls") returned 5 [0049.697] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", pszSpec="*.xlsx") returned 0 [0049.697] lstrlenA (lpString="*.xlsx") returned 6 [0049.697] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", pszSpec="*.ppt") returned 0 [0049.697] lstrlenA (lpString="*.ppt") returned 5 [0049.697] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", pszSpec="*.pptx") returned 0 [0049.698] lstrlenA (lpString="*.pptx") returned 6 [0049.698] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", pszSpec="*.pdf") returned 0 [0049.698] lstrlenA (lpString="*.pdf") returned 5 [0049.698] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", pszSpec="*.mov") returned 0 [0049.698] lstrlenA (lpString="*.mov") returned 5 [0049.698] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", pszSpec="*.m2v") returned 0 [0049.698] lstrlenA (lpString="*.m2v") returned 5 [0049.698] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", pszSpec="*.3gp") returned 0 [0049.698] lstrlenA (lpString="*.3gp") returned 5 [0049.698] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", pszSpec="*.mpeg") returned 0 [0049.698] lstrlenA (lpString="*.mpeg") returned 6 [0049.698] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", pszSpec="*.mpg") returned 0 [0049.698] lstrlenA (lpString="*.mpg") returned 5 [0049.698] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", pszSpec="*.flv") returned 0 [0049.698] lstrlenA (lpString="*.flv") returned 5 [0049.698] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", pszSpec="*.avi") returned 0 [0049.698] lstrlenA (lpString="*.avi") returned 5 [0049.698] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", pszSpec="*.mp4") returned 0 [0049.698] lstrlenA (lpString="*.mp4") returned 5 [0049.698] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", pszSpec="*.wmv") returned 1 [0049.698] lstrlenA (lpString="*.wmv") returned 5 [0049.698] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" [0049.698] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" [0049.698] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", lpString2="." | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv.") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv." [0049.698] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv.wannacry") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv.wannacry" [0049.698] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.699] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x2d8140, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0049.699] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.699] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BabyBoyMainToScenesBackground_PAL.wmv") returned 1 [0049.699] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BabyBoyMainToScenesBackground_PAL.wmv") returned 1 [0049.700] lstrcmpiA (lpString1="", lpString2="BabyBoyMainToScenesBackground_PAL.wmv") returned -1 [0049.700] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned="BabyBoyMainToScenesBackground.wmv" [0049.700] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0049.700] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0049.700] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" [0049.700] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\how to decrypt files.txt")) returned 0x20 [0049.700] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="BabyBoyMainToScenesBackground_PAL.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" [0049.700] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", pszSpec="*.zip") returned 0 [0049.700] lstrlenA (lpString="*.zip") returned 5 [0049.700] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", pszSpec="*.rar") returned 0 [0049.700] lstrlenA (lpString="*.rar") returned 5 [0049.700] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", pszSpec="*.7z") returned 0 [0049.700] lstrlenA (lpString="*.7z") returned 4 [0049.700] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", pszSpec="*.tar") returned 0 [0049.700] lstrlenA (lpString="*.tar") returned 5 [0049.700] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", pszSpec="*.gzip") returned 0 [0049.700] lstrlenA (lpString="*.gzip") returned 6 [0049.700] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", pszSpec="*.jpg") returned 0 [0049.700] lstrlenA (lpString="*.jpg") returned 5 [0049.700] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", pszSpec="*.jpeg") returned 0 [0049.700] lstrlenA (lpString="*.jpeg") returned 6 [0049.700] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", pszSpec="*.psd") returned 0 [0049.701] lstrlenA (lpString="*.psd") returned 5 [0049.701] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", pszSpec="*.gif") returned 0 [0049.701] lstrlenA (lpString="*.gif") returned 5 [0049.701] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", pszSpec="*.doc") returned 0 [0049.701] lstrlenA (lpString="*.doc") returned 5 [0049.701] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", pszSpec="*.docx") returned 0 [0049.701] lstrlenA (lpString="*.docx") returned 6 [0049.701] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", pszSpec="*.xls") returned 0 [0049.701] lstrlenA (lpString="*.xls") returned 5 [0049.701] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", pszSpec="*.xlsx") returned 0 [0049.701] lstrlenA (lpString="*.xlsx") returned 6 [0049.701] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", pszSpec="*.ppt") returned 0 [0049.701] lstrlenA (lpString="*.ppt") returned 5 [0049.701] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", pszSpec="*.pptx") returned 0 [0049.701] lstrlenA (lpString="*.pptx") returned 6 [0049.701] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", pszSpec="*.pdf") returned 0 [0049.701] lstrlenA (lpString="*.pdf") returned 5 [0049.701] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", pszSpec="*.mov") returned 0 [0049.701] lstrlenA (lpString="*.mov") returned 5 [0049.701] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", pszSpec="*.m2v") returned 0 [0049.701] lstrlenA (lpString="*.m2v") returned 5 [0049.701] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", pszSpec="*.3gp") returned 0 [0049.701] lstrlenA (lpString="*.3gp") returned 5 [0049.701] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", pszSpec="*.mpeg") returned 0 [0049.701] lstrlenA (lpString="*.mpeg") returned 6 [0049.701] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", pszSpec="*.mpg") returned 0 [0049.701] lstrlenA (lpString="*.mpg") returned 5 [0049.701] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", pszSpec="*.flv") returned 0 [0049.701] lstrlenA (lpString="*.flv") returned 5 [0049.702] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", pszSpec="*.avi") returned 0 [0049.702] lstrlenA (lpString="*.avi") returned 5 [0049.702] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", pszSpec="*.mp4") returned 0 [0049.702] lstrlenA (lpString="*.mp4") returned 5 [0049.702] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", pszSpec="*.wmv") returned 1 [0049.702] lstrlenA (lpString="*.wmv") returned 5 [0049.702] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" [0049.702] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" [0049.702] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", lpString2="." | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv.") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv." [0049.702] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv.wannacry") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv.wannacry" [0049.702] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.702] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ec2199, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ec2199, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x2d8148, dwReserved1=0x0, cFileName="BabyBoyNotesBackground.wmv", cAlternateFileName="")) returned 1 [0049.702] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.712] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BabyBoyNotesBackground.wmv") returned 1 [0049.712] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BabyBoyNotesBackground.wmv") returned 1 [0049.712] lstrcmpiA (lpString1="", lpString2="BabyBoyNotesBackground.wmv") returned -1 [0049.712] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned="BabyBoyMainToScenesBackground_PAL.wmv" [0049.712] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0049.712] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0049.712] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" [0049.712] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\how to decrypt files.txt")) returned 0x20 [0049.712] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="BabyBoyNotesBackground.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" [0049.712] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", pszSpec="*.zip") returned 0 [0049.712] lstrlenA (lpString="*.zip") returned 5 [0049.712] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", pszSpec="*.rar") returned 0 [0049.712] lstrlenA (lpString="*.rar") returned 5 [0049.712] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", pszSpec="*.7z") returned 0 [0049.712] lstrlenA (lpString="*.7z") returned 4 [0049.712] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", pszSpec="*.tar") returned 0 [0049.713] lstrlenA (lpString="*.tar") returned 5 [0049.713] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", pszSpec="*.gzip") returned 0 [0049.713] lstrlenA (lpString="*.gzip") returned 6 [0049.713] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", pszSpec="*.jpg") returned 0 [0049.713] lstrlenA (lpString="*.jpg") returned 5 [0049.713] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", pszSpec="*.jpeg") returned 0 [0049.713] lstrlenA (lpString="*.jpeg") returned 6 [0049.713] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", pszSpec="*.psd") returned 0 [0049.713] lstrlenA (lpString="*.psd") returned 5 [0049.713] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", pszSpec="*.gif") returned 0 [0049.713] lstrlenA (lpString="*.gif") returned 5 [0049.713] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", pszSpec="*.doc") returned 0 [0049.713] lstrlenA (lpString="*.doc") returned 5 [0049.713] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", pszSpec="*.docx") returned 0 [0049.713] lstrlenA (lpString="*.docx") returned 6 [0049.713] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", pszSpec="*.xls") returned 0 [0049.713] lstrlenA (lpString="*.xls") returned 5 [0049.713] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", pszSpec="*.xlsx") returned 0 [0049.713] lstrlenA (lpString="*.xlsx") returned 6 [0049.713] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", pszSpec="*.ppt") returned 0 [0049.713] lstrlenA (lpString="*.ppt") returned 5 [0049.713] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", pszSpec="*.pptx") returned 0 [0049.713] lstrlenA (lpString="*.pptx") returned 6 [0049.713] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", pszSpec="*.pdf") returned 0 [0049.713] lstrlenA (lpString="*.pdf") returned 5 [0049.713] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", pszSpec="*.mov") returned 0 [0049.713] lstrlenA (lpString="*.mov") returned 5 [0049.714] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", pszSpec="*.m2v") returned 0 [0049.714] lstrlenA (lpString="*.m2v") returned 5 [0049.714] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", pszSpec="*.3gp") returned 0 [0049.714] lstrlenA (lpString="*.3gp") returned 5 [0049.714] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", pszSpec="*.mpeg") returned 0 [0049.714] lstrlenA (lpString="*.mpeg") returned 6 [0049.714] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", pszSpec="*.mpg") returned 0 [0049.714] lstrlenA (lpString="*.mpg") returned 5 [0049.714] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", pszSpec="*.flv") returned 0 [0049.714] lstrlenA (lpString="*.flv") returned 5 [0049.714] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", pszSpec="*.avi") returned 0 [0049.714] lstrlenA (lpString="*.avi") returned 5 [0049.714] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", pszSpec="*.mp4") returned 0 [0049.714] lstrlenA (lpString="*.mp4") returned 5 [0049.714] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", pszSpec="*.wmv") returned 1 [0049.714] lstrlenA (lpString="*.wmv") returned 5 [0049.714] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" [0049.714] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" [0049.714] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", lpString2="." | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv.") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv." [0049.714] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv.wannacry") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv.wannacry" [0049.714] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.714] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f345b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f345b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x2d8130, dwReserved1=0x0, cFileName="BabyBoyNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0049.714] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.714] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BabyBoyNotesBackground_PAL.wmv") returned 1 [0049.714] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BabyBoyNotesBackground_PAL.wmv") returned 1 [0049.714] lstrcmpiA (lpString1="", lpString2="BabyBoyNotesBackground_PAL.wmv") returned -1 [0049.714] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned="BabyBoyNotesBackground.wmv" [0049.714] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0049.715] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0049.715] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" [0049.715] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\how to decrypt files.txt")) returned 0x20 [0049.715] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="BabyBoyNotesBackground_PAL.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" [0049.715] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", pszSpec="*.zip") returned 0 [0049.715] lstrlenA (lpString="*.zip") returned 5 [0049.715] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", pszSpec="*.rar") returned 0 [0049.715] lstrlenA (lpString="*.rar") returned 5 [0049.715] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", pszSpec="*.7z") returned 0 [0049.715] lstrlenA (lpString="*.7z") returned 4 [0049.715] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", pszSpec="*.tar") returned 0 [0049.715] lstrlenA (lpString="*.tar") returned 5 [0049.715] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", pszSpec="*.gzip") returned 0 [0049.715] lstrlenA (lpString="*.gzip") returned 6 [0049.715] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", pszSpec="*.jpg") returned 0 [0049.715] lstrlenA (lpString="*.jpg") returned 5 [0049.715] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", pszSpec="*.jpeg") returned 0 [0049.715] lstrlenA (lpString="*.jpeg") returned 6 [0049.715] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", pszSpec="*.psd") returned 0 [0049.715] lstrlenA (lpString="*.psd") returned 5 [0049.715] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", pszSpec="*.gif") returned 0 [0049.715] lstrlenA (lpString="*.gif") returned 5 [0049.715] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", pszSpec="*.doc") returned 0 [0049.715] lstrlenA (lpString="*.doc") returned 5 [0049.715] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", pszSpec="*.docx") returned 0 [0049.715] lstrlenA (lpString="*.docx") returned 6 [0049.715] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", pszSpec="*.xls") returned 0 [0049.715] lstrlenA (lpString="*.xls") returned 5 [0049.715] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", pszSpec="*.xlsx") returned 0 [0049.715] lstrlenA (lpString="*.xlsx") returned 6 [0049.715] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", pszSpec="*.ppt") returned 0 [0049.716] lstrlenA (lpString="*.ppt") returned 5 [0049.716] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", pszSpec="*.pptx") returned 0 [0049.716] lstrlenA (lpString="*.pptx") returned 6 [0049.716] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", pszSpec="*.pdf") returned 0 [0049.716] lstrlenA (lpString="*.pdf") returned 5 [0049.716] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", pszSpec="*.mov") returned 0 [0049.716] lstrlenA (lpString="*.mov") returned 5 [0049.716] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", pszSpec="*.m2v") returned 0 [0049.716] lstrlenA (lpString="*.m2v") returned 5 [0049.716] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", pszSpec="*.3gp") returned 0 [0049.716] lstrlenA (lpString="*.3gp") returned 5 [0049.716] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", pszSpec="*.mpeg") returned 0 [0049.716] lstrlenA (lpString="*.mpeg") returned 6 [0049.716] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", pszSpec="*.mpg") returned 0 [0049.716] lstrlenA (lpString="*.mpg") returned 5 [0049.716] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", pszSpec="*.flv") returned 0 [0049.716] lstrlenA (lpString="*.flv") returned 5 [0049.716] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", pszSpec="*.avi") returned 0 [0049.716] lstrlenA (lpString="*.avi") returned 5 [0049.716] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", pszSpec="*.mp4") returned 0 [0049.716] lstrlenA (lpString="*.mp4") returned 5 [0049.716] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", pszSpec="*.wmv") returned 1 [0049.716] lstrlenA (lpString="*.wmv") returned 5 [0049.716] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" [0049.716] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" [0049.716] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", lpString2="." | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv.") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv." [0049.716] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv.wannacry") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv.wannacry" [0049.716] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.717] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f5a70d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f5a70d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2472c, dwReserved0=0x2d8138, dwReserved1=0x0, cFileName="BabyBoyScenesBackground.wmv", cAlternateFileName="")) returned 1 [0049.717] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.717] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BabyBoyScenesBackground.wmv") returned 1 [0049.717] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BabyBoyScenesBackground.wmv") returned 1 [0049.717] lstrcmpiA (lpString1="", lpString2="BabyBoyScenesBackground.wmv") returned -1 [0049.717] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0049.717] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0049.717] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" [0049.717] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\how to decrypt files.txt")) returned 0x20 [0049.717] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="BabyBoyScenesBackground.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" [0049.717] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv", pszSpec="*.zip") returned 0 [0049.717] lstrlenA (lpString="*.zip") returned 5 [0049.717] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv", pszSpec="*.rar") returned 0 [0049.717] lstrlenA (lpString="*.rar") returned 5 [0049.717] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv", pszSpec="*.7z") returned 0 [0049.717] lstrlenA (lpString="*.7z") returned 4 [0049.717] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv", pszSpec="*.tar") returned 0 [0049.717] lstrlenA (lpString="*.tar") returned 5 [0049.717] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv", pszSpec="*.gzip") returned 0 [0049.717] lstrlenA (lpString="*.gzip") returned 6 [0049.717] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv", pszSpec="*.jpg") returned 0 [0049.717] lstrlenA (lpString="*.jpg") returned 5 [0049.717] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv", pszSpec="*.jpeg") returned 0 [0049.717] lstrlenA (lpString="*.jpeg") returned 6 [0049.717] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv", pszSpec="*.psd") returned 0 [0049.717] lstrlenA (lpString="*.psd") returned 5 [0049.717] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv", pszSpec="*.gif") returned 0 [0049.717] lstrlenA (lpString="*.gif") returned 5 [0049.717] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv", pszSpec="*.doc") returned 0 [0049.717] lstrlenA (lpString="*.doc") returned 5 [0049.717] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv", pszSpec="*.docx") returned 0 [0049.718] lstrlenA (lpString="*.docx") returned 6 [0049.718] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv", pszSpec="*.xls") returned 0 [0049.718] lstrlenA (lpString="*.xls") returned 5 [0049.718] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv", pszSpec="*.xlsx") returned 0 [0049.718] lstrlenA (lpString="*.xlsx") returned 6 [0049.718] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv", pszSpec="*.ppt") returned 0 [0049.718] lstrlenA (lpString="*.ppt") returned 5 [0049.718] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv", pszSpec="*.pptx") returned 0 [0049.718] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" [0049.718] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" [0049.718] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv", lpString2="." | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv.") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv." [0049.718] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv.wannacry") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv.wannacry" [0049.718] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.719] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f8086a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f8086a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1e96c, dwReserved0=0x2d8130, dwReserved1=0x0, cFileName="BabyBoyScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0049.719] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.719] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BabyBoyScenesBackground_PAL.wmv") returned 1 [0049.719] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BabyBoyScenesBackground_PAL.wmv") returned 1 [0049.719] lstrcmpiA (lpString1="", lpString2="BabyBoyScenesBackground_PAL.wmv") returned -1 [0049.719] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0049.719] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0049.719] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" [0049.719] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\how to decrypt files.txt")) returned 0x20 [0049.719] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="BabyBoyScenesBackground_PAL.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" [0049.719] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" [0049.719] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" [0049.719] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv", lpString2="." | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv.") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv." [0049.720] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv.wannacry") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv.wannacry" [0049.720] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.720] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fa69c7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fa69c7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x2d8138, dwReserved1=0x0, cFileName="LightBlueRectangle.PNG", cAlternateFileName="")) returned 1 [0049.720] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.720] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LightBlueRectangle.PNG") returned -1 [0049.720] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LightBlueRectangle.PNG") returned -1 [0049.720] lstrcmpiA (lpString1="", lpString2="LightBlueRectangle.PNG") returned -1 [0049.720] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0049.720] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0049.720] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" [0049.720] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\how to decrypt files.txt")) returned 0x20 [0049.720] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="LightBlueRectangle.PNG" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" [0049.720] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MainMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0049.720] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.720] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MainMenuButtonIcon.png") returned -1 [0049.720] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MainMenuButtonIcon.png") returned -1 [0049.720] lstrcmpiA (lpString1="", lpString2="MainMenuButtonIcon.png") returned -1 [0049.720] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0049.720] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0049.720] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" [0049.720] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\how to decrypt files.txt")) returned 0x20 [0049.720] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="MainMenuButtonIcon.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" [0049.720] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7103ef3b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7103ef3b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf63, dwReserved0=0x0, dwReserved1=0x0, cFileName="navSubpicture.png", cAlternateFileName="")) returned 1 [0049.720] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.720] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="navSubpicture.png") returned -1 [0049.720] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="navSubpicture.png") returned -1 [0049.721] lstrcmpiA (lpString1="", lpString2="navSubpicture.png") returned -1 [0049.721] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0049.721] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0049.721] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" [0049.721] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\how to decrypt files.txt")) returned 0x20 [0049.721] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="navSubpicture.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" [0049.721] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_leftarrow.png", cAlternateFileName="")) returned 1 [0049.721] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.721] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="nav_leftarrow.png") returned -1 [0049.721] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="nav_leftarrow.png") returned -1 [0049.721] lstrcmpiA (lpString1="", lpString2="nav_leftarrow.png") returned -1 [0049.721] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0049.721] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0049.721] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" [0049.721] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\how to decrypt files.txt")) returned 0x20 [0049.721] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="nav_leftarrow.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" [0049.721] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ff2c81, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ff2c81, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_rightarrow.png", cAlternateFileName="")) returned 1 [0049.721] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.721] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="nav_rightarrow.png") returned -1 [0049.721] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="nav_rightarrow.png") returned -1 [0049.721] lstrcmpiA (lpString1="", lpString2="nav_rightarrow.png") returned -1 [0049.721] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" [0049.721] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned="" [0049.721] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" [0049.721] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\how to decrypt files.txt")) returned 0x20 [0049.722] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 1 [0049.722] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.722] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="nav_uparrow.png") returned -1 [0049.722] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="nav_uparrow.png") returned -1 [0049.722] lstrcmpiA (lpString1="", lpString2="nav_uparrow.png") returned -1 [0049.723] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 0 [0049.723] FindClose (in: hFindFile=0x2d7fe8 | out: hFindFile=0x2d7fe8) returned 1 [0049.723] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="BabyGirl", cAlternateFileName="")) returned 1 [0049.723] lstrcmpA (lpString1=".", lpString2="BabyGirl") returned -1 [0049.723] lstrcmpA (lpString1="..", lpString2="BabyGirl") returned -1 [0049.723] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d7fe8 [0049.725] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.725] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.725] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.725] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.725] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xab3, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0049.725] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.725] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="16_9-frame-background.png") returned 1 [0049.726] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="16_9-frame-background.png") returned 1 [0049.726] lstrcmpiA (lpString1="", lpString2="16_9-frame-background.png") returned -1 [0049.729] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.729] CloseHandle (hObject=0x90) returned 1 [0049.729] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8a3, dwReserved0=0x0, dwReserved1=0x2d8360, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0049.729] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.729] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="16_9-frame-highlight.png") returned 1 [0049.729] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="16_9-frame-highlight.png") returned 1 [0049.729] lstrcmpiA (lpString1="", lpString2="16_9-frame-highlight.png") returned -1 [0049.729] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7287ed72, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7287ed72, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1 [0049.729] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.729] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="16_9-frame-image-mask.png") returned 1 [0049.729] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="16_9-frame-image-mask.png") returned 1 [0049.729] lstrcmpiA (lpString1="", lpString2="16_9-frame-image-mask.png") returned -1 [0049.729] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72832ab8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72832ab8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4c15, dwReserved0=0x0, dwReserved1=0x0, cFileName="babypink.png", cAlternateFileName="")) returned 1 [0049.730] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.730] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="babypink.png") returned 1 [0049.730] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="babypink.png") returned 1 [0049.730] lstrcmpiA (lpString1="", lpString2="babypink.png") returned -1 [0049.730] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728a4ecf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728a4ecf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0049.730] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.730] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="background.png") returned 1 [0049.730] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.png") returned 1 [0049.730] lstrcmpiA (lpString1="", lpString2="background.png") returned -1 [0049.730] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728cb02c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728cb02c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fe5c4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c432, dwReserved0=0x0, dwReserved1=0x0, cFileName="bear_formatted_matte2.wmv", cAlternateFileName="")) returned 1 [0049.730] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.730] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bear_formatted_matte2.wmv") returned 1 [0049.730] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bear_formatted_matte2.wmv") returned 1 [0049.730] lstrcmpiA (lpString1="", lpString2="bear_formatted_matte2.wmv") returned -1 [0049.732] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728f1189, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728f1189, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a058069, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c44a, dwReserved0=0x2d8130, dwReserved1=0x0, cFileName="Bear_Formatted_MATTE2_PAL.wmv", cAlternateFileName="")) returned 1 [0049.732] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.732] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Bear_Formatted_MATTE2_PAL.wmv") returned 1 [0049.732] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Bear_Formatted_MATTE2_PAL.wmv") returned 1 [0049.732] lstrcmpiA (lpString1="", lpString2="Bear_Formatted_MATTE2_PAL.wmv") returned -1 [0049.732] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729172e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729172e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a351bc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39ef2, dwReserved0=0x2d8138, dwReserved1=0x0, cFileName="bear_formatted_rgb6.wmv", cAlternateFileName="")) returned 1 [0049.732] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.732] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bear_formatted_rgb6.wmv") returned 1 [0049.732] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bear_formatted_rgb6.wmv") returned 1 [0049.732] lstrcmpiA (lpString1="", lpString2="bear_formatted_rgb6.wmv") returned -1 [0049.732] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729635a0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729635a0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41c0a, dwReserved0=0x2d8130, dwReserved1=0x0, cFileName="Bear_Formatted_RGB6_PAL.wmv", cAlternateFileName="")) returned 1 [0049.732] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.732] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Bear_Formatted_RGB6_PAL.wmv") returned 1 [0049.732] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Bear_Formatted_RGB6_PAL.wmv") returned 1 [0049.732] lstrcmpiA (lpString1="", lpString2="Bear_Formatted_RGB6_PAL.wmv") returned -1 [0049.732] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc5, dwReserved0=0x2d8138, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0049.733] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.733] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="btn-back-static.png") returned 1 [0049.733] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="btn-back-static.png") returned 1 [0049.733] lstrcmpiA (lpString1="", lpString2="btn-back-static.png") returned -1 [0049.733] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0049.733] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.733] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="btn-next-static.png") returned 1 [0049.733] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="btn-next-static.png") returned 1 [0049.733] lstrcmpiA (lpString1="", lpString2="btn-next-static.png") returned -1 [0049.733] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0049.733] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.733] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="btn-previous-static.png") returned 1 [0049.733] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="btn-previous-static.png") returned 1 [0049.733] lstrcmpiA (lpString1="", lpString2="btn-previous-static.png") returned -1 [0049.733] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75d, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0049.733] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.733] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="button-highlight.png") returned 1 [0049.733] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button-highlight.png") returned 1 [0049.733] lstrcmpiA (lpString1="", lpString2="button-highlight.png") returned -1 [0049.733] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x55f, dwReserved0=0x0, dwReserved1=0x0, cFileName="chapters-static.png", cAlternateFileName="")) returned 1 [0049.733] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.733] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="chapters-static.png") returned 1 [0049.733] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chapters-static.png") returned 1 [0049.733] lstrcmpiA (lpString1="", lpString2="chapters-static.png") returned -1 [0049.733] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729fbb14, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729fbb14, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4aba6851, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8df12, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-background.png", cAlternateFileName="")) returned 1 [0049.734] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.734] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="content-background.png") returned 1 [0049.734] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="content-background.png") returned 1 [0049.734] lstrcmpiA (lpString1="", lpString2="content-background.png") returned -1 [0049.734] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a47dce, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a47dce, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-foreground.png", cAlternateFileName="")) returned 1 [0049.734] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.734] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="content-foreground.png") returned 1 [0049.734] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="content-foreground.png") returned 1 [0049.734] lstrcmpiA (lpString1="", lpString2="content-foreground.png") returned -1 [0049.734] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a6df2b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a6df2b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="curtains.png", cAlternateFileName="")) returned 1 [0049.734] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.734] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="curtains.png") returned 1 [0049.734] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="curtains.png") returned 1 [0049.734] lstrcmpiA (lpString1="", lpString2="curtains.png") returned -1 [0049.734] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12d98, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_precomp_matte.wmv", cAlternateFileName="")) returned 1 [0049.734] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.734] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="flower_precomp_matte.wmv") returned -1 [0049.734] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="flower_precomp_matte.wmv") returned 1 [0049.734] lstrcmpiA (lpString1="", lpString2="flower_precomp_matte.wmv") returned -1 [0049.735] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14cd8, dwReserved0=0x2d8130, dwReserved1=0x0, cFileName="flower_PreComp_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0049.735] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.735] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="flower_PreComp_MATTE_PAL.wmv") returned -1 [0049.735] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="flower_PreComp_MATTE_PAL.wmv") returned 1 [0049.735] lstrcmpiA (lpString1="", lpString2="flower_PreComp_MATTE_PAL.wmv") returned -1 [0049.735] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b788b6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b788b6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x26618, dwReserved0=0x2d8138, dwReserved1=0x0, cFileName="flower_trans_matte.wmv", cAlternateFileName="")) returned 1 [0049.735] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.735] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="flower_trans_matte.wmv") returned -1 [0049.735] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="flower_trans_matte.wmv") returned 1 [0049.735] lstrcmpiA (lpString1="", lpString2="flower_trans_matte.wmv") returned -1 [0049.735] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b9ea13, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b9ea13, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x28558, dwReserved0=0x2d8128, dwReserved1=0x0, cFileName="flower_trans_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0049.735] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.735] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="flower_trans_MATTE_PAL.wmv") returned -1 [0049.736] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="flower_trans_MATTE_PAL.wmv") returned 1 [0049.736] lstrcmpiA (lpString1="", lpString2="flower_trans_MATTE_PAL.wmv") returned -1 [0049.736] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b0649f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b0649f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b44779d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e31e, dwReserved0=0x2d8130, dwReserved1=0x0, cFileName="flower_trans_rgb.wmv", cAlternateFileName="")) returned 1 [0049.736] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.736] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="flower_trans_rgb.wmv") returned -1 [0049.736] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="flower_trans_rgb.wmv") returned 1 [0049.736] lstrcmpiA (lpString1="", lpString2="flower_trans_rgb.wmv") returned -1 [0049.736] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b2c5fc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b2c5fc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39e98, dwReserved0=0x2d8128, dwReserved1=0x0, cFileName="flower_trans_RGB_PAL.wmv", cAlternateFileName="")) returned 1 [0049.736] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.737] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="flower_trans_RGB_PAL.wmv") returned -1 [0049.737] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="flower_trans_RGB_PAL.wmv") returned 1 [0049.737] lstrcmpiA (lpString1="", lpString2="flower_trans_RGB_PAL.wmv") returned -1 [0049.737] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a94088, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a94088, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0x2d8130, dwReserved1=0x0, cFileName="highlight.png", cAlternateFileName="")) returned 1 [0049.737] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.737] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="highlight.png") returned -1 [0049.737] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="highlight.png") returned 1 [0049.737] lstrcmpiA (lpString1="", lpString2="highlight.png") returned -1 [0049.737] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72aba1e5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72aba1e5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x239b, dwReserved0=0x0, dwReserved1=0x0, cFileName="mainimage-mask.png", cAlternateFileName="")) returned 1 [0049.737] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.737] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mainimage-mask.png") returned -1 [0049.737] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mainimage-mask.png") returned -1 [0049.737] lstrcmpiA (lpString1="", lpString2="mainimage-mask.png") returned -1 [0049.737] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x559, dwReserved0=0x0, dwReserved1=0x0, cFileName="notes-static.png", cAlternateFileName="")) returned 1 [0049.737] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.737] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="notes-static.png") returned -1 [0049.737] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="notes-static.png") returned -1 [0049.737] lstrcmpiA (lpString1="", lpString2="notes-static.png") returned -1 [0049.737] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0x0, dwReserved1=0x0, cFileName="play-static.png", cAlternateFileName="")) returned 1 [0049.737] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.737] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="play-static.png") returned -1 [0049.737] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="play-static.png") returned -1 [0049.737] lstrcmpiA (lpString1="", lpString2="play-static.png") returned -1 [0049.738] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0x0, dwReserved1=0x0, cFileName="play-static.png", cAlternateFileName="")) returned 0 [0049.738] FindClose (in: hFindFile=0x2d7fe8 | out: hFindFile=0x2d7fe8) returned 1 [0049.738] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecb0968, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ecb0968, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="BlackRectangle.bmp", cAlternateFileName="")) returned 1 [0049.738] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.738] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BlackRectangle.bmp") returned 1 [0049.738] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BlackRectangle.bmp") returned 1 [0049.738] lstrcmpiA (lpString1="", lpString2="BlackRectangle.bmp") returned -1 [0049.738] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_glass.png", cAlternateFileName="")) returned 1 [0049.738] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.738] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="circleround_glass.png") returned 1 [0049.738] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="circleround_glass.png") returned 1 [0049.738] lstrcmpiA (lpString1="", lpString2="circleround_glass.png") returned -1 [0049.738] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0049.738] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.738] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="circleround_selectionsubpicture.png") returned 1 [0049.738] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="circleround_selectionsubpicture.png") returned 1 [0049.738] lstrcmpiA (lpString1="", lpString2="circleround_selectionsubpicture.png") returned -1 [0049.738] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebcc13a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebcc13a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_videoinset.png", cAlternateFileName="")) returned 1 [0049.738] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.738] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="circleround_videoinset.png") returned 1 [0049.738] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="circleround_videoinset.png") returned 1 [0049.738] lstrcmpiA (lpString1="", lpString2="circleround_videoinset.png") returned -1 [0049.739] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edbb2f3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6edbb2f3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c53d379, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0049.739] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.739] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Circle_ButtonGraphic.png") returned 1 [0049.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Circle_ButtonGraphic.png") returned 1 [0049.739] lstrcmpiA (lpString1="", lpString2="Circle_ButtonGraphic.png") returned -1 [0049.739] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e990cc7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e990cc7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="circle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0049.739] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.739] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="circle_glass_Thumbnail.bmp") returned 1 [0049.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="circle_glass_Thumbnail.bmp") returned 1 [0049.739] lstrcmpiA (lpString1="", lpString2="circle_glass_Thumbnail.bmp") returned -1 [0049.739] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureA.png", cAlternateFileName="")) returned 1 [0049.739] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.739] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Circle_SelectionSubpictureA.png") returned 1 [0049.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Circle_SelectionSubpictureA.png") returned 1 [0049.739] lstrcmpiA (lpString1="", lpString2="Circle_SelectionSubpictureA.png") returned -1 [0049.739] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureB.png", cAlternateFileName="")) returned 1 [0049.739] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.739] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Circle_SelectionSubpictureB.png") returned 1 [0049.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Circle_SelectionSubpictureB.png") returned 1 [0049.739] lstrcmpiA (lpString1="", lpString2="Circle_SelectionSubpictureB.png") returned -1 [0049.739] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_VideoInset.png", cAlternateFileName="")) returned 1 [0049.739] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.739] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Circle_VideoInset.png") returned 1 [0049.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Circle_VideoInset.png") returned 1 [0049.739] lstrcmpiA (lpString1="", lpString2="Circle_VideoInset.png") returned -1 [0049.740] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea030de, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea030de, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cloud_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0049.740] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.740] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cloud_Thumbnail.bmp") returned 1 [0049.740] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cloud_Thumbnail.bmp") returned 1 [0049.740] lstrcmpiA (lpString1="", lpString2="cloud_Thumbnail.bmp") returned -1 [0049.740] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5c9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dot.png", cAlternateFileName="")) returned 1 [0049.740] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.740] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Dot.png") returned 1 [0049.740] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Dot.png") returned 1 [0049.740] lstrcmpiA (lpString1="", lpString2="Dot.png") returned -1 [0049.740] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee799c4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee799c4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4cb30a29, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x422c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DvdTransform.fx", cAlternateFileName="")) returned 1 [0049.740] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.740] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DvdTransform.fx") returned 1 [0049.740] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DvdTransform.fx") returned 1 [0049.740] lstrcmpiA (lpString1="", lpString2="DvdTransform.fx") returned -1 [0049.740] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlipPage", cAlternateFileName="")) returned 1 [0049.740] lstrcmpA (lpString1=".", lpString2="FlipPage") returned -1 [0049.740] lstrcmpA (lpString1="..", lpString2="FlipPage") returned -1 [0049.740] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d8118, cFileName=".", cAlternateFileName="")) returned 0x2d7fe8 [0049.742] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.742] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.743] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.743] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.743] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe188e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe188e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0049.743] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.743] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="1047x576black.png") returned 1 [0049.743] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1047x576black.png") returned 1 [0049.743] lstrcmpiA (lpString1="", lpString2="1047x576black.png") returned -1 [0049.743] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*") returned="*.*" [0049.743] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" [0049.743] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="" [0049.743] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\how to decrypt files.txt")) returned 0xffffffff [0049.743] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.744] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0049.744] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0049.745] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.745] CloseHandle (hObject=0x90) returned 1 [0049.745] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpString2="1047x576black.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" [0049.745] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.zip") returned 0 [0049.745] lstrlenA (lpString="*.zip") returned 5 [0049.745] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.rar") returned 0 [0049.745] lstrlenA (lpString="*.rar") returned 5 [0049.745] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.7z") returned 0 [0049.745] lstrlenA (lpString="*.7z") returned 4 [0049.746] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.tar") returned 0 [0049.746] lstrlenA (lpString="*.tar") returned 5 [0049.746] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.gzip") returned 0 [0049.746] lstrlenA (lpString="*.gzip") returned 6 [0049.746] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.jpg") returned 0 [0049.746] lstrlenA (lpString="*.jpg") returned 5 [0049.746] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.jpeg") returned 0 [0049.746] lstrlenA (lpString="*.jpeg") returned 6 [0049.746] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.psd") returned 0 [0049.746] lstrlenA (lpString="*.psd") returned 5 [0049.746] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.gif") returned 0 [0049.746] lstrlenA (lpString="*.gif") returned 5 [0049.746] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.doc") returned 0 [0049.746] lstrlenA (lpString="*.doc") returned 5 [0049.746] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.docx") returned 0 [0049.746] lstrlenA (lpString="*.docx") returned 6 [0049.746] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.xls") returned 0 [0049.746] lstrlenA (lpString="*.xls") returned 5 [0049.746] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.xlsx") returned 0 [0049.746] lstrlenA (lpString="*.xlsx") returned 6 [0049.746] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.ppt") returned 0 [0049.746] lstrlenA (lpString="*.ppt") returned 5 [0049.746] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.pptx") returned 0 [0049.746] lstrlenA (lpString="*.pptx") returned 6 [0049.746] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.pdf") returned 0 [0049.746] lstrlenA (lpString="*.pdf") returned 5 [0049.746] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.mov") returned 0 [0049.746] lstrlenA (lpString="*.mov") returned 5 [0049.746] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.m2v") returned 0 [0049.746] lstrlenA (lpString="*.m2v") returned 5 [0049.746] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.3gp") returned 0 [0049.746] lstrlenA (lpString="*.3gp") returned 5 [0049.747] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.mpeg") returned 0 [0049.747] lstrlenA (lpString="*.mpeg") returned 6 [0049.747] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.mpg") returned 0 [0049.747] lstrlenA (lpString="*.mpg") returned 5 [0049.747] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.flv") returned 0 [0049.747] lstrlenA (lpString="*.flv") returned 5 [0049.747] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.avi") returned 0 [0049.747] lstrlenA (lpString="*.avi") returned 5 [0049.747] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.mp4") returned 0 [0049.747] lstrlenA (lpString="*.mp4") returned 5 [0049.747] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.wmv") returned 0 [0049.747] lstrlenA (lpString="*.wmv") returned 5 [0049.747] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.divx") returned 0 [0049.747] lstrlenA (lpString="*.divx") returned 6 [0049.747] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.mkv") returned 0 [0049.747] lstrlenA (lpString="*.mkv") returned 5 [0049.747] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.mp3") returned 0 [0049.747] lstrlenA (lpString="*.mp3") returned 5 [0049.747] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.wav") returned 0 [0049.747] lstrlenA (lpString="*.wav") returned 5 [0049.747] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.flac") returned 0 [0049.747] lstrlenA (lpString="*.flac") returned 6 [0049.747] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.ape") returned 0 [0049.747] lstrlenA (lpString="*.ape") returned 5 [0049.747] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.wma") returned 0 [0049.747] lstrlenA (lpString="*.wma") returned 5 [0049.747] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.ac3") returned 0 [0049.747] lstrlenA (lpString="*.ac3") returned 5 [0049.747] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", pszSpec="*.mxf") returned 0 [0049.748] lstrlenA (lpString="*.mxf") returned 5 [0049.748] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe3ea46, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe3ea46, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x2d8360, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0049.748] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.748] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="203x8subpicture.png") returned 1 [0049.748] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="203x8subpicture.png") returned 1 [0049.748] lstrcmpiA (lpString1="", lpString2="203x8subpicture.png") returned -1 [0049.748] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png") returned="1047x576black.png" [0049.748] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" [0049.748] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="" [0049.748] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\HOW TO DECRYPT FILES.txt" [0049.748] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\how to decrypt files.txt")) returned 0x20 [0049.748] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpString2="203x8subpicture.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" [0049.748] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.zip") returned 0 [0049.748] lstrlenA (lpString="*.zip") returned 5 [0049.748] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.rar") returned 0 [0049.748] lstrlenA (lpString="*.rar") returned 5 [0049.748] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.7z") returned 0 [0049.748] lstrlenA (lpString="*.7z") returned 4 [0049.748] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.tar") returned 0 [0049.748] lstrlenA (lpString="*.tar") returned 5 [0049.748] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.gzip") returned 0 [0049.748] lstrlenA (lpString="*.gzip") returned 6 [0049.748] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.jpg") returned 0 [0049.748] lstrlenA (lpString="*.jpg") returned 5 [0049.748] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.jpeg") returned 0 [0049.748] lstrlenA (lpString="*.jpeg") returned 6 [0049.749] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.psd") returned 0 [0049.749] lstrlenA (lpString="*.psd") returned 5 [0049.749] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.gif") returned 0 [0049.749] lstrlenA (lpString="*.gif") returned 5 [0049.749] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.doc") returned 0 [0049.749] lstrlenA (lpString="*.doc") returned 5 [0049.749] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.docx") returned 0 [0049.749] lstrlenA (lpString="*.docx") returned 6 [0049.749] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.xls") returned 0 [0049.749] lstrlenA (lpString="*.xls") returned 5 [0049.749] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.xlsx") returned 0 [0049.749] lstrlenA (lpString="*.xlsx") returned 6 [0049.749] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.ppt") returned 0 [0049.749] lstrlenA (lpString="*.ppt") returned 5 [0049.749] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.pptx") returned 0 [0049.749] lstrlenA (lpString="*.pptx") returned 6 [0049.749] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.pdf") returned 0 [0049.749] lstrlenA (lpString="*.pdf") returned 5 [0049.749] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.mov") returned 0 [0049.749] lstrlenA (lpString="*.mov") returned 5 [0049.749] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.m2v") returned 0 [0049.749] lstrlenA (lpString="*.m2v") returned 5 [0049.749] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.3gp") returned 0 [0049.749] lstrlenA (lpString="*.3gp") returned 5 [0049.749] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.mpeg") returned 0 [0049.749] lstrlenA (lpString="*.mpeg") returned 6 [0049.750] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.mpg") returned 0 [0049.750] lstrlenA (lpString="*.mpg") returned 5 [0049.750] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.flv") returned 0 [0049.750] lstrlenA (lpString="*.flv") returned 5 [0049.750] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.avi") returned 0 [0049.750] lstrlenA (lpString="*.avi") returned 5 [0049.750] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.mp4") returned 0 [0049.750] lstrlenA (lpString="*.mp4") returned 5 [0049.750] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.wmv") returned 0 [0049.750] lstrlenA (lpString="*.wmv") returned 5 [0049.750] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.divx") returned 0 [0049.750] lstrlenA (lpString="*.divx") returned 6 [0049.750] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.mkv") returned 0 [0049.750] lstrlenA (lpString="*.mkv") returned 5 [0049.750] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.mp3") returned 0 [0049.750] lstrlenA (lpString="*.mp3") returned 5 [0049.750] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.wav") returned 0 [0049.750] lstrlenA (lpString="*.wav") returned 5 [0049.750] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.flac") returned 0 [0049.750] lstrlenA (lpString="*.flac") returned 6 [0049.750] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.ape") returned 0 [0049.750] lstrlenA (lpString="*.ape") returned 5 [0049.750] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.wma") returned 0 [0049.751] lstrlenA (lpString="*.wma") returned 5 [0049.751] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.ac3") returned 0 [0049.751] lstrlenA (lpString="*.ac3") returned 5 [0049.751] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", pszSpec="*.mxf") returned 0 [0049.751] lstrlenA (lpString="*.mxf") returned 5 [0049.751] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fed6fba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fed6fba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0049.751] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.751] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NavigationLeft_ButtonGraphic.png") returned -1 [0049.751] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NavigationLeft_ButtonGraphic.png") returned -1 [0049.751] lstrcmpiA (lpString1="", lpString2="NavigationLeft_ButtonGraphic.png") returned -1 [0049.751] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png") returned="203x8subpicture.png" [0049.751] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" [0049.751] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="" [0049.751] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\HOW TO DECRYPT FILES.txt" [0049.751] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\how to decrypt files.txt")) returned 0x20 [0049.751] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" [0049.751] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.zip") returned 0 [0049.751] lstrlenA (lpString="*.zip") returned 5 [0049.751] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.rar") returned 0 [0049.751] lstrlenA (lpString="*.rar") returned 5 [0049.751] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.7z") returned 0 [0049.752] lstrlenA (lpString="*.7z") returned 4 [0049.752] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.tar") returned 0 [0049.752] lstrlenA (lpString="*.tar") returned 5 [0049.752] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.gzip") returned 0 [0049.752] lstrlenA (lpString="*.gzip") returned 6 [0049.752] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.jpg") returned 0 [0049.752] lstrlenA (lpString="*.jpg") returned 5 [0049.752] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.jpeg") returned 0 [0049.752] lstrlenA (lpString="*.jpeg") returned 6 [0049.752] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.psd") returned 0 [0049.752] lstrlenA (lpString="*.psd") returned 5 [0049.752] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.gif") returned 0 [0049.752] lstrlenA (lpString="*.gif") returned 5 [0049.752] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.doc") returned 0 [0049.752] lstrlenA (lpString="*.doc") returned 5 [0049.752] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.docx") returned 0 [0049.752] lstrlenA (lpString="*.docx") returned 6 [0049.752] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.xls") returned 0 [0049.752] lstrlenA (lpString="*.xls") returned 5 [0049.752] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.xlsx") returned 0 [0049.752] lstrlenA (lpString="*.xlsx") returned 6 [0049.752] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.ppt") returned 0 [0049.752] lstrlenA (lpString="*.ppt") returned 5 [0049.752] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.pptx") returned 0 [0049.752] lstrlenA (lpString="*.pptx") returned 6 [0049.752] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.pdf") returned 0 [0049.752] lstrlenA (lpString="*.pdf") returned 5 [0049.753] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.mov") returned 0 [0049.753] lstrlenA (lpString="*.mov") returned 5 [0049.753] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.m2v") returned 0 [0049.753] lstrlenA (lpString="*.m2v") returned 5 [0049.753] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.3gp") returned 0 [0049.753] lstrlenA (lpString="*.3gp") returned 5 [0049.753] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.mpeg") returned 0 [0049.753] lstrlenA (lpString="*.mpeg") returned 6 [0049.753] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.mpg") returned 0 [0049.753] lstrlenA (lpString="*.mpg") returned 5 [0049.753] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.flv") returned 0 [0049.753] lstrlenA (lpString="*.flv") returned 5 [0049.753] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.avi") returned 0 [0049.753] lstrlenA (lpString="*.avi") returned 5 [0049.753] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.mp4") returned 0 [0049.753] lstrlenA (lpString="*.mp4") returned 5 [0049.753] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.wmv") returned 0 [0049.753] lstrlenA (lpString="*.wmv") returned 5 [0049.753] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.divx") returned 0 [0049.753] lstrlenA (lpString="*.divx") returned 6 [0049.753] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.mkv") returned 0 [0049.753] lstrlenA (lpString="*.mkv") returned 5 [0049.753] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.mp3") returned 0 [0049.753] lstrlenA (lpString="*.mp3") returned 5 [0049.753] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.wav") returned 0 [0049.753] lstrlenA (lpString="*.wav") returned 5 [0049.753] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.flac") returned 0 [0049.754] lstrlenA (lpString="*.flac") returned 6 [0049.754] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.ape") returned 0 [0049.754] lstrlenA (lpString="*.ape") returned 5 [0049.754] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.wma") returned 0 [0049.754] lstrlenA (lpString="*.wma") returned 5 [0049.754] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.ac3") returned 0 [0049.754] lstrlenA (lpString="*.ac3") returned 5 [0049.754] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", pszSpec="*.mxf") returned 0 [0049.754] lstrlenA (lpString="*.mxf") returned 5 [0049.754] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0049.754] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.754] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NavigationLeft_SelectionSubpicture.png") returned -1 [0049.754] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NavigationLeft_SelectionSubpicture.png") returned -1 [0049.754] lstrcmpiA (lpString1="", lpString2="NavigationLeft_SelectionSubpicture.png") returned -1 [0049.754] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0049.754] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" [0049.754] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="" [0049.754] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\HOW TO DECRYPT FILES.txt" [0049.754] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\how to decrypt files.txt")) returned 0x20 [0049.754] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" [0049.754] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.zip") returned 0 [0049.754] lstrlenA (lpString="*.zip") returned 5 [0049.755] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.rar") returned 0 [0049.755] lstrlenA (lpString="*.rar") returned 5 [0049.755] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.7z") returned 0 [0049.755] lstrlenA (lpString="*.7z") returned 4 [0049.755] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.tar") returned 0 [0049.755] lstrlenA (lpString="*.tar") returned 5 [0049.755] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.gzip") returned 0 [0049.755] lstrlenA (lpString="*.gzip") returned 6 [0049.755] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.jpg") returned 0 [0049.755] lstrlenA (lpString="*.jpg") returned 5 [0049.755] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.jpeg") returned 0 [0049.755] lstrlenA (lpString="*.jpeg") returned 6 [0049.755] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.psd") returned 0 [0049.755] lstrlenA (lpString="*.psd") returned 5 [0049.755] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.gif") returned 0 [0049.755] lstrlenA (lpString="*.gif") returned 5 [0049.755] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.doc") returned 0 [0049.755] lstrlenA (lpString="*.doc") returned 5 [0049.755] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.docx") returned 0 [0049.755] lstrlenA (lpString="*.docx") returned 6 [0049.755] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.xls") returned 0 [0049.755] lstrlenA (lpString="*.xls") returned 5 [0049.755] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.xlsx") returned 0 [0049.755] lstrlenA (lpString="*.xlsx") returned 6 [0049.755] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.ppt") returned 0 [0049.755] lstrlenA (lpString="*.ppt") returned 5 [0049.755] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.pptx") returned 0 [0049.755] lstrlenA (lpString="*.pptx") returned 6 [0049.756] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.pdf") returned 0 [0049.756] lstrlenA (lpString="*.pdf") returned 5 [0049.756] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.mov") returned 0 [0049.756] lstrlenA (lpString="*.mov") returned 5 [0049.756] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.m2v") returned 0 [0049.756] lstrlenA (lpString="*.m2v") returned 5 [0049.756] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.3gp") returned 0 [0049.756] lstrlenA (lpString="*.3gp") returned 5 [0049.756] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.mpeg") returned 0 [0049.756] lstrlenA (lpString="*.mpeg") returned 6 [0049.756] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.mpg") returned 0 [0049.756] lstrlenA (lpString="*.mpg") returned 5 [0049.756] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.flv") returned 0 [0049.756] lstrlenA (lpString="*.flv") returned 5 [0049.756] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.avi") returned 0 [0049.756] lstrlenA (lpString="*.avi") returned 5 [0049.756] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.mp4") returned 0 [0049.756] lstrlenA (lpString="*.mp4") returned 5 [0049.756] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.wmv") returned 0 [0049.756] lstrlenA (lpString="*.wmv") returned 5 [0049.756] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.divx") returned 0 [0049.756] lstrlenA (lpString="*.divx") returned 6 [0049.756] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.mkv") returned 0 [0049.756] lstrlenA (lpString="*.mkv") returned 5 [0049.756] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.mp3") returned 0 [0049.756] lstrlenA (lpString="*.mp3") returned 5 [0049.756] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.wav") returned 0 [0049.756] lstrlenA (lpString="*.wav") returned 5 [0049.756] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.flac") returned 0 [0049.757] lstrlenA (lpString="*.flac") returned 6 [0049.757] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.ape") returned 0 [0049.757] lstrlenA (lpString="*.ape") returned 5 [0049.757] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.wma") returned 0 [0049.757] lstrlenA (lpString="*.wma") returned 5 [0049.757] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.ac3") returned 0 [0049.757] lstrlenA (lpString="*.ac3") returned 5 [0049.757] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", pszSpec="*.mxf") returned 0 [0049.757] lstrlenA (lpString="*.mxf") returned 5 [0049.757] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0049.757] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.757] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NavigationRight_ButtonGraphic.png") returned -1 [0049.757] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NavigationRight_ButtonGraphic.png") returned -1 [0049.757] lstrcmpiA (lpString1="", lpString2="NavigationRight_ButtonGraphic.png") returned -1 [0049.757] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0049.757] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" [0049.757] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="" [0049.757] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\HOW TO DECRYPT FILES.txt" [0049.757] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\how to decrypt files.txt")) returned 0x20 [0049.757] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" [0049.757] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.zip") returned 0 [0049.757] lstrlenA (lpString="*.zip") returned 5 [0049.758] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.rar") returned 0 [0049.758] lstrlenA (lpString="*.rar") returned 5 [0049.758] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.7z") returned 0 [0049.758] lstrlenA (lpString="*.7z") returned 4 [0049.758] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.tar") returned 0 [0049.758] lstrlenA (lpString="*.tar") returned 5 [0049.758] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.gzip") returned 0 [0049.758] lstrlenA (lpString="*.gzip") returned 6 [0049.758] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.jpg") returned 0 [0049.758] lstrlenA (lpString="*.jpg") returned 5 [0049.758] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.jpeg") returned 0 [0049.758] lstrlenA (lpString="*.jpeg") returned 6 [0049.758] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.psd") returned 0 [0049.758] lstrlenA (lpString="*.psd") returned 5 [0049.758] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.gif") returned 0 [0049.758] lstrlenA (lpString="*.gif") returned 5 [0049.758] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.doc") returned 0 [0049.758] lstrlenA (lpString="*.doc") returned 5 [0049.758] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.docx") returned 0 [0049.758] lstrlenA (lpString="*.docx") returned 6 [0049.758] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.xls") returned 0 [0049.759] lstrlenA (lpString="*.xls") returned 5 [0049.759] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.xlsx") returned 0 [0049.759] lstrlenA (lpString="*.xlsx") returned 6 [0049.759] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.ppt") returned 0 [0049.759] lstrlenA (lpString="*.ppt") returned 5 [0049.759] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.pptx") returned 0 [0049.759] lstrlenA (lpString="*.pptx") returned 6 [0049.759] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.pdf") returned 0 [0049.759] lstrlenA (lpString="*.pdf") returned 5 [0049.759] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.mov") returned 0 [0049.759] lstrlenA (lpString="*.mov") returned 5 [0049.759] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.m2v") returned 0 [0049.759] lstrlenA (lpString="*.m2v") returned 5 [0049.759] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.3gp") returned 0 [0049.759] lstrlenA (lpString="*.3gp") returned 5 [0049.759] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.mpeg") returned 0 [0049.759] lstrlenA (lpString="*.mpeg") returned 6 [0049.759] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.mpg") returned 0 [0049.759] lstrlenA (lpString="*.mpg") returned 5 [0049.760] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.flv") returned 0 [0049.760] lstrlenA (lpString="*.flv") returned 5 [0049.760] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.avi") returned 0 [0049.760] lstrlenA (lpString="*.avi") returned 5 [0049.760] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.mp4") returned 0 [0049.760] lstrlenA (lpString="*.mp4") returned 5 [0049.760] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.wmv") returned 0 [0049.760] lstrlenA (lpString="*.wmv") returned 5 [0049.760] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.divx") returned 0 [0049.760] lstrlenA (lpString="*.divx") returned 6 [0049.760] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.mkv") returned 0 [0049.760] lstrlenA (lpString="*.mkv") returned 5 [0049.760] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.mp3") returned 0 [0049.760] lstrlenA (lpString="*.mp3") returned 5 [0049.760] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.wav") returned 0 [0049.760] lstrlenA (lpString="*.wav") returned 5 [0049.760] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.flac") returned 0 [0049.760] lstrlenA (lpString="*.flac") returned 6 [0049.760] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.ape") returned 0 [0049.760] lstrlenA (lpString="*.ape") returned 5 [0049.761] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.wma") returned 0 [0049.761] lstrlenA (lpString="*.wma") returned 5 [0049.761] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.ac3") returned 0 [0049.761] lstrlenA (lpString="*.ac3") returned 5 [0049.761] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", pszSpec="*.mxf") returned 0 [0049.761] lstrlenA (lpString="*.mxf") returned 5 [0049.761] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0049.761] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.761] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NavigationRight_SelectionSubpicture.png") returned -1 [0049.761] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NavigationRight_SelectionSubpicture.png") returned -1 [0049.761] lstrcmpiA (lpString1="", lpString2="NavigationRight_SelectionSubpicture.png") returned -1 [0049.761] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0049.761] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" [0049.761] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="" [0049.761] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\HOW TO DECRYPT FILES.txt" [0049.761] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\how to decrypt files.txt")) returned 0x20 [0049.761] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" [0049.761] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.zip") returned 0 [0049.761] lstrlenA (lpString="*.zip") returned 5 [0049.761] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.rar") returned 0 [0049.761] lstrlenA (lpString="*.rar") returned 5 [0049.761] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.7z") returned 0 [0049.761] lstrlenA (lpString="*.7z") returned 4 [0049.762] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.tar") returned 0 [0049.762] lstrlenA (lpString="*.tar") returned 5 [0049.762] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.gzip") returned 0 [0049.762] lstrlenA (lpString="*.gzip") returned 6 [0049.762] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.jpg") returned 0 [0049.762] lstrlenA (lpString="*.jpg") returned 5 [0049.762] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.jpeg") returned 0 [0049.762] lstrlenA (lpString="*.jpeg") returned 6 [0049.762] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.psd") returned 0 [0049.762] lstrlenA (lpString="*.psd") returned 5 [0049.762] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.gif") returned 0 [0049.762] lstrlenA (lpString="*.gif") returned 5 [0049.762] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.doc") returned 0 [0049.762] lstrlenA (lpString="*.doc") returned 5 [0049.762] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.docx") returned 0 [0049.762] lstrlenA (lpString="*.docx") returned 6 [0049.762] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.xls") returned 0 [0049.762] lstrlenA (lpString="*.xls") returned 5 [0049.762] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.xlsx") returned 0 [0049.762] lstrlenA (lpString="*.xlsx") returned 6 [0049.762] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.ppt") returned 0 [0049.762] lstrlenA (lpString="*.ppt") returned 5 [0049.762] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.pptx") returned 0 [0049.762] lstrlenA (lpString="*.pptx") returned 6 [0049.762] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.pdf") returned 0 [0049.763] lstrlenA (lpString="*.pdf") returned 5 [0049.763] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.mov") returned 0 [0049.763] lstrlenA (lpString="*.mov") returned 5 [0049.763] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.m2v") returned 0 [0049.763] lstrlenA (lpString="*.m2v") returned 5 [0049.763] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.3gp") returned 0 [0049.763] lstrlenA (lpString="*.3gp") returned 5 [0049.763] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.mpeg") returned 0 [0049.763] lstrlenA (lpString="*.mpeg") returned 6 [0049.763] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.mpg") returned 0 [0049.763] lstrlenA (lpString="*.mpg") returned 5 [0049.763] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.flv") returned 0 [0049.763] lstrlenA (lpString="*.flv") returned 5 [0049.763] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.avi") returned 0 [0049.763] lstrlenA (lpString="*.avi") returned 5 [0049.763] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.mp4") returned 0 [0049.763] lstrlenA (lpString="*.mp4") returned 5 [0049.763] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.wmv") returned 0 [0049.764] lstrlenA (lpString="*.wmv") returned 5 [0049.764] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.divx") returned 0 [0049.764] lstrlenA (lpString="*.divx") returned 6 [0049.764] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.mkv") returned 0 [0049.764] lstrlenA (lpString="*.mkv") returned 5 [0049.764] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.mp3") returned 0 [0049.764] lstrlenA (lpString="*.mp3") returned 5 [0049.764] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.wav") returned 0 [0049.764] lstrlenA (lpString="*.wav") returned 5 [0049.764] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.flac") returned 0 [0049.764] lstrlenA (lpString="*.flac") returned 6 [0049.764] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.ape") returned 0 [0049.764] lstrlenA (lpString="*.ape") returned 5 [0049.764] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.wma") returned 0 [0049.764] lstrlenA (lpString="*.wma") returned 5 [0049.764] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.ac3") returned 0 [0049.764] lstrlenA (lpString="*.ac3") returned 5 [0049.764] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", pszSpec="*.mxf") returned 0 [0049.764] lstrlenA (lpString="*.mxf") returned 5 [0049.764] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0049.764] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.765] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NavigationUp_ButtonGraphic.png") returned -1 [0049.765] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NavigationUp_ButtonGraphic.png") returned -1 [0049.765] lstrcmpiA (lpString1="", lpString2="NavigationUp_ButtonGraphic.png") returned -1 [0049.765] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0049.765] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" [0049.765] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="" [0049.765] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\HOW TO DECRYPT FILES.txt" [0049.765] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\how to decrypt files.txt")) returned 0x20 [0049.765] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" [0049.765] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.zip") returned 0 [0049.765] lstrlenA (lpString="*.zip") returned 5 [0049.765] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.rar") returned 0 [0049.765] lstrlenA (lpString="*.rar") returned 5 [0049.765] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.7z") returned 0 [0049.765] lstrlenA (lpString="*.7z") returned 4 [0049.765] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.tar") returned 0 [0049.765] lstrlenA (lpString="*.tar") returned 5 [0049.765] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.gzip") returned 0 [0049.765] lstrlenA (lpString="*.gzip") returned 6 [0049.765] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.jpg") returned 0 [0049.765] lstrlenA (lpString="*.jpg") returned 5 [0049.765] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.jpeg") returned 0 [0049.765] lstrlenA (lpString="*.jpeg") returned 6 [0049.765] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.psd") returned 0 [0049.765] lstrlenA (lpString="*.psd") returned 5 [0049.765] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.gif") returned 0 [0049.765] lstrlenA (lpString="*.gif") returned 5 [0049.765] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.doc") returned 0 [0049.766] lstrlenA (lpString="*.doc") returned 5 [0049.766] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.docx") returned 0 [0049.766] lstrlenA (lpString="*.docx") returned 6 [0049.766] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.xls") returned 0 [0049.766] lstrlenA (lpString="*.xls") returned 5 [0049.766] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.xlsx") returned 0 [0049.766] lstrlenA (lpString="*.xlsx") returned 6 [0049.766] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.ppt") returned 0 [0049.766] lstrlenA (lpString="*.ppt") returned 5 [0049.766] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.pptx") returned 0 [0049.766] lstrlenA (lpString="*.pptx") returned 6 [0049.766] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.pdf") returned 0 [0049.766] lstrlenA (lpString="*.pdf") returned 5 [0049.766] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.mov") returned 0 [0049.766] lstrlenA (lpString="*.mov") returned 5 [0049.766] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.m2v") returned 0 [0049.766] lstrlenA (lpString="*.m2v") returned 5 [0049.766] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.3gp") returned 0 [0049.766] lstrlenA (lpString="*.3gp") returned 5 [0049.766] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.mpeg") returned 0 [0049.766] lstrlenA (lpString="*.mpeg") returned 6 [0049.766] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.mpg") returned 0 [0049.766] lstrlenA (lpString="*.mpg") returned 5 [0049.766] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.flv") returned 0 [0049.766] lstrlenA (lpString="*.flv") returned 5 [0049.766] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.avi") returned 0 [0049.766] lstrlenA (lpString="*.avi") returned 5 [0049.766] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.mp4") returned 0 [0049.766] lstrlenA (lpString="*.mp4") returned 5 [0049.766] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.wmv") returned 0 [0049.766] lstrlenA (lpString="*.wmv") returned 5 [0049.766] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.divx") returned 0 [0049.767] lstrlenA (lpString="*.divx") returned 6 [0049.767] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.mkv") returned 0 [0049.767] lstrlenA (lpString="*.mkv") returned 5 [0049.767] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.mp3") returned 0 [0049.767] lstrlenA (lpString="*.mp3") returned 5 [0049.767] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.wav") returned 0 [0049.767] lstrlenA (lpString="*.wav") returned 5 [0049.767] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.flac") returned 0 [0049.767] lstrlenA (lpString="*.flac") returned 6 [0049.767] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.ape") returned 0 [0049.767] lstrlenA (lpString="*.ape") returned 5 [0049.767] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.wma") returned 0 [0049.767] lstrlenA (lpString="*.wma") returned 5 [0049.767] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.ac3") returned 0 [0049.767] lstrlenA (lpString="*.ac3") returned 5 [0049.767] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", pszSpec="*.mxf") returned 0 [0049.767] lstrlenA (lpString="*.mxf") returned 5 [0049.767] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe8ad00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe8ad00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0049.767] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.767] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NavigationUp_SelectionSubpicture.png") returned -1 [0049.767] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NavigationUp_SelectionSubpicture.png") returned -1 [0049.767] lstrcmpiA (lpString1="", lpString2="NavigationUp_SelectionSubpicture.png") returned -1 [0049.767] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0049.767] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" [0049.767] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="" [0049.767] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\HOW TO DECRYPT FILES.txt" [0049.767] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\how to decrypt files.txt")) returned 0x20 [0049.767] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" [0049.767] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png", pszSpec="*.zip") returned 0 [0049.767] lstrlenA (lpString="*.zip") returned 5 [0049.767] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png", pszSpec="*.rar") returned 0 [0049.768] lstrlenA (lpString="*.rar") returned 5 [0049.768] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png", pszSpec="*.7z") returned 0 [0049.768] lstrlenA (lpString="*.7z") returned 4 [0049.768] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png", pszSpec="*.tar") returned 0 [0049.768] lstrlenA (lpString="*.tar") returned 5 [0049.768] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png", pszSpec="*.gzip") returned 0 [0049.768] lstrlenA (lpString="*.gzip") returned 6 [0049.768] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png", pszSpec="*.jpg") returned 0 [0049.768] lstrlenA (lpString="*.jpg") returned 5 [0049.768] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png", pszSpec="*.jpeg") returned 0 [0049.768] lstrlenA (lpString="*.jpeg") returned 6 [0049.768] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png", pszSpec="*.psd") returned 0 [0049.768] lstrlenA (lpString="*.psd") returned 5 [0049.768] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png", pszSpec="*.gif") returned 0 [0049.768] lstrlenA (lpString="*.gif") returned 5 [0049.768] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png", pszSpec="*.doc") returned 0 [0049.768] lstrlenA (lpString="*.doc") returned 5 [0049.768] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png", pszSpec="*.docx") returned 0 [0049.768] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 1 [0049.768] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.768] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="pagecurl.png") returned -1 [0049.768] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pagecurl.png") returned -1 [0049.768] lstrcmpiA (lpString1="", lpString2="pagecurl.png") returned -1 [0049.769] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0049.769] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" [0049.769] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned="" [0049.769] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\HOW TO DECRYPT FILES.txt" [0049.769] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\how to decrypt files.txt")) returned 0x20 [0049.769] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", lpString2="pagecurl.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" [0049.769] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 0 [0049.769] FindClose (in: hFindFile=0x2d7fe8 | out: hFindFile=0x2d7fe8) returned 1 [0049.769] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Full", cAlternateFileName="")) returned 1 [0049.769] lstrcmpA (lpString1=".", lpString2="Full") returned -1 [0049.769] lstrcmpA (lpString1="..", lpString2="Full") returned -1 [0049.769] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*") returned="*.*" [0049.769] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="Full" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full" [0049.769] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d7fe8 [0049.771] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.771] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.771] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.771] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.771] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0049.771] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.771] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="1047x576black.png") returned 1 [0049.771] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1047x576black.png") returned 1 [0049.771] lstrcmpiA (lpString1="", lpString2="1047x576black.png") returned -1 [0049.771] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*") returned="*.*" [0049.771] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" [0049.771] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="" [0049.771] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt" [0049.771] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\how to decrypt files.txt")) returned 0xffffffff [0049.772] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.775] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.775] CloseHandle (hObject=0x90) returned 1 [0049.775] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpString2="1047x576black.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" [0049.775] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x2d8358, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0049.775] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.775] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="15x15dot.png") returned 1 [0049.775] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="15x15dot.png") returned 1 [0049.775] lstrcmpiA (lpString1="", lpString2="15x15dot.png") returned -1 [0049.775] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png") returned="1047x576black.png" [0049.775] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" [0049.775] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="" [0049.775] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt" [0049.775] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\how to decrypt files.txt")) returned 0x20 [0049.775] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpString2="15x15dot.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" [0049.775] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="dotsdarkoverlay.png", cAlternateFileName="")) returned 1 [0049.775] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.776] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dotsdarkoverlay.png") returned 1 [0049.776] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dotsdarkoverlay.png") returned 1 [0049.776] lstrcmpiA (lpString1="", lpString2="dotsdarkoverlay.png") returned -1 [0049.776] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png") returned="15x15dot.png" [0049.776] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" [0049.776] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="" [0049.776] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt" [0049.776] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\how to decrypt files.txt")) returned 0x20 [0049.776] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpString2="dotsdarkoverlay.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" [0049.776] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x123d, dwReserved0=0x0, dwReserved1=0x0, cFileName="dotslightoverlay.png", cAlternateFileName="")) returned 1 [0049.776] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.776] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="dotslightoverlay.png") returned 1 [0049.776] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dotslightoverlay.png") returned 1 [0049.776] lstrcmpiA (lpString1="", lpString2="dotslightoverlay.png") returned -1 [0049.776] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png") returned="dotsdarkoverlay.png" [0049.776] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" [0049.776] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="" [0049.776] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt" [0049.776] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\how to decrypt files.txt")) returned 0x20 [0049.776] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpString2="dotslightoverlay.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" [0049.776] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6794, dwReserved0=0x0, dwReserved1=0x0, cFileName="full.png", cAlternateFileName="")) returned 1 [0049.776] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.776] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="full.png") returned -1 [0049.776] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="full.png") returned 1 [0049.776] lstrcmpiA (lpString1="", lpString2="full.png") returned -1 [0049.776] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned="dotslightoverlay.png" [0049.776] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" [0049.776] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="" [0049.777] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt" [0049.777] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\how to decrypt files.txt")) returned 0x20 [0049.777] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpString2="full.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" [0049.777] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0049.777] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.777] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NavigationLeft_ButtonGraphic.png") returned -1 [0049.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NavigationLeft_ButtonGraphic.png") returned -1 [0049.777] lstrcmpiA (lpString1="", lpString2="NavigationLeft_ButtonGraphic.png") returned -1 [0049.777] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned="full.png" [0049.777] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" [0049.777] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="" [0049.777] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt" [0049.777] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\how to decrypt files.txt")) returned 0x20 [0049.777] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" [0049.777] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0049.777] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.777] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NavigationLeft_SelectionSubpicture.png") returned -1 [0049.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NavigationLeft_SelectionSubpicture.png") returned -1 [0049.777] lstrcmpiA (lpString1="", lpString2="NavigationLeft_SelectionSubpicture.png") returned -1 [0049.777] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0049.777] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" [0049.777] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="" [0049.777] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt" [0049.777] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\how to decrypt files.txt")) returned 0x20 [0049.777] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" [0049.778] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0049.778] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.778] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NavigationRight_ButtonGraphic.png") returned -1 [0049.778] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NavigationRight_ButtonGraphic.png") returned -1 [0049.778] lstrcmpiA (lpString1="", lpString2="NavigationRight_ButtonGraphic.png") returned -1 [0049.778] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0049.778] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" [0049.778] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="" [0049.778] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt" [0049.778] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\how to decrypt files.txt")) returned 0x20 [0049.778] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" [0049.778] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0049.778] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.778] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NavigationRight_SelectionSubpicture.png") returned -1 [0049.778] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NavigationRight_SelectionSubpicture.png") returned -1 [0049.778] lstrcmpiA (lpString1="", lpString2="NavigationRight_SelectionSubpicture.png") returned -1 [0049.778] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0049.778] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" [0049.778] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="" [0049.778] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt" [0049.778] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\how to decrypt files.txt")) returned 0x20 [0049.778] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" [0049.778] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0049.778] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.778] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NavigationUp_ButtonGraphic.png") returned -1 [0049.778] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NavigationUp_ButtonGraphic.png") returned -1 [0049.778] lstrcmpiA (lpString1="", lpString2="NavigationUp_ButtonGraphic.png") returned -1 [0049.778] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0049.778] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" [0049.779] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="" [0049.779] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt" [0049.779] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\how to decrypt files.txt")) returned 0x20 [0049.779] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" [0049.779] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f199665, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f199665, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0049.779] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.779] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NavigationUp_SelectionSubpicture.png") returned -1 [0049.779] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NavigationUp_SelectionSubpicture.png") returned -1 [0049.779] lstrcmpiA (lpString1="", lpString2="NavigationUp_SelectionSubpicture.png") returned -1 [0049.779] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0049.779] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" [0049.779] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="" [0049.779] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt" [0049.779] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\how to decrypt files.txt")) returned 0x20 [0049.779] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" [0049.779] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f231bd9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f231bd9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x0, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 1 [0049.779] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.779] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="pushplaysubpicture.png") returned -1 [0049.779] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pushplaysubpicture.png") returned -1 [0049.779] lstrcmpiA (lpString1="", lpString2="pushplaysubpicture.png") returned -1 [0049.779] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0049.779] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" [0049.779] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\") returned="" [0049.779] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt" [0049.779] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\how to decrypt files.txt")) returned 0x20 [0049.779] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\", lpString2="pushplaysubpicture.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" [0049.780] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f231bd9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f231bd9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x0, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 0 [0049.780] FindClose (in: hFindFile=0x2d7fe8 | out: hFindFile=0x2d7fe8) returned 1 [0049.780] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75ba, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Heart_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0049.780] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.780] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Heart_ButtonGraphic.png") returned -1 [0049.780] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Heart_ButtonGraphic.png") returned 1 [0049.780] lstrcmpiA (lpString1="", lpString2="Heart_ButtonGraphic.png") returned -1 [0049.780] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*") returned="*.*" [0049.780] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0049.780] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="" [0049.780] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" [0049.780] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\how to decrypt files.txt")) returned 0x20 [0049.780] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="Heart_ButtonGraphic.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" [0049.780] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea2923b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea2923b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="heart_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0049.780] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.780] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="heart_glass_Thumbnail.bmp") returned -1 [0049.780] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="heart_glass_Thumbnail.bmp") returned 1 [0049.780] lstrcmpiA (lpString1="", lpString2="heart_glass_Thumbnail.bmp") returned -1 [0049.780] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned="Heart_ButtonGraphic.png" [0049.780] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0049.780] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="" [0049.781] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" [0049.781] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\how to decrypt files.txt")) returned 0x20 [0049.781] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="heart_glass_Thumbnail.bmp" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" [0049.781] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1278, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0049.781] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.781] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Heart_SelectionSubpicture.png") returned -1 [0049.781] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Heart_SelectionSubpicture.png") returned 1 [0049.781] lstrcmpiA (lpString1="", lpString2="Heart_SelectionSubpicture.png") returned -1 [0049.781] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned="heart_glass_Thumbnail.bmp" [0049.781] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0049.781] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="" [0049.781] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" [0049.781] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\how to decrypt files.txt")) returned 0x20 [0049.781] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="Heart_SelectionSubpicture.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" [0049.781] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eeebddb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eeebddb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x166e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_VideoInset.png", cAlternateFileName="")) returned 1 [0049.781] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0049.781] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Heart_VideoInset.png") returned -1 [0049.781] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Heart_VideoInset.png") returned 1 [0049.781] lstrcmpiA (lpString1="", lpString2="Heart_VideoInset.png") returned -1 [0049.781] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned="Heart_SelectionSubpicture.png" [0049.781] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0049.782] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="" [0049.782] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" [0049.782] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\how to decrypt files.txt")) returned 0x20 [0049.782] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="Heart_VideoInset.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" [0049.782] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HueCycle", cAlternateFileName="")) returned 1 [0049.782] lstrcmpA (lpString1=".", lpString2="HueCycle") returned -1 [0049.782] lstrcmpA (lpString1="..", lpString2="HueCycle") returned -1 [0049.782] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned="Heart_VideoInset.png" [0049.782] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="HueCycle" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle" [0049.782] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d8118, cFileName=".", cAlternateFileName="")) returned 0x2d7fe8 [0049.785] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.785] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.785] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.785] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.785] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6faf8c48, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6faf8c48, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0049.785] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.785] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="1047x576black.png") returned 1 [0049.785] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1047x576black.png") returned 1 [0049.785] lstrcmpiA (lpString1="", lpString2="1047x576black.png") returned -1 [0049.785] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*") returned="*.*" [0049.785] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" [0049.785] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="" [0049.785] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt" [0049.785] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\how to decrypt files.txt")) returned 0xffffffff [0049.785] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.787] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.787] CloseHandle (hObject=0x90) returned 1 [0049.787] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpString2="1047x576black.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" [0049.787] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb1eda5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb1eda5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x2d8360, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0049.787] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.787] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="15x15dot.png") returned 1 [0049.787] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="15x15dot.png") returned 1 [0049.787] lstrcmpiA (lpString1="", lpString2="15x15dot.png") returned -1 [0049.787] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png") returned="1047x576black.png" [0049.787] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" [0049.787] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="" [0049.787] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt" [0049.787] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\how to decrypt files.txt")) returned 0x20 [0049.787] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpString2="15x15dot.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" [0049.787] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fad2aeb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fad2aeb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x43e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="colorcycle.png", cAlternateFileName="")) returned 1 [0049.788] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.788] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="colorcycle.png") returned 1 [0049.788] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="colorcycle.png") returned 1 [0049.788] lstrcmpiA (lpString1="", lpString2="colorcycle.png") returned -1 [0049.788] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png") returned="15x15dot.png" [0049.788] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" [0049.788] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="" [0049.788] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt" [0049.788] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\how to decrypt files.txt")) returned 0x20 [0049.788] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpString2="colorcycle.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" [0049.788] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb44f02, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb44f02, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb57, dwReserved0=0x0, dwReserved1=0x0, cFileName="huemainsubpicture2.png", cAlternateFileName="")) returned 1 [0049.788] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.788] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned="colorcycle.png" [0049.788] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" [0049.788] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="" [0049.788] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt" [0049.788] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\how to decrypt files.txt")) returned 0x20 [0049.788] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpString2="huemainsubpicture2.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" [0049.788] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc29730, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc29730, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0049.788] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.788] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png") returned="huemainsubpicture2.png" [0049.788] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" [0049.788] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="" [0049.789] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt" [0049.789] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\how to decrypt files.txt")) returned 0x20 [0049.789] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" [0049.789] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0049.789] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.789] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0049.789] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" [0049.789] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="" [0049.789] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt" [0049.789] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\how to decrypt files.txt")) returned 0x20 [0049.789] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" [0049.789] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0049.789] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.789] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0049.789] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" [0049.789] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="" [0049.789] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt" [0049.789] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\how to decrypt files.txt")) returned 0x20 [0049.789] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" [0049.789] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0049.789] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.790] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0049.790] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" [0049.790] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="" [0049.790] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt" [0049.790] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\how to decrypt files.txt")) returned 0x20 [0049.790] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" [0049.790] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0049.790] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.790] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0049.790] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" [0049.790] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="" [0049.790] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt" [0049.791] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\how to decrypt files.txt")) returned 0x20 [0049.791] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" [0049.791] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbb7319, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbb7319, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0049.791] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.791] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0049.791] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" [0049.791] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="" [0049.791] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt" [0049.791] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\how to decrypt files.txt")) returned 0x20 [0049.791] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" [0049.792] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb6b05f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb6b05f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="title_stripe.png", cAlternateFileName="")) returned 1 [0049.792] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.792] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0049.792] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" [0049.792] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned="" [0049.792] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt" [0049.792] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\how to decrypt files.txt")) returned 0x20 [0049.792] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", lpString2="title_stripe.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" [0049.792] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb6b05f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb6b05f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="title_stripe.png", cAlternateFileName="")) returned 0 [0049.792] FindClose (in: hFindFile=0x2d7fe8 | out: hFindFile=0x2d7fe8) returned 1 [0049.792] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="LayeredTitles", cAlternateFileName="LAYERE~1")) returned 1 [0049.792] lstrcmpA (lpString1=".", lpString2="LayeredTitles") returned -1 [0049.792] lstrcmpA (lpString1="..", lpString2="LayeredTitles") returned -1 [0049.792] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*") returned="*.*" [0049.792] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="LayeredTitles" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles" [0049.792] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d7fe8 [0049.794] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.794] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.794] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.794] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.794] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70bee7b2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70bee7b2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0049.794] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.794] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*") returned="*.*" [0049.794] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" [0049.794] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="" [0049.794] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt" [0049.794] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\how to decrypt files.txt")) returned 0xffffffff [0049.794] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.796] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.796] CloseHandle (hObject=0x90) returned 1 [0049.796] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpString2="1047x576black.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" [0049.796] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c60bc9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70c60bc9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x2d8368, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0049.796] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.796] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png") returned="1047x576black.png" [0049.796] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" [0049.796] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="" [0049.796] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt" [0049.796] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\how to decrypt files.txt")) returned 0x20 [0049.796] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpString2="203x8subpicture.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" [0049.796] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c1490f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70c1490f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x191f, dwReserved0=0x0, dwReserved1=0x0, cFileName="blackbars60.png", cAlternateFileName="")) returned 1 [0049.797] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.797] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png") returned="203x8subpicture.png" [0049.797] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" [0049.797] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="" [0049.797] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt" [0049.797] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\how to decrypt files.txt")) returned 0x20 [0049.797] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpString2="blackbars60.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" [0049.797] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70abdcca, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70abdcca, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fed, dwReserved0=0x0, dwReserved1=0x0, cFileName="layers.png", cAlternateFileName="")) returned 1 [0049.797] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.797] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned="blackbars60.png" [0049.797] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" [0049.797] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="" [0049.797] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt" [0049.797] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\how to decrypt files.txt")) returned 0x20 [0049.797] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpString2="layers.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" [0049.797] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ba24f8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ba24f8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0049.797] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.797] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png") returned="layers.png" [0049.797] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" [0049.797] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="" [0049.797] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt" [0049.797] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\how to decrypt files.txt")) returned 0x20 [0049.797] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" [0049.797] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0049.797] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.798] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0049.798] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" [0049.798] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="" [0049.798] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt" [0049.798] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\how to decrypt files.txt")) returned 0x20 [0049.798] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" [0049.798] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ba24f8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ba24f8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0049.798] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.798] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0049.798] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" [0049.798] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="" [0049.798] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt" [0049.798] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\how to decrypt files.txt")) returned 0x20 [0049.798] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" [0049.798] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b300e1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b300e1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0049.798] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.798] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0049.798] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" [0049.798] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="" [0049.798] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt" [0049.798] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\how to decrypt files.txt")) returned 0x20 [0049.798] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" [0049.798] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ae3e27, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ae3e27, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0049.799] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.799] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0049.799] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" [0049.799] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="" [0049.799] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt" [0049.799] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\how to decrypt files.txt")) returned 0x20 [0049.799] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpString2="NavigationUp_ButtonGraphic.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" [0049.800] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0049.800] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.800] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0049.800] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" [0049.800] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned="" [0049.800] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt" [0049.800] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\how to decrypt files.txt")) returned 0x20 [0049.800] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", lpString2="NavigationUp_SelectionSubpicture.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" [0049.800] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 0 [0049.800] FindClose (in: hFindFile=0x2d7fe8 | out: hFindFile=0x2d7fe8) returned 1 [0049.800] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Memories", cAlternateFileName="")) returned 1 [0049.801] lstrcmpA (lpString1=".", lpString2="Memories") returned -1 [0049.801] lstrcmpA (lpString1="..", lpString2="Memories") returned -1 [0049.801] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*") returned="*.*" [0049.801] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="Memories" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories" [0049.801] lstrlenA (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories") returned 52 [0049.802] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d7fe8 [0049.816] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.816] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.816] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.816] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.816] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710d74af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710d74af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb08f, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0049.816] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.816] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*") returned="*.*" [0049.816] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" [0049.816] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="" [0049.817] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" [0049.817] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\how to decrypt files.txt")) returned 0xffffffff [0049.817] CreateFileA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0049.817] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0049.817] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0049.818] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.818] CloseHandle (hObject=0x90) returned 1 [0049.819] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="16_9-frame-background.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" [0049.819] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.zip") returned 0 [0049.819] lstrlenA (lpString="*.zip") returned 5 [0049.819] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.rar") returned 0 [0049.819] lstrlenA (lpString="*.rar") returned 5 [0049.819] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.7z") returned 0 [0049.819] lstrlenA (lpString="*.7z") returned 4 [0049.819] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.tar") returned 0 [0049.819] lstrlenA (lpString="*.tar") returned 5 [0049.819] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.gzip") returned 0 [0049.819] lstrlenA (lpString="*.gzip") returned 6 [0049.819] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.jpg") returned 0 [0049.819] lstrlenA (lpString="*.jpg") returned 5 [0049.819] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.jpeg") returned 0 [0049.819] lstrlenA (lpString="*.jpeg") returned 6 [0049.819] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.psd") returned 0 [0049.819] lstrlenA (lpString="*.psd") returned 5 [0049.819] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.gif") returned 0 [0049.819] lstrlenA (lpString="*.gif") returned 5 [0049.819] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.doc") returned 0 [0049.819] lstrlenA (lpString="*.doc") returned 5 [0049.819] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.docx") returned 0 [0049.819] lstrlenA (lpString="*.docx") returned 6 [0049.819] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.xls") returned 0 [0049.819] lstrlenA (lpString="*.xls") returned 5 [0049.820] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.xlsx") returned 0 [0049.820] lstrlenA (lpString="*.xlsx") returned 6 [0049.820] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.ppt") returned 0 [0049.820] lstrlenA (lpString="*.ppt") returned 5 [0049.820] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.pptx") returned 0 [0049.820] lstrlenA (lpString="*.pptx") returned 6 [0049.820] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.pdf") returned 0 [0049.820] lstrlenA (lpString="*.pdf") returned 5 [0049.820] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.mov") returned 0 [0049.820] lstrlenA (lpString="*.mov") returned 5 [0049.820] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.m2v") returned 0 [0049.820] lstrlenA (lpString="*.m2v") returned 5 [0049.820] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.3gp") returned 0 [0049.820] lstrlenA (lpString="*.3gp") returned 5 [0049.820] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.mpeg") returned 0 [0049.820] lstrlenA (lpString="*.mpeg") returned 6 [0049.820] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.mpg") returned 0 [0049.820] lstrlenA (lpString="*.mpg") returned 5 [0049.820] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.flv") returned 0 [0049.820] lstrlenA (lpString="*.flv") returned 5 [0049.820] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.avi") returned 0 [0049.820] lstrlenA (lpString="*.avi") returned 5 [0049.820] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.mp4") returned 0 [0049.820] lstrlenA (lpString="*.mp4") returned 5 [0049.820] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.wmv") returned 0 [0049.820] lstrlenA (lpString="*.wmv") returned 5 [0049.820] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.divx") returned 0 [0049.820] lstrlenA (lpString="*.divx") returned 6 [0049.821] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.mkv") returned 0 [0049.821] lstrlenA (lpString="*.mkv") returned 5 [0049.821] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.mp3") returned 0 [0049.821] lstrlenA (lpString="*.mp3") returned 5 [0049.821] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.wav") returned 0 [0049.821] lstrlenA (lpString="*.wav") returned 5 [0049.821] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.flac") returned 0 [0049.821] lstrlenA (lpString="*.flac") returned 6 [0049.821] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.ape") returned 0 [0049.821] lstrlenA (lpString="*.ape") returned 5 [0049.821] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.wma") returned 0 [0049.821] lstrlenA (lpString="*.wma") returned 5 [0049.821] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.ac3") returned 0 [0049.821] lstrlenA (lpString="*.ac3") returned 5 [0049.821] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", pszSpec="*.mxf") returned 0 [0049.821] lstrlenA (lpString="*.mxf") returned 5 [0049.821] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710fd60c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710fd60c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc32, dwReserved0=0x0, dwReserved1=0x2d8360, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0049.821] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0049.821] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="16_9-frame-highlight.png") returned 1 [0049.822] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="16_9-frame-highlight.png") returned 1 [0049.822] lstrcmpiA (lpString1="", lpString2="16_9-frame-highlight.png") returned -1 [0049.822] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png") returned="16_9-frame-background.png" [0049.822] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" [0049.822] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="" [0049.822] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" [0049.822] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\how to decrypt files.txt")) returned 0x20 [0049.822] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="16_9-frame-highlight.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" [0049.822] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.zip") returned 0 [0049.822] lstrlenA (lpString="*.zip") returned 5 [0049.822] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.rar") returned 0 [0049.822] lstrlenA (lpString="*.rar") returned 5 [0049.822] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.7z") returned 0 [0049.822] lstrlenA (lpString="*.7z") returned 4 [0049.822] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.tar") returned 0 [0049.822] lstrlenA (lpString="*.tar") returned 5 [0049.822] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.gzip") returned 0 [0049.822] lstrlenA (lpString="*.gzip") returned 6 [0049.822] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.jpg") returned 0 [0049.822] lstrlenA (lpString="*.jpg") returned 5 [0049.822] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.jpeg") returned 0 [0049.822] lstrlenA (lpString="*.jpeg") returned 6 [0049.822] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.psd") returned 0 [0049.823] lstrlenA (lpString="*.psd") returned 5 [0049.823] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.gif") returned 0 [0049.823] lstrlenA (lpString="*.gif") returned 5 [0049.823] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.doc") returned 0 [0049.823] lstrlenA (lpString="*.doc") returned 5 [0049.823] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.docx") returned 0 [0049.823] lstrlenA (lpString="*.docx") returned 6 [0049.823] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.xls") returned 0 [0049.823] lstrlenA (lpString="*.xls") returned 5 [0049.823] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.xlsx") returned 0 [0049.823] lstrlenA (lpString="*.xlsx") returned 6 [0049.823] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.ppt") returned 0 [0049.823] lstrlenA (lpString="*.ppt") returned 5 [0049.823] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.pptx") returned 0 [0049.823] lstrlenA (lpString="*.pptx") returned 6 [0049.823] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.pdf") returned 0 [0049.823] lstrlenA (lpString="*.pdf") returned 5 [0049.823] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.mov") returned 0 [0049.823] lstrlenA (lpString="*.mov") returned 5 [0049.823] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.m2v") returned 0 [0049.823] lstrlenA (lpString="*.m2v") returned 5 [0049.823] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.3gp") returned 0 [0049.823] lstrlenA (lpString="*.3gp") returned 5 [0049.823] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.mpeg") returned 0 [0049.823] lstrlenA (lpString="*.mpeg") returned 6 [0049.823] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.mpg") returned 0 [0049.823] lstrlenA (lpString="*.mpg") returned 5 [0049.823] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.flv") returned 0 [0049.823] lstrlenA (lpString="*.flv") returned 5 [0049.823] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.avi") returned 0 [0049.823] lstrlenA (lpString="*.avi") returned 5 [0049.823] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.mp4") returned 0 [0049.824] lstrlenA (lpString="*.mp4") returned 5 [0049.824] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.wmv") returned 0 [0049.824] lstrlenA (lpString="*.wmv") returned 5 [0049.824] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.divx") returned 0 [0049.824] lstrlenA (lpString="*.divx") returned 6 [0049.824] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.mkv") returned 0 [0049.824] lstrlenA (lpString="*.mkv") returned 5 [0049.824] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.mp3") returned 0 [0049.824] lstrlenA (lpString="*.mp3") returned 5 [0049.824] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.wav") returned 0 [0049.824] lstrlenA (lpString="*.wav") returned 5 [0049.824] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.flac") returned 0 [0049.824] lstrlenA (lpString="*.flac") returned 6 [0049.824] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.ape") returned 0 [0049.824] lstrlenA (lpString="*.ape") returned 5 [0049.824] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.wma") returned 0 [0049.824] lstrlenA (lpString="*.wma") returned 5 [0049.824] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.ac3") returned 0 [0049.824] lstrlenA (lpString="*.ac3") returned 5 [0049.824] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", pszSpec="*.mxf") returned 0 [0049.824] lstrlenA (lpString="*.mxf") returned 5 [0049.824] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71123769, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71123769, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1 [0049.824] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="16_9-frame-image-mask.png") returned 1 [0049.824] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="16_9-frame-image-mask.png") returned 1 [0049.824] lstrcmpiA (lpString1="", lpString2="16_9-frame-image-mask.png") returned -1 [0049.824] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png") returned="16_9-frame-highlight.png" [0049.825] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" [0049.825] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="" [0049.825] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" [0049.825] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\how to decrypt files.txt")) returned 0x20 [0049.825] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="16_9-frame-image-mask.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" [0049.825] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.zip") returned 0 [0049.825] lstrlenA (lpString="*.zip") returned 5 [0049.825] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.rar") returned 0 [0049.825] lstrlenA (lpString="*.rar") returned 5 [0049.825] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.7z") returned 0 [0049.825] lstrlenA (lpString="*.7z") returned 4 [0049.825] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.tar") returned 0 [0049.825] lstrlenA (lpString="*.tar") returned 5 [0049.825] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.gzip") returned 0 [0049.825] lstrlenA (lpString="*.gzip") returned 6 [0049.825] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.jpg") returned 0 [0049.825] lstrlenA (lpString="*.jpg") returned 5 [0049.825] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.jpeg") returned 0 [0049.825] lstrlenA (lpString="*.jpeg") returned 6 [0049.825] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.psd") returned 0 [0049.825] lstrlenA (lpString="*.psd") returned 5 [0049.825] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.gif") returned 0 [0049.826] lstrlenA (lpString="*.gif") returned 5 [0049.826] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.doc") returned 0 [0049.826] lstrlenA (lpString="*.doc") returned 5 [0049.826] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.docx") returned 0 [0049.826] lstrlenA (lpString="*.docx") returned 6 [0049.826] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.xls") returned 0 [0049.826] lstrlenA (lpString="*.xls") returned 5 [0049.826] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.xlsx") returned 0 [0049.826] lstrlenA (lpString="*.xlsx") returned 6 [0049.826] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.ppt") returned 0 [0049.826] lstrlenA (lpString="*.ppt") returned 5 [0049.826] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.pptx") returned 0 [0049.826] lstrlenA (lpString="*.pptx") returned 6 [0049.826] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.pdf") returned 0 [0049.826] lstrlenA (lpString="*.pdf") returned 5 [0049.826] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.mov") returned 0 [0049.826] lstrlenA (lpString="*.mov") returned 5 [0049.826] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.m2v") returned 0 [0049.826] lstrlenA (lpString="*.m2v") returned 5 [0049.826] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.3gp") returned 0 [0049.826] lstrlenA (lpString="*.3gp") returned 5 [0049.826] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.mpeg") returned 0 [0049.826] lstrlenA (lpString="*.mpeg") returned 6 [0049.826] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.mpg") returned 0 [0049.826] lstrlenA (lpString="*.mpg") returned 5 [0049.826] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.flv") returned 0 [0049.826] lstrlenA (lpString="*.flv") returned 5 [0049.827] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.avi") returned 0 [0049.827] lstrlenA (lpString="*.avi") returned 5 [0049.827] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.mp4") returned 0 [0049.827] lstrlenA (lpString="*.mp4") returned 5 [0049.827] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.wmv") returned 0 [0049.827] lstrlenA (lpString="*.wmv") returned 5 [0049.827] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.divx") returned 0 [0049.827] lstrlenA (lpString="*.divx") returned 6 [0049.827] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.mkv") returned 0 [0049.827] lstrlenA (lpString="*.mkv") returned 5 [0049.827] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.mp3") returned 0 [0049.827] lstrlenA (lpString="*.mp3") returned 5 [0049.827] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.wav") returned 0 [0049.827] lstrlenA (lpString="*.wav") returned 5 [0049.827] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.flac") returned 0 [0049.827] lstrlenA (lpString="*.flac") returned 6 [0049.827] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.ape") returned 0 [0049.827] lstrlenA (lpString="*.ape") returned 5 [0049.827] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.wma") returned 0 [0049.827] lstrlenA (lpString="*.wma") returned 5 [0049.827] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.ac3") returned 0 [0049.827] lstrlenA (lpString="*.ac3") returned 5 [0049.827] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", pszSpec="*.mxf") returned 0 [0049.827] lstrlenA (lpString="*.mxf") returned 5 [0049.827] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711498c6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711498c6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-overlay.png", cAlternateFileName="")) returned 1 [0049.828] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="16_9-frame-overlay.png") returned 1 [0049.828] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="16_9-frame-overlay.png") returned 1 [0049.828] lstrcmpiA (lpString1="", lpString2="16_9-frame-overlay.png") returned -1 [0049.828] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png") returned="16_9-frame-image-mask.png" [0049.828] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" [0049.828] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="" [0049.828] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" [0049.828] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\how to decrypt files.txt")) returned 0x20 [0049.828] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="16_9-frame-overlay.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" [0049.828] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.zip") returned 0 [0049.828] lstrlenA (lpString="*.zip") returned 5 [0049.828] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.rar") returned 0 [0049.828] lstrlenA (lpString="*.rar") returned 5 [0049.828] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.7z") returned 0 [0049.828] lstrlenA (lpString="*.7z") returned 4 [0049.828] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.tar") returned 0 [0049.828] lstrlenA (lpString="*.tar") returned 5 [0049.828] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.gzip") returned 0 [0049.828] lstrlenA (lpString="*.gzip") returned 6 [0049.828] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.jpg") returned 0 [0049.828] lstrlenA (lpString="*.jpg") returned 5 [0049.828] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.jpeg") returned 0 [0049.828] lstrlenA (lpString="*.jpeg") returned 6 [0049.829] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.psd") returned 0 [0049.829] lstrlenA (lpString="*.psd") returned 5 [0049.829] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.gif") returned 0 [0049.829] lstrlenA (lpString="*.gif") returned 5 [0049.829] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.doc") returned 0 [0049.829] lstrlenA (lpString="*.doc") returned 5 [0049.829] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.docx") returned 0 [0049.829] lstrlenA (lpString="*.docx") returned 6 [0049.829] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.xls") returned 0 [0049.829] lstrlenA (lpString="*.xls") returned 5 [0049.829] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.xlsx") returned 0 [0049.829] lstrlenA (lpString="*.xlsx") returned 6 [0049.829] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.ppt") returned 0 [0049.829] lstrlenA (lpString="*.ppt") returned 5 [0049.829] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.pptx") returned 0 [0049.829] lstrlenA (lpString="*.pptx") returned 6 [0049.829] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.pdf") returned 0 [0049.829] lstrlenA (lpString="*.pdf") returned 5 [0049.829] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.mov") returned 0 [0049.829] lstrlenA (lpString="*.mov") returned 5 [0049.829] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.m2v") returned 0 [0049.829] lstrlenA (lpString="*.m2v") returned 5 [0049.829] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.3gp") returned 0 [0049.829] lstrlenA (lpString="*.3gp") returned 5 [0049.829] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.mpeg") returned 0 [0049.830] lstrlenA (lpString="*.mpeg") returned 6 [0049.830] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.mpg") returned 0 [0049.830] lstrlenA (lpString="*.mpg") returned 5 [0049.830] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.flv") returned 0 [0049.830] lstrlenA (lpString="*.flv") returned 5 [0049.830] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.avi") returned 0 [0049.830] lstrlenA (lpString="*.avi") returned 5 [0049.830] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.mp4") returned 0 [0049.830] lstrlenA (lpString="*.mp4") returned 5 [0049.830] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.wmv") returned 0 [0049.830] lstrlenA (lpString="*.wmv") returned 5 [0049.830] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.divx") returned 0 [0049.830] lstrlenA (lpString="*.divx") returned 6 [0049.830] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.mkv") returned 0 [0049.830] lstrlenA (lpString="*.mkv") returned 5 [0049.830] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.mp3") returned 0 [0049.830] lstrlenA (lpString="*.mp3") returned 5 [0049.830] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.wav") returned 0 [0049.830] lstrlenA (lpString="*.wav") returned 5 [0049.830] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.flac") returned 0 [0049.830] lstrlenA (lpString="*.flac") returned 6 [0049.830] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.ape") returned 0 [0049.830] lstrlenA (lpString="*.ape") returned 5 [0049.830] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.wma") returned 0 [0049.830] lstrlenA (lpString="*.wma") returned 5 [0049.831] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.ac3") returned 0 [0049.831] lstrlenA (lpString="*.ac3") returned 5 [0049.831] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", pszSpec="*.mxf") returned 0 [0049.831] lstrlenA (lpString="*.mxf") returned 5 [0049.831] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71254251, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71254251, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2f993, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0049.831] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="background.png") returned 1 [0049.831] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.png") returned 1 [0049.831] lstrcmpiA (lpString1="", lpString2="background.png") returned -1 [0049.831] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png") returned="16_9-frame-overlay.png" [0049.831] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" [0049.831] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="" [0049.831] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" [0049.831] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\how to decrypt files.txt")) returned 0x20 [0049.831] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="background.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" [0049.831] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.zip") returned 0 [0049.831] lstrlenA (lpString="*.zip") returned 5 [0049.831] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.rar") returned 0 [0049.831] lstrlenA (lpString="*.rar") returned 5 [0049.831] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.7z") returned 0 [0049.831] lstrlenA (lpString="*.7z") returned 4 [0049.831] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.tar") returned 0 [0049.831] lstrlenA (lpString="*.tar") returned 5 [0049.831] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.gzip") returned 0 [0049.832] lstrlenA (lpString="*.gzip") returned 6 [0049.832] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.jpg") returned 0 [0049.832] lstrlenA (lpString="*.jpg") returned 5 [0049.832] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.jpeg") returned 0 [0049.832] lstrlenA (lpString="*.jpeg") returned 6 [0049.832] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.psd") returned 0 [0049.832] lstrlenA (lpString="*.psd") returned 5 [0049.832] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.gif") returned 0 [0049.832] lstrlenA (lpString="*.gif") returned 5 [0049.832] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.doc") returned 0 [0049.832] lstrlenA (lpString="*.doc") returned 5 [0049.832] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.docx") returned 0 [0049.832] lstrlenA (lpString="*.docx") returned 6 [0049.832] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.xls") returned 0 [0049.832] lstrlenA (lpString="*.xls") returned 5 [0049.832] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.xlsx") returned 0 [0049.832] lstrlenA (lpString="*.xlsx") returned 6 [0049.832] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.ppt") returned 0 [0049.832] lstrlenA (lpString="*.ppt") returned 5 [0049.832] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.pptx") returned 0 [0049.832] lstrlenA (lpString="*.pptx") returned 6 [0049.832] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.pdf") returned 0 [0049.832] lstrlenA (lpString="*.pdf") returned 5 [0049.832] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.mov") returned 0 [0049.832] lstrlenA (lpString="*.mov") returned 5 [0049.832] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.m2v") returned 0 [0049.832] lstrlenA (lpString="*.m2v") returned 5 [0049.833] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.3gp") returned 0 [0049.833] lstrlenA (lpString="*.3gp") returned 5 [0049.833] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.mpeg") returned 0 [0049.833] lstrlenA (lpString="*.mpeg") returned 6 [0049.833] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.mpg") returned 0 [0049.833] lstrlenA (lpString="*.mpg") returned 5 [0049.833] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.flv") returned 0 [0049.833] lstrlenA (lpString="*.flv") returned 5 [0049.833] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.avi") returned 0 [0049.833] lstrlenA (lpString="*.avi") returned 5 [0049.833] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.mp4") returned 0 [0049.833] lstrlenA (lpString="*.mp4") returned 5 [0049.833] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.wmv") returned 0 [0049.833] lstrlenA (lpString="*.wmv") returned 5 [0049.833] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.divx") returned 0 [0049.833] lstrlenA (lpString="*.divx") returned 6 [0049.833] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.mkv") returned 0 [0049.833] lstrlenA (lpString="*.mkv") returned 5 [0049.833] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.mp3") returned 0 [0049.833] lstrlenA (lpString="*.mp3") returned 5 [0049.833] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.wav") returned 0 [0049.833] lstrlenA (lpString="*.wav") returned 5 [0049.833] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.flac") returned 0 [0049.833] lstrlenA (lpString="*.flac") returned 6 [0049.833] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.ape") returned 0 [0049.833] lstrlenA (lpString="*.ape") returned 5 [0049.834] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.wma") returned 0 [0049.834] lstrlenA (lpString="*.wma") returned 5 [0049.834] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.ac3") returned 0 [0049.834] lstrlenA (lpString="*.ac3") returned 5 [0049.834] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", pszSpec="*.mxf") returned 0 [0049.834] lstrlenA (lpString="*.mxf") returned 5 [0049.834] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7116fa23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7116fa23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2a88, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0049.834] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="btn-back-static.png") returned 1 [0049.834] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="btn-back-static.png") returned 1 [0049.834] lstrcmpiA (lpString1="", lpString2="btn-back-static.png") returned -1 [0049.834] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png") returned="background.png" [0049.834] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" [0049.834] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="" [0049.834] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" [0049.835] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\how to decrypt files.txt")) returned 0x20 [0049.835] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="btn-back-static.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" [0049.835] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.zip") returned 0 [0049.835] lstrlenA (lpString="*.zip") returned 5 [0049.835] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.rar") returned 0 [0049.835] lstrlenA (lpString="*.rar") returned 5 [0049.835] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.7z") returned 0 [0049.835] lstrlenA (lpString="*.7z") returned 4 [0049.835] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.tar") returned 0 [0049.835] lstrlenA (lpString="*.tar") returned 5 [0049.835] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.gzip") returned 0 [0049.835] lstrlenA (lpString="*.gzip") returned 6 [0049.835] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.jpg") returned 0 [0049.835] lstrlenA (lpString="*.jpg") returned 5 [0049.835] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.jpeg") returned 0 [0049.835] lstrlenA (lpString="*.jpeg") returned 6 [0049.835] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.psd") returned 0 [0049.835] lstrlenA (lpString="*.psd") returned 5 [0049.835] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.gif") returned 0 [0049.835] lstrlenA (lpString="*.gif") returned 5 [0049.835] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.doc") returned 0 [0049.835] lstrlenA (lpString="*.doc") returned 5 [0049.836] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.docx") returned 0 [0049.836] lstrlenA (lpString="*.docx") returned 6 [0049.836] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.xls") returned 0 [0049.836] lstrlenA (lpString="*.xls") returned 5 [0049.836] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.xlsx") returned 0 [0049.836] lstrlenA (lpString="*.xlsx") returned 6 [0049.836] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.ppt") returned 0 [0049.836] lstrlenA (lpString="*.ppt") returned 5 [0049.836] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.pptx") returned 0 [0049.836] lstrlenA (lpString="*.pptx") returned 6 [0049.836] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.pdf") returned 0 [0049.836] lstrlenA (lpString="*.pdf") returned 5 [0049.836] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.mov") returned 0 [0049.836] lstrlenA (lpString="*.mov") returned 5 [0049.836] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.m2v") returned 0 [0049.836] lstrlenA (lpString="*.m2v") returned 5 [0049.836] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.3gp") returned 0 [0049.836] lstrlenA (lpString="*.3gp") returned 5 [0049.836] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.mpeg") returned 0 [0049.836] lstrlenA (lpString="*.mpeg") returned 6 [0049.837] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.mpg") returned 0 [0049.837] lstrlenA (lpString="*.mpg") returned 5 [0049.837] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.flv") returned 0 [0049.837] lstrlenA (lpString="*.flv") returned 5 [0049.837] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.avi") returned 0 [0049.837] lstrlenA (lpString="*.avi") returned 5 [0049.837] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.mp4") returned 0 [0049.837] lstrlenA (lpString="*.mp4") returned 5 [0049.837] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.wmv") returned 0 [0049.837] lstrlenA (lpString="*.wmv") returned 5 [0049.837] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.divx") returned 0 [0049.837] lstrlenA (lpString="*.divx") returned 6 [0049.837] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.mkv") returned 0 [0049.837] lstrlenA (lpString="*.mkv") returned 5 [0049.837] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.mp3") returned 0 [0049.837] lstrlenA (lpString="*.mp3") returned 5 [0049.837] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.wav") returned 0 [0049.837] lstrlenA (lpString="*.wav") returned 5 [0049.837] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.flac") returned 0 [0049.837] lstrlenA (lpString="*.flac") returned 6 [0049.837] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.ape") returned 0 [0049.837] lstrlenA (lpString="*.ape") returned 5 [0049.837] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.wma") returned 0 [0049.837] lstrlenA (lpString="*.wma") returned 5 [0049.837] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.ac3") returned 0 [0049.838] lstrlenA (lpString="*.ac3") returned 5 [0049.838] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", pszSpec="*.mxf") returned 0 [0049.838] lstrlenA (lpString="*.mxf") returned 5 [0049.838] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7116fa23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7116fa23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x280e, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0049.838] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="btn-next-static.png") returned 1 [0049.838] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="btn-next-static.png") returned 1 [0049.838] lstrcmpiA (lpString1="", lpString2="btn-next-static.png") returned -1 [0049.838] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png") returned="btn-back-static.png" [0049.838] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" [0049.838] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="" [0049.838] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" [0049.838] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\how to decrypt files.txt")) returned 0x20 [0049.838] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="btn-next-static.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" [0049.838] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.zip") returned 0 [0049.838] lstrlenA (lpString="*.zip") returned 5 [0049.838] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.rar") returned 0 [0049.838] lstrlenA (lpString="*.rar") returned 5 [0049.838] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.7z") returned 0 [0049.839] lstrlenA (lpString="*.7z") returned 4 [0049.839] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.tar") returned 0 [0049.839] lstrlenA (lpString="*.tar") returned 5 [0049.839] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.gzip") returned 0 [0049.839] lstrlenA (lpString="*.gzip") returned 6 [0049.839] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.jpg") returned 0 [0049.839] lstrlenA (lpString="*.jpg") returned 5 [0049.839] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.jpeg") returned 0 [0049.839] lstrlenA (lpString="*.jpeg") returned 6 [0049.839] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.psd") returned 0 [0049.839] lstrlenA (lpString="*.psd") returned 5 [0049.839] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.gif") returned 0 [0049.839] lstrlenA (lpString="*.gif") returned 5 [0049.839] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.doc") returned 0 [0049.839] lstrlenA (lpString="*.doc") returned 5 [0049.839] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.docx") returned 0 [0049.839] lstrlenA (lpString="*.docx") returned 6 [0049.839] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.xls") returned 0 [0049.839] lstrlenA (lpString="*.xls") returned 5 [0049.839] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.xlsx") returned 0 [0049.839] lstrlenA (lpString="*.xlsx") returned 6 [0049.840] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.ppt") returned 0 [0049.840] lstrlenA (lpString="*.ppt") returned 5 [0049.840] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.pptx") returned 0 [0049.840] lstrlenA (lpString="*.pptx") returned 6 [0049.840] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.pdf") returned 0 [0049.840] lstrlenA (lpString="*.pdf") returned 5 [0049.840] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.mov") returned 0 [0049.840] lstrlenA (lpString="*.mov") returned 5 [0049.840] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.m2v") returned 0 [0049.840] lstrlenA (lpString="*.m2v") returned 5 [0049.840] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.3gp") returned 0 [0049.840] lstrlenA (lpString="*.3gp") returned 5 [0049.840] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.mpeg") returned 0 [0049.840] lstrlenA (lpString="*.mpeg") returned 6 [0049.840] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.mpg") returned 0 [0049.840] lstrlenA (lpString="*.mpg") returned 5 [0049.840] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.flv") returned 0 [0049.840] lstrlenA (lpString="*.flv") returned 5 [0049.840] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.avi") returned 0 [0049.840] lstrlenA (lpString="*.avi") returned 5 [0049.840] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.mp4") returned 0 [0049.840] lstrlenA (lpString="*.mp4") returned 5 [0049.840] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.wmv") returned 0 [0049.840] lstrlenA (lpString="*.wmv") returned 5 [0049.840] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.divx") returned 0 [0049.840] lstrlenA (lpString="*.divx") returned 6 [0049.841] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.mkv") returned 0 [0049.841] lstrlenA (lpString="*.mkv") returned 5 [0049.841] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.mp3") returned 0 [0049.841] lstrlenA (lpString="*.mp3") returned 5 [0049.841] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.wav") returned 0 [0049.841] lstrlenA (lpString="*.wav") returned 5 [0049.841] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.flac") returned 0 [0049.841] lstrlenA (lpString="*.flac") returned 6 [0049.841] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.ape") returned 0 [0049.841] lstrlenA (lpString="*.ape") returned 5 [0049.841] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.wma") returned 0 [0049.841] lstrlenA (lpString="*.wma") returned 5 [0049.841] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.ac3") returned 0 [0049.841] lstrlenA (lpString="*.ac3") returned 5 [0049.841] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", pszSpec="*.mxf") returned 0 [0049.841] lstrlenA (lpString="*.mxf") returned 5 [0049.841] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711bbcdd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711bbcdd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2808, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0049.841] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="btn-previous-static.png") returned 1 [0049.841] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="btn-previous-static.png") returned 1 [0049.841] lstrcmpiA (lpString1="", lpString2="btn-previous-static.png") returned -1 [0049.841] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png") returned="btn-next-static.png" [0049.841] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" [0049.841] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="" [0049.841] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" [0049.842] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\how to decrypt files.txt")) returned 0x20 [0049.842] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="btn-previous-static.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" [0049.842] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png", pszSpec="*.zip") returned 0 [0049.842] lstrlenA (lpString="*.zip") returned 5 [0049.842] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png", pszSpec="*.rar") returned 0 [0049.842] lstrlenA (lpString="*.rar") returned 5 [0049.842] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png", pszSpec="*.7z") returned 0 [0049.842] lstrlenA (lpString="*.7z") returned 4 [0049.842] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png", pszSpec="*.tar") returned 0 [0049.842] lstrlenA (lpString="*.tar") returned 5 [0049.842] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png", pszSpec="*.gzip") returned 0 [0049.842] lstrlenA (lpString="*.gzip") returned 6 [0049.842] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png", pszSpec="*.jpg") returned 0 [0049.842] lstrlenA (lpString="*.jpg") returned 5 [0049.842] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png", pszSpec="*.jpeg") returned 0 [0049.842] lstrlenA (lpString="*.jpeg") returned 6 [0049.842] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png", pszSpec="*.psd") returned 0 [0049.842] lstrlenA (lpString="*.psd") returned 5 [0049.842] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png", pszSpec="*.gif") returned 0 [0049.842] lstrlenA (lpString="*.gif") returned 5 [0049.842] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png", pszSpec="*.doc") returned 0 [0049.843] PathMatchSpecA (pszFile="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png", pszSpec="*.docx") returned 0 [0049.843] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711bbcdd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711bbcdd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x946, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0049.843] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="button-highlight.png") returned 1 [0049.843] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button-highlight.png") returned 1 [0049.843] lstrcmpiA (lpString1="", lpString2="button-highlight.png") returned -1 [0049.843] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png") returned="btn-previous-static.png" [0049.843] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" [0049.843] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="" [0049.843] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" [0049.843] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\how to decrypt files.txt")) returned 0x20 [0049.843] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="button-highlight.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" [0049.843] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711e1e3a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711e1e3a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6bbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-overlay.png", cAlternateFileName="")) returned 1 [0049.844] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="button-overlay.png") returned 1 [0049.844] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button-overlay.png") returned 1 [0049.844] lstrcmpiA (lpString1="", lpString2="button-overlay.png") returned -1 [0049.844] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png") returned="button-highlight.png" [0049.844] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" [0049.844] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="" [0049.844] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" [0049.844] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\how to decrypt files.txt")) returned 0x20 [0049.844] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="button-overlay.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" [0049.844] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71207f97, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71207f97, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb53, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memories_buttonClear.png", cAlternateFileName="")) returned 1 [0049.844] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Memories_buttonClear.png") returned -1 [0049.844] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Memories_buttonClear.png") returned -1 [0049.844] lstrcmpiA (lpString1="", lpString2="Memories_buttonClear.png") returned -1 [0049.844] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png") returned="button-overlay.png" [0049.844] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" [0049.844] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="" [0049.844] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" [0049.844] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\how to decrypt files.txt")) returned 0x20 [0049.845] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="Memories_buttonClear.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" [0049.845] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7122e0f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7122e0f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2a88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_btn-back-static.png", cAlternateFileName="")) returned 1 [0049.845] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Notes_btn-back-static.png") returned -1 [0049.845] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Notes_btn-back-static.png") returned -1 [0049.845] lstrcmpiA (lpString1="", lpString2="Notes_btn-back-static.png") returned -1 [0049.845] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png") returned="Memories_buttonClear.png" [0049.845] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" [0049.845] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="" [0049.845] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" [0049.845] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\how to decrypt files.txt")) returned 0x20 [0049.845] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="Notes_btn-back-static.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" [0049.845] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7127a3ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7127a3ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a7ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_content-background.png", cAlternateFileName="")) returned 1 [0049.845] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Notes_content-background.png") returned -1 [0049.845] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Notes_content-background.png") returned -1 [0049.845] lstrcmpiA (lpString1="", lpString2="Notes_content-background.png") returned -1 [0049.845] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png") returned="Notes_btn-back-static.png" [0049.845] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" [0049.845] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="" [0049.845] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" [0049.846] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\how to decrypt files.txt")) returned 0x20 [0049.846] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="Notes_content-background.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" [0049.846] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710b1352, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710b1352, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="scrapbook.png", cAlternateFileName="")) returned 1 [0049.846] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="scrapbook.png") returned -1 [0049.846] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="scrapbook.png") returned -1 [0049.846] lstrcmpiA (lpString1="", lpString2="scrapbook.png") returned -1 [0049.846] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png") returned="Notes_content-background.png" [0049.846] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" [0049.846] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="" [0049.846] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" [0049.846] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\how to decrypt files.txt")) returned 0x20 [0049.846] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="scrapbook.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" [0049.846] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712c6668, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712c6668, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x390c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_content-background.png", cAlternateFileName="")) returned 1 [0049.846] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Title_content-background.png") returned -1 [0049.846] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Title_content-background.png") returned -1 [0049.846] lstrcmpiA (lpString1="", lpString2="Title_content-background.png") returned -1 [0049.846] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned="scrapbook.png" [0049.846] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" [0049.847] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="" [0049.847] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" [0049.847] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\how to decrypt files.txt")) returned 0x20 [0049.847] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="Title_content-background.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" [0049.847] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2c6fe3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_mainImage-mask.png", cAlternateFileName="")) returned 1 [0049.847] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Title_mainImage-mask.png") returned -1 [0049.847] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Title_mainImage-mask.png") returned -1 [0049.847] lstrcmpiA (lpString1="", lpString2="Title_mainImage-mask.png") returned -1 [0049.847] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png") returned="Title_content-background.png" [0049.847] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" [0049.847] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="" [0049.847] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" [0049.847] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\how to decrypt files.txt")) returned 0x20 [0049.847] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="Title_mainImage-mask.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" [0049.847] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc47, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_select-highlight.png", cAlternateFileName="")) returned 1 [0049.847] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Title_select-highlight.png") returned -1 [0049.847] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Title_select-highlight.png") returned -1 [0049.848] lstrcmpiA (lpString1="", lpString2="Title_select-highlight.png") returned -1 [0049.848] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png") returned="Title_mainImage-mask.png" [0049.848] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" [0049.848] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned="" [0049.848] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" [0049.848] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\how to decrypt files.txt")) returned 0x20 [0049.848] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", lpString2="Title_select-highlight.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" [0049.848] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc47, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_select-highlight.png", cAlternateFileName="")) returned 0 [0049.848] FindClose (in: hFindFile=0x2d7fe8 | out: hFindFile=0x2d7fe8) returned 1 [0049.848] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e96ab6a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e96ab6a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12ea, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="menu_style_default_Thumbnail.png", cAlternateFileName="")) returned 1 [0049.848] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="menu_style_default_Thumbnail.png") returned -1 [0049.848] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="menu_style_default_Thumbnail.png") returned -1 [0049.848] lstrcmpiA (lpString1="", lpString2="menu_style_default_Thumbnail.png") returned -1 [0049.848] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*") returned="*.*" [0049.848] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0049.848] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="" [0049.849] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" [0049.849] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\how to decrypt files.txt")) returned 0x20 [0049.849] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="menu_style_default_Thumbnail.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" [0049.849] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef11f38, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef11f38, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0049.849] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NavigationLeft_ButtonGraphic.png") returned -1 [0049.849] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NavigationLeft_ButtonGraphic.png") returned -1 [0049.849] lstrcmpiA (lpString1="", lpString2="NavigationLeft_ButtonGraphic.png") returned -1 [0049.849] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png") returned="menu_style_default_Thumbnail.png" [0049.849] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0049.849] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="" [0049.849] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" [0049.849] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\how to decrypt files.txt")) returned 0x20 [0049.849] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="NavigationLeft_ButtonGraphic.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" [0049.849] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef11f38, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef11f38, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0049.849] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NavigationLeft_SelectionSubpicture.png") returned -1 [0049.849] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NavigationLeft_SelectionSubpicture.png") returned -1 [0049.849] lstrcmpiA (lpString1="", lpString2="NavigationLeft_SelectionSubpicture.png") returned -1 [0049.850] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0049.850] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0049.850] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="" [0049.850] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" [0049.850] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\how to decrypt files.txt")) returned 0x20 [0049.850] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="NavigationLeft_SelectionSubpicture.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" [0049.850] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef38095, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef38095, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0049.850] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NavigationRight_ButtonGraphic.png") returned -1 [0049.850] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NavigationRight_ButtonGraphic.png") returned -1 [0049.850] lstrcmpiA (lpString1="", lpString2="NavigationRight_ButtonGraphic.png") returned -1 [0049.850] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0049.850] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0049.850] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="" [0049.850] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" [0049.850] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\how to decrypt files.txt")) returned 0x20 [0049.850] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="NavigationRight_ButtonGraphic.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" [0049.850] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef5e1f2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef5e1f2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0049.851] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NavigationRight_SelectionSubpicture.png") returned -1 [0049.851] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NavigationRight_SelectionSubpicture.png") returned -1 [0049.851] lstrcmpiA (lpString1="", lpString2="NavigationRight_SelectionSubpicture.png") returned -1 [0049.851] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0049.851] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" [0049.851] PathAddBackslashA (in: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\" | out: pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned="" [0049.851] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" [0049.851] GetFileAttributesA (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\how to decrypt files.txt")) returned 0x20 [0049.851] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="NavigationRight_SelectionSubpicture.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" [0049.851] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0049.851] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NavigationUp_ButtonGraphic.png") returned -1 [0049.851] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NavigationUp_ButtonGraphic.png") returned -1 [0049.851] lstrcmpiA (lpString1="", lpString2="NavigationUp_ButtonGraphic.png") returned -1 [0049.851] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0049.854] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0049.854] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NavigationUp_SelectionSubpicture.png") returned -1 [0049.854] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NavigationUp_SelectionSubpicture.png") returned -1 [0049.854] lstrcmpiA (lpString1="", lpString2="NavigationUp_SelectionSubpicture.png") returned -1 [0049.855] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0049.855] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OldAge", cAlternateFileName="")) returned 1 [0049.855] lstrcmpA (lpString1=".", lpString2="OldAge") returned -1 [0049.855] lstrcmpA (lpString1="..", lpString2="OldAge") returned -1 [0049.855] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0049.855] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="OldAge" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge" [0049.855] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d8118, cFileName=".", cAlternateFileName="")) returned 0x2d7fe8 [0049.857] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.857] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.857] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.857] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.857] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fcc1ca4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fcc1ca4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0049.857] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="1047x576black.png") returned 1 [0049.857] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1047x576black.png") returned 1 [0049.857] lstrcmpiA (lpString1="", lpString2="1047x576black.png") returned -1 [0049.858] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*") returned="*.*" [0049.862] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.862] CloseHandle (hObject=0x90) returned 1 [0049.862] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", lpString2="1047x576black.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" [0049.862] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fce7e01, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fce7e01, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x2d8358, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0049.862] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png") returned="1047x576black.png" [0049.862] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd0df5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd0df5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x183b, dwReserved0=0x0, dwReserved1=0x0, cFileName="decorative_rule.png", cAlternateFileName="")) returned 1 [0049.862] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png") returned="15x15dot.png" [0049.862] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdcc62f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdcc62f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0049.862] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png") returned="decorative_rule.png" [0049.863] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd80375, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd80375, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0049.863] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0049.863] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fda64d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fda64d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0049.863] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0049.863] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd340bb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd340bb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d31329f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0049.863] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0049.863] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd0df5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd0df5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d31329f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0049.863] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0049.863] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd5a218, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd5a218, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0049.863] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0049.864] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc9bb47, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc9bb47, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="vintage.png", cAlternateFileName="")) returned 1 [0049.864] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0049.864] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc9bb47, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc9bb47, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="vintage.png", cAlternateFileName="")) returned 0 [0049.864] FindClose (in: hFindFile=0x2d7fe8 | out: hFindFile=0x2d7fe8) returned 1 [0049.864] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Performance", cAlternateFileName="PERFOR~1")) returned 1 [0049.864] lstrcmpA (lpString1=".", lpString2="Performance") returned -1 [0049.864] lstrcmpA (lpString1="..", lpString2="Performance") returned -1 [0049.864] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*") returned="*.*" [0049.864] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="Performance" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance" [0049.864] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d7fe8 [0049.867] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.867] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.867] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.867] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.867] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70562bb6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70562bb6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="720x480blacksquare.png", cAlternateFileName="")) returned 1 [0049.867] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*") returned="*.*" [0049.869] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.869] CloseHandle (hObject=0x90) returned 1 [0049.869] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", lpString2="720x480blacksquare.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" [0049.869] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703015e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x703015e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1168, dwReserved0=0x0, dwReserved1=0x2d8368, cFileName="NextMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0049.869] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png") returned="720x480blacksquare.png" [0049.870] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70327743, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70327743, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dbda349, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc04, dwReserved0=0x0, dwReserved1=0x0, cFileName="NextMenuButtonIconSubpictur.png", cAlternateFileName="")) returned 1 [0049.870] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png") returned="NextMenuButtonIcon.png" [0049.870] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70184844, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70184844, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dc26605, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa942c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_loop.wmv", cAlternateFileName="")) returned 1 [0049.870] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png") returned="NextMenuButtonIconSubpictur.png" [0049.872] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7021cdb8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7021cdb8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dc728c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbebec, dwReserved0=0x2d8120, dwReserved1=0x0, cFileName="Notes_loop_PAL.wmv", cAlternateFileName="")) returned 1 [0049.872] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv") returned="Notes_loop.wmv" [0049.872] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7015e6e7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7015e6e7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11ad, dwReserved0=0x2d8128, dwReserved1=0x0, cFileName="ParentMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0049.872] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv") returned="Notes_loop_PAL.wmv" [0049.872] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7015e6e7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7015e6e7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParentMenuButtonIconSubpict.png", cAlternateFileName="")) returned 1 [0049.872] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png") returned="ParentMenuButtonIcon.png" [0049.872] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70053d5c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70053d5c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x629b, dwReserved0=0x0, dwReserved1=0x0, cFileName="performance.png", cAlternateFileName="")) returned 1 [0049.872] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png") returned="ParentMenuButtonIconSubpict.png" [0049.873] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700a0016, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700a0016, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1b0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perf_Scenes_Mask1.png", cAlternateFileName="")) returned 1 [0049.873] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png") returned="performance.png" [0049.873] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perf_Scenes_Subpicture1.png", cAlternateFileName="")) returned 1 [0049.873] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned="Perf_Scenes_Mask1.png" [0049.873] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70269072, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70269072, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0x0, dwReserved1=0x0, cFileName="PreviousMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0049.873] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned="Perf_Scenes_Subpicture1.png" [0049.873] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x702b532c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x702b532c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PreviousMenuButtonIconSubpi.png", cAlternateFileName="")) returned 1 [0049.873] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png") returned="PreviousMenuButtonIcon.png" [0049.873] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700ec2d0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700ec2d0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc24, dwReserved0=0x0, dwReserved1=0x0, cFileName="redmenu.png", cAlternateFileName="")) returned 1 [0049.873] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png") returned="PreviousMenuButtonIconSubpi.png" [0049.873] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70327743, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70327743, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ddc950f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8232c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scene_loop.wmv", cAlternateFileName="")) returned 1 [0049.874] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png") returned="redmenu.png" [0049.874] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70399b5a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70399b5a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4de61a87, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x95bac, dwReserved0=0x2d8120, dwReserved1=0x0, cFileName="Scene_loop_PAL.wmv", cAlternateFileName="")) returned 1 [0049.874] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv") returned="Scene_loop.wmv" [0049.875] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7011242d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7011242d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x2d8128, dwReserved1=0x0, cFileName="TitleButtonIcon.png", cAlternateFileName="")) returned 1 [0049.875] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv") returned="Scene_loop_PAL.wmv" [0049.875] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7011242d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7011242d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x0, dwReserved1=0x0, cFileName="TitleButtonSubpicture.png", cAlternateFileName="")) returned 1 [0049.875] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png") returned="TitleButtonIcon.png" [0049.875] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703e5e14, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x703e5e14, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ded3ea1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a9204, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Page.wmv", cAlternateFileName="")) returned 1 [0049.875] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png") returned="TitleButtonSubpicture.png" [0049.876] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7047e388, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7047e388, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e050c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1d0304, dwReserved0=0x2d8120, dwReserved1=0x0, cFileName="Title_Page_PAL.wmv", cAlternateFileName="")) returned 1 [0049.876] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned="Title_Page.wmv" [0049.876] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70588d13, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70588d13, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e1a789b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xad264, dwReserved0=0x2d8128, dwReserved1=0x0, cFileName="title_trans_notes.wmv", cAlternateFileName="")) returned 1 [0049.876] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned="Title_Page_PAL.wmv" [0049.877] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705fb12a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x705fb12a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e1f3b57, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb4f64, dwReserved0=0x2d8130, dwReserved1=0x0, cFileName="Title_Trans_Notes_PAL.wmv", cAlternateFileName="")) returned 1 [0049.877] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv") returned="title_trans_notes.wmv" [0049.877] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7066d541, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7066d541, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e23fe13, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x999e4, dwReserved0=0x2d8138, dwReserved1=0x0, cFileName="title_trans_scene.wmv", cAlternateFileName="")) returned 1 [0049.877] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv") returned="Title_Trans_Notes_PAL.wmv" [0049.878] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70705ab5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70705ab5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa16e4, dwReserved0=0x2d8130, dwReserved1=0x0, cFileName="Title_Trans_Scene_PAL.wmv", cAlternateFileName="")) returned 1 [0049.878] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv") returned="title_trans_scene.wmv" [0049.878] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70079eb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70079eb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a3c, dwReserved0=0x2d8138, dwReserved1=0x0, cFileName="userContent_16x9_imagemask.png", cAlternateFileName="")) returned 1 [0049.878] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv") returned="Title_Trans_Scene_PAL.wmv" [0049.878] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2ee8, dwReserved0=0x0, dwReserved1=0x0, cFileName="whitemenu.png", cAlternateFileName="")) returned 1 [0049.878] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png") returned="userContent_16x9_imagemask.png" [0049.878] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2ee8, dwReserved0=0x0, dwReserved1=0x0, cFileName="whitemenu.png", cAlternateFileName="")) returned 0 [0049.878] FindClose (in: hFindFile=0x2d7fe8 | out: hFindFile=0x2d7fe8) returned 1 [0049.878] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Pets", cAlternateFileName="")) returned 1 [0049.878] lstrcmpA (lpString1=".", lpString2="Pets") returned -1 [0049.878] lstrcmpA (lpString1="..", lpString2="Pets") returned -1 [0049.879] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*") returned="*.*" [0049.879] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="Pets" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets" [0049.879] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d7fe8 [0049.881] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.881] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.881] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.881] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.881] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72003fbd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72003fbd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39eaa, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Notes_INTRO_BG.wmv", cAlternateFileName="")) returned 1 [0049.881] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*") returned="*.*" [0049.882] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.883] CloseHandle (hObject=0x90) returned 1 [0049.883] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", lpString2="Notes_INTRO_BG.wmv" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" [0049.884] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72050277, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72050277, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd24, dwReserved0=0x2d8118, dwReserved1=0x0, cFileName="Notes_INTRO_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0049.884] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv") returned="Notes_INTRO_BG.wmv" [0049.885] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x720763d4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x720763d4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e5d1ee3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc0b4a, dwReserved0=0x2d8120, dwReserved1=0x0, cFileName="Notes_LOOP_BG.wmv", cAlternateFileName="")) returned 1 [0049.885] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv") returned="Notes_INTRO_BG_PAL.wmv" [0049.885] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7210e948, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7210e948, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e61e19f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd43ca, dwReserved0=0x2d8118, dwReserved1=0x0, cFileName="Notes_LOOP_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0049.885] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv") returned="Notes_LOOP_BG.wmv" [0049.885] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7240848c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7240848c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e66a45b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x2d8120, dwReserved1=0x0, cFileName="Pets_btn-back-over-select.png", cAlternateFileName="")) returned 1 [0049.885] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv") returned="Notes_LOOP_BG_PAL.wmv" [0049.886] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7242e5e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7242e5e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e66a45b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x739, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-back-static.png", cAlternateFileName="")) returned 1 [0049.886] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png") returned="Pets_btn-back-over-select.png" [0049.886] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72454746, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72454746, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-next-over-select.png", cAlternateFileName="")) returned 1 [0049.886] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned="Pets_btn-back-static.png" [0049.886] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7247a8a3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7247a8a3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-next-static.png", cAlternateFileName="")) returned 1 [0049.886] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned="Pets_btn-next-over-select.png" [0049.886] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722b1847, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722b1847, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-over-DOT.png", cAlternateFileName="")) returned 1 [0049.886] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned="Pets_btn-next-static.png" [0049.886] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724a0a00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724a0a00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-previous-over-select.png", cAlternateFileName="")) returned 1 [0049.886] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png") returned="Pets_btn-over-DOT.png" [0049.887] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724a0a00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724a0a00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-previous-static.png", cAlternateFileName="")) returned 1 [0049.887] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned="Pets_btn-previous-over-select.png" [0049.887] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722d79a4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722d79a4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x33b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_frame-border.png", cAlternateFileName="")) returned 1 [0049.887] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned="Pets_btn-previous-static.png" [0049.887] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724c6b5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724c6b5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6dc875, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1681, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_frame-highlight.png", cAlternateFileName="")) returned 1 [0049.887] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png") returned="Pets_frame-border.png" [0049.887] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722fdb01, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722fdb01, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6dc875, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1fe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_frame-imageMask.png", cAlternateFileName="")) returned 1 [0049.887] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png") returned="Pets_frame-highlight.png" [0049.887] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722d79a4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722d79a4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea22689, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x643e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_frame-shadow.png", cAlternateFileName="")) returned 1 [0049.887] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png") returned="Pets_frame-imageMask.png" [0049.887] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724eccba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724eccba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_image-frame-backglow.png", cAlternateFileName="")) returned 1 [0049.887] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png") returned="Pets_frame-shadow.png" [0049.887] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724eccba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724eccba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1f0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_image-frame-border.png", cAlternateFileName="")) returned 1 [0049.887] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png") returned="Pets_image-frame-backglow.png" [0049.887] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724c6b5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724c6b5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1146, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_image-frame-ImageMask.png", cAlternateFileName="")) returned 1 [0049.887] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png") returned="Pets_image-frame-border.png" [0049.888] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7240848c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7240848c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1ed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_notes-txt-background.png", cAlternateFileName="")) returned 1 [0049.888] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png") returned="Pets_image-frame-ImageMask.png" [0049.888] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71fdde60, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71fdde60, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="rollinghills.png", cAlternateFileName="")) returned 1 [0049.888] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned="Pets_notes-txt-background.png" [0049.888] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7215ac02, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7215ac02, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea6e945, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scenes_INTRO_BG.wmv", cAlternateFileName="")) returned 1 [0049.888] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned="rollinghills.png" [0049.889] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72180d5f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72180d5f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ec1184f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3fc64, dwReserved0=0x2d8120, dwReserved1=0x0, cFileName="Scenes_INTRO_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0049.889] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned="Scenes_INTRO_BG.wmv" [0049.889] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x721cd019, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x721cd019, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ec379ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2a8a, dwReserved0=0x2d8128, dwReserved1=0x0, cFileName="Scenes_LOOP_BG.wmv", cAlternateFileName="")) returned 1 [0049.889] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned="Scenes_INTRO_BG_PAL.wmv" [0049.890] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7223f430, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7223f430, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ecf6083, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd43ca, dwReserved0=0x2d8118, dwReserved1=0x0, cFileName="Scenes_LOOP_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0049.890] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned="Scenes_LOOP_BG.wmv" [0049.890] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72323c5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72323c5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ed4233f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xe3dca, dwReserved0=0x2d8120, dwReserved1=0x0, cFileName="Title_Page_Ref.wmv", cAlternateFileName="")) returned 1 [0049.890] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv") returned="Scenes_LOOP_BG_PAL.wmv" [0049.890] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723bc1d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x723bc1d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf188a, dwReserved0=0x2d8118, dwReserved1=0x0, cFileName="Title_Page_Ref_PAL.wmv", cAlternateFileName="")) returned 1 [0049.890] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv") returned="Title_Page_Ref.wmv" [0049.891] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723bc1d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x723bc1d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf188a, dwReserved0=0x2d8118, dwReserved1=0x0, cFileName="Title_Page_Ref_PAL.wmv", cAlternateFileName="")) returned 0 [0049.891] FindClose (in: hFindFile=0x2d7fe8 | out: hFindFile=0x2d7fe8) returned 1 [0049.892] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ee00a15, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x4ee00a15, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14fc, dwReserved0=0x2d495f, dwReserved1=0x3, cFileName="photoedge_buttongraphic.png", cAlternateFileName="")) returned 1 [0049.892] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*") returned="*.*" [0049.892] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8601df, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8601df, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1274, dwReserved0=0x0, dwReserved1=0x0, cFileName="photoedge_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0049.892] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png") returned="photoedge_buttongraphic.png" [0049.892] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e88633c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e88633c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1266, dwReserved0=0x0, dwReserved1=0x0, cFileName="photoedge_videoinset.png", cAlternateFileName="")) returned 1 [0049.892] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png") returned="photoedge_selectionsubpicture.png" [0049.892] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efaa4ac, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efaa4ac, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x59b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Postage_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0049.892] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png") returned="photoedge_videoinset.png" [0049.892] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efd0609, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efd0609, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x160f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Postage_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0049.892] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png") returned="Postage_ButtonGraphic.png" [0049.893] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efd0609, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efd0609, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Postage_VideoInset.png", cAlternateFileName="")) returned 1 [0049.893] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png") returned="Postage_SelectionSubpicture.png" [0049.893] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Push", cAlternateFileName="")) returned 1 [0049.893] lstrcmpA (lpString1=".", lpString2="Push") returned -1 [0049.893] lstrcmpA (lpString1="..", lpString2="Push") returned -1 [0049.893] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png") returned="Postage_VideoInset.png" [0049.893] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="Push" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push" [0049.893] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d8118, cFileName=".", cAlternateFileName="")) returned 0x2d7fe8 [0049.895] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.896] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0049.896] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.896] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.896] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f316407, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f316407, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0049.896] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*") returned="*.*" [0049.897] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.897] CloseHandle (hObject=0x90) returned 1 [0049.898] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\", lpString2="1047x576black.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" [0049.898] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f316407, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f316407, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x2d8358, cFileName="1047_576black.png", cAlternateFileName="")) returned 1 [0049.898] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png") returned="1047x576black.png" [0049.898] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3626c1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3626c1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0049.898] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png") returned="1047_576black.png" [0049.898] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3626c1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3626c1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0049.898] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0049.898] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0049.898] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0049.898] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0049.899] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0049.899] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f33c564, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f33c564, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0049.899] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0049.899] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f33c564, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f33c564, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0049.899] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0049.899] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2f02aa, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f2f02aa, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5e02, dwReserved0=0x0, dwReserved1=0x0, cFileName="push.png", cAlternateFileName="")) returned 1 [0049.899] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0049.900] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x0, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 1 [0049.900] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png") returned="push.png" [0049.900] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="push_item.png", cAlternateFileName="")) returned 1 [0049.900] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png") returned="pushplaysubpicture.png" [0049.900] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="push_title.png", cAlternateFileName="")) returned 1 [0049.900] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png") returned="push_item.png" [0049.900] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="push_title.png", cAlternateFileName="")) returned 0 [0049.900] FindClose (in: hFindFile=0x2d7fe8 | out: hFindFile=0x2d7fe8) returned 1 [0049.900] FindNextFileA (in: hFindFile=0x2d8050, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Rectangles", cAlternateFileName="RECTAN~1")) returned 1 [0049.900] lstrcmpA (lpString1=".", lpString2="Rectangles") returned -1 [0049.900] lstrcmpA (lpString1="..", lpString2="Rectangles") returned -1 [0049.900] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*") returned="*.*" [0049.900] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="Rectangles" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles" [0049.901] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d7fe8 [0049.903] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.903] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.903] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.903] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.903] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f955d49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f955d49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0049.903] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*") returned="*.*" [0049.904] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.904] CloseHandle (hObject=0x90) returned 1 [0049.905] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", lpString2="1047x576black.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" [0049.905] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9c8160, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9c8160, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x0, dwReserved1=0x2d8360, cFileName="1047x576_91n92.png", cAlternateFileName="")) returned 1 [0049.905] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png") returned="1047x576black.png" [0049.905] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9ee2bd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9ee2bd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eee5249, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0049.905] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png") returned="1047x576_91n92.png" [0049.905] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9a2003, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9a2003, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480icongraphic.png", cAlternateFileName="")) returned 1 [0049.905] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png") returned="15x15dot.png" [0049.906] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa86831, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa86831, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0049.906] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png") returned="720x480icongraphic.png" [0049.906] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa3a577, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa3a577, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0049.906] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0049.906] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa606d4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa606d4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0049.906] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0049.906] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1441a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa1441a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0049.906] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0049.906] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9ee2bd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9ee2bd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0049.906] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0049.906] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa3a577, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa3a577, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0049.907] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0049.907] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f92fbec, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f92fbec, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef31505, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6114, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflect.png", cAlternateFileName="")) returned 1 [0049.907] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0049.907] FindNextFileA (in: hFindFile=0x2d7fe8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f97bea6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f97bea6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef31505, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2fcdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="vistabg.png", cAlternateFileName="")) returned 1 [0049.907] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png") returned="reflect.png" [0049.907] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*") returned="*.*" [0049.907] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned="rectangle_babypink_Thumbnail.bmp" [0049.907] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned="rectangle_glass_Thumbnail.bmp" [0049.907] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp") returned="rectangle_highlights_Thumbnail.bmp" [0049.908] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp") returned="rectangle_performance_Thumbnail.bmp" [0049.908] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned="rectangle_photo_Thumbnail.bmp" [0049.908] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp") returned="rectangle_plain_Thumbnail.bmp" [0049.908] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp") returned="rectangle_postage_Thumbnail.bmp" [0049.908] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp") returned="rectangle_scrapbook_Thumbnail.bmp" [0049.908] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp") returned="rectangle_specialocc_Thumbnail.bmp" [0049.908] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp") returned="rectangle_travel_Thumbnail.bmp" [0049.908] lstrcmpA (lpString1=".", lpString2="ResizingPanels") returned -1 [0049.908] lstrcmpA (lpString1="..", lpString2="ResizingPanels") returned -1 [0049.908] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp") returned="rectangle_widescreen_Thumbnail.bmp" [0049.909] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="ResizingPanels" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels" [0049.909] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d8118, cFileName=".", cAlternateFileName="")) returned 0x2d7fe8 [0049.911] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.911] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.911] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.912] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*") returned="*.*" [0049.913] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.913] CloseHandle (hObject=0x90) returned 1 [0049.913] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", lpString2="1047x576black.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" [0049.913] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png") returned="1047x576black.png" [0049.914] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png") returned="203x8subpicture.png" [0049.914] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png") returned="bandwidth.png" [0049.914] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png") returned="blackbars80.png" [0049.914] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0049.914] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0049.914] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0049.914] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0049.915] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0049.915] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0049.916] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv") returned="Panel_Mask.wmv" [0049.916] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*") returned="*.*" [0049.916] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp") returned="scene_button_style_default_Thumbnail.bmp" [0049.917] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png") returned="shadowonlyframe_buttongraphic.png" [0049.917] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png") returned="shadowonlyframe_selectionsubpicture.png" [0049.917] lstrcmpA (lpString1=".", lpString2="Shatter") returned -1 [0049.917] lstrcmpA (lpString1="..", lpString2="Shatter") returned -1 [0049.917] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png") returned="shadowonlyframe_videoinset.png" [0049.917] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="Shatter" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter" [0049.917] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d8118, cFileName=".", cAlternateFileName="")) returned 0x2d7fe8 [0049.921] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.921] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.921] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.921] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*") returned="*.*" [0049.922] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.922] CloseHandle (hObject=0x90) returned 1 [0049.922] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", lpString2="1047x576black.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" [0049.922] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png") returned="1047x576black.png" [0049.922] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png") returned="203x8subpicture.png" [0049.923] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0049.923] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0049.923] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0049.923] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0049.923] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0049.923] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0049.923] lstrcmpA (lpString1=".", lpString2="SpecialOccasion") returned -1 [0049.923] lstrcmpA (lpString1="..", lpString2="SpecialOccasion") returned -1 [0049.923] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*") returned="*.*" [0049.923] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="SpecialOccasion" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion" [0049.923] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d7fe8 [0049.925] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.925] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.925] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.925] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*") returned="*.*" [0049.927] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.927] CloseHandle (hObject=0x90) returned 1 [0049.927] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", lpString2="1047x576black.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" [0049.927] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png") returned="1047x576black.png" [0049.927] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png") returned="mainscroll.png" [0049.927] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png") returned="NavigationLeft_ButtonGraphic.png" [0049.927] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png") returned="NavigationLeft_SelectionSubpicture.png" [0049.927] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png") returned="NavigationRight_ButtonGraphic.png" [0049.927] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png") returned="NavigationRight_SelectionSubpicture.png" [0049.928] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png") returned="NavigationUp_ButtonGraphic.png" [0049.928] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png") returned="NavigationUp_SelectionSubpicture.png" [0049.928] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png") returned="scenesscroll.png" [0049.928] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png") returned="specialmainsubpicture.png" [0049.928] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png") returned="SpecialNavigationLeft_ButtonGraphic.png" [0049.928] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png") returned="SpecialNavigationLeft_SelectionSubpicture.png" [0049.928] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png") returned="SpecialNavigationRight_ButtonGraphic.png" [0049.928] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png") returned="SpecialNavigationRight_SelectionSubpicture.png" [0049.928] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png") returned="SpecialNavigationUp_ButtonGraphic.png" [0049.928] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png") returned="SpecialNavigationUp_SelectionSubpicture.png" [0049.928] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png") returned="specialoccasion.png" [0049.929] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png") returned="whitemask1047.png" [0049.929] lstrcmpA (lpString1=".", lpString2="Sports") returned -1 [0049.929] lstrcmpA (lpString1="..", lpString2="Sports") returned -1 [0049.929] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*") returned="*.*" [0049.929] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", lpString2="Sports" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports" [0049.929] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d7fe8 [0049.931] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.931] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.931] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.931] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*") returned="*.*" [0049.935] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.935] CloseHandle (hObject=0x90) returned 1 [0049.935] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", lpString2="CircleSubpicture.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" [0049.935] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png") returned="CircleSubpicture.png" [0049.936] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png") returned="GoldRing.png" [0049.936] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png") returned="highlight.png" [0049.936] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png") returned="NavigationButtonSubpicture.png" [0049.936] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png") returned="NextMenuButtonIcon.png" [0049.936] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png") returned="ParentMenuButtonIcon.png" [0049.936] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png") returned="PreviousMenuButtonIcon.png" [0049.936] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png") returned="SceneButtonInset_Alpha1.png" [0049.936] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png") returned="SceneButtonInset_Alpha2.png" [0049.936] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png") returned="SceneButtonSubpicture.png" [0049.937] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned="SportsMainBackground.wmv" [0049.938] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned="SportsMainBackground_PAL.wmv" [0049.938] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv") returned="SportsMainToNotesBackground.wmv" [0049.939] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv") returned="SportsMainToNotesBackground_PAL.wmv" [0049.939] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv") returned="SportsMainToScenesBackground.wmv" [0049.939] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned="SportsMainToScenesBackground_PAL.wmv" [0049.939] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned="SportsNotesBackground.wmv" [0049.940] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned="SportsNotesBackground_PAL.wmv" [0049.940] PathFindFileNameA (pszPath="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned="SportsScenesBackground.wmv" [0049.940] lstrcmpA (lpString1=".", lpString2="Stacking") returned -1 [0049.940] lstrcmpA (lpString1="..", lpString2="Stacking") returned -1 [0049.940] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d7fe8 [0049.942] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.942] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.942] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.944] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.944] CloseHandle (hObject=0x90) returned 1 [0049.944] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", lpString2="1047x576black.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" [0049.945] lstrcmpA (lpString1=".", lpString2="Travel") returned -1 [0049.945] lstrcmpA (lpString1="..", lpString2="Travel") returned -1 [0049.945] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d7fe8 [0049.947] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.947] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.947] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.948] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.948] CloseHandle (hObject=0x90) returned 1 [0049.949] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", lpString2="16_9-frame-background.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" [0049.953] lstrcmpA (lpString1=".", lpString2="VideoWall") returned -1 [0049.953] lstrcmpA (lpString1="..", lpString2="VideoWall") returned -1 [0049.953] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d8130, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d7fe8 [0049.953] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.953] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.953] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.955] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.955] CloseHandle (hObject=0x90) returned 1 [0049.955] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\", lpString2="203x8subpicture.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" [0049.955] lstrcmpA (lpString1=".", lpString2="Vignette") returned -1 [0049.955] lstrcmpA (lpString1="..", lpString2="Vignette") returned -1 [0049.955] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d7fe8 [0049.957] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.957] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.957] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.958] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.958] CloseHandle (hObject=0x90) returned 1 [0049.959] lstrcatA (in: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", lpString2="1047x576black.png" | out: lpString1="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png") returned="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" [0049.959] lstrcmpA (lpString1=".", lpString2="Internet Explorer") returned -1 [0049.959] lstrcmpA (lpString1="..", lpString2="Internet Explorer") returned -1 [0049.959] FindFirstFileA (in: lpFileName="C:\\Program Files\\Internet Explorer\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdfb78b20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfb78b20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d6fb0 [0049.960] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.960] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.960] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.960] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0049.960] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0049.960] FindFirstFileA (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d6ff0, dwReserved1=0x2d6feb, cFileName=".", cAlternateFileName="")) returned 0x2d6f58 [0049.961] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.961] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.961] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.962] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.962] CloseHandle (hObject=0x88) returned 1 [0049.962] lstrcatA (in: lpString1="C:\\Program Files\\Internet Explorer\\en-US\\", lpString2="hmmapi.dll.mui" | out: lpString1="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui") returned="C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" [0049.964] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.964] CloseHandle (hObject=0x84) returned 1 [0049.964] lstrcatA (in: lpString1="C:\\Program Files\\Internet Explorer\\", lpString2="hmmapi.dll" | out: lpString1="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned="C:\\Program Files\\Internet Explorer\\hmmapi.dll" [0049.964] lstrcmpA (lpString1=".", lpString2="SIGNUP") returned -1 [0049.964] lstrcmpA (lpString1="..", lpString2="SIGNUP") returned -1 [0049.964] FindFirstFileA (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x2d1296, cFileName=".", cAlternateFileName="")) returned 0x2d6f58 [0049.965] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.965] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.965] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.966] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.966] CloseHandle (hObject=0x88) returned 1 [0049.966] lstrcatA (in: lpString1="C:\\Program Files\\Internet Explorer\\SIGNUP\\", lpString2="install.ins" | out: lpString1="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" [0049.966] lstrcmpA (lpString1=".", lpString2="Microsoft Analysis Services") returned -1 [0049.966] lstrcmpA (lpString1="..", lpString2="Microsoft Analysis Services") returned -1 [0049.966] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdd66d4c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd66d4c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d6fc8 [0049.966] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.966] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.966] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.966] lstrcmpA (lpString1=".", lpString2="AS OLEDB") returned -1 [0049.966] lstrcmpA (lpString1="..", lpString2="AS OLEDB") returned -1 [0049.966] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d7008, dwReserved1=0x2d7003, cFileName=".", cAlternateFileName="")) returned 0x2d6f58 [0049.967] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.967] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.967] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.967] lstrcmpA (lpString1=".", lpString2="10") returned -1 [0049.967] lstrcmpA (lpString1="..", lpString2="10") returned -1 [0049.967] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2d8098 [0049.974] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.974] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.974] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.974] lstrcmpA (lpString1=".", lpString2="Cartridges") returned -1 [0049.974] lstrcmpA (lpString1="..", lpString2="Cartridges") returned -1 [0049.974] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2d8010 [0049.977] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.977] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.977] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.979] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.979] CloseHandle (hObject=0x90) returned 1 [0049.979] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", lpString2="as80.xsl" | out: lpString1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" [0049.980] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.980] CloseHandle (hObject=0x8c) returned 1 [0049.981] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", lpString2="msmdlocal.dll" | out: lpString1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" [0049.981] lstrcmpA (lpString1=".", lpString2="Resources") returned -1 [0049.981] lstrcmpA (lpString1="..", lpString2="Resources") returned -1 [0049.981] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d817a, cFileName=".", cAlternateFileName="")) returned 0x2d8010 [0049.981] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.981] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.981] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.981] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0049.981] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0049.981] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2db3c0, dwReserved1=0x2db3bb, cFileName=".", cAlternateFileName="")) returned 0x2d8050 [0049.982] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.982] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.982] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.984] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.984] CloseHandle (hObject=0x94) returned 1 [0049.984] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", lpString2="msmdsrv.rll" | out: lpString1="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" [0049.988] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0049.988] CloseHandle (hObject=0x84) returned 1 [0049.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Analysis Services\\", lpString2="far.exe" | out: lpString1="C:\\Program Files\\Microsoft Analysis Services\\far.exe") returned="C:\\Program Files\\Microsoft Analysis Services\\far.exe" [0049.988] lstrcmpA (lpString1=".", lpString2="Microsoft Office") returned -1 [0049.988] lstrcmpA (lpString1="..", lpString2="Microsoft Office") returned -1 [0049.988] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdd940ee0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd940ee0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d82d0, cFileName=".", cAlternateFileName="")) returned 0x2d6fb0 [0049.988] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.988] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.988] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.988] lstrcmpA (lpString1=".", lpString2="CLIPART") returned -1 [0049.988] lstrcmpA (lpString1="..", lpString2="CLIPART") returned -1 [0049.988] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d6ff0, dwReserved1=0x2d6feb, cFileName=".", cAlternateFileName="")) returned 0x2d6f58 [0049.990] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0049.990] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0049.990] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0049.990] lstrcmpA (lpString1=".", lpString2="PUB60COR") returned -1 [0049.990] lstrcmpA (lpString1="..", lpString2="PUB60COR") returned -1 [0049.990] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2d8070 [0049.998] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0050.020] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0050.021] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0050.056] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0050.056] CloseHandle (hObject=0x8c) returned 1 [0050.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00004_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" [0050.078] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0050.078] CloseHandle (hObject=0x8c) returned 1 [0050.078] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.wannacry")) returned 1 [0050.079] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0050.079] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00011_.GIF") returned 1 [0050.079] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00011_.GIF") returned 1 [0050.079] lstrcmpiA (lpString1="", lpString2="AG00011_.GIF") returned -1 [0050.079] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0050.079] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00011_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" [0050.082] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c30 [0050.082] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83130700, dwHighDateTime=0x1bd4b49), lpLastAccessTime=0x407536*(dwLowDateTime=0x512f1610, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83130700, dwHighDateTime=0x1bd4b49)) returned 1 [0050.082] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0050.082] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1bb2, lpOverlapped=0x0) returned 1 [0050.295] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0050.295] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1bb2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1bb2, lpOverlapped=0x0) returned 1 [0050.295] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0050.295] CloseHandle (hObject=0x8c) returned 1 [0050.296] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.wannacry")) returned 1 [0050.297] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0050.297] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00021_.GIF") returned 1 [0050.297] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00021_.GIF") returned 1 [0050.297] lstrcmpiA (lpString1="", lpString2="AG00021_.GIF") returned -1 [0050.297] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0050.297] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0050.297] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0050.297] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0050.297] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00021_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" [0050.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", pszSpec="*.zip") returned 0 [0050.297] lstrlenA (lpString="*.zip") returned 5 [0050.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", pszSpec="*.rar") returned 0 [0050.298] lstrlenA (lpString="*.rar") returned 5 [0050.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", pszSpec="*.7z") returned 0 [0050.298] lstrlenA (lpString="*.7z") returned 4 [0050.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", pszSpec="*.tar") returned 0 [0050.298] lstrlenA (lpString="*.tar") returned 5 [0050.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", pszSpec="*.gzip") returned 0 [0050.298] lstrlenA (lpString="*.gzip") returned 6 [0050.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", pszSpec="*.jpg") returned 0 [0050.298] lstrlenA (lpString="*.jpg") returned 5 [0050.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", pszSpec="*.jpeg") returned 0 [0050.298] lstrlenA (lpString="*.jpeg") returned 6 [0050.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", pszSpec="*.psd") returned 0 [0050.298] lstrlenA (lpString="*.psd") returned 5 [0050.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", pszSpec="*.gif") returned 1 [0050.298] lstrlenA (lpString="*.gif") returned 5 [0050.298] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" [0050.298] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" [0050.298] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF." [0050.298] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.wannacry" [0050.298] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0050.328] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a19 [0050.328] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x78587200, dwHighDateTime=0x1bd4b49), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb42550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x78587200, dwHighDateTime=0x1bd4b49)) returned 1 [0050.328] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0050.328] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x399b, lpOverlapped=0x0) returned 1 [0050.372] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned="AG00021_.GIF" [0050.372] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0050.372] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x399b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x399b, lpOverlapped=0x0) returned 1 [0050.372] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0050.372] CloseHandle (hObject=0x8c) returned 1 [0050.373] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.wannacry")) returned 1 [0050.374] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64147500, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64147500, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1a1c, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00037_.GIF", cAlternateFileName="")) returned 1 [0050.374] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0050.374] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00037_.GIF") returned 1 [0050.374] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00037_.GIF") returned 1 [0050.374] lstrcmpiA (lpString1="", lpString2="AG00037_.GIF") returned -1 [0050.374] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned="AG00021_.GIF" [0050.374] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0050.374] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0050.374] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0050.374] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0050.374] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00037_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" [0050.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", pszSpec="*.zip") returned 0 [0050.375] lstrlenA (lpString="*.zip") returned 5 [0050.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", pszSpec="*.rar") returned 0 [0050.375] lstrlenA (lpString="*.rar") returned 5 [0050.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", pszSpec="*.7z") returned 0 [0050.375] lstrlenA (lpString="*.7z") returned 4 [0050.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", pszSpec="*.tar") returned 0 [0050.375] lstrlenA (lpString="*.tar") returned 5 [0050.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", pszSpec="*.gzip") returned 0 [0050.375] lstrlenA (lpString="*.gzip") returned 6 [0050.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", pszSpec="*.jpg") returned 0 [0050.375] lstrlenA (lpString="*.jpg") returned 5 [0050.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", pszSpec="*.jpeg") returned 0 [0050.375] lstrlenA (lpString="*.jpeg") returned 6 [0050.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", pszSpec="*.psd") returned 0 [0050.375] lstrlenA (lpString="*.psd") returned 5 [0050.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", pszSpec="*.gif") returned 1 [0050.375] lstrlenA (lpString="*.gif") returned 5 [0050.375] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" [0050.375] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" [0050.375] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF." [0050.375] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.wannacry" [0050.375] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0050.375] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a1c [0050.375] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x64147500, dwHighDateTime=0x1bd4b49), lpLastAccessTime=0x407536*(dwLowDateTime=0x512f1610, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x64147500, dwHighDateTime=0x1bd4b49)) returned 1 [0050.376] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0050.376] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x199e, lpOverlapped=0x0) returned 1 [0050.441] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned="AG00037_.GIF" [0050.441] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0050.441] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x199e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x199e, lpOverlapped=0x0) returned 1 [0050.442] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0050.442] CloseHandle (hObject=0x8c) returned 1 [0050.443] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.wannacry")) returned 1 [0050.444] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47589c00, ftCreationTime.dwHighDateTime=0x1bf325d, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47589c00, ftLastWriteTime.dwHighDateTime=0x1bf325d, nFileSizeHigh=0x0, nFileSizeLow=0xcb3, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00038_.GIF", cAlternateFileName="")) returned 1 [0050.444] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0050.444] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00038_.GIF") returned 1 [0050.444] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00038_.GIF") returned 1 [0050.444] lstrcmpiA (lpString1="", lpString2="AG00038_.GIF") returned -1 [0050.444] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned="AG00037_.GIF" [0050.444] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0050.444] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0050.444] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0050.444] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0050.444] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00038_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" [0050.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", pszSpec="*.zip") returned 0 [0050.444] lstrlenA (lpString="*.zip") returned 5 [0050.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", pszSpec="*.rar") returned 0 [0050.444] lstrlenA (lpString="*.rar") returned 5 [0050.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", pszSpec="*.7z") returned 0 [0050.444] lstrlenA (lpString="*.7z") returned 4 [0050.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", pszSpec="*.tar") returned 0 [0050.445] lstrlenA (lpString="*.tar") returned 5 [0050.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", pszSpec="*.gzip") returned 0 [0050.445] lstrlenA (lpString="*.gzip") returned 6 [0050.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", pszSpec="*.jpg") returned 0 [0050.445] lstrlenA (lpString="*.jpg") returned 5 [0050.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", pszSpec="*.jpeg") returned 0 [0050.445] lstrlenA (lpString="*.jpeg") returned 6 [0050.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", pszSpec="*.psd") returned 0 [0050.445] lstrlenA (lpString="*.psd") returned 5 [0050.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", pszSpec="*.gif") returned 1 [0050.445] lstrlenA (lpString="*.gif") returned 5 [0050.445] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" [0050.446] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" [0050.446] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF." [0050.446] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.wannacry" [0050.446] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0050.526] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcb3 [0050.526] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x47589c00, dwHighDateTime=0x1bf325d), lpLastAccessTime=0x407536*(dwLowDateTime=0x512f1610, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x47589c00, dwHighDateTime=0x1bf325d)) returned 1 [0050.526] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0050.526] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xc35, lpOverlapped=0x0) returned 1 [0050.696] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned="AG00038_.GIF" [0050.696] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0050.696] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xc35, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xc35, lpOverlapped=0x0) returned 1 [0050.696] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0050.697] CloseHandle (hObject=0x8c) returned 1 [0050.698] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.wannacry")) returned 1 [0050.699] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f4fc100, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f4fc100, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1fa1, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00040_.GIF", cAlternateFileName="")) returned 1 [0050.700] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0050.700] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00040_.GIF") returned 1 [0050.700] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00040_.GIF") returned 1 [0050.700] lstrcmpiA (lpString1="", lpString2="AG00040_.GIF") returned -1 [0050.700] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned="AG00038_.GIF" [0050.700] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0050.700] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0050.700] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0050.700] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0050.700] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00040_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" [0050.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", pszSpec="*.zip") returned 0 [0050.700] lstrlenA (lpString="*.zip") returned 5 [0050.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", pszSpec="*.rar") returned 0 [0050.700] lstrlenA (lpString="*.rar") returned 5 [0050.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", pszSpec="*.7z") returned 0 [0050.700] lstrlenA (lpString="*.7z") returned 4 [0050.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", pszSpec="*.tar") returned 0 [0050.700] lstrlenA (lpString="*.tar") returned 5 [0050.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", pszSpec="*.gzip") returned 0 [0050.700] lstrlenA (lpString="*.gzip") returned 6 [0050.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", pszSpec="*.jpg") returned 0 [0050.701] lstrlenA (lpString="*.jpg") returned 5 [0050.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", pszSpec="*.jpeg") returned 0 [0050.701] lstrlenA (lpString="*.jpeg") returned 6 [0050.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", pszSpec="*.psd") returned 0 [0050.701] lstrlenA (lpString="*.psd") returned 5 [0050.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", pszSpec="*.gif") returned 1 [0050.701] lstrlenA (lpString="*.gif") returned 5 [0050.701] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" [0050.701] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" [0050.701] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF." [0050.701] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.wannacry" [0050.701] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0050.701] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fa1 [0050.701] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5f4fc100, dwHighDateTime=0x1bd4b49), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb42550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5f4fc100, dwHighDateTime=0x1bd4b49)) returned 1 [0050.701] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0050.702] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1f23, lpOverlapped=0x0) returned 1 [0051.188] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned="AG00040_.GIF" [0051.188] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.188] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1f23, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1f23, lpOverlapped=0x0) returned 1 [0051.189] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.189] CloseHandle (hObject=0x8c) returned 1 [0051.190] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.wannacry")) returned 1 [0051.191] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262e5400, ftCreationTime.dwHighDateTime=0x1bd4c10, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x262e5400, ftLastWriteTime.dwHighDateTime=0x1bd4c10, nFileSizeHigh=0x0, nFileSizeLow=0x1e06, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00052_.GIF", cAlternateFileName="")) returned 1 [0051.191] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.191] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00052_.GIF") returned 1 [0051.191] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00052_.GIF") returned 1 [0051.191] lstrcmpiA (lpString1="", lpString2="AG00052_.GIF") returned -1 [0051.191] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned="AG00040_.GIF" [0051.191] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.191] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.191] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.191] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.192] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00052_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" [0051.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", pszSpec="*.zip") returned 0 [0051.192] lstrlenA (lpString="*.zip") returned 5 [0051.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", pszSpec="*.rar") returned 0 [0051.192] lstrlenA (lpString="*.rar") returned 5 [0051.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", pszSpec="*.7z") returned 0 [0051.192] lstrlenA (lpString="*.7z") returned 4 [0051.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", pszSpec="*.tar") returned 0 [0051.192] lstrlenA (lpString="*.tar") returned 5 [0051.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", pszSpec="*.gzip") returned 0 [0051.192] lstrlenA (lpString="*.gzip") returned 6 [0051.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", pszSpec="*.jpg") returned 0 [0051.192] lstrlenA (lpString="*.jpg") returned 5 [0051.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", pszSpec="*.jpeg") returned 0 [0051.192] lstrlenA (lpString="*.jpeg") returned 6 [0051.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", pszSpec="*.psd") returned 0 [0051.192] lstrlenA (lpString="*.psd") returned 5 [0051.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", pszSpec="*.gif") returned 1 [0051.192] lstrlenA (lpString="*.gif") returned 5 [0051.192] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" [0051.192] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" [0051.192] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF." [0051.192] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.wannacry" [0051.192] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.193] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e06 [0051.193] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x262e5400, dwHighDateTime=0x1bd4c10), lpLastAccessTime=0x407536*(dwLowDateTime=0x512f1610, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x262e5400, dwHighDateTime=0x1bd4c10)) returned 1 [0051.193] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.193] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1d88, lpOverlapped=0x0) returned 1 [0051.202] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned="AG00052_.GIF" [0051.202] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.202] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1d88, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1d88, lpOverlapped=0x0) returned 1 [0051.202] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.202] CloseHandle (hObject=0x8c) returned 1 [0051.203] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.wannacry")) returned 1 [0051.204] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6b4200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b6b4200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2e73, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00057_.GIF", cAlternateFileName="")) returned 1 [0051.204] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.204] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00057_.GIF") returned 1 [0051.204] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00057_.GIF") returned 1 [0051.204] lstrcmpiA (lpString1="", lpString2="AG00057_.GIF") returned -1 [0051.204] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned="AG00052_.GIF" [0051.204] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.204] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.204] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.204] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.204] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00057_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" [0051.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", pszSpec="*.zip") returned 0 [0051.204] lstrlenA (lpString="*.zip") returned 5 [0051.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", pszSpec="*.rar") returned 0 [0051.204] lstrlenA (lpString="*.rar") returned 5 [0051.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", pszSpec="*.7z") returned 0 [0051.204] lstrlenA (lpString="*.7z") returned 4 [0051.204] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", pszSpec="*.tar") returned 0 [0051.204] lstrlenA (lpString="*.tar") returned 5 [0051.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", pszSpec="*.gzip") returned 0 [0051.205] lstrlenA (lpString="*.gzip") returned 6 [0051.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", pszSpec="*.jpg") returned 0 [0051.205] lstrlenA (lpString="*.jpg") returned 5 [0051.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", pszSpec="*.jpeg") returned 0 [0051.205] lstrlenA (lpString="*.jpeg") returned 6 [0051.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", pszSpec="*.psd") returned 0 [0051.205] lstrlenA (lpString="*.psd") returned 5 [0051.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", pszSpec="*.gif") returned 1 [0051.205] lstrlenA (lpString="*.gif") returned 5 [0051.205] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" [0051.205] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" [0051.205] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF." [0051.205] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.wannacry" [0051.205] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.205] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2e73 [0051.205] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8b6b4200, dwHighDateTime=0x1bd4b49), lpLastAccessTime=0x407536*(dwLowDateTime=0x512f1610, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8b6b4200, dwHighDateTime=0x1bd4b49)) returned 1 [0051.205] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.205] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2df5, lpOverlapped=0x0) returned 1 [0051.207] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned="AG00057_.GIF" [0051.207] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.207] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2df5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2df5, lpOverlapped=0x0) returned 1 [0051.208] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.208] CloseHandle (hObject=0x8c) returned 1 [0051.215] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.wannacry")) returned 1 [0051.216] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29618e00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29618e00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x205, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00090_.GIF", cAlternateFileName="")) returned 1 [0051.216] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.216] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00090_.GIF") returned 1 [0051.216] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00090_.GIF") returned 1 [0051.216] lstrcmpiA (lpString1="", lpString2="AG00090_.GIF") returned -1 [0051.216] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned="AG00057_.GIF" [0051.216] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.216] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.216] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.216] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.216] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00090_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" [0051.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", pszSpec="*.zip") returned 0 [0051.216] lstrlenA (lpString="*.zip") returned 5 [0051.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", pszSpec="*.rar") returned 0 [0051.216] lstrlenA (lpString="*.rar") returned 5 [0051.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", pszSpec="*.7z") returned 0 [0051.216] lstrlenA (lpString="*.7z") returned 4 [0051.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", pszSpec="*.tar") returned 0 [0051.216] lstrlenA (lpString="*.tar") returned 5 [0051.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", pszSpec="*.gzip") returned 0 [0051.216] lstrlenA (lpString="*.gzip") returned 6 [0051.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", pszSpec="*.jpg") returned 0 [0051.217] lstrlenA (lpString="*.jpg") returned 5 [0051.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", pszSpec="*.jpeg") returned 0 [0051.217] lstrlenA (lpString="*.jpeg") returned 6 [0051.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", pszSpec="*.psd") returned 0 [0051.217] lstrlenA (lpString="*.psd") returned 5 [0051.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", pszSpec="*.gif") returned 1 [0051.217] lstrlenA (lpString="*.gif") returned 5 [0051.217] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" [0051.217] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" [0051.217] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF." [0051.217] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.wannacry" [0051.217] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.217] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x205 [0051.217] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x29618e00, dwHighDateTime=0x1bd50af), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb42550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x29618e00, dwHighDateTime=0x1bd50af)) returned 1 [0051.218] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.218] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x187, lpOverlapped=0x0) returned 1 [0051.219] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned="AG00090_.GIF" [0051.219] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.219] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x187, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x187, lpOverlapped=0x0) returned 1 [0051.219] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.219] CloseHandle (hObject=0x8c) returned 1 [0051.231] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.wannacry")) returned 1 [0051.231] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ff3400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26ff3400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x1f6, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00092_.GIF", cAlternateFileName="")) returned 1 [0051.231] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.232] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00092_.GIF") returned 1 [0051.232] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00092_.GIF") returned 1 [0051.232] lstrcmpiA (lpString1="", lpString2="AG00092_.GIF") returned -1 [0051.232] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned="AG00090_.GIF" [0051.232] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.232] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.232] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00092_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" [0051.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", pszSpec="*.zip") returned 0 [0051.232] lstrlenA (lpString="*.zip") returned 5 [0051.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", pszSpec="*.rar") returned 0 [0051.232] lstrlenA (lpString="*.rar") returned 5 [0051.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", pszSpec="*.7z") returned 0 [0051.232] lstrlenA (lpString="*.7z") returned 4 [0051.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", pszSpec="*.tar") returned 0 [0051.232] lstrlenA (lpString="*.tar") returned 5 [0051.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", pszSpec="*.gzip") returned 0 [0051.232] lstrlenA (lpString="*.gzip") returned 6 [0051.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", pszSpec="*.jpg") returned 0 [0051.232] lstrlenA (lpString="*.jpg") returned 5 [0051.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", pszSpec="*.jpeg") returned 0 [0051.233] lstrlenA (lpString="*.jpeg") returned 6 [0051.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", pszSpec="*.psd") returned 0 [0051.233] lstrlenA (lpString="*.psd") returned 5 [0051.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", pszSpec="*.gif") returned 1 [0051.233] lstrlenA (lpString="*.gif") returned 5 [0051.233] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" [0051.233] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" [0051.233] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF." [0051.233] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.wannacry" [0051.233] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.233] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f6 [0051.233] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x26ff3400, dwHighDateTime=0x1bd50af), lpLastAccessTime=0x407536*(dwLowDateTime=0x512f1610, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x26ff3400, dwHighDateTime=0x1bd50af)) returned 1 [0051.233] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.234] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x178, lpOverlapped=0x0) returned 1 [0051.235] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned="AG00092_.GIF" [0051.235] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.235] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x178, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x178, lpOverlapped=0x0) returned 1 [0051.235] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.235] CloseHandle (hObject=0x8c) returned 1 [0051.245] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.wannacry")) returned 1 [0051.246] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ef57700, ftCreationTime.dwHighDateTime=0x1bd4f8b, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ef57700, ftLastWriteTime.dwHighDateTime=0x1bd4f8b, nFileSizeHigh=0x0, nFileSizeLow=0x319e, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00103_.GIF", cAlternateFileName="")) returned 1 [0051.246] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.246] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00103_.GIF") returned 1 [0051.246] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00103_.GIF") returned 1 [0051.246] lstrcmpiA (lpString1="", lpString2="AG00103_.GIF") returned -1 [0051.246] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned="AG00092_.GIF" [0051.246] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.246] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.246] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.246] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.246] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00103_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" [0051.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", pszSpec="*.zip") returned 0 [0051.246] lstrlenA (lpString="*.zip") returned 5 [0051.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", pszSpec="*.rar") returned 0 [0051.246] lstrlenA (lpString="*.rar") returned 5 [0051.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", pszSpec="*.7z") returned 0 [0051.247] lstrlenA (lpString="*.7z") returned 4 [0051.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", pszSpec="*.tar") returned 0 [0051.247] lstrlenA (lpString="*.tar") returned 5 [0051.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", pszSpec="*.gzip") returned 0 [0051.247] lstrlenA (lpString="*.gzip") returned 6 [0051.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", pszSpec="*.jpg") returned 0 [0051.247] lstrlenA (lpString="*.jpg") returned 5 [0051.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", pszSpec="*.jpeg") returned 0 [0051.247] lstrlenA (lpString="*.jpeg") returned 6 [0051.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", pszSpec="*.psd") returned 0 [0051.247] lstrlenA (lpString="*.psd") returned 5 [0051.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", pszSpec="*.gif") returned 1 [0051.247] lstrlenA (lpString="*.gif") returned 5 [0051.247] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" [0051.247] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" [0051.247] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF." [0051.247] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.wannacry" [0051.247] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.249] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x319e [0051.249] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4ef57700, dwHighDateTime=0x1bd4f8b), lpLastAccessTime=0x407536*(dwLowDateTime=0x512f1610, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4ef57700, dwHighDateTime=0x1bd4f8b)) returned 1 [0051.249] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.249] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3120, lpOverlapped=0x0) returned 1 [0051.251] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned="AG00103_.GIF" [0051.252] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.252] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3120, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3120, lpOverlapped=0x0) returned 1 [0051.252] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.252] CloseHandle (hObject=0x8c) returned 1 [0051.255] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.wannacry")) returned 1 [0051.256] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf316a100, ftCreationTime.dwHighDateTime=0x1bd4bcc, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf316a100, ftLastWriteTime.dwHighDateTime=0x1bd4bcc, nFileSizeHigh=0x0, nFileSizeLow=0xd9c, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00120_.GIF", cAlternateFileName="")) returned 1 [0051.256] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.256] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00120_.GIF") returned 1 [0051.256] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00120_.GIF") returned 1 [0051.256] lstrcmpiA (lpString1="", lpString2="AG00120_.GIF") returned -1 [0051.256] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned="AG00103_.GIF" [0051.256] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.256] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.256] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.256] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.257] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00120_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" [0051.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", pszSpec="*.zip") returned 0 [0051.257] lstrlenA (lpString="*.zip") returned 5 [0051.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", pszSpec="*.rar") returned 0 [0051.257] lstrlenA (lpString="*.rar") returned 5 [0051.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", pszSpec="*.7z") returned 0 [0051.257] lstrlenA (lpString="*.7z") returned 4 [0051.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", pszSpec="*.tar") returned 0 [0051.257] lstrlenA (lpString="*.tar") returned 5 [0051.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", pszSpec="*.gzip") returned 0 [0051.257] lstrlenA (lpString="*.gzip") returned 6 [0051.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", pszSpec="*.jpg") returned 0 [0051.257] lstrlenA (lpString="*.jpg") returned 5 [0051.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", pszSpec="*.jpeg") returned 0 [0051.257] lstrlenA (lpString="*.jpeg") returned 6 [0051.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", pszSpec="*.psd") returned 0 [0051.257] lstrlenA (lpString="*.psd") returned 5 [0051.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", pszSpec="*.gif") returned 1 [0051.257] lstrlenA (lpString="*.gif") returned 5 [0051.257] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" [0051.257] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" [0051.257] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF." [0051.257] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.wannacry" [0051.257] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.258] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd9c [0051.258] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf316a100, dwHighDateTime=0x1bd4bcc), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf316a100, dwHighDateTime=0x1bd4bcc)) returned 1 [0051.258] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.258] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd1e, lpOverlapped=0x0) returned 1 [0051.260] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned="AG00120_.GIF" [0051.260] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.260] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd1e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd1e, lpOverlapped=0x0) returned 1 [0051.260] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.261] CloseHandle (hObject=0x8c) returned 1 [0051.267] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.wannacry")) returned 1 [0051.268] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33bee00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33bee00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00126_.GIF", cAlternateFileName="")) returned 1 [0051.268] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.268] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00126_.GIF") returned 1 [0051.268] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00126_.GIF") returned 1 [0051.268] lstrcmpiA (lpString1="", lpString2="AG00126_.GIF") returned -1 [0051.268] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned="AG00120_.GIF" [0051.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.268] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.268] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00126_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" [0051.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", pszSpec="*.zip") returned 0 [0051.268] lstrlenA (lpString="*.zip") returned 5 [0051.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", pszSpec="*.rar") returned 0 [0051.268] lstrlenA (lpString="*.rar") returned 5 [0051.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", pszSpec="*.7z") returned 0 [0051.268] lstrlenA (lpString="*.7z") returned 4 [0051.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", pszSpec="*.tar") returned 0 [0051.269] lstrlenA (lpString="*.tar") returned 5 [0051.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", pszSpec="*.gzip") returned 0 [0051.269] lstrlenA (lpString="*.gzip") returned 6 [0051.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", pszSpec="*.jpg") returned 0 [0051.269] lstrlenA (lpString="*.jpg") returned 5 [0051.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", pszSpec="*.jpeg") returned 0 [0051.269] lstrlenA (lpString="*.jpeg") returned 6 [0051.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", pszSpec="*.psd") returned 0 [0051.269] lstrlenA (lpString="*.psd") returned 5 [0051.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", pszSpec="*.gif") returned 1 [0051.269] lstrlenA (lpString="*.gif") returned 5 [0051.269] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" [0051.269] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" [0051.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF." [0051.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.wannacry" [0051.269] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.269] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc44 [0051.270] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x33bee00, dwHighDateTime=0x1bd50af), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x33bee00, dwHighDateTime=0x1bd50af)) returned 1 [0051.270] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.270] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xbc6, lpOverlapped=0x0) returned 1 [0051.296] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned="AG00126_.GIF" [0051.296] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.296] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xbc6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xbc6, lpOverlapped=0x0) returned 1 [0051.296] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.296] CloseHandle (hObject=0x8c) returned 1 [0051.307] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.wannacry")) returned 1 [0051.308] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00129_.GIF", cAlternateFileName="")) returned 1 [0051.308] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.308] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00129_.GIF") returned 1 [0051.308] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00129_.GIF") returned 1 [0051.308] lstrcmpiA (lpString1="", lpString2="AG00129_.GIF") returned -1 [0051.308] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned="AG00126_.GIF" [0051.308] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.308] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.308] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.308] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.308] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00129_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" [0051.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", pszSpec="*.zip") returned 0 [0051.308] lstrlenA (lpString="*.zip") returned 5 [0051.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", pszSpec="*.rar") returned 0 [0051.308] lstrlenA (lpString="*.rar") returned 5 [0051.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", pszSpec="*.7z") returned 0 [0051.308] lstrlenA (lpString="*.7z") returned 4 [0051.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", pszSpec="*.tar") returned 0 [0051.308] lstrlenA (lpString="*.tar") returned 5 [0051.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", pszSpec="*.gzip") returned 0 [0051.309] lstrlenA (lpString="*.gzip") returned 6 [0051.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", pszSpec="*.jpg") returned 0 [0051.309] lstrlenA (lpString="*.jpg") returned 5 [0051.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", pszSpec="*.jpeg") returned 0 [0051.309] lstrlenA (lpString="*.jpeg") returned 6 [0051.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", pszSpec="*.psd") returned 0 [0051.309] lstrlenA (lpString="*.psd") returned 5 [0051.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", pszSpec="*.gif") returned 1 [0051.309] lstrlenA (lpString="*.gif") returned 5 [0051.309] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" [0051.309] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" [0051.309] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF." [0051.309] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.wannacry" [0051.309] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.309] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x30c2 [0051.309] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd99400, dwHighDateTime=0x1bd50af), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd99400, dwHighDateTime=0x1bd50af)) returned 1 [0051.309] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.309] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3044, lpOverlapped=0x0) returned 1 [0051.311] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned="AG00129_.GIF" [0051.311] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.311] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3044, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3044, lpOverlapped=0x0) returned 1 [0051.312] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.312] CloseHandle (hObject=0x8c) returned 1 [0051.314] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.wannacry")) returned 1 [0051.315] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffa86700, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffa86700, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x1485, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00130_.GIF", cAlternateFileName="")) returned 1 [0051.315] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.315] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00130_.GIF") returned 1 [0051.315] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00130_.GIF") returned 1 [0051.315] lstrcmpiA (lpString1="", lpString2="AG00130_.GIF") returned -1 [0051.315] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned="AG00129_.GIF" [0051.315] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.315] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.315] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.315] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.315] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00130_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" [0051.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", pszSpec="*.zip") returned 0 [0051.315] lstrlenA (lpString="*.zip") returned 5 [0051.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", pszSpec="*.rar") returned 0 [0051.315] lstrlenA (lpString="*.rar") returned 5 [0051.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", pszSpec="*.7z") returned 0 [0051.315] lstrlenA (lpString="*.7z") returned 4 [0051.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", pszSpec="*.tar") returned 0 [0051.315] lstrlenA (lpString="*.tar") returned 5 [0051.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", pszSpec="*.gzip") returned 0 [0051.315] lstrlenA (lpString="*.gzip") returned 6 [0051.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", pszSpec="*.jpg") returned 0 [0051.316] lstrlenA (lpString="*.jpg") returned 5 [0051.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", pszSpec="*.jpeg") returned 0 [0051.316] lstrlenA (lpString="*.jpeg") returned 6 [0051.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", pszSpec="*.psd") returned 0 [0051.316] lstrlenA (lpString="*.psd") returned 5 [0051.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", pszSpec="*.gif") returned 1 [0051.316] lstrlenA (lpString="*.gif") returned 5 [0051.316] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" [0051.316] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" [0051.316] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF." [0051.316] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.wannacry" [0051.316] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.316] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1485 [0051.316] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xffa86700, dwHighDateTime=0x1bd50ae), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb42550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xffa86700, dwHighDateTime=0x1bd50ae)) returned 1 [0051.316] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.317] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1407, lpOverlapped=0x0) returned 1 [0051.319] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned="AG00130_.GIF" [0051.319] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.319] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1407, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1407, lpOverlapped=0x0) returned 1 [0051.319] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.319] CloseHandle (hObject=0x8c) returned 1 [0051.320] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.wannacry")) returned 1 [0051.321] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b28600, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b28600, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00135_.GIF", cAlternateFileName="")) returned 1 [0051.321] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.321] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00135_.GIF") returned 1 [0051.321] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00135_.GIF") returned 1 [0051.321] lstrcmpiA (lpString1="", lpString2="AG00135_.GIF") returned -1 [0051.321] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned="AG00130_.GIF" [0051.321] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.321] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.321] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.321] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.321] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00135_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" [0051.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", pszSpec="*.zip") returned 0 [0051.322] lstrlenA (lpString="*.zip") returned 5 [0051.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", pszSpec="*.rar") returned 0 [0051.322] lstrlenA (lpString="*.rar") returned 5 [0051.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", pszSpec="*.7z") returned 0 [0051.322] lstrlenA (lpString="*.7z") returned 4 [0051.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", pszSpec="*.tar") returned 0 [0051.322] lstrlenA (lpString="*.tar") returned 5 [0051.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", pszSpec="*.gzip") returned 0 [0051.322] lstrlenA (lpString="*.gzip") returned 6 [0051.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", pszSpec="*.jpg") returned 0 [0051.322] lstrlenA (lpString="*.jpg") returned 5 [0051.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", pszSpec="*.jpeg") returned 0 [0051.322] lstrlenA (lpString="*.jpeg") returned 6 [0051.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", pszSpec="*.psd") returned 0 [0051.322] lstrlenA (lpString="*.psd") returned 5 [0051.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", pszSpec="*.gif") returned 1 [0051.322] lstrlenA (lpString="*.gif") returned 5 [0051.322] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" [0051.322] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" [0051.322] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF." [0051.322] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.wannacry" [0051.322] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.324] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa24 [0051.324] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf9b28600, dwHighDateTime=0x1bd50ae), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb42550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf9b28600, dwHighDateTime=0x1bd50ae)) returned 1 [0051.324] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.324] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x9a6, lpOverlapped=0x0) returned 1 [0051.326] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned="AG00135_.GIF" [0051.326] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.326] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x9a6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x9a6, lpOverlapped=0x0) returned 1 [0051.326] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.326] CloseHandle (hObject=0x8c) returned 1 [0051.329] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.wannacry")) returned 1 [0051.329] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3bca500, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3bca500, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x296f, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00139_.GIF", cAlternateFileName="")) returned 1 [0051.329] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.329] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00139_.GIF") returned 1 [0051.329] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00139_.GIF") returned 1 [0051.330] lstrcmpiA (lpString1="", lpString2="AG00139_.GIF") returned -1 [0051.330] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned="AG00135_.GIF" [0051.330] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.330] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.330] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.330] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.330] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00139_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" [0051.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", pszSpec="*.zip") returned 0 [0051.330] lstrlenA (lpString="*.zip") returned 5 [0051.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", pszSpec="*.rar") returned 0 [0051.330] lstrlenA (lpString="*.rar") returned 5 [0051.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", pszSpec="*.7z") returned 0 [0051.330] lstrlenA (lpString="*.7z") returned 4 [0051.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", pszSpec="*.tar") returned 0 [0051.330] lstrlenA (lpString="*.tar") returned 5 [0051.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", pszSpec="*.gzip") returned 0 [0051.330] lstrlenA (lpString="*.gzip") returned 6 [0051.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", pszSpec="*.jpg") returned 0 [0051.330] lstrlenA (lpString="*.jpg") returned 5 [0051.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", pszSpec="*.jpeg") returned 0 [0051.330] lstrlenA (lpString="*.jpeg") returned 6 [0051.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", pszSpec="*.psd") returned 0 [0051.331] lstrlenA (lpString="*.psd") returned 5 [0051.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", pszSpec="*.gif") returned 1 [0051.331] lstrlenA (lpString="*.gif") returned 5 [0051.331] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" [0051.331] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" [0051.331] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF." [0051.331] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.wannacry" [0051.331] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.332] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x296f [0051.332] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf3bca500, dwHighDateTime=0x1bd50ae), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf3bca500, dwHighDateTime=0x1bd50ae)) returned 1 [0051.332] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.332] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x28f1, lpOverlapped=0x0) returned 1 [0051.334] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned="AG00139_.GIF" [0051.334] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.334] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x28f1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x28f1, lpOverlapped=0x0) returned 1 [0051.335] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.335] CloseHandle (hObject=0x8c) returned 1 [0051.336] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.wannacry")) returned 1 [0051.337] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedc6c400, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedc6c400, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x3bcc, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00142_.GIF", cAlternateFileName="")) returned 1 [0051.337] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.337] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00142_.GIF") returned 1 [0051.337] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00142_.GIF") returned 1 [0051.337] lstrcmpiA (lpString1="", lpString2="AG00142_.GIF") returned -1 [0051.337] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned="AG00139_.GIF" [0051.337] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.337] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.337] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.337] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.338] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00142_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" [0051.338] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", pszSpec="*.zip") returned 0 [0051.338] lstrlenA (lpString="*.zip") returned 5 [0051.338] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", pszSpec="*.rar") returned 0 [0051.338] lstrlenA (lpString="*.rar") returned 5 [0051.338] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", pszSpec="*.7z") returned 0 [0051.338] lstrlenA (lpString="*.7z") returned 4 [0051.338] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", pszSpec="*.tar") returned 0 [0051.338] lstrlenA (lpString="*.tar") returned 5 [0051.338] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", pszSpec="*.gzip") returned 0 [0051.338] lstrlenA (lpString="*.gzip") returned 6 [0051.338] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", pszSpec="*.jpg") returned 0 [0051.338] lstrlenA (lpString="*.jpg") returned 5 [0051.338] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", pszSpec="*.jpeg") returned 0 [0051.338] lstrlenA (lpString="*.jpeg") returned 6 [0051.338] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", pszSpec="*.psd") returned 0 [0051.338] lstrlenA (lpString="*.psd") returned 5 [0051.338] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", pszSpec="*.gif") returned 1 [0051.338] lstrlenA (lpString="*.gif") returned 5 [0051.338] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" [0051.338] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" [0051.338] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF." [0051.338] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.wannacry" [0051.338] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.339] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3bcc [0051.339] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xedc6c400, dwHighDateTime=0x1bd50ae), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb42550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xedc6c400, dwHighDateTime=0x1bd50ae)) returned 1 [0051.339] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.339] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3b4e, lpOverlapped=0x0) returned 1 [0051.341] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned="AG00142_.GIF" [0051.341] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.341] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3b4e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3b4e, lpOverlapped=0x0) returned 1 [0051.341] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.342] CloseHandle (hObject=0x8c) returned 1 [0051.346] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.wannacry")) returned 1 [0051.347] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9688900, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9688900, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14c3, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00154_.GIF", cAlternateFileName="")) returned 1 [0051.347] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.347] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00154_.GIF") returned 1 [0051.347] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00154_.GIF") returned 1 [0051.347] lstrcmpiA (lpString1="", lpString2="AG00154_.GIF") returned -1 [0051.347] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned="AG00142_.GIF" [0051.347] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.347] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.347] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.347] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.347] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00154_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" [0051.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", pszSpec="*.zip") returned 0 [0051.347] lstrlenA (lpString="*.zip") returned 5 [0051.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", pszSpec="*.rar") returned 0 [0051.347] lstrlenA (lpString="*.rar") returned 5 [0051.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", pszSpec="*.7z") returned 0 [0051.347] lstrlenA (lpString="*.7z") returned 4 [0051.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", pszSpec="*.tar") returned 0 [0051.347] lstrlenA (lpString="*.tar") returned 5 [0051.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", pszSpec="*.gzip") returned 0 [0051.347] lstrlenA (lpString="*.gzip") returned 6 [0051.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", pszSpec="*.jpg") returned 0 [0051.348] lstrlenA (lpString="*.jpg") returned 5 [0051.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", pszSpec="*.jpeg") returned 0 [0051.348] lstrlenA (lpString="*.jpeg") returned 6 [0051.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", pszSpec="*.psd") returned 0 [0051.348] lstrlenA (lpString="*.psd") returned 5 [0051.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", pszSpec="*.gif") returned 1 [0051.348] lstrlenA (lpString="*.gif") returned 5 [0051.348] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" [0051.348] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" [0051.348] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF." [0051.348] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.wannacry" [0051.348] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.348] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14c3 [0051.348] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb9688900, dwHighDateTime=0x1bd4c12), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb9688900, dwHighDateTime=0x1bd4c12)) returned 1 [0051.348] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.349] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1445, lpOverlapped=0x0) returned 1 [0051.352] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned="AG00154_.GIF" [0051.353] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.353] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1445, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1445, lpOverlapped=0x0) returned 1 [0051.353] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.353] CloseHandle (hObject=0x8c) returned 1 [0051.354] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.wannacry")) returned 1 [0051.355] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2417b00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2417b00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00157_.GIF", cAlternateFileName="")) returned 1 [0051.355] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.355] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00157_.GIF") returned 1 [0051.355] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00157_.GIF") returned 1 [0051.355] lstrcmpiA (lpString1="", lpString2="AG00157_.GIF") returned -1 [0051.355] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned="AG00154_.GIF" [0051.355] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.355] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.355] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.355] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.355] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00157_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" [0051.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", pszSpec="*.zip") returned 0 [0051.355] lstrlenA (lpString="*.zip") returned 5 [0051.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", pszSpec="*.rar") returned 0 [0051.355] lstrlenA (lpString="*.rar") returned 5 [0051.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", pszSpec="*.7z") returned 0 [0051.356] lstrlenA (lpString="*.7z") returned 4 [0051.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", pszSpec="*.tar") returned 0 [0051.356] lstrlenA (lpString="*.tar") returned 5 [0051.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", pszSpec="*.gzip") returned 0 [0051.356] lstrlenA (lpString="*.gzip") returned 6 [0051.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", pszSpec="*.jpg") returned 0 [0051.356] lstrlenA (lpString="*.jpg") returned 5 [0051.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", pszSpec="*.jpeg") returned 0 [0051.356] lstrlenA (lpString="*.jpeg") returned 6 [0051.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", pszSpec="*.psd") returned 0 [0051.356] lstrlenA (lpString="*.psd") returned 5 [0051.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", pszSpec="*.gif") returned 1 [0051.356] lstrlenA (lpString="*.gif") returned 5 [0051.356] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" [0051.356] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" [0051.356] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF." [0051.356] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.wannacry" [0051.356] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.356] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x135b [0051.357] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb2417b00, dwHighDateTime=0x1bd4c12), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb2417b00, dwHighDateTime=0x1bd4c12)) returned 1 [0051.357] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.357] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x12dd, lpOverlapped=0x0) returned 1 [0051.359] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned="AG00157_.GIF" [0051.359] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.359] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x12dd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x12dd, lpOverlapped=0x0) returned 1 [0051.359] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.360] CloseHandle (hObject=0x8c) returned 1 [0051.365] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.wannacry")) returned 1 [0051.366] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7cc700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad7cc700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x13a6, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00158_.GIF", cAlternateFileName="")) returned 1 [0051.366] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.366] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00158_.GIF") returned 1 [0051.366] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00158_.GIF") returned 1 [0051.366] lstrcmpiA (lpString1="", lpString2="AG00158_.GIF") returned -1 [0051.366] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned="AG00157_.GIF" [0051.366] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.366] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.366] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.366] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.366] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00158_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" [0051.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", pszSpec="*.zip") returned 0 [0051.366] lstrlenA (lpString="*.zip") returned 5 [0051.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", pszSpec="*.rar") returned 0 [0051.366] lstrlenA (lpString="*.rar") returned 5 [0051.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", pszSpec="*.7z") returned 0 [0051.366] lstrlenA (lpString="*.7z") returned 4 [0051.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", pszSpec="*.tar") returned 0 [0051.366] lstrlenA (lpString="*.tar") returned 5 [0051.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", pszSpec="*.gzip") returned 0 [0051.366] lstrlenA (lpString="*.gzip") returned 6 [0051.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", pszSpec="*.jpg") returned 0 [0051.367] lstrlenA (lpString="*.jpg") returned 5 [0051.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", pszSpec="*.jpeg") returned 0 [0051.367] lstrlenA (lpString="*.jpeg") returned 6 [0051.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", pszSpec="*.psd") returned 0 [0051.367] lstrlenA (lpString="*.psd") returned 5 [0051.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", pszSpec="*.gif") returned 1 [0051.367] lstrlenA (lpString="*.gif") returned 5 [0051.367] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" [0051.367] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" [0051.367] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF." [0051.367] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.wannacry" [0051.367] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.367] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13a6 [0051.367] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xad7cc700, dwHighDateTime=0x1bd4c12), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb42550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xad7cc700, dwHighDateTime=0x1bd4c12)) returned 1 [0051.367] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.368] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1328, lpOverlapped=0x0) returned 1 [0051.370] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned="AG00158_.GIF" [0051.370] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.370] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1328, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1328, lpOverlapped=0x0) returned 1 [0051.370] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.370] CloseHandle (hObject=0x8c) returned 1 [0051.371] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.wannacry")) returned 1 [0051.372] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a69f700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a69f700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x47a, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00160_.GIF", cAlternateFileName="")) returned 1 [0051.372] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.372] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00160_.GIF") returned 1 [0051.372] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00160_.GIF") returned 1 [0051.372] lstrcmpiA (lpString1="", lpString2="AG00160_.GIF") returned -1 [0051.372] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned="AG00158_.GIF" [0051.372] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.372] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.372] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.373] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.373] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00160_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" [0051.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", pszSpec="*.zip") returned 0 [0051.373] lstrlenA (lpString="*.zip") returned 5 [0051.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", pszSpec="*.rar") returned 0 [0051.373] lstrlenA (lpString="*.rar") returned 5 [0051.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", pszSpec="*.7z") returned 0 [0051.373] lstrlenA (lpString="*.7z") returned 4 [0051.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", pszSpec="*.tar") returned 0 [0051.373] lstrlenA (lpString="*.tar") returned 5 [0051.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", pszSpec="*.gzip") returned 0 [0051.373] lstrlenA (lpString="*.gzip") returned 6 [0051.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", pszSpec="*.jpg") returned 0 [0051.373] lstrlenA (lpString="*.jpg") returned 5 [0051.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", pszSpec="*.jpeg") returned 0 [0051.373] lstrlenA (lpString="*.jpeg") returned 6 [0051.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", pszSpec="*.psd") returned 0 [0051.373] lstrlenA (lpString="*.psd") returned 5 [0051.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", pszSpec="*.gif") returned 1 [0051.373] lstrlenA (lpString="*.gif") returned 5 [0051.373] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" [0051.373] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" [0051.373] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF." [0051.373] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.wannacry" [0051.373] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.374] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x47a [0051.374] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a69f700, dwHighDateTime=0x1bd4c12), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a69f700, dwHighDateTime=0x1bd4c12)) returned 1 [0051.374] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.374] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3fc, lpOverlapped=0x0) returned 1 [0051.375] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned="AG00160_.GIF" [0051.375] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.376] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3fc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3fc, lpOverlapped=0x0) returned 1 [0051.376] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.376] CloseHandle (hObject=0x8c) returned 1 [0051.379] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.wannacry")) returned 1 [0051.380] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a54300, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a54300, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1d9f, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00161_.GIF", cAlternateFileName="")) returned 1 [0051.380] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.380] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00161_.GIF") returned 1 [0051.380] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00161_.GIF") returned 1 [0051.380] lstrcmpiA (lpString1="", lpString2="AG00161_.GIF") returned -1 [0051.380] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned="AG00160_.GIF" [0051.380] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.380] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.380] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.380] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.380] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00161_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" [0051.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", pszSpec="*.zip") returned 0 [0051.380] lstrlenA (lpString="*.zip") returned 5 [0051.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", pszSpec="*.rar") returned 0 [0051.380] lstrlenA (lpString="*.rar") returned 5 [0051.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", pszSpec="*.7z") returned 0 [0051.380] lstrlenA (lpString="*.7z") returned 4 [0051.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", pszSpec="*.tar") returned 0 [0051.380] lstrlenA (lpString="*.tar") returned 5 [0051.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", pszSpec="*.gzip") returned 0 [0051.380] lstrlenA (lpString="*.gzip") returned 6 [0051.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", pszSpec="*.jpg") returned 0 [0051.381] lstrlenA (lpString="*.jpg") returned 5 [0051.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", pszSpec="*.jpeg") returned 0 [0051.381] lstrlenA (lpString="*.jpeg") returned 6 [0051.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", pszSpec="*.psd") returned 0 [0051.381] lstrlenA (lpString="*.psd") returned 5 [0051.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", pszSpec="*.gif") returned 1 [0051.381] lstrlenA (lpString="*.gif") returned 5 [0051.381] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" [0051.381] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" [0051.381] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF." [0051.381] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.wannacry" [0051.381] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.382] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d9f [0051.382] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x95a54300, dwHighDateTime=0x1bd4c12), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb42550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x95a54300, dwHighDateTime=0x1bd4c12)) returned 1 [0051.382] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.382] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1d21, lpOverlapped=0x0) returned 1 [0051.384] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned="AG00161_.GIF" [0051.384] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.384] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1d21, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1d21, lpOverlapped=0x0) returned 1 [0051.384] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.384] CloseHandle (hObject=0x8c) returned 1 [0051.386] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.wannacry")) returned 1 [0051.386] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65e47e00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65e47e00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x1b48, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00163_.GIF", cAlternateFileName="")) returned 1 [0051.386] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.386] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00163_.GIF") returned 1 [0051.386] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00163_.GIF") returned 1 [0051.386] lstrcmpiA (lpString1="", lpString2="AG00163_.GIF") returned -1 [0051.387] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned="AG00161_.GIF" [0051.387] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.387] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.387] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.387] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.387] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00163_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" [0051.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", pszSpec="*.zip") returned 0 [0051.387] lstrlenA (lpString="*.zip") returned 5 [0051.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", pszSpec="*.rar") returned 0 [0051.387] lstrlenA (lpString="*.rar") returned 5 [0051.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", pszSpec="*.7z") returned 0 [0051.387] lstrlenA (lpString="*.7z") returned 4 [0051.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", pszSpec="*.tar") returned 0 [0051.387] lstrlenA (lpString="*.tar") returned 5 [0051.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", pszSpec="*.gzip") returned 0 [0051.387] lstrlenA (lpString="*.gzip") returned 6 [0051.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", pszSpec="*.jpg") returned 0 [0051.387] lstrlenA (lpString="*.jpg") returned 5 [0051.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", pszSpec="*.jpeg") returned 0 [0051.387] lstrlenA (lpString="*.jpeg") returned 6 [0051.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", pszSpec="*.psd") returned 0 [0051.388] lstrlenA (lpString="*.psd") returned 5 [0051.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", pszSpec="*.gif") returned 1 [0051.388] lstrlenA (lpString="*.gif") returned 5 [0051.388] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" [0051.388] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" [0051.388] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF." [0051.388] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.wannacry" [0051.388] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.389] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b48 [0051.389] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x65e47e00, dwHighDateTime=0x1bd4e52), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb42550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x65e47e00, dwHighDateTime=0x1bd4e52)) returned 1 [0051.389] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.389] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1aca, lpOverlapped=0x0) returned 1 [0051.391] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned="AG00163_.GIF" [0051.391] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.391] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1aca, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1aca, lpOverlapped=0x0) returned 1 [0051.391] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.391] CloseHandle (hObject=0x8c) returned 1 [0051.392] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.wannacry")) returned 1 [0051.393] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4d0800, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4d0800, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x33c6, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00164_.GIF", cAlternateFileName="")) returned 1 [0051.393] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.393] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00164_.GIF") returned 1 [0051.393] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00164_.GIF") returned 1 [0051.393] lstrcmpiA (lpString1="", lpString2="AG00164_.GIF") returned -1 [0051.393] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned="AG00163_.GIF" [0051.393] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.393] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.393] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.393] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.394] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00164_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" [0051.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", pszSpec="*.zip") returned 0 [0051.394] lstrlenA (lpString="*.zip") returned 5 [0051.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", pszSpec="*.rar") returned 0 [0051.394] lstrlenA (lpString="*.rar") returned 5 [0051.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", pszSpec="*.7z") returned 0 [0051.394] lstrlenA (lpString="*.7z") returned 4 [0051.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", pszSpec="*.tar") returned 0 [0051.394] lstrlenA (lpString="*.tar") returned 5 [0051.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", pszSpec="*.gzip") returned 0 [0051.394] lstrlenA (lpString="*.gzip") returned 6 [0051.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", pszSpec="*.jpg") returned 0 [0051.394] lstrlenA (lpString="*.jpg") returned 5 [0051.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", pszSpec="*.jpeg") returned 0 [0051.394] lstrlenA (lpString="*.jpeg") returned 6 [0051.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", pszSpec="*.psd") returned 0 [0051.394] lstrlenA (lpString="*.psd") returned 5 [0051.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", pszSpec="*.gif") returned 1 [0051.394] lstrlenA (lpString="*.gif") returned 5 [0051.394] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" [0051.394] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" [0051.394] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF." [0051.394] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.wannacry" [0051.394] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.395] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x33c6 [0051.395] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d4d0800, dwHighDateTime=0x1bd4c12), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb42550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d4d0800, dwHighDateTime=0x1bd4c12)) returned 1 [0051.395] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.395] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3348, lpOverlapped=0x0) returned 1 [0051.397] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned="AG00164_.GIF" [0051.397] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.397] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3348, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3348, lpOverlapped=0x0) returned 1 [0051.397] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.397] CloseHandle (hObject=0x8c) returned 1 [0051.405] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.wannacry")) returned 1 [0051.405] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b98100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89b98100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2186, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00165_.GIF", cAlternateFileName="")) returned 1 [0051.405] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.405] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00165_.GIF") returned 1 [0051.405] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00165_.GIF") returned 1 [0051.406] lstrcmpiA (lpString1="", lpString2="AG00165_.GIF") returned -1 [0051.406] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned="AG00164_.GIF" [0051.406] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.406] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.406] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.406] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.406] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00165_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" [0051.406] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", pszSpec="*.zip") returned 0 [0051.406] lstrlenA (lpString="*.zip") returned 5 [0051.406] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", pszSpec="*.rar") returned 0 [0051.406] lstrlenA (lpString="*.rar") returned 5 [0051.406] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", pszSpec="*.7z") returned 0 [0051.406] lstrlenA (lpString="*.7z") returned 4 [0051.406] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", pszSpec="*.tar") returned 0 [0051.406] lstrlenA (lpString="*.tar") returned 5 [0051.406] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", pszSpec="*.gzip") returned 0 [0051.406] lstrlenA (lpString="*.gzip") returned 6 [0051.406] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", pszSpec="*.jpg") returned 0 [0051.406] lstrlenA (lpString="*.jpg") returned 5 [0051.406] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", pszSpec="*.jpeg") returned 0 [0051.406] lstrlenA (lpString="*.jpeg") returned 6 [0051.406] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", pszSpec="*.psd") returned 0 [0051.406] lstrlenA (lpString="*.psd") returned 5 [0051.406] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", pszSpec="*.gif") returned 1 [0051.406] lstrlenA (lpString="*.gif") returned 5 [0051.407] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" [0051.407] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" [0051.407] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF." [0051.407] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.wannacry" [0051.407] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.408] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2186 [0051.408] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x89b98100, dwHighDateTime=0x1bd4c12), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x89b98100, dwHighDateTime=0x1bd4c12)) returned 1 [0051.408] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.408] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2108, lpOverlapped=0x0) returned 1 [0051.410] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned="AG00165_.GIF" [0051.410] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.410] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2108, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2108, lpOverlapped=0x0) returned 1 [0051.410] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.411] CloseHandle (hObject=0x8c) returned 1 [0051.412] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.wannacry")) returned 1 [0051.416] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81614600, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81614600, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x131e, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00167_.GIF", cAlternateFileName="")) returned 1 [0051.416] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.416] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00167_.GIF") returned 1 [0051.416] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00167_.GIF") returned 1 [0051.417] lstrcmpiA (lpString1="", lpString2="AG00167_.GIF") returned -1 [0051.417] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned="AG00165_.GIF" [0051.417] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.417] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.417] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.417] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.417] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00167_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" [0051.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", pszSpec="*.zip") returned 0 [0051.417] lstrlenA (lpString="*.zip") returned 5 [0051.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", pszSpec="*.rar") returned 0 [0051.417] lstrlenA (lpString="*.rar") returned 5 [0051.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", pszSpec="*.7z") returned 0 [0051.417] lstrlenA (lpString="*.7z") returned 4 [0051.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", pszSpec="*.tar") returned 0 [0051.417] lstrlenA (lpString="*.tar") returned 5 [0051.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", pszSpec="*.gzip") returned 0 [0051.417] lstrlenA (lpString="*.gzip") returned 6 [0051.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", pszSpec="*.jpg") returned 0 [0051.417] lstrlenA (lpString="*.jpg") returned 5 [0051.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", pszSpec="*.jpeg") returned 0 [0051.417] lstrlenA (lpString="*.jpeg") returned 6 [0051.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", pszSpec="*.psd") returned 0 [0051.418] lstrlenA (lpString="*.psd") returned 5 [0051.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", pszSpec="*.gif") returned 1 [0051.418] lstrlenA (lpString="*.gif") returned 5 [0051.418] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" [0051.418] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" [0051.419] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF." [0051.419] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.wannacry" [0051.419] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.420] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x131e [0051.420] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x81614600, dwHighDateTime=0x1bd4c12), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb42550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x81614600, dwHighDateTime=0x1bd4c12)) returned 1 [0051.420] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.420] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x12a0, lpOverlapped=0x0) returned 1 [0051.422] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned="AG00167_.GIF" [0051.423] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.423] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x12a0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x12a0, lpOverlapped=0x0) returned 1 [0051.423] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.423] CloseHandle (hObject=0x8c) returned 1 [0051.424] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.wannacry")) returned 1 [0051.425] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9c9200, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9c9200, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14ff, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00169_.GIF", cAlternateFileName="")) returned 1 [0051.425] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.425] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00169_.GIF") returned 1 [0051.425] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00169_.GIF") returned 1 [0051.425] lstrcmpiA (lpString1="", lpString2="AG00169_.GIF") returned -1 [0051.425] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned="AG00167_.GIF" [0051.425] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.425] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.425] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.425] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.425] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00169_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" [0051.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", pszSpec="*.zip") returned 0 [0051.425] lstrlenA (lpString="*.zip") returned 5 [0051.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", pszSpec="*.rar") returned 0 [0051.425] lstrlenA (lpString="*.rar") returned 5 [0051.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", pszSpec="*.7z") returned 0 [0051.425] lstrlenA (lpString="*.7z") returned 4 [0051.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", pszSpec="*.tar") returned 0 [0051.426] lstrlenA (lpString="*.tar") returned 5 [0051.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", pszSpec="*.gzip") returned 0 [0051.426] lstrlenA (lpString="*.gzip") returned 6 [0051.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", pszSpec="*.jpg") returned 0 [0051.426] lstrlenA (lpString="*.jpg") returned 5 [0051.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", pszSpec="*.jpeg") returned 0 [0051.426] lstrlenA (lpString="*.jpeg") returned 6 [0051.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", pszSpec="*.psd") returned 0 [0051.426] lstrlenA (lpString="*.psd") returned 5 [0051.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", pszSpec="*.gif") returned 1 [0051.426] lstrlenA (lpString="*.gif") returned 5 [0051.426] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" [0051.426] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" [0051.426] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF." [0051.426] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.wannacry" [0051.426] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.426] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14ff [0051.427] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7c9c9200, dwHighDateTime=0x1bd4c12), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7c9c9200, dwHighDateTime=0x1bd4c12)) returned 1 [0051.427] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.427] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1481, lpOverlapped=0x0) returned 1 [0051.429] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned="AG00169_.GIF" [0051.429] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.430] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1481, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1481, lpOverlapped=0x0) returned 1 [0051.430] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.430] CloseHandle (hObject=0x8c) returned 1 [0051.431] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.wannacry")) returned 1 [0051.432] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a6b100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76a6b100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2420, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00170_.GIF", cAlternateFileName="")) returned 1 [0051.432] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.432] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00170_.GIF") returned 1 [0051.432] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00170_.GIF") returned 1 [0051.432] lstrcmpiA (lpString1="", lpString2="AG00170_.GIF") returned -1 [0051.432] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned="AG00169_.GIF" [0051.432] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.432] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.432] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.432] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.432] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00170_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" [0051.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", pszSpec="*.zip") returned 0 [0051.432] lstrlenA (lpString="*.zip") returned 5 [0051.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", pszSpec="*.rar") returned 0 [0051.433] lstrlenA (lpString="*.rar") returned 5 [0051.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", pszSpec="*.7z") returned 0 [0051.433] lstrlenA (lpString="*.7z") returned 4 [0051.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", pszSpec="*.tar") returned 0 [0051.433] lstrlenA (lpString="*.tar") returned 5 [0051.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", pszSpec="*.gzip") returned 0 [0051.433] lstrlenA (lpString="*.gzip") returned 6 [0051.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", pszSpec="*.jpg") returned 0 [0051.433] lstrlenA (lpString="*.jpg") returned 5 [0051.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", pszSpec="*.jpeg") returned 0 [0051.433] lstrlenA (lpString="*.jpeg") returned 6 [0051.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", pszSpec="*.psd") returned 0 [0051.433] lstrlenA (lpString="*.psd") returned 5 [0051.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", pszSpec="*.gif") returned 1 [0051.433] lstrlenA (lpString="*.gif") returned 5 [0051.433] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" [0051.433] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" [0051.433] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF." [0051.433] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.wannacry" [0051.433] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.434] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2420 [0051.434] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x76a6b100, dwHighDateTime=0x1bd4c12), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x76a6b100, dwHighDateTime=0x1bd4c12)) returned 1 [0051.434] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.434] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x23a2, lpOverlapped=0x0) returned 1 [0051.494] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned="AG00170_.GIF" [0051.494] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.494] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x23a2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x23a2, lpOverlapped=0x0) returned 1 [0051.495] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.495] CloseHandle (hObject=0x8c) returned 1 [0051.496] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.wannacry")) returned 1 [0051.497] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e1fd00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71e1fd00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1398, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00171_.GIF", cAlternateFileName="")) returned 1 [0051.497] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.497] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00171_.GIF") returned 1 [0051.497] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00171_.GIF") returned 1 [0051.497] lstrcmpiA (lpString1="", lpString2="AG00171_.GIF") returned -1 [0051.497] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned="AG00170_.GIF" [0051.497] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.497] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.497] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.497] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.497] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00171_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" [0051.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", pszSpec="*.zip") returned 0 [0051.497] lstrlenA (lpString="*.zip") returned 5 [0051.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", pszSpec="*.rar") returned 0 [0051.497] lstrlenA (lpString="*.rar") returned 5 [0051.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", pszSpec="*.7z") returned 0 [0051.497] lstrlenA (lpString="*.7z") returned 4 [0051.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", pszSpec="*.tar") returned 0 [0051.500] lstrlenA (lpString="*.tar") returned 5 [0051.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", pszSpec="*.gzip") returned 0 [0051.500] lstrlenA (lpString="*.gzip") returned 6 [0051.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", pszSpec="*.jpg") returned 0 [0051.500] lstrlenA (lpString="*.jpg") returned 5 [0051.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", pszSpec="*.jpeg") returned 0 [0051.500] lstrlenA (lpString="*.jpeg") returned 6 [0051.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", pszSpec="*.psd") returned 0 [0051.500] lstrlenA (lpString="*.psd") returned 5 [0051.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", pszSpec="*.gif") returned 1 [0051.500] lstrlenA (lpString="*.gif") returned 5 [0051.500] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" [0051.500] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" [0051.500] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF." [0051.500] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.wannacry" [0051.500] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.501] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1398 [0051.501] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x71e1fd00, dwHighDateTime=0x1bd4c12), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x71e1fd00, dwHighDateTime=0x1bd4c12)) returned 1 [0051.501] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.501] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x131a, lpOverlapped=0x0) returned 1 [0051.506] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned="AG00171_.GIF" [0051.506] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.507] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x131a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x131a, lpOverlapped=0x0) returned 1 [0051.507] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.507] CloseHandle (hObject=0x8c) returned 1 [0051.514] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.wannacry")) returned 1 [0051.515] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a04e500, ftCreationTime.dwHighDateTime=0x1bd4e61, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a04e500, ftLastWriteTime.dwHighDateTime=0x1bd4e61, nFileSizeHigh=0x0, nFileSizeLow=0x1126, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00172_.GIF", cAlternateFileName="")) returned 1 [0051.515] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.515] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00172_.GIF") returned 1 [0051.515] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00172_.GIF") returned 1 [0051.515] lstrcmpiA (lpString1="", lpString2="AG00172_.GIF") returned -1 [0051.515] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned="AG00171_.GIF" [0051.515] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.515] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.515] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.515] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.515] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00172_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" [0051.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", pszSpec="*.zip") returned 0 [0051.515] lstrlenA (lpString="*.zip") returned 5 [0051.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", pszSpec="*.rar") returned 0 [0051.515] lstrlenA (lpString="*.rar") returned 5 [0051.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", pszSpec="*.7z") returned 0 [0051.515] lstrlenA (lpString="*.7z") returned 4 [0051.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", pszSpec="*.tar") returned 0 [0051.516] lstrlenA (lpString="*.tar") returned 5 [0051.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", pszSpec="*.gzip") returned 0 [0051.516] lstrlenA (lpString="*.gzip") returned 6 [0051.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", pszSpec="*.jpg") returned 0 [0051.516] lstrlenA (lpString="*.jpg") returned 5 [0051.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", pszSpec="*.jpeg") returned 0 [0051.516] lstrlenA (lpString="*.jpeg") returned 6 [0051.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", pszSpec="*.psd") returned 0 [0051.516] lstrlenA (lpString="*.psd") returned 5 [0051.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", pszSpec="*.gif") returned 1 [0051.516] lstrlenA (lpString="*.gif") returned 5 [0051.516] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" [0051.516] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" [0051.516] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF." [0051.516] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.wannacry" [0051.516] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.517] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1126 [0051.517] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x2a04e500, dwHighDateTime=0x1bd4e61), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x2a04e500, dwHighDateTime=0x1bd4e61)) returned 1 [0051.517] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.518] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x10a8, lpOverlapped=0x0) returned 1 [0051.519] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned="AG00172_.GIF" [0051.519] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.520] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x10a8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x10a8, lpOverlapped=0x0) returned 1 [0051.520] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.520] CloseHandle (hObject=0x8c) returned 1 [0051.521] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.wannacry")) returned 1 [0051.522] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde4d3e00, ftCreationTime.dwHighDateTime=0x1bd4e56, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde4d3e00, ftLastWriteTime.dwHighDateTime=0x1bd4e56, nFileSizeHigh=0x0, nFileSizeLow=0xf7e, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00174_.GIF", cAlternateFileName="")) returned 1 [0051.522] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.522] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00174_.GIF") returned 1 [0051.522] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00174_.GIF") returned 1 [0051.522] lstrcmpiA (lpString1="", lpString2="AG00174_.GIF") returned -1 [0051.522] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned="AG00172_.GIF" [0051.522] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.522] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.522] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.522] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.522] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00174_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" [0051.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", pszSpec="*.zip") returned 0 [0051.523] lstrlenA (lpString="*.zip") returned 5 [0051.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", pszSpec="*.rar") returned 0 [0051.523] lstrlenA (lpString="*.rar") returned 5 [0051.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", pszSpec="*.7z") returned 0 [0051.523] lstrlenA (lpString="*.7z") returned 4 [0051.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", pszSpec="*.tar") returned 0 [0051.523] lstrlenA (lpString="*.tar") returned 5 [0051.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", pszSpec="*.gzip") returned 0 [0051.523] lstrlenA (lpString="*.gzip") returned 6 [0051.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", pszSpec="*.jpg") returned 0 [0051.523] lstrlenA (lpString="*.jpg") returned 5 [0051.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", pszSpec="*.jpeg") returned 0 [0051.523] lstrlenA (lpString="*.jpeg") returned 6 [0051.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", pszSpec="*.psd") returned 0 [0051.523] lstrlenA (lpString="*.psd") returned 5 [0051.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", pszSpec="*.gif") returned 1 [0051.523] lstrlenA (lpString="*.gif") returned 5 [0051.523] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" [0051.523] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" [0051.523] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF." [0051.523] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.wannacry" [0051.523] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.524] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf7e [0051.524] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xde4d3e00, dwHighDateTime=0x1bd4e56), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xde4d3e00, dwHighDateTime=0x1bd4e56)) returned 1 [0051.524] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.524] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xf00, lpOverlapped=0x0) returned 1 [0051.526] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned="AG00174_.GIF" [0051.526] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.526] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xf00, lpOverlapped=0x0) returned 1 [0051.526] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.526] CloseHandle (hObject=0x8c) returned 1 [0051.527] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.wannacry")) returned 1 [0051.528] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc18a400, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc18a400, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xd32, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00175_.GIF", cAlternateFileName="")) returned 1 [0051.528] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.528] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00175_.GIF") returned 1 [0051.528] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00175_.GIF") returned 1 [0051.528] lstrcmpiA (lpString1="", lpString2="AG00175_.GIF") returned -1 [0051.528] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned="AG00174_.GIF" [0051.528] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.528] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.528] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.528] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.528] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00175_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" [0051.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", pszSpec="*.zip") returned 0 [0051.529] lstrlenA (lpString="*.zip") returned 5 [0051.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", pszSpec="*.rar") returned 0 [0051.529] lstrlenA (lpString="*.rar") returned 5 [0051.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", pszSpec="*.7z") returned 0 [0051.529] lstrlenA (lpString="*.7z") returned 4 [0051.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", pszSpec="*.tar") returned 0 [0051.529] lstrlenA (lpString="*.tar") returned 5 [0051.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", pszSpec="*.gzip") returned 0 [0051.529] lstrlenA (lpString="*.gzip") returned 6 [0051.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", pszSpec="*.jpg") returned 0 [0051.529] lstrlenA (lpString="*.jpg") returned 5 [0051.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", pszSpec="*.jpeg") returned 0 [0051.529] lstrlenA (lpString="*.jpeg") returned 6 [0051.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", pszSpec="*.psd") returned 0 [0051.529] lstrlenA (lpString="*.psd") returned 5 [0051.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", pszSpec="*.gif") returned 1 [0051.529] lstrlenA (lpString="*.gif") returned 5 [0051.529] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" [0051.529] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" [0051.529] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF." [0051.529] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.wannacry" [0051.529] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.530] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd32 [0051.530] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfc18a400, dwHighDateTime=0x1bd4e52), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xfc18a400, dwHighDateTime=0x1bd4e52)) returned 1 [0051.530] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.530] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xcb4, lpOverlapped=0x0) returned 1 [0051.533] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned="AG00175_.GIF" [0051.533] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.534] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xcb4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xcb4, lpOverlapped=0x0) returned 1 [0051.534] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.534] CloseHandle (hObject=0x8c) returned 1 [0051.540] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.wannacry")) returned 1 [0051.541] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3cb900, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e3cb900, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xc30, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AG00176_.GIF", cAlternateFileName="")) returned 1 [0051.542] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.542] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AG00176_.GIF") returned 1 [0051.542] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AG00176_.GIF") returned 1 [0051.542] lstrcmpiA (lpString1="", lpString2="AG00176_.GIF") returned -1 [0051.542] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned="AG00175_.GIF" [0051.542] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.542] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.542] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.542] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.543] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AG00176_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" [0051.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", pszSpec="*.zip") returned 0 [0051.543] lstrlenA (lpString="*.zip") returned 5 [0051.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", pszSpec="*.rar") returned 0 [0051.543] lstrlenA (lpString="*.rar") returned 5 [0051.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", pszSpec="*.7z") returned 0 [0051.543] lstrlenA (lpString="*.7z") returned 4 [0051.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", pszSpec="*.tar") returned 0 [0051.543] lstrlenA (lpString="*.tar") returned 5 [0051.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", pszSpec="*.gzip") returned 0 [0051.543] lstrlenA (lpString="*.gzip") returned 6 [0051.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", pszSpec="*.jpg") returned 0 [0051.543] lstrlenA (lpString="*.jpg") returned 5 [0051.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", pszSpec="*.jpeg") returned 0 [0051.543] lstrlenA (lpString="*.jpeg") returned 6 [0051.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", pszSpec="*.psd") returned 0 [0051.543] lstrlenA (lpString="*.psd") returned 5 [0051.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", pszSpec="*.gif") returned 1 [0051.543] lstrlenA (lpString="*.gif") returned 5 [0051.543] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" [0051.543] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" [0051.543] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF." [0051.543] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.wannacry" [0051.543] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.544] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc30 [0051.544] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6e3cb900, dwHighDateTime=0x1bd4e52), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6e3cb900, dwHighDateTime=0x1bd4e52)) returned 1 [0051.544] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.544] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xbb2, lpOverlapped=0x0) returned 1 [0051.546] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned="AG00176_.GIF" [0051.546] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.546] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xbb2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xbb2, lpOverlapped=0x0) returned 1 [0051.546] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.546] CloseHandle (hObject=0x8c) returned 1 [0051.557] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.wannacry")) returned 1 [0051.558] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a5f2300, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a5f2300, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="AN00010_.WMF", cAlternateFileName="")) returned 1 [0051.558] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.558] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN00010_.WMF") returned 1 [0051.558] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN00010_.WMF") returned 1 [0051.558] lstrcmpiA (lpString1="", lpString2="AN00010_.WMF") returned -1 [0051.558] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned="AG00176_.GIF" [0051.559] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.559] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.559] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.559] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.559] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN00010_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" [0051.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.zip") returned 0 [0051.559] lstrlenA (lpString="*.zip") returned 5 [0051.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.rar") returned 0 [0051.559] lstrlenA (lpString="*.rar") returned 5 [0051.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.7z") returned 0 [0051.559] lstrlenA (lpString="*.7z") returned 4 [0051.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.tar") returned 0 [0051.559] lstrlenA (lpString="*.tar") returned 5 [0051.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.gzip") returned 0 [0051.559] lstrlenA (lpString="*.gzip") returned 6 [0051.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.jpg") returned 0 [0051.559] lstrlenA (lpString="*.jpg") returned 5 [0051.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.jpeg") returned 0 [0051.559] lstrlenA (lpString="*.jpeg") returned 6 [0051.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.psd") returned 0 [0051.559] lstrlenA (lpString="*.psd") returned 5 [0051.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.gif") returned 0 [0051.559] lstrlenA (lpString="*.gif") returned 5 [0051.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.doc") returned 0 [0051.559] lstrlenA (lpString="*.doc") returned 5 [0051.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.docx") returned 0 [0051.560] lstrlenA (lpString="*.docx") returned 6 [0051.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.xls") returned 0 [0051.560] lstrlenA (lpString="*.xls") returned 5 [0051.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.xlsx") returned 0 [0051.560] lstrlenA (lpString="*.xlsx") returned 6 [0051.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.ppt") returned 0 [0051.560] lstrlenA (lpString="*.ppt") returned 5 [0051.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.pptx") returned 0 [0051.560] lstrlenA (lpString="*.pptx") returned 6 [0051.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.pdf") returned 0 [0051.560] lstrlenA (lpString="*.pdf") returned 5 [0051.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.mov") returned 0 [0051.560] lstrlenA (lpString="*.mov") returned 5 [0051.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.m2v") returned 0 [0051.560] lstrlenA (lpString="*.m2v") returned 5 [0051.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.3gp") returned 0 [0051.560] lstrlenA (lpString="*.3gp") returned 5 [0051.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.mpeg") returned 0 [0051.560] lstrlenA (lpString="*.mpeg") returned 6 [0051.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.mpg") returned 0 [0051.560] lstrlenA (lpString="*.mpg") returned 5 [0051.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.flv") returned 0 [0051.560] lstrlenA (lpString="*.flv") returned 5 [0051.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.avi") returned 0 [0051.560] lstrlenA (lpString="*.avi") returned 5 [0051.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.mp4") returned 0 [0051.560] lstrlenA (lpString="*.mp4") returned 5 [0051.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.wmv") returned 0 [0051.561] lstrlenA (lpString="*.wmv") returned 5 [0051.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.divx") returned 0 [0051.561] lstrlenA (lpString="*.divx") returned 6 [0051.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.mkv") returned 0 [0051.561] lstrlenA (lpString="*.mkv") returned 5 [0051.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.mp3") returned 0 [0051.561] lstrlenA (lpString="*.mp3") returned 5 [0051.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.wav") returned 0 [0051.561] lstrlenA (lpString="*.wav") returned 5 [0051.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.flac") returned 0 [0051.561] lstrlenA (lpString="*.flac") returned 6 [0051.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.ape") returned 0 [0051.561] lstrlenA (lpString="*.ape") returned 5 [0051.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.wma") returned 0 [0051.561] lstrlenA (lpString="*.wma") returned 5 [0051.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.ac3") returned 0 [0051.561] lstrlenA (lpString="*.ac3") returned 5 [0051.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", pszSpec="*.mxf") returned 0 [0051.561] lstrlenA (lpString="*.mxf") returned 5 [0051.561] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab1c4f00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab1c4f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00015_.WMF", cAlternateFileName="")) returned 1 [0051.561] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.561] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN00015_.WMF") returned 1 [0051.561] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN00015_.WMF") returned 1 [0051.561] lstrcmpiA (lpString1="", lpString2="AN00015_.WMF") returned -1 [0051.561] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned="AN00010_.WMF" [0051.561] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.561] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.562] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.562] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.562] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN00015_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" [0051.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.zip") returned 0 [0051.562] lstrlenA (lpString="*.zip") returned 5 [0051.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.rar") returned 0 [0051.562] lstrlenA (lpString="*.rar") returned 5 [0051.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.7z") returned 0 [0051.562] lstrlenA (lpString="*.7z") returned 4 [0051.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.tar") returned 0 [0051.562] lstrlenA (lpString="*.tar") returned 5 [0051.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.gzip") returned 0 [0051.562] lstrlenA (lpString="*.gzip") returned 6 [0051.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.jpg") returned 0 [0051.562] lstrlenA (lpString="*.jpg") returned 5 [0051.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.jpeg") returned 0 [0051.562] lstrlenA (lpString="*.jpeg") returned 6 [0051.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.psd") returned 0 [0051.562] lstrlenA (lpString="*.psd") returned 5 [0051.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.gif") returned 0 [0051.562] lstrlenA (lpString="*.gif") returned 5 [0051.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.doc") returned 0 [0051.562] lstrlenA (lpString="*.doc") returned 5 [0051.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.docx") returned 0 [0051.562] lstrlenA (lpString="*.docx") returned 6 [0051.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.xls") returned 0 [0051.563] lstrlenA (lpString="*.xls") returned 5 [0051.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.xlsx") returned 0 [0051.563] lstrlenA (lpString="*.xlsx") returned 6 [0051.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.ppt") returned 0 [0051.563] lstrlenA (lpString="*.ppt") returned 5 [0051.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.pptx") returned 0 [0051.563] lstrlenA (lpString="*.pptx") returned 6 [0051.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.pdf") returned 0 [0051.563] lstrlenA (lpString="*.pdf") returned 5 [0051.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.mov") returned 0 [0051.563] lstrlenA (lpString="*.mov") returned 5 [0051.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.m2v") returned 0 [0051.563] lstrlenA (lpString="*.m2v") returned 5 [0051.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.3gp") returned 0 [0051.563] lstrlenA (lpString="*.3gp") returned 5 [0051.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.mpeg") returned 0 [0051.563] lstrlenA (lpString="*.mpeg") returned 6 [0051.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.mpg") returned 0 [0051.563] lstrlenA (lpString="*.mpg") returned 5 [0051.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.flv") returned 0 [0051.563] lstrlenA (lpString="*.flv") returned 5 [0051.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.avi") returned 0 [0051.563] lstrlenA (lpString="*.avi") returned 5 [0051.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.mp4") returned 0 [0051.563] lstrlenA (lpString="*.mp4") returned 5 [0051.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.wmv") returned 0 [0051.563] lstrlenA (lpString="*.wmv") returned 5 [0051.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.divx") returned 0 [0051.563] lstrlenA (lpString="*.divx") returned 6 [0051.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.mkv") returned 0 [0051.564] lstrlenA (lpString="*.mkv") returned 5 [0051.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.mp3") returned 0 [0051.564] lstrlenA (lpString="*.mp3") returned 5 [0051.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.wav") returned 0 [0051.564] lstrlenA (lpString="*.wav") returned 5 [0051.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.flac") returned 0 [0051.564] lstrlenA (lpString="*.flac") returned 6 [0051.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.ape") returned 0 [0051.564] lstrlenA (lpString="*.ape") returned 5 [0051.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.wma") returned 0 [0051.564] lstrlenA (lpString="*.wma") returned 5 [0051.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.ac3") returned 0 [0051.564] lstrlenA (lpString="*.ac3") returned 5 [0051.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", pszSpec="*.mxf") returned 0 [0051.564] lstrlenA (lpString="*.mxf") returned 5 [0051.564] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e812b00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e812b00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x1634, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00790_.WMF", cAlternateFileName="")) returned 1 [0051.564] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.564] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN00790_.WMF") returned 1 [0051.564] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN00790_.WMF") returned 1 [0051.564] lstrcmpiA (lpString1="", lpString2="AN00790_.WMF") returned -1 [0051.564] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned="AN00015_.WMF" [0051.564] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.564] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.564] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.564] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.565] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN00790_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" [0051.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.zip") returned 0 [0051.565] lstrlenA (lpString="*.zip") returned 5 [0051.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.rar") returned 0 [0051.565] lstrlenA (lpString="*.rar") returned 5 [0051.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.7z") returned 0 [0051.565] lstrlenA (lpString="*.7z") returned 4 [0051.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.tar") returned 0 [0051.565] lstrlenA (lpString="*.tar") returned 5 [0051.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.gzip") returned 0 [0051.565] lstrlenA (lpString="*.gzip") returned 6 [0051.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.jpg") returned 0 [0051.565] lstrlenA (lpString="*.jpg") returned 5 [0051.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.jpeg") returned 0 [0051.565] lstrlenA (lpString="*.jpeg") returned 6 [0051.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.psd") returned 0 [0051.565] lstrlenA (lpString="*.psd") returned 5 [0051.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.gif") returned 0 [0051.565] lstrlenA (lpString="*.gif") returned 5 [0051.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.doc") returned 0 [0051.565] lstrlenA (lpString="*.doc") returned 5 [0051.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.docx") returned 0 [0051.565] lstrlenA (lpString="*.docx") returned 6 [0051.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.xls") returned 0 [0051.565] lstrlenA (lpString="*.xls") returned 5 [0051.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.xlsx") returned 0 [0051.565] lstrlenA (lpString="*.xlsx") returned 6 [0051.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.ppt") returned 0 [0051.566] lstrlenA (lpString="*.ppt") returned 5 [0051.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.pptx") returned 0 [0051.566] lstrlenA (lpString="*.pptx") returned 6 [0051.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.pdf") returned 0 [0051.566] lstrlenA (lpString="*.pdf") returned 5 [0051.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.mov") returned 0 [0051.566] lstrlenA (lpString="*.mov") returned 5 [0051.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.m2v") returned 0 [0051.566] lstrlenA (lpString="*.m2v") returned 5 [0051.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.3gp") returned 0 [0051.566] lstrlenA (lpString="*.3gp") returned 5 [0051.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.mpeg") returned 0 [0051.566] lstrlenA (lpString="*.mpeg") returned 6 [0051.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.mpg") returned 0 [0051.566] lstrlenA (lpString="*.mpg") returned 5 [0051.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.flv") returned 0 [0051.566] lstrlenA (lpString="*.flv") returned 5 [0051.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.avi") returned 0 [0051.566] lstrlenA (lpString="*.avi") returned 5 [0051.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.mp4") returned 0 [0051.566] lstrlenA (lpString="*.mp4") returned 5 [0051.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.wmv") returned 0 [0051.566] lstrlenA (lpString="*.wmv") returned 5 [0051.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.divx") returned 0 [0051.566] lstrlenA (lpString="*.divx") returned 6 [0051.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.mkv") returned 0 [0051.566] lstrlenA (lpString="*.mkv") returned 5 [0051.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.mp3") returned 0 [0051.567] lstrlenA (lpString="*.mp3") returned 5 [0051.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.wav") returned 0 [0051.567] lstrlenA (lpString="*.wav") returned 5 [0051.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.flac") returned 0 [0051.567] lstrlenA (lpString="*.flac") returned 6 [0051.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.ape") returned 0 [0051.567] lstrlenA (lpString="*.ape") returned 5 [0051.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.wma") returned 0 [0051.567] lstrlenA (lpString="*.wma") returned 5 [0051.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.ac3") returned 0 [0051.567] lstrlenA (lpString="*.ac3") returned 5 [0051.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", pszSpec="*.mxf") returned 0 [0051.567] lstrlenA (lpString="*.mxf") returned 5 [0051.567] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9eb2200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9eb2200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5062, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00853_.WMF", cAlternateFileName="")) returned 1 [0051.567] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.567] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN00853_.WMF") returned 1 [0051.567] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN00853_.WMF") returned 1 [0051.567] lstrcmpiA (lpString1="", lpString2="AN00853_.WMF") returned -1 [0051.567] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned="AN00790_.WMF" [0051.567] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.567] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.567] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.567] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.567] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN00853_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" [0051.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.zip") returned 0 [0051.568] lstrlenA (lpString="*.zip") returned 5 [0051.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.rar") returned 0 [0051.568] lstrlenA (lpString="*.rar") returned 5 [0051.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.7z") returned 0 [0051.568] lstrlenA (lpString="*.7z") returned 4 [0051.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.tar") returned 0 [0051.568] lstrlenA (lpString="*.tar") returned 5 [0051.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.gzip") returned 0 [0051.568] lstrlenA (lpString="*.gzip") returned 6 [0051.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.jpg") returned 0 [0051.568] lstrlenA (lpString="*.jpg") returned 5 [0051.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.jpeg") returned 0 [0051.569] lstrlenA (lpString="*.jpeg") returned 6 [0051.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.psd") returned 0 [0051.569] lstrlenA (lpString="*.psd") returned 5 [0051.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.gif") returned 0 [0051.569] lstrlenA (lpString="*.gif") returned 5 [0051.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.doc") returned 0 [0051.569] lstrlenA (lpString="*.doc") returned 5 [0051.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.docx") returned 0 [0051.569] lstrlenA (lpString="*.docx") returned 6 [0051.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.xls") returned 0 [0051.569] lstrlenA (lpString="*.xls") returned 5 [0051.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.xlsx") returned 0 [0051.569] lstrlenA (lpString="*.xlsx") returned 6 [0051.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.ppt") returned 0 [0051.569] lstrlenA (lpString="*.ppt") returned 5 [0051.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.pptx") returned 0 [0051.569] lstrlenA (lpString="*.pptx") returned 6 [0051.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.pdf") returned 0 [0051.569] lstrlenA (lpString="*.pdf") returned 5 [0051.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.mov") returned 0 [0051.569] lstrlenA (lpString="*.mov") returned 5 [0051.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.m2v") returned 0 [0051.569] lstrlenA (lpString="*.m2v") returned 5 [0051.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.3gp") returned 0 [0051.569] lstrlenA (lpString="*.3gp") returned 5 [0051.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.mpeg") returned 0 [0051.570] lstrlenA (lpString="*.mpeg") returned 6 [0051.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.mpg") returned 0 [0051.570] lstrlenA (lpString="*.mpg") returned 5 [0051.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.flv") returned 0 [0051.570] lstrlenA (lpString="*.flv") returned 5 [0051.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.avi") returned 0 [0051.570] lstrlenA (lpString="*.avi") returned 5 [0051.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.mp4") returned 0 [0051.570] lstrlenA (lpString="*.mp4") returned 5 [0051.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.wmv") returned 0 [0051.570] lstrlenA (lpString="*.wmv") returned 5 [0051.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.divx") returned 0 [0051.570] lstrlenA (lpString="*.divx") returned 6 [0051.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.mkv") returned 0 [0051.570] lstrlenA (lpString="*.mkv") returned 5 [0051.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.mp3") returned 0 [0051.570] lstrlenA (lpString="*.mp3") returned 5 [0051.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.wav") returned 0 [0051.570] lstrlenA (lpString="*.wav") returned 5 [0051.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.flac") returned 0 [0051.570] lstrlenA (lpString="*.flac") returned 6 [0051.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.ape") returned 0 [0051.570] lstrlenA (lpString="*.ape") returned 5 [0051.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.wma") returned 0 [0051.570] lstrlenA (lpString="*.wma") returned 5 [0051.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.ac3") returned 0 [0051.570] lstrlenA (lpString="*.ac3") returned 5 [0051.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", pszSpec="*.mxf") returned 0 [0051.570] lstrlenA (lpString="*.mxf") returned 5 [0051.571] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2efb2900, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2efb2900, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x2a50, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00914_.WMF", cAlternateFileName="")) returned 1 [0051.571] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.571] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN00914_.WMF") returned 1 [0051.571] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN00914_.WMF") returned 1 [0051.571] lstrcmpiA (lpString1="", lpString2="AN00914_.WMF") returned -1 [0051.571] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned="AN00853_.WMF" [0051.571] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.571] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.571] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.571] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.571] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN00914_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" [0051.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.zip") returned 0 [0051.571] lstrlenA (lpString="*.zip") returned 5 [0051.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.rar") returned 0 [0051.571] lstrlenA (lpString="*.rar") returned 5 [0051.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.7z") returned 0 [0051.571] lstrlenA (lpString="*.7z") returned 4 [0051.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.tar") returned 0 [0051.571] lstrlenA (lpString="*.tar") returned 5 [0051.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.gzip") returned 0 [0051.571] lstrlenA (lpString="*.gzip") returned 6 [0051.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.jpg") returned 0 [0051.571] lstrlenA (lpString="*.jpg") returned 5 [0051.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.jpeg") returned 0 [0051.571] lstrlenA (lpString="*.jpeg") returned 6 [0051.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.psd") returned 0 [0051.571] lstrlenA (lpString="*.psd") returned 5 [0051.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.gif") returned 0 [0051.572] lstrlenA (lpString="*.gif") returned 5 [0051.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.doc") returned 0 [0051.572] lstrlenA (lpString="*.doc") returned 5 [0051.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.docx") returned 0 [0051.572] lstrlenA (lpString="*.docx") returned 6 [0051.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.xls") returned 0 [0051.572] lstrlenA (lpString="*.xls") returned 5 [0051.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.xlsx") returned 0 [0051.572] lstrlenA (lpString="*.xlsx") returned 6 [0051.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.ppt") returned 0 [0051.572] lstrlenA (lpString="*.ppt") returned 5 [0051.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.pptx") returned 0 [0051.572] lstrlenA (lpString="*.pptx") returned 6 [0051.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.pdf") returned 0 [0051.572] lstrlenA (lpString="*.pdf") returned 5 [0051.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.mov") returned 0 [0051.572] lstrlenA (lpString="*.mov") returned 5 [0051.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.m2v") returned 0 [0051.572] lstrlenA (lpString="*.m2v") returned 5 [0051.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.3gp") returned 0 [0051.572] lstrlenA (lpString="*.3gp") returned 5 [0051.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.mpeg") returned 0 [0051.572] lstrlenA (lpString="*.mpeg") returned 6 [0051.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.mpg") returned 0 [0051.572] lstrlenA (lpString="*.mpg") returned 5 [0051.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.flv") returned 0 [0051.572] lstrlenA (lpString="*.flv") returned 5 [0051.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.avi") returned 0 [0051.572] lstrlenA (lpString="*.avi") returned 5 [0051.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.mp4") returned 0 [0051.573] lstrlenA (lpString="*.mp4") returned 5 [0051.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.wmv") returned 0 [0051.573] lstrlenA (lpString="*.wmv") returned 5 [0051.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.divx") returned 0 [0051.573] lstrlenA (lpString="*.divx") returned 6 [0051.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.mkv") returned 0 [0051.573] lstrlenA (lpString="*.mkv") returned 5 [0051.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.mp3") returned 0 [0051.573] lstrlenA (lpString="*.mp3") returned 5 [0051.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.wav") returned 0 [0051.573] lstrlenA (lpString="*.wav") returned 5 [0051.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.flac") returned 0 [0051.573] lstrlenA (lpString="*.flac") returned 6 [0051.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.ape") returned 0 [0051.573] lstrlenA (lpString="*.ape") returned 5 [0051.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.wma") returned 0 [0051.573] lstrlenA (lpString="*.wma") returned 5 [0051.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.ac3") returned 0 [0051.573] lstrlenA (lpString="*.ac3") returned 5 [0051.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", pszSpec="*.mxf") returned 0 [0051.573] lstrlenA (lpString="*.mxf") returned 5 [0051.573] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9f500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8b9f500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x385c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00932_.WMF", cAlternateFileName="")) returned 1 [0051.573] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.573] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN00932_.WMF") returned 1 [0051.573] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN00932_.WMF") returned 1 [0051.573] lstrcmpiA (lpString1="", lpString2="AN00932_.WMF") returned -1 [0051.573] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned="AN00914_.WMF" [0051.573] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.574] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.574] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.574] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.574] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN00932_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" [0051.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.zip") returned 0 [0051.574] lstrlenA (lpString="*.zip") returned 5 [0051.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.rar") returned 0 [0051.574] lstrlenA (lpString="*.rar") returned 5 [0051.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.7z") returned 0 [0051.574] lstrlenA (lpString="*.7z") returned 4 [0051.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.tar") returned 0 [0051.574] lstrlenA (lpString="*.tar") returned 5 [0051.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.gzip") returned 0 [0051.574] lstrlenA (lpString="*.gzip") returned 6 [0051.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.jpg") returned 0 [0051.574] lstrlenA (lpString="*.jpg") returned 5 [0051.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.jpeg") returned 0 [0051.574] lstrlenA (lpString="*.jpeg") returned 6 [0051.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.psd") returned 0 [0051.574] lstrlenA (lpString="*.psd") returned 5 [0051.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.gif") returned 0 [0051.574] lstrlenA (lpString="*.gif") returned 5 [0051.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.doc") returned 0 [0051.574] lstrlenA (lpString="*.doc") returned 5 [0051.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.docx") returned 0 [0051.575] lstrlenA (lpString="*.docx") returned 6 [0051.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.xls") returned 0 [0051.575] lstrlenA (lpString="*.xls") returned 5 [0051.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.xlsx") returned 0 [0051.575] lstrlenA (lpString="*.xlsx") returned 6 [0051.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.ppt") returned 0 [0051.575] lstrlenA (lpString="*.ppt") returned 5 [0051.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.pptx") returned 0 [0051.575] lstrlenA (lpString="*.pptx") returned 6 [0051.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.pdf") returned 0 [0051.575] lstrlenA (lpString="*.pdf") returned 5 [0051.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.mov") returned 0 [0051.575] lstrlenA (lpString="*.mov") returned 5 [0051.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.m2v") returned 0 [0051.575] lstrlenA (lpString="*.m2v") returned 5 [0051.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.3gp") returned 0 [0051.575] lstrlenA (lpString="*.3gp") returned 5 [0051.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.mpeg") returned 0 [0051.575] lstrlenA (lpString="*.mpeg") returned 6 [0051.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.mpg") returned 0 [0051.575] lstrlenA (lpString="*.mpg") returned 5 [0051.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.flv") returned 0 [0051.575] lstrlenA (lpString="*.flv") returned 5 [0051.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.avi") returned 0 [0051.575] lstrlenA (lpString="*.avi") returned 5 [0051.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.mp4") returned 0 [0051.575] lstrlenA (lpString="*.mp4") returned 5 [0051.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.wmv") returned 0 [0051.576] lstrlenA (lpString="*.wmv") returned 5 [0051.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.divx") returned 0 [0051.576] lstrlenA (lpString="*.divx") returned 6 [0051.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.mkv") returned 0 [0051.576] lstrlenA (lpString="*.mkv") returned 5 [0051.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.mp3") returned 0 [0051.576] lstrlenA (lpString="*.mp3") returned 5 [0051.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.wav") returned 0 [0051.576] lstrlenA (lpString="*.wav") returned 5 [0051.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.flac") returned 0 [0051.576] lstrlenA (lpString="*.flac") returned 6 [0051.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.ape") returned 0 [0051.576] lstrlenA (lpString="*.ape") returned 5 [0051.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.wma") returned 0 [0051.576] lstrlenA (lpString="*.wma") returned 5 [0051.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.ac3") returned 0 [0051.576] lstrlenA (lpString="*.ac3") returned 5 [0051.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", pszSpec="*.mxf") returned 0 [0051.576] lstrlenA (lpString="*.mxf") returned 5 [0051.576] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc14efd00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc14efd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00965_.WMF", cAlternateFileName="")) returned 1 [0051.576] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.576] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN00965_.WMF") returned 1 [0051.576] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN00965_.WMF") returned 1 [0051.576] lstrcmpiA (lpString1="", lpString2="AN00965_.WMF") returned -1 [0051.576] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned="AN00932_.WMF" [0051.576] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.577] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.577] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.577] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.577] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN00965_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" [0051.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.zip") returned 0 [0051.577] lstrlenA (lpString="*.zip") returned 5 [0051.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.rar") returned 0 [0051.577] lstrlenA (lpString="*.rar") returned 5 [0051.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.7z") returned 0 [0051.577] lstrlenA (lpString="*.7z") returned 4 [0051.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.tar") returned 0 [0051.577] lstrlenA (lpString="*.tar") returned 5 [0051.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.gzip") returned 0 [0051.577] lstrlenA (lpString="*.gzip") returned 6 [0051.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.jpg") returned 0 [0051.577] lstrlenA (lpString="*.jpg") returned 5 [0051.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.jpeg") returned 0 [0051.577] lstrlenA (lpString="*.jpeg") returned 6 [0051.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.psd") returned 0 [0051.577] lstrlenA (lpString="*.psd") returned 5 [0051.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.gif") returned 0 [0051.577] lstrlenA (lpString="*.gif") returned 5 [0051.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.doc") returned 0 [0051.577] lstrlenA (lpString="*.doc") returned 5 [0051.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.docx") returned 0 [0051.578] lstrlenA (lpString="*.docx") returned 6 [0051.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.xls") returned 0 [0051.578] lstrlenA (lpString="*.xls") returned 5 [0051.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.xlsx") returned 0 [0051.578] lstrlenA (lpString="*.xlsx") returned 6 [0051.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.ppt") returned 0 [0051.578] lstrlenA (lpString="*.ppt") returned 5 [0051.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.pptx") returned 0 [0051.578] lstrlenA (lpString="*.pptx") returned 6 [0051.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.pdf") returned 0 [0051.578] lstrlenA (lpString="*.pdf") returned 5 [0051.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.mov") returned 0 [0051.578] lstrlenA (lpString="*.mov") returned 5 [0051.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.m2v") returned 0 [0051.578] lstrlenA (lpString="*.m2v") returned 5 [0051.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.3gp") returned 0 [0051.578] lstrlenA (lpString="*.3gp") returned 5 [0051.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.mpeg") returned 0 [0051.578] lstrlenA (lpString="*.mpeg") returned 6 [0051.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.mpg") returned 0 [0051.578] lstrlenA (lpString="*.mpg") returned 5 [0051.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.flv") returned 0 [0051.578] lstrlenA (lpString="*.flv") returned 5 [0051.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.avi") returned 0 [0051.578] lstrlenA (lpString="*.avi") returned 5 [0051.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.mp4") returned 0 [0051.579] lstrlenA (lpString="*.mp4") returned 5 [0051.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.wmv") returned 0 [0051.579] lstrlenA (lpString="*.wmv") returned 5 [0051.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.divx") returned 0 [0051.579] lstrlenA (lpString="*.divx") returned 6 [0051.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.mkv") returned 0 [0051.579] lstrlenA (lpString="*.mkv") returned 5 [0051.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.mp3") returned 0 [0051.579] lstrlenA (lpString="*.mp3") returned 5 [0051.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.wav") returned 0 [0051.579] lstrlenA (lpString="*.wav") returned 5 [0051.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.flac") returned 0 [0051.579] lstrlenA (lpString="*.flac") returned 6 [0051.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.ape") returned 0 [0051.579] lstrlenA (lpString="*.ape") returned 5 [0051.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.wma") returned 0 [0051.579] lstrlenA (lpString="*.wma") returned 5 [0051.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.ac3") returned 0 [0051.579] lstrlenA (lpString="*.ac3") returned 5 [0051.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", pszSpec="*.mxf") returned 0 [0051.579] lstrlenA (lpString="*.mxf") returned 5 [0051.579] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d83ea00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d83ea00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0xd10, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01039_.WMF", cAlternateFileName="")) returned 1 [0051.579] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.579] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN01039_.WMF") returned 1 [0051.579] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN01039_.WMF") returned 1 [0051.579] lstrcmpiA (lpString1="", lpString2="AN01039_.WMF") returned -1 [0051.579] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned="AN00965_.WMF" [0051.580] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.580] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.580] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.580] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.580] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN01039_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" [0051.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF", pszSpec="*.zip") returned 0 [0051.580] lstrlenA (lpString="*.zip") returned 5 [0051.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF", pszSpec="*.rar") returned 0 [0051.580] lstrlenA (lpString="*.rar") returned 5 [0051.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF", pszSpec="*.7z") returned 0 [0051.580] lstrlenA (lpString="*.7z") returned 4 [0051.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF", pszSpec="*.tar") returned 0 [0051.580] lstrlenA (lpString="*.tar") returned 5 [0051.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF", pszSpec="*.gzip") returned 0 [0051.580] lstrlenA (lpString="*.gzip") returned 6 [0051.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF", pszSpec="*.jpg") returned 0 [0051.580] lstrlenA (lpString="*.jpg") returned 5 [0051.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF", pszSpec="*.jpeg") returned 0 [0051.580] lstrlenA (lpString="*.jpeg") returned 6 [0051.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF", pszSpec="*.psd") returned 0 [0051.580] lstrlenA (lpString="*.psd") returned 5 [0051.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF", pszSpec="*.gif") returned 0 [0051.580] lstrlenA (lpString="*.gif") returned 5 [0051.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF", pszSpec="*.doc") returned 0 [0051.581] lstrlenA (lpString="*.doc") returned 5 [0051.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF", pszSpec="*.docx") returned 0 [0051.581] lstrlenA (lpString="*.docx") returned 6 [0051.581] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e92000, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31e92000, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x63c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01044_.WMF", cAlternateFileName="")) returned 1 [0051.581] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.581] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN01044_.WMF") returned 1 [0051.581] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN01044_.WMF") returned 1 [0051.581] lstrcmpiA (lpString1="", lpString2="AN01044_.WMF") returned -1 [0051.581] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned="AN01039_.WMF" [0051.581] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.581] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.581] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.581] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.581] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN01044_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" [0051.582] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1fda300, ftCreationTime.dwHighDateTime=0x1bd4b21, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1fda300, ftLastWriteTime.dwHighDateTime=0x1bd4b21, nFileSizeHigh=0x0, nFileSizeLow=0x1f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01060_.WMF", cAlternateFileName="")) returned 1 [0051.582] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.582] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN01060_.WMF") returned 1 [0051.582] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN01060_.WMF") returned 1 [0051.582] lstrcmpiA (lpString1="", lpString2="AN01060_.WMF") returned -1 [0051.582] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned="AN01044_.WMF" [0051.582] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.582] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.582] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.582] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.582] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN01060_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" [0051.582] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dd6400, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86dd6400, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0x728, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01084_.WMF", cAlternateFileName="")) returned 1 [0051.582] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.582] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN01084_.WMF") returned 1 [0051.582] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN01084_.WMF") returned 1 [0051.582] lstrcmpiA (lpString1="", lpString2="AN01084_.WMF") returned -1 [0051.582] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned="AN01060_.WMF" [0051.582] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.582] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.582] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.583] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.583] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN01084_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" [0051.583] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54406500, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54406500, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x66dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01173_.WMF", cAlternateFileName="")) returned 1 [0051.583] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.583] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN01173_.WMF") returned 1 [0051.583] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN01173_.WMF") returned 1 [0051.583] lstrcmpiA (lpString1="", lpString2="AN01173_.WMF") returned -1 [0051.583] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned="AN01084_.WMF" [0051.583] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.583] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.583] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.583] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.583] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN01173_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" [0051.583] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x530f3800, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x530f3800, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x6cd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01174_.WMF", cAlternateFileName="")) returned 1 [0051.583] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.583] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN01174_.WMF") returned 1 [0051.583] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN01174_.WMF") returned 1 [0051.583] lstrcmpiA (lpString1="", lpString2="AN01174_.WMF") returned -1 [0051.583] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned="AN01173_.WMF" [0051.584] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.584] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.584] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.584] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.584] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN01174_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" [0051.584] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cbf4f00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cbf4f00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01184_.WMF", cAlternateFileName="")) returned 1 [0051.584] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.584] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN01184_.WMF") returned 1 [0051.584] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN01184_.WMF") returned 1 [0051.584] lstrcmpiA (lpString1="", lpString2="AN01184_.WMF") returned -1 [0051.584] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned="AN01174_.WMF" [0051.584] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.584] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.584] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.585] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.585] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN01184_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" [0051.585] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8335e700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8335e700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x16cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01216_.WMF", cAlternateFileName="")) returned 1 [0051.585] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.585] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN01216_.WMF") returned 1 [0051.585] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN01216_.WMF") returned 1 [0051.585] lstrcmpiA (lpString1="", lpString2="AN01216_.WMF") returned -1 [0051.585] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned="AN01184_.WMF" [0051.585] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.585] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.585] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.585] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.585] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN01216_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" [0051.585] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa26000, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fa26000, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01218_.WMF", cAlternateFileName="")) returned 1 [0051.585] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.585] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN01218_.WMF") returned 1 [0051.585] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN01218_.WMF") returned 1 [0051.585] lstrcmpiA (lpString1="", lpString2="AN01218_.WMF") returned -1 [0051.585] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned="AN01216_.WMF" [0051.585] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.586] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.586] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.586] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.586] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN01218_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" [0051.586] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68bb3800, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x68bb3800, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01251_.WMF", cAlternateFileName="")) returned 1 [0051.586] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.586] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN01251_.WMF") returned 1 [0051.586] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN01251_.WMF") returned 1 [0051.586] lstrcmpiA (lpString1="", lpString2="AN01251_.WMF") returned -1 [0051.586] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned="AN01218_.WMF" [0051.586] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.586] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.586] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.586] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.586] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN01251_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" [0051.586] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc436f700, ftCreationTime.dwHighDateTime=0x1bd4b08, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc436f700, ftLastWriteTime.dwHighDateTime=0x1bd4b08, nFileSizeHigh=0x0, nFileSizeLow=0x1ccc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01545_.WMF", cAlternateFileName="")) returned 1 [0051.586] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.586] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN01545_.WMF") returned 1 [0051.586] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN01545_.WMF") returned 1 [0051.587] lstrcmpiA (lpString1="", lpString2="AN01545_.WMF") returned -1 [0051.587] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned="AN01251_.WMF" [0051.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.587] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.587] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.587] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.587] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN01545_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" [0051.587] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37a5800, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe37a5800, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1d74, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02122_.WMF", cAlternateFileName="")) returned 1 [0051.587] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.587] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN02122_.WMF") returned 1 [0051.587] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN02122_.WMF") returned 1 [0051.587] lstrcmpiA (lpString1="", lpString2="AN02122_.WMF") returned -1 [0051.587] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned="AN01545_.WMF" [0051.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.587] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.587] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.587] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.587] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN02122_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" [0051.587] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec9bd00, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcec9bd00, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0x19e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02559_.WMF", cAlternateFileName="")) returned 1 [0051.587] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.587] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN02559_.WMF") returned 1 [0051.588] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN02559_.WMF") returned 1 [0051.588] lstrcmpiA (lpString1="", lpString2="AN02559_.WMF") returned -1 [0051.588] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned="AN02122_.WMF" [0051.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.588] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.588] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.588] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.588] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN02559_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" [0051.588] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b6bc300, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b6bc300, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02724_.WMF", cAlternateFileName="")) returned 1 [0051.588] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.588] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN02724_.WMF") returned 1 [0051.588] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN02724_.WMF") returned 1 [0051.588] lstrcmpiA (lpString1="", lpString2="AN02724_.WMF") returned -1 [0051.588] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned="AN02559_.WMF" [0051.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.588] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.588] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.588] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.588] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN02724_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" [0051.589] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c87b100, ftCreationTime.dwHighDateTime=0x1bd4c18, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c87b100, ftLastWriteTime.dwHighDateTime=0x1bd4c18, nFileSizeHigh=0x0, nFileSizeLow=0x2418, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN03500_.WMF", cAlternateFileName="")) returned 1 [0051.589] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.589] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN03500_.WMF") returned 1 [0051.589] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN03500_.WMF") returned 1 [0051.589] lstrcmpiA (lpString1="", lpString2="AN03500_.WMF") returned -1 [0051.589] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned="AN02724_.WMF" [0051.589] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.589] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.589] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.589] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.589] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN03500_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" [0051.589] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x928, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04108_.WMF", cAlternateFileName="")) returned 1 [0051.589] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.589] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN04108_.WMF") returned 1 [0051.589] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04108_.WMF") returned 1 [0051.589] lstrcmpiA (lpString1="", lpString2="AN04108_.WMF") returned -1 [0051.589] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned="AN03500_.WMF" [0051.589] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.589] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.589] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.589] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.590] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04108_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" [0051.590] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04117_.WMF", cAlternateFileName="")) returned 1 [0051.590] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.590] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN04117_.WMF") returned 1 [0051.590] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04117_.WMF") returned 1 [0051.590] lstrcmpiA (lpString1="", lpString2="AN04117_.WMF") returned -1 [0051.590] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned="AN04108_.WMF" [0051.590] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.590] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.590] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.590] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.590] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04117_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" [0051.590] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04134_.WMF", cAlternateFileName="")) returned 1 [0051.590] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.590] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN04134_.WMF") returned 1 [0051.590] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04134_.WMF") returned 1 [0051.590] lstrcmpiA (lpString1="", lpString2="AN04134_.WMF") returned -1 [0051.590] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned="AN04117_.WMF" [0051.590] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.590] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.591] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.591] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.591] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04134_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" [0051.591] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04174_.WMF", cAlternateFileName="")) returned 1 [0051.591] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.591] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN04174_.WMF") returned 1 [0051.591] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04174_.WMF") returned 1 [0051.591] lstrcmpiA (lpString1="", lpString2="AN04174_.WMF") returned -1 [0051.591] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned="AN04134_.WMF" [0051.591] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.591] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.591] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.591] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.591] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04174_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" [0051.591] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04191_.WMF", cAlternateFileName="")) returned 1 [0051.591] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.591] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN04191_.WMF") returned 1 [0051.591] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04191_.WMF") returned 1 [0051.591] lstrcmpiA (lpString1="", lpString2="AN04191_.WMF") returned -1 [0051.592] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned="AN04174_.WMF" [0051.592] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.592] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.592] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.592] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.592] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04191_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" [0051.592] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04195_.WMF", cAlternateFileName="")) returned 1 [0051.592] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.592] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN04195_.WMF") returned 1 [0051.592] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04195_.WMF") returned 1 [0051.592] lstrcmpiA (lpString1="", lpString2="AN04195_.WMF") returned -1 [0051.592] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned="AN04191_.WMF" [0051.592] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.592] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.592] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.592] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.592] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04195_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" [0051.592] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04196_.WMF", cAlternateFileName="")) returned 1 [0051.592] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.593] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN04196_.WMF") returned 1 [0051.593] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04196_.WMF") returned 1 [0051.593] lstrcmpiA (lpString1="", lpString2="AN04196_.WMF") returned -1 [0051.593] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned="AN04195_.WMF" [0051.593] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.593] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.593] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.593] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.593] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04196_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" [0051.593] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04206_.WMF", cAlternateFileName="")) returned 1 [0051.593] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.593] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN04206_.WMF") returned 1 [0051.593] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04206_.WMF") returned 1 [0051.593] lstrcmpiA (lpString1="", lpString2="AN04206_.WMF") returned -1 [0051.593] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned="AN04196_.WMF" [0051.593] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.593] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.593] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.593] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.594] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04206_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" [0051.594] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x212c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04225_.WMF", cAlternateFileName="")) returned 1 [0051.594] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.594] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN04225_.WMF") returned 1 [0051.594] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04225_.WMF") returned 1 [0051.594] lstrcmpiA (lpString1="", lpString2="AN04225_.WMF") returned -1 [0051.594] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned="AN04206_.WMF" [0051.594] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.594] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.594] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.594] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.594] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04225_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" [0051.594] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04235_.WMF", cAlternateFileName="")) returned 1 [0051.594] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.594] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN04235_.WMF") returned 1 [0051.594] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04235_.WMF") returned 1 [0051.594] lstrcmpiA (lpString1="", lpString2="AN04235_.WMF") returned -1 [0051.594] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned="AN04225_.WMF" [0051.594] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.594] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.595] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.595] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.595] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04235_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" [0051.595] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04267_.WMF", cAlternateFileName="")) returned 1 [0051.595] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.595] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN04267_.WMF") returned 1 [0051.595] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04267_.WMF") returned 1 [0051.595] lstrcmpiA (lpString1="", lpString2="AN04267_.WMF") returned -1 [0051.595] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned="AN04235_.WMF" [0051.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.595] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.595] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.595] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.595] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04267_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" [0051.595] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04269_.WMF", cAlternateFileName="")) returned 1 [0051.596] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.596] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN04269_.WMF") returned 1 [0051.596] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04269_.WMF") returned 1 [0051.596] lstrcmpiA (lpString1="", lpString2="AN04269_.WMF") returned -1 [0051.597] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned="AN04267_.WMF" [0051.597] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.597] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.597] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.597] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.597] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04269_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" [0051.597] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04323_.WMF", cAlternateFileName="")) returned 1 [0051.597] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.597] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN04323_.WMF") returned 1 [0051.597] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04323_.WMF") returned 1 [0051.597] lstrcmpiA (lpString1="", lpString2="AN04323_.WMF") returned -1 [0051.597] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned="AN04269_.WMF" [0051.597] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.597] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.597] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.597] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.597] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04323_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" [0051.597] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd14, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04326_.WMF", cAlternateFileName="")) returned 1 [0051.598] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.598] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN04326_.WMF") returned 1 [0051.598] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04326_.WMF") returned 1 [0051.598] lstrcmpiA (lpString1="", lpString2="AN04326_.WMF") returned -1 [0051.598] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned="AN04323_.WMF" [0051.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.598] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.598] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.598] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.598] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04326_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" [0051.598] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04332_.WMF", cAlternateFileName="")) returned 1 [0051.598] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.598] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN04332_.WMF") returned 1 [0051.598] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04332_.WMF") returned 1 [0051.599] lstrcmpiA (lpString1="", lpString2="AN04332_.WMF") returned -1 [0051.599] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned="AN04326_.WMF" [0051.599] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.599] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.599] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.599] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.599] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04332_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" [0051.599] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04355_.WMF", cAlternateFileName="")) returned 1 [0051.599] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.599] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN04355_.WMF") returned 1 [0051.599] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04355_.WMF") returned 1 [0051.599] lstrcmpiA (lpString1="", lpString2="AN04355_.WMF") returned -1 [0051.599] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned="AN04332_.WMF" [0051.599] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.599] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.599] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.600] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.600] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04355_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" [0051.600] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04369_.WMF", cAlternateFileName="")) returned 1 [0051.600] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.600] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN04369_.WMF") returned 1 [0051.600] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04369_.WMF") returned 1 [0051.600] lstrcmpiA (lpString1="", lpString2="AN04369_.WMF") returned -1 [0051.600] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned="AN04355_.WMF" [0051.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.600] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.600] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.600] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.600] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04369_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" [0051.600] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04384_.WMF", cAlternateFileName="")) returned 1 [0051.600] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.600] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN04384_.WMF") returned 1 [0051.600] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04384_.WMF") returned 1 [0051.600] lstrcmpiA (lpString1="", lpString2="AN04384_.WMF") returned -1 [0051.600] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned="AN04369_.WMF" [0051.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.601] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.601] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.601] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.601] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04384_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" [0051.601] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04385_.WMF", cAlternateFileName="")) returned 1 [0051.601] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.601] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AN04385_.WMF") returned 1 [0051.601] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AN04385_.WMF") returned 1 [0051.601] lstrcmpiA (lpString1="", lpString2="AN04385_.WMF") returned -1 [0051.601] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned="AN04384_.WMF" [0051.601] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.601] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.601] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.601] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.601] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="AN04385_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" [0051.601] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfc41400, ftCreationTime.dwHighDateTime=0x1bd4c15, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfc41400, ftLastWriteTime.dwHighDateTime=0x1bd4c15, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BABY_01.MID", cAlternateFileName="")) returned 1 [0051.602] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.602] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BABY_01.MID") returned 1 [0051.602] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BABY_01.MID") returned 1 [0051.602] lstrcmpiA (lpString1="", lpString2="BABY_01.MID") returned -1 [0051.602] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned="AN04385_.WMF" [0051.602] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.602] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.602] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.602] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.602] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BABY_01.MID" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" [0051.602] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1306, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00116_.WMF", cAlternateFileName="")) returned 1 [0051.602] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.602] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD00116_.WMF") returned 1 [0051.602] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD00116_.WMF") returned 1 [0051.602] lstrcmpiA (lpString1="", lpString2="BD00116_.WMF") returned -1 [0051.602] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned="BABY_01.MID" [0051.602] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.602] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.602] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.603] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.603] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD00116_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" [0051.603] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2332bb00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2332bb00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6906, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00141_.WMF", cAlternateFileName="")) returned 1 [0051.603] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.603] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD00141_.WMF") returned 1 [0051.603] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD00141_.WMF") returned 1 [0051.603] lstrcmpiA (lpString1="", lpString2="BD00141_.WMF") returned -1 [0051.603] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned="BD00116_.WMF" [0051.603] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.603] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.603] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.603] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.603] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD00141_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" [0051.603] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb983d700, ftCreationTime.dwHighDateTime=0x1bf148e, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb983d700, ftLastWriteTime.dwHighDateTime=0x1bf148e, nFileSizeHigh=0x0, nFileSizeLow=0x7114, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00146_.WMF", cAlternateFileName="")) returned 1 [0051.603] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.603] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD00146_.WMF") returned 1 [0051.603] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD00146_.WMF") returned 1 [0051.603] lstrcmpiA (lpString1="", lpString2="BD00146_.WMF") returned -1 [0051.603] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned="BD00141_.WMF" [0051.603] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.604] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.604] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.604] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.604] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD00146_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" [0051.604] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d1cf00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d1cf00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x2d74, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00155_.WMF", cAlternateFileName="")) returned 1 [0051.604] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.604] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD00155_.WMF") returned 1 [0051.604] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD00155_.WMF") returned 1 [0051.604] lstrcmpiA (lpString1="", lpString2="BD00155_.WMF") returned -1 [0051.604] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned="BD00146_.WMF" [0051.604] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.604] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.604] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.604] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.604] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD00155_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" [0051.604] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaac100, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaaac100, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x57f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00160_.WMF", cAlternateFileName="")) returned 1 [0051.604] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.604] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD00160_.WMF") returned 1 [0051.605] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD00160_.WMF") returned 1 [0051.605] lstrcmpiA (lpString1="", lpString2="BD00160_.WMF") returned -1 [0051.605] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned="BD00155_.WMF" [0051.605] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.605] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.605] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.605] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.605] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD00160_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" [0051.605] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcafbb900, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcafbb900, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x3f34, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00173_.WMF", cAlternateFileName="")) returned 1 [0051.605] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.605] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD00173_.WMF") returned 1 [0051.605] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD00173_.WMF") returned 1 [0051.605] lstrcmpiA (lpString1="", lpString2="BD00173_.WMF") returned -1 [0051.605] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned="BD00160_.WMF" [0051.605] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.605] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.605] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.605] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.605] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD00173_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" [0051.605] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4354, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD05119_.WMF", cAlternateFileName="")) returned 1 [0051.606] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.606] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD05119_.WMF") returned 1 [0051.606] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD05119_.WMF") returned 1 [0051.606] lstrcmpiA (lpString1="", lpString2="BD05119_.WMF") returned -1 [0051.606] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned="BD00173_.WMF" [0051.606] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.606] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.606] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.606] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.606] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD05119_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" [0051.606] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ef0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD06102_.WMF", cAlternateFileName="")) returned 1 [0051.606] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.606] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD06102_.WMF") returned 1 [0051.606] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD06102_.WMF") returned 1 [0051.606] lstrcmpiA (lpString1="", lpString2="BD06102_.WMF") returned -1 [0051.606] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned="BD05119_.WMF" [0051.606] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.606] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.606] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.606] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.606] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD06102_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" [0051.607] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD06200_.WMF", cAlternateFileName="")) returned 1 [0051.607] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.607] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD06200_.WMF") returned 1 [0051.607] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD06200_.WMF") returned 1 [0051.607] lstrcmpiA (lpString1="", lpString2="BD06200_.WMF") returned -1 [0051.607] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned="BD06102_.WMF" [0051.607] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.607] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.607] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.607] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.607] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD06200_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" [0051.607] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x687c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07761_.WMF", cAlternateFileName="")) returned 1 [0051.607] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.607] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD07761_.WMF") returned 1 [0051.607] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD07761_.WMF") returned 1 [0051.607] lstrcmpiA (lpString1="", lpString2="BD07761_.WMF") returned -1 [0051.607] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned="BD06200_.WMF" [0051.607] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.607] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.607] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.607] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.608] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD07761_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" [0051.608] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x133c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07804_.WMF", cAlternateFileName="")) returned 1 [0051.608] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.608] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD07804_.WMF") returned 1 [0051.608] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD07804_.WMF") returned 1 [0051.608] lstrcmpiA (lpString1="", lpString2="BD07804_.WMF") returned -1 [0051.608] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned="BD07761_.WMF" [0051.608] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.608] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.608] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.608] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.608] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD07804_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" [0051.608] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07831_.WMF", cAlternateFileName="")) returned 1 [0051.608] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.608] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD07831_.WMF") returned 1 [0051.608] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD07831_.WMF") returned 1 [0051.608] lstrcmpiA (lpString1="", lpString2="BD07831_.WMF") returned -1 [0051.608] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned="BD07804_.WMF" [0051.608] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.608] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.608] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.608] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.609] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD07831_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" [0051.609] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08758_.WMF", cAlternateFileName="")) returned 1 [0051.609] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.609] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD08758_.WMF") returned 1 [0051.609] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD08758_.WMF") returned 1 [0051.609] lstrcmpiA (lpString1="", lpString2="BD08758_.WMF") returned -1 [0051.609] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned="BD07831_.WMF" [0051.609] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.609] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.609] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.609] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.609] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD08758_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" [0051.609] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08773_.WMF", cAlternateFileName="")) returned 1 [0051.609] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.609] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD08773_.WMF") returned 1 [0051.609] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD08773_.WMF") returned 1 [0051.609] lstrcmpiA (lpString1="", lpString2="BD08773_.WMF") returned -1 [0051.609] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned="BD08758_.WMF" [0051.609] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.609] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.609] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.610] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.610] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD08773_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" [0051.610] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbb7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08808_.WMF", cAlternateFileName="")) returned 1 [0051.610] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.610] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD08808_.WMF") returned 1 [0051.610] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD08808_.WMF") returned 1 [0051.610] lstrcmpiA (lpString1="", lpString2="BD08808_.WMF") returned -1 [0051.610] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned="BD08773_.WMF" [0051.610] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.610] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.610] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.610] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.610] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD08808_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" [0051.610] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9d0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08868_.WMF", cAlternateFileName="")) returned 1 [0051.610] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.610] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD08868_.WMF") returned 1 [0051.610] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD08868_.WMF") returned 1 [0051.610] lstrcmpiA (lpString1="", lpString2="BD08868_.WMF") returned -1 [0051.610] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned="BD08808_.WMF" [0051.610] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.611] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.611] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.611] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.611] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD08868_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" [0051.611] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbaaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09031_.WMF", cAlternateFileName="")) returned 1 [0051.611] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.611] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD09031_.WMF") returned 1 [0051.611] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD09031_.WMF") returned 1 [0051.611] lstrcmpiA (lpString1="", lpString2="BD09031_.WMF") returned -1 [0051.611] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned="BD08868_.WMF" [0051.611] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.611] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.611] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.611] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.611] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD09031_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" [0051.611] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x38cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09194_.WMF", cAlternateFileName="")) returned 1 [0051.611] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.611] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD09194_.WMF") returned 1 [0051.611] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD09194_.WMF") returned 1 [0051.611] lstrcmpiA (lpString1="", lpString2="BD09194_.WMF") returned -1 [0051.612] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned="BD09031_.WMF" [0051.612] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.612] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.612] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.612] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.612] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD09194_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" [0051.612] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x504a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09662_.WMF", cAlternateFileName="")) returned 1 [0051.612] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.612] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD09662_.WMF") returned 1 [0051.612] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD09662_.WMF") returned 1 [0051.612] lstrcmpiA (lpString1="", lpString2="BD09662_.WMF") returned -1 [0051.612] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned="BD09194_.WMF" [0051.612] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.612] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.612] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.612] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.612] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD09662_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" [0051.612] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09664_.WMF", cAlternateFileName="")) returned 1 [0051.612] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.612] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD09664_.WMF") returned 1 [0051.613] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD09664_.WMF") returned 1 [0051.613] lstrcmpiA (lpString1="", lpString2="BD09664_.WMF") returned -1 [0051.613] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned="BD09662_.WMF" [0051.613] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.613] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.613] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.613] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.613] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD09664_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" [0051.613] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c365a00, ftCreationTime.dwHighDateTime=0x1bd4f6a, ftLastAccessTime.dwLowDateTime=0x5f47ba90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c365a00, ftLastWriteTime.dwHighDateTime=0x1bd4f6a, nFileSizeHigh=0x0, nFileSizeLow=0x34cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10890_.GIF", cAlternateFileName="")) returned 1 [0051.613] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.613] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD10890_.GIF") returned 1 [0051.613] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10890_.GIF") returned 1 [0051.613] lstrcmpiA (lpString1="", lpString2="BD10890_.GIF") returned -1 [0051.613] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned="BD09664_.WMF" [0051.613] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.613] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.613] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.613] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.613] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD10890_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" [0051.613] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" [0051.613] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" [0051.614] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF." [0051.614] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.wannacry" [0051.614] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.614] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34cb [0051.614] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4c365a00, dwHighDateTime=0x1bd4f6a), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f47ba90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4c365a00, dwHighDateTime=0x1bd4f6a)) returned 1 [0051.614] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.614] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x344d, lpOverlapped=0x0) returned 1 [0051.630] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned="BD10890_.GIF" [0051.630] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.630] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x344d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x344d, lpOverlapped=0x0) returned 1 [0051.630] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.631] CloseHandle (hObject=0x8c) returned 1 [0051.635] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.wannacry")) returned 1 [0051.636] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93701b00, ftCreationTime.dwHighDateTime=0x1bd4f69, ftLastAccessTime.dwLowDateTime=0x517da370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93701b00, ftLastWriteTime.dwHighDateTime=0x1bd4f69, nFileSizeHigh=0x0, nFileSizeLow=0x4edd, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="BD10972_.GIF", cAlternateFileName="")) returned 1 [0051.636] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.636] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD10972_.GIF") returned 1 [0051.636] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10972_.GIF") returned 1 [0051.636] lstrcmpiA (lpString1="", lpString2="BD10972_.GIF") returned -1 [0051.636] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned="BD10890_.GIF" [0051.636] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.636] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.636] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.636] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.636] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD10972_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" [0051.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF", pszSpec="*.zip") returned 0 [0051.636] lstrlenA (lpString="*.zip") returned 5 [0051.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF", pszSpec="*.rar") returned 0 [0051.636] lstrlenA (lpString="*.rar") returned 5 [0051.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF", pszSpec="*.7z") returned 0 [0051.636] lstrlenA (lpString="*.7z") returned 4 [0051.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF", pszSpec="*.tar") returned 0 [0051.637] lstrlenA (lpString="*.tar") returned 5 [0051.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF", pszSpec="*.gzip") returned 0 [0051.637] lstrlenA (lpString="*.gzip") returned 6 [0051.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF", pszSpec="*.jpg") returned 0 [0051.637] lstrlenA (lpString="*.jpg") returned 5 [0051.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF", pszSpec="*.jpeg") returned 0 [0051.637] lstrlenA (lpString="*.jpeg") returned 6 [0051.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF", pszSpec="*.psd") returned 0 [0051.637] lstrlenA (lpString="*.psd") returned 5 [0051.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF", pszSpec="*.gif") returned 1 [0051.637] lstrlenA (lpString="*.gif") returned 5 [0051.637] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" [0051.637] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" [0051.637] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF." [0051.637] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.wannacry" [0051.637] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.638] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4edd [0051.638] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93701b00, dwHighDateTime=0x1bd4f69), lpLastAccessTime=0x407536*(dwLowDateTime=0x517da370, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93701b00, dwHighDateTime=0x1bd4f69)) returned 1 [0051.639] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.639] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4e5f, lpOverlapped=0x0) returned 1 [0051.641] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned="BD10972_.GIF" [0051.641] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.641] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4e5f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4e5f, lpOverlapped=0x0) returned 1 [0051.641] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.641] CloseHandle (hObject=0x8c) returned 1 [0051.647] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.wannacry")) returned 1 [0051.648] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6557800, ftCreationTime.dwHighDateTime=0x1bd4d57, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6557800, ftLastWriteTime.dwHighDateTime=0x1bd4d57, nFileSizeHigh=0x0, nFileSizeLow=0x4fe6, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="BD19563_.GIF", cAlternateFileName="")) returned 1 [0051.648] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.648] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD19563_.GIF") returned 1 [0051.648] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD19563_.GIF") returned 1 [0051.648] lstrcmpiA (lpString1="", lpString2="BD19563_.GIF") returned -1 [0051.648] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned="BD10972_.GIF" [0051.648] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.648] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.648] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.648] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.648] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD19563_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" [0051.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF", pszSpec="*.zip") returned 0 [0051.648] lstrlenA (lpString="*.zip") returned 5 [0051.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF", pszSpec="*.rar") returned 0 [0051.648] lstrlenA (lpString="*.rar") returned 5 [0051.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF", pszSpec="*.7z") returned 0 [0051.648] lstrlenA (lpString="*.7z") returned 4 [0051.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF", pszSpec="*.tar") returned 0 [0051.648] lstrlenA (lpString="*.tar") returned 5 [0051.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF", pszSpec="*.gzip") returned 0 [0051.649] lstrlenA (lpString="*.gzip") returned 6 [0051.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF", pszSpec="*.jpg") returned 0 [0051.649] lstrlenA (lpString="*.jpg") returned 5 [0051.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF", pszSpec="*.jpeg") returned 0 [0051.649] lstrlenA (lpString="*.jpeg") returned 6 [0051.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF", pszSpec="*.psd") returned 0 [0051.649] lstrlenA (lpString="*.psd") returned 5 [0051.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF", pszSpec="*.gif") returned 1 [0051.649] lstrlenA (lpString="*.gif") returned 5 [0051.649] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" [0051.649] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" [0051.649] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF." [0051.649] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.wannacry" [0051.649] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.649] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4fe6 [0051.649] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6557800, dwHighDateTime=0x1bd4d57), lpLastAccessTime=0x407536*(dwLowDateTime=0x5190ae70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6557800, dwHighDateTime=0x1bd4d57)) returned 1 [0051.649] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.649] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4f68, lpOverlapped=0x0) returned 1 [0051.651] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned="BD19563_.GIF" [0051.651] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.651] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4f68, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4f68, lpOverlapped=0x0) returned 1 [0051.652] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.652] CloseHandle (hObject=0x8c) returned 1 [0051.655] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.wannacry")) returned 1 [0051.655] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4f48c00, ftCreationTime.dwHighDateTime=0x1bd4d56, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe4f48c00, ftLastWriteTime.dwHighDateTime=0x1bd4d56, nFileSizeHigh=0x0, nFileSizeLow=0x3d75, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="BD19582_.GIF", cAlternateFileName="")) returned 1 [0051.655] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.656] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD19582_.GIF") returned 1 [0051.656] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD19582_.GIF") returned 1 [0051.656] lstrcmpiA (lpString1="", lpString2="BD19582_.GIF") returned -1 [0051.656] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned="BD19563_.GIF" [0051.656] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.656] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.656] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.656] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.656] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD19582_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" [0051.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF", pszSpec="*.zip") returned 0 [0051.656] lstrlenA (lpString="*.zip") returned 5 [0051.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF", pszSpec="*.rar") returned 0 [0051.656] lstrlenA (lpString="*.rar") returned 5 [0051.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF", pszSpec="*.7z") returned 0 [0051.656] lstrlenA (lpString="*.7z") returned 4 [0051.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF", pszSpec="*.tar") returned 0 [0051.656] lstrlenA (lpString="*.tar") returned 5 [0051.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF", pszSpec="*.gzip") returned 0 [0051.656] lstrlenA (lpString="*.gzip") returned 6 [0051.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF", pszSpec="*.jpg") returned 0 [0051.656] lstrlenA (lpString="*.jpg") returned 5 [0051.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF", pszSpec="*.jpeg") returned 0 [0051.656] lstrlenA (lpString="*.jpeg") returned 6 [0051.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF", pszSpec="*.psd") returned 0 [0051.657] lstrlenA (lpString="*.psd") returned 5 [0051.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF", pszSpec="*.gif") returned 1 [0051.657] lstrlenA (lpString="*.gif") returned 5 [0051.657] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" [0051.657] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" [0051.657] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF." [0051.657] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.wannacry" [0051.657] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0051.657] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d75 [0051.657] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe4f48c00, dwHighDateTime=0x1bd4d56), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f586430, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe4f48c00, dwHighDateTime=0x1bd4d56)) returned 1 [0051.657] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.657] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3cf7, lpOverlapped=0x0) returned 1 [0051.660] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned="BD19582_.GIF" [0051.660] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0051.660] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3cf7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3cf7, lpOverlapped=0x0) returned 1 [0051.661] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.661] CloseHandle (hObject=0x8c) returned 1 [0051.663] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.wannacry")) returned 1 [0051.664] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c6cc00, ftCreationTime.dwHighDateTime=0x1bd4d5a, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4c6cc00, ftLastWriteTime.dwHighDateTime=0x1bd4d5a, nFileSizeHigh=0x0, nFileSizeLow=0x32b6, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="BD19695_.WMF", cAlternateFileName="")) returned 1 [0051.664] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.664] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD19695_.WMF") returned 1 [0051.664] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD19695_.WMF") returned 1 [0051.664] lstrcmpiA (lpString1="", lpString2="BD19695_.WMF") returned -1 [0051.664] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned="BD19582_.GIF" [0051.664] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.664] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.664] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.664] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.664] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD19695_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" [0051.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.zip") returned 0 [0051.664] lstrlenA (lpString="*.zip") returned 5 [0051.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.rar") returned 0 [0051.664] lstrlenA (lpString="*.rar") returned 5 [0051.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.7z") returned 0 [0051.664] lstrlenA (lpString="*.7z") returned 4 [0051.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.tar") returned 0 [0051.664] lstrlenA (lpString="*.tar") returned 5 [0051.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.gzip") returned 0 [0051.664] lstrlenA (lpString="*.gzip") returned 6 [0051.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.jpg") returned 0 [0051.664] lstrlenA (lpString="*.jpg") returned 5 [0051.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.jpeg") returned 0 [0051.664] lstrlenA (lpString="*.jpeg") returned 6 [0051.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.psd") returned 0 [0051.665] lstrlenA (lpString="*.psd") returned 5 [0051.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.gif") returned 0 [0051.665] lstrlenA (lpString="*.gif") returned 5 [0051.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.doc") returned 0 [0051.665] lstrlenA (lpString="*.doc") returned 5 [0051.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.docx") returned 0 [0051.665] lstrlenA (lpString="*.docx") returned 6 [0051.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.xls") returned 0 [0051.665] lstrlenA (lpString="*.xls") returned 5 [0051.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.xlsx") returned 0 [0051.665] lstrlenA (lpString="*.xlsx") returned 6 [0051.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.ppt") returned 0 [0051.665] lstrlenA (lpString="*.ppt") returned 5 [0051.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.pptx") returned 0 [0051.665] lstrlenA (lpString="*.pptx") returned 6 [0051.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.pdf") returned 0 [0051.665] lstrlenA (lpString="*.pdf") returned 5 [0051.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.mov") returned 0 [0051.665] lstrlenA (lpString="*.mov") returned 5 [0051.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.m2v") returned 0 [0051.665] lstrlenA (lpString="*.m2v") returned 5 [0051.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.3gp") returned 0 [0051.665] lstrlenA (lpString="*.3gp") returned 5 [0051.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.mpeg") returned 0 [0051.665] lstrlenA (lpString="*.mpeg") returned 6 [0051.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.mpg") returned 0 [0051.665] lstrlenA (lpString="*.mpg") returned 5 [0051.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.flv") returned 0 [0051.665] lstrlenA (lpString="*.flv") returned 5 [0051.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.avi") returned 0 [0051.665] lstrlenA (lpString="*.avi") returned 5 [0051.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.mp4") returned 0 [0051.665] lstrlenA (lpString="*.mp4") returned 5 [0051.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.wmv") returned 0 [0051.665] lstrlenA (lpString="*.wmv") returned 5 [0051.666] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.divx") returned 0 [0051.666] lstrlenA (lpString="*.divx") returned 6 [0051.666] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.mkv") returned 0 [0051.666] lstrlenA (lpString="*.mkv") returned 5 [0051.666] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.mp3") returned 0 [0051.666] lstrlenA (lpString="*.mp3") returned 5 [0051.666] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.wav") returned 0 [0051.666] lstrlenA (lpString="*.wav") returned 5 [0051.666] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.flac") returned 0 [0051.666] lstrlenA (lpString="*.flac") returned 6 [0051.666] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.ape") returned 0 [0051.666] lstrlenA (lpString="*.ape") returned 5 [0051.666] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.wma") returned 0 [0051.666] lstrlenA (lpString="*.wma") returned 5 [0051.666] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.ac3") returned 0 [0051.666] lstrlenA (lpString="*.ac3") returned 5 [0051.666] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", pszSpec="*.mxf") returned 0 [0051.666] lstrlenA (lpString="*.mxf") returned 5 [0051.666] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee332800, ftCreationTime.dwHighDateTime=0x1bd4d59, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee332800, ftLastWriteTime.dwHighDateTime=0x1bd4d59, nFileSizeHigh=0x0, nFileSizeLow=0x25ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19827_.WMF", cAlternateFileName="")) returned 1 [0051.667] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.667] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD19827_.WMF") returned 1 [0051.667] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD19827_.WMF") returned 1 [0051.667] lstrcmpiA (lpString1="", lpString2="BD19827_.WMF") returned -1 [0051.667] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned="BD19695_.WMF" [0051.667] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.667] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.667] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.667] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.667] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD19827_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" [0051.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.zip") returned 0 [0051.667] lstrlenA (lpString="*.zip") returned 5 [0051.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.rar") returned 0 [0051.667] lstrlenA (lpString="*.rar") returned 5 [0051.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.7z") returned 0 [0051.667] lstrlenA (lpString="*.7z") returned 4 [0051.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.tar") returned 0 [0051.667] lstrlenA (lpString="*.tar") returned 5 [0051.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.gzip") returned 0 [0051.667] lstrlenA (lpString="*.gzip") returned 6 [0051.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.jpg") returned 0 [0051.667] lstrlenA (lpString="*.jpg") returned 5 [0051.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.jpeg") returned 0 [0051.668] lstrlenA (lpString="*.jpeg") returned 6 [0051.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.psd") returned 0 [0051.668] lstrlenA (lpString="*.psd") returned 5 [0051.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.gif") returned 0 [0051.668] lstrlenA (lpString="*.gif") returned 5 [0051.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.doc") returned 0 [0051.668] lstrlenA (lpString="*.doc") returned 5 [0051.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.docx") returned 0 [0051.668] lstrlenA (lpString="*.docx") returned 6 [0051.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.xls") returned 0 [0051.668] lstrlenA (lpString="*.xls") returned 5 [0051.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.xlsx") returned 0 [0051.668] lstrlenA (lpString="*.xlsx") returned 6 [0051.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.ppt") returned 0 [0051.668] lstrlenA (lpString="*.ppt") returned 5 [0051.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.pptx") returned 0 [0051.668] lstrlenA (lpString="*.pptx") returned 6 [0051.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.pdf") returned 0 [0051.668] lstrlenA (lpString="*.pdf") returned 5 [0051.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.mov") returned 0 [0051.668] lstrlenA (lpString="*.mov") returned 5 [0051.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.m2v") returned 0 [0051.668] lstrlenA (lpString="*.m2v") returned 5 [0051.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.3gp") returned 0 [0051.668] lstrlenA (lpString="*.3gp") returned 5 [0051.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.mpeg") returned 0 [0051.668] lstrlenA (lpString="*.mpeg") returned 6 [0051.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.mpg") returned 0 [0051.668] lstrlenA (lpString="*.mpg") returned 5 [0051.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.flv") returned 0 [0051.668] lstrlenA (lpString="*.flv") returned 5 [0051.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.avi") returned 0 [0051.668] lstrlenA (lpString="*.avi") returned 5 [0051.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.mp4") returned 0 [0051.668] lstrlenA (lpString="*.mp4") returned 5 [0051.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.wmv") returned 0 [0051.669] lstrlenA (lpString="*.wmv") returned 5 [0051.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.divx") returned 0 [0051.669] lstrlenA (lpString="*.divx") returned 6 [0051.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.mkv") returned 0 [0051.669] lstrlenA (lpString="*.mkv") returned 5 [0051.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.mp3") returned 0 [0051.669] lstrlenA (lpString="*.mp3") returned 5 [0051.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.wav") returned 0 [0051.669] lstrlenA (lpString="*.wav") returned 5 [0051.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.flac") returned 0 [0051.669] lstrlenA (lpString="*.flac") returned 6 [0051.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.ape") returned 0 [0051.669] lstrlenA (lpString="*.ape") returned 5 [0051.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.wma") returned 0 [0051.669] lstrlenA (lpString="*.wma") returned 5 [0051.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.ac3") returned 0 [0051.669] lstrlenA (lpString="*.ac3") returned 5 [0051.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", pszSpec="*.mxf") returned 0 [0051.669] lstrlenA (lpString="*.mxf") returned 5 [0051.669] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed01fb00, ftCreationTime.dwHighDateTime=0x1bd4d59, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed01fb00, ftLastWriteTime.dwHighDateTime=0x1bd4d59, nFileSizeHigh=0x0, nFileSizeLow=0x2244, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19828_.WMF", cAlternateFileName="")) returned 1 [0051.669] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.669] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD19828_.WMF") returned 1 [0051.669] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD19828_.WMF") returned 1 [0051.669] lstrcmpiA (lpString1="", lpString2="BD19828_.WMF") returned -1 [0051.669] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned="BD19827_.WMF" [0051.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.669] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.669] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.669] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.669] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD19828_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" [0051.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.zip") returned 0 [0051.669] lstrlenA (lpString="*.zip") returned 5 [0051.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.rar") returned 0 [0051.670] lstrlenA (lpString="*.rar") returned 5 [0051.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.7z") returned 0 [0051.670] lstrlenA (lpString="*.7z") returned 4 [0051.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.tar") returned 0 [0051.670] lstrlenA (lpString="*.tar") returned 5 [0051.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.gzip") returned 0 [0051.670] lstrlenA (lpString="*.gzip") returned 6 [0051.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.jpg") returned 0 [0051.670] lstrlenA (lpString="*.jpg") returned 5 [0051.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.jpeg") returned 0 [0051.670] lstrlenA (lpString="*.jpeg") returned 6 [0051.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.psd") returned 0 [0051.670] lstrlenA (lpString="*.psd") returned 5 [0051.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.gif") returned 0 [0051.670] lstrlenA (lpString="*.gif") returned 5 [0051.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.doc") returned 0 [0051.670] lstrlenA (lpString="*.doc") returned 5 [0051.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.docx") returned 0 [0051.670] lstrlenA (lpString="*.docx") returned 6 [0051.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.xls") returned 0 [0051.670] lstrlenA (lpString="*.xls") returned 5 [0051.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.xlsx") returned 0 [0051.670] lstrlenA (lpString="*.xlsx") returned 6 [0051.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.ppt") returned 0 [0051.670] lstrlenA (lpString="*.ppt") returned 5 [0051.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.pptx") returned 0 [0051.670] lstrlenA (lpString="*.pptx") returned 6 [0051.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.pdf") returned 0 [0051.670] lstrlenA (lpString="*.pdf") returned 5 [0051.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.mov") returned 0 [0051.670] lstrlenA (lpString="*.mov") returned 5 [0051.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.m2v") returned 0 [0051.671] lstrlenA (lpString="*.m2v") returned 5 [0051.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.3gp") returned 0 [0051.671] lstrlenA (lpString="*.3gp") returned 5 [0051.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.mpeg") returned 0 [0051.671] lstrlenA (lpString="*.mpeg") returned 6 [0051.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.mpg") returned 0 [0051.671] lstrlenA (lpString="*.mpg") returned 5 [0051.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.flv") returned 0 [0051.671] lstrlenA (lpString="*.flv") returned 5 [0051.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.avi") returned 0 [0051.671] lstrlenA (lpString="*.avi") returned 5 [0051.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.mp4") returned 0 [0051.671] lstrlenA (lpString="*.mp4") returned 5 [0051.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.wmv") returned 0 [0051.671] lstrlenA (lpString="*.wmv") returned 5 [0051.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.divx") returned 0 [0051.671] lstrlenA (lpString="*.divx") returned 6 [0051.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.mkv") returned 0 [0051.671] lstrlenA (lpString="*.mkv") returned 5 [0051.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.mp3") returned 0 [0051.671] lstrlenA (lpString="*.mp3") returned 5 [0051.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.wav") returned 0 [0051.671] lstrlenA (lpString="*.wav") returned 5 [0051.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.flac") returned 0 [0051.671] lstrlenA (lpString="*.flac") returned 6 [0051.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.ape") returned 0 [0051.671] lstrlenA (lpString="*.ape") returned 5 [0051.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.wma") returned 0 [0051.671] lstrlenA (lpString="*.wma") returned 5 [0051.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.ac3") returned 0 [0051.672] lstrlenA (lpString="*.ac3") returned 5 [0051.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", pszSpec="*.mxf") returned 0 [0051.672] lstrlenA (lpString="*.mxf") returned 5 [0051.672] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe58e2200, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe58e2200, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x3896, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19986_.WMF", cAlternateFileName="")) returned 1 [0051.672] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.672] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD19986_.WMF") returned 1 [0051.672] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD19986_.WMF") returned 1 [0051.672] lstrcmpiA (lpString1="", lpString2="BD19986_.WMF") returned -1 [0051.672] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned="BD19828_.WMF" [0051.672] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.672] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.672] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.672] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.672] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD19986_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" [0051.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.zip") returned 0 [0051.672] lstrlenA (lpString="*.zip") returned 5 [0051.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.rar") returned 0 [0051.672] lstrlenA (lpString="*.rar") returned 5 [0051.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.7z") returned 0 [0051.672] lstrlenA (lpString="*.7z") returned 4 [0051.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.tar") returned 0 [0051.672] lstrlenA (lpString="*.tar") returned 5 [0051.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.gzip") returned 0 [0051.673] lstrlenA (lpString="*.gzip") returned 6 [0051.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.jpg") returned 0 [0051.673] lstrlenA (lpString="*.jpg") returned 5 [0051.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.jpeg") returned 0 [0051.673] lstrlenA (lpString="*.jpeg") returned 6 [0051.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.psd") returned 0 [0051.673] lstrlenA (lpString="*.psd") returned 5 [0051.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.gif") returned 0 [0051.673] lstrlenA (lpString="*.gif") returned 5 [0051.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.doc") returned 0 [0051.673] lstrlenA (lpString="*.doc") returned 5 [0051.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.docx") returned 0 [0051.673] lstrlenA (lpString="*.docx") returned 6 [0051.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.xls") returned 0 [0051.673] lstrlenA (lpString="*.xls") returned 5 [0051.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.xlsx") returned 0 [0051.673] lstrlenA (lpString="*.xlsx") returned 6 [0051.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.ppt") returned 0 [0051.673] lstrlenA (lpString="*.ppt") returned 5 [0051.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.pptx") returned 0 [0051.673] lstrlenA (lpString="*.pptx") returned 6 [0051.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.pdf") returned 0 [0051.673] lstrlenA (lpString="*.pdf") returned 5 [0051.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.mov") returned 0 [0051.673] lstrlenA (lpString="*.mov") returned 5 [0051.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.m2v") returned 0 [0051.673] lstrlenA (lpString="*.m2v") returned 5 [0051.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.3gp") returned 0 [0051.674] lstrlenA (lpString="*.3gp") returned 5 [0051.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.mpeg") returned 0 [0051.674] lstrlenA (lpString="*.mpeg") returned 6 [0051.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.mpg") returned 0 [0051.674] lstrlenA (lpString="*.mpg") returned 5 [0051.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.flv") returned 0 [0051.674] lstrlenA (lpString="*.flv") returned 5 [0051.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.avi") returned 0 [0051.674] lstrlenA (lpString="*.avi") returned 5 [0051.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.mp4") returned 0 [0051.674] lstrlenA (lpString="*.mp4") returned 5 [0051.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.wmv") returned 0 [0051.674] lstrlenA (lpString="*.wmv") returned 5 [0051.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.divx") returned 0 [0051.674] lstrlenA (lpString="*.divx") returned 6 [0051.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.mkv") returned 0 [0051.674] lstrlenA (lpString="*.mkv") returned 5 [0051.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.mp3") returned 0 [0051.674] lstrlenA (lpString="*.mp3") returned 5 [0051.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.wav") returned 0 [0051.674] lstrlenA (lpString="*.wav") returned 5 [0051.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.flac") returned 0 [0051.674] lstrlenA (lpString="*.flac") returned 6 [0051.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.ape") returned 0 [0051.674] lstrlenA (lpString="*.ape") returned 5 [0051.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.wma") returned 0 [0051.675] lstrlenA (lpString="*.wma") returned 5 [0051.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.ac3") returned 0 [0051.675] lstrlenA (lpString="*.ac3") returned 5 [0051.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", pszSpec="*.mxf") returned 0 [0051.675] lstrlenA (lpString="*.mxf") returned 5 [0051.675] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1fa9b00, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1fa9b00, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x4780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19988_.WMF", cAlternateFileName="")) returned 1 [0051.675] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.675] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD19988_.WMF") returned 1 [0051.675] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD19988_.WMF") returned 1 [0051.675] lstrcmpiA (lpString1="", lpString2="BD19988_.WMF") returned -1 [0051.675] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned="BD19986_.WMF" [0051.675] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.675] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.675] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.675] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.675] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD19988_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" [0051.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.zip") returned 0 [0051.675] lstrlenA (lpString="*.zip") returned 5 [0051.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.rar") returned 0 [0051.675] lstrlenA (lpString="*.rar") returned 5 [0051.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.7z") returned 0 [0051.675] lstrlenA (lpString="*.7z") returned 4 [0051.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.tar") returned 0 [0051.675] lstrlenA (lpString="*.tar") returned 5 [0051.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.gzip") returned 0 [0051.676] lstrlenA (lpString="*.gzip") returned 6 [0051.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.jpg") returned 0 [0051.676] lstrlenA (lpString="*.jpg") returned 5 [0051.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.jpeg") returned 0 [0051.676] lstrlenA (lpString="*.jpeg") returned 6 [0051.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.psd") returned 0 [0051.676] lstrlenA (lpString="*.psd") returned 5 [0051.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.gif") returned 0 [0051.676] lstrlenA (lpString="*.gif") returned 5 [0051.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.doc") returned 0 [0051.676] lstrlenA (lpString="*.doc") returned 5 [0051.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.docx") returned 0 [0051.676] lstrlenA (lpString="*.docx") returned 6 [0051.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.xls") returned 0 [0051.676] lstrlenA (lpString="*.xls") returned 5 [0051.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.xlsx") returned 0 [0051.676] lstrlenA (lpString="*.xlsx") returned 6 [0051.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.ppt") returned 0 [0051.676] lstrlenA (lpString="*.ppt") returned 5 [0051.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.pptx") returned 0 [0051.676] lstrlenA (lpString="*.pptx") returned 6 [0051.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.pdf") returned 0 [0051.676] lstrlenA (lpString="*.pdf") returned 5 [0051.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.mov") returned 0 [0051.676] lstrlenA (lpString="*.mov") returned 5 [0051.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.m2v") returned 0 [0051.677] lstrlenA (lpString="*.m2v") returned 5 [0051.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.3gp") returned 0 [0051.677] lstrlenA (lpString="*.3gp") returned 5 [0051.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.mpeg") returned 0 [0051.677] lstrlenA (lpString="*.mpeg") returned 6 [0051.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.mpg") returned 0 [0051.677] lstrlenA (lpString="*.mpg") returned 5 [0051.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.flv") returned 0 [0051.677] lstrlenA (lpString="*.flv") returned 5 [0051.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.avi") returned 0 [0051.677] lstrlenA (lpString="*.avi") returned 5 [0051.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.mp4") returned 0 [0051.677] lstrlenA (lpString="*.mp4") returned 5 [0051.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.wmv") returned 0 [0051.677] lstrlenA (lpString="*.wmv") returned 5 [0051.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.divx") returned 0 [0051.677] lstrlenA (lpString="*.divx") returned 6 [0051.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.mkv") returned 0 [0051.677] lstrlenA (lpString="*.mkv") returned 5 [0051.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.mp3") returned 0 [0051.677] lstrlenA (lpString="*.mp3") returned 5 [0051.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.wav") returned 0 [0051.677] lstrlenA (lpString="*.wav") returned 5 [0051.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.flac") returned 0 [0051.677] lstrlenA (lpString="*.flac") returned 6 [0051.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.ape") returned 0 [0051.678] lstrlenA (lpString="*.ape") returned 5 [0051.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.wma") returned 0 [0051.678] lstrlenA (lpString="*.wma") returned 5 [0051.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.ac3") returned 0 [0051.678] lstrlenA (lpString="*.ac3") returned 5 [0051.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", pszSpec="*.mxf") returned 0 [0051.678] lstrlenA (lpString="*.mxf") returned 5 [0051.678] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf688200, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf688200, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x2b32, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD20013_.WMF", cAlternateFileName="")) returned 1 [0051.678] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.678] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD20013_.WMF") returned 1 [0051.678] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD20013_.WMF") returned 1 [0051.678] lstrcmpiA (lpString1="", lpString2="BD20013_.WMF") returned -1 [0051.678] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned="BD19988_.WMF" [0051.678] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.678] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.678] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.678] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.678] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BD20013_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" [0051.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.zip") returned 0 [0051.678] lstrlenA (lpString="*.zip") returned 5 [0051.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.rar") returned 0 [0051.678] lstrlenA (lpString="*.rar") returned 5 [0051.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.7z") returned 0 [0051.679] lstrlenA (lpString="*.7z") returned 4 [0051.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.tar") returned 0 [0051.679] lstrlenA (lpString="*.tar") returned 5 [0051.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.gzip") returned 0 [0051.679] lstrlenA (lpString="*.gzip") returned 6 [0051.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.jpg") returned 0 [0051.679] lstrlenA (lpString="*.jpg") returned 5 [0051.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.jpeg") returned 0 [0051.679] lstrlenA (lpString="*.jpeg") returned 6 [0051.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.psd") returned 0 [0051.679] lstrlenA (lpString="*.psd") returned 5 [0051.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.gif") returned 0 [0051.679] lstrlenA (lpString="*.gif") returned 5 [0051.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.doc") returned 0 [0051.679] lstrlenA (lpString="*.doc") returned 5 [0051.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.docx") returned 0 [0051.679] lstrlenA (lpString="*.docx") returned 6 [0051.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.xls") returned 0 [0051.679] lstrlenA (lpString="*.xls") returned 5 [0051.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.xlsx") returned 0 [0051.679] lstrlenA (lpString="*.xlsx") returned 6 [0051.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.ppt") returned 0 [0051.679] lstrlenA (lpString="*.ppt") returned 5 [0051.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.pptx") returned 0 [0051.679] lstrlenA (lpString="*.pptx") returned 6 [0051.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.pdf") returned 0 [0051.680] lstrlenA (lpString="*.pdf") returned 5 [0051.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.mov") returned 0 [0051.680] lstrlenA (lpString="*.mov") returned 5 [0051.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.m2v") returned 0 [0051.680] lstrlenA (lpString="*.m2v") returned 5 [0051.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.3gp") returned 0 [0051.680] lstrlenA (lpString="*.3gp") returned 5 [0051.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.mpeg") returned 0 [0051.680] lstrlenA (lpString="*.mpeg") returned 6 [0051.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.mpg") returned 0 [0051.680] lstrlenA (lpString="*.mpg") returned 5 [0051.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.flv") returned 0 [0051.680] lstrlenA (lpString="*.flv") returned 5 [0051.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.avi") returned 0 [0051.680] lstrlenA (lpString="*.avi") returned 5 [0051.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.mp4") returned 0 [0051.680] lstrlenA (lpString="*.mp4") returned 5 [0051.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.wmv") returned 0 [0051.680] lstrlenA (lpString="*.wmv") returned 5 [0051.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.divx") returned 0 [0051.680] lstrlenA (lpString="*.divx") returned 6 [0051.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.mkv") returned 0 [0051.680] lstrlenA (lpString="*.mkv") returned 5 [0051.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.mp3") returned 0 [0051.680] lstrlenA (lpString="*.mp3") returned 5 [0051.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.wav") returned 0 [0051.680] lstrlenA (lpString="*.wav") returned 5 [0051.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.flac") returned 0 [0051.681] lstrlenA (lpString="*.flac") returned 6 [0051.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.ape") returned 0 [0051.681] lstrlenA (lpString="*.ape") returned 5 [0051.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.wma") returned 0 [0051.681] lstrlenA (lpString="*.wma") returned 5 [0051.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.ac3") returned 0 [0051.681] lstrlenA (lpString="*.ac3") returned 5 [0051.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", pszSpec="*.mxf") returned 0 [0051.681] lstrlenA (lpString="*.mxf") returned 5 [0051.681] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b147c00, ftCreationTime.dwHighDateTime=0x1bd4b34, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b147c00, ftLastWriteTime.dwHighDateTime=0x1bd4b34, nFileSizeHigh=0x0, nFileSizeLow=0x30e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00008_.WMF", cAlternateFileName="")) returned 1 [0051.681] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.681] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00008_.WMF") returned 1 [0051.681] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00008_.WMF") returned 1 [0051.681] lstrcmpiA (lpString1="", lpString2="BL00008_.WMF") returned -1 [0051.681] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned="BD20013_.WMF" [0051.681] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.681] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.681] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.681] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.681] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BL00008_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" [0051.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.zip") returned 0 [0051.681] lstrlenA (lpString="*.zip") returned 5 [0051.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.rar") returned 0 [0051.682] lstrlenA (lpString="*.rar") returned 5 [0051.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.7z") returned 0 [0051.682] lstrlenA (lpString="*.7z") returned 4 [0051.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.tar") returned 0 [0051.682] lstrlenA (lpString="*.tar") returned 5 [0051.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.gzip") returned 0 [0051.682] lstrlenA (lpString="*.gzip") returned 6 [0051.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.jpg") returned 0 [0051.682] lstrlenA (lpString="*.jpg") returned 5 [0051.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.jpeg") returned 0 [0051.682] lstrlenA (lpString="*.jpeg") returned 6 [0051.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.psd") returned 0 [0051.682] lstrlenA (lpString="*.psd") returned 5 [0051.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.gif") returned 0 [0051.682] lstrlenA (lpString="*.gif") returned 5 [0051.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.doc") returned 0 [0051.682] lstrlenA (lpString="*.doc") returned 5 [0051.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.docx") returned 0 [0051.682] lstrlenA (lpString="*.docx") returned 6 [0051.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.xls") returned 0 [0051.682] lstrlenA (lpString="*.xls") returned 5 [0051.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.xlsx") returned 0 [0051.682] lstrlenA (lpString="*.xlsx") returned 6 [0051.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.ppt") returned 0 [0051.682] lstrlenA (lpString="*.ppt") returned 5 [0051.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.pptx") returned 0 [0051.682] lstrlenA (lpString="*.pptx") returned 6 [0051.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.pdf") returned 0 [0051.683] lstrlenA (lpString="*.pdf") returned 5 [0051.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.mov") returned 0 [0051.683] lstrlenA (lpString="*.mov") returned 5 [0051.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.m2v") returned 0 [0051.683] lstrlenA (lpString="*.m2v") returned 5 [0051.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.3gp") returned 0 [0051.683] lstrlenA (lpString="*.3gp") returned 5 [0051.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.mpeg") returned 0 [0051.683] lstrlenA (lpString="*.mpeg") returned 6 [0051.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.mpg") returned 0 [0051.683] lstrlenA (lpString="*.mpg") returned 5 [0051.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.flv") returned 0 [0051.683] lstrlenA (lpString="*.flv") returned 5 [0051.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.avi") returned 0 [0051.683] lstrlenA (lpString="*.avi") returned 5 [0051.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.mp4") returned 0 [0051.683] lstrlenA (lpString="*.mp4") returned 5 [0051.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.wmv") returned 0 [0051.683] lstrlenA (lpString="*.wmv") returned 5 [0051.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.divx") returned 0 [0051.683] lstrlenA (lpString="*.divx") returned 6 [0051.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.mkv") returned 0 [0051.683] lstrlenA (lpString="*.mkv") returned 5 [0051.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.mp3") returned 0 [0051.684] lstrlenA (lpString="*.mp3") returned 5 [0051.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.wav") returned 0 [0051.684] lstrlenA (lpString="*.wav") returned 5 [0051.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.flac") returned 0 [0051.684] lstrlenA (lpString="*.flac") returned 6 [0051.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.ape") returned 0 [0051.684] lstrlenA (lpString="*.ape") returned 5 [0051.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.wma") returned 0 [0051.684] lstrlenA (lpString="*.wma") returned 5 [0051.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.ac3") returned 0 [0051.684] lstrlenA (lpString="*.ac3") returned 5 [0051.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", pszSpec="*.mxf") returned 0 [0051.684] lstrlenA (lpString="*.mxf") returned 5 [0051.684] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x851e9b00, ftCreationTime.dwHighDateTime=0x1bd4b34, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x851e9b00, ftLastWriteTime.dwHighDateTime=0x1bd4b34, nFileSizeHigh=0x0, nFileSizeLow=0x265a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00012_.WMF", cAlternateFileName="")) returned 1 [0051.684] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.684] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00012_.WMF") returned 1 [0051.684] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00012_.WMF") returned 1 [0051.684] lstrcmpiA (lpString1="", lpString2="BL00012_.WMF") returned -1 [0051.684] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned="BL00008_.WMF" [0051.684] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.684] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.684] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.685] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.685] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BL00012_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" [0051.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF", pszSpec="*.zip") returned 0 [0051.685] lstrlenA (lpString="*.zip") returned 5 [0051.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF", pszSpec="*.rar") returned 0 [0051.685] lstrlenA (lpString="*.rar") returned 5 [0051.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF", pszSpec="*.7z") returned 0 [0051.685] lstrlenA (lpString="*.7z") returned 4 [0051.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF", pszSpec="*.tar") returned 0 [0051.685] lstrlenA (lpString="*.tar") returned 5 [0051.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF", pszSpec="*.gzip") returned 0 [0051.685] lstrlenA (lpString="*.gzip") returned 6 [0051.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF", pszSpec="*.jpg") returned 0 [0051.685] lstrlenA (lpString="*.jpg") returned 5 [0051.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF", pszSpec="*.jpeg") returned 0 [0051.685] lstrlenA (lpString="*.jpeg") returned 6 [0051.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF", pszSpec="*.psd") returned 0 [0051.685] lstrlenA (lpString="*.psd") returned 5 [0051.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF", pszSpec="*.gif") returned 0 [0051.685] lstrlenA (lpString="*.gif") returned 5 [0051.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF", pszSpec="*.doc") returned 0 [0051.685] lstrlenA (lpString="*.doc") returned 5 [0051.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF", pszSpec="*.docx") returned 0 [0051.685] lstrlenA (lpString="*.docx") returned 6 [0051.686] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c98800, ftCreationTime.dwHighDateTime=0x1bd4b2b, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1c98800, ftLastWriteTime.dwHighDateTime=0x1bd4b2b, nFileSizeHigh=0x0, nFileSizeLow=0x1eb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00045_.WMF", cAlternateFileName="")) returned 1 [0051.686] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.686] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00045_.WMF") returned 1 [0051.686] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00045_.WMF") returned 1 [0051.686] lstrcmpiA (lpString1="", lpString2="BL00045_.WMF") returned -1 [0051.686] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned="BL00012_.WMF" [0051.686] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.686] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.686] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BL00045_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" [0051.686] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a40fd00, ftCreationTime.dwHighDateTime=0x1bd4b27, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a40fd00, ftLastWriteTime.dwHighDateTime=0x1bd4b27, nFileSizeHigh=0x0, nFileSizeLow=0x3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00098_.WMF", cAlternateFileName="")) returned 1 [0051.686] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.687] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00098_.WMF") returned 1 [0051.687] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00098_.WMF") returned 1 [0051.687] lstrcmpiA (lpString1="", lpString2="BL00098_.WMF") returned -1 [0051.687] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned="BL00045_.WMF" [0051.687] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.687] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.687] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.687] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.687] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BL00098_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" [0051.687] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x888a3600, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x888a3600, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00105_.WMF", cAlternateFileName="")) returned 1 [0051.687] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.687] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00105_.WMF") returned 1 [0051.687] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00105_.WMF") returned 1 [0051.687] lstrcmpiA (lpString1="", lpString2="BL00105_.WMF") returned -1 [0051.687] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned="BL00098_.WMF" [0051.687] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.687] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.687] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.687] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.687] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BL00105_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" [0051.688] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d0f5c00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d0f5c00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x27a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00122_.WMF", cAlternateFileName="")) returned 1 [0051.688] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.688] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00122_.WMF") returned 1 [0051.688] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00122_.WMF") returned 1 [0051.688] lstrcmpiA (lpString1="", lpString2="BL00122_.WMF") returned -1 [0051.688] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned="BL00105_.WMF" [0051.688] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.688] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.688] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.688] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.688] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BL00122_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" [0051.688] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39fc8c00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39fc8c00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x5b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00130_.WMF", cAlternateFileName="")) returned 1 [0051.688] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.688] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00130_.WMF") returned 1 [0051.688] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00130_.WMF") returned 1 [0051.688] lstrcmpiA (lpString1="", lpString2="BL00130_.WMF") returned -1 [0051.688] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned="BL00122_.WMF" [0051.688] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.688] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.688] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.688] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.689] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BL00130_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" [0051.689] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c58200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83c58200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00148_.WMF", cAlternateFileName="")) returned 1 [0051.689] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.693] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00148_.WMF") returned 1 [0051.693] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00148_.WMF") returned 1 [0051.693] lstrcmpiA (lpString1="", lpString2="BL00148_.WMF") returned -1 [0051.693] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned="BL00130_.WMF" [0051.693] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.693] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.693] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.693] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.693] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BL00148_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" [0051.694] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82945500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82945500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00152_.WMF", cAlternateFileName="")) returned 1 [0051.694] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.694] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00152_.WMF") returned 1 [0051.694] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00152_.WMF") returned 1 [0051.694] lstrcmpiA (lpString1="", lpString2="BL00152_.WMF") returned -1 [0051.694] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned="BL00148_.WMF" [0051.694] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.694] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.694] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.694] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.694] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BL00152_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" [0051.694] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a72500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a72500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0xf92, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00194_.WMF", cAlternateFileName="")) returned 1 [0051.694] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.694] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00194_.WMF") returned 1 [0051.694] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00194_.WMF") returned 1 [0051.694] lstrcmpiA (lpString1="", lpString2="BL00194_.WMF") returned -1 [0051.694] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned="BL00152_.WMF" [0051.694] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.694] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.694] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.695] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.695] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BL00194_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" [0051.695] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81632800, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81632800, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1f86, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00195_.WMF", cAlternateFileName="")) returned 1 [0051.695] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.695] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00195_.WMF") returned 1 [0051.695] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00195_.WMF") returned 1 [0051.695] lstrcmpiA (lpString1="", lpString2="BL00195_.WMF") returned -1 [0051.695] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned="BL00194_.WMF" [0051.695] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.695] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.695] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.695] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.695] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BL00195_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" [0051.695] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81891500, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81891500, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x2458, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00234_.WMF", cAlternateFileName="")) returned 1 [0051.695] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.695] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00234_.WMF") returned 1 [0051.695] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00234_.WMF") returned 1 [0051.695] lstrcmpiA (lpString1="", lpString2="BL00234_.WMF") returned -1 [0051.695] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned="BL00195_.WMF" [0051.696] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.696] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.696] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.696] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.696] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BL00234_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" [0051.696] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9438d00, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9438d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0xfb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00242_.WMF", cAlternateFileName="")) returned 1 [0051.696] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.696] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00242_.WMF") returned 1 [0051.696] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00242_.WMF") returned 1 [0051.696] lstrcmpiA (lpString1="", lpString2="BL00242_.WMF") returned -1 [0051.696] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned="BL00234_.WMF" [0051.696] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.696] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.696] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.696] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.696] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BL00242_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" [0051.697] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5124300, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5124300, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x386c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00247_.WMF", cAlternateFileName="")) returned 1 [0051.697] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.697] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00247_.WMF") returned 1 [0051.697] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00247_.WMF") returned 1 [0051.697] lstrcmpiA (lpString1="", lpString2="BL00247_.WMF") returned -1 [0051.697] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned="BL00242_.WMF" [0051.697] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.697] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.697] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.697] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.697] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="BL00247_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" [0051.697] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b9eb00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b9eb00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00248_.WMF", cAlternateFileName="")) returned 1 [0051.697] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.697] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00248_.WMF") returned 1 [0051.697] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00248_.WMF") returned 1 [0051.697] lstrcmpiA (lpString1="", lpString2="BL00248_.WMF") returned -1 [0051.697] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned="BL00247_.WMF" [0051.697] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.697] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.698] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" [0051.698] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\how to decrypt files.txt")) returned 0x20 [0051.698] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b67a200, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b67a200, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x1264, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00252_.WMF", cAlternateFileName="")) returned 1 [0051.698] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.698] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00252_.WMF") returned 1 [0051.698] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00252_.WMF") returned 1 [0051.698] lstrcmpiA (lpString1="", lpString2="BL00252_.WMF") returned -1 [0051.698] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned="BL00248_.WMF" [0051.698] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.698] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.700] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9e7400, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9e7400, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00254_.WMF", cAlternateFileName="")) returned 1 [0051.700] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.700] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00254_.WMF") returned 1 [0051.700] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00254_.WMF") returned 1 [0051.700] lstrcmpiA (lpString1="", lpString2="BL00254_.WMF") returned -1 [0051.700] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned="BL00252_.WMF" [0051.700] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.700] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.700] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ae0bf00, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ae0bf00, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00261_.WMF", cAlternateFileName="")) returned 1 [0051.700] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.700] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00261_.WMF") returned 1 [0051.700] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00261_.WMF") returned 1 [0051.700] lstrcmpiA (lpString1="", lpString2="BL00261_.WMF") returned -1 [0051.700] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned="BL00254_.WMF" [0051.700] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.700] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.700] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63b9b100, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63b9b100, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00262_.WMF", cAlternateFileName="")) returned 1 [0051.700] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.700] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00262_.WMF") returned 1 [0051.700] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00262_.WMF") returned 1 [0051.700] lstrcmpiA (lpString1="", lpString2="BL00262_.WMF") returned -1 [0051.700] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned="BL00261_.WMF" [0051.701] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.701] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.701] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaca6c00, ftCreationTime.dwHighDateTime=0x1bd4b12, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcaca6c00, ftLastWriteTime.dwHighDateTime=0x1bd4b12, nFileSizeHigh=0x0, nFileSizeLow=0x1678, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00265_.WMF", cAlternateFileName="")) returned 1 [0051.701] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.701] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00265_.WMF") returned 1 [0051.701] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00265_.WMF") returned 1 [0051.701] lstrcmpiA (lpString1="", lpString2="BL00265_.WMF") returned -1 [0051.701] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned="BL00262_.WMF" [0051.701] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.701] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.701] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2253700, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2253700, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00267_.WMF", cAlternateFileName="")) returned 1 [0051.701] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.701] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00267_.WMF") returned 1 [0051.701] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00267_.WMF") returned 1 [0051.701] lstrcmpiA (lpString1="", lpString2="BL00267_.WMF") returned -1 [0051.701] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned="BL00265_.WMF" [0051.701] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.701] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.701] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbde25400, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbde25400, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00269_.WMF", cAlternateFileName="")) returned 1 [0051.701] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.701] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00269_.WMF") returned 1 [0051.702] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00269_.WMF") returned 1 [0051.702] lstrcmpiA (lpString1="", lpString2="BL00269_.WMF") returned -1 [0051.702] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned="BL00267_.WMF" [0051.702] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.702] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.702] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d095f00, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d095f00, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00270_.WMF", cAlternateFileName="")) returned 1 [0051.702] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.702] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00270_.WMF") returned 1 [0051.702] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00270_.WMF") returned 1 [0051.702] lstrcmpiA (lpString1="", lpString2="BL00270_.WMF") returned -1 [0051.702] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned="BL00269_.WMF" [0051.702] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.702] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.702] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd2a9800, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd2a9800, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00273_.WMF", cAlternateFileName="")) returned 1 [0051.702] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.702] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00273_.WMF") returned 1 [0051.702] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00273_.WMF") returned 1 [0051.702] lstrcmpiA (lpString1="", lpString2="BL00273_.WMF") returned -1 [0051.702] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned="BL00270_.WMF" [0051.702] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.703] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.703] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e80900, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9e80900, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0x1044, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00274_.WMF", cAlternateFileName="")) returned 1 [0051.703] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.703] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00274_.WMF") returned 1 [0051.703] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00274_.WMF") returned 1 [0051.703] lstrcmpiA (lpString1="", lpString2="BL00274_.WMF") returned -1 [0051.703] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned="BL00273_.WMF" [0051.703] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.703] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.703] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac309900, ftCreationTime.dwHighDateTime=0x1bd4b43, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac309900, ftLastWriteTime.dwHighDateTime=0x1bd4b43, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00296_.WMF", cAlternateFileName="")) returned 1 [0051.703] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.703] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00296_.WMF") returned 1 [0051.703] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00296_.WMF") returned 1 [0051.703] lstrcmpiA (lpString1="", lpString2="BL00296_.WMF") returned -1 [0051.703] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned="BL00274_.WMF" [0051.703] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.703] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.703] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf533800, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf533800, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x332e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00390_.WMF", cAlternateFileName="")) returned 1 [0051.703] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.703] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00390_.WMF") returned 1 [0051.704] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00390_.WMF") returned 1 [0051.704] lstrcmpiA (lpString1="", lpString2="BL00390_.WMF") returned -1 [0051.704] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned="BL00296_.WMF" [0051.704] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.704] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.704] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf0de00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcf0de00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x69aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00392_.WMF", cAlternateFileName="")) returned 1 [0051.704] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.704] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00392_.WMF") returned 1 [0051.704] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00392_.WMF") returned 1 [0051.704] lstrcmpiA (lpString1="", lpString2="BL00392_.WMF") returned -1 [0051.704] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned="BL00390_.WMF" [0051.704] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.704] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.704] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd65d6900, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd65d6900, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00524_.WMF", cAlternateFileName="")) returned 1 [0051.704] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.704] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00524_.WMF") returned 1 [0051.704] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00524_.WMF") returned 1 [0051.704] lstrcmpiA (lpString1="", lpString2="BL00524_.WMF") returned -1 [0051.704] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned="BL00392_.WMF" [0051.704] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.704] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.705] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd52c3c00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd52c3c00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x2576, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00525_.WMF", cAlternateFileName="")) returned 1 [0051.706] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.706] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00525_.WMF") returned 1 [0051.706] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00525_.WMF") returned 1 [0051.706] lstrcmpiA (lpString1="", lpString2="BL00525_.WMF") returned -1 [0051.706] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned="BL00524_.WMF" [0051.706] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.706] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.707] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3fb0f00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3fb0f00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x6ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00526_.WMF", cAlternateFileName="")) returned 1 [0051.707] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.707] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00526_.WMF") returned 1 [0051.707] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00526_.WMF") returned 1 [0051.707] lstrcmpiA (lpString1="", lpString2="BL00526_.WMF") returned -1 [0051.707] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned="BL00525_.WMF" [0051.707] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.707] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.707] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20fce500, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20fce500, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x2cec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00648_.WMF", cAlternateFileName="")) returned 1 [0051.707] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.707] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00648_.WMF") returned 1 [0051.707] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00648_.WMF") returned 1 [0051.707] lstrcmpiA (lpString1="", lpString2="BL00648_.WMF") returned -1 [0051.707] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned="BL00526_.WMF" [0051.707] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.707] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.707] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeba4c700, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeba4c700, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00921_.WMF", cAlternateFileName="")) returned 1 [0051.707] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.707] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00921_.WMF") returned 1 [0051.707] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00921_.WMF") returned 1 [0051.708] lstrcmpiA (lpString1="", lpString2="BL00921_.WMF") returned -1 [0051.708] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned="BL00648_.WMF" [0051.708] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.708] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.708] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74832900, ftCreationTime.dwHighDateTime=0x1bd4bf7, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74832900, ftLastWriteTime.dwHighDateTime=0x1bd4bf7, nFileSizeHigh=0x0, nFileSizeLow=0x1870, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00923_.WMF", cAlternateFileName="")) returned 1 [0051.708] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.708] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00923_.WMF") returned 1 [0051.708] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00923_.WMF") returned 1 [0051.708] lstrcmpiA (lpString1="", lpString2="BL00923_.WMF") returned -1 [0051.708] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned="BL00921_.WMF" [0051.708] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.708] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.708] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c14, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00932_.WMF", cAlternateFileName="")) returned 1 [0051.708] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.708] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00932_.WMF") returned 1 [0051.709] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00932_.WMF") returned 1 [0051.709] lstrcmpiA (lpString1="", lpString2="BL00932_.WMF") returned -1 [0051.709] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned="BL00923_.WMF" [0051.709] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.709] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.709] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7d46d00, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7d46d00, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0xeb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00985_.WMF", cAlternateFileName="")) returned 1 [0051.709] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.709] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BL00985_.WMF") returned 1 [0051.709] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BL00985_.WMF") returned 1 [0051.709] lstrcmpiA (lpString1="", lpString2="BL00985_.WMF") returned -1 [0051.709] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned="BL00932_.WMF" [0051.709] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.709] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.709] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xd16, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOAT.WMF", cAlternateFileName="")) returned 1 [0051.709] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.709] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BOAT.WMF") returned 1 [0051.709] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BOAT.WMF") returned 1 [0051.709] lstrcmpiA (lpString1="", lpString2="BOAT.WMF") returned -1 [0051.709] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned="BL00985_.WMF" [0051.710] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.710] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.710] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x714c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOATINST.WMF", cAlternateFileName="")) returned 1 [0051.710] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.710] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BOATINST.WMF") returned 1 [0051.710] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BOATINST.WMF") returned 1 [0051.710] lstrcmpiA (lpString1="", lpString2="BOATINST.WMF") returned -1 [0051.710] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned="BOAT.WMF" [0051.710] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.710] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.710] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77641800, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77641800, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00076_.WMF", cAlternateFileName="")) returned 1 [0051.710] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.710] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BS00076_.WMF") returned 1 [0051.710] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00076_.WMF") returned 1 [0051.710] lstrcmpiA (lpString1="", lpString2="BS00076_.WMF") returned -1 [0051.710] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned="BOATINST.WMF" [0051.710] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.710] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.711] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfadcd00, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfadcd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00078_.WMF", cAlternateFileName="")) returned 1 [0051.711] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.711] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BS00078_.WMF") returned 1 [0051.711] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00078_.WMF") returned 1 [0051.711] lstrcmpiA (lpString1="", lpString2="BS00078_.WMF") returned -1 [0051.711] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned="BS00076_.WMF" [0051.711] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.711] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.711] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6395c300, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6395c300, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1f26, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00092_.WMF", cAlternateFileName="")) returned 1 [0051.711] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.711] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BS00092_.WMF") returned 1 [0051.711] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00092_.WMF") returned 1 [0051.711] lstrcmpiA (lpString1="", lpString2="BS00092_.WMF") returned -1 [0051.711] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned="BS00078_.WMF" [0051.711] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.711] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.711] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60023c00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60023c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x94a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00100_.WMF", cAlternateFileName="")) returned 1 [0051.711] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.712] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BS00100_.WMF") returned 1 [0051.712] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00100_.WMF") returned 1 [0051.712] lstrcmpiA (lpString1="", lpString2="BS00100_.WMF") returned -1 [0051.712] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned="BS00092_.WMF" [0051.712] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.712] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.712] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c6eb500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c6eb500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00135_.WMF", cAlternateFileName="")) returned 1 [0051.712] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.712] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BS00135_.WMF") returned 1 [0051.712] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00135_.WMF") returned 1 [0051.712] lstrcmpiA (lpString1="", lpString2="BS00135_.WMF") returned -1 [0051.712] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned="BS00100_.WMF" [0051.712] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.712] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.712] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5295200, ftCreationTime.dwHighDateTime=0x1bd4b23, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5295200, ftLastWriteTime.dwHighDateTime=0x1bd4b23, nFileSizeHigh=0x0, nFileSizeLow=0x876, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00136_.WMF", cAlternateFileName="")) returned 1 [0051.712] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.712] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BS00136_.WMF") returned 1 [0051.713] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00136_.WMF") returned 1 [0051.713] lstrcmpiA (lpString1="", lpString2="BS00136_.WMF") returned -1 [0051.713] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned="BS00135_.WMF" [0051.713] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.713] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.713] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99a2a00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99a2a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00145_.WMF", cAlternateFileName="")) returned 1 [0051.713] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.713] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BS00145_.WMF") returned 1 [0051.713] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00145_.WMF") returned 1 [0051.713] lstrcmpiA (lpString1="", lpString2="BS00145_.WMF") returned -1 [0051.713] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned="BS00136_.WMF" [0051.713] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.713] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.713] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ca47100, ftCreationTime.dwHighDateTime=0x1bd4af0, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ca47100, ftLastWriteTime.dwHighDateTime=0x1bd4af0, nFileSizeHigh=0x0, nFileSizeLow=0x20ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00174_.WMF", cAlternateFileName="")) returned 1 [0051.713] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.713] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BS00174_.WMF") returned 1 [0051.713] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00174_.WMF") returned 1 [0051.713] lstrcmpiA (lpString1="", lpString2="BS00174_.WMF") returned -1 [0051.713] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned="BS00145_.WMF" [0051.713] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.713] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.714] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f738600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f738600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x1370, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00184_.WMF", cAlternateFileName="")) returned 1 [0051.714] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.714] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BS00184_.WMF") returned 1 [0051.714] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00184_.WMF") returned 1 [0051.714] lstrcmpiA (lpString1="", lpString2="BS00184_.WMF") returned -1 [0051.714] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned="BS00174_.WMF" [0051.714] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.714] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.714] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c60b600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c60b600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x31f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00186_.WMF", cAlternateFileName="")) returned 1 [0051.714] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.714] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BS00186_.WMF") returned 1 [0051.714] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00186_.WMF") returned 1 [0051.714] lstrcmpiA (lpString1="", lpString2="BS00186_.WMF") returned -1 [0051.714] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned="BS00184_.WMF" [0051.714] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.714] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.714] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9efd600, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9efd600, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00200_.WMF", cAlternateFileName="")) returned 1 [0051.714] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.715] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BS00200_.WMF") returned 1 [0051.715] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00200_.WMF") returned 1 [0051.715] lstrcmpiA (lpString1="", lpString2="BS00200_.WMF") returned -1 [0051.715] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned="BS00186_.WMF" [0051.715] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.715] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.715] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54fadc00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54fadc00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00224_.WMF", cAlternateFileName="")) returned 1 [0051.715] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.715] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BS00224_.WMF") returned 1 [0051.715] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00224_.WMF") returned 1 [0051.715] lstrcmpiA (lpString1="", lpString2="BS00224_.WMF") returned -1 [0051.715] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned="BS00200_.WMF" [0051.715] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.715] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.715] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c55700, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x62c55700, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00438_.WMF", cAlternateFileName="")) returned 1 [0051.715] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.715] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BS00438_.WMF") returned 1 [0051.715] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00438_.WMF") returned 1 [0051.715] lstrcmpiA (lpString1="", lpString2="BS00438_.WMF") returned -1 [0051.716] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned="BS00224_.WMF" [0051.716] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.716] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.716] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x276b5e00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x276b5e00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00439_.WMF", cAlternateFileName="")) returned 1 [0051.716] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.716] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BS00439_.WMF") returned 1 [0051.716] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00439_.WMF") returned 1 [0051.716] lstrcmpiA (lpString1="", lpString2="BS00439_.WMF") returned -1 [0051.716] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned="BS00438_.WMF" [0051.716] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.716] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.716] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x263a3100, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x263a3100, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x15cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00440_.WMF", cAlternateFileName="")) returned 1 [0051.716] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.716] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BS00440_.WMF") returned 1 [0051.716] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00440_.WMF") returned 1 [0051.716] lstrcmpiA (lpString1="", lpString2="BS00440_.WMF") returned -1 [0051.716] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned="BS00439_.WMF" [0051.717] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.717] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.717] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25090400, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25090400, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00441_.WMF", cAlternateFileName="")) returned 1 [0051.717] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.717] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BS00441_.WMF") returned 1 [0051.717] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00441_.WMF") returned 1 [0051.717] lstrcmpiA (lpString1="", lpString2="BS00441_.WMF") returned -1 [0051.717] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned="BS00440_.WMF" [0051.717] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.717] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.717] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d7d700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23d7d700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00442_.WMF", cAlternateFileName="")) returned 1 [0051.717] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.717] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BS00442_.WMF") returned 1 [0051.717] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00442_.WMF") returned 1 [0051.717] lstrcmpiA (lpString1="", lpString2="BS00442_.WMF") returned -1 [0051.717] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned="BS00441_.WMF" [0051.717] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.717] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.718] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb7ffa00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb7ffa00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00443_.WMF", cAlternateFileName="")) returned 1 [0051.718] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.718] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BS00443_.WMF") returned 1 [0051.718] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00443_.WMF") returned 1 [0051.718] lstrcmpiA (lpString1="", lpString2="BS00443_.WMF") returned -1 [0051.718] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned="BS00442_.WMF" [0051.718] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.718] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.718] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a6aa00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22a6aa00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00444_.WMF", cAlternateFileName="")) returned 1 [0051.718] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.718] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BS00444_.WMF") returned 1 [0051.718] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00444_.WMF") returned 1 [0051.718] lstrcmpiA (lpString1="", lpString2="BS00444_.WMF") returned -1 [0051.718] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned="BS00443_.WMF" [0051.718] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.718] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.718] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21757d00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21757d00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00445_.WMF", cAlternateFileName="")) returned 1 [0051.718] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.718] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BS00445_.WMF") returned 1 [0051.719] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00445_.WMF") returned 1 [0051.719] lstrcmpiA (lpString1="", lpString2="BS00445_.WMF") returned -1 [0051.719] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned="BS00444_.WMF" [0051.719] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.719] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.719] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00453_.WMF", cAlternateFileName="")) returned 1 [0051.719] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.719] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BS00453_.WMF") returned 1 [0051.719] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS00453_.WMF") returned 1 [0051.719] lstrcmpiA (lpString1="", lpString2="BS00453_.WMF") returned -1 [0051.719] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned="BS00445_.WMF" [0051.719] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.719] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.719] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ba86700, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ba86700, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01080_.WMF", cAlternateFileName="")) returned 1 [0051.719] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.719] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BS01080_.WMF") returned 1 [0051.719] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS01080_.WMF") returned 1 [0051.719] lstrcmpiA (lpString1="", lpString2="BS01080_.WMF") returned -1 [0051.719] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned="BS00453_.WMF" [0051.720] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.720] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.720] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d186600, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d186600, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1c08, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01603_.WMF", cAlternateFileName="")) returned 1 [0051.720] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.720] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BS01603_.WMF") returned 1 [0051.720] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS01603_.WMF") returned 1 [0051.720] lstrcmpiA (lpString1="", lpString2="BS01603_.WMF") returned -1 [0051.720] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned="BS01080_.WMF" [0051.720] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.720] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.720] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc31ccd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc31ccd00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xda6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01634_.WMF", cAlternateFileName="")) returned 1 [0051.720] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.720] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BS01634_.WMF") returned 1 [0051.720] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS01634_.WMF") returned 1 [0051.720] lstrcmpiA (lpString1="", lpString2="BS01634_.WMF") returned -1 [0051.720] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned="BS01603_.WMF" [0051.720] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.720] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.720] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63bebd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63bebd00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01635_.WMF", cAlternateFileName="")) returned 1 [0051.721] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.721] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BS01635_.WMF") returned 1 [0051.721] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS01635_.WMF") returned 1 [0051.721] lstrcmpiA (lpString1="", lpString2="BS01635_.WMF") returned -1 [0051.721] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned="BS01634_.WMF" [0051.721] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.721] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.721] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe440e600, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe440e600, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x752, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01636_.WMF", cAlternateFileName="")) returned 1 [0051.722] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.722] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BS01636_.WMF") returned 1 [0051.722] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS01636_.WMF") returned 1 [0051.722] lstrcmpiA (lpString1="", lpString2="BS01636_.WMF") returned -1 [0051.722] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned="BS01635_.WMF" [0051.722] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.722] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.722] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910b6b00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x910b6b00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xf6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01637_.WMF", cAlternateFileName="")) returned 1 [0051.722] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.722] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BS01637_.WMF") returned 1 [0051.722] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS01637_.WMF") returned 1 [0051.722] lstrcmpiA (lpString1="", lpString2="BS01637_.WMF") returned -1 [0051.722] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned="BS01636_.WMF" [0051.722] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.722] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.723] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd16ae900, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd16ae900, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x292a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01638_.WMF", cAlternateFileName="")) returned 1 [0051.723] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.723] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BS01638_.WMF") returned 1 [0051.723] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS01638_.WMF") returned 1 [0051.723] lstrcmpiA (lpString1="", lpString2="BS01638_.WMF") returned -1 [0051.723] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned="BS01637_.WMF" [0051.723] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.723] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.723] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c32800, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88c32800, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x108c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01639_.WMF", cAlternateFileName="")) returned 1 [0051.723] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.723] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BS01639_.WMF") returned 1 [0051.723] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BS01639_.WMF") returned 1 [0051.723] lstrcmpiA (lpString1="", lpString2="BS01639_.WMF") returned -1 [0051.723] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned="BS01638_.WMF" [0051.723] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.723] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.723] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x246a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CARBN_01.MID", cAlternateFileName="")) returned 1 [0051.723] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.723] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CARBN_01.MID") returned 1 [0051.723] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CARBN_01.MID") returned 1 [0051.724] lstrcmpiA (lpString1="", lpString2="CARBN_01.MID") returned -1 [0051.724] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned="BS01639_.WMF" [0051.724] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.724] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.724] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceceee00, ftCreationTime.dwHighDateTime=0x1c9b81d, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xceceee00, ftLastWriteTime.dwHighDateTime=0x1c9b81d, nFileSizeHigh=0x0, nFileSizeLow=0xdec, dwReserved0=0x0, dwReserved1=0x0, cFileName="CG1606.WMF", cAlternateFileName="")) returned 1 [0051.724] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.724] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CG1606.WMF") returned 1 [0051.724] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CG1606.WMF") returned 1 [0051.724] lstrcmpiA (lpString1="", lpString2="CG1606.WMF") returned -1 [0051.724] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned="CARBN_01.MID" [0051.724] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.724] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.724] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLASSIC1.WMF", cAlternateFileName="")) returned 1 [0051.724] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.724] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CLASSIC1.WMF") returned 1 [0051.724] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CLASSIC1.WMF") returned 1 [0051.725] lstrcmpiA (lpString1="", lpString2="CLASSIC1.WMF") returned -1 [0051.725] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned="CG1606.WMF" [0051.725] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.725] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.725] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLASSIC2.WMF", cAlternateFileName="")) returned 1 [0051.725] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.725] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CLASSIC2.WMF") returned 1 [0051.725] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CLASSIC2.WMF") returned 1 [0051.725] lstrcmpiA (lpString1="", lpString2="CLASSIC2.WMF") returned -1 [0051.725] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned="CLASSIC1.WMF" [0051.725] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.725] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.725] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLIP.WMF", cAlternateFileName="")) returned 1 [0051.725] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.725] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CLIP.WMF") returned 1 [0051.725] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CLIP.WMF") returned 1 [0051.725] lstrcmpiA (lpString1="", lpString2="CLIP.WMF") returned -1 [0051.725] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned="CLASSIC2.WMF" [0051.725] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.725] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.726] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMNTY_01.MID", cAlternateFileName="")) returned 1 [0051.726] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.726] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CMNTY_01.MID") returned 1 [0051.726] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CMNTY_01.MID") returned 1 [0051.726] lstrcmpiA (lpString1="", lpString2="CMNTY_01.MID") returned -1 [0051.726] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned="CLIP.WMF" [0051.726] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.726] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.726] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51d0f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0x1496, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRANE.WMF", cAlternateFileName="")) returned 1 [0051.726] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.726] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CRANE.WMF") returned 1 [0051.726] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CRANE.WMF") returned 1 [0051.726] lstrcmpiA (lpString1="", lpString2="CRANE.WMF") returned -1 [0051.726] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned="CMNTY_01.MID" [0051.726] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.726] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.726] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x60609cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0xc18a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRANINST.WMF", cAlternateFileName="")) returned 1 [0051.726] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.726] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CRANINST.WMF") returned 1 [0051.726] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CRANINST.WMF") returned 1 [0051.726] lstrcmpiA (lpString1="", lpString2="CRANINST.WMF") returned -1 [0051.727] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned="CRANE.WMF" [0051.727] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.727] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.727] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUP.WMF", cAlternateFileName="")) returned 1 [0051.727] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.727] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CUP.WMF") returned 1 [0051.727] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CUP.WMF") returned 1 [0051.727] lstrcmpiA (lpString1="", lpString2="CUP.WMF") returned -1 [0051.727] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned="CRANINST.WMF" [0051.727] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.727] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.727] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x2856, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUPINST.WMF", cAlternateFileName="")) returned 1 [0051.727] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.727] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CUPINST.WMF") returned 1 [0051.727] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CUPINST.WMF") returned 1 [0051.727] lstrcmpiA (lpString1="", lpString2="CUPINST.WMF") returned -1 [0051.727] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned="CUP.WMF" [0051.727] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.727] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.727] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7992, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00117_.WMF", cAlternateFileName="")) returned 1 [0051.727] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.728] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned="CUPINST.WMF" [0051.728] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.728] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.728] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a43700, ftCreationTime.dwHighDateTime=0x1bd4aee, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6a43700, ftLastWriteTime.dwHighDateTime=0x1bd4aee, nFileSizeHigh=0x0, nFileSizeLow=0x2040, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00121_.WMF", cAlternateFileName="")) returned 1 [0051.728] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.728] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned="DD00117_.WMF" [0051.728] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.728] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.728] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x73bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00234_.WMF", cAlternateFileName="")) returned 1 [0051.728] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.728] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned="DD00121_.WMF" [0051.728] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.728] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.728] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf650000, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf650000, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0xa82, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00255_.WMF", cAlternateFileName="")) returned 1 [0051.728] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.728] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned="DD00234_.WMF" [0051.729] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.729] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.729] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00256_.WMF", cAlternateFileName="")) returned 1 [0051.729] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.729] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned="DD00255_.WMF" [0051.729] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.729] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.729] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe550c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe550c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x9456, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00261_.WMF", cAlternateFileName="")) returned 1 [0051.729] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.729] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned="DD00256_.WMF" [0051.729] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.729] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.729] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8572f00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8572f00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x9c5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00297_.WMF", cAlternateFileName="")) returned 1 [0051.729] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.729] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned="DD00261_.WMF" [0051.729] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.729] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.730] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d8c4300, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d8c4300, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00372_.WMF", cAlternateFileName="")) returned 1 [0051.730] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.730] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned="DD00297_.WMF" [0051.730] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.730] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.730] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00405_.WMF", cAlternateFileName="")) returned 1 [0051.730] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.730] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned="DD00372_.WMF" [0051.730] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.730] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.730] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e94, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00407_.WMF", cAlternateFileName="")) returned 1 [0051.730] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.730] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned="DD00405_.WMF" [0051.730] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.730] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.730] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa7f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00413_.WMF", cAlternateFileName="")) returned 1 [0051.730] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.730] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned="DD00407_.WMF" [0051.731] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.731] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.731] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa79c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00414_.WMF", cAlternateFileName="")) returned 1 [0051.731] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.731] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned="DD00413_.WMF" [0051.731] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.731] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.731] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba4ecd00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba4ecd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00419_.WMF", cAlternateFileName="")) returned 1 [0051.731] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.731] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned="DD00414_.WMF" [0051.731] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.731] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.731] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91da000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb91da000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x78c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00437_.WMF", cAlternateFileName="")) returned 1 [0051.731] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.731] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned="DD00419_.WMF" [0051.731] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.731] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.731] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00448_.WMF", cAlternateFileName="")) returned 1 [0051.732] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.732] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned="DD00437_.WMF" [0051.732] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.732] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.732] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2708, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00449_.WMF", cAlternateFileName="")) returned 1 [0051.732] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.732] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned="DD00448_.WMF" [0051.732] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.732] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.732] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac04fe00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac04fe00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5130, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00687_.WMF", cAlternateFileName="")) returned 1 [0051.732] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.732] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned="DD00449_.WMF" [0051.732] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.732] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.732] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcb1e00, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcb1e00, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x600c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00705_.WMF", cAlternateFileName="")) returned 1 [0051.732] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.732] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned="DD00687_.WMF" [0051.732] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.732] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.733] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb92d600, ftCreationTime.dwHighDateTime=0x1bd4b42, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb92d600, ftLastWriteTime.dwHighDateTime=0x1bd4b42, nFileSizeHigh=0x0, nFileSizeLow=0x8b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01015_.WMF", cAlternateFileName="")) returned 1 [0051.733] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.733] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned="DD00705_.WMF" [0051.733] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.733] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.733] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x39e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01039_.WMF", cAlternateFileName="")) returned 1 [0051.733] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.733] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned="DD01015_.WMF" [0051.733] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.733] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.733] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01138_.WMF", cAlternateFileName="")) returned 1 [0051.734] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.734] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned="DD01039_.WMF" [0051.734] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.734] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.734] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe30, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01139_.WMF", cAlternateFileName="")) returned 1 [0051.734] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.734] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned="DD01138_.WMF" [0051.734] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.734] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.735] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01140_.WMF", cAlternateFileName="")) returned 1 [0051.735] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.735] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned="DD01139_.WMF" [0051.735] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.735] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.735] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x85c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01143_.WMF", cAlternateFileName="")) returned 1 [0051.735] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.735] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned="DD01140_.WMF" [0051.735] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.735] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.735] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xadc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01145_.WMF", cAlternateFileName="")) returned 1 [0051.735] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.735] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned="DD01143_.WMF" [0051.735] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.735] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.735] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaec, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01146_.WMF", cAlternateFileName="")) returned 1 [0051.735] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.736] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned="DD01145_.WMF" [0051.736] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.736] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.736] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01151_.WMF", cAlternateFileName="")) returned 1 [0051.736] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.736] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned="DD01146_.WMF" [0051.736] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.736] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.736] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01152_.WMF", cAlternateFileName="")) returned 1 [0051.736] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.736] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned="DD01151_.WMF" [0051.736] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.736] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.736] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe04, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01157_.WMF", cAlternateFileName="")) returned 1 [0051.736] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.736] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned="DD01152_.WMF" [0051.736] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.736] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="" [0051.737] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01160_.WMF", cAlternateFileName="")) returned 1 [0051.737] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.737] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned="DD01157_.WMF" [0051.737] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01162_.WMF", cAlternateFileName="")) returned 1 [0051.737] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.756] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned="DD01160_.WMF" [0051.756] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01163_.WMF", cAlternateFileName="")) returned 1 [0051.756] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.756] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned="DD01162_.WMF" [0051.756] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01166_.WMF", cAlternateFileName="")) returned 1 [0051.756] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.756] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned="DD01163_.WMF" [0051.756] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01167_.WMF", cAlternateFileName="")) returned 1 [0051.756] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.756] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned="DD01166_.WMF" [0051.756] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01168_.WMF", cAlternateFileName="")) returned 1 [0051.756] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.756] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned="DD01167_.WMF" [0051.757] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01169_.WMF", cAlternateFileName="")) returned 1 [0051.757] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.757] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned="DD01168_.WMF" [0051.757] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x964, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01170_.WMF", cAlternateFileName="")) returned 1 [0051.757] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.757] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned="DD01169_.WMF" [0051.757] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01171_.WMF", cAlternateFileName="")) returned 1 [0051.757] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.757] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned="DD01170_.WMF" [0051.757] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01172_.WMF", cAlternateFileName="")) returned 1 [0051.757] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.757] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned="DD01171_.WMF" [0051.757] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x70c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01173_.WMF", cAlternateFileName="")) returned 1 [0051.757] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.757] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned="DD01172_.WMF" [0051.758] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01176_.WMF", cAlternateFileName="")) returned 1 [0051.758] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.758] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned="DD01173_.WMF" [0051.758] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01178_.WMF", cAlternateFileName="")) returned 1 [0051.758] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.758] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned="DD01176_.WMF" [0051.758] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01179_.WMF", cAlternateFileName="")) returned 1 [0051.758] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.758] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned="DD01178_.WMF" [0051.758] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x824, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01180_.WMF", cAlternateFileName="")) returned 1 [0051.758] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.758] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned="DD01179_.WMF" [0051.758] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01181_.WMF", cAlternateFileName="")) returned 1 [0051.758] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.759] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned="DD01180_.WMF" [0051.759] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01182_.WMF", cAlternateFileName="")) returned 1 [0051.759] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.759] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned="DD01181_.WMF" [0051.759] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01183_.WMF", cAlternateFileName="")) returned 1 [0051.759] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.759] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned="DD01182_.WMF" [0051.759] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9936cb00, ftCreationTime.dwHighDateTime=0x1bd4c0e, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9936cb00, ftLastWriteTime.dwHighDateTime=0x1bd4c0e, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01186_.WMF", cAlternateFileName="")) returned 1 [0051.759] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.759] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned="DD01183_.WMF" [0051.759] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4fe9900, ftCreationTime.dwHighDateTime=0x1c7a766, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4fe9900, ftLastWriteTime.dwHighDateTime=0x1c7a766, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01366_.WMF", cAlternateFileName="")) returned 1 [0051.759] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.759] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned="DD01186_.WMF" [0051.759] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81594a00, ftCreationTime.dwHighDateTime=0x1bd4c02, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81594a00, ftLastWriteTime.dwHighDateTime=0x1bd4c02, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01434_.WMF", cAlternateFileName="")) returned 1 [0051.759] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.759] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned="DD01366_.WMF" [0051.760] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55829800, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55829800, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x9dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01585_.WMF", cAlternateFileName="")) returned 1 [0051.760] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.760] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned="DD01434_.WMF" [0051.760] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf93000, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4bf93000, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x914, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01586_.WMF", cAlternateFileName="")) returned 1 [0051.760] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.760] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned="DD01585_.WMF" [0051.760] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf28f0200, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf28f0200, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x4a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01628_.WMF", cAlternateFileName="")) returned 1 [0051.760] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.760] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned="DD01586_.WMF" [0051.760] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa241400, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa241400, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01629_.WMF", cAlternateFileName="")) returned 1 [0051.760] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.760] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned="DD01628_.WMF" [0051.760] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef951100, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xef951100, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0x128, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01630_.WMF", cAlternateFileName="")) returned 1 [0051.762] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.762] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned="DD01629_.WMF" [0051.762] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8660ce00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8660ce00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01631_.WMF", cAlternateFileName="")) returned 1 [0051.762] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.762] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned="DD01630_.WMF" [0051.762] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1034, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01761_.WMF", cAlternateFileName="")) returned 1 [0051.762] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.762] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned="DD01631_.WMF" [0051.762] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01772_.WMF", cAlternateFileName="")) returned 1 [0051.763] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.763] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned="DD01761_.WMF" [0051.763] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01793_.WMF", cAlternateFileName="")) returned 1 [0051.763] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.763] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned="DD01772_.WMF" [0051.763] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51e3fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1815, dwReserved0=0x0, dwReserved1=0x0, cFileName="EAST_01.MID", cAlternateFileName="")) returned 1 [0051.763] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.763] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned="DD01793_.WMF" [0051.763] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd787d00, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x51f4a830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd787d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="ED00010_.WMF", cAlternateFileName="")) returned 1 [0051.763] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.763] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned="EAST_01.MID" [0051.763] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a81c00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x51f4a830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2a81c00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x32f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ED00019_.WMF", cAlternateFileName="")) returned 1 [0051.763] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.763] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned="ED00010_.WMF" [0051.763] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc465ee00, ftCreationTime.dwHighDateTime=0x1bd4bff, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc465ee00, ftLastWriteTime.dwHighDateTime=0x1bd4bff, nFileSizeHigh=0x0, nFileSizeLow=0xa8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ED00172_.WMF", cAlternateFileName="")) returned 1 [0051.764] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.764] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned="ED00019_.WMF" [0051.764] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95cb3000, ftCreationTime.dwHighDateTime=0x1bd4c5e, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95cb3000, ftLastWriteTime.dwHighDateTime=0x1bd4c5e, nFileSizeHigh=0x0, nFileSizeLow=0x1b2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ED00184_.WMF", cAlternateFileName="")) returned 1 [0051.764] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.764] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned="ED00172_.WMF" [0051.764] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d81900, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27d81900, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x3670, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00006_.WMF", cAlternateFileName="")) returned 1 [0051.764] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.764] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned="ED00184_.WMF" [0051.764] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57852200, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x57852200, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x1b1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00202_.WMF", cAlternateFileName="")) returned 1 [0051.764] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.764] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned="EN00006_.WMF" [0051.764] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7a68a00, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7a68a00, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x3044, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00222_.WMF", cAlternateFileName="")) returned 1 [0051.764] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.764] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned="EN00202_.WMF" [0051.765] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1dc9900, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1dc9900, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00242_.WMF", cAlternateFileName="")) returned 1 [0051.765] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.765] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned="EN00222_.WMF" [0051.765] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ec7300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7ec7300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x8e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00319_.WMF", cAlternateFileName="")) returned 1 [0051.765] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.765] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned="EN00242_.WMF" [0051.765] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bc3900, ftCreationTime.dwHighDateTime=0x1bd4af5, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bc3900, ftLastWriteTime.dwHighDateTime=0x1bd4af5, nFileSizeHigh=0x0, nFileSizeLow=0x2e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00320_.WMF", cAlternateFileName="")) returned 1 [0051.765] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.765] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned="EN00319_.WMF" [0051.765] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1131c200, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1131c200, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x439c, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00397_.WMF", cAlternateFileName="")) returned 1 [0051.765] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.765] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51904f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51904f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x1f08, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00902_.WMF", cAlternateFileName="")) returned 1 [0051.765] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.765] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2942, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPLR_01.MID", cAlternateFileName="")) returned 1 [0051.766] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.766] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x12ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="FALL_01.MID", cAlternateFileName="")) returned 1 [0051.766] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.766] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadef6200, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadef6200, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x45ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00074_.WMF", cAlternateFileName="")) returned 1 [0051.766] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.766] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa5bdb00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa5bdb00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x2eda, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00076_.WMF", cAlternateFileName="")) returned 1 [0051.766] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.766] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6bb4600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6bb4600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7620, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00077_.WMF", cAlternateFileName="")) returned 1 [0051.766] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.766] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb58a1900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb58a1900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x721c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00086_.WMF", cAlternateFileName="")) returned 1 [0051.766] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.766] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2c1c00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a2c1c00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x3772, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00090_.WMF", cAlternateFileName="")) returned 1 [0051.766] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.767] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb458ec00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb458ec00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x920e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00096_.WMF", cAlternateFileName="")) returned 1 [0051.767] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.767] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1f69200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1f69200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x3df0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00296_.WMF", cAlternateFileName="")) returned 1 [0051.767] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.767] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b40e00, ftCreationTime.dwHighDateTime=0x1bd4aee, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54b40e00, ftLastWriteTime.dwHighDateTime=0x1bd4aee, nFileSizeHigh=0x0, nFileSizeLow=0x4712, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00297_.WMF", cAlternateFileName="")) returned 1 [0051.767] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.767] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c56500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0c56500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xb6de, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00306_.WMF", cAlternateFileName="")) returned 1 [0051.767] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.767] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2c8c800, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2c8c800, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00336_.WMF", cAlternateFileName="")) returned 1 [0051.767] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.767] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf943800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf943800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xfea, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00361_.WMF", cAlternateFileName="")) returned 1 [0051.767] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.767] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb6bcf00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb6bcf00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00369_.WMF", cAlternateFileName="")) returned 1 [0051.767] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.767] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcdfcc00, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcdfcc00, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x20e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00382_.WMF", cAlternateFileName="")) returned 1 [0051.767] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.767] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae630b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae630b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00397_.WMF", cAlternateFileName="")) returned 1 [0051.767] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.767] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad31de00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad31de00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1ec6, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00403_.WMF", cAlternateFileName="")) returned 1 [0051.773] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.773] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac00b100, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac00b100, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2afa, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00414_.WMF", cAlternateFileName="")) returned 1 [0051.773] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.773] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaacf8400, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaacf8400, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x400c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00419_.WMF", cAlternateFileName="")) returned 1 [0051.773] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.773] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa86d2a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa86d2a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x12bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00428_.WMF", cAlternateFileName="")) returned 1 [0051.773] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.773] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa73bfd00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa73bfd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00435_.WMF", cAlternateFileName="")) returned 1 [0051.773] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.773] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60ad000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa60ad000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x13ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00438_.WMF", cAlternateFileName="")) returned 1 [0051.773] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.773] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4d9a300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4d9a300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x22de, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00455_.WMF", cAlternateFileName="")) returned 1 [0051.773] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.774] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3a87600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3a87600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x43fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00459_.WMF", cAlternateFileName="")) returned 1 [0051.774] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.774] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2774900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2774900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x5c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00543_.WMF", cAlternateFileName="")) returned 1 [0051.774] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.774] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf50d3100, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf50d3100, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x148c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00544_.WMF", cAlternateFileName="")) returned 1 [0051.774] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.774] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb4f600, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb4f600, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00564_.WMF", cAlternateFileName="")) returned 1 [0051.774] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.774] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4dd7200, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4dd7200, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00586_.WMF", cAlternateFileName="")) returned 1 [0051.774] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.774] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbef0a100, ftCreationTime.dwHighDateTime=0x1bd4b36, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbef0a100, ftLastWriteTime.dwHighDateTime=0x1bd4b36, nFileSizeHigh=0x0, nFileSizeLow=0x2b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00775_.WMF", cAlternateFileName="")) returned 1 [0051.774] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.774] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2364900, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2364900, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x2332, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00779_.WMF", cAlternateFileName="")) returned 1 [0051.774] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.774] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4adb300, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4adb300, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x3690, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00799_.WMF", cAlternateFileName="")) returned 1 [0051.774] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.774] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad86a500, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad86a500, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0xa6d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00814_.WMF", cAlternateFileName="")) returned 1 [0051.774] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.775] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fdeb00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95fdeb00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x3b3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00965_.WMF", cAlternateFileName="")) returned 1 [0051.775] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.775] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9963a600, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9963a600, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x121a, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01074_.WMF", cAlternateFileName="")) returned 1 [0051.775] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.775] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf455c700, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf455c700, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0x96c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01084_.WMF", cAlternateFileName="")) returned 1 [0051.775] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.775] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ff1000, ftCreationTime.dwHighDateTime=0x1bd4bfe, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ff1000, ftLastWriteTime.dwHighDateTime=0x1bd4bfe, nFileSizeHigh=0x0, nFileSizeLow=0x1378, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01176_.WMF", cAlternateFileName="")) returned 1 [0051.775] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.775] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d752900, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d752900, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0xf7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01191_.WMF", cAlternateFileName="")) returned 1 [0051.775] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.775] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97014c00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97014c00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x488, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01193_.WMF", cAlternateFileName="")) returned 1 [0051.775] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.775] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49e1a200, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49e1a200, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0x91c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01196_.WMF", cAlternateFileName="")) returned 1 [0051.775] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.775] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cfde00, ftCreationTime.dwHighDateTime=0x1bf3242, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80cfde00, ftLastWriteTime.dwHighDateTime=0x1bf3242, nFileSizeHigh=0x0, nFileSizeLow=0x284c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01548_.WMF", cAlternateFileName="")) returned 1 [0051.775] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.775] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4fe7000, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4fe7000, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x76ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01657_.WMF", cAlternateFileName="")) returned 1 [0051.776] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.776] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb44f00, ftCreationTime.dwHighDateTime=0x1bd4c0c, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4eb44f00, ftLastWriteTime.dwHighDateTime=0x1bd4c0c, nFileSizeHigh=0x0, nFileSizeLow=0x4604, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01658_.WMF", cAlternateFileName="")) returned 1 [0051.776] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.776] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02ca800, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf02ca800, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x79cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01659_.WMF", cAlternateFileName="")) returned 1 [0051.776] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.776] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd62f9d00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd62f9d00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x329e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD01660_.WMF", cAlternateFileName="")) returned 1 [0051.776] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.776] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02068_.WMF", cAlternateFileName="")) returned 1 [0051.776] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.776] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x88c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02071_.WMF", cAlternateFileName="")) returned 1 [0051.776] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.776] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x112c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02075_.WMF", cAlternateFileName="")) returned 1 [0051.776] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.776] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02088_.WMF", cAlternateFileName="")) returned 1 [0051.776] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.776] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02097_.WMF", cAlternateFileName="")) returned 1 [0051.777] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.777] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1234, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02115_.WMF", cAlternateFileName="")) returned 1 [0051.777] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.777] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf94, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02116_.WMF", cAlternateFileName="")) returned 1 [0051.778] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.778] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02141_.WMF", cAlternateFileName="")) returned 1 [0051.778] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.778] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1510, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02153_.WMF", cAlternateFileName="")) returned 1 [0051.778] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.778] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02158_.WMF", cAlternateFileName="")) returned 1 [0051.778] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.778] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc38, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02161_.WMF", cAlternateFileName="")) returned 1 [0051.778] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.779] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x32b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FINCL_01.MID", cAlternateFileName="")) returned 1 [0051.779] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.779] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2466, dwReserved0=0x0, dwReserved1=0x0, cFileName="FINCL_02.MID", cAlternateFileName="")) returned 1 [0051.779] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.779] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x617e41d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x816, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLAP.WMF", cAlternateFileName="")) returned 1 [0051.779] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.779] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRDEN_01.MID", cAlternateFileName="")) returned 1 [0051.779] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.787] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x52c3bfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x18bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRID_01.MID", cAlternateFileName="")) returned 1 [0051.787] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.787] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636ce600, ftCreationTime.dwHighDateTime=0x1bd4b2b, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x636ce600, ftLastWriteTime.dwHighDateTime=0x1bd4b2b, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00057_.WMF", cAlternateFileName="")) returned 1 [0051.787] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.787] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af3b00, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0af3b00, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00084_.WMF", cAlternateFileName="")) returned 1 [0051.787] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.787] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf81f1600, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf81f1600, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00231_.WMF", cAlternateFileName="")) returned 1 [0051.787] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.787] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0c84900, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0c84900, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00235_.WMF", cAlternateFileName="")) returned 1 [0051.787] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.788] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf971c00, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf971c00, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00236_.WMF", cAlternateFileName="")) returned 1 [0051.788] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.788] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cd54400, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cd54400, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00241_.WMF", cAlternateFileName="")) returned 1 [0051.788] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.788] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1461c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1461c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xe4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00260_.WMF", cAlternateFileName="")) returned 1 [0051.788] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.788] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa014ef00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa014ef00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00276_.WMF", cAlternateFileName="")) returned 1 [0051.788] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.788] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10883400, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10883400, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x5f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00334_.WMF", cAlternateFileName="")) returned 1 [0051.788] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.788] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe38a5000, ftCreationTime.dwHighDateTime=0x1bd4b19, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe38a5000, ftLastWriteTime.dwHighDateTime=0x1bd4b19, nFileSizeHigh=0x0, nFileSizeLow=0xce2, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00443_.WMF", cAlternateFileName="")) returned 1 [0051.788] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.788] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9cafd00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9cafd00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00513_.WMF", cAlternateFileName="")) returned 1 [0051.788] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.789] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6576c00, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6576c00, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00524_.WMF", cAlternateFileName="")) returned 1 [0051.789] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.789] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f51200, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3f51200, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x34e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00526_.WMF", cAlternateFileName="")) returned 1 [0051.789] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.789] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c3e500, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2c3e500, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x16a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00527_.WMF", cAlternateFileName="")) returned 1 [0051.789] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.789] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c49d600, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c49d600, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0xe86, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00546_.WMF", cAlternateFileName="")) returned 1 [0051.789] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.789] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48e63d00, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48e63d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00601_.WMF", cAlternateFileName="")) returned 1 [0051.789] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.789] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eb62b00, ftCreationTime.dwHighDateTime=0x1bd4b47, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5eb62b00, ftLastWriteTime.dwHighDateTime=0x1bd4b47, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00602_.WMF", cAlternateFileName="")) returned 1 [0051.789] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.789] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aad3100, ftCreationTime.dwHighDateTime=0x1bd4b1b, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1aad3100, ftLastWriteTime.dwHighDateTime=0x1bd4b1b, nFileSizeHigh=0x0, nFileSizeLow=0x3158, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00612_.WMF", cAlternateFileName="")) returned 1 [0051.789] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.790] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98237200, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98237200, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x2994, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00623_.WMF", cAlternateFileName="")) returned 1 [0051.790] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.790] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b873a00, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b873a00, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x844, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00625_.WMF", cAlternateFileName="")) returned 1 [0051.790] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.790] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5d7f800, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5d7f800, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x620, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00636_.WMF", cAlternateFileName="")) returned 1 [0051.790] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.790] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9db29500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9db29500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2ce2, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00669_.WMF", cAlternateFileName="")) returned 1 [0051.790] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.790] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39dc9c00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39dc9c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x2454, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00681_.WMF", cAlternateFileName="")) returned 1 [0051.790] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.790] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cf47e00, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3cf47e00, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0xfc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00685_.WMF", cAlternateFileName="")) returned 1 [0051.790] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.790] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c816800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c816800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x10f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00687_.WMF", cAlternateFileName="")) returned 1 [0051.792] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.792] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159db100, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x159db100, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0x1bac, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00688_.WMF", cAlternateFileName="")) returned 1 [0051.792] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.792] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b503b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b503b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1bba, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00693_.WMF", cAlternateFileName="")) returned 1 [0051.792] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.792] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7507bb00, ftCreationTime.dwHighDateTime=0x1bd4b36, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7507bb00, ftLastWriteTime.dwHighDateTime=0x1bd4b36, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01013_.WMF", cAlternateFileName="")) returned 1 [0051.792] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.792] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x47c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01015_.WMF", cAlternateFileName="")) returned 1 [0051.792] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.793] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436e0000, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x436e0000, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01058_.WMF", cAlternateFileName="")) returned 1 [0051.793] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.793] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39e49800, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39e49800, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01065_.WMF", cAlternateFileName="")) returned 1 [0051.793] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.793] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25a09b00, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25a09b00, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x1388, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01080_.WMF", cAlternateFileName="")) returned 1 [0051.793] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.793] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1cac, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01242_.WMF", cAlternateFileName="")) returned 1 [0051.793] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.793] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH01291_.WMF", cAlternateFileName="")) returned 1 [0051.793] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0051.806] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.807] CloseHandle (hObject=0x8c) returned 1 [0051.807] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.wannacry")) returned 1 [0051.812] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.812] CloseHandle (hObject=0x8c) returned 1 [0051.812] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.wannacry")) returned 1 [0051.842] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.842] CloseHandle (hObject=0x8c) returned 1 [0051.842] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.wannacry")) returned 1 [0051.848] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.848] CloseHandle (hObject=0x8c) returned 1 [0051.848] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.wannacry")) returned 1 [0051.855] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.855] CloseHandle (hObject=0x8c) returned 1 [0051.855] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.wannacry")) returned 1 [0051.859] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.859] CloseHandle (hObject=0x8c) returned 1 [0051.859] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.wannacry")) returned 1 [0051.864] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.865] CloseHandle (hObject=0x8c) returned 1 [0051.865] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.wannacry")) returned 1 [0051.869] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.869] CloseHandle (hObject=0x8c) returned 1 [0051.870] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.wannacry")) returned 1 [0051.873] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.873] CloseHandle (hObject=0x8c) returned 1 [0051.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.wannacry")) returned 1 [0051.876] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.876] CloseHandle (hObject=0x8c) returned 1 [0051.876] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.wannacry")) returned 1 [0051.881] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.881] CloseHandle (hObject=0x8c) returned 1 [0051.881] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.wannacry")) returned 1 [0051.887] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.887] CloseHandle (hObject=0x8c) returned 1 [0051.887] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.wannacry")) returned 1 [0051.890] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.890] CloseHandle (hObject=0x8c) returned 1 [0051.891] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.wannacry")) returned 1 [0051.894] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.894] CloseHandle (hObject=0x8c) returned 1 [0051.895] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.wannacry")) returned 1 [0051.900] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.900] CloseHandle (hObject=0x8c) returned 1 [0051.900] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.wannacry")) returned 1 [0051.905] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.905] CloseHandle (hObject=0x8c) returned 1 [0051.905] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.wannacry")) returned 1 [0051.909] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.909] CloseHandle (hObject=0x8c) returned 1 [0051.909] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.wannacry")) returned 1 [0051.914] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.914] CloseHandle (hObject=0x8c) returned 1 [0051.914] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.wannacry")) returned 1 [0051.918] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.918] CloseHandle (hObject=0x8c) returned 1 [0051.918] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.wannacry")) returned 1 [0051.921] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.921] CloseHandle (hObject=0x8c) returned 1 [0051.922] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.wannacry")) returned 1 [0051.924] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.925] CloseHandle (hObject=0x8c) returned 1 [0051.925] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.wannacry")) returned 1 [0051.929] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.929] CloseHandle (hObject=0x8c) returned 1 [0051.929] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.wannacry")) returned 1 [0051.933] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.933] CloseHandle (hObject=0x8c) returned 1 [0051.934] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.wannacry")) returned 1 [0051.937] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.937] CloseHandle (hObject=0x8c) returned 1 [0051.937] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.wannacry")) returned 1 [0051.940] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.940] CloseHandle (hObject=0x8c) returned 1 [0051.940] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.wannacry")) returned 1 [0051.950] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.950] CloseHandle (hObject=0x8c) returned 1 [0051.950] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif.wannacry")) returned 1 [0051.957] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.957] CloseHandle (hObject=0x8c) returned 1 [0051.958] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.wannacry")) returned 1 [0051.961] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.961] CloseHandle (hObject=0x8c) returned 1 [0051.962] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.wannacry")) returned 1 [0051.965] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.965] CloseHandle (hObject=0x8c) returned 1 [0051.966] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.wannacry")) returned 1 [0051.969] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.969] CloseHandle (hObject=0x8c) returned 1 [0051.969] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.wannacry")) returned 1 [0051.972] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.972] CloseHandle (hObject=0x8c) returned 1 [0051.972] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.wannacry")) returned 1 [0051.975] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.975] CloseHandle (hObject=0x8c) returned 1 [0051.976] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.wannacry")) returned 1 [0051.979] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.979] CloseHandle (hObject=0x8c) returned 1 [0051.979] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.wannacry")) returned 1 [0051.983] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.983] CloseHandle (hObject=0x8c) returned 1 [0051.983] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.wannacry")) returned 1 [0051.986] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.986] CloseHandle (hObject=0x8c) returned 1 [0051.986] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.wannacry")) returned 1 [0051.989] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0051.989] CloseHandle (hObject=0x8c) returned 1 [0051.990] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.wannacry")) returned 1 [0052.056] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.056] CloseHandle (hObject=0x8c) returned 1 [0052.056] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.wannacry")) returned 1 [0052.059] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.059] CloseHandle (hObject=0x8c) returned 1 [0052.059] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.wannacry")) returned 1 [0052.066] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.066] CloseHandle (hObject=0x8c) returned 1 [0052.066] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.wannacry")) returned 1 [0052.070] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.070] CloseHandle (hObject=0x8c) returned 1 [0052.070] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.wannacry")) returned 1 [0052.073] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.073] CloseHandle (hObject=0x8c) returned 1 [0052.073] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.wannacry")) returned 1 [0052.076] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.076] CloseHandle (hObject=0x8c) returned 1 [0052.076] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.wannacry")) returned 1 [0052.079] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.079] CloseHandle (hObject=0x8c) returned 1 [0052.079] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.wannacry")) returned 1 [0052.082] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.082] CloseHandle (hObject=0x8c) returned 1 [0052.082] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.wannacry")) returned 1 [0052.086] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.086] CloseHandle (hObject=0x8c) returned 1 [0052.086] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.wannacry")) returned 1 [0052.089] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.089] CloseHandle (hObject=0x8c) returned 1 [0052.089] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.wannacry")) returned 1 [0052.092] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.092] CloseHandle (hObject=0x8c) returned 1 [0052.092] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.wannacry")) returned 1 [0052.095] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.095] CloseHandle (hObject=0x8c) returned 1 [0052.095] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.wannacry")) returned 1 [0052.098] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.098] CloseHandle (hObject=0x8c) returned 1 [0052.098] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.wannacry")) returned 1 [0052.101] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.101] CloseHandle (hObject=0x8c) returned 1 [0052.101] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.wannacry")) returned 1 [0052.105] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.105] CloseHandle (hObject=0x8c) returned 1 [0052.106] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.wannacry")) returned 1 [0052.129] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.129] CloseHandle (hObject=0x8c) returned 1 [0052.129] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.wannacry")) returned 1 [0052.133] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.133] CloseHandle (hObject=0x8c) returned 1 [0052.134] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.wannacry")) returned 1 [0052.138] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.138] CloseHandle (hObject=0x8c) returned 1 [0052.138] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.wannacry")) returned 1 [0052.149] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.150] CloseHandle (hObject=0x8c) returned 1 [0052.150] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.wannacry")) returned 1 [0052.154] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.154] CloseHandle (hObject=0x8c) returned 1 [0052.154] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg.wannacry")) returned 1 [0052.158] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.158] CloseHandle (hObject=0x8c) returned 1 [0052.158] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg.wannacry")) returned 1 [0052.161] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.161] CloseHandle (hObject=0x8c) returned 1 [0052.161] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg.wannacry")) returned 1 [0052.167] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.167] CloseHandle (hObject=0x8c) returned 1 [0052.167] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg.wannacry")) returned 1 [0052.171] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.172] CloseHandle (hObject=0x8c) returned 1 [0052.172] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg.wannacry")) returned 1 [0052.175] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.175] CloseHandle (hObject=0x8c) returned 1 [0052.175] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg.wannacry")) returned 1 [0052.178] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.178] CloseHandle (hObject=0x8c) returned 1 [0052.179] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg.wannacry")) returned 1 [0052.181] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.181] CloseHandle (hObject=0x8c) returned 1 [0052.182] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg.wannacry")) returned 1 [0052.184] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.185] CloseHandle (hObject=0x8c) returned 1 [0052.185] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg.wannacry")) returned 1 [0052.188] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.188] CloseHandle (hObject=0x8c) returned 1 [0052.188] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg.wannacry")) returned 1 [0052.195] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.195] CloseHandle (hObject=0x8c) returned 1 [0052.195] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg.wannacry")) returned 1 [0052.199] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.200] CloseHandle (hObject=0x8c) returned 1 [0052.200] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg.wannacry")) returned 1 [0052.203] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.203] CloseHandle (hObject=0x8c) returned 1 [0052.203] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg.wannacry")) returned 1 [0052.207] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.207] CloseHandle (hObject=0x8c) returned 1 [0052.207] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg.wannacry")) returned 1 [0052.223] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.224] CloseHandle (hObject=0x8c) returned 1 [0052.224] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg.wannacry")) returned 1 [0052.229] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.229] CloseHandle (hObject=0x8c) returned 1 [0052.229] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg.wannacry")) returned 1 [0052.233] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.233] CloseHandle (hObject=0x8c) returned 1 [0052.233] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg.wannacry")) returned 1 [0052.237] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.237] CloseHandle (hObject=0x8c) returned 1 [0052.238] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg.wannacry")) returned 1 [0052.242] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.242] CloseHandle (hObject=0x8c) returned 1 [0052.243] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg.wannacry")) returned 1 [0052.256] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.256] CloseHandle (hObject=0x8c) returned 1 [0052.256] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg.wannacry")) returned 1 [0052.259] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.259] CloseHandle (hObject=0x8c) returned 1 [0052.259] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg.wannacry")) returned 1 [0052.262] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.262] CloseHandle (hObject=0x8c) returned 1 [0052.262] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg.wannacry")) returned 1 [0052.265] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.265] CloseHandle (hObject=0x8c) returned 1 [0052.265] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg.wannacry")) returned 1 [0052.269] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.269] CloseHandle (hObject=0x8c) returned 1 [0052.269] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg.wannacry")) returned 1 [0052.272] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.272] CloseHandle (hObject=0x8c) returned 1 [0052.273] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg.wannacry")) returned 1 [0052.277] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.278] CloseHandle (hObject=0x8c) returned 1 [0052.278] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg.wannacry")) returned 1 [0052.281] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.281] CloseHandle (hObject=0x8c) returned 1 [0052.282] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg.wannacry")) returned 1 [0052.286] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.286] CloseHandle (hObject=0x8c) returned 1 [0052.286] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg.wannacry")) returned 1 [0052.289] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.289] CloseHandle (hObject=0x8c) returned 1 [0052.289] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg.wannacry")) returned 1 [0052.294] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.294] CloseHandle (hObject=0x8c) returned 1 [0052.294] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg.wannacry")) returned 1 [0052.297] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.297] CloseHandle (hObject=0x8c) returned 1 [0052.298] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg.wannacry")) returned 1 [0052.302] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.302] CloseHandle (hObject=0x8c) returned 1 [0052.302] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg.wannacry")) returned 1 [0052.305] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.305] CloseHandle (hObject=0x8c) returned 1 [0052.305] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg.wannacry")) returned 1 [0052.308] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.308] CloseHandle (hObject=0x8c) returned 1 [0052.309] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg.wannacry")) returned 1 [0052.312] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.312] CloseHandle (hObject=0x8c) returned 1 [0052.312] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg.wannacry")) returned 1 [0052.316] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.316] CloseHandle (hObject=0x8c) returned 1 [0052.316] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg.wannacry")) returned 1 [0052.321] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.321] CloseHandle (hObject=0x8c) returned 1 [0052.322] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg.wannacry")) returned 1 [0052.325] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.325] CloseHandle (hObject=0x8c) returned 1 [0052.325] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg.wannacry")) returned 1 [0052.329] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.329] CloseHandle (hObject=0x8c) returned 1 [0052.329] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg.wannacry")) returned 1 [0052.334] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.334] CloseHandle (hObject=0x8c) returned 1 [0052.335] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg.wannacry")) returned 1 [0052.338] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.338] CloseHandle (hObject=0x8c) returned 1 [0052.338] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg.wannacry")) returned 1 [0052.342] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.342] CloseHandle (hObject=0x8c) returned 1 [0052.342] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg.wannacry")) returned 1 [0052.345] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.345] CloseHandle (hObject=0x8c) returned 1 [0052.346] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg.wannacry")) returned 1 [0052.349] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.349] CloseHandle (hObject=0x8c) returned 1 [0052.349] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg.wannacry")) returned 1 [0052.352] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.352] CloseHandle (hObject=0x8c) returned 1 [0052.352] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg.wannacry")) returned 1 [0052.356] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.356] CloseHandle (hObject=0x8c) returned 1 [0052.356] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg.wannacry")) returned 1 [0052.360] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.360] CloseHandle (hObject=0x8c) returned 1 [0052.360] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg.wannacry")) returned 1 [0052.363] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.363] CloseHandle (hObject=0x8c) returned 1 [0052.363] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg.wannacry")) returned 1 [0052.366] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.366] CloseHandle (hObject=0x8c) returned 1 [0052.366] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg.wannacry")) returned 1 [0052.369] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.370] CloseHandle (hObject=0x8c) returned 1 [0052.370] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg.wannacry")) returned 1 [0052.377] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.377] CloseHandle (hObject=0x8c) returned 1 [0052.377] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg.wannacry")) returned 1 [0052.380] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.380] CloseHandle (hObject=0x8c) returned 1 [0052.380] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg.wannacry")) returned 1 [0052.386] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.386] CloseHandle (hObject=0x8c) returned 1 [0052.386] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg.wannacry")) returned 1 [0052.390] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.390] CloseHandle (hObject=0x8c) returned 1 [0052.390] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg.wannacry")) returned 1 [0052.393] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.393] CloseHandle (hObject=0x8c) returned 1 [0052.393] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg.wannacry")) returned 1 [0052.398] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.398] CloseHandle (hObject=0x8c) returned 1 [0052.399] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg.wannacry")) returned 1 [0052.402] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.403] CloseHandle (hObject=0x8c) returned 1 [0052.403] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg.wannacry")) returned 1 [0052.406] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.406] CloseHandle (hObject=0x8c) returned 1 [0052.406] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg.wannacry")) returned 1 [0052.409] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.409] CloseHandle (hObject=0x8c) returned 1 [0052.409] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg.wannacry")) returned 1 [0052.413] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.413] CloseHandle (hObject=0x8c) returned 1 [0052.414] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg.wannacry")) returned 1 [0052.418] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.418] CloseHandle (hObject=0x8c) returned 1 [0052.418] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg.wannacry")) returned 1 [0052.422] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.422] CloseHandle (hObject=0x8c) returned 1 [0052.422] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg.wannacry")) returned 1 [0052.427] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.427] CloseHandle (hObject=0x8c) returned 1 [0052.427] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg.wannacry")) returned 1 [0052.431] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.431] CloseHandle (hObject=0x8c) returned 1 [0052.431] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg.wannacry")) returned 1 [0052.436] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.436] CloseHandle (hObject=0x8c) returned 1 [0052.436] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg.wannacry")) returned 1 [0052.440] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.440] CloseHandle (hObject=0x8c) returned 1 [0052.440] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg.wannacry")) returned 1 [0052.444] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.444] CloseHandle (hObject=0x8c) returned 1 [0052.445] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg.wannacry")) returned 1 [0052.453] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.453] CloseHandle (hObject=0x8c) returned 1 [0052.453] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg.wannacry")) returned 1 [0052.458] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.458] CloseHandle (hObject=0x8c) returned 1 [0052.458] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg.wannacry")) returned 1 [0052.463] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.463] CloseHandle (hObject=0x8c) returned 1 [0052.463] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg.wannacry")) returned 1 [0052.501] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.501] CloseHandle (hObject=0x8c) returned 1 [0052.501] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg.wannacry")) returned 1 [0052.508] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.508] CloseHandle (hObject=0x8c) returned 1 [0052.508] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg.wannacry")) returned 1 [0052.513] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.513] CloseHandle (hObject=0x8c) returned 1 [0052.514] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg.wannacry")) returned 1 [0052.521] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.521] CloseHandle (hObject=0x8c) returned 1 [0052.521] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg.wannacry")) returned 1 [0052.525] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.525] CloseHandle (hObject=0x8c) returned 1 [0052.525] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg.wannacry")) returned 1 [0052.529] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.529] CloseHandle (hObject=0x8c) returned 1 [0052.530] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg.wannacry")) returned 1 [0052.535] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.535] CloseHandle (hObject=0x8c) returned 1 [0052.535] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg.wannacry")) returned 1 [0052.539] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.539] CloseHandle (hObject=0x8c) returned 1 [0052.540] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg.wannacry")) returned 1 [0052.544] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.544] CloseHandle (hObject=0x8c) returned 1 [0052.544] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg.wannacry")) returned 1 [0052.596] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.596] CloseHandle (hObject=0x8c) returned 1 [0052.597] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg.wannacry")) returned 1 [0052.603] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.603] CloseHandle (hObject=0x8c) returned 1 [0052.603] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg.wannacry")) returned 1 [0052.607] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.607] CloseHandle (hObject=0x8c) returned 1 [0052.608] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg.wannacry")) returned 1 [0052.613] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.624] CloseHandle (hObject=0x8c) returned 1 [0052.625] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg.wannacry")) returned 1 [0052.631] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.631] CloseHandle (hObject=0x8c) returned 1 [0052.631] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg.wannacry")) returned 1 [0052.637] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.637] CloseHandle (hObject=0x8c) returned 1 [0052.637] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg.wannacry")) returned 1 [0052.642] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.643] CloseHandle (hObject=0x8c) returned 1 [0052.643] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg.wannacry")) returned 1 [0052.653] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.653] CloseHandle (hObject=0x8c) returned 1 [0052.654] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg.wannacry")) returned 1 [0052.739] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.740] CloseHandle (hObject=0x8c) returned 1 [0052.740] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg.wannacry")) returned 1 [0052.764] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.765] CloseHandle (hObject=0x8c) returned 1 [0052.765] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg.wannacry")) returned 1 [0052.771] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.771] CloseHandle (hObject=0x8c) returned 1 [0052.772] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg.wannacry")) returned 1 [0052.776] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.776] CloseHandle (hObject=0x8c) returned 1 [0052.778] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg.wannacry")) returned 1 [0052.786] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.786] CloseHandle (hObject=0x8c) returned 1 [0052.786] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg.wannacry")) returned 1 [0052.790] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.790] CloseHandle (hObject=0x8c) returned 1 [0052.791] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg.wannacry")) returned 1 [0052.794] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.795] CloseHandle (hObject=0x8c) returned 1 [0052.795] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg.wannacry")) returned 1 [0052.821] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.821] CloseHandle (hObject=0x8c) returned 1 [0052.821] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg.wannacry")) returned 1 [0052.839] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.839] CloseHandle (hObject=0x8c) returned 1 [0052.839] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg.wannacry")) returned 1 [0052.844] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.845] CloseHandle (hObject=0x8c) returned 1 [0052.845] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg.wannacry")) returned 1 [0052.849] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.849] CloseHandle (hObject=0x8c) returned 1 [0052.849] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg.wannacry")) returned 1 [0052.852] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.852] CloseHandle (hObject=0x8c) returned 1 [0052.852] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg.wannacry")) returned 1 [0052.855] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.855] CloseHandle (hObject=0x8c) returned 1 [0052.856] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg.wannacry")) returned 1 [0052.863] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.864] CloseHandle (hObject=0x8c) returned 1 [0052.864] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg.wannacry")) returned 1 [0052.868] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.868] CloseHandle (hObject=0x8c) returned 1 [0052.869] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg.wannacry")) returned 1 [0052.873] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.873] CloseHandle (hObject=0x8c) returned 1 [0052.874] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg.wannacry")) returned 1 [0052.877] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.877] CloseHandle (hObject=0x8c) returned 1 [0052.878] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg.wannacry")) returned 1 [0052.881] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.881] CloseHandle (hObject=0x8c) returned 1 [0052.881] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg.wannacry")) returned 1 [0052.886] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.886] CloseHandle (hObject=0x8c) returned 1 [0052.886] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg.wannacry")) returned 1 [0052.889] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.889] CloseHandle (hObject=0x8c) returned 1 [0052.889] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg.wannacry")) returned 1 [0052.918] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.918] CloseHandle (hObject=0x8c) returned 1 [0052.919] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif.wannacry")) returned 1 [0052.925] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.925] CloseHandle (hObject=0x8c) returned 1 [0052.925] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg.wannacry")) returned 1 [0052.930] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.930] CloseHandle (hObject=0x8c) returned 1 [0052.930] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg.wannacry")) returned 1 [0052.942] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.942] CloseHandle (hObject=0x8c) returned 1 [0052.943] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg.wannacry")) returned 1 [0052.946] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.946] CloseHandle (hObject=0x8c) returned 1 [0052.946] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg.wannacry")) returned 1 [0052.950] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.951] CloseHandle (hObject=0x8c) returned 1 [0052.951] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg.wannacry")) returned 1 [0052.954] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.954] CloseHandle (hObject=0x8c) returned 1 [0052.954] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif.wannacry")) returned 1 [0052.960] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.960] CloseHandle (hObject=0x8c) returned 1 [0052.960] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg.wannacry")) returned 1 [0052.964] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.965] CloseHandle (hObject=0x8c) returned 1 [0052.965] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg.wannacry")) returned 1 [0052.969] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.969] CloseHandle (hObject=0x8c) returned 1 [0052.969] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg.wannacry")) returned 1 [0052.974] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.975] CloseHandle (hObject=0x8c) returned 1 [0052.975] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg.wannacry")) returned 1 [0052.979] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.979] CloseHandle (hObject=0x8c) returned 1 [0052.979] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg.wannacry")) returned 1 [0052.984] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.984] CloseHandle (hObject=0x8c) returned 1 [0052.984] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg.wannacry")) returned 1 [0052.987] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.988] CloseHandle (hObject=0x8c) returned 1 [0052.988] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif.wannacry")) returned 1 [0052.992] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.992] CloseHandle (hObject=0x8c) returned 1 [0052.992] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif.wannacry")) returned 1 [0052.996] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0052.996] CloseHandle (hObject=0x8c) returned 1 [0052.996] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif.wannacry")) returned 1 [0053.001] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.001] CloseHandle (hObject=0x8c) returned 1 [0053.001] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif.wannacry")) returned 1 [0053.004] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.004] CloseHandle (hObject=0x8c) returned 1 [0053.005] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif.wannacry")) returned 1 [0053.008] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.008] CloseHandle (hObject=0x8c) returned 1 [0053.009] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif.wannacry")) returned 1 [0053.014] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.014] CloseHandle (hObject=0x8c) returned 1 [0053.015] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif.wannacry")) returned 1 [0053.019] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.019] CloseHandle (hObject=0x8c) returned 1 [0053.020] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif.wannacry")) returned 1 [0053.023] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.023] CloseHandle (hObject=0x8c) returned 1 [0053.024] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif.wannacry")) returned 1 [0053.031] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.031] CloseHandle (hObject=0x8c) returned 1 [0053.032] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg.wannacry")) returned 1 [0053.035] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.036] CloseHandle (hObject=0x8c) returned 1 [0053.036] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg.wannacry")) returned 1 [0053.040] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.040] CloseHandle (hObject=0x8c) returned 1 [0053.040] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg.wannacry")) returned 1 [0053.044] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.044] CloseHandle (hObject=0x8c) returned 1 [0053.044] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif.wannacry")) returned 1 [0053.048] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.048] CloseHandle (hObject=0x8c) returned 1 [0053.048] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg.wannacry")) returned 1 [0053.052] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.052] CloseHandle (hObject=0x8c) returned 1 [0053.052] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif.wannacry")) returned 1 [0053.056] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.056] CloseHandle (hObject=0x8c) returned 1 [0053.056] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg.wannacry")) returned 1 [0053.059] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.059] CloseHandle (hObject=0x8c) returned 1 [0053.059] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg.wannacry")) returned 1 [0053.063] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.063] CloseHandle (hObject=0x8c) returned 1 [0053.064] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg.wannacry")) returned 1 [0053.067] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.067] CloseHandle (hObject=0x8c) returned 1 [0053.067] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg.wannacry")) returned 1 [0053.071] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.071] CloseHandle (hObject=0x8c) returned 1 [0053.071] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg.wannacry")) returned 1 [0053.074] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.074] CloseHandle (hObject=0x8c) returned 1 [0053.074] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg.wannacry")) returned 1 [0053.077] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.077] CloseHandle (hObject=0x8c) returned 1 [0053.078] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg.wannacry")) returned 1 [0053.110] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.111] CloseHandle (hObject=0x8c) returned 1 [0053.111] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif.wannacry")) returned 1 [0053.114] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.114] CloseHandle (hObject=0x8c) returned 1 [0053.114] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif.wannacry")) returned 1 [0053.116] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.116] CloseHandle (hObject=0x8c) returned 1 [0053.116] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif.wannacry")) returned 1 [0053.118] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.118] CloseHandle (hObject=0x8c) returned 1 [0053.119] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif.wannacry")) returned 1 [0053.120] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.121] CloseHandle (hObject=0x8c) returned 1 [0053.121] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif.wannacry")) returned 1 [0053.123] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.123] CloseHandle (hObject=0x8c) returned 1 [0053.123] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif.wannacry")) returned 1 [0053.125] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.125] CloseHandle (hObject=0x8c) returned 1 [0053.125] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif.wannacry")) returned 1 [0053.130] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.130] CloseHandle (hObject=0x8c) returned 1 [0053.130] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif.wannacry")) returned 1 [0053.132] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.132] CloseHandle (hObject=0x8c) returned 1 [0053.133] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif.wannacry")) returned 1 [0053.136] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.136] CloseHandle (hObject=0x8c) returned 1 [0053.136] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif.wannacry")) returned 1 [0053.138] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.138] CloseHandle (hObject=0x8c) returned 1 [0053.139] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif.wannacry")) returned 1 [0053.141] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.141] CloseHandle (hObject=0x8c) returned 1 [0053.142] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif.wannacry")) returned 1 [0053.143] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.144] CloseHandle (hObject=0x8c) returned 1 [0053.144] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif.wannacry")) returned 1 [0053.146] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.146] CloseHandle (hObject=0x8c) returned 1 [0053.146] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif.wannacry")) returned 1 [0053.150] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.150] CloseHandle (hObject=0x8c) returned 1 [0053.150] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif.wannacry")) returned 1 [0053.153] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.153] CloseHandle (hObject=0x8c) returned 1 [0053.154] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif.wannacry")) returned 1 [0053.158] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.158] CloseHandle (hObject=0x8c) returned 1 [0053.159] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif.wannacry")) returned 1 [0053.164] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.164] CloseHandle (hObject=0x8c) returned 1 [0053.164] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif.wannacry")) returned 1 [0053.181] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.181] CloseHandle (hObject=0x8c) returned 1 [0053.181] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif.wannacry")) returned 1 [0053.184] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.185] CloseHandle (hObject=0x8c) returned 1 [0053.185] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif.wannacry")) returned 1 [0053.188] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.188] CloseHandle (hObject=0x8c) returned 1 [0053.188] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif.wannacry")) returned 1 [0053.190] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.190] CloseHandle (hObject=0x8c) returned 1 [0053.191] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif.wannacry")) returned 1 [0053.194] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.194] CloseHandle (hObject=0x8c) returned 1 [0053.194] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif.wannacry")) returned 1 [0053.198] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.198] CloseHandle (hObject=0x8c) returned 1 [0053.198] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif.wannacry")) returned 1 [0053.201] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.201] CloseHandle (hObject=0x8c) returned 1 [0053.201] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif.wannacry")) returned 1 [0053.205] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.205] CloseHandle (hObject=0x8c) returned 1 [0053.206] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif.wannacry")) returned 1 [0053.208] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.208] CloseHandle (hObject=0x8c) returned 1 [0053.208] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif.wannacry")) returned 1 [0053.215] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.215] CloseHandle (hObject=0x8c) returned 1 [0053.215] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif.wannacry")) returned 1 [0053.219] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.219] CloseHandle (hObject=0x8c) returned 1 [0053.220] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif.wannacry")) returned 1 [0053.223] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.223] CloseHandle (hObject=0x8c) returned 1 [0053.223] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif.wannacry")) returned 1 [0053.226] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.226] CloseHandle (hObject=0x8c) returned 1 [0053.226] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif.wannacry")) returned 1 [0053.230] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.230] CloseHandle (hObject=0x8c) returned 1 [0053.230] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif.wannacry")) returned 1 [0053.234] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.234] CloseHandle (hObject=0x8c) returned 1 [0053.234] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif.wannacry")) returned 1 [0053.246] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.246] CloseHandle (hObject=0x8c) returned 1 [0053.246] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif.wannacry")) returned 1 [0053.249] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.249] CloseHandle (hObject=0x8c) returned 1 [0053.249] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif.wannacry")) returned 1 [0053.251] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.251] CloseHandle (hObject=0x8c) returned 1 [0053.251] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif.wannacry")) returned 1 [0053.254] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.254] CloseHandle (hObject=0x8c) returned 1 [0053.254] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif.wannacry")) returned 1 [0053.257] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.257] CloseHandle (hObject=0x8c) returned 1 [0053.257] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif.wannacry")) returned 1 [0053.259] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.259] CloseHandle (hObject=0x8c) returned 1 [0053.260] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif.wannacry")) returned 1 [0053.262] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.262] CloseHandle (hObject=0x8c) returned 1 [0053.262] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif.wannacry")) returned 1 [0053.264] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.264] CloseHandle (hObject=0x8c) returned 1 [0053.264] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif.wannacry")) returned 1 [0053.267] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.267] CloseHandle (hObject=0x8c) returned 1 [0053.267] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif.wannacry")) returned 1 [0053.269] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.269] CloseHandle (hObject=0x8c) returned 1 [0053.269] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif.wannacry")) returned 1 [0053.272] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.272] CloseHandle (hObject=0x8c) returned 1 [0053.272] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif.wannacry")) returned 1 [0053.273] lstrcmpA (lpString1=".", lpString2="Publisher") returned -1 [0053.273] lstrcmpA (lpString1="..", lpString2="Publisher") returned -1 [0053.273] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d8070 [0053.274] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0053.274] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0053.274] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0053.274] lstrcmpA (lpString1=".", lpString2="Backgrounds") returned -1 [0053.274] lstrcmpA (lpString1="..", lpString2="Backgrounds") returned -1 [0053.274] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2d7ff8 [0053.276] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0053.276] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0053.276] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0053.279] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0053.279] CloseHandle (hObject=0x90) returned 1 [0053.281] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.281] CloseHandle (hObject=0x90) returned 1 [0053.282] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif.wannacry")) returned 1 [0053.282] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.282] CloseHandle (hObject=0x90) returned 1 [0053.282] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif.wannacry")) returned 1 [0053.286] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.286] CloseHandle (hObject=0x90) returned 1 [0053.286] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif.wannacry")) returned 1 [0053.288] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.288] CloseHandle (hObject=0x90) returned 1 [0053.289] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif.wannacry")) returned 1 [0053.292] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.292] CloseHandle (hObject=0x90) returned 1 [0053.292] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif.wannacry")) returned 1 [0053.294] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.294] CloseHandle (hObject=0x90) returned 1 [0053.294] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif.wannacry")) returned 1 [0053.299] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.299] CloseHandle (hObject=0x90) returned 1 [0053.299] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif.wannacry")) returned 1 [0053.301] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.301] CloseHandle (hObject=0x90) returned 1 [0053.301] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif.wannacry")) returned 1 [0053.304] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.304] CloseHandle (hObject=0x90) returned 1 [0053.304] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif.wannacry")) returned 1 [0053.306] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.307] CloseHandle (hObject=0x90) returned 1 [0053.307] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif.wannacry")) returned 1 [0053.309] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.309] CloseHandle (hObject=0x90) returned 1 [0053.309] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif.wannacry")) returned 1 [0053.312] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.312] CloseHandle (hObject=0x90) returned 1 [0053.312] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif.wannacry")) returned 1 [0053.315] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.315] CloseHandle (hObject=0x90) returned 1 [0053.316] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif.wannacry")) returned 1 [0053.318] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.318] CloseHandle (hObject=0x90) returned 1 [0053.318] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif.wannacry")) returned 1 [0053.321] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.321] CloseHandle (hObject=0x90) returned 1 [0053.321] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif.wannacry")) returned 1 [0053.323] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.324] CloseHandle (hObject=0x90) returned 1 [0053.324] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif.wannacry")) returned 1 [0053.327] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.327] CloseHandle (hObject=0x90) returned 1 [0053.327] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif.wannacry")) returned 1 [0053.329] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.329] CloseHandle (hObject=0x90) returned 1 [0053.329] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif.wannacry")) returned 1 [0053.332] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.332] CloseHandle (hObject=0x90) returned 1 [0053.333] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif.wannacry")) returned 1 [0053.335] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.336] CloseHandle (hObject=0x90) returned 1 [0053.338] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif.wannacry")) returned 1 [0053.341] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.341] CloseHandle (hObject=0x90) returned 1 [0053.341] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif.wannacry")) returned 1 [0053.343] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.343] CloseHandle (hObject=0x90) returned 1 [0053.343] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif.wannacry")) returned 1 [0053.346] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.346] CloseHandle (hObject=0x90) returned 1 [0053.346] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif.wannacry")) returned 1 [0053.348] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.348] CloseHandle (hObject=0x90) returned 1 [0053.348] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif.wannacry")) returned 1 [0053.351] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.351] CloseHandle (hObject=0x90) returned 1 [0053.351] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif.wannacry")) returned 1 [0053.353] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.353] CloseHandle (hObject=0x90) returned 1 [0053.354] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif.wannacry")) returned 1 [0053.356] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.356] CloseHandle (hObject=0x90) returned 1 [0053.356] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif.wannacry")) returned 1 [0053.359] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.359] CloseHandle (hObject=0x90) returned 1 [0053.359] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif.wannacry")) returned 1 [0053.364] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.364] CloseHandle (hObject=0x90) returned 1 [0053.364] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif.wannacry")) returned 1 [0053.366] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.366] CloseHandle (hObject=0x90) returned 1 [0053.367] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif.wannacry")) returned 1 [0053.369] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.369] CloseHandle (hObject=0x90) returned 1 [0053.369] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif.wannacry")) returned 1 [0053.372] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.372] CloseHandle (hObject=0x90) returned 1 [0053.372] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif.wannacry")) returned 1 [0053.375] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.375] CloseHandle (hObject=0x90) returned 1 [0053.375] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif.wannacry")) returned 1 [0053.378] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.378] CloseHandle (hObject=0x90) returned 1 [0053.378] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif.wannacry")) returned 1 [0053.379] lstrcmpA (lpString1=".", lpString2="Document Themes 14") returned -1 [0053.379] lstrcmpA (lpString1="..", lpString2="Document Themes 14") returned -1 [0053.379] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x750050, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2d6f58 [0053.381] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0053.382] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0053.382] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0053.384] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0053.384] CloseHandle (hObject=0x88) returned 1 [0053.385] lstrcmpA (lpString1=".", lpString2="Theme Colors") returned -1 [0053.385] lstrcmpA (lpString1="..", lpString2="Theme Colors") returned -1 [0053.385] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2d8092, cFileName=".", cAlternateFileName="")) returned 0x2d8090 [0053.388] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0053.389] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0053.389] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0053.390] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0053.390] CloseHandle (hObject=0x8c) returned 1 [0053.392] lstrcmpA (lpString1=".", lpString2="Theme Effects") returned -1 [0053.392] lstrcmpA (lpString1="..", lpString2="Theme Effects") returned -1 [0053.392] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5caf100, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x530045, dwReserved1=0x74002e, cFileName=".", cAlternateFileName="")) returned 0x2d8090 [0053.394] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0053.397] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0053.397] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0053.398] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0053.399] CloseHandle (hObject=0x8c) returned 1 [0053.401] lstrcmpA (lpString1=".", lpString2="Theme Fonts") returned -1 [0053.401] lstrcmpA (lpString1="..", lpString2="Theme Fonts") returned -1 [0053.401] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName=".", cAlternateFileName="")) returned 0x2d8090 [0053.404] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0053.405] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0053.405] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0053.406] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0053.406] CloseHandle (hObject=0x8c) returned 1 [0053.411] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0053.411] WriteFile (in: hFile=0x84, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0053.413] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0053.413] CloseHandle (hObject=0x84) returned 1 [0053.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.zip") returned 0 [0053.413] lstrlenA (lpString="*.zip") returned 5 [0053.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.rar") returned 0 [0053.413] lstrlenA (lpString="*.rar") returned 5 [0053.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.7z") returned 0 [0053.414] lstrlenA (lpString="*.7z") returned 4 [0053.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.tar") returned 0 [0053.414] lstrlenA (lpString="*.tar") returned 5 [0053.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.gzip") returned 0 [0053.414] lstrlenA (lpString="*.gzip") returned 6 [0053.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.jpg") returned 0 [0053.414] lstrlenA (lpString="*.jpg") returned 5 [0053.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.jpeg") returned 0 [0053.414] lstrlenA (lpString="*.jpeg") returned 6 [0053.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.psd") returned 0 [0053.414] lstrlenA (lpString="*.psd") returned 5 [0053.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.gif") returned 0 [0053.414] lstrlenA (lpString="*.gif") returned 5 [0053.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.doc") returned 0 [0053.414] lstrlenA (lpString="*.doc") returned 5 [0053.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.docx") returned 0 [0053.414] lstrlenA (lpString="*.docx") returned 6 [0053.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.xls") returned 0 [0053.414] lstrlenA (lpString="*.xls") returned 5 [0053.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.xlsx") returned 0 [0053.414] lstrlenA (lpString="*.xlsx") returned 6 [0053.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.ppt") returned 0 [0053.414] lstrlenA (lpString="*.ppt") returned 5 [0053.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.pptx") returned 0 [0053.414] lstrlenA (lpString="*.pptx") returned 6 [0053.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.pdf") returned 0 [0053.415] lstrlenA (lpString="*.pdf") returned 5 [0053.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.mov") returned 0 [0053.415] lstrlenA (lpString="*.mov") returned 5 [0053.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.m2v") returned 0 [0053.415] lstrlenA (lpString="*.m2v") returned 5 [0053.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.3gp") returned 0 [0053.415] lstrlenA (lpString="*.3gp") returned 5 [0053.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.mpeg") returned 0 [0053.415] lstrlenA (lpString="*.mpeg") returned 6 [0053.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.mpg") returned 0 [0053.415] lstrlenA (lpString="*.mpg") returned 5 [0053.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.flv") returned 0 [0053.415] lstrlenA (lpString="*.flv") returned 5 [0053.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.avi") returned 0 [0053.415] lstrlenA (lpString="*.avi") returned 5 [0053.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.mp4") returned 0 [0053.415] lstrlenA (lpString="*.mp4") returned 5 [0053.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.wmv") returned 0 [0053.415] lstrlenA (lpString="*.wmv") returned 5 [0053.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.divx") returned 0 [0053.415] lstrlenA (lpString="*.divx") returned 6 [0053.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.mkv") returned 0 [0053.415] lstrlenA (lpString="*.mkv") returned 5 [0053.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.mp3") returned 0 [0053.415] lstrlenA (lpString="*.mp3") returned 5 [0053.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.wav") returned 0 [0053.415] lstrlenA (lpString="*.wav") returned 5 [0053.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.flac") returned 0 [0053.416] lstrlenA (lpString="*.flac") returned 6 [0053.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.ape") returned 0 [0053.416] lstrlenA (lpString="*.ape") returned 5 [0053.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.wma") returned 0 [0053.416] lstrlenA (lpString="*.wma") returned 5 [0053.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.ac3") returned 0 [0053.416] lstrlenA (lpString="*.ac3") returned 5 [0053.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\foxmailincmail.exe", pszSpec="*.mxf") returned 0 [0053.416] lstrlenA (lpString="*.mxf") returned 5 [0053.416] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\") returned="" [0053.416] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\HOW TO DECRYPT FILES.txt" [0053.416] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\how to decrypt files.txt")) returned 0x20 [0053.416] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\", lpString2="gmailnotifierpro.exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe") returned="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe" [0053.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.zip") returned 0 [0053.417] lstrlenA (lpString="*.zip") returned 5 [0053.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.rar") returned 0 [0053.417] lstrlenA (lpString="*.rar") returned 5 [0053.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.7z") returned 0 [0053.417] lstrlenA (lpString="*.7z") returned 4 [0053.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.tar") returned 0 [0053.417] lstrlenA (lpString="*.tar") returned 5 [0053.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.gzip") returned 0 [0053.417] lstrlenA (lpString="*.gzip") returned 6 [0053.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.jpg") returned 0 [0053.417] lstrlenA (lpString="*.jpg") returned 5 [0053.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.jpeg") returned 0 [0053.417] lstrlenA (lpString="*.jpeg") returned 6 [0053.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.psd") returned 0 [0053.417] lstrlenA (lpString="*.psd") returned 5 [0053.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.gif") returned 0 [0053.417] lstrlenA (lpString="*.gif") returned 5 [0053.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.doc") returned 0 [0053.417] lstrlenA (lpString="*.doc") returned 5 [0053.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.docx") returned 0 [0053.417] lstrlenA (lpString="*.docx") returned 6 [0053.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.xls") returned 0 [0053.417] lstrlenA (lpString="*.xls") returned 5 [0053.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.xlsx") returned 0 [0053.417] lstrlenA (lpString="*.xlsx") returned 6 [0053.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.ppt") returned 0 [0053.417] lstrlenA (lpString="*.ppt") returned 5 [0053.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.pptx") returned 0 [0053.418] lstrlenA (lpString="*.pptx") returned 6 [0053.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.pdf") returned 0 [0053.418] lstrlenA (lpString="*.pdf") returned 5 [0053.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.mov") returned 0 [0053.418] lstrlenA (lpString="*.mov") returned 5 [0053.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.m2v") returned 0 [0053.418] lstrlenA (lpString="*.m2v") returned 5 [0053.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.3gp") returned 0 [0053.418] lstrlenA (lpString="*.3gp") returned 5 [0053.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.mpeg") returned 0 [0053.418] lstrlenA (lpString="*.mpeg") returned 6 [0053.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.mpg") returned 0 [0053.418] lstrlenA (lpString="*.mpg") returned 5 [0053.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.flv") returned 0 [0053.418] lstrlenA (lpString="*.flv") returned 5 [0053.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.avi") returned 0 [0053.418] lstrlenA (lpString="*.avi") returned 5 [0053.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.mp4") returned 0 [0053.418] lstrlenA (lpString="*.mp4") returned 5 [0053.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.wmv") returned 0 [0053.418] lstrlenA (lpString="*.wmv") returned 5 [0053.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.divx") returned 0 [0053.418] lstrlenA (lpString="*.divx") returned 6 [0053.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.mkv") returned 0 [0053.418] lstrlenA (lpString="*.mkv") returned 5 [0053.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.mp3") returned 0 [0053.419] lstrlenA (lpString="*.mp3") returned 5 [0053.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.wav") returned 0 [0053.419] lstrlenA (lpString="*.wav") returned 5 [0053.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.flac") returned 0 [0053.419] lstrlenA (lpString="*.flac") returned 6 [0053.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.ape") returned 0 [0053.419] lstrlenA (lpString="*.ape") returned 5 [0053.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.wma") returned 0 [0053.419] lstrlenA (lpString="*.wma") returned 5 [0053.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.ac3") returned 0 [0053.419] lstrlenA (lpString="*.ac3") returned 5 [0053.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\gmailnotifierpro.exe", pszSpec="*.mxf") returned 0 [0053.419] lstrlenA (lpString="*.mxf") returned 5 [0053.419] lstrcmpA (lpString1=".", lpString2="MEDIA") returned -1 [0053.419] lstrcmpA (lpString1="..", lpString2="MEDIA") returned -1 [0053.419] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\MEDIA") returned 39 [0053.419] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x2d1294, cFileName=".", cAlternateFileName="")) returned 0x2d6f58 [0053.420] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0053.421] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0053.421] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0053.421] lstrcmpA (lpString1=".", lpString2="CAGCAT10") returned -1 [0053.421] lstrcmpA (lpString1="..", lpString2="CAGCAT10") returned -1 [0053.421] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned 48 [0053.421] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2d8070 [0053.444] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0053.638] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0053.638] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0053.638] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0053.638] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0053.638] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033") returned 53 [0053.638] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2d7ff8 [0053.639] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0053.639] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0053.639] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0053.639] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CAGCAT10.MML") returned 1 [0053.639] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CAGCAT10.MML") returned 1 [0053.639] lstrcmpiA (lpString1="", lpString2="CAGCAT10.MML") returned -1 [0053.639] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\" [0053.639] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\") returned="" [0053.639] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\HOW TO DECRYPT FILES.txt" [0053.639] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\how to decrypt files.txt")) returned 0xffffffff [0053.639] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0053.640] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0053.640] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0053.641] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0053.641] CloseHandle (hObject=0x90) returned 1 [0053.641] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\", lpString2="CAGCAT10.MML" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" [0053.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.zip") returned 0 [0053.641] lstrlenA (lpString="*.zip") returned 5 [0053.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.rar") returned 0 [0053.641] lstrlenA (lpString="*.rar") returned 5 [0053.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.7z") returned 0 [0053.641] lstrlenA (lpString="*.7z") returned 4 [0053.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.tar") returned 0 [0053.641] lstrlenA (lpString="*.tar") returned 5 [0053.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.gzip") returned 0 [0053.641] lstrlenA (lpString="*.gzip") returned 6 [0053.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.jpg") returned 0 [0053.641] lstrlenA (lpString="*.jpg") returned 5 [0053.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.jpeg") returned 0 [0053.641] lstrlenA (lpString="*.jpeg") returned 6 [0053.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.psd") returned 0 [0053.641] lstrlenA (lpString="*.psd") returned 5 [0053.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.gif") returned 0 [0053.642] lstrlenA (lpString="*.gif") returned 5 [0053.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.doc") returned 0 [0053.642] lstrlenA (lpString="*.doc") returned 5 [0053.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.docx") returned 0 [0053.642] lstrlenA (lpString="*.docx") returned 6 [0053.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.xls") returned 0 [0053.642] lstrlenA (lpString="*.xls") returned 5 [0053.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.xlsx") returned 0 [0053.642] lstrlenA (lpString="*.xlsx") returned 6 [0053.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.ppt") returned 0 [0053.642] lstrlenA (lpString="*.ppt") returned 5 [0053.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.pptx") returned 0 [0053.642] lstrlenA (lpString="*.pptx") returned 6 [0053.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.pdf") returned 0 [0053.642] lstrlenA (lpString="*.pdf") returned 5 [0053.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.mov") returned 0 [0053.642] lstrlenA (lpString="*.mov") returned 5 [0053.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.m2v") returned 0 [0053.642] lstrlenA (lpString="*.m2v") returned 5 [0053.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.3gp") returned 0 [0053.642] lstrlenA (lpString="*.3gp") returned 5 [0053.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.mpeg") returned 0 [0053.642] lstrlenA (lpString="*.mpeg") returned 6 [0053.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.mpg") returned 0 [0053.642] lstrlenA (lpString="*.mpg") returned 5 [0053.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.flv") returned 0 [0053.642] lstrlenA (lpString="*.flv") returned 5 [0053.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.avi") returned 0 [0053.642] lstrlenA (lpString="*.avi") returned 5 [0053.642] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.mp4") returned 0 [0053.642] lstrlenA (lpString="*.mp4") returned 5 [0053.643] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.wmv") returned 0 [0053.643] lstrlenA (lpString="*.wmv") returned 5 [0053.643] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.divx") returned 0 [0053.643] lstrlenA (lpString="*.divx") returned 6 [0053.643] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.mkv") returned 0 [0053.643] lstrlenA (lpString="*.mkv") returned 5 [0053.643] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.mp3") returned 0 [0053.643] lstrlenA (lpString="*.mp3") returned 5 [0053.643] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.wav") returned 0 [0053.643] lstrlenA (lpString="*.wav") returned 5 [0053.643] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.flac") returned 0 [0053.643] lstrlenA (lpString="*.flac") returned 6 [0053.643] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.ape") returned 0 [0053.643] lstrlenA (lpString="*.ape") returned 5 [0053.643] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.wma") returned 0 [0053.643] lstrlenA (lpString="*.wma") returned 5 [0053.643] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.ac3") returned 0 [0053.643] lstrlenA (lpString="*.ac3") returned 5 [0053.643] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", pszSpec="*.mxf") returned 0 [0053.643] lstrlenA (lpString="*.mxf") returned 5 [0053.643] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11d8d700, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x11d8d700, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c450, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CAGCAT10.MML", cAlternateFileName="")) returned 0 [0053.643] FindClose (in: hFindFile=0x2d7ff8 | out: hFindFile=0x2d7ff8) returned 1 [0053.644] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2162900, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2162900, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="CAGCAT10.DLL", cAlternateFileName="")) returned 1 [0053.644] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.644] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CAGCAT10.DLL") returned 1 [0053.644] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CAGCAT10.DLL") returned 1 [0053.644] lstrcmpiA (lpString1="", lpString2="CAGCAT10.DLL") returned -1 [0053.644] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*") returned="*.*" [0053.644] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.644] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.644] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.644] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0xffffffff [0053.644] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0053.644] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0053.644] WriteFile (in: hFile=0x8c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0053.645] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0053.645] CloseHandle (hObject=0x8c) returned 1 [0053.646] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="CAGCAT10.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" [0053.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.zip") returned 0 [0053.646] lstrlenA (lpString="*.zip") returned 5 [0053.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.rar") returned 0 [0053.646] lstrlenA (lpString="*.rar") returned 5 [0053.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.7z") returned 0 [0053.646] lstrlenA (lpString="*.7z") returned 4 [0053.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.tar") returned 0 [0053.646] lstrlenA (lpString="*.tar") returned 5 [0053.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.gzip") returned 0 [0053.646] lstrlenA (lpString="*.gzip") returned 6 [0053.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.jpg") returned 0 [0053.646] lstrlenA (lpString="*.jpg") returned 5 [0053.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.jpeg") returned 0 [0053.646] lstrlenA (lpString="*.jpeg") returned 6 [0053.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.psd") returned 0 [0053.646] lstrlenA (lpString="*.psd") returned 5 [0053.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.gif") returned 0 [0053.646] lstrlenA (lpString="*.gif") returned 5 [0053.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.doc") returned 0 [0053.646] lstrlenA (lpString="*.doc") returned 5 [0053.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.docx") returned 0 [0053.646] lstrlenA (lpString="*.docx") returned 6 [0053.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.xls") returned 0 [0053.646] lstrlenA (lpString="*.xls") returned 5 [0053.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.xlsx") returned 0 [0053.647] lstrlenA (lpString="*.xlsx") returned 6 [0053.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.ppt") returned 0 [0053.647] lstrlenA (lpString="*.ppt") returned 5 [0053.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.pptx") returned 0 [0053.647] lstrlenA (lpString="*.pptx") returned 6 [0053.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.pdf") returned 0 [0053.647] lstrlenA (lpString="*.pdf") returned 5 [0053.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.mov") returned 0 [0053.647] lstrlenA (lpString="*.mov") returned 5 [0053.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.m2v") returned 0 [0053.647] lstrlenA (lpString="*.m2v") returned 5 [0053.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.3gp") returned 0 [0053.647] lstrlenA (lpString="*.3gp") returned 5 [0053.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.mpeg") returned 0 [0053.647] lstrlenA (lpString="*.mpeg") returned 6 [0053.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.mpg") returned 0 [0053.647] lstrlenA (lpString="*.mpg") returned 5 [0053.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.flv") returned 0 [0053.647] lstrlenA (lpString="*.flv") returned 5 [0053.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.avi") returned 0 [0053.647] lstrlenA (lpString="*.avi") returned 5 [0053.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.mp4") returned 0 [0053.647] lstrlenA (lpString="*.mp4") returned 5 [0053.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.wmv") returned 0 [0053.647] lstrlenA (lpString="*.wmv") returned 5 [0053.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.divx") returned 0 [0053.647] lstrlenA (lpString="*.divx") returned 6 [0053.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.mkv") returned 0 [0053.647] lstrlenA (lpString="*.mkv") returned 5 [0053.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.mp3") returned 0 [0053.648] lstrlenA (lpString="*.mp3") returned 5 [0053.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.wav") returned 0 [0053.648] lstrlenA (lpString="*.wav") returned 5 [0053.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.flac") returned 0 [0053.648] lstrlenA (lpString="*.flac") returned 6 [0053.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.ape") returned 0 [0053.648] lstrlenA (lpString="*.ape") returned 5 [0053.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.wma") returned 0 [0053.648] lstrlenA (lpString="*.wma") returned 5 [0053.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.ac3") returned 0 [0053.648] lstrlenA (lpString="*.ac3") returned 5 [0053.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", pszSpec="*.mxf") returned 0 [0053.648] lstrlenA (lpString="*.mxf") returned 5 [0053.648] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x603d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.MMW", cAlternateFileName="")) returned 1 [0053.648] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.648] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CAGCAT10.MMW") returned 1 [0053.648] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CAGCAT10.MMW") returned 1 [0053.648] lstrcmpiA (lpString1="", lpString2="CAGCAT10.MMW") returned -1 [0053.648] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned="CAGCAT10.DLL" [0053.648] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.648] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.648] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.648] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.648] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="CAGCAT10.MMW" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" [0053.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.zip") returned 0 [0053.649] lstrlenA (lpString="*.zip") returned 5 [0053.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.rar") returned 0 [0053.649] lstrlenA (lpString="*.rar") returned 5 [0053.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.7z") returned 0 [0053.649] lstrlenA (lpString="*.7z") returned 4 [0053.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.tar") returned 0 [0053.649] lstrlenA (lpString="*.tar") returned 5 [0053.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.gzip") returned 0 [0053.649] lstrlenA (lpString="*.gzip") returned 6 [0053.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.jpg") returned 0 [0053.649] lstrlenA (lpString="*.jpg") returned 5 [0053.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.jpeg") returned 0 [0053.649] lstrlenA (lpString="*.jpeg") returned 6 [0053.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.psd") returned 0 [0053.649] lstrlenA (lpString="*.psd") returned 5 [0053.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.gif") returned 0 [0053.649] lstrlenA (lpString="*.gif") returned 5 [0053.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.doc") returned 0 [0053.649] lstrlenA (lpString="*.doc") returned 5 [0053.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.docx") returned 0 [0053.649] lstrlenA (lpString="*.docx") returned 6 [0053.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.xls") returned 0 [0053.649] lstrlenA (lpString="*.xls") returned 5 [0053.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.xlsx") returned 0 [0053.649] lstrlenA (lpString="*.xlsx") returned 6 [0053.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.ppt") returned 0 [0053.649] lstrlenA (lpString="*.ppt") returned 5 [0053.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.pptx") returned 0 [0053.649] lstrlenA (lpString="*.pptx") returned 6 [0053.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.pdf") returned 0 [0053.650] lstrlenA (lpString="*.pdf") returned 5 [0053.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.mov") returned 0 [0053.650] lstrlenA (lpString="*.mov") returned 5 [0053.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.m2v") returned 0 [0053.650] lstrlenA (lpString="*.m2v") returned 5 [0053.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.3gp") returned 0 [0053.650] lstrlenA (lpString="*.3gp") returned 5 [0053.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.mpeg") returned 0 [0053.650] lstrlenA (lpString="*.mpeg") returned 6 [0053.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.mpg") returned 0 [0053.650] lstrlenA (lpString="*.mpg") returned 5 [0053.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.flv") returned 0 [0053.650] lstrlenA (lpString="*.flv") returned 5 [0053.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.avi") returned 0 [0053.650] lstrlenA (lpString="*.avi") returned 5 [0053.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.mp4") returned 0 [0053.650] lstrlenA (lpString="*.mp4") returned 5 [0053.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.wmv") returned 0 [0053.650] lstrlenA (lpString="*.wmv") returned 5 [0053.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.divx") returned 0 [0053.650] lstrlenA (lpString="*.divx") returned 6 [0053.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.mkv") returned 0 [0053.650] lstrlenA (lpString="*.mkv") returned 5 [0053.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.mp3") returned 0 [0053.650] lstrlenA (lpString="*.mp3") returned 5 [0053.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.wav") returned 0 [0053.650] lstrlenA (lpString="*.wav") returned 5 [0053.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.flac") returned 0 [0053.650] lstrlenA (lpString="*.flac") returned 6 [0053.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.ape") returned 0 [0053.651] lstrlenA (lpString="*.ape") returned 5 [0053.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.wma") returned 0 [0053.651] lstrlenA (lpString="*.wma") returned 5 [0053.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.ac3") returned 0 [0053.651] lstrlenA (lpString="*.ac3") returned 5 [0053.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", pszSpec="*.mxf") returned 0 [0053.651] lstrlenA (lpString="*.mxf") returned 5 [0053.651] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ec5600, ftCreationTime.dwHighDateTime=0x1bd4c14, ftLastAccessTime.dwLowDateTime=0xbd180ea0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x11ec5600, ftLastWriteTime.dwHighDateTime=0x1bd4c14, nFileSizeHigh=0x0, nFileSizeLow=0x585a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ELPHRG01.WAV", cAlternateFileName="")) returned 1 [0053.651] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.651] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ELPHRG01.WAV") returned -1 [0053.651] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ELPHRG01.WAV") returned 1 [0053.651] lstrcmpiA (lpString1="", lpString2="ELPHRG01.WAV") returned -1 [0053.651] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned="CAGCAT10.MMW" [0053.651] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.651] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.651] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.651] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.651] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="ELPHRG01.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" [0053.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.zip") returned 0 [0053.651] lstrlenA (lpString="*.zip") returned 5 [0053.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.rar") returned 0 [0053.651] lstrlenA (lpString="*.rar") returned 5 [0053.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.7z") returned 0 [0053.651] lstrlenA (lpString="*.7z") returned 4 [0053.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.tar") returned 0 [0053.651] lstrlenA (lpString="*.tar") returned 5 [0053.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.gzip") returned 0 [0053.651] lstrlenA (lpString="*.gzip") returned 6 [0053.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.jpg") returned 0 [0053.652] lstrlenA (lpString="*.jpg") returned 5 [0053.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.jpeg") returned 0 [0053.652] lstrlenA (lpString="*.jpeg") returned 6 [0053.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.psd") returned 0 [0053.652] lstrlenA (lpString="*.psd") returned 5 [0053.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.gif") returned 0 [0053.652] lstrlenA (lpString="*.gif") returned 5 [0053.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.doc") returned 0 [0053.652] lstrlenA (lpString="*.doc") returned 5 [0053.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.docx") returned 0 [0053.652] lstrlenA (lpString="*.docx") returned 6 [0053.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.xls") returned 0 [0053.652] lstrlenA (lpString="*.xls") returned 5 [0053.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.xlsx") returned 0 [0053.652] lstrlenA (lpString="*.xlsx") returned 6 [0053.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.ppt") returned 0 [0053.652] lstrlenA (lpString="*.ppt") returned 5 [0053.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.pptx") returned 0 [0053.652] lstrlenA (lpString="*.pptx") returned 6 [0053.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.pdf") returned 0 [0053.652] lstrlenA (lpString="*.pdf") returned 5 [0053.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.mov") returned 0 [0053.652] lstrlenA (lpString="*.mov") returned 5 [0053.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.m2v") returned 0 [0053.652] lstrlenA (lpString="*.m2v") returned 5 [0053.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.3gp") returned 0 [0053.652] lstrlenA (lpString="*.3gp") returned 5 [0053.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.mpeg") returned 0 [0053.653] lstrlenA (lpString="*.mpeg") returned 6 [0053.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.mpg") returned 0 [0053.653] lstrlenA (lpString="*.mpg") returned 5 [0053.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.flv") returned 0 [0053.653] lstrlenA (lpString="*.flv") returned 5 [0053.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.avi") returned 0 [0053.653] lstrlenA (lpString="*.avi") returned 5 [0053.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.mp4") returned 0 [0053.653] lstrlenA (lpString="*.mp4") returned 5 [0053.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.wmv") returned 0 [0053.653] lstrlenA (lpString="*.wmv") returned 5 [0053.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.divx") returned 0 [0053.653] lstrlenA (lpString="*.divx") returned 6 [0053.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.mkv") returned 0 [0053.653] lstrlenA (lpString="*.mkv") returned 5 [0053.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.mp3") returned 0 [0053.653] lstrlenA (lpString="*.mp3") returned 5 [0053.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", pszSpec="*.wav") returned 1 [0053.653] lstrlenA (lpString="*.wav") returned 5 [0053.653] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" [0053.653] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" [0053.653] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV." [0053.653] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV.wannacry" [0053.653] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0053.654] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x585a [0053.654] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x11ec5600, dwHighDateTime=0x1bd4c14), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd180ea0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x11ec5600, dwHighDateTime=0x1bd4c14)) returned 1 [0053.654] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0053.654] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x57dc, lpOverlapped=0x0) returned 1 [0053.656] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV") returned="ELPHRG01.WAV" [0053.656] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0053.656] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x57dc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x57dc, lpOverlapped=0x0) returned 1 [0053.657] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.657] CloseHandle (hObject=0x8c) returned 1 [0053.658] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav.wannacry")) returned 1 [0053.658] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63c1b400, ftCreationTime.dwHighDateTime=0x1bd216e, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x63c1b400, ftLastWriteTime.dwHighDateTime=0x1bd216e, nFileSizeHigh=0x0, nFileSizeLow=0x3602, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="J0088542.WMF", cAlternateFileName="")) returned 1 [0053.658] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.658] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0088542.WMF") returned -1 [0053.658] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0088542.WMF") returned -1 [0053.658] lstrcmpiA (lpString1="", lpString2="J0088542.WMF") returned -1 [0053.658] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV") returned="ELPHRG01.WAV" [0053.659] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.659] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.659] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.659] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.659] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0088542.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF" [0053.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.zip") returned 0 [0053.659] lstrlenA (lpString="*.zip") returned 5 [0053.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.rar") returned 0 [0053.659] lstrlenA (lpString="*.rar") returned 5 [0053.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.7z") returned 0 [0053.659] lstrlenA (lpString="*.7z") returned 4 [0053.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.tar") returned 0 [0053.659] lstrlenA (lpString="*.tar") returned 5 [0053.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.gzip") returned 0 [0053.659] lstrlenA (lpString="*.gzip") returned 6 [0053.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.jpg") returned 0 [0053.659] lstrlenA (lpString="*.jpg") returned 5 [0053.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.jpeg") returned 0 [0053.659] lstrlenA (lpString="*.jpeg") returned 6 [0053.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.psd") returned 0 [0053.659] lstrlenA (lpString="*.psd") returned 5 [0053.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.gif") returned 0 [0053.659] lstrlenA (lpString="*.gif") returned 5 [0053.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.doc") returned 0 [0053.659] lstrlenA (lpString="*.doc") returned 5 [0053.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.docx") returned 0 [0053.659] lstrlenA (lpString="*.docx") returned 6 [0053.659] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.xls") returned 0 [0053.659] lstrlenA (lpString="*.xls") returned 5 [0053.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.xlsx") returned 0 [0053.660] lstrlenA (lpString="*.xlsx") returned 6 [0053.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.ppt") returned 0 [0053.660] lstrlenA (lpString="*.ppt") returned 5 [0053.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.pptx") returned 0 [0053.660] lstrlenA (lpString="*.pptx") returned 6 [0053.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.pdf") returned 0 [0053.660] lstrlenA (lpString="*.pdf") returned 5 [0053.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.mov") returned 0 [0053.660] lstrlenA (lpString="*.mov") returned 5 [0053.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.m2v") returned 0 [0053.660] lstrlenA (lpString="*.m2v") returned 5 [0053.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.3gp") returned 0 [0053.660] lstrlenA (lpString="*.3gp") returned 5 [0053.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.mpeg") returned 0 [0053.660] lstrlenA (lpString="*.mpeg") returned 6 [0053.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.mpg") returned 0 [0053.660] lstrlenA (lpString="*.mpg") returned 5 [0053.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.flv") returned 0 [0053.660] lstrlenA (lpString="*.flv") returned 5 [0053.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.avi") returned 0 [0053.660] lstrlenA (lpString="*.avi") returned 5 [0053.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.mp4") returned 0 [0053.660] lstrlenA (lpString="*.mp4") returned 5 [0053.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.wmv") returned 0 [0053.660] lstrlenA (lpString="*.wmv") returned 5 [0053.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.divx") returned 0 [0053.660] lstrlenA (lpString="*.divx") returned 6 [0053.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.mkv") returned 0 [0053.661] lstrlenA (lpString="*.mkv") returned 5 [0053.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.mp3") returned 0 [0053.661] lstrlenA (lpString="*.mp3") returned 5 [0053.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.wav") returned 0 [0053.661] lstrlenA (lpString="*.wav") returned 5 [0053.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.flac") returned 0 [0053.661] lstrlenA (lpString="*.flac") returned 6 [0053.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.ape") returned 0 [0053.661] lstrlenA (lpString="*.ape") returned 5 [0053.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.wma") returned 0 [0053.661] lstrlenA (lpString="*.wma") returned 5 [0053.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.ac3") returned 0 [0053.661] lstrlenA (lpString="*.ac3") returned 5 [0053.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", pszSpec="*.mxf") returned 0 [0053.661] lstrlenA (lpString="*.mxf") returned 5 [0053.661] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ad6a00, ftCreationTime.dwHighDateTime=0x1bcf887, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x68ad6a00, ftLastWriteTime.dwHighDateTime=0x1bcf887, nFileSizeHigh=0x0, nFileSizeLow=0x8880, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090070.WMF", cAlternateFileName="")) returned 1 [0053.661] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.661] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0090070.WMF") returned -1 [0053.661] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0090070.WMF") returned -1 [0053.661] lstrcmpiA (lpString1="", lpString2="J0090070.WMF") returned -1 [0053.661] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF") returned="J0088542.WMF" [0053.661] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.661] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.661] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.661] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.661] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0090070.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF" [0053.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.zip") returned 0 [0053.662] lstrlenA (lpString="*.zip") returned 5 [0053.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.rar") returned 0 [0053.662] lstrlenA (lpString="*.rar") returned 5 [0053.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.7z") returned 0 [0053.662] lstrlenA (lpString="*.7z") returned 4 [0053.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.tar") returned 0 [0053.662] lstrlenA (lpString="*.tar") returned 5 [0053.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.gzip") returned 0 [0053.662] lstrlenA (lpString="*.gzip") returned 6 [0053.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.jpg") returned 0 [0053.662] lstrlenA (lpString="*.jpg") returned 5 [0053.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.jpeg") returned 0 [0053.662] lstrlenA (lpString="*.jpeg") returned 6 [0053.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.psd") returned 0 [0053.662] lstrlenA (lpString="*.psd") returned 5 [0053.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.gif") returned 0 [0053.662] lstrlenA (lpString="*.gif") returned 5 [0053.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.doc") returned 0 [0053.662] lstrlenA (lpString="*.doc") returned 5 [0053.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.docx") returned 0 [0053.662] lstrlenA (lpString="*.docx") returned 6 [0053.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.xls") returned 0 [0053.662] lstrlenA (lpString="*.xls") returned 5 [0053.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.xlsx") returned 0 [0053.662] lstrlenA (lpString="*.xlsx") returned 6 [0053.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.ppt") returned 0 [0053.662] lstrlenA (lpString="*.ppt") returned 5 [0053.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.pptx") returned 0 [0053.663] lstrlenA (lpString="*.pptx") returned 6 [0053.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.pdf") returned 0 [0053.663] lstrlenA (lpString="*.pdf") returned 5 [0053.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.mov") returned 0 [0053.663] lstrlenA (lpString="*.mov") returned 5 [0053.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.m2v") returned 0 [0053.663] lstrlenA (lpString="*.m2v") returned 5 [0053.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.3gp") returned 0 [0053.663] lstrlenA (lpString="*.3gp") returned 5 [0053.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.mpeg") returned 0 [0053.663] lstrlenA (lpString="*.mpeg") returned 6 [0053.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.mpg") returned 0 [0053.663] lstrlenA (lpString="*.mpg") returned 5 [0053.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.flv") returned 0 [0053.663] lstrlenA (lpString="*.flv") returned 5 [0053.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.avi") returned 0 [0053.663] lstrlenA (lpString="*.avi") returned 5 [0053.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.mp4") returned 0 [0053.663] lstrlenA (lpString="*.mp4") returned 5 [0053.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.wmv") returned 0 [0053.663] lstrlenA (lpString="*.wmv") returned 5 [0053.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.divx") returned 0 [0053.663] lstrlenA (lpString="*.divx") returned 6 [0053.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.mkv") returned 0 [0053.663] lstrlenA (lpString="*.mkv") returned 5 [0053.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.mp3") returned 0 [0053.663] lstrlenA (lpString="*.mp3") returned 5 [0053.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.wav") returned 0 [0053.663] lstrlenA (lpString="*.wav") returned 5 [0053.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.flac") returned 0 [0053.663] lstrlenA (lpString="*.flac") returned 6 [0053.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.ape") returned 0 [0053.663] lstrlenA (lpString="*.ape") returned 5 [0053.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.wma") returned 0 [0053.664] lstrlenA (lpString="*.wma") returned 5 [0053.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.ac3") returned 0 [0053.664] lstrlenA (lpString="*.ac3") returned 5 [0053.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", pszSpec="*.mxf") returned 0 [0053.664] lstrlenA (lpString="*.mxf") returned 5 [0053.664] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59c88400, ftCreationTime.dwHighDateTime=0x1bd208e, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x59c88400, ftLastWriteTime.dwHighDateTime=0x1bd208e, nFileSizeHigh=0x0, nFileSizeLow=0x830a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090386.WMF", cAlternateFileName="")) returned 1 [0053.664] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.664] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0090386.WMF") returned -1 [0053.664] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0090386.WMF") returned -1 [0053.664] lstrcmpiA (lpString1="", lpString2="J0090386.WMF") returned -1 [0053.664] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF") returned="J0090070.WMF" [0053.664] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.664] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.664] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.664] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.664] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0090386.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF" [0053.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.zip") returned 0 [0053.664] lstrlenA (lpString="*.zip") returned 5 [0053.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.rar") returned 0 [0053.664] lstrlenA (lpString="*.rar") returned 5 [0053.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.7z") returned 0 [0053.664] lstrlenA (lpString="*.7z") returned 4 [0053.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.tar") returned 0 [0053.664] lstrlenA (lpString="*.tar") returned 5 [0053.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.gzip") returned 0 [0053.665] lstrlenA (lpString="*.gzip") returned 6 [0053.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.jpg") returned 0 [0053.665] lstrlenA (lpString="*.jpg") returned 5 [0053.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.jpeg") returned 0 [0053.665] lstrlenA (lpString="*.jpeg") returned 6 [0053.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.psd") returned 0 [0053.665] lstrlenA (lpString="*.psd") returned 5 [0053.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.gif") returned 0 [0053.665] lstrlenA (lpString="*.gif") returned 5 [0053.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.doc") returned 0 [0053.665] lstrlenA (lpString="*.doc") returned 5 [0053.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.docx") returned 0 [0053.665] lstrlenA (lpString="*.docx") returned 6 [0053.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.xls") returned 0 [0053.665] lstrlenA (lpString="*.xls") returned 5 [0053.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.xlsx") returned 0 [0053.665] lstrlenA (lpString="*.xlsx") returned 6 [0053.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.ppt") returned 0 [0053.665] lstrlenA (lpString="*.ppt") returned 5 [0053.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.pptx") returned 0 [0053.665] lstrlenA (lpString="*.pptx") returned 6 [0053.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.pdf") returned 0 [0053.665] lstrlenA (lpString="*.pdf") returned 5 [0053.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.mov") returned 0 [0053.665] lstrlenA (lpString="*.mov") returned 5 [0053.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.m2v") returned 0 [0053.665] lstrlenA (lpString="*.m2v") returned 5 [0053.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.3gp") returned 0 [0053.665] lstrlenA (lpString="*.3gp") returned 5 [0053.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.mpeg") returned 0 [0053.665] lstrlenA (lpString="*.mpeg") returned 6 [0053.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.mpg") returned 0 [0053.665] lstrlenA (lpString="*.mpg") returned 5 [0053.666] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.flv") returned 0 [0053.666] lstrlenA (lpString="*.flv") returned 5 [0053.666] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.avi") returned 0 [0053.666] lstrlenA (lpString="*.avi") returned 5 [0053.666] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.mp4") returned 0 [0053.666] lstrlenA (lpString="*.mp4") returned 5 [0053.666] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.wmv") returned 0 [0053.666] lstrlenA (lpString="*.wmv") returned 5 [0053.666] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.divx") returned 0 [0053.666] lstrlenA (lpString="*.divx") returned 6 [0053.666] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.mkv") returned 0 [0053.666] lstrlenA (lpString="*.mkv") returned 5 [0053.666] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.mp3") returned 0 [0053.666] lstrlenA (lpString="*.mp3") returned 5 [0053.666] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.wav") returned 0 [0053.666] lstrlenA (lpString="*.wav") returned 5 [0053.666] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.flac") returned 0 [0053.666] lstrlenA (lpString="*.flac") returned 6 [0053.666] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.ape") returned 0 [0053.666] lstrlenA (lpString="*.ape") returned 5 [0053.666] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.wma") returned 0 [0053.666] lstrlenA (lpString="*.wma") returned 5 [0053.666] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.ac3") returned 0 [0053.666] lstrlenA (lpString="*.ac3") returned 5 [0053.666] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", pszSpec="*.mxf") returned 0 [0053.666] lstrlenA (lpString="*.mxf") returned 5 [0053.666] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e332700, ftCreationTime.dwHighDateTime=0x1bd3d86, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e332700, ftLastWriteTime.dwHighDateTime=0x1bd3d86, nFileSizeHigh=0x0, nFileSizeLow=0x870a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149407.WMF", cAlternateFileName="")) returned 1 [0053.666] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.666] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0149407.WMF") returned -1 [0053.666] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0149407.WMF") returned -1 [0053.666] lstrcmpiA (lpString1="", lpString2="J0149407.WMF") returned -1 [0053.666] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF") returned="J0090386.WMF" [0053.666] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.667] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.667] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.667] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.667] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0149407.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF" [0053.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.zip") returned 0 [0053.667] lstrlenA (lpString="*.zip") returned 5 [0053.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.rar") returned 0 [0053.667] lstrlenA (lpString="*.rar") returned 5 [0053.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.7z") returned 0 [0053.667] lstrlenA (lpString="*.7z") returned 4 [0053.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.tar") returned 0 [0053.667] lstrlenA (lpString="*.tar") returned 5 [0053.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.gzip") returned 0 [0053.667] lstrlenA (lpString="*.gzip") returned 6 [0053.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.jpg") returned 0 [0053.667] lstrlenA (lpString="*.jpg") returned 5 [0053.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.jpeg") returned 0 [0053.667] lstrlenA (lpString="*.jpeg") returned 6 [0053.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.psd") returned 0 [0053.667] lstrlenA (lpString="*.psd") returned 5 [0053.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.gif") returned 0 [0053.667] lstrlenA (lpString="*.gif") returned 5 [0053.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.doc") returned 0 [0053.667] lstrlenA (lpString="*.doc") returned 5 [0053.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.docx") returned 0 [0053.667] lstrlenA (lpString="*.docx") returned 6 [0053.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.xls") returned 0 [0053.667] lstrlenA (lpString="*.xls") returned 5 [0053.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.xlsx") returned 0 [0053.667] lstrlenA (lpString="*.xlsx") returned 6 [0053.667] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.ppt") returned 0 [0053.668] lstrlenA (lpString="*.ppt") returned 5 [0053.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.pptx") returned 0 [0053.668] lstrlenA (lpString="*.pptx") returned 6 [0053.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.pdf") returned 0 [0053.668] lstrlenA (lpString="*.pdf") returned 5 [0053.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.mov") returned 0 [0053.668] lstrlenA (lpString="*.mov") returned 5 [0053.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.m2v") returned 0 [0053.668] lstrlenA (lpString="*.m2v") returned 5 [0053.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.3gp") returned 0 [0053.668] lstrlenA (lpString="*.3gp") returned 5 [0053.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.mpeg") returned 0 [0053.668] lstrlenA (lpString="*.mpeg") returned 6 [0053.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.mpg") returned 0 [0053.668] lstrlenA (lpString="*.mpg") returned 5 [0053.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.flv") returned 0 [0053.668] lstrlenA (lpString="*.flv") returned 5 [0053.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.avi") returned 0 [0053.668] lstrlenA (lpString="*.avi") returned 5 [0053.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.mp4") returned 0 [0053.668] lstrlenA (lpString="*.mp4") returned 5 [0053.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.wmv") returned 0 [0053.668] lstrlenA (lpString="*.wmv") returned 5 [0053.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.divx") returned 0 [0053.668] lstrlenA (lpString="*.divx") returned 6 [0053.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.mkv") returned 0 [0053.668] lstrlenA (lpString="*.mkv") returned 5 [0053.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.mp3") returned 0 [0053.668] lstrlenA (lpString="*.mp3") returned 5 [0053.668] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.wav") returned 0 [0053.668] lstrlenA (lpString="*.wav") returned 5 [0053.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.flac") returned 0 [0053.669] lstrlenA (lpString="*.flac") returned 6 [0053.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.ape") returned 0 [0053.669] lstrlenA (lpString="*.ape") returned 5 [0053.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.wma") returned 0 [0053.669] lstrlenA (lpString="*.wma") returned 5 [0053.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.ac3") returned 0 [0053.669] lstrlenA (lpString="*.ac3") returned 5 [0053.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", pszSpec="*.mxf") returned 0 [0053.669] lstrlenA (lpString="*.mxf") returned 5 [0053.669] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fd5900, ftCreationTime.dwHighDateTime=0x1bd4249, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4fd5900, ftLastWriteTime.dwHighDateTime=0x1bd4249, nFileSizeHigh=0x0, nFileSizeLow=0x5eda, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149481.WMF", cAlternateFileName="")) returned 1 [0053.669] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.669] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0149481.WMF") returned -1 [0053.669] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0149481.WMF") returned -1 [0053.669] lstrcmpiA (lpString1="", lpString2="J0149481.WMF") returned -1 [0053.669] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF") returned="J0149407.WMF" [0053.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.669] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.669] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.669] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.669] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0149481.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF" [0053.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.zip") returned 0 [0053.669] lstrlenA (lpString="*.zip") returned 5 [0053.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.rar") returned 0 [0053.669] lstrlenA (lpString="*.rar") returned 5 [0053.669] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.7z") returned 0 [0053.670] lstrlenA (lpString="*.7z") returned 4 [0053.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.tar") returned 0 [0053.670] lstrlenA (lpString="*.tar") returned 5 [0053.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.gzip") returned 0 [0053.670] lstrlenA (lpString="*.gzip") returned 6 [0053.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.jpg") returned 0 [0053.670] lstrlenA (lpString="*.jpg") returned 5 [0053.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.jpeg") returned 0 [0053.670] lstrlenA (lpString="*.jpeg") returned 6 [0053.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.psd") returned 0 [0053.670] lstrlenA (lpString="*.psd") returned 5 [0053.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.gif") returned 0 [0053.670] lstrlenA (lpString="*.gif") returned 5 [0053.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.doc") returned 0 [0053.670] lstrlenA (lpString="*.doc") returned 5 [0053.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.docx") returned 0 [0053.670] lstrlenA (lpString="*.docx") returned 6 [0053.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.xls") returned 0 [0053.670] lstrlenA (lpString="*.xls") returned 5 [0053.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.xlsx") returned 0 [0053.670] lstrlenA (lpString="*.xlsx") returned 6 [0053.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.ppt") returned 0 [0053.670] lstrlenA (lpString="*.ppt") returned 5 [0053.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.pptx") returned 0 [0053.670] lstrlenA (lpString="*.pptx") returned 6 [0053.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.pdf") returned 0 [0053.670] lstrlenA (lpString="*.pdf") returned 5 [0053.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.mov") returned 0 [0053.670] lstrlenA (lpString="*.mov") returned 5 [0053.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.m2v") returned 0 [0053.670] lstrlenA (lpString="*.m2v") returned 5 [0053.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.3gp") returned 0 [0053.671] lstrlenA (lpString="*.3gp") returned 5 [0053.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.mpeg") returned 0 [0053.671] lstrlenA (lpString="*.mpeg") returned 6 [0053.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.mpg") returned 0 [0053.671] lstrlenA (lpString="*.mpg") returned 5 [0053.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.flv") returned 0 [0053.671] lstrlenA (lpString="*.flv") returned 5 [0053.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.avi") returned 0 [0053.671] lstrlenA (lpString="*.avi") returned 5 [0053.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.mp4") returned 0 [0053.671] lstrlenA (lpString="*.mp4") returned 5 [0053.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.wmv") returned 0 [0053.671] lstrlenA (lpString="*.wmv") returned 5 [0053.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.divx") returned 0 [0053.671] lstrlenA (lpString="*.divx") returned 6 [0053.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.mkv") returned 0 [0053.671] lstrlenA (lpString="*.mkv") returned 5 [0053.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.mp3") returned 0 [0053.671] lstrlenA (lpString="*.mp3") returned 5 [0053.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.wav") returned 0 [0053.671] lstrlenA (lpString="*.wav") returned 5 [0053.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.flac") returned 0 [0053.671] lstrlenA (lpString="*.flac") returned 6 [0053.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.ape") returned 0 [0053.671] lstrlenA (lpString="*.ape") returned 5 [0053.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.wma") returned 0 [0053.671] lstrlenA (lpString="*.wma") returned 5 [0053.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.ac3") returned 0 [0053.671] lstrlenA (lpString="*.ac3") returned 5 [0053.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", pszSpec="*.mxf") returned 0 [0053.671] lstrlenA (lpString="*.mxf") returned 5 [0053.672] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fe3f700, ftCreationTime.dwHighDateTime=0x1bd5067, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fe3f700, ftLastWriteTime.dwHighDateTime=0x1bd5067, nFileSizeHigh=0x0, nFileSizeLow=0xa80a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149627.WMF", cAlternateFileName="")) returned 1 [0053.672] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.672] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0149627.WMF") returned -1 [0053.672] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0149627.WMF") returned -1 [0053.672] lstrcmpiA (lpString1="", lpString2="J0149627.WMF") returned -1 [0053.672] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF") returned="J0149481.WMF" [0053.672] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.672] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.672] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.672] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.672] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0149627.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF" [0053.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.zip") returned 0 [0053.672] lstrlenA (lpString="*.zip") returned 5 [0053.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.rar") returned 0 [0053.672] lstrlenA (lpString="*.rar") returned 5 [0053.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.7z") returned 0 [0053.672] lstrlenA (lpString="*.7z") returned 4 [0053.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.tar") returned 0 [0053.672] lstrlenA (lpString="*.tar") returned 5 [0053.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.gzip") returned 0 [0053.672] lstrlenA (lpString="*.gzip") returned 6 [0053.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.jpg") returned 0 [0053.672] lstrlenA (lpString="*.jpg") returned 5 [0053.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.jpeg") returned 0 [0053.672] lstrlenA (lpString="*.jpeg") returned 6 [0053.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.psd") returned 0 [0053.672] lstrlenA (lpString="*.psd") returned 5 [0053.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.gif") returned 0 [0053.672] lstrlenA (lpString="*.gif") returned 5 [0053.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.doc") returned 0 [0053.673] lstrlenA (lpString="*.doc") returned 5 [0053.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.docx") returned 0 [0053.673] lstrlenA (lpString="*.docx") returned 6 [0053.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.xls") returned 0 [0053.673] lstrlenA (lpString="*.xls") returned 5 [0053.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.xlsx") returned 0 [0053.673] lstrlenA (lpString="*.xlsx") returned 6 [0053.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.ppt") returned 0 [0053.673] lstrlenA (lpString="*.ppt") returned 5 [0053.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.pptx") returned 0 [0053.673] lstrlenA (lpString="*.pptx") returned 6 [0053.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.pdf") returned 0 [0053.673] lstrlenA (lpString="*.pdf") returned 5 [0053.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.mov") returned 0 [0053.673] lstrlenA (lpString="*.mov") returned 5 [0053.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.m2v") returned 0 [0053.673] lstrlenA (lpString="*.m2v") returned 5 [0053.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.3gp") returned 0 [0053.673] lstrlenA (lpString="*.3gp") returned 5 [0053.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.mpeg") returned 0 [0053.673] lstrlenA (lpString="*.mpeg") returned 6 [0053.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.mpg") returned 0 [0053.673] lstrlenA (lpString="*.mpg") returned 5 [0053.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.flv") returned 0 [0053.673] lstrlenA (lpString="*.flv") returned 5 [0053.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.avi") returned 0 [0053.673] lstrlenA (lpString="*.avi") returned 5 [0053.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.mp4") returned 0 [0053.673] lstrlenA (lpString="*.mp4") returned 5 [0053.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.wmv") returned 0 [0053.673] lstrlenA (lpString="*.wmv") returned 5 [0053.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.divx") returned 0 [0053.673] lstrlenA (lpString="*.divx") returned 6 [0053.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.mkv") returned 0 [0053.674] lstrlenA (lpString="*.mkv") returned 5 [0053.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.mp3") returned 0 [0053.674] lstrlenA (lpString="*.mp3") returned 5 [0053.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.wav") returned 0 [0053.674] lstrlenA (lpString="*.wav") returned 5 [0053.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.flac") returned 0 [0053.674] lstrlenA (lpString="*.flac") returned 6 [0053.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.ape") returned 0 [0053.674] lstrlenA (lpString="*.ape") returned 5 [0053.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.wma") returned 0 [0053.674] lstrlenA (lpString="*.wma") returned 5 [0053.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.ac3") returned 0 [0053.674] lstrlenA (lpString="*.ac3") returned 5 [0053.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", pszSpec="*.mxf") returned 0 [0053.674] lstrlenA (lpString="*.mxf") returned 5 [0053.674] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd2e700, ftCreationTime.dwHighDateTime=0x1bd6439, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9dd2e700, ftLastWriteTime.dwHighDateTime=0x1bd6439, nFileSizeHigh=0x0, nFileSizeLow=0x1ffa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149887.WMF", cAlternateFileName="")) returned 1 [0053.674] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.674] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0149887.WMF") returned -1 [0053.674] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0149887.WMF") returned -1 [0053.674] lstrcmpiA (lpString1="", lpString2="J0149887.WMF") returned -1 [0053.674] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF") returned="J0149627.WMF" [0053.674] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.674] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.674] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.674] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.675] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0149887.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF" [0053.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.zip") returned 0 [0053.675] lstrlenA (lpString="*.zip") returned 5 [0053.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.rar") returned 0 [0053.675] lstrlenA (lpString="*.rar") returned 5 [0053.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.7z") returned 0 [0053.675] lstrlenA (lpString="*.7z") returned 4 [0053.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.tar") returned 0 [0053.675] lstrlenA (lpString="*.tar") returned 5 [0053.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.gzip") returned 0 [0053.675] lstrlenA (lpString="*.gzip") returned 6 [0053.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.jpg") returned 0 [0053.675] lstrlenA (lpString="*.jpg") returned 5 [0053.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.jpeg") returned 0 [0053.675] lstrlenA (lpString="*.jpeg") returned 6 [0053.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.psd") returned 0 [0053.675] lstrlenA (lpString="*.psd") returned 5 [0053.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.gif") returned 0 [0053.675] lstrlenA (lpString="*.gif") returned 5 [0053.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.doc") returned 0 [0053.675] lstrlenA (lpString="*.doc") returned 5 [0053.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.docx") returned 0 [0053.675] lstrlenA (lpString="*.docx") returned 6 [0053.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.xls") returned 0 [0053.675] lstrlenA (lpString="*.xls") returned 5 [0053.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.xlsx") returned 0 [0053.675] lstrlenA (lpString="*.xlsx") returned 6 [0053.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.ppt") returned 0 [0053.675] lstrlenA (lpString="*.ppt") returned 5 [0053.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.pptx") returned 0 [0053.675] lstrlenA (lpString="*.pptx") returned 6 [0053.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.pdf") returned 0 [0053.676] lstrlenA (lpString="*.pdf") returned 5 [0053.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.mov") returned 0 [0053.676] lstrlenA (lpString="*.mov") returned 5 [0053.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.m2v") returned 0 [0053.676] lstrlenA (lpString="*.m2v") returned 5 [0053.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.3gp") returned 0 [0053.676] lstrlenA (lpString="*.3gp") returned 5 [0053.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.mpeg") returned 0 [0053.676] lstrlenA (lpString="*.mpeg") returned 6 [0053.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.mpg") returned 0 [0053.676] lstrlenA (lpString="*.mpg") returned 5 [0053.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.flv") returned 0 [0053.676] lstrlenA (lpString="*.flv") returned 5 [0053.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.avi") returned 0 [0053.676] lstrlenA (lpString="*.avi") returned 5 [0053.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.mp4") returned 0 [0053.676] lstrlenA (lpString="*.mp4") returned 5 [0053.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.wmv") returned 0 [0053.676] lstrlenA (lpString="*.wmv") returned 5 [0053.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.divx") returned 0 [0053.676] lstrlenA (lpString="*.divx") returned 6 [0053.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.mkv") returned 0 [0053.676] lstrlenA (lpString="*.mkv") returned 5 [0053.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.mp3") returned 0 [0053.676] lstrlenA (lpString="*.mp3") returned 5 [0053.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.wav") returned 0 [0053.676] lstrlenA (lpString="*.wav") returned 5 [0053.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.flac") returned 0 [0053.676] lstrlenA (lpString="*.flac") returned 6 [0053.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.ape") returned 0 [0053.676] lstrlenA (lpString="*.ape") returned 5 [0053.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.wma") returned 0 [0053.676] lstrlenA (lpString="*.wma") returned 5 [0053.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.ac3") returned 0 [0053.676] lstrlenA (lpString="*.ac3") returned 5 [0053.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", pszSpec="*.mxf") returned 0 [0053.677] lstrlenA (lpString="*.mxf") returned 5 [0053.677] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fc87200, ftCreationTime.dwHighDateTime=0x1bd7ec5, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fc87200, ftLastWriteTime.dwHighDateTime=0x1bd7ec5, nFileSizeHigh=0x0, nFileSizeLow=0x2068, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157763.WMF", cAlternateFileName="")) returned 1 [0053.677] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.677] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0157763.WMF") returned -1 [0053.677] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0157763.WMF") returned -1 [0053.677] lstrcmpiA (lpString1="", lpString2="J0157763.WMF") returned -1 [0053.677] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF") returned="J0149887.WMF" [0053.677] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.677] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.677] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.677] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.677] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0157763.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF" [0053.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF", pszSpec="*.zip") returned 0 [0053.677] lstrlenA (lpString="*.zip") returned 5 [0053.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF", pszSpec="*.rar") returned 0 [0053.677] lstrlenA (lpString="*.rar") returned 5 [0053.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF", pszSpec="*.7z") returned 0 [0053.677] lstrlenA (lpString="*.7z") returned 4 [0053.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF", pszSpec="*.tar") returned 0 [0053.677] lstrlenA (lpString="*.tar") returned 5 [0053.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF", pszSpec="*.gzip") returned 0 [0053.677] lstrlenA (lpString="*.gzip") returned 6 [0053.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF", pszSpec="*.jpg") returned 0 [0053.677] lstrlenA (lpString="*.jpg") returned 5 [0053.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF", pszSpec="*.jpeg") returned 0 [0053.677] lstrlenA (lpString="*.jpeg") returned 6 [0053.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF", pszSpec="*.psd") returned 0 [0053.677] lstrlenA (lpString="*.psd") returned 5 [0053.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF", pszSpec="*.gif") returned 0 [0053.677] lstrlenA (lpString="*.gif") returned 5 [0053.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF", pszSpec="*.doc") returned 0 [0053.677] lstrlenA (lpString="*.doc") returned 5 [0053.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF", pszSpec="*.docx") returned 0 [0053.678] lstrlenA (lpString="*.docx") returned 6 [0053.678] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeffa900, ftCreationTime.dwHighDateTime=0x1bd94f9, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaeffa900, ftLastWriteTime.dwHighDateTime=0x1bd94f9, nFileSizeHigh=0x0, nFileSizeLow=0x1d94, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157995.WMF", cAlternateFileName="")) returned 1 [0053.678] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.678] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0157995.WMF") returned -1 [0053.678] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0157995.WMF") returned -1 [0053.678] lstrcmpiA (lpString1="", lpString2="J0157995.WMF") returned -1 [0053.678] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF") returned="J0157763.WMF" [0053.678] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.678] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.678] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.678] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.678] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0157995.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF" [0053.678] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9ba3e00, ftCreationTime.dwHighDateTime=0x1bd94f9, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb9ba3e00, ftLastWriteTime.dwHighDateTime=0x1bd94f9, nFileSizeHigh=0x0, nFileSizeLow=0x1426, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0158007.WMF", cAlternateFileName="")) returned 1 [0053.678] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.679] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0158007.WMF") returned -1 [0053.679] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0158007.WMF") returned -1 [0053.679] lstrcmpiA (lpString1="", lpString2="J0158007.WMF") returned -1 [0053.679] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF") returned="J0157995.WMF" [0053.679] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.679] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.679] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.679] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.679] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0158007.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF" [0053.679] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf00c800, ftCreationTime.dwHighDateTime=0x1bdf6f6, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf00c800, ftLastWriteTime.dwHighDateTime=0x1bdf6f6, nFileSizeHigh=0x0, nFileSizeLow=0x4d38, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183168.WMF", cAlternateFileName="")) returned 1 [0053.679] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.679] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0183168.WMF") returned -1 [0053.679] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0183168.WMF") returned -1 [0053.679] lstrcmpiA (lpString1="", lpString2="J0183168.WMF") returned -1 [0053.679] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF") returned="J0158007.WMF" [0053.679] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.679] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.679] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.679] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.679] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0183168.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF" [0053.679] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d86900, ftCreationTime.dwHighDateTime=0x1bdf6f7, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9d86900, ftLastWriteTime.dwHighDateTime=0x1bdf6f7, nFileSizeHigh=0x0, nFileSizeLow=0x7018, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183290.WMF", cAlternateFileName="")) returned 1 [0053.679] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.679] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0183290.WMF") returned -1 [0053.679] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0183290.WMF") returned -1 [0053.679] lstrcmpiA (lpString1="", lpString2="J0183290.WMF") returned -1 [0053.679] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF") returned="J0183168.WMF" [0053.679] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.679] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.679] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.680] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.680] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0183290.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF" [0053.680] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8564400, ftCreationTime.dwHighDateTime=0x1bdf6f7, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf8564400, ftLastWriteTime.dwHighDateTime=0x1bdf6f7, nFileSizeHigh=0x0, nFileSizeLow=0x14fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183328.WMF", cAlternateFileName="")) returned 1 [0053.680] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.680] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0183328.WMF") returned -1 [0053.680] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0183328.WMF") returned -1 [0053.680] lstrcmpiA (lpString1="", lpString2="J0183328.WMF") returned -1 [0053.680] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF") returned="J0183290.WMF" [0053.680] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.680] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.680] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.680] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.680] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0183328.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF" [0053.680] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf396a700, ftCreationTime.dwHighDateTime=0x1be0d1a, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf396a700, ftLastWriteTime.dwHighDateTime=0x1be0d1a, nFileSizeHigh=0x0, nFileSizeLow=0x171c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185604.WMF", cAlternateFileName="")) returned 1 [0053.680] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.680] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0185604.WMF") returned -1 [0053.680] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0185604.WMF") returned -1 [0053.680] lstrcmpiA (lpString1="", lpString2="J0185604.WMF") returned -1 [0053.680] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF") returned="J0183328.WMF" [0053.680] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.680] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.680] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.680] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.680] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0185604.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF" [0053.680] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc0fec00, ftCreationTime.dwHighDateTime=0x1be0d23, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdc0fec00, ftLastWriteTime.dwHighDateTime=0x1be0d23, nFileSizeHigh=0x0, nFileSizeLow=0x2f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186002.WMF", cAlternateFileName="")) returned 1 [0053.680] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.680] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0186002.WMF") returned -1 [0053.681] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0186002.WMF") returned -1 [0053.681] lstrcmpiA (lpString1="", lpString2="J0186002.WMF") returned -1 [0053.681] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF") returned="J0185604.WMF" [0053.681] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.681] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.681] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.681] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.681] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0186002.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF" [0053.681] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb426a00, ftCreationTime.dwHighDateTime=0x1be0d22, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xeb426a00, ftLastWriteTime.dwHighDateTime=0x1be0d22, nFileSizeHigh=0x0, nFileSizeLow=0x1b3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186348.WMF", cAlternateFileName="")) returned 1 [0053.681] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.681] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0186348.WMF") returned -1 [0053.681] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0186348.WMF") returned -1 [0053.681] lstrcmpiA (lpString1="", lpString2="J0186348.WMF") returned -1 [0053.681] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF") returned="J0186002.WMF" [0053.681] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.681] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.681] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.681] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.681] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0186348.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF" [0053.681] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b608300, ftCreationTime.dwHighDateTime=0x1be10fe, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b608300, ftLastWriteTime.dwHighDateTime=0x1be10fe, nFileSizeHigh=0x0, nFileSizeLow=0x4746, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187423.WMF", cAlternateFileName="")) returned 1 [0053.681] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.681] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0187423.WMF") returned -1 [0053.681] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0187423.WMF") returned -1 [0053.681] lstrcmpiA (lpString1="", lpString2="J0187423.WMF") returned -1 [0053.681] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF") returned="J0186348.WMF" [0053.682] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.682] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.682] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.682] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.682] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0187423.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF" [0053.682] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc36d6a00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc36d6a00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x31da, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195384.WMF", cAlternateFileName="")) returned 1 [0053.682] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.682] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0195384.WMF") returned -1 [0053.682] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0195384.WMF") returned -1 [0053.682] lstrcmpiA (lpString1="", lpString2="J0195384.WMF") returned -1 [0053.682] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF") returned="J0187423.WMF" [0053.682] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.682] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.682] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.682] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.682] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0195384.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF" [0053.682] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa438000, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfa438000, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x275c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195534.WMF", cAlternateFileName="")) returned 1 [0053.682] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.682] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0195534.WMF") returned -1 [0053.682] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0195534.WMF") returned -1 [0053.682] lstrcmpiA (lpString1="", lpString2="J0195534.WMF") returned -1 [0053.682] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF") returned="J0195384.WMF" [0053.682] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.682] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.682] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.682] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.682] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0195534.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF" [0053.683] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x455d9300, ftCreationTime.dwHighDateTime=0x1be2706, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x455d9300, ftLastWriteTime.dwHighDateTime=0x1be2706, nFileSizeHigh=0x0, nFileSizeLow=0xfca, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195812.WMF", cAlternateFileName="")) returned 1 [0053.683] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.683] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0195812.WMF") returned -1 [0053.683] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0195812.WMF") returned -1 [0053.683] lstrcmpiA (lpString1="", lpString2="J0195812.WMF") returned -1 [0053.683] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF") returned="J0195534.WMF" [0053.683] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.683] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.683] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.683] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.683] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0195812.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF" [0053.683] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec5c200, ftCreationTime.dwHighDateTime=0x1be2706, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9ec5c200, ftLastWriteTime.dwHighDateTime=0x1be2706, nFileSizeHigh=0x0, nFileSizeLow=0x7b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196164.WMF", cAlternateFileName="")) returned 1 [0053.683] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.683] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0196164.WMF") returned -1 [0053.683] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0196164.WMF") returned -1 [0053.683] lstrcmpiA (lpString1="", lpString2="J0196164.WMF") returned -1 [0053.683] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF") returned="J0195812.WMF" [0053.683] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.683] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.683] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.683] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.683] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0196164.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF" [0053.683] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81ec6b00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81ec6b00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x1216, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196374.WMF", cAlternateFileName="")) returned 1 [0053.683] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.683] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0196374.WMF") returned -1 [0053.683] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0196374.WMF") returned -1 [0053.683] lstrcmpiA (lpString1="", lpString2="J0196374.WMF") returned -1 [0053.683] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF") returned="J0196164.WMF" [0053.684] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.684] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.684] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.684] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.684] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0196374.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF" [0053.684] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x929ce100, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x929ce100, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x8cbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196400.WMF", cAlternateFileName="")) returned 1 [0053.684] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.684] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0196400.WMF") returned -1 [0053.684] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0196400.WMF") returned -1 [0053.684] lstrcmpiA (lpString1="", lpString2="J0196400.WMF") returned -1 [0053.684] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF") returned="J0196374.WMF" [0053.684] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.684] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.684] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.684] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.684] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0196400.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF" [0053.684] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91fc00, ftCreationTime.dwHighDateTime=0x1bdf0c6, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x91fc00, ftLastWriteTime.dwHighDateTime=0x1bdf0c6, nFileSizeHigh=0x0, nFileSizeLow=0x2518, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199036.WMF", cAlternateFileName="")) returned 1 [0053.684] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.684] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0199036.WMF") returned -1 [0053.684] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0199036.WMF") returned -1 [0053.684] lstrcmpiA (lpString1="", lpString2="J0199036.WMF") returned -1 [0053.684] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF") returned="J0196400.WMF" [0053.684] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.684] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.684] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.684] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.684] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0199036.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF" [0053.685] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebd55500, ftCreationTime.dwHighDateTime=0x1be05ec, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xebd55500, ftLastWriteTime.dwHighDateTime=0x1be05ec, nFileSizeHigh=0x0, nFileSizeLow=0x8ec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199283.WMF", cAlternateFileName="")) returned 1 [0053.685] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.685] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0199283.WMF") returned -1 [0053.685] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0199283.WMF") returned -1 [0053.685] lstrcmpiA (lpString1="", lpString2="J0199283.WMF") returned -1 [0053.685] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF") returned="J0199036.WMF" [0053.685] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.685] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.685] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.685] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.685] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0199283.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF" [0053.685] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b53500, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x54b53500, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0xf5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199549.WMF", cAlternateFileName="")) returned 1 [0053.685] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.685] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0199549.WMF") returned -1 [0053.685] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0199549.WMF") returned -1 [0053.685] lstrcmpiA (lpString1="", lpString2="J0199549.WMF") returned -1 [0053.685] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF") returned="J0199283.WMF" [0053.685] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.685] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.685] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.685] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.685] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0199549.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF" [0053.685] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b8b4b00, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b8b4b00, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x341e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199661.WMF", cAlternateFileName="")) returned 1 [0053.685] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.685] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0199661.WMF") returned -1 [0053.685] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0199661.WMF") returned -1 [0053.685] lstrcmpiA (lpString1="", lpString2="J0199661.WMF") returned -1 [0053.685] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF") returned="J0199549.WMF" [0053.686] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.686] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.686] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0199661.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF" [0053.686] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1b0eb00, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb1b0eb00, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199727.WMF", cAlternateFileName="")) returned 1 [0053.686] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.686] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0199727.WMF") returned -1 [0053.686] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0199727.WMF") returned -1 [0053.686] lstrcmpiA (lpString1="", lpString2="J0199727.WMF") returned -1 [0053.686] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF") returned="J0199661.WMF" [0053.686] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.686] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.686] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0199727.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF" [0053.686] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc6b8000, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbc6b8000, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0xaf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199755.WMF", cAlternateFileName="")) returned 1 [0053.686] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.686] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0199755.WMF") returned -1 [0053.686] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0199755.WMF") returned -1 [0053.686] lstrcmpiA (lpString1="", lpString2="J0199755.WMF") returned -1 [0053.686] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF") returned="J0199727.WMF" [0053.686] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.686] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.686] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0199755.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF" [0053.687] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd311d700, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd311d700, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199805.WMF", cAlternateFileName="")) returned 1 [0053.690] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.691] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0199805.WMF") returned -1 [0053.691] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0199805.WMF") returned -1 [0053.691] lstrcmpiA (lpString1="", lpString2="J0199805.WMF") returned -1 [0053.691] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF") returned="J0199755.WMF" [0053.691] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.691] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.691] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.691] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.691] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0199805.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF" [0053.691] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85ccab00, ftCreationTime.dwHighDateTime=0x1be4d5e, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85ccab00, ftLastWriteTime.dwHighDateTime=0x1be4d5e, nFileSizeHigh=0x0, nFileSizeLow=0x2398, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0205462.WMF", cAlternateFileName="")) returned 1 [0053.691] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.691] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0205462.WMF") returned -1 [0053.691] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0205462.WMF") returned -1 [0053.691] lstrcmpiA (lpString1="", lpString2="J0205462.WMF") returned -1 [0053.691] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF") returned="J0199805.WMF" [0053.691] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.691] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.691] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.691] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.691] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0205462.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF" [0053.691] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89603200, ftCreationTime.dwHighDateTime=0x1be4d5e, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x89603200, ftLastWriteTime.dwHighDateTime=0x1be4d5e, nFileSizeHigh=0x0, nFileSizeLow=0x11e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0205466.WMF", cAlternateFileName="")) returned 1 [0053.691] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.691] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0205466.WMF") returned -1 [0053.691] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0205466.WMF") returned -1 [0053.691] lstrcmpiA (lpString1="", lpString2="J0205466.WMF") returned -1 [0053.691] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF") returned="J0205462.WMF" [0053.692] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.692] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.692] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.692] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.692] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0205466.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF" [0053.692] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14d9c300, ftCreationTime.dwHighDateTime=0x1be4d5f, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x14d9c300, ftLastWriteTime.dwHighDateTime=0x1be4d5f, nFileSizeHigh=0x0, nFileSizeLow=0x17f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0205582.WMF", cAlternateFileName="")) returned 1 [0053.692] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.692] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0205582.WMF") returned -1 [0053.692] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0205582.WMF") returned -1 [0053.692] lstrcmpiA (lpString1="", lpString2="J0205582.WMF") returned -1 [0053.692] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF") returned="J0205466.WMF" [0053.692] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.692] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.692] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.692] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.692] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0205582.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF" [0053.692] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e240a00, ftCreationTime.dwHighDateTime=0x1be560f, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3e240a00, ftLastWriteTime.dwHighDateTime=0x1be560f, nFileSizeHigh=0x0, nFileSizeLow=0xb34e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0211949.WMF", cAlternateFileName="")) returned 1 [0053.692] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.692] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0211949.WMF") returned -1 [0053.692] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0211949.WMF") returned -1 [0053.692] lstrcmpiA (lpString1="", lpString2="J0211949.WMF") returned -1 [0053.692] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF") returned="J0205582.WMF" [0053.692] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.692] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.692] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.692] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.693] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0211949.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF" [0053.693] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50527800, ftCreationTime.dwHighDateTime=0x1be5610, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x50527800, ftLastWriteTime.dwHighDateTime=0x1be5610, nFileSizeHigh=0x0, nFileSizeLow=0x11be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212219.WMF", cAlternateFileName="")) returned 1 [0053.693] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.693] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0212219.WMF") returned -1 [0053.693] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0212219.WMF") returned -1 [0053.693] lstrcmpiA (lpString1="", lpString2="J0212219.WMF") returned -1 [0053.693] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF") returned="J0211949.WMF" [0053.693] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.693] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.693] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.693] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.693] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0212219.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF" [0053.693] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56952400, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x56952400, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0x248e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212661.WMF", cAlternateFileName="")) returned 1 [0053.693] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.693] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0212661.WMF") returned -1 [0053.693] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0212661.WMF") returned -1 [0053.693] lstrcmpiA (lpString1="", lpString2="J0212661.WMF") returned -1 [0053.693] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF") returned="J0212219.WMF" [0053.693] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.693] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.693] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.693] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.693] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0212661.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF" [0053.694] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e6ca800, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e6ca800, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0xb7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212701.WMF", cAlternateFileName="")) returned 1 [0053.694] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.694] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0212701.WMF") returned -1 [0053.694] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0212701.WMF") returned -1 [0053.694] lstrcmpiA (lpString1="", lpString2="J0212701.WMF") returned -1 [0053.694] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF") returned="J0212661.WMF" [0053.694] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.694] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.694] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.694] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.694] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0212701.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF" [0053.694] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdae7a700, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdae7a700, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0x2424, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212957.WMF", cAlternateFileName="")) returned 1 [0053.694] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.694] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0212957.WMF") returned -1 [0053.694] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0212957.WMF") returned -1 [0053.694] lstrcmpiA (lpString1="", lpString2="J0212957.WMF") returned -1 [0053.694] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF") returned="J0212701.WMF" [0053.694] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.694] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.694] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.694] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.694] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0212957.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF" [0053.694] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8726e600, ftCreationTime.dwHighDateTime=0x1be59a2, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8726e600, ftLastWriteTime.dwHighDateTime=0x1be59a2, nFileSizeHigh=0x0, nFileSizeLow=0x68ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0214098.WAV", cAlternateFileName="")) returned 1 [0053.694] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.694] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0214098.WAV") returned -1 [0053.694] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0214098.WAV") returned -1 [0053.695] lstrcmpiA (lpString1="", lpString2="J0214098.WAV") returned -1 [0053.695] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF") returned="J0212957.WMF" [0053.695] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.695] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.695] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.695] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.695] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0214098.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" [0053.695] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" [0053.695] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" [0053.695] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV." [0053.695] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV.wannacry" [0053.695] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0053.696] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x68ba [0053.696] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8726e600, dwHighDateTime=0x1be59a2), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd512fa0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8726e600, dwHighDateTime=0x1be59a2)) returned 1 [0053.696] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0053.696] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x683c, lpOverlapped=0x0) returned 1 [0053.698] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV") returned="J0214098.WAV" [0053.698] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0053.698] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x683c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x683c, lpOverlapped=0x0) returned 1 [0053.698] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.698] CloseHandle (hObject=0x8c) returned 1 [0053.699] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav.wannacry")) returned 1 [0053.702] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32ba5a00, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x32ba5a00, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1d3a, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="J0215086.WMF", cAlternateFileName="")) returned 1 [0053.702] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.702] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0215086.WMF") returned -1 [0053.702] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0215086.WMF") returned -1 [0053.702] lstrcmpiA (lpString1="", lpString2="J0215086.WMF") returned -1 [0053.702] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV") returned="J0214098.WAV" [0053.702] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.702] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.702] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.702] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.702] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0215086.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF" [0053.702] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.zip") returned 0 [0053.702] lstrlenA (lpString="*.zip") returned 5 [0053.702] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.rar") returned 0 [0053.702] lstrlenA (lpString="*.rar") returned 5 [0053.702] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.7z") returned 0 [0053.702] lstrlenA (lpString="*.7z") returned 4 [0053.702] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.tar") returned 0 [0053.702] lstrlenA (lpString="*.tar") returned 5 [0053.703] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.gzip") returned 0 [0053.703] lstrlenA (lpString="*.gzip") returned 6 [0053.703] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.jpg") returned 0 [0053.703] lstrlenA (lpString="*.jpg") returned 5 [0053.703] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.jpeg") returned 0 [0053.703] lstrlenA (lpString="*.jpeg") returned 6 [0053.703] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.psd") returned 0 [0053.703] lstrlenA (lpString="*.psd") returned 5 [0053.703] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.gif") returned 0 [0053.703] lstrlenA (lpString="*.gif") returned 5 [0053.703] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.doc") returned 0 [0053.703] lstrlenA (lpString="*.doc") returned 5 [0053.703] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.docx") returned 0 [0053.703] lstrlenA (lpString="*.docx") returned 6 [0053.703] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.xls") returned 0 [0053.703] lstrlenA (lpString="*.xls") returned 5 [0053.703] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.xlsx") returned 0 [0053.703] lstrlenA (lpString="*.xlsx") returned 6 [0053.703] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.ppt") returned 0 [0053.703] lstrlenA (lpString="*.ppt") returned 5 [0053.703] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.pptx") returned 0 [0053.703] lstrlenA (lpString="*.pptx") returned 6 [0053.703] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.pdf") returned 0 [0053.703] lstrlenA (lpString="*.pdf") returned 5 [0053.703] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.mov") returned 0 [0053.703] lstrlenA (lpString="*.mov") returned 5 [0053.703] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.m2v") returned 0 [0053.703] lstrlenA (lpString="*.m2v") returned 5 [0053.703] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.3gp") returned 0 [0053.703] lstrlenA (lpString="*.3gp") returned 5 [0053.703] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.mpeg") returned 0 [0053.703] lstrlenA (lpString="*.mpeg") returned 6 [0053.703] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.mpg") returned 0 [0053.703] lstrlenA (lpString="*.mpg") returned 5 [0053.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.flv") returned 0 [0053.704] lstrlenA (lpString="*.flv") returned 5 [0053.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.avi") returned 0 [0053.704] lstrlenA (lpString="*.avi") returned 5 [0053.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.mp4") returned 0 [0053.704] lstrlenA (lpString="*.mp4") returned 5 [0053.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.wmv") returned 0 [0053.704] lstrlenA (lpString="*.wmv") returned 5 [0053.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.divx") returned 0 [0053.704] lstrlenA (lpString="*.divx") returned 6 [0053.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.mkv") returned 0 [0053.704] lstrlenA (lpString="*.mkv") returned 5 [0053.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.mp3") returned 0 [0053.704] lstrlenA (lpString="*.mp3") returned 5 [0053.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.wav") returned 0 [0053.704] lstrlenA (lpString="*.wav") returned 5 [0053.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.flac") returned 0 [0053.704] lstrlenA (lpString="*.flac") returned 6 [0053.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.ape") returned 0 [0053.704] lstrlenA (lpString="*.ape") returned 5 [0053.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.wma") returned 0 [0053.704] lstrlenA (lpString="*.wma") returned 5 [0053.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.ac3") returned 0 [0053.704] lstrlenA (lpString="*.ac3") returned 5 [0053.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", pszSpec="*.mxf") returned 0 [0053.704] lstrlenA (lpString="*.mxf") returned 5 [0053.704] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35c4ec00, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x35c4ec00, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x3138, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216516.WMF", cAlternateFileName="")) returned 1 [0053.704] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.704] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0216516.WMF") returned -1 [0053.704] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0216516.WMF") returned -1 [0053.704] lstrcmpiA (lpString1="", lpString2="J0216516.WMF") returned -1 [0053.704] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF") returned="J0215086.WMF" [0053.704] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.704] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.704] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.704] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.705] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0216516.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF" [0053.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.zip") returned 0 [0053.705] lstrlenA (lpString="*.zip") returned 5 [0053.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.rar") returned 0 [0053.705] lstrlenA (lpString="*.rar") returned 5 [0053.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.7z") returned 0 [0053.705] lstrlenA (lpString="*.7z") returned 4 [0053.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.tar") returned 0 [0053.705] lstrlenA (lpString="*.tar") returned 5 [0053.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.gzip") returned 0 [0053.705] lstrlenA (lpString="*.gzip") returned 6 [0053.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.jpg") returned 0 [0053.705] lstrlenA (lpString="*.jpg") returned 5 [0053.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.jpeg") returned 0 [0053.705] lstrlenA (lpString="*.jpeg") returned 6 [0053.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.psd") returned 0 [0053.705] lstrlenA (lpString="*.psd") returned 5 [0053.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.gif") returned 0 [0053.705] lstrlenA (lpString="*.gif") returned 5 [0053.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.doc") returned 0 [0053.705] lstrlenA (lpString="*.doc") returned 5 [0053.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.docx") returned 0 [0053.705] lstrlenA (lpString="*.docx") returned 6 [0053.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.xls") returned 0 [0053.705] lstrlenA (lpString="*.xls") returned 5 [0053.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.xlsx") returned 0 [0053.705] lstrlenA (lpString="*.xlsx") returned 6 [0053.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.ppt") returned 0 [0053.705] lstrlenA (lpString="*.ppt") returned 5 [0053.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.pptx") returned 0 [0053.706] lstrlenA (lpString="*.pptx") returned 6 [0053.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.pdf") returned 0 [0053.706] lstrlenA (lpString="*.pdf") returned 5 [0053.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.mov") returned 0 [0053.706] lstrlenA (lpString="*.mov") returned 5 [0053.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.m2v") returned 0 [0053.706] lstrlenA (lpString="*.m2v") returned 5 [0053.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.3gp") returned 0 [0053.706] lstrlenA (lpString="*.3gp") returned 5 [0053.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.mpeg") returned 0 [0053.706] lstrlenA (lpString="*.mpeg") returned 6 [0053.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.mpg") returned 0 [0053.706] lstrlenA (lpString="*.mpg") returned 5 [0053.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.flv") returned 0 [0053.706] lstrlenA (lpString="*.flv") returned 5 [0053.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.avi") returned 0 [0053.706] lstrlenA (lpString="*.avi") returned 5 [0053.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.mp4") returned 0 [0053.706] lstrlenA (lpString="*.mp4") returned 5 [0053.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.wmv") returned 0 [0053.706] lstrlenA (lpString="*.wmv") returned 5 [0053.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.divx") returned 0 [0053.706] lstrlenA (lpString="*.divx") returned 6 [0053.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.mkv") returned 0 [0053.706] lstrlenA (lpString="*.mkv") returned 5 [0053.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.mp3") returned 0 [0053.706] lstrlenA (lpString="*.mp3") returned 5 [0053.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.wav") returned 0 [0053.706] lstrlenA (lpString="*.wav") returned 5 [0053.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.flac") returned 0 [0053.707] lstrlenA (lpString="*.flac") returned 6 [0053.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.ape") returned 0 [0053.707] lstrlenA (lpString="*.ape") returned 5 [0053.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.wma") returned 0 [0053.707] lstrlenA (lpString="*.wma") returned 5 [0053.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.ac3") returned 0 [0053.707] lstrlenA (lpString="*.ac3") returned 5 [0053.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", pszSpec="*.mxf") returned 0 [0053.707] lstrlenA (lpString="*.mxf") returned 5 [0053.707] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e7ca500, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7e7ca500, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x1c06, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216588.WMF", cAlternateFileName="")) returned 1 [0053.707] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.707] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0216588.WMF") returned -1 [0053.707] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0216588.WMF") returned -1 [0053.707] lstrcmpiA (lpString1="", lpString2="J0216588.WMF") returned -1 [0053.707] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF") returned="J0216516.WMF" [0053.707] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.707] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.707] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.707] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.707] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0216588.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF" [0053.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.zip") returned 0 [0053.707] lstrlenA (lpString="*.zip") returned 5 [0053.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.rar") returned 0 [0053.707] lstrlenA (lpString="*.rar") returned 5 [0053.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.7z") returned 0 [0053.707] lstrlenA (lpString="*.7z") returned 4 [0053.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.tar") returned 0 [0053.707] lstrlenA (lpString="*.tar") returned 5 [0053.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.gzip") returned 0 [0053.707] lstrlenA (lpString="*.gzip") returned 6 [0053.707] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.jpg") returned 0 [0053.708] lstrlenA (lpString="*.jpg") returned 5 [0053.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.jpeg") returned 0 [0053.708] lstrlenA (lpString="*.jpeg") returned 6 [0053.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.psd") returned 0 [0053.708] lstrlenA (lpString="*.psd") returned 5 [0053.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.gif") returned 0 [0053.708] lstrlenA (lpString="*.gif") returned 5 [0053.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.doc") returned 0 [0053.708] lstrlenA (lpString="*.doc") returned 5 [0053.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.docx") returned 0 [0053.708] lstrlenA (lpString="*.docx") returned 6 [0053.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.xls") returned 0 [0053.708] lstrlenA (lpString="*.xls") returned 5 [0053.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.xlsx") returned 0 [0053.708] lstrlenA (lpString="*.xlsx") returned 6 [0053.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.ppt") returned 0 [0053.708] lstrlenA (lpString="*.ppt") returned 5 [0053.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.pptx") returned 0 [0053.708] lstrlenA (lpString="*.pptx") returned 6 [0053.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.pdf") returned 0 [0053.708] lstrlenA (lpString="*.pdf") returned 5 [0053.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.mov") returned 0 [0053.708] lstrlenA (lpString="*.mov") returned 5 [0053.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.m2v") returned 0 [0053.708] lstrlenA (lpString="*.m2v") returned 5 [0053.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.3gp") returned 0 [0053.708] lstrlenA (lpString="*.3gp") returned 5 [0053.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.mpeg") returned 0 [0053.708] lstrlenA (lpString="*.mpeg") returned 6 [0053.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.mpg") returned 0 [0053.708] lstrlenA (lpString="*.mpg") returned 5 [0053.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.flv") returned 0 [0053.709] lstrlenA (lpString="*.flv") returned 5 [0053.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.avi") returned 0 [0053.709] lstrlenA (lpString="*.avi") returned 5 [0053.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.mp4") returned 0 [0053.709] lstrlenA (lpString="*.mp4") returned 5 [0053.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.wmv") returned 0 [0053.709] lstrlenA (lpString="*.wmv") returned 5 [0053.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.divx") returned 0 [0053.709] lstrlenA (lpString="*.divx") returned 6 [0053.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.mkv") returned 0 [0053.709] lstrlenA (lpString="*.mkv") returned 5 [0053.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.mp3") returned 0 [0053.709] lstrlenA (lpString="*.mp3") returned 5 [0053.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.wav") returned 0 [0053.709] lstrlenA (lpString="*.wav") returned 5 [0053.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.flac") returned 0 [0053.709] lstrlenA (lpString="*.flac") returned 6 [0053.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.ape") returned 0 [0053.709] lstrlenA (lpString="*.ape") returned 5 [0053.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.wma") returned 0 [0053.709] lstrlenA (lpString="*.wma") returned 5 [0053.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.ac3") returned 0 [0053.709] lstrlenA (lpString="*.ac3") returned 5 [0053.709] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", pszSpec="*.mxf") returned 0 [0053.709] lstrlenA (lpString="*.mxf") returned 5 [0053.709] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff3ba100, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xff3ba100, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x5d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216724.WMF", cAlternateFileName="")) returned 1 [0053.709] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.709] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0216724.WMF") returned -1 [0053.709] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0216724.WMF") returned -1 [0053.709] lstrcmpiA (lpString1="", lpString2="J0216724.WMF") returned -1 [0053.709] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF") returned="J0216588.WMF" [0053.709] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.709] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.710] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.710] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.710] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0216724.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF" [0053.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.zip") returned 0 [0053.710] lstrlenA (lpString="*.zip") returned 5 [0053.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.rar") returned 0 [0053.710] lstrlenA (lpString="*.rar") returned 5 [0053.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.7z") returned 0 [0053.710] lstrlenA (lpString="*.7z") returned 4 [0053.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.tar") returned 0 [0053.710] lstrlenA (lpString="*.tar") returned 5 [0053.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.gzip") returned 0 [0053.710] lstrlenA (lpString="*.gzip") returned 6 [0053.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.jpg") returned 0 [0053.710] lstrlenA (lpString="*.jpg") returned 5 [0053.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.jpeg") returned 0 [0053.710] lstrlenA (lpString="*.jpeg") returned 6 [0053.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.psd") returned 0 [0053.710] lstrlenA (lpString="*.psd") returned 5 [0053.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.gif") returned 0 [0053.710] lstrlenA (lpString="*.gif") returned 5 [0053.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.doc") returned 0 [0053.710] lstrlenA (lpString="*.doc") returned 5 [0053.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.docx") returned 0 [0053.710] lstrlenA (lpString="*.docx") returned 6 [0053.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.xls") returned 0 [0053.710] lstrlenA (lpString="*.xls") returned 5 [0053.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.xlsx") returned 0 [0053.710] lstrlenA (lpString="*.xlsx") returned 6 [0053.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.ppt") returned 0 [0053.711] lstrlenA (lpString="*.ppt") returned 5 [0053.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.pptx") returned 0 [0053.711] lstrlenA (lpString="*.pptx") returned 6 [0053.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.pdf") returned 0 [0053.711] lstrlenA (lpString="*.pdf") returned 5 [0053.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.mov") returned 0 [0053.711] lstrlenA (lpString="*.mov") returned 5 [0053.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.m2v") returned 0 [0053.711] lstrlenA (lpString="*.m2v") returned 5 [0053.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.3gp") returned 0 [0053.711] lstrlenA (lpString="*.3gp") returned 5 [0053.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.mpeg") returned 0 [0053.711] lstrlenA (lpString="*.mpeg") returned 6 [0053.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.mpg") returned 0 [0053.711] lstrlenA (lpString="*.mpg") returned 5 [0053.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.flv") returned 0 [0053.711] lstrlenA (lpString="*.flv") returned 5 [0053.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.avi") returned 0 [0053.711] lstrlenA (lpString="*.avi") returned 5 [0053.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.mp4") returned 0 [0053.711] lstrlenA (lpString="*.mp4") returned 5 [0053.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.wmv") returned 0 [0053.711] lstrlenA (lpString="*.wmv") returned 5 [0053.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.divx") returned 0 [0053.711] lstrlenA (lpString="*.divx") returned 6 [0053.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.mkv") returned 0 [0053.711] lstrlenA (lpString="*.mkv") returned 5 [0053.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.mp3") returned 0 [0053.711] lstrlenA (lpString="*.mp3") returned 5 [0053.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.wav") returned 0 [0053.711] lstrlenA (lpString="*.wav") returned 5 [0053.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.flac") returned 0 [0053.711] lstrlenA (lpString="*.flac") returned 6 [0053.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.ape") returned 0 [0053.712] lstrlenA (lpString="*.ape") returned 5 [0053.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.wma") returned 0 [0053.712] lstrlenA (lpString="*.wma") returned 5 [0053.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.ac3") returned 0 [0053.712] lstrlenA (lpString="*.ac3") returned 5 [0053.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", pszSpec="*.mxf") returned 0 [0053.712] lstrlenA (lpString="*.mxf") returned 5 [0053.712] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x825cf700, ftCreationTime.dwHighDateTime=0x1be6c1b, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x825cf700, ftLastWriteTime.dwHighDateTime=0x1be6c1b, nFileSizeHigh=0x0, nFileSizeLow=0x2dc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216858.WMF", cAlternateFileName="")) returned 1 [0053.712] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.712] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0216858.WMF") returned -1 [0053.712] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0216858.WMF") returned -1 [0053.712] lstrcmpiA (lpString1="", lpString2="J0216858.WMF") returned -1 [0053.712] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF") returned="J0216724.WMF" [0053.712] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.712] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.712] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.712] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.712] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0216858.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF" [0053.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.zip") returned 0 [0053.712] lstrlenA (lpString="*.zip") returned 5 [0053.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.rar") returned 0 [0053.712] lstrlenA (lpString="*.rar") returned 5 [0053.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.7z") returned 0 [0053.712] lstrlenA (lpString="*.7z") returned 4 [0053.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.tar") returned 0 [0053.712] lstrlenA (lpString="*.tar") returned 5 [0053.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.gzip") returned 0 [0053.712] lstrlenA (lpString="*.gzip") returned 6 [0053.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.jpg") returned 0 [0053.712] lstrlenA (lpString="*.jpg") returned 5 [0053.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.jpeg") returned 0 [0053.713] lstrlenA (lpString="*.jpeg") returned 6 [0053.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.psd") returned 0 [0053.713] lstrlenA (lpString="*.psd") returned 5 [0053.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.gif") returned 0 [0053.713] lstrlenA (lpString="*.gif") returned 5 [0053.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.doc") returned 0 [0053.713] lstrlenA (lpString="*.doc") returned 5 [0053.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.docx") returned 0 [0053.713] lstrlenA (lpString="*.docx") returned 6 [0053.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.xls") returned 0 [0053.713] lstrlenA (lpString="*.xls") returned 5 [0053.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.xlsx") returned 0 [0053.713] lstrlenA (lpString="*.xlsx") returned 6 [0053.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.ppt") returned 0 [0053.713] lstrlenA (lpString="*.ppt") returned 5 [0053.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.pptx") returned 0 [0053.713] lstrlenA (lpString="*.pptx") returned 6 [0053.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.pdf") returned 0 [0053.713] lstrlenA (lpString="*.pdf") returned 5 [0053.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.mov") returned 0 [0053.713] lstrlenA (lpString="*.mov") returned 5 [0053.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.m2v") returned 0 [0053.713] lstrlenA (lpString="*.m2v") returned 5 [0053.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.3gp") returned 0 [0053.713] lstrlenA (lpString="*.3gp") returned 5 [0053.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.mpeg") returned 0 [0053.713] lstrlenA (lpString="*.mpeg") returned 6 [0053.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.mpg") returned 0 [0053.713] lstrlenA (lpString="*.mpg") returned 5 [0053.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.flv") returned 0 [0053.713] lstrlenA (lpString="*.flv") returned 5 [0053.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.avi") returned 0 [0053.713] lstrlenA (lpString="*.avi") returned 5 [0053.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.mp4") returned 0 [0053.713] lstrlenA (lpString="*.mp4") returned 5 [0053.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.wmv") returned 0 [0053.714] lstrlenA (lpString="*.wmv") returned 5 [0053.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.divx") returned 0 [0053.714] lstrlenA (lpString="*.divx") returned 6 [0053.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.mkv") returned 0 [0053.714] lstrlenA (lpString="*.mkv") returned 5 [0053.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.mp3") returned 0 [0053.714] lstrlenA (lpString="*.mp3") returned 5 [0053.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.wav") returned 0 [0053.714] lstrlenA (lpString="*.wav") returned 5 [0053.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.flac") returned 0 [0053.714] lstrlenA (lpString="*.flac") returned 6 [0053.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.ape") returned 0 [0053.714] lstrlenA (lpString="*.ape") returned 5 [0053.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.wma") returned 0 [0053.714] lstrlenA (lpString="*.wma") returned 5 [0053.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.ac3") returned 0 [0053.714] lstrlenA (lpString="*.ac3") returned 5 [0053.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", pszSpec="*.mxf") returned 0 [0053.714] lstrlenA (lpString="*.mxf") returned 5 [0053.714] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8cb3500, ftCreationTime.dwHighDateTime=0x1be6c1d, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd8cb3500, ftLastWriteTime.dwHighDateTime=0x1be6c1d, nFileSizeHigh=0x0, nFileSizeLow=0x1aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0217698.WMF", cAlternateFileName="")) returned 1 [0053.714] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.714] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0217698.WMF") returned -1 [0053.714] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0217698.WMF") returned -1 [0053.714] lstrcmpiA (lpString1="", lpString2="J0217698.WMF") returned -1 [0053.714] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF") returned="J0216858.WMF" [0053.714] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.714] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.714] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.714] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.714] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0217698.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF" [0053.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.zip") returned 0 [0053.715] lstrlenA (lpString="*.zip") returned 5 [0053.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.rar") returned 0 [0053.715] lstrlenA (lpString="*.rar") returned 5 [0053.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.7z") returned 0 [0053.715] lstrlenA (lpString="*.7z") returned 4 [0053.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.tar") returned 0 [0053.715] lstrlenA (lpString="*.tar") returned 5 [0053.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.gzip") returned 0 [0053.715] lstrlenA (lpString="*.gzip") returned 6 [0053.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.jpg") returned 0 [0053.715] lstrlenA (lpString="*.jpg") returned 5 [0053.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.jpeg") returned 0 [0053.715] lstrlenA (lpString="*.jpeg") returned 6 [0053.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.psd") returned 0 [0053.715] lstrlenA (lpString="*.psd") returned 5 [0053.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.gif") returned 0 [0053.715] lstrlenA (lpString="*.gif") returned 5 [0053.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.doc") returned 0 [0053.715] lstrlenA (lpString="*.doc") returned 5 [0053.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.docx") returned 0 [0053.715] lstrlenA (lpString="*.docx") returned 6 [0053.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.xls") returned 0 [0053.715] lstrlenA (lpString="*.xls") returned 5 [0053.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.xlsx") returned 0 [0053.715] lstrlenA (lpString="*.xlsx") returned 6 [0053.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.ppt") returned 0 [0053.715] lstrlenA (lpString="*.ppt") returned 5 [0053.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.pptx") returned 0 [0053.715] lstrlenA (lpString="*.pptx") returned 6 [0053.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.pdf") returned 0 [0053.715] lstrlenA (lpString="*.pdf") returned 5 [0053.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.mov") returned 0 [0053.716] lstrlenA (lpString="*.mov") returned 5 [0053.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.m2v") returned 0 [0053.716] lstrlenA (lpString="*.m2v") returned 5 [0053.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.3gp") returned 0 [0053.716] lstrlenA (lpString="*.3gp") returned 5 [0053.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.mpeg") returned 0 [0053.716] lstrlenA (lpString="*.mpeg") returned 6 [0053.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.mpg") returned 0 [0053.716] lstrlenA (lpString="*.mpg") returned 5 [0053.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.flv") returned 0 [0053.716] lstrlenA (lpString="*.flv") returned 5 [0053.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.avi") returned 0 [0053.716] lstrlenA (lpString="*.avi") returned 5 [0053.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.mp4") returned 0 [0053.716] lstrlenA (lpString="*.mp4") returned 5 [0053.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.wmv") returned 0 [0053.716] lstrlenA (lpString="*.wmv") returned 5 [0053.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.divx") returned 0 [0053.716] lstrlenA (lpString="*.divx") returned 6 [0053.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.mkv") returned 0 [0053.716] lstrlenA (lpString="*.mkv") returned 5 [0053.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.mp3") returned 0 [0053.716] lstrlenA (lpString="*.mp3") returned 5 [0053.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.wav") returned 0 [0053.716] lstrlenA (lpString="*.wav") returned 5 [0053.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.flac") returned 0 [0053.716] lstrlenA (lpString="*.flac") returned 6 [0053.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.ape") returned 0 [0053.716] lstrlenA (lpString="*.ape") returned 5 [0053.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.wma") returned 0 [0053.716] lstrlenA (lpString="*.wma") returned 5 [0053.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.ac3") returned 0 [0053.716] lstrlenA (lpString="*.ac3") returned 5 [0053.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", pszSpec="*.mxf") returned 0 [0053.717] lstrlenA (lpString="*.mxf") returned 5 [0053.717] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bfdb600, ftCreationTime.dwHighDateTime=0x1be7a36, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7bfdb600, ftLastWriteTime.dwHighDateTime=0x1be7a36, nFileSizeHigh=0x0, nFileSizeLow=0x3838, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0221903.WMF", cAlternateFileName="")) returned 1 [0053.717] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.717] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0221903.WMF") returned -1 [0053.717] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0221903.WMF") returned -1 [0053.717] lstrcmpiA (lpString1="", lpString2="J0221903.WMF") returned -1 [0053.717] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF") returned="J0217698.WMF" [0053.717] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.717] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.717] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.717] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.717] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0221903.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF" [0053.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.zip") returned 0 [0053.717] lstrlenA (lpString="*.zip") returned 5 [0053.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.rar") returned 0 [0053.717] lstrlenA (lpString="*.rar") returned 5 [0053.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.7z") returned 0 [0053.717] lstrlenA (lpString="*.7z") returned 4 [0053.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.tar") returned 0 [0053.717] lstrlenA (lpString="*.tar") returned 5 [0053.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.gzip") returned 0 [0053.717] lstrlenA (lpString="*.gzip") returned 6 [0053.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.jpg") returned 0 [0053.717] lstrlenA (lpString="*.jpg") returned 5 [0053.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.jpeg") returned 0 [0053.717] lstrlenA (lpString="*.jpeg") returned 6 [0053.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.psd") returned 0 [0053.717] lstrlenA (lpString="*.psd") returned 5 [0053.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.gif") returned 0 [0053.718] lstrlenA (lpString="*.gif") returned 5 [0053.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.doc") returned 0 [0053.718] lstrlenA (lpString="*.doc") returned 5 [0053.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.docx") returned 0 [0053.718] lstrlenA (lpString="*.docx") returned 6 [0053.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.xls") returned 0 [0053.718] lstrlenA (lpString="*.xls") returned 5 [0053.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.xlsx") returned 0 [0053.718] lstrlenA (lpString="*.xlsx") returned 6 [0053.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.ppt") returned 0 [0053.718] lstrlenA (lpString="*.ppt") returned 5 [0053.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.pptx") returned 0 [0053.718] lstrlenA (lpString="*.pptx") returned 6 [0053.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.pdf") returned 0 [0053.718] lstrlenA (lpString="*.pdf") returned 5 [0053.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.mov") returned 0 [0053.718] lstrlenA (lpString="*.mov") returned 5 [0053.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.m2v") returned 0 [0053.718] lstrlenA (lpString="*.m2v") returned 5 [0053.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.3gp") returned 0 [0053.718] lstrlenA (lpString="*.3gp") returned 5 [0053.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.mpeg") returned 0 [0053.718] lstrlenA (lpString="*.mpeg") returned 6 [0053.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.mpg") returned 0 [0053.718] lstrlenA (lpString="*.mpg") returned 5 [0053.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.flv") returned 0 [0053.718] lstrlenA (lpString="*.flv") returned 5 [0053.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.avi") returned 0 [0053.718] lstrlenA (lpString="*.avi") returned 5 [0053.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.mp4") returned 0 [0053.719] lstrlenA (lpString="*.mp4") returned 5 [0053.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.wmv") returned 0 [0053.719] lstrlenA (lpString="*.wmv") returned 5 [0053.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.divx") returned 0 [0053.719] lstrlenA (lpString="*.divx") returned 6 [0053.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.mkv") returned 0 [0053.719] lstrlenA (lpString="*.mkv") returned 5 [0053.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.mp3") returned 0 [0053.719] lstrlenA (lpString="*.mp3") returned 5 [0053.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.wav") returned 0 [0053.719] lstrlenA (lpString="*.wav") returned 5 [0053.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.flac") returned 0 [0053.719] lstrlenA (lpString="*.flac") returned 6 [0053.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.ape") returned 0 [0053.719] lstrlenA (lpString="*.ape") returned 5 [0053.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.wma") returned 0 [0053.719] lstrlenA (lpString="*.wma") returned 5 [0053.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.ac3") returned 0 [0053.719] lstrlenA (lpString="*.ac3") returned 5 [0053.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", pszSpec="*.mxf") returned 0 [0053.719] lstrlenA (lpString="*.mxf") returned 5 [0053.719] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7bae00, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7d7bae00, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222015.WMF", cAlternateFileName="")) returned 1 [0053.719] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.719] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0222015.WMF") returned -1 [0053.719] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0222015.WMF") returned -1 [0053.719] lstrcmpiA (lpString1="", lpString2="J0222015.WMF") returned -1 [0053.719] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF") returned="J0221903.WMF" [0053.719] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.719] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.719] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.719] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.720] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0222015.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF" [0053.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF", pszSpec="*.zip") returned 0 [0053.720] lstrlenA (lpString="*.zip") returned 5 [0053.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF", pszSpec="*.rar") returned 0 [0053.720] lstrlenA (lpString="*.rar") returned 5 [0053.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF", pszSpec="*.7z") returned 0 [0053.720] lstrlenA (lpString="*.7z") returned 4 [0053.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF", pszSpec="*.tar") returned 0 [0053.720] lstrlenA (lpString="*.tar") returned 5 [0053.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF", pszSpec="*.gzip") returned 0 [0053.720] lstrlenA (lpString="*.gzip") returned 6 [0053.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF", pszSpec="*.jpg") returned 0 [0053.720] lstrlenA (lpString="*.jpg") returned 5 [0053.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF", pszSpec="*.jpeg") returned 0 [0053.720] lstrlenA (lpString="*.jpeg") returned 6 [0053.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF", pszSpec="*.psd") returned 0 [0053.720] lstrlenA (lpString="*.psd") returned 5 [0053.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF", pszSpec="*.gif") returned 0 [0053.720] lstrlenA (lpString="*.gif") returned 5 [0053.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF", pszSpec="*.doc") returned 0 [0053.720] lstrlenA (lpString="*.doc") returned 5 [0053.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF", pszSpec="*.docx") returned 0 [0053.720] lstrlenA (lpString="*.docx") returned 6 [0053.721] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fde0800, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fde0800, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x632, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222017.WMF", cAlternateFileName="")) returned 1 [0053.721] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.721] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0222017.WMF") returned -1 [0053.721] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0222017.WMF") returned -1 [0053.721] lstrcmpiA (lpString1="", lpString2="J0222017.WMF") returned -1 [0053.721] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF") returned="J0222015.WMF" [0053.721] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.721] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.721] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.721] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.721] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0222017.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF" [0053.721] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82406200, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x82406200, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x58e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222019.WMF", cAlternateFileName="")) returned 1 [0053.721] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.721] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0222019.WMF") returned -1 [0053.721] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0222019.WMF") returned -1 [0053.721] lstrcmpiA (lpString1="", lpString2="J0222019.WMF") returned -1 [0053.721] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF") returned="J0222017.WMF" [0053.721] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.721] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.721] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.721] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.721] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0222019.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF" [0053.721] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85d3e900, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85d3e900, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222021.WMF", cAlternateFileName="")) returned 1 [0053.721] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.722] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0222021.WMF") returned -1 [0053.722] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0222021.WMF") returned -1 [0053.722] lstrcmpiA (lpString1="", lpString2="J0222021.WMF") returned -1 [0053.722] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF") returned="J0222019.WMF" [0053.722] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.722] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.722] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.722] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.722] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0222021.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF" [0053.722] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b0a7e00, ftCreationTime.dwHighDateTime=0x1be860b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7b0a7e00, ftLastWriteTime.dwHighDateTime=0x1be860b, nFileSizeHigh=0x0, nFileSizeLow=0xf5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0229385.WMF", cAlternateFileName="")) returned 1 [0053.722] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.722] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0229385.WMF") returned -1 [0053.722] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0229385.WMF") returned -1 [0053.722] lstrcmpiA (lpString1="", lpString2="J0229385.WMF") returned -1 [0053.722] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF") returned="J0222021.WMF" [0053.722] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.722] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.722] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.722] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.722] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0229385.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF" [0053.722] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c3bab00, ftCreationTime.dwHighDateTime=0x1be860b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7c3bab00, ftLastWriteTime.dwHighDateTime=0x1be860b, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0229389.WMF", cAlternateFileName="")) returned 1 [0053.722] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.722] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0229389.WMF") returned -1 [0053.722] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0229389.WMF") returned -1 [0053.722] lstrcmpiA (lpString1="", lpString2="J0229389.WMF") returned -1 [0053.722] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF") returned="J0229385.WMF" [0053.722] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.722] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.723] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.723] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.723] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0229389.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF" [0053.723] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd64900, ftCreationTime.dwHighDateTime=0x1bc82e4, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6fd64900, ftLastWriteTime.dwHighDateTime=0x1bc82e4, nFileSizeHigh=0x0, nFileSizeLow=0x30da, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0230876.WMF", cAlternateFileName="")) returned 1 [0053.723] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.723] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0230876.WMF") returned -1 [0053.723] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0230876.WMF") returned -1 [0053.723] lstrcmpiA (lpString1="", lpString2="J0230876.WMF") returned -1 [0053.723] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF") returned="J0229389.WMF" [0053.723] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.723] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.723] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.723] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.723] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0230876.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF" [0053.723] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabe1b900, ftCreationTime.dwHighDateTime=0x1be516b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xabe1b900, ftLastWriteTime.dwHighDateTime=0x1be516b, nFileSizeHigh=0x0, nFileSizeLow=0x77f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233018.WMF", cAlternateFileName="")) returned 1 [0053.723] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.723] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0233018.WMF") returned -1 [0053.723] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0233018.WMF") returned -1 [0053.723] lstrcmpiA (lpString1="", lpString2="J0233018.WMF") returned -1 [0053.723] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF") returned="J0230876.WMF" [0053.723] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.723] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.724] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.724] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.724] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0233018.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF" [0053.724] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c43c200, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3c43c200, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1522, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233070.WMF", cAlternateFileName="")) returned 1 [0053.724] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.724] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0233070.WMF") returned -1 [0053.724] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0233070.WMF") returned -1 [0053.724] lstrcmpiA (lpString1="", lpString2="J0233070.WMF") returned -1 [0053.724] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF") returned="J0233018.WMF" [0053.724] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.724] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.724] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.724] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.724] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0233070.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF" [0053.724] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36d32e00, ftCreationTime.dwHighDateTime=0x1be56ed, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x36d32e00, ftLastWriteTime.dwHighDateTime=0x1be56ed, nFileSizeHigh=0x0, nFileSizeLow=0x80f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233312.WMF", cAlternateFileName="")) returned 1 [0053.724] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.724] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0233312.WMF") returned -1 [0053.724] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0233312.WMF") returned -1 [0053.724] lstrcmpiA (lpString1="", lpString2="J0233312.WMF") returned -1 [0053.724] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF") returned="J0233070.WMF" [0053.724] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.724] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.724] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.724] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.724] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0233312.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF" [0053.724] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23f92c00, ftCreationTime.dwHighDateTime=0x1be8094, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x23f92c00, ftLastWriteTime.dwHighDateTime=0x1be8094, nFileSizeHigh=0x0, nFileSizeLow=0x6632, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234131.WMF", cAlternateFileName="")) returned 1 [0053.725] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.725] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0234131.WMF") returned -1 [0053.725] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0234131.WMF") returned -1 [0053.725] lstrcmpiA (lpString1="", lpString2="J0234131.WMF") returned -1 [0053.725] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF") returned="J0233312.WMF" [0053.725] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.725] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.725] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.725] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.725] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0234131.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF" [0053.725] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a15c200, ftCreationTime.dwHighDateTime=0x1be7fe9, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4a15c200, ftLastWriteTime.dwHighDateTime=0x1be7fe9, nFileSizeHigh=0x0, nFileSizeLow=0xa87e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234266.WMF", cAlternateFileName="")) returned 1 [0053.725] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.725] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0234266.WMF") returned -1 [0053.725] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0234266.WMF") returned -1 [0053.725] lstrcmpiA (lpString1="", lpString2="J0234266.WMF") returned -1 [0053.725] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF") returned="J0234131.WMF" [0053.725] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.725] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.725] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.725] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.725] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0234266.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF" [0053.725] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1034e00, ftCreationTime.dwHighDateTime=0x1be75a5, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1034e00, ftLastWriteTime.dwHighDateTime=0x1be75a5, nFileSizeHigh=0x0, nFileSizeLow=0x27ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234657.WMF", cAlternateFileName="")) returned 1 [0053.725] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.725] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0234657.WMF") returned -1 [0053.725] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0234657.WMF") returned -1 [0053.725] lstrcmpiA (lpString1="", lpString2="J0234657.WMF") returned -1 [0053.725] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF") returned="J0234266.WMF" [0053.725] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.726] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.726] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.726] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.726] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0234657.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF" [0053.726] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9eeb500, ftCreationTime.dwHighDateTime=0x1bf2be6, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9eeb500, ftLastWriteTime.dwHighDateTime=0x1bf2be6, nFileSizeHigh=0x0, nFileSizeLow=0xd4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234687.GIF", cAlternateFileName="")) returned 1 [0053.726] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.726] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0234687.GIF") returned -1 [0053.726] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0234687.GIF") returned -1 [0053.726] lstrcmpiA (lpString1="", lpString2="J0234687.GIF") returned -1 [0053.726] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF") returned="J0234657.WMF" [0053.726] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.726] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.726] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.726] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.726] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0234687.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" [0053.726] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" [0053.726] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" [0053.726] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF." [0053.726] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF.wannacry" [0053.726] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0053.727] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd4f [0053.727] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc9eeb500, dwHighDateTime=0x1bf2be6), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd5853c0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc9eeb500, dwHighDateTime=0x1bf2be6)) returned 1 [0053.727] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0053.727] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xcd1, lpOverlapped=0x0) returned 1 [0053.729] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF") returned="J0234687.GIF" [0053.729] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0053.729] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xcd1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xcd1, lpOverlapped=0x0) returned 1 [0053.729] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.729] CloseHandle (hObject=0x8c) returned 1 [0053.735] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif.wannacry")) returned 1 [0053.735] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85566d00, ftCreationTime.dwHighDateTime=0x1be911f, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85566d00, ftLastWriteTime.dwHighDateTime=0x1be911f, nFileSizeHigh=0x0, nFileSizeLow=0x1820, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="J0235241.WMF", cAlternateFileName="")) returned 1 [0053.735] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.736] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0235241.WMF") returned -1 [0053.736] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0235241.WMF") returned -1 [0053.736] lstrcmpiA (lpString1="", lpString2="J0235241.WMF") returned -1 [0053.736] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF") returned="J0234687.GIF" [0053.736] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.736] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.736] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.736] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.736] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0235241.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF" [0053.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.zip") returned 0 [0053.736] lstrlenA (lpString="*.zip") returned 5 [0053.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.rar") returned 0 [0053.736] lstrlenA (lpString="*.rar") returned 5 [0053.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.7z") returned 0 [0053.736] lstrlenA (lpString="*.7z") returned 4 [0053.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.tar") returned 0 [0053.736] lstrlenA (lpString="*.tar") returned 5 [0053.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.gzip") returned 0 [0053.736] lstrlenA (lpString="*.gzip") returned 6 [0053.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.jpg") returned 0 [0053.736] lstrlenA (lpString="*.jpg") returned 5 [0053.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.jpeg") returned 0 [0053.736] lstrlenA (lpString="*.jpeg") returned 6 [0053.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.psd") returned 0 [0053.736] lstrlenA (lpString="*.psd") returned 5 [0053.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.gif") returned 0 [0053.737] lstrlenA (lpString="*.gif") returned 5 [0053.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.doc") returned 0 [0053.737] lstrlenA (lpString="*.doc") returned 5 [0053.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.docx") returned 0 [0053.737] lstrlenA (lpString="*.docx") returned 6 [0053.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.xls") returned 0 [0053.737] lstrlenA (lpString="*.xls") returned 5 [0053.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.xlsx") returned 0 [0053.737] lstrlenA (lpString="*.xlsx") returned 6 [0053.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.ppt") returned 0 [0053.737] lstrlenA (lpString="*.ppt") returned 5 [0053.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.pptx") returned 0 [0053.737] lstrlenA (lpString="*.pptx") returned 6 [0053.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.pdf") returned 0 [0053.737] lstrlenA (lpString="*.pdf") returned 5 [0053.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.mov") returned 0 [0053.737] lstrlenA (lpString="*.mov") returned 5 [0053.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.m2v") returned 0 [0053.737] lstrlenA (lpString="*.m2v") returned 5 [0053.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.3gp") returned 0 [0053.737] lstrlenA (lpString="*.3gp") returned 5 [0053.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.mpeg") returned 0 [0053.737] lstrlenA (lpString="*.mpeg") returned 6 [0053.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.mpg") returned 0 [0053.737] lstrlenA (lpString="*.mpg") returned 5 [0053.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.flv") returned 0 [0053.737] lstrlenA (lpString="*.flv") returned 5 [0053.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.avi") returned 0 [0053.737] lstrlenA (lpString="*.avi") returned 5 [0053.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.mp4") returned 0 [0053.737] lstrlenA (lpString="*.mp4") returned 5 [0053.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.wmv") returned 0 [0053.737] lstrlenA (lpString="*.wmv") returned 5 [0053.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.divx") returned 0 [0053.738] lstrlenA (lpString="*.divx") returned 6 [0053.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.mkv") returned 0 [0053.738] lstrlenA (lpString="*.mkv") returned 5 [0053.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.mp3") returned 0 [0053.738] lstrlenA (lpString="*.mp3") returned 5 [0053.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.wav") returned 0 [0053.738] lstrlenA (lpString="*.wav") returned 5 [0053.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.flac") returned 0 [0053.738] lstrlenA (lpString="*.flac") returned 6 [0053.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.ape") returned 0 [0053.738] lstrlenA (lpString="*.ape") returned 5 [0053.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.wma") returned 0 [0053.738] lstrlenA (lpString="*.wma") returned 5 [0053.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.ac3") returned 0 [0053.738] lstrlenA (lpString="*.ac3") returned 5 [0053.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", pszSpec="*.mxf") returned 0 [0053.738] lstrlenA (lpString="*.mxf") returned 5 [0053.738] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c56b00, ftCreationTime.dwHighDateTime=0x1c0371d, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4c56b00, ftLastWriteTime.dwHighDateTime=0x1c0371d, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0235319.WMF", cAlternateFileName="")) returned 1 [0053.738] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.738] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0235319.WMF") returned -1 [0053.738] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0235319.WMF") returned -1 [0053.738] lstrcmpiA (lpString1="", lpString2="J0235319.WMF") returned -1 [0053.738] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF") returned="J0235241.WMF" [0053.738] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.738] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.738] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.738] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.738] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0235319.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF" [0053.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.zip") returned 0 [0053.738] lstrlenA (lpString="*.zip") returned 5 [0053.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.rar") returned 0 [0053.739] lstrlenA (lpString="*.rar") returned 5 [0053.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.7z") returned 0 [0053.739] lstrlenA (lpString="*.7z") returned 4 [0053.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.tar") returned 0 [0053.739] lstrlenA (lpString="*.tar") returned 5 [0053.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.gzip") returned 0 [0053.739] lstrlenA (lpString="*.gzip") returned 6 [0053.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.jpg") returned 0 [0053.739] lstrlenA (lpString="*.jpg") returned 5 [0053.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.jpeg") returned 0 [0053.739] lstrlenA (lpString="*.jpeg") returned 6 [0053.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.psd") returned 0 [0053.739] lstrlenA (lpString="*.psd") returned 5 [0053.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.gif") returned 0 [0053.739] lstrlenA (lpString="*.gif") returned 5 [0053.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.doc") returned 0 [0053.739] lstrlenA (lpString="*.doc") returned 5 [0053.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.docx") returned 0 [0053.739] lstrlenA (lpString="*.docx") returned 6 [0053.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.xls") returned 0 [0053.739] lstrlenA (lpString="*.xls") returned 5 [0053.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.xlsx") returned 0 [0053.739] lstrlenA (lpString="*.xlsx") returned 6 [0053.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.ppt") returned 0 [0053.739] lstrlenA (lpString="*.ppt") returned 5 [0053.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.pptx") returned 0 [0053.739] lstrlenA (lpString="*.pptx") returned 6 [0053.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.pdf") returned 0 [0053.739] lstrlenA (lpString="*.pdf") returned 5 [0053.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.mov") returned 0 [0053.739] lstrlenA (lpString="*.mov") returned 5 [0053.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.m2v") returned 0 [0053.739] lstrlenA (lpString="*.m2v") returned 5 [0053.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.3gp") returned 0 [0053.739] lstrlenA (lpString="*.3gp") returned 5 [0053.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.mpeg") returned 0 [0053.740] lstrlenA (lpString="*.mpeg") returned 6 [0053.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.mpg") returned 0 [0053.740] lstrlenA (lpString="*.mpg") returned 5 [0053.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.flv") returned 0 [0053.740] lstrlenA (lpString="*.flv") returned 5 [0053.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.avi") returned 0 [0053.740] lstrlenA (lpString="*.avi") returned 5 [0053.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.mp4") returned 0 [0053.740] lstrlenA (lpString="*.mp4") returned 5 [0053.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.wmv") returned 0 [0053.740] lstrlenA (lpString="*.wmv") returned 5 [0053.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.divx") returned 0 [0053.740] lstrlenA (lpString="*.divx") returned 6 [0053.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.mkv") returned 0 [0053.740] lstrlenA (lpString="*.mkv") returned 5 [0053.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.mp3") returned 0 [0053.740] lstrlenA (lpString="*.mp3") returned 5 [0053.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.wav") returned 0 [0053.740] lstrlenA (lpString="*.wav") returned 5 [0053.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.flac") returned 0 [0053.740] lstrlenA (lpString="*.flac") returned 6 [0053.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.ape") returned 0 [0053.740] lstrlenA (lpString="*.ape") returned 5 [0053.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.wma") returned 0 [0053.740] lstrlenA (lpString="*.wma") returned 5 [0053.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.ac3") returned 0 [0053.740] lstrlenA (lpString="*.ac3") returned 5 [0053.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", pszSpec="*.mxf") returned 0 [0053.740] lstrlenA (lpString="*.mxf") returned 5 [0053.740] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bd8800, ftCreationTime.dwHighDateTime=0x1be9cd9, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb0bd8800, ftLastWriteTime.dwHighDateTime=0x1be9cd9, nFileSizeHigh=0x0, nFileSizeLow=0x13d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240695.WMF", cAlternateFileName="")) returned 1 [0053.740] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.740] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0240695.WMF") returned -1 [0053.740] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0240695.WMF") returned -1 [0053.740] lstrcmpiA (lpString1="", lpString2="J0240695.WMF") returned -1 [0053.741] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF") returned="J0235319.WMF" [0053.741] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.741] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.741] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.741] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.741] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0240695.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF" [0053.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.zip") returned 0 [0053.741] lstrlenA (lpString="*.zip") returned 5 [0053.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.rar") returned 0 [0053.741] lstrlenA (lpString="*.rar") returned 5 [0053.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.7z") returned 0 [0053.741] lstrlenA (lpString="*.7z") returned 4 [0053.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.tar") returned 0 [0053.741] lstrlenA (lpString="*.tar") returned 5 [0053.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.gzip") returned 0 [0053.741] lstrlenA (lpString="*.gzip") returned 6 [0053.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.jpg") returned 0 [0053.741] lstrlenA (lpString="*.jpg") returned 5 [0053.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.jpeg") returned 0 [0053.741] lstrlenA (lpString="*.jpeg") returned 6 [0053.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.psd") returned 0 [0053.741] lstrlenA (lpString="*.psd") returned 5 [0053.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.gif") returned 0 [0053.741] lstrlenA (lpString="*.gif") returned 5 [0053.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.doc") returned 0 [0053.741] lstrlenA (lpString="*.doc") returned 5 [0053.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.docx") returned 0 [0053.741] lstrlenA (lpString="*.docx") returned 6 [0053.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.xls") returned 0 [0053.741] lstrlenA (lpString="*.xls") returned 5 [0053.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.xlsx") returned 0 [0053.741] lstrlenA (lpString="*.xlsx") returned 6 [0053.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.ppt") returned 0 [0053.742] lstrlenA (lpString="*.ppt") returned 5 [0053.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.pptx") returned 0 [0053.742] lstrlenA (lpString="*.pptx") returned 6 [0053.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.pdf") returned 0 [0053.742] lstrlenA (lpString="*.pdf") returned 5 [0053.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.mov") returned 0 [0053.742] lstrlenA (lpString="*.mov") returned 5 [0053.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.m2v") returned 0 [0053.742] lstrlenA (lpString="*.m2v") returned 5 [0053.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.3gp") returned 0 [0053.742] lstrlenA (lpString="*.3gp") returned 5 [0053.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.mpeg") returned 0 [0053.742] lstrlenA (lpString="*.mpeg") returned 6 [0053.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.mpg") returned 0 [0053.742] lstrlenA (lpString="*.mpg") returned 5 [0053.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.flv") returned 0 [0053.742] lstrlenA (lpString="*.flv") returned 5 [0053.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.avi") returned 0 [0053.742] lstrlenA (lpString="*.avi") returned 5 [0053.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.mp4") returned 0 [0053.742] lstrlenA (lpString="*.mp4") returned 5 [0053.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.wmv") returned 0 [0053.742] lstrlenA (lpString="*.wmv") returned 5 [0053.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.divx") returned 0 [0053.742] lstrlenA (lpString="*.divx") returned 6 [0053.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.mkv") returned 0 [0053.742] lstrlenA (lpString="*.mkv") returned 5 [0053.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.mp3") returned 0 [0053.742] lstrlenA (lpString="*.mp3") returned 5 [0053.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.wav") returned 0 [0053.742] lstrlenA (lpString="*.wav") returned 5 [0053.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.flac") returned 0 [0053.742] lstrlenA (lpString="*.flac") returned 6 [0053.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.ape") returned 0 [0053.742] lstrlenA (lpString="*.ape") returned 5 [0053.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.wma") returned 0 [0053.743] lstrlenA (lpString="*.wma") returned 5 [0053.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.ac3") returned 0 [0053.743] lstrlenA (lpString="*.ac3") returned 5 [0053.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", pszSpec="*.mxf") returned 0 [0053.743] lstrlenA (lpString="*.mxf") returned 5 [0053.743] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc16dfe00, ftCreationTime.dwHighDateTime=0x1be9cd9, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc16dfe00, ftLastWriteTime.dwHighDateTime=0x1be9cd9, nFileSizeHigh=0x0, nFileSizeLow=0x1aa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240719.WMF", cAlternateFileName="")) returned 1 [0053.744] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.744] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0240719.WMF") returned -1 [0053.744] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0240719.WMF") returned -1 [0053.744] lstrcmpiA (lpString1="", lpString2="J0240719.WMF") returned -1 [0053.744] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF") returned="J0240695.WMF" [0053.744] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.744] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.744] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.744] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.744] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0240719.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF" [0053.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.zip") returned 0 [0053.744] lstrlenA (lpString="*.zip") returned 5 [0053.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.rar") returned 0 [0053.744] lstrlenA (lpString="*.rar") returned 5 [0053.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.7z") returned 0 [0053.745] lstrlenA (lpString="*.7z") returned 4 [0053.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.tar") returned 0 [0053.745] lstrlenA (lpString="*.tar") returned 5 [0053.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.gzip") returned 0 [0053.745] lstrlenA (lpString="*.gzip") returned 6 [0053.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.jpg") returned 0 [0053.745] lstrlenA (lpString="*.jpg") returned 5 [0053.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.jpeg") returned 0 [0053.745] lstrlenA (lpString="*.jpeg") returned 6 [0053.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.psd") returned 0 [0053.745] lstrlenA (lpString="*.psd") returned 5 [0053.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.gif") returned 0 [0053.745] lstrlenA (lpString="*.gif") returned 5 [0053.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.doc") returned 0 [0053.745] lstrlenA (lpString="*.doc") returned 5 [0053.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.docx") returned 0 [0053.745] lstrlenA (lpString="*.docx") returned 6 [0053.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.xls") returned 0 [0053.745] lstrlenA (lpString="*.xls") returned 5 [0053.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.xlsx") returned 0 [0053.745] lstrlenA (lpString="*.xlsx") returned 6 [0053.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.ppt") returned 0 [0053.745] lstrlenA (lpString="*.ppt") returned 5 [0053.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.pptx") returned 0 [0053.745] lstrlenA (lpString="*.pptx") returned 6 [0053.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.pdf") returned 0 [0053.745] lstrlenA (lpString="*.pdf") returned 5 [0053.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.mov") returned 0 [0053.745] lstrlenA (lpString="*.mov") returned 5 [0053.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.m2v") returned 0 [0053.745] lstrlenA (lpString="*.m2v") returned 5 [0053.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.3gp") returned 0 [0053.745] lstrlenA (lpString="*.3gp") returned 5 [0053.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.mpeg") returned 0 [0053.745] lstrlenA (lpString="*.mpeg") returned 6 [0053.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.mpg") returned 0 [0053.746] lstrlenA (lpString="*.mpg") returned 5 [0053.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.flv") returned 0 [0053.746] lstrlenA (lpString="*.flv") returned 5 [0053.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.avi") returned 0 [0053.746] lstrlenA (lpString="*.avi") returned 5 [0053.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.mp4") returned 0 [0053.746] lstrlenA (lpString="*.mp4") returned 5 [0053.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.wmv") returned 0 [0053.746] lstrlenA (lpString="*.wmv") returned 5 [0053.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.divx") returned 0 [0053.746] lstrlenA (lpString="*.divx") returned 6 [0053.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.mkv") returned 0 [0053.746] lstrlenA (lpString="*.mkv") returned 5 [0053.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.mp3") returned 0 [0053.746] lstrlenA (lpString="*.mp3") returned 5 [0053.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.wav") returned 0 [0053.746] lstrlenA (lpString="*.wav") returned 5 [0053.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.flac") returned 0 [0053.746] lstrlenA (lpString="*.flac") returned 6 [0053.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.ape") returned 0 [0053.746] lstrlenA (lpString="*.ape") returned 5 [0053.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.wma") returned 0 [0053.746] lstrlenA (lpString="*.wma") returned 5 [0053.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.ac3") returned 0 [0053.746] lstrlenA (lpString="*.ac3") returned 5 [0053.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", pszSpec="*.mxf") returned 0 [0053.746] lstrlenA (lpString="*.mxf") returned 5 [0053.746] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d89700, ftCreationTime.dwHighDateTime=0x1beb2f4, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x28d89700, ftLastWriteTime.dwHighDateTime=0x1beb2f4, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0251301.WMF", cAlternateFileName="")) returned 1 [0053.746] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.746] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0251301.WMF") returned -1 [0053.746] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0251301.WMF") returned -1 [0053.746] lstrcmpiA (lpString1="", lpString2="J0251301.WMF") returned -1 [0053.746] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF") returned="J0240719.WMF" [0053.747] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.747] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.747] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.747] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.747] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0251301.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF" [0053.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.zip") returned 0 [0053.747] lstrlenA (lpString="*.zip") returned 5 [0053.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.rar") returned 0 [0053.747] lstrlenA (lpString="*.rar") returned 5 [0053.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.7z") returned 0 [0053.747] lstrlenA (lpString="*.7z") returned 4 [0053.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.tar") returned 0 [0053.747] lstrlenA (lpString="*.tar") returned 5 [0053.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.gzip") returned 0 [0053.747] lstrlenA (lpString="*.gzip") returned 6 [0053.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.jpg") returned 0 [0053.747] lstrlenA (lpString="*.jpg") returned 5 [0053.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.jpeg") returned 0 [0053.747] lstrlenA (lpString="*.jpeg") returned 6 [0053.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.psd") returned 0 [0053.747] lstrlenA (lpString="*.psd") returned 5 [0053.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.gif") returned 0 [0053.747] lstrlenA (lpString="*.gif") returned 5 [0053.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.doc") returned 0 [0053.747] lstrlenA (lpString="*.doc") returned 5 [0053.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.docx") returned 0 [0053.748] lstrlenA (lpString="*.docx") returned 6 [0053.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.xls") returned 0 [0053.748] lstrlenA (lpString="*.xls") returned 5 [0053.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.xlsx") returned 0 [0053.748] lstrlenA (lpString="*.xlsx") returned 6 [0053.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.ppt") returned 0 [0053.748] lstrlenA (lpString="*.ppt") returned 5 [0053.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.pptx") returned 0 [0053.748] lstrlenA (lpString="*.pptx") returned 6 [0053.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.pdf") returned 0 [0053.748] lstrlenA (lpString="*.pdf") returned 5 [0053.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.mov") returned 0 [0053.748] lstrlenA (lpString="*.mov") returned 5 [0053.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.m2v") returned 0 [0053.748] lstrlenA (lpString="*.m2v") returned 5 [0053.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.3gp") returned 0 [0053.748] lstrlenA (lpString="*.3gp") returned 5 [0053.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.mpeg") returned 0 [0053.748] lstrlenA (lpString="*.mpeg") returned 6 [0053.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.mpg") returned 0 [0053.748] lstrlenA (lpString="*.mpg") returned 5 [0053.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.flv") returned 0 [0053.748] lstrlenA (lpString="*.flv") returned 5 [0053.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.avi") returned 0 [0053.748] lstrlenA (lpString="*.avi") returned 5 [0053.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.mp4") returned 0 [0053.748] lstrlenA (lpString="*.mp4") returned 5 [0053.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.wmv") returned 0 [0053.748] lstrlenA (lpString="*.wmv") returned 5 [0053.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.divx") returned 0 [0053.748] lstrlenA (lpString="*.divx") returned 6 [0053.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.mkv") returned 0 [0053.749] lstrlenA (lpString="*.mkv") returned 5 [0053.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.mp3") returned 0 [0053.749] lstrlenA (lpString="*.mp3") returned 5 [0053.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.wav") returned 0 [0053.749] lstrlenA (lpString="*.wav") returned 5 [0053.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.flac") returned 0 [0053.749] lstrlenA (lpString="*.flac") returned 6 [0053.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.ape") returned 0 [0053.749] lstrlenA (lpString="*.ape") returned 5 [0053.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.wma") returned 0 [0053.749] lstrlenA (lpString="*.wma") returned 5 [0053.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.ac3") returned 0 [0053.749] lstrlenA (lpString="*.ac3") returned 5 [0053.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", pszSpec="*.mxf") returned 0 [0053.749] lstrlenA (lpString="*.mxf") returned 5 [0053.749] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf384f00, ftCreationTime.dwHighDateTime=0x1beb2f6, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf384f00, ftLastWriteTime.dwHighDateTime=0x1beb2f6, nFileSizeHigh=0x0, nFileSizeLow=0x1232, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0251871.WMF", cAlternateFileName="")) returned 1 [0053.749] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.749] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0251871.WMF") returned -1 [0053.749] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0251871.WMF") returned -1 [0053.749] lstrcmpiA (lpString1="", lpString2="J0251871.WMF") returned -1 [0053.749] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF") returned="J0251301.WMF" [0053.749] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.749] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.749] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.749] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.749] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0251871.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF" [0053.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.zip") returned 0 [0053.749] lstrlenA (lpString="*.zip") returned 5 [0053.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.rar") returned 0 [0053.749] lstrlenA (lpString="*.rar") returned 5 [0053.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.7z") returned 0 [0053.750] lstrlenA (lpString="*.7z") returned 4 [0053.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.tar") returned 0 [0053.750] lstrlenA (lpString="*.tar") returned 5 [0053.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.gzip") returned 0 [0053.750] lstrlenA (lpString="*.gzip") returned 6 [0053.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.jpg") returned 0 [0053.750] lstrlenA (lpString="*.jpg") returned 5 [0053.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.jpeg") returned 0 [0053.750] lstrlenA (lpString="*.jpeg") returned 6 [0053.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.psd") returned 0 [0053.750] lstrlenA (lpString="*.psd") returned 5 [0053.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.gif") returned 0 [0053.750] lstrlenA (lpString="*.gif") returned 5 [0053.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.doc") returned 0 [0053.750] lstrlenA (lpString="*.doc") returned 5 [0053.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.docx") returned 0 [0053.750] lstrlenA (lpString="*.docx") returned 6 [0053.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.xls") returned 0 [0053.750] lstrlenA (lpString="*.xls") returned 5 [0053.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.xlsx") returned 0 [0053.750] lstrlenA (lpString="*.xlsx") returned 6 [0053.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.ppt") returned 0 [0053.750] lstrlenA (lpString="*.ppt") returned 5 [0053.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.pptx") returned 0 [0053.750] lstrlenA (lpString="*.pptx") returned 6 [0053.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.pdf") returned 0 [0053.750] lstrlenA (lpString="*.pdf") returned 5 [0053.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.mov") returned 0 [0053.750] lstrlenA (lpString="*.mov") returned 5 [0053.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.m2v") returned 0 [0053.750] lstrlenA (lpString="*.m2v") returned 5 [0053.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.3gp") returned 0 [0053.750] lstrlenA (lpString="*.3gp") returned 5 [0053.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.mpeg") returned 0 [0053.751] lstrlenA (lpString="*.mpeg") returned 6 [0053.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.mpg") returned 0 [0053.751] lstrlenA (lpString="*.mpg") returned 5 [0053.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.flv") returned 0 [0053.751] lstrlenA (lpString="*.flv") returned 5 [0053.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.avi") returned 0 [0053.751] lstrlenA (lpString="*.avi") returned 5 [0053.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.mp4") returned 0 [0053.751] lstrlenA (lpString="*.mp4") returned 5 [0053.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.wmv") returned 0 [0053.751] lstrlenA (lpString="*.wmv") returned 5 [0053.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.divx") returned 0 [0053.751] lstrlenA (lpString="*.divx") returned 6 [0053.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.mkv") returned 0 [0053.751] lstrlenA (lpString="*.mkv") returned 5 [0053.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.mp3") returned 0 [0053.751] lstrlenA (lpString="*.mp3") returned 5 [0053.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.wav") returned 0 [0053.751] lstrlenA (lpString="*.wav") returned 5 [0053.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.flac") returned 0 [0053.751] lstrlenA (lpString="*.flac") returned 6 [0053.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.ape") returned 0 [0053.751] lstrlenA (lpString="*.ape") returned 5 [0053.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.wma") returned 0 [0053.751] lstrlenA (lpString="*.wma") returned 5 [0053.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.ac3") returned 0 [0053.751] lstrlenA (lpString="*.ac3") returned 5 [0053.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", pszSpec="*.mxf") returned 0 [0053.751] lstrlenA (lpString="*.mxf") returned 5 [0053.751] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db62a00, ftCreationTime.dwHighDateTime=0x1beb2f6, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3db62a00, ftLastWriteTime.dwHighDateTime=0x1beb2f6, nFileSizeHigh=0x0, nFileSizeLow=0x11b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0251925.WMF", cAlternateFileName="")) returned 1 [0053.751] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.751] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0251925.WMF") returned -1 [0053.751] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0251925.WMF") returned -1 [0053.751] lstrcmpiA (lpString1="", lpString2="J0251925.WMF") returned -1 [0053.752] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF") returned="J0251871.WMF" [0053.752] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.752] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.752] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.752] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.752] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0251925.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF" [0053.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.zip") returned 0 [0053.752] lstrlenA (lpString="*.zip") returned 5 [0053.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.rar") returned 0 [0053.752] lstrlenA (lpString="*.rar") returned 5 [0053.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.7z") returned 0 [0053.752] lstrlenA (lpString="*.7z") returned 4 [0053.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.tar") returned 0 [0053.752] lstrlenA (lpString="*.tar") returned 5 [0053.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.gzip") returned 0 [0053.752] lstrlenA (lpString="*.gzip") returned 6 [0053.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.jpg") returned 0 [0053.752] lstrlenA (lpString="*.jpg") returned 5 [0053.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.jpeg") returned 0 [0053.752] lstrlenA (lpString="*.jpeg") returned 6 [0053.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.psd") returned 0 [0053.752] lstrlenA (lpString="*.psd") returned 5 [0053.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.gif") returned 0 [0053.752] lstrlenA (lpString="*.gif") returned 5 [0053.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.doc") returned 0 [0053.752] lstrlenA (lpString="*.doc") returned 5 [0053.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.docx") returned 0 [0053.752] lstrlenA (lpString="*.docx") returned 6 [0053.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.xls") returned 0 [0053.752] lstrlenA (lpString="*.xls") returned 5 [0053.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.xlsx") returned 0 [0053.753] lstrlenA (lpString="*.xlsx") returned 6 [0053.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.ppt") returned 0 [0053.753] lstrlenA (lpString="*.ppt") returned 5 [0053.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.pptx") returned 0 [0053.753] lstrlenA (lpString="*.pptx") returned 6 [0053.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.pdf") returned 0 [0053.753] lstrlenA (lpString="*.pdf") returned 5 [0053.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.mov") returned 0 [0053.753] lstrlenA (lpString="*.mov") returned 5 [0053.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.m2v") returned 0 [0053.753] lstrlenA (lpString="*.m2v") returned 5 [0053.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.3gp") returned 0 [0053.753] lstrlenA (lpString="*.3gp") returned 5 [0053.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.mpeg") returned 0 [0053.753] lstrlenA (lpString="*.mpeg") returned 6 [0053.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.mpg") returned 0 [0053.753] lstrlenA (lpString="*.mpg") returned 5 [0053.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.flv") returned 0 [0053.753] lstrlenA (lpString="*.flv") returned 5 [0053.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.avi") returned 0 [0053.753] lstrlenA (lpString="*.avi") returned 5 [0053.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.mp4") returned 0 [0053.753] lstrlenA (lpString="*.mp4") returned 5 [0053.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.wmv") returned 0 [0053.753] lstrlenA (lpString="*.wmv") returned 5 [0053.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.divx") returned 0 [0053.753] lstrlenA (lpString="*.divx") returned 6 [0053.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.mkv") returned 0 [0053.753] lstrlenA (lpString="*.mkv") returned 5 [0053.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.mp3") returned 0 [0053.753] lstrlenA (lpString="*.mp3") returned 5 [0053.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.wav") returned 0 [0053.753] lstrlenA (lpString="*.wav") returned 5 [0053.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.flac") returned 0 [0053.754] lstrlenA (lpString="*.flac") returned 6 [0053.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.ape") returned 0 [0053.754] lstrlenA (lpString="*.ape") returned 5 [0053.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.wma") returned 0 [0053.754] lstrlenA (lpString="*.wma") returned 5 [0053.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.ac3") returned 0 [0053.754] lstrlenA (lpString="*.ac3") returned 5 [0053.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", pszSpec="*.mxf") returned 0 [0053.754] lstrlenA (lpString="*.mxf") returned 5 [0053.754] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb8de800, ftCreationTime.dwHighDateTime=0x1beb2f7, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfb8de800, ftLastWriteTime.dwHighDateTime=0x1beb2f7, nFileSizeHigh=0x0, nFileSizeLow=0x158c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0252349.WMF", cAlternateFileName="")) returned 1 [0053.754] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.754] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0252349.WMF") returned -1 [0053.754] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0252349.WMF") returned -1 [0053.754] lstrcmpiA (lpString1="", lpString2="J0252349.WMF") returned -1 [0053.754] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF") returned="J0251925.WMF" [0053.754] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.754] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.754] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.754] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.754] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0252349.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF" [0053.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF", pszSpec="*.zip") returned 0 [0053.754] lstrlenA (lpString="*.zip") returned 5 [0053.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF", pszSpec="*.rar") returned 0 [0053.754] lstrlenA (lpString="*.rar") returned 5 [0053.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF", pszSpec="*.7z") returned 0 [0053.754] lstrlenA (lpString="*.7z") returned 4 [0053.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF", pszSpec="*.tar") returned 0 [0053.755] lstrlenA (lpString="*.tar") returned 5 [0053.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF", pszSpec="*.gzip") returned 0 [0053.755] lstrlenA (lpString="*.gzip") returned 6 [0053.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF", pszSpec="*.jpg") returned 0 [0053.755] lstrlenA (lpString="*.jpg") returned 5 [0053.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF", pszSpec="*.jpeg") returned 0 [0053.755] lstrlenA (lpString="*.jpeg") returned 6 [0053.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF", pszSpec="*.psd") returned 0 [0053.755] lstrlenA (lpString="*.psd") returned 5 [0053.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF", pszSpec="*.gif") returned 0 [0053.755] lstrlenA (lpString="*.gif") returned 5 [0053.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF", pszSpec="*.doc") returned 0 [0053.755] lstrlenA (lpString="*.doc") returned 5 [0053.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF", pszSpec="*.docx") returned 0 [0053.755] lstrlenA (lpString="*.docx") returned 6 [0053.755] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fdf2000, ftCreationTime.dwHighDateTime=0x1beccca, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fdf2000, ftLastWriteTime.dwHighDateTime=0x1beccca, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0278882.WMF", cAlternateFileName="")) returned 1 [0053.755] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.755] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0278882.WMF") returned -1 [0053.755] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0278882.WMF") returned -1 [0053.755] lstrcmpiA (lpString1="", lpString2="J0278882.WMF") returned -1 [0053.755] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF") returned="J0252349.WMF" [0053.755] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.755] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.756] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.756] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.756] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0278882.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF" [0053.756] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0c800, ftCreationTime.dwHighDateTime=0x1bee443, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xecd0c800, ftLastWriteTime.dwHighDateTime=0x1bee443, nFileSizeHigh=0x0, nFileSizeLow=0x4ffa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281904.WMF", cAlternateFileName="")) returned 1 [0053.756] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.756] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0281904.WMF") returned -1 [0053.756] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0281904.WMF") returned -1 [0053.756] lstrcmpiA (lpString1="", lpString2="J0281904.WMF") returned -1 [0053.756] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF") returned="J0278882.WMF" [0053.756] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.756] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.756] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.756] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.756] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0281904.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF" [0053.756] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1a4f200, ftCreationTime.dwHighDateTime=0x1bed3d9, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe1a4f200, ftLastWriteTime.dwHighDateTime=0x1bed3d9, nFileSizeHigh=0x0, nFileSizeLow=0x4dc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0283209.GIF", cAlternateFileName="")) returned 1 [0053.756] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.756] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0283209.GIF") returned -1 [0053.756] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0283209.GIF") returned -1 [0053.756] lstrcmpiA (lpString1="", lpString2="J0283209.GIF") returned -1 [0053.756] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF") returned="J0281904.WMF" [0053.756] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.756] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.756] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.756] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.756] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0283209.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" [0053.757] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" [0053.757] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" [0053.757] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF." [0053.757] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF.wannacry" [0053.757] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0053.758] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4dc6 [0053.758] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe1a4f200, dwHighDateTime=0x1bed3d9), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd5d1680, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe1a4f200, dwHighDateTime=0x1bed3d9)) returned 1 [0053.758] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0053.758] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4d48, lpOverlapped=0x0) returned 1 [0053.760] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF") returned="J0283209.GIF" [0053.760] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0053.760] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4d48, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4d48, lpOverlapped=0x0) returned 1 [0053.760] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.760] CloseHandle (hObject=0x8c) returned 1 [0053.763] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif.wannacry")) returned 1 [0053.764] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ae3400, ftCreationTime.dwHighDateTime=0x1bea1cc, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7ae3400, ftLastWriteTime.dwHighDateTime=0x1bea1cc, nFileSizeHigh=0x0, nFileSizeLow=0x62e3, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="J0284916.JPG", cAlternateFileName="")) returned 1 [0053.764] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.764] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0284916.JPG") returned -1 [0053.764] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0284916.JPG") returned -1 [0053.764] lstrcmpiA (lpString1="", lpString2="J0284916.JPG") returned -1 [0053.764] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF") returned="J0283209.GIF" [0053.764] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.764] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.764] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.764] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.764] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0284916.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" [0053.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG", pszSpec="*.zip") returned 0 [0053.764] lstrlenA (lpString="*.zip") returned 5 [0053.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG", pszSpec="*.rar") returned 0 [0053.765] lstrlenA (lpString="*.rar") returned 5 [0053.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG", pszSpec="*.7z") returned 0 [0053.765] lstrlenA (lpString="*.7z") returned 4 [0053.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG", pszSpec="*.tar") returned 0 [0053.765] lstrlenA (lpString="*.tar") returned 5 [0053.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG", pszSpec="*.gzip") returned 0 [0053.765] lstrlenA (lpString="*.gzip") returned 6 [0053.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG", pszSpec="*.jpg") returned 1 [0053.765] lstrlenA (lpString="*.jpg") returned 5 [0053.765] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" [0053.765] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" [0053.765] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG." [0053.765] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.wannacry" [0053.765] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0053.766] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x62e3 [0053.766] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb7ae3400, dwHighDateTime=0x1bea1cc), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd5d1680, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb7ae3400, dwHighDateTime=0x1bea1cc)) returned 1 [0053.766] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0053.766] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x6265, lpOverlapped=0x0) returned 1 [0053.768] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG") returned="J0284916.JPG" [0053.768] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0053.768] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x6265, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x6265, lpOverlapped=0x0) returned 1 [0053.769] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.769] CloseHandle (hObject=0x8c) returned 1 [0053.770] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg.wannacry")) returned 1 [0053.771] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa68bc300, ftCreationTime.dwHighDateTime=0x1befd79, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa68bc300, ftLastWriteTime.dwHighDateTime=0x1befd79, nFileSizeHigh=0x0, nFileSizeLow=0x7876, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="J0285360.WMF", cAlternateFileName="")) returned 1 [0053.771] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.771] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0285360.WMF") returned -1 [0053.771] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0285360.WMF") returned -1 [0053.771] lstrcmpiA (lpString1="", lpString2="J0285360.WMF") returned -1 [0053.771] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG") returned="J0284916.JPG" [0053.771] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.771] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.771] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.771] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.771] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0285360.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF" [0053.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.zip") returned 0 [0053.771] lstrlenA (lpString="*.zip") returned 5 [0053.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.rar") returned 0 [0053.771] lstrlenA (lpString="*.rar") returned 5 [0053.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.7z") returned 0 [0053.771] lstrlenA (lpString="*.7z") returned 4 [0053.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.tar") returned 0 [0053.771] lstrlenA (lpString="*.tar") returned 5 [0053.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.gzip") returned 0 [0053.771] lstrlenA (lpString="*.gzip") returned 6 [0053.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.jpg") returned 0 [0053.772] lstrlenA (lpString="*.jpg") returned 5 [0053.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.jpeg") returned 0 [0053.772] lstrlenA (lpString="*.jpeg") returned 6 [0053.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.psd") returned 0 [0053.772] lstrlenA (lpString="*.psd") returned 5 [0053.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.gif") returned 0 [0053.772] lstrlenA (lpString="*.gif") returned 5 [0053.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.doc") returned 0 [0053.772] lstrlenA (lpString="*.doc") returned 5 [0053.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.docx") returned 0 [0053.772] lstrlenA (lpString="*.docx") returned 6 [0053.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.xls") returned 0 [0053.772] lstrlenA (lpString="*.xls") returned 5 [0053.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.xlsx") returned 0 [0053.772] lstrlenA (lpString="*.xlsx") returned 6 [0053.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.ppt") returned 0 [0053.772] lstrlenA (lpString="*.ppt") returned 5 [0053.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.pptx") returned 0 [0053.772] lstrlenA (lpString="*.pptx") returned 6 [0053.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.pdf") returned 0 [0053.772] lstrlenA (lpString="*.pdf") returned 5 [0053.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.mov") returned 0 [0053.772] lstrlenA (lpString="*.mov") returned 5 [0053.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.m2v") returned 0 [0053.772] lstrlenA (lpString="*.m2v") returned 5 [0053.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.3gp") returned 0 [0053.773] lstrlenA (lpString="*.3gp") returned 5 [0053.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.mpeg") returned 0 [0053.773] lstrlenA (lpString="*.mpeg") returned 6 [0053.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.mpg") returned 0 [0053.773] lstrlenA (lpString="*.mpg") returned 5 [0053.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.flv") returned 0 [0053.773] lstrlenA (lpString="*.flv") returned 5 [0053.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.avi") returned 0 [0053.773] lstrlenA (lpString="*.avi") returned 5 [0053.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.mp4") returned 0 [0053.773] lstrlenA (lpString="*.mp4") returned 5 [0053.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.wmv") returned 0 [0053.773] lstrlenA (lpString="*.wmv") returned 5 [0053.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.divx") returned 0 [0053.773] lstrlenA (lpString="*.divx") returned 6 [0053.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.mkv") returned 0 [0053.773] lstrlenA (lpString="*.mkv") returned 5 [0053.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.mp3") returned 0 [0053.773] lstrlenA (lpString="*.mp3") returned 5 [0053.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.wav") returned 0 [0053.773] lstrlenA (lpString="*.wav") returned 5 [0053.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.flac") returned 0 [0053.773] lstrlenA (lpString="*.flac") returned 6 [0053.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.ape") returned 0 [0053.774] lstrlenA (lpString="*.ape") returned 5 [0053.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.wma") returned 0 [0053.774] lstrlenA (lpString="*.wma") returned 5 [0053.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.ac3") returned 0 [0053.774] lstrlenA (lpString="*.ac3") returned 5 [0053.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", pszSpec="*.mxf") returned 0 [0053.774] lstrlenA (lpString="*.mxf") returned 5 [0053.774] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd63acb00, ftCreationTime.dwHighDateTime=0x1befd79, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd63acb00, ftLastWriteTime.dwHighDateTime=0x1befd79, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285410.WMF", cAlternateFileName="")) returned 1 [0053.774] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.774] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0285410.WMF") returned -1 [0053.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0285410.WMF") returned -1 [0053.774] lstrcmpiA (lpString1="", lpString2="J0285410.WMF") returned -1 [0053.774] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF") returned="J0285360.WMF" [0053.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.774] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.774] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.774] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.774] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0285410.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF" [0053.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.zip") returned 0 [0053.774] lstrlenA (lpString="*.zip") returned 5 [0053.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.rar") returned 0 [0053.775] lstrlenA (lpString="*.rar") returned 5 [0053.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.7z") returned 0 [0053.775] lstrlenA (lpString="*.7z") returned 4 [0053.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.tar") returned 0 [0053.775] lstrlenA (lpString="*.tar") returned 5 [0053.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.gzip") returned 0 [0053.775] lstrlenA (lpString="*.gzip") returned 6 [0053.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.jpg") returned 0 [0053.775] lstrlenA (lpString="*.jpg") returned 5 [0053.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.jpeg") returned 0 [0053.775] lstrlenA (lpString="*.jpeg") returned 6 [0053.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.psd") returned 0 [0053.775] lstrlenA (lpString="*.psd") returned 5 [0053.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.gif") returned 0 [0053.775] lstrlenA (lpString="*.gif") returned 5 [0053.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.doc") returned 0 [0053.775] lstrlenA (lpString="*.doc") returned 5 [0053.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.docx") returned 0 [0053.775] lstrlenA (lpString="*.docx") returned 6 [0053.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.xls") returned 0 [0053.775] lstrlenA (lpString="*.xls") returned 5 [0053.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.xlsx") returned 0 [0053.775] lstrlenA (lpString="*.xlsx") returned 6 [0053.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.ppt") returned 0 [0053.775] lstrlenA (lpString="*.ppt") returned 5 [0053.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.pptx") returned 0 [0053.776] lstrlenA (lpString="*.pptx") returned 6 [0053.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.pdf") returned 0 [0053.776] lstrlenA (lpString="*.pdf") returned 5 [0053.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.mov") returned 0 [0053.776] lstrlenA (lpString="*.mov") returned 5 [0053.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.m2v") returned 0 [0053.776] lstrlenA (lpString="*.m2v") returned 5 [0053.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.3gp") returned 0 [0053.776] lstrlenA (lpString="*.3gp") returned 5 [0053.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.mpeg") returned 0 [0053.776] lstrlenA (lpString="*.mpeg") returned 6 [0053.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.mpg") returned 0 [0053.776] lstrlenA (lpString="*.mpg") returned 5 [0053.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.flv") returned 0 [0053.776] lstrlenA (lpString="*.flv") returned 5 [0053.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.avi") returned 0 [0053.776] lstrlenA (lpString="*.avi") returned 5 [0053.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.mp4") returned 0 [0053.776] lstrlenA (lpString="*.mp4") returned 5 [0053.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.wmv") returned 0 [0053.776] lstrlenA (lpString="*.wmv") returned 5 [0053.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.divx") returned 0 [0053.776] lstrlenA (lpString="*.divx") returned 6 [0053.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.mkv") returned 0 [0053.776] lstrlenA (lpString="*.mkv") returned 5 [0053.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.mp3") returned 0 [0053.777] lstrlenA (lpString="*.mp3") returned 5 [0053.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.wav") returned 0 [0053.777] lstrlenA (lpString="*.wav") returned 5 [0053.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.flac") returned 0 [0053.777] lstrlenA (lpString="*.flac") returned 6 [0053.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.ape") returned 0 [0053.777] lstrlenA (lpString="*.ape") returned 5 [0053.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.wma") returned 0 [0053.777] lstrlenA (lpString="*.wma") returned 5 [0053.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.ac3") returned 0 [0053.777] lstrlenA (lpString="*.ac3") returned 5 [0053.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", pszSpec="*.mxf") returned 0 [0053.777] lstrlenA (lpString="*.mxf") returned 5 [0053.777] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d5a00, ftCreationTime.dwHighDateTime=0x1befd7a, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x97d5a00, ftLastWriteTime.dwHighDateTime=0x1befd7a, nFileSizeHigh=0x0, nFileSizeLow=0x2448, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285444.WMF", cAlternateFileName="")) returned 1 [0053.777] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.777] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0285444.WMF") returned -1 [0053.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0285444.WMF") returned -1 [0053.777] lstrcmpiA (lpString1="", lpString2="J0285444.WMF") returned -1 [0053.777] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF") returned="J0285410.WMF" [0053.777] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.777] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.777] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.778] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.778] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0285444.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF" [0053.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.zip") returned 0 [0053.778] lstrlenA (lpString="*.zip") returned 5 [0053.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.rar") returned 0 [0053.778] lstrlenA (lpString="*.rar") returned 5 [0053.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.7z") returned 0 [0053.778] lstrlenA (lpString="*.7z") returned 4 [0053.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.tar") returned 0 [0053.778] lstrlenA (lpString="*.tar") returned 5 [0053.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.gzip") returned 0 [0053.778] lstrlenA (lpString="*.gzip") returned 6 [0053.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.jpg") returned 0 [0053.778] lstrlenA (lpString="*.jpg") returned 5 [0053.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.jpeg") returned 0 [0053.778] lstrlenA (lpString="*.jpeg") returned 6 [0053.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.psd") returned 0 [0053.778] lstrlenA (lpString="*.psd") returned 5 [0053.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.gif") returned 0 [0053.778] lstrlenA (lpString="*.gif") returned 5 [0053.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.doc") returned 0 [0053.779] lstrlenA (lpString="*.doc") returned 5 [0053.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.docx") returned 0 [0053.779] lstrlenA (lpString="*.docx") returned 6 [0053.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.xls") returned 0 [0053.779] lstrlenA (lpString="*.xls") returned 5 [0053.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.xlsx") returned 0 [0053.779] lstrlenA (lpString="*.xlsx") returned 6 [0053.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.ppt") returned 0 [0053.779] lstrlenA (lpString="*.ppt") returned 5 [0053.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.pptx") returned 0 [0053.779] lstrlenA (lpString="*.pptx") returned 6 [0053.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.pdf") returned 0 [0053.779] lstrlenA (lpString="*.pdf") returned 5 [0053.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.mov") returned 0 [0053.779] lstrlenA (lpString="*.mov") returned 5 [0053.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.m2v") returned 0 [0053.779] lstrlenA (lpString="*.m2v") returned 5 [0053.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.3gp") returned 0 [0053.779] lstrlenA (lpString="*.3gp") returned 5 [0053.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.mpeg") returned 0 [0053.779] lstrlenA (lpString="*.mpeg") returned 6 [0053.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.mpg") returned 0 [0053.779] lstrlenA (lpString="*.mpg") returned 5 [0053.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.flv") returned 0 [0053.779] lstrlenA (lpString="*.flv") returned 5 [0053.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.avi") returned 0 [0053.780] lstrlenA (lpString="*.avi") returned 5 [0053.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.mp4") returned 0 [0053.780] lstrlenA (lpString="*.mp4") returned 5 [0053.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.wmv") returned 0 [0053.780] lstrlenA (lpString="*.wmv") returned 5 [0053.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.divx") returned 0 [0053.780] lstrlenA (lpString="*.divx") returned 6 [0053.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.mkv") returned 0 [0053.780] lstrlenA (lpString="*.mkv") returned 5 [0053.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.mp3") returned 0 [0053.780] lstrlenA (lpString="*.mp3") returned 5 [0053.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.wav") returned 0 [0053.780] lstrlenA (lpString="*.wav") returned 5 [0053.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.flac") returned 0 [0053.780] lstrlenA (lpString="*.flac") returned 6 [0053.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.ape") returned 0 [0053.780] lstrlenA (lpString="*.ape") returned 5 [0053.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.wma") returned 0 [0053.780] lstrlenA (lpString="*.wma") returned 5 [0053.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.ac3") returned 0 [0053.780] lstrlenA (lpString="*.ac3") returned 5 [0053.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", pszSpec="*.mxf") returned 0 [0053.780] lstrlenA (lpString="*.mxf") returned 5 [0053.780] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d3c7300, ftCreationTime.dwHighDateTime=0x1befd7b, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5d3c7300, ftLastWriteTime.dwHighDateTime=0x1befd7b, nFileSizeHigh=0x0, nFileSizeLow=0x2a12, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285698.WMF", cAlternateFileName="")) returned 1 [0053.781] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.781] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0285698.WMF") returned -1 [0053.781] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0285698.WMF") returned -1 [0053.781] lstrcmpiA (lpString1="", lpString2="J0285698.WMF") returned -1 [0053.781] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF") returned="J0285444.WMF" [0053.781] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.781] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.781] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.781] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.781] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0285698.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF" [0053.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.zip") returned 0 [0053.781] lstrlenA (lpString="*.zip") returned 5 [0053.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.rar") returned 0 [0053.781] lstrlenA (lpString="*.rar") returned 5 [0053.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.7z") returned 0 [0053.781] lstrlenA (lpString="*.7z") returned 4 [0053.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.tar") returned 0 [0053.781] lstrlenA (lpString="*.tar") returned 5 [0053.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.gzip") returned 0 [0053.781] lstrlenA (lpString="*.gzip") returned 6 [0053.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.jpg") returned 0 [0053.782] lstrlenA (lpString="*.jpg") returned 5 [0053.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.jpeg") returned 0 [0053.782] lstrlenA (lpString="*.jpeg") returned 6 [0053.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.psd") returned 0 [0053.782] lstrlenA (lpString="*.psd") returned 5 [0053.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.gif") returned 0 [0053.782] lstrlenA (lpString="*.gif") returned 5 [0053.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.doc") returned 0 [0053.782] lstrlenA (lpString="*.doc") returned 5 [0053.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.docx") returned 0 [0053.782] lstrlenA (lpString="*.docx") returned 6 [0053.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.xls") returned 0 [0053.782] lstrlenA (lpString="*.xls") returned 5 [0053.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.xlsx") returned 0 [0053.782] lstrlenA (lpString="*.xlsx") returned 6 [0053.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.ppt") returned 0 [0053.782] lstrlenA (lpString="*.ppt") returned 5 [0053.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.pptx") returned 0 [0053.782] lstrlenA (lpString="*.pptx") returned 6 [0053.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.pdf") returned 0 [0053.782] lstrlenA (lpString="*.pdf") returned 5 [0053.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.mov") returned 0 [0053.782] lstrlenA (lpString="*.mov") returned 5 [0053.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.m2v") returned 0 [0053.782] lstrlenA (lpString="*.m2v") returned 5 [0053.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.3gp") returned 0 [0053.783] lstrlenA (lpString="*.3gp") returned 5 [0053.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.mpeg") returned 0 [0053.783] lstrlenA (lpString="*.mpeg") returned 6 [0053.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.mpg") returned 0 [0053.783] lstrlenA (lpString="*.mpg") returned 5 [0053.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.flv") returned 0 [0053.783] lstrlenA (lpString="*.flv") returned 5 [0053.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.avi") returned 0 [0053.783] lstrlenA (lpString="*.avi") returned 5 [0053.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.mp4") returned 0 [0053.783] lstrlenA (lpString="*.mp4") returned 5 [0053.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.wmv") returned 0 [0053.783] lstrlenA (lpString="*.wmv") returned 5 [0053.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.divx") returned 0 [0053.783] lstrlenA (lpString="*.divx") returned 6 [0053.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.mkv") returned 0 [0053.783] lstrlenA (lpString="*.mkv") returned 5 [0053.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.mp3") returned 0 [0053.783] lstrlenA (lpString="*.mp3") returned 5 [0053.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.wav") returned 0 [0053.783] lstrlenA (lpString="*.wav") returned 5 [0053.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.flac") returned 0 [0053.784] lstrlenA (lpString="*.flac") returned 6 [0053.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.ape") returned 0 [0053.784] lstrlenA (lpString="*.ape") returned 5 [0053.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.wma") returned 0 [0053.784] lstrlenA (lpString="*.wma") returned 5 [0053.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.ac3") returned 0 [0053.784] lstrlenA (lpString="*.ac3") returned 5 [0053.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", pszSpec="*.mxf") returned 0 [0053.784] lstrlenA (lpString="*.mxf") returned 5 [0053.784] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ecd1e00, ftCreationTime.dwHighDateTime=0x1befd7b, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9ecd1e00, ftLastWriteTime.dwHighDateTime=0x1befd7b, nFileSizeHigh=0x0, nFileSizeLow=0x958c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285750.WMF", cAlternateFileName="")) returned 1 [0053.784] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.784] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0285750.WMF") returned -1 [0053.784] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0285750.WMF") returned -1 [0053.784] lstrcmpiA (lpString1="", lpString2="J0285750.WMF") returned -1 [0053.784] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF") returned="J0285698.WMF" [0053.784] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.784] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.784] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0285750.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF" [0053.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.zip") returned 0 [0053.785] lstrlenA (lpString="*.zip") returned 5 [0053.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.rar") returned 0 [0053.785] lstrlenA (lpString="*.rar") returned 5 [0053.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.7z") returned 0 [0053.785] lstrlenA (lpString="*.7z") returned 4 [0053.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.tar") returned 0 [0053.785] lstrlenA (lpString="*.tar") returned 5 [0053.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.gzip") returned 0 [0053.785] lstrlenA (lpString="*.gzip") returned 6 [0053.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.jpg") returned 0 [0053.785] lstrlenA (lpString="*.jpg") returned 5 [0053.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.jpeg") returned 0 [0053.785] lstrlenA (lpString="*.jpeg") returned 6 [0053.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.psd") returned 0 [0053.785] lstrlenA (lpString="*.psd") returned 5 [0053.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.gif") returned 0 [0053.785] lstrlenA (lpString="*.gif") returned 5 [0053.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.doc") returned 0 [0053.786] lstrlenA (lpString="*.doc") returned 5 [0053.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.docx") returned 0 [0053.786] lstrlenA (lpString="*.docx") returned 6 [0053.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.xls") returned 0 [0053.786] lstrlenA (lpString="*.xls") returned 5 [0053.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.xlsx") returned 0 [0053.786] lstrlenA (lpString="*.xlsx") returned 6 [0053.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.ppt") returned 0 [0053.786] lstrlenA (lpString="*.ppt") returned 5 [0053.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.pptx") returned 0 [0053.786] lstrlenA (lpString="*.pptx") returned 6 [0053.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.pdf") returned 0 [0053.786] lstrlenA (lpString="*.pdf") returned 5 [0053.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.mov") returned 0 [0053.786] lstrlenA (lpString="*.mov") returned 5 [0053.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.m2v") returned 0 [0053.786] lstrlenA (lpString="*.m2v") returned 5 [0053.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.3gp") returned 0 [0053.787] lstrlenA (lpString="*.3gp") returned 5 [0053.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.mpeg") returned 0 [0053.787] lstrlenA (lpString="*.mpeg") returned 6 [0053.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.mpg") returned 0 [0053.787] lstrlenA (lpString="*.mpg") returned 5 [0053.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.flv") returned 0 [0053.787] lstrlenA (lpString="*.flv") returned 5 [0053.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.avi") returned 0 [0053.787] lstrlenA (lpString="*.avi") returned 5 [0053.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.mp4") returned 0 [0053.787] lstrlenA (lpString="*.mp4") returned 5 [0053.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.wmv") returned 0 [0053.787] lstrlenA (lpString="*.wmv") returned 5 [0053.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.divx") returned 0 [0053.787] lstrlenA (lpString="*.divx") returned 6 [0053.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.mkv") returned 0 [0053.787] lstrlenA (lpString="*.mkv") returned 5 [0053.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.mp3") returned 0 [0053.787] lstrlenA (lpString="*.mp3") returned 5 [0053.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.wav") returned 0 [0053.788] lstrlenA (lpString="*.wav") returned 5 [0053.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.flac") returned 0 [0053.788] lstrlenA (lpString="*.flac") returned 6 [0053.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.ape") returned 0 [0053.788] lstrlenA (lpString="*.ape") returned 5 [0053.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.wma") returned 0 [0053.788] lstrlenA (lpString="*.wma") returned 5 [0053.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.ac3") returned 0 [0053.788] lstrlenA (lpString="*.ac3") returned 5 [0053.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", pszSpec="*.mxf") returned 0 [0053.788] lstrlenA (lpString="*.mxf") returned 5 [0053.788] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95908100, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x95908100, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x3452, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285926.WMF", cAlternateFileName="")) returned 1 [0053.788] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.788] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0285926.WMF") returned -1 [0053.788] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0285926.WMF") returned -1 [0053.788] lstrcmpiA (lpString1="", lpString2="J0285926.WMF") returned -1 [0053.788] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF") returned="J0285750.WMF" [0053.788] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.788] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.788] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.788] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.789] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0285926.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF" [0053.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.zip") returned 0 [0053.789] lstrlenA (lpString="*.zip") returned 5 [0053.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.rar") returned 0 [0053.789] lstrlenA (lpString="*.rar") returned 5 [0053.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.7z") returned 0 [0053.789] lstrlenA (lpString="*.7z") returned 4 [0053.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.tar") returned 0 [0053.789] lstrlenA (lpString="*.tar") returned 5 [0053.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.gzip") returned 0 [0053.789] lstrlenA (lpString="*.gzip") returned 6 [0053.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.jpg") returned 0 [0053.789] lstrlenA (lpString="*.jpg") returned 5 [0053.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.jpeg") returned 0 [0053.789] lstrlenA (lpString="*.jpeg") returned 6 [0053.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.psd") returned 0 [0053.789] lstrlenA (lpString="*.psd") returned 5 [0053.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.gif") returned 0 [0053.789] lstrlenA (lpString="*.gif") returned 5 [0053.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.doc") returned 0 [0053.789] lstrlenA (lpString="*.doc") returned 5 [0053.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.docx") returned 0 [0053.790] lstrlenA (lpString="*.docx") returned 6 [0053.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.xls") returned 0 [0053.790] lstrlenA (lpString="*.xls") returned 5 [0053.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.xlsx") returned 0 [0053.790] lstrlenA (lpString="*.xlsx") returned 6 [0053.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.ppt") returned 0 [0053.790] lstrlenA (lpString="*.ppt") returned 5 [0053.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.pptx") returned 0 [0053.790] lstrlenA (lpString="*.pptx") returned 6 [0053.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.pdf") returned 0 [0053.790] lstrlenA (lpString="*.pdf") returned 5 [0053.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.mov") returned 0 [0053.790] lstrlenA (lpString="*.mov") returned 5 [0053.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.m2v") returned 0 [0053.790] lstrlenA (lpString="*.m2v") returned 5 [0053.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.3gp") returned 0 [0053.790] lstrlenA (lpString="*.3gp") returned 5 [0053.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.mpeg") returned 0 [0053.790] lstrlenA (lpString="*.mpeg") returned 6 [0053.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.mpg") returned 0 [0053.790] lstrlenA (lpString="*.mpg") returned 5 [0053.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.flv") returned 0 [0053.790] lstrlenA (lpString="*.flv") returned 5 [0053.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.avi") returned 0 [0053.790] lstrlenA (lpString="*.avi") returned 5 [0053.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.mp4") returned 0 [0053.791] lstrlenA (lpString="*.mp4") returned 5 [0053.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.wmv") returned 0 [0053.791] lstrlenA (lpString="*.wmv") returned 5 [0053.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.divx") returned 0 [0053.791] lstrlenA (lpString="*.divx") returned 6 [0053.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.mkv") returned 0 [0053.791] lstrlenA (lpString="*.mkv") returned 5 [0053.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.mp3") returned 0 [0053.791] lstrlenA (lpString="*.mp3") returned 5 [0053.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.wav") returned 0 [0053.791] lstrlenA (lpString="*.wav") returned 5 [0053.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.flac") returned 0 [0053.791] lstrlenA (lpString="*.flac") returned 6 [0053.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.ape") returned 0 [0053.791] lstrlenA (lpString="*.ape") returned 5 [0053.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.wma") returned 0 [0053.791] lstrlenA (lpString="*.wma") returned 5 [0053.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.ac3") returned 0 [0053.791] lstrlenA (lpString="*.ac3") returned 5 [0053.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", pszSpec="*.mxf") returned 0 [0053.791] lstrlenA (lpString="*.mxf") returned 5 [0053.791] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf49a800, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbf49a800, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x9e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0286034.WMF", cAlternateFileName="")) returned 1 [0053.791] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.792] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0286034.WMF") returned -1 [0053.792] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0286034.WMF") returned -1 [0053.792] lstrcmpiA (lpString1="", lpString2="J0286034.WMF") returned -1 [0053.792] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF") returned="J0285926.WMF" [0053.792] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.792] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.792] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.792] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.792] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0286034.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF" [0053.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.zip") returned 0 [0053.792] lstrlenA (lpString="*.zip") returned 5 [0053.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.rar") returned 0 [0053.792] lstrlenA (lpString="*.rar") returned 5 [0053.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.7z") returned 0 [0053.792] lstrlenA (lpString="*.7z") returned 4 [0053.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.tar") returned 0 [0053.792] lstrlenA (lpString="*.tar") returned 5 [0053.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.gzip") returned 0 [0053.792] lstrlenA (lpString="*.gzip") returned 6 [0053.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.jpg") returned 0 [0053.793] lstrlenA (lpString="*.jpg") returned 5 [0053.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.jpeg") returned 0 [0053.793] lstrlenA (lpString="*.jpeg") returned 6 [0053.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.psd") returned 0 [0053.793] lstrlenA (lpString="*.psd") returned 5 [0053.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.gif") returned 0 [0053.793] lstrlenA (lpString="*.gif") returned 5 [0053.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.doc") returned 0 [0053.793] lstrlenA (lpString="*.doc") returned 5 [0053.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.docx") returned 0 [0053.793] lstrlenA (lpString="*.docx") returned 6 [0053.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.xls") returned 0 [0053.793] lstrlenA (lpString="*.xls") returned 5 [0053.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.xlsx") returned 0 [0053.793] lstrlenA (lpString="*.xlsx") returned 6 [0053.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.ppt") returned 0 [0053.793] lstrlenA (lpString="*.ppt") returned 5 [0053.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.pptx") returned 0 [0053.793] lstrlenA (lpString="*.pptx") returned 6 [0053.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.pdf") returned 0 [0053.793] lstrlenA (lpString="*.pdf") returned 5 [0053.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.mov") returned 0 [0053.793] lstrlenA (lpString="*.mov") returned 5 [0053.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.m2v") returned 0 [0053.793] lstrlenA (lpString="*.m2v") returned 5 [0053.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.3gp") returned 0 [0053.794] lstrlenA (lpString="*.3gp") returned 5 [0053.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.mpeg") returned 0 [0053.794] lstrlenA (lpString="*.mpeg") returned 6 [0053.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.mpg") returned 0 [0053.794] lstrlenA (lpString="*.mpg") returned 5 [0053.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.flv") returned 0 [0053.794] lstrlenA (lpString="*.flv") returned 5 [0053.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.avi") returned 0 [0053.794] lstrlenA (lpString="*.avi") returned 5 [0053.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.mp4") returned 0 [0053.794] lstrlenA (lpString="*.mp4") returned 5 [0053.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.wmv") returned 0 [0053.794] lstrlenA (lpString="*.wmv") returned 5 [0053.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.divx") returned 0 [0053.794] lstrlenA (lpString="*.divx") returned 6 [0053.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.mkv") returned 0 [0053.794] lstrlenA (lpString="*.mkv") returned 5 [0053.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.mp3") returned 0 [0053.794] lstrlenA (lpString="*.mp3") returned 5 [0053.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.wav") returned 0 [0053.794] lstrlenA (lpString="*.wav") returned 5 [0053.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.flac") returned 0 [0053.795] lstrlenA (lpString="*.flac") returned 6 [0053.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.ape") returned 0 [0053.795] lstrlenA (lpString="*.ape") returned 5 [0053.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.wma") returned 0 [0053.795] lstrlenA (lpString="*.wma") returned 5 [0053.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.ac3") returned 0 [0053.795] lstrlenA (lpString="*.ac3") returned 5 [0053.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", pszSpec="*.mxf") returned 0 [0053.795] lstrlenA (lpString="*.mxf") returned 5 [0053.795] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5efff00, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd5efff00, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x9d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0286068.WMF", cAlternateFileName="")) returned 1 [0053.795] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.795] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0286068.WMF") returned -1 [0053.795] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0286068.WMF") returned -1 [0053.795] lstrcmpiA (lpString1="", lpString2="J0286068.WMF") returned -1 [0053.795] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF") returned="J0286034.WMF" [0053.795] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.795] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.795] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.795] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.795] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0286068.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF" [0053.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF", pszSpec="*.zip") returned 0 [0053.796] lstrlenA (lpString="*.zip") returned 5 [0053.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF", pszSpec="*.rar") returned 0 [0053.796] lstrlenA (lpString="*.rar") returned 5 [0053.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF", pszSpec="*.7z") returned 0 [0053.796] lstrlenA (lpString="*.7z") returned 4 [0053.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF", pszSpec="*.tar") returned 0 [0053.796] lstrlenA (lpString="*.tar") returned 5 [0053.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF", pszSpec="*.gzip") returned 0 [0053.796] lstrlenA (lpString="*.gzip") returned 6 [0053.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF", pszSpec="*.jpg") returned 0 [0053.796] lstrlenA (lpString="*.jpg") returned 5 [0053.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF", pszSpec="*.jpeg") returned 0 [0053.796] lstrlenA (lpString="*.jpeg") returned 6 [0053.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF", pszSpec="*.psd") returned 0 [0053.796] lstrlenA (lpString="*.psd") returned 5 [0053.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF", pszSpec="*.gif") returned 0 [0053.796] lstrlenA (lpString="*.gif") returned 5 [0053.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF", pszSpec="*.doc") returned 0 [0053.796] lstrlenA (lpString="*.doc") returned 5 [0053.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF", pszSpec="*.docx") returned 0 [0053.796] lstrlenA (lpString="*.docx") returned 6 [0053.797] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa019c00, ftCreationTime.dwHighDateTime=0x1bef57a, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa019c00, ftLastWriteTime.dwHighDateTime=0x1bef57a, nFileSizeHigh=0x0, nFileSizeLow=0xb21e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287005.WMF", cAlternateFileName="")) returned 1 [0053.797] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.797] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0287005.WMF") returned -1 [0053.797] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0287005.WMF") returned -1 [0053.797] lstrcmpiA (lpString1="", lpString2="J0287005.WMF") returned -1 [0053.797] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF") returned="J0286068.WMF" [0053.797] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.797] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.797] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.797] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.797] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0287005.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF" [0053.797] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948c7400, ftCreationTime.dwHighDateTime=0x1bf1521, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x948c7400, ftLastWriteTime.dwHighDateTime=0x1bf1521, nFileSizeHigh=0x0, nFileSizeLow=0x76ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0291984.WMF", cAlternateFileName="")) returned 1 [0053.797] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.797] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0291984.WMF") returned -1 [0053.797] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0291984.WMF") returned -1 [0053.797] lstrcmpiA (lpString1="", lpString2="J0291984.WMF") returned -1 [0053.797] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF") returned="J0287005.WMF" [0053.798] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.798] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.798] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.798] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.798] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0291984.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF" [0053.798] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9003000, ftCreationTime.dwHighDateTime=0x1bf1521, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9003000, ftLastWriteTime.dwHighDateTime=0x1bf1521, nFileSizeHigh=0x0, nFileSizeLow=0x7148, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292020.WMF", cAlternateFileName="")) returned 1 [0053.798] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.798] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0292020.WMF") returned -1 [0053.798] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0292020.WMF") returned -1 [0053.798] lstrcmpiA (lpString1="", lpString2="J0292020.WMF") returned -1 [0053.798] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF") returned="J0291984.WMF" [0053.798] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.798] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.798] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.798] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.798] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0292020.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF" [0053.799] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4af05900, ftCreationTime.dwHighDateTime=0x1bf1522, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4af05900, ftLastWriteTime.dwHighDateTime=0x1bf1522, nFileSizeHigh=0x0, nFileSizeLow=0x20ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292152.WMF", cAlternateFileName="")) returned 1 [0053.799] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.799] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0292152.WMF") returned -1 [0053.799] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0292152.WMF") returned -1 [0053.799] lstrcmpiA (lpString1="", lpString2="J0292152.WMF") returned -1 [0053.799] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF") returned="J0292020.WMF" [0053.799] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.799] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.799] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.799] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.800] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0292152.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF" [0053.800] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48b60800, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x48b60800, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292982.WMF", cAlternateFileName="")) returned 1 [0053.800] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.800] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0292982.WMF") returned -1 [0053.800] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0292982.WMF") returned -1 [0053.800] lstrcmpiA (lpString1="", lpString2="J0292982.WMF") returned -1 [0053.800] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF") returned="J0292152.WMF" [0053.800] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.800] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.800] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.800] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.800] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0292982.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF" [0053.800] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x5ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293234.WMF", cAlternateFileName="")) returned 1 [0053.800] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.800] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0293234.WMF") returned -1 [0053.800] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0293234.WMF") returned -1 [0053.801] lstrcmpiA (lpString1="", lpString2="J0293234.WMF") returned -1 [0053.801] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF") returned="J0292982.WMF" [0053.801] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.801] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.801] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.801] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.801] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0293234.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF" [0053.801] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x766, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293236.WMF", cAlternateFileName="")) returned 1 [0053.801] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.801] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0293236.WMF") returned -1 [0053.801] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0293236.WMF") returned -1 [0053.801] lstrcmpiA (lpString1="", lpString2="J0293236.WMF") returned -1 [0053.801] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF") returned="J0293234.WMF" [0053.801] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.801] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.801] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.801] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.801] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0293236.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF" [0053.802] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293238.WMF", cAlternateFileName="")) returned 1 [0053.802] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.802] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0293238.WMF") returned -1 [0053.802] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0293238.WMF") returned -1 [0053.802] lstrcmpiA (lpString1="", lpString2="J0293238.WMF") returned -1 [0053.802] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF") returned="J0293236.WMF" [0053.802] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.802] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.802] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.802] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.802] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0293238.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF" [0053.802] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c285600, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9c285600, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x88e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293240.WMF", cAlternateFileName="")) returned 1 [0053.802] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.802] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0293240.WMF") returned -1 [0053.802] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0293240.WMF") returned -1 [0053.802] lstrcmpiA (lpString1="", lpString2="J0293240.WMF") returned -1 [0053.802] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF") returned="J0293238.WMF" [0053.802] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.802] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.803] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.803] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.803] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0293240.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF" [0053.803] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47a99d00, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x47a99d00, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x92c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293570.WMF", cAlternateFileName="")) returned 1 [0053.803] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.803] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0293570.WMF") returned -1 [0053.803] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0293570.WMF") returned -1 [0053.803] lstrcmpiA (lpString1="", lpString2="J0293570.WMF") returned -1 [0053.803] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF") returned="J0293240.WMF" [0053.803] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.803] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.803] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.803] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.803] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0293570.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF" [0053.803] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0911500, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb0911500, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x15ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293828.WMF", cAlternateFileName="")) returned 1 [0053.803] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.804] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0293828.WMF") returned -1 [0053.804] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0293828.WMF") returned -1 [0053.804] lstrcmpiA (lpString1="", lpString2="J0293828.WMF") returned -1 [0053.804] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF") returned="J0293570.WMF" [0053.804] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.804] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.804] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.804] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.804] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0293828.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF" [0053.804] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7b82300, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7b82300, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x812, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293844.WMF", cAlternateFileName="")) returned 1 [0053.804] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.804] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0293844.WMF") returned -1 [0053.804] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0293844.WMF") returned -1 [0053.805] lstrcmpiA (lpString1="", lpString2="J0293844.WMF") returned -1 [0053.805] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF") returned="J0293828.WMF" [0053.805] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.805] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.805] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.805] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.805] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0293844.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF" [0053.805] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72dc8d00, ftCreationTime.dwHighDateTime=0x1bf0891, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72dc8d00, ftLastWriteTime.dwHighDateTime=0x1bf0891, nFileSizeHigh=0x0, nFileSizeLow=0x29e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0295241.GIF", cAlternateFileName="")) returned 1 [0053.805] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.805] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0295241.GIF") returned -1 [0053.805] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0295241.GIF") returned -1 [0053.805] lstrcmpiA (lpString1="", lpString2="J0295241.GIF") returned -1 [0053.805] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF") returned="J0293844.WMF" [0053.805] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.805] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.805] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.806] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.806] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0295241.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" [0053.806] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" [0053.806] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" [0053.806] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF." [0053.806] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF.wannacry" [0053.806] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0053.807] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29e5 [0053.807] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x72dc8d00, dwHighDateTime=0x1bf0891), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd643aa0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x72dc8d00, dwHighDateTime=0x1bf0891)) returned 1 [0053.808] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0053.808] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2967, lpOverlapped=0x0) returned 1 [0053.810] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF") returned="J0295241.GIF" [0053.810] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0053.810] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2967, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2967, lpOverlapped=0x0) returned 1 [0053.810] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.810] CloseHandle (hObject=0x8c) returned 1 [0053.811] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif.wannacry")) returned 1 [0053.812] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4c2400, ftCreationTime.dwHighDateTime=0x1bf2c95, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7b4c2400, ftLastWriteTime.dwHighDateTime=0x1bf2c95, nFileSizeHigh=0x0, nFileSizeLow=0xcd52, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="J0297185.WMF", cAlternateFileName="")) returned 1 [0053.812] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.812] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0297185.WMF") returned -1 [0053.813] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0297185.WMF") returned -1 [0053.813] lstrcmpiA (lpString1="", lpString2="J0297185.WMF") returned -1 [0053.813] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF") returned="J0295241.GIF" [0053.813] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.813] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.813] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.813] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.813] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0297185.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF" [0053.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.zip") returned 0 [0053.813] lstrlenA (lpString="*.zip") returned 5 [0053.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.rar") returned 0 [0053.813] lstrlenA (lpString="*.rar") returned 5 [0053.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.7z") returned 0 [0053.813] lstrlenA (lpString="*.7z") returned 4 [0053.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.tar") returned 0 [0053.813] lstrlenA (lpString="*.tar") returned 5 [0053.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.gzip") returned 0 [0053.813] lstrlenA (lpString="*.gzip") returned 6 [0053.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.jpg") returned 0 [0053.813] lstrlenA (lpString="*.jpg") returned 5 [0053.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.jpeg") returned 0 [0053.813] lstrlenA (lpString="*.jpeg") returned 6 [0053.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.psd") returned 0 [0053.814] lstrlenA (lpString="*.psd") returned 5 [0053.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.gif") returned 0 [0053.814] lstrlenA (lpString="*.gif") returned 5 [0053.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.doc") returned 0 [0053.814] lstrlenA (lpString="*.doc") returned 5 [0053.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.docx") returned 0 [0053.814] lstrlenA (lpString="*.docx") returned 6 [0053.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.xls") returned 0 [0053.814] lstrlenA (lpString="*.xls") returned 5 [0053.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.xlsx") returned 0 [0053.814] lstrlenA (lpString="*.xlsx") returned 6 [0053.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.ppt") returned 0 [0053.814] lstrlenA (lpString="*.ppt") returned 5 [0053.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.pptx") returned 0 [0053.814] lstrlenA (lpString="*.pptx") returned 6 [0053.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.pdf") returned 0 [0053.814] lstrlenA (lpString="*.pdf") returned 5 [0053.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.mov") returned 0 [0053.815] lstrlenA (lpString="*.mov") returned 5 [0053.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.m2v") returned 0 [0053.815] lstrlenA (lpString="*.m2v") returned 5 [0053.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.3gp") returned 0 [0053.815] lstrlenA (lpString="*.3gp") returned 5 [0053.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.mpeg") returned 0 [0053.815] lstrlenA (lpString="*.mpeg") returned 6 [0053.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.mpg") returned 0 [0053.815] lstrlenA (lpString="*.mpg") returned 5 [0053.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.flv") returned 0 [0053.815] lstrlenA (lpString="*.flv") returned 5 [0053.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.avi") returned 0 [0053.815] lstrlenA (lpString="*.avi") returned 5 [0053.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.mp4") returned 0 [0053.815] lstrlenA (lpString="*.mp4") returned 5 [0053.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.wmv") returned 0 [0053.815] lstrlenA (lpString="*.wmv") returned 5 [0053.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.divx") returned 0 [0053.815] lstrlenA (lpString="*.divx") returned 6 [0053.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.mkv") returned 0 [0053.815] lstrlenA (lpString="*.mkv") returned 5 [0053.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.mp3") returned 0 [0053.815] lstrlenA (lpString="*.mp3") returned 5 [0053.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.wav") returned 0 [0053.815] lstrlenA (lpString="*.wav") returned 5 [0053.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.flac") returned 0 [0053.816] lstrlenA (lpString="*.flac") returned 6 [0053.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.ape") returned 0 [0053.816] lstrlenA (lpString="*.ape") returned 5 [0053.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.wma") returned 0 [0053.816] lstrlenA (lpString="*.wma") returned 5 [0053.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.ac3") returned 0 [0053.816] lstrlenA (lpString="*.ac3") returned 5 [0053.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", pszSpec="*.mxf") returned 0 [0053.816] lstrlenA (lpString="*.mxf") returned 5 [0053.816] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74beac00, ftCreationTime.dwHighDateTime=0x1bf2c97, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74beac00, ftLastWriteTime.dwHighDateTime=0x1bf2c97, nFileSizeHigh=0x0, nFileSizeLow=0x6db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297551.WMF", cAlternateFileName="")) returned 1 [0053.816] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.816] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0297551.WMF") returned -1 [0053.816] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0297551.WMF") returned -1 [0053.816] lstrcmpiA (lpString1="", lpString2="J0297551.WMF") returned -1 [0053.816] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF") returned="J0297185.WMF" [0053.816] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.816] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.816] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.816] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.816] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0297551.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF" [0053.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.zip") returned 0 [0053.817] lstrlenA (lpString="*.zip") returned 5 [0053.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.rar") returned 0 [0053.817] lstrlenA (lpString="*.rar") returned 5 [0053.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.7z") returned 0 [0053.817] lstrlenA (lpString="*.7z") returned 4 [0053.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.tar") returned 0 [0053.817] lstrlenA (lpString="*.tar") returned 5 [0053.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.gzip") returned 0 [0053.817] lstrlenA (lpString="*.gzip") returned 6 [0053.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.jpg") returned 0 [0053.817] lstrlenA (lpString="*.jpg") returned 5 [0053.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.jpeg") returned 0 [0053.817] lstrlenA (lpString="*.jpeg") returned 6 [0053.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.psd") returned 0 [0053.817] lstrlenA (lpString="*.psd") returned 5 [0053.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.gif") returned 0 [0053.817] lstrlenA (lpString="*.gif") returned 5 [0053.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.doc") returned 0 [0053.817] lstrlenA (lpString="*.doc") returned 5 [0053.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.docx") returned 0 [0053.817] lstrlenA (lpString="*.docx") returned 6 [0053.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.xls") returned 0 [0053.818] lstrlenA (lpString="*.xls") returned 5 [0053.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.xlsx") returned 0 [0053.818] lstrlenA (lpString="*.xlsx") returned 6 [0053.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.ppt") returned 0 [0053.818] lstrlenA (lpString="*.ppt") returned 5 [0053.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.pptx") returned 0 [0053.818] lstrlenA (lpString="*.pptx") returned 6 [0053.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.pdf") returned 0 [0053.818] lstrlenA (lpString="*.pdf") returned 5 [0053.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.mov") returned 0 [0053.818] lstrlenA (lpString="*.mov") returned 5 [0053.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.m2v") returned 0 [0053.818] lstrlenA (lpString="*.m2v") returned 5 [0053.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.3gp") returned 0 [0053.818] lstrlenA (lpString="*.3gp") returned 5 [0053.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.mpeg") returned 0 [0053.818] lstrlenA (lpString="*.mpeg") returned 6 [0053.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.mpg") returned 0 [0053.818] lstrlenA (lpString="*.mpg") returned 5 [0053.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.flv") returned 0 [0053.818] lstrlenA (lpString="*.flv") returned 5 [0053.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.avi") returned 0 [0053.818] lstrlenA (lpString="*.avi") returned 5 [0053.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.mp4") returned 0 [0053.819] lstrlenA (lpString="*.mp4") returned 5 [0053.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.wmv") returned 0 [0053.819] lstrlenA (lpString="*.wmv") returned 5 [0053.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.divx") returned 0 [0053.819] lstrlenA (lpString="*.divx") returned 6 [0053.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.mkv") returned 0 [0053.819] lstrlenA (lpString="*.mkv") returned 5 [0053.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.mp3") returned 0 [0053.819] lstrlenA (lpString="*.mp3") returned 5 [0053.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.wav") returned 0 [0053.819] lstrlenA (lpString="*.wav") returned 5 [0053.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.flac") returned 0 [0053.819] lstrlenA (lpString="*.flac") returned 6 [0053.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.ape") returned 0 [0053.819] lstrlenA (lpString="*.ape") returned 5 [0053.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.wma") returned 0 [0053.819] lstrlenA (lpString="*.wma") returned 5 [0053.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.ac3") returned 0 [0053.819] lstrlenA (lpString="*.ac3") returned 5 [0053.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", pszSpec="*.mxf") returned 0 [0053.819] lstrlenA (lpString="*.mxf") returned 5 [0053.819] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50170400, ftCreationTime.dwHighDateTime=0x1bf2c98, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x50170400, ftLastWriteTime.dwHighDateTime=0x1bf2c98, nFileSizeHigh=0x0, nFileSizeLow=0xa7c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297707.WMF", cAlternateFileName="")) returned 1 [0053.819] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.820] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0297707.WMF") returned -1 [0053.820] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0297707.WMF") returned -1 [0053.820] lstrcmpiA (lpString1="", lpString2="J0297707.WMF") returned -1 [0053.820] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF") returned="J0297551.WMF" [0053.820] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.820] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.820] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.820] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.820] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0297707.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF" [0053.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.zip") returned 0 [0053.820] lstrlenA (lpString="*.zip") returned 5 [0053.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.rar") returned 0 [0053.820] lstrlenA (lpString="*.rar") returned 5 [0053.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.7z") returned 0 [0053.820] lstrlenA (lpString="*.7z") returned 4 [0053.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.tar") returned 0 [0053.820] lstrlenA (lpString="*.tar") returned 5 [0053.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.gzip") returned 0 [0053.820] lstrlenA (lpString="*.gzip") returned 6 [0053.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.jpg") returned 0 [0053.820] lstrlenA (lpString="*.jpg") returned 5 [0053.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.jpeg") returned 0 [0053.820] lstrlenA (lpString="*.jpeg") returned 6 [0053.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.psd") returned 0 [0053.821] lstrlenA (lpString="*.psd") returned 5 [0053.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.gif") returned 0 [0053.821] lstrlenA (lpString="*.gif") returned 5 [0053.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.doc") returned 0 [0053.821] lstrlenA (lpString="*.doc") returned 5 [0053.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.docx") returned 0 [0053.821] lstrlenA (lpString="*.docx") returned 6 [0053.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.xls") returned 0 [0053.821] lstrlenA (lpString="*.xls") returned 5 [0053.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.xlsx") returned 0 [0053.821] lstrlenA (lpString="*.xlsx") returned 6 [0053.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.ppt") returned 0 [0053.821] lstrlenA (lpString="*.ppt") returned 5 [0053.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.pptx") returned 0 [0053.821] lstrlenA (lpString="*.pptx") returned 6 [0053.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.pdf") returned 0 [0053.821] lstrlenA (lpString="*.pdf") returned 5 [0053.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.mov") returned 0 [0053.821] lstrlenA (lpString="*.mov") returned 5 [0053.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.m2v") returned 0 [0053.821] lstrlenA (lpString="*.m2v") returned 5 [0053.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.3gp") returned 0 [0053.821] lstrlenA (lpString="*.3gp") returned 5 [0053.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.mpeg") returned 0 [0053.821] lstrlenA (lpString="*.mpeg") returned 6 [0053.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.mpg") returned 0 [0053.822] lstrlenA (lpString="*.mpg") returned 5 [0053.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.flv") returned 0 [0053.822] lstrlenA (lpString="*.flv") returned 5 [0053.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.avi") returned 0 [0053.822] lstrlenA (lpString="*.avi") returned 5 [0053.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.mp4") returned 0 [0053.822] lstrlenA (lpString="*.mp4") returned 5 [0053.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.wmv") returned 0 [0053.822] lstrlenA (lpString="*.wmv") returned 5 [0053.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.divx") returned 0 [0053.822] lstrlenA (lpString="*.divx") returned 6 [0053.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.mkv") returned 0 [0053.822] lstrlenA (lpString="*.mkv") returned 5 [0053.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.mp3") returned 0 [0053.822] lstrlenA (lpString="*.mp3") returned 5 [0053.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.wav") returned 0 [0053.822] lstrlenA (lpString="*.wav") returned 5 [0053.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.flac") returned 0 [0053.822] lstrlenA (lpString="*.flac") returned 6 [0053.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.ape") returned 0 [0053.822] lstrlenA (lpString="*.ape") returned 5 [0053.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.wma") returned 0 [0053.822] lstrlenA (lpString="*.wma") returned 5 [0053.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.ac3") returned 0 [0053.823] lstrlenA (lpString="*.ac3") returned 5 [0053.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", pszSpec="*.mxf") returned 0 [0053.823] lstrlenA (lpString="*.mxf") returned 5 [0053.823] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x848ac000, ftCreationTime.dwHighDateTime=0x1bf2c98, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x848ac000, ftLastWriteTime.dwHighDateTime=0x1bf2c98, nFileSizeHigh=0x0, nFileSizeLow=0x27ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297749.WMF", cAlternateFileName="")) returned 1 [0053.823] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.823] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0297749.WMF") returned -1 [0053.823] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0297749.WMF") returned -1 [0053.823] lstrcmpiA (lpString1="", lpString2="J0297749.WMF") returned -1 [0053.823] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF") returned="J0297707.WMF" [0053.823] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.823] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.823] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.823] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.823] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0297749.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF" [0053.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.zip") returned 0 [0053.823] lstrlenA (lpString="*.zip") returned 5 [0053.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.rar") returned 0 [0053.823] lstrlenA (lpString="*.rar") returned 5 [0053.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.7z") returned 0 [0053.824] lstrlenA (lpString="*.7z") returned 4 [0053.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.tar") returned 0 [0053.824] lstrlenA (lpString="*.tar") returned 5 [0053.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.gzip") returned 0 [0053.824] lstrlenA (lpString="*.gzip") returned 6 [0053.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.jpg") returned 0 [0053.824] lstrlenA (lpString="*.jpg") returned 5 [0053.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.jpeg") returned 0 [0053.824] lstrlenA (lpString="*.jpeg") returned 6 [0053.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.psd") returned 0 [0053.824] lstrlenA (lpString="*.psd") returned 5 [0053.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.gif") returned 0 [0053.824] lstrlenA (lpString="*.gif") returned 5 [0053.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.doc") returned 0 [0053.824] lstrlenA (lpString="*.doc") returned 5 [0053.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.docx") returned 0 [0053.824] lstrlenA (lpString="*.docx") returned 6 [0053.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.xls") returned 0 [0053.824] lstrlenA (lpString="*.xls") returned 5 [0053.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.xlsx") returned 0 [0053.824] lstrlenA (lpString="*.xlsx") returned 6 [0053.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.ppt") returned 0 [0053.824] lstrlenA (lpString="*.ppt") returned 5 [0053.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.pptx") returned 0 [0053.825] lstrlenA (lpString="*.pptx") returned 6 [0053.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.pdf") returned 0 [0053.825] lstrlenA (lpString="*.pdf") returned 5 [0053.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.mov") returned 0 [0053.825] lstrlenA (lpString="*.mov") returned 5 [0053.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.m2v") returned 0 [0053.825] lstrlenA (lpString="*.m2v") returned 5 [0053.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.3gp") returned 0 [0053.825] lstrlenA (lpString="*.3gp") returned 5 [0053.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.mpeg") returned 0 [0053.825] lstrlenA (lpString="*.mpeg") returned 6 [0053.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.mpg") returned 0 [0053.825] lstrlenA (lpString="*.mpg") returned 5 [0053.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.flv") returned 0 [0053.825] lstrlenA (lpString="*.flv") returned 5 [0053.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.avi") returned 0 [0053.825] lstrlenA (lpString="*.avi") returned 5 [0053.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.mp4") returned 0 [0053.825] lstrlenA (lpString="*.mp4") returned 5 [0053.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.wmv") returned 0 [0053.825] lstrlenA (lpString="*.wmv") returned 5 [0053.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.divx") returned 0 [0053.825] lstrlenA (lpString="*.divx") returned 6 [0053.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.mkv") returned 0 [0053.826] lstrlenA (lpString="*.mkv") returned 5 [0053.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.mp3") returned 0 [0053.826] lstrlenA (lpString="*.mp3") returned 5 [0053.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.wav") returned 0 [0053.826] lstrlenA (lpString="*.wav") returned 5 [0053.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.flac") returned 0 [0053.826] lstrlenA (lpString="*.flac") returned 6 [0053.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.ape") returned 0 [0053.826] lstrlenA (lpString="*.ape") returned 5 [0053.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.wma") returned 0 [0053.826] lstrlenA (lpString="*.wma") returned 5 [0053.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.ac3") returned 0 [0053.826] lstrlenA (lpString="*.ac3") returned 5 [0053.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", pszSpec="*.mxf") returned 0 [0053.826] lstrlenA (lpString="*.mxf") returned 5 [0053.826] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3dea00, ftCreationTime.dwHighDateTime=0x1bf2c8c, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xae3dea00, ftLastWriteTime.dwHighDateTime=0x1bf2c8c, nFileSizeHigh=0x0, nFileSizeLow=0x197e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0298653.WMF", cAlternateFileName="")) returned 1 [0053.826] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.826] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0298653.WMF") returned -1 [0053.826] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0298653.WMF") returned -1 [0053.826] lstrcmpiA (lpString1="", lpString2="J0298653.WMF") returned -1 [0053.826] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF") returned="J0297749.WMF" [0053.826] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.827] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.827] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.827] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.827] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0298653.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF" [0053.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.zip") returned 0 [0053.827] lstrlenA (lpString="*.zip") returned 5 [0053.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.rar") returned 0 [0053.827] lstrlenA (lpString="*.rar") returned 5 [0053.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.7z") returned 0 [0053.827] lstrlenA (lpString="*.7z") returned 4 [0053.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.tar") returned 0 [0053.827] lstrlenA (lpString="*.tar") returned 5 [0053.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.gzip") returned 0 [0053.827] lstrlenA (lpString="*.gzip") returned 6 [0053.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.jpg") returned 0 [0053.827] lstrlenA (lpString="*.jpg") returned 5 [0053.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.jpeg") returned 0 [0053.827] lstrlenA (lpString="*.jpeg") returned 6 [0053.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.psd") returned 0 [0053.827] lstrlenA (lpString="*.psd") returned 5 [0053.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.gif") returned 0 [0053.828] lstrlenA (lpString="*.gif") returned 5 [0053.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.doc") returned 0 [0053.828] lstrlenA (lpString="*.doc") returned 5 [0053.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.docx") returned 0 [0053.828] lstrlenA (lpString="*.docx") returned 6 [0053.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.xls") returned 0 [0053.828] lstrlenA (lpString="*.xls") returned 5 [0053.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.xlsx") returned 0 [0053.828] lstrlenA (lpString="*.xlsx") returned 6 [0053.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.ppt") returned 0 [0053.828] lstrlenA (lpString="*.ppt") returned 5 [0053.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.pptx") returned 0 [0053.828] lstrlenA (lpString="*.pptx") returned 6 [0053.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.pdf") returned 0 [0053.828] lstrlenA (lpString="*.pdf") returned 5 [0053.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.mov") returned 0 [0053.828] lstrlenA (lpString="*.mov") returned 5 [0053.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.m2v") returned 0 [0053.828] lstrlenA (lpString="*.m2v") returned 5 [0053.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.3gp") returned 0 [0053.828] lstrlenA (lpString="*.3gp") returned 5 [0053.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.mpeg") returned 0 [0053.829] lstrlenA (lpString="*.mpeg") returned 6 [0053.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.mpg") returned 0 [0053.829] lstrlenA (lpString="*.mpg") returned 5 [0053.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.flv") returned 0 [0053.829] lstrlenA (lpString="*.flv") returned 5 [0053.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.avi") returned 0 [0053.829] lstrlenA (lpString="*.avi") returned 5 [0053.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.mp4") returned 0 [0053.829] lstrlenA (lpString="*.mp4") returned 5 [0053.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.wmv") returned 0 [0053.829] lstrlenA (lpString="*.wmv") returned 5 [0053.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.divx") returned 0 [0053.829] lstrlenA (lpString="*.divx") returned 6 [0053.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.mkv") returned 0 [0053.829] lstrlenA (lpString="*.mkv") returned 5 [0053.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.mp3") returned 0 [0053.829] lstrlenA (lpString="*.mp3") returned 5 [0053.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.wav") returned 0 [0053.829] lstrlenA (lpString="*.wav") returned 5 [0053.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.flac") returned 0 [0053.830] lstrlenA (lpString="*.flac") returned 6 [0053.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.ape") returned 0 [0053.830] lstrlenA (lpString="*.ape") returned 5 [0053.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.wma") returned 0 [0053.830] lstrlenA (lpString="*.wma") returned 5 [0053.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.ac3") returned 0 [0053.830] lstrlenA (lpString="*.ac3") returned 5 [0053.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", pszSpec="*.mxf") returned 0 [0053.830] lstrlenA (lpString="*.mxf") returned 5 [0053.830] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dcbb900, ftCreationTime.dwHighDateTime=0x1bf2c8d, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2dcbb900, ftLastWriteTime.dwHighDateTime=0x1bf2c8d, nFileSizeHigh=0x0, nFileSizeLow=0x19a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0298897.WMF", cAlternateFileName="")) returned 1 [0053.830] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.831] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0298897.WMF") returned -1 [0053.831] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0298897.WMF") returned -1 [0053.831] lstrcmpiA (lpString1="", lpString2="J0298897.WMF") returned -1 [0053.831] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF") returned="J0298653.WMF" [0053.831] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.831] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.831] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.831] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.831] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0298897.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF" [0053.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.zip") returned 0 [0053.831] lstrlenA (lpString="*.zip") returned 5 [0053.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.rar") returned 0 [0053.831] lstrlenA (lpString="*.rar") returned 5 [0053.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.7z") returned 0 [0053.831] lstrlenA (lpString="*.7z") returned 4 [0053.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.tar") returned 0 [0053.831] lstrlenA (lpString="*.tar") returned 5 [0053.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.gzip") returned 0 [0053.832] lstrlenA (lpString="*.gzip") returned 6 [0053.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.jpg") returned 0 [0053.832] lstrlenA (lpString="*.jpg") returned 5 [0053.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.jpeg") returned 0 [0053.832] lstrlenA (lpString="*.jpeg") returned 6 [0053.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.psd") returned 0 [0053.832] lstrlenA (lpString="*.psd") returned 5 [0053.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.gif") returned 0 [0053.832] lstrlenA (lpString="*.gif") returned 5 [0053.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.doc") returned 0 [0053.832] lstrlenA (lpString="*.doc") returned 5 [0053.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.docx") returned 0 [0053.832] lstrlenA (lpString="*.docx") returned 6 [0053.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.xls") returned 0 [0053.832] lstrlenA (lpString="*.xls") returned 5 [0053.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.xlsx") returned 0 [0053.832] lstrlenA (lpString="*.xlsx") returned 6 [0053.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.ppt") returned 0 [0053.832] lstrlenA (lpString="*.ppt") returned 5 [0053.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.pptx") returned 0 [0053.833] lstrlenA (lpString="*.pptx") returned 6 [0053.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.pdf") returned 0 [0053.833] lstrlenA (lpString="*.pdf") returned 5 [0053.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.mov") returned 0 [0053.833] lstrlenA (lpString="*.mov") returned 5 [0053.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.m2v") returned 0 [0053.833] lstrlenA (lpString="*.m2v") returned 5 [0053.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.3gp") returned 0 [0053.833] lstrlenA (lpString="*.3gp") returned 5 [0053.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.mpeg") returned 0 [0053.833] lstrlenA (lpString="*.mpeg") returned 6 [0053.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.mpg") returned 0 [0053.833] lstrlenA (lpString="*.mpg") returned 5 [0053.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.flv") returned 0 [0053.833] lstrlenA (lpString="*.flv") returned 5 [0053.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.avi") returned 0 [0053.833] lstrlenA (lpString="*.avi") returned 5 [0053.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.mp4") returned 0 [0053.833] lstrlenA (lpString="*.mp4") returned 5 [0053.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.wmv") returned 0 [0053.834] lstrlenA (lpString="*.wmv") returned 5 [0053.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.divx") returned 0 [0053.834] lstrlenA (lpString="*.divx") returned 6 [0053.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.mkv") returned 0 [0053.834] lstrlenA (lpString="*.mkv") returned 5 [0053.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.mp3") returned 0 [0053.834] lstrlenA (lpString="*.mp3") returned 5 [0053.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.wav") returned 0 [0053.834] lstrlenA (lpString="*.wav") returned 5 [0053.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.flac") returned 0 [0053.834] lstrlenA (lpString="*.flac") returned 6 [0053.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.ape") returned 0 [0053.834] lstrlenA (lpString="*.ape") returned 5 [0053.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.wma") returned 0 [0053.834] lstrlenA (lpString="*.wma") returned 5 [0053.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.ac3") returned 0 [0053.835] lstrlenA (lpString="*.ac3") returned 5 [0053.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", pszSpec="*.mxf") returned 0 [0053.835] lstrlenA (lpString="*.mxf") returned 5 [0053.835] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15fa3200, ftCreationTime.dwHighDateTime=0x1bf2c99, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x15fa3200, ftLastWriteTime.dwHighDateTime=0x1bf2c99, nFileSizeHigh=0x0, nFileSizeLow=0x163c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299125.WMF", cAlternateFileName="")) returned 1 [0053.835] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.835] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0299125.WMF") returned -1 [0053.835] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0299125.WMF") returned -1 [0053.835] lstrcmpiA (lpString1="", lpString2="J0299125.WMF") returned -1 [0053.835] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF") returned="J0298897.WMF" [0053.835] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.835] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.835] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.835] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.835] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0299125.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF" [0053.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.zip") returned 0 [0053.835] lstrlenA (lpString="*.zip") returned 5 [0053.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.rar") returned 0 [0053.836] lstrlenA (lpString="*.rar") returned 5 [0053.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.7z") returned 0 [0053.836] lstrlenA (lpString="*.7z") returned 4 [0053.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.tar") returned 0 [0053.836] lstrlenA (lpString="*.tar") returned 5 [0053.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.gzip") returned 0 [0053.836] lstrlenA (lpString="*.gzip") returned 6 [0053.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.jpg") returned 0 [0053.836] lstrlenA (lpString="*.jpg") returned 5 [0053.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.jpeg") returned 0 [0053.836] lstrlenA (lpString="*.jpeg") returned 6 [0053.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.psd") returned 0 [0053.836] lstrlenA (lpString="*.psd") returned 5 [0053.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.gif") returned 0 [0053.836] lstrlenA (lpString="*.gif") returned 5 [0053.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.doc") returned 0 [0053.836] lstrlenA (lpString="*.doc") returned 5 [0053.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.docx") returned 0 [0053.837] lstrlenA (lpString="*.docx") returned 6 [0053.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.xls") returned 0 [0053.837] lstrlenA (lpString="*.xls") returned 5 [0053.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.xlsx") returned 0 [0053.837] lstrlenA (lpString="*.xlsx") returned 6 [0053.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.ppt") returned 0 [0053.837] lstrlenA (lpString="*.ppt") returned 5 [0053.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.pptx") returned 0 [0053.837] lstrlenA (lpString="*.pptx") returned 6 [0053.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.pdf") returned 0 [0053.837] lstrlenA (lpString="*.pdf") returned 5 [0053.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.mov") returned 0 [0053.837] lstrlenA (lpString="*.mov") returned 5 [0053.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.m2v") returned 0 [0053.837] lstrlenA (lpString="*.m2v") returned 5 [0053.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.3gp") returned 0 [0053.837] lstrlenA (lpString="*.3gp") returned 5 [0053.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.mpeg") returned 0 [0053.837] lstrlenA (lpString="*.mpeg") returned 6 [0053.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.mpg") returned 0 [0053.838] lstrlenA (lpString="*.mpg") returned 5 [0053.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.flv") returned 0 [0053.838] lstrlenA (lpString="*.flv") returned 5 [0053.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.avi") returned 0 [0053.838] lstrlenA (lpString="*.avi") returned 5 [0053.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.mp4") returned 0 [0053.838] lstrlenA (lpString="*.mp4") returned 5 [0053.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.wmv") returned 0 [0053.838] lstrlenA (lpString="*.wmv") returned 5 [0053.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.divx") returned 0 [0053.838] lstrlenA (lpString="*.divx") returned 6 [0053.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.mkv") returned 0 [0053.838] lstrlenA (lpString="*.mkv") returned 5 [0053.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.mp3") returned 0 [0053.838] lstrlenA (lpString="*.mp3") returned 5 [0053.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.wav") returned 0 [0053.838] lstrlenA (lpString="*.wav") returned 5 [0053.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.flac") returned 0 [0053.838] lstrlenA (lpString="*.flac") returned 6 [0053.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.ape") returned 0 [0053.839] lstrlenA (lpString="*.ape") returned 5 [0053.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.wma") returned 0 [0053.839] lstrlenA (lpString="*.wma") returned 5 [0053.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.ac3") returned 0 [0053.839] lstrlenA (lpString="*.ac3") returned 5 [0053.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", pszSpec="*.mxf") returned 0 [0053.839] lstrlenA (lpString="*.mxf") returned 5 [0053.839] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x375b1e00, ftCreationTime.dwHighDateTime=0x1bf2c99, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x375b1e00, ftLastWriteTime.dwHighDateTime=0x1bf2c99, nFileSizeHigh=0x0, nFileSizeLow=0x23b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299171.WMF", cAlternateFileName="")) returned 1 [0053.839] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.839] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0299171.WMF") returned -1 [0053.839] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0299171.WMF") returned -1 [0053.839] lstrcmpiA (lpString1="", lpString2="J0299171.WMF") returned -1 [0053.839] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF") returned="J0299125.WMF" [0053.839] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.839] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.839] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.839] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.839] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0299171.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF" [0053.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF", pszSpec="*.zip") returned 0 [0053.839] lstrlenA (lpString="*.zip") returned 5 [0053.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF", pszSpec="*.rar") returned 0 [0053.840] lstrlenA (lpString="*.rar") returned 5 [0053.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF", pszSpec="*.7z") returned 0 [0053.840] lstrlenA (lpString="*.7z") returned 4 [0053.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF", pszSpec="*.tar") returned 0 [0053.840] lstrlenA (lpString="*.tar") returned 5 [0053.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF", pszSpec="*.gzip") returned 0 [0053.840] lstrlenA (lpString="*.gzip") returned 6 [0053.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF", pszSpec="*.jpg") returned 0 [0053.840] lstrlenA (lpString="*.jpg") returned 5 [0053.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF", pszSpec="*.jpeg") returned 0 [0053.840] lstrlenA (lpString="*.jpeg") returned 6 [0053.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF", pszSpec="*.psd") returned 0 [0053.840] lstrlenA (lpString="*.psd") returned 5 [0053.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF", pszSpec="*.gif") returned 0 [0053.840] lstrlenA (lpString="*.gif") returned 5 [0053.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF", pszSpec="*.doc") returned 0 [0053.840] lstrlenA (lpString="*.doc") returned 5 [0053.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF", pszSpec="*.docx") returned 0 [0053.840] lstrlenA (lpString="*.docx") returned 6 [0053.841] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa08f6100, ftCreationTime.dwHighDateTime=0x1bf2c9a, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa08f6100, ftLastWriteTime.dwHighDateTime=0x1bf2c9a, nFileSizeHigh=0x0, nFileSizeLow=0x62c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299587.WMF", cAlternateFileName="")) returned 1 [0053.841] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.841] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0299587.WMF") returned -1 [0053.841] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0299587.WMF") returned -1 [0053.841] lstrcmpiA (lpString1="", lpString2="J0299587.WMF") returned -1 [0053.841] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF") returned="J0299171.WMF" [0053.841] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.841] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.841] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.841] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.841] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0299587.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF" [0053.842] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2b9900, ftCreationTime.dwHighDateTime=0x1bf2c9a, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd2b9900, ftLastWriteTime.dwHighDateTime=0x1bf2c9a, nFileSizeHigh=0x0, nFileSizeLow=0x1310, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299611.WMF", cAlternateFileName="")) returned 1 [0053.842] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.842] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0299611.WMF") returned -1 [0053.842] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0299611.WMF") returned -1 [0053.842] lstrcmpiA (lpString1="", lpString2="J0299611.WMF") returned -1 [0053.842] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF") returned="J0299587.WMF" [0053.842] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.842] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.842] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.842] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.842] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0299611.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF" [0053.842] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e1a5400, ftCreationTime.dwHighDateTime=0x1bf2c9b, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5e1a5400, ftLastWriteTime.dwHighDateTime=0x1bf2c9b, nFileSizeHigh=0x0, nFileSizeLow=0x4322, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299763.WMF", cAlternateFileName="")) returned 1 [0053.842] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.842] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0299763.WMF") returned -1 [0053.843] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0299763.WMF") returned -1 [0053.843] lstrcmpiA (lpString1="", lpString2="J0299763.WMF") returned -1 [0053.843] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF") returned="J0299611.WMF" [0053.843] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.843] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.843] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.843] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.843] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0299763.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF" [0053.843] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0508500, ftCreationTime.dwHighDateTime=0x1bf3a1b, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf0508500, ftLastWriteTime.dwHighDateTime=0x1bf3a1b, nFileSizeHigh=0x0, nFileSizeLow=0x3465, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300520.GIF", cAlternateFileName="")) returned 1 [0053.843] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.843] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0300520.GIF") returned -1 [0053.843] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0300520.GIF") returned -1 [0053.843] lstrcmpiA (lpString1="", lpString2="J0300520.GIF") returned -1 [0053.843] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF") returned="J0299763.WMF" [0053.843] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.843] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.844] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.844] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.844] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0300520.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" [0053.844] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" [0053.844] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" [0053.844] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF." [0053.844] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF.wannacry" [0053.844] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0053.861] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3465 [0053.861] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf0508500, dwHighDateTime=0x1bf3a1b), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd68fd60, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf0508500, dwHighDateTime=0x1bf3a1b)) returned 1 [0053.861] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0053.862] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x33e7, lpOverlapped=0x0) returned 1 [0053.864] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF") returned="J0300520.GIF" [0053.864] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0053.864] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x33e7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x33e7, lpOverlapped=0x0) returned 1 [0053.864] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.864] CloseHandle (hObject=0x8c) returned 1 [0053.865] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif.wannacry")) returned 1 [0053.866] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b61300, ftCreationTime.dwHighDateTime=0x1bf452c, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf9b61300, ftLastWriteTime.dwHighDateTime=0x1bf452c, nFileSizeHigh=0x0, nFileSizeLow=0x239c, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="J0300840.WMF", cAlternateFileName="")) returned 1 [0053.866] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.866] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0300840.WMF") returned -1 [0053.866] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0300840.WMF") returned -1 [0053.867] lstrcmpiA (lpString1="", lpString2="J0300840.WMF") returned -1 [0053.867] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF") returned="J0300520.GIF" [0053.867] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.867] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.867] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.867] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.867] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0300840.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF" [0053.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.zip") returned 0 [0053.867] lstrlenA (lpString="*.zip") returned 5 [0053.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.rar") returned 0 [0053.867] lstrlenA (lpString="*.rar") returned 5 [0053.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.7z") returned 0 [0053.867] lstrlenA (lpString="*.7z") returned 4 [0053.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.tar") returned 0 [0053.867] lstrlenA (lpString="*.tar") returned 5 [0053.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.gzip") returned 0 [0053.867] lstrlenA (lpString="*.gzip") returned 6 [0053.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.jpg") returned 0 [0053.867] lstrlenA (lpString="*.jpg") returned 5 [0053.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.jpeg") returned 0 [0053.867] lstrlenA (lpString="*.jpeg") returned 6 [0053.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.psd") returned 0 [0053.867] lstrlenA (lpString="*.psd") returned 5 [0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.gif") returned 0 [0053.868] lstrlenA (lpString="*.gif") returned 5 [0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.doc") returned 0 [0053.868] lstrlenA (lpString="*.doc") returned 5 [0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.docx") returned 0 [0053.868] lstrlenA (lpString="*.docx") returned 6 [0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.xls") returned 0 [0053.868] lstrlenA (lpString="*.xls") returned 5 [0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.xlsx") returned 0 [0053.868] lstrlenA (lpString="*.xlsx") returned 6 [0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.ppt") returned 0 [0053.868] lstrlenA (lpString="*.ppt") returned 5 [0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.pptx") returned 0 [0053.868] lstrlenA (lpString="*.pptx") returned 6 [0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.pdf") returned 0 [0053.868] lstrlenA (lpString="*.pdf") returned 5 [0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.mov") returned 0 [0053.868] lstrlenA (lpString="*.mov") returned 5 [0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.m2v") returned 0 [0053.868] lstrlenA (lpString="*.m2v") returned 5 [0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.3gp") returned 0 [0053.868] lstrlenA (lpString="*.3gp") returned 5 [0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.mpeg") returned 0 [0053.868] lstrlenA (lpString="*.mpeg") returned 6 [0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.mpg") returned 0 [0053.868] lstrlenA (lpString="*.mpg") returned 5 [0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.flv") returned 0 [0053.868] lstrlenA (lpString="*.flv") returned 5 [0053.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.avi") returned 0 [0053.868] lstrlenA (lpString="*.avi") returned 5 [0053.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.mp4") returned 0 [0053.869] lstrlenA (lpString="*.mp4") returned 5 [0053.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.wmv") returned 0 [0053.869] lstrlenA (lpString="*.wmv") returned 5 [0053.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.divx") returned 0 [0053.869] lstrlenA (lpString="*.divx") returned 6 [0053.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.mkv") returned 0 [0053.869] lstrlenA (lpString="*.mkv") returned 5 [0053.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.mp3") returned 0 [0053.869] lstrlenA (lpString="*.mp3") returned 5 [0053.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.wav") returned 0 [0053.869] lstrlenA (lpString="*.wav") returned 5 [0053.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.flac") returned 0 [0053.869] lstrlenA (lpString="*.flac") returned 6 [0053.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.ape") returned 0 [0053.869] lstrlenA (lpString="*.ape") returned 5 [0053.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.wma") returned 0 [0053.869] lstrlenA (lpString="*.wma") returned 5 [0053.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.ac3") returned 0 [0053.869] lstrlenA (lpString="*.ac3") returned 5 [0053.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", pszSpec="*.mxf") returned 0 [0053.869] lstrlenA (lpString="*.mxf") returned 5 [0053.869] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x616c5e00, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x616c5e00, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0xdafc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300912.WMF", cAlternateFileName="")) returned 1 [0053.869] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.869] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0300912.WMF") returned -1 [0053.869] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0300912.WMF") returned -1 [0053.869] lstrcmpiA (lpString1="", lpString2="J0300912.WMF") returned -1 [0053.869] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF") returned="J0300840.WMF" [0053.869] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.870] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.870] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.870] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.870] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0300912.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF" [0053.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.zip") returned 0 [0053.870] lstrlenA (lpString="*.zip") returned 5 [0053.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.rar") returned 0 [0053.870] lstrlenA (lpString="*.rar") returned 5 [0053.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.7z") returned 0 [0053.870] lstrlenA (lpString="*.7z") returned 4 [0053.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.tar") returned 0 [0053.870] lstrlenA (lpString="*.tar") returned 5 [0053.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.gzip") returned 0 [0053.870] lstrlenA (lpString="*.gzip") returned 6 [0053.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.jpg") returned 0 [0053.870] lstrlenA (lpString="*.jpg") returned 5 [0053.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.jpeg") returned 0 [0053.870] lstrlenA (lpString="*.jpeg") returned 6 [0053.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.psd") returned 0 [0053.870] lstrlenA (lpString="*.psd") returned 5 [0053.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.gif") returned 0 [0053.870] lstrlenA (lpString="*.gif") returned 5 [0053.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.doc") returned 0 [0053.871] lstrlenA (lpString="*.doc") returned 5 [0053.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.docx") returned 0 [0053.871] lstrlenA (lpString="*.docx") returned 6 [0053.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.xls") returned 0 [0053.871] lstrlenA (lpString="*.xls") returned 5 [0053.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.xlsx") returned 0 [0053.871] lstrlenA (lpString="*.xlsx") returned 6 [0053.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.ppt") returned 0 [0053.871] lstrlenA (lpString="*.ppt") returned 5 [0053.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.pptx") returned 0 [0053.871] lstrlenA (lpString="*.pptx") returned 6 [0053.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.pdf") returned 0 [0053.871] lstrlenA (lpString="*.pdf") returned 5 [0053.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.mov") returned 0 [0053.871] lstrlenA (lpString="*.mov") returned 5 [0053.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.m2v") returned 0 [0053.871] lstrlenA (lpString="*.m2v") returned 5 [0053.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.3gp") returned 0 [0053.871] lstrlenA (lpString="*.3gp") returned 5 [0053.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.mpeg") returned 0 [0053.871] lstrlenA (lpString="*.mpeg") returned 6 [0053.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.mpg") returned 0 [0053.871] lstrlenA (lpString="*.mpg") returned 5 [0053.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.flv") returned 0 [0053.871] lstrlenA (lpString="*.flv") returned 5 [0053.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.avi") returned 0 [0053.872] lstrlenA (lpString="*.avi") returned 5 [0053.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.mp4") returned 0 [0053.872] lstrlenA (lpString="*.mp4") returned 5 [0053.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.wmv") returned 0 [0053.872] lstrlenA (lpString="*.wmv") returned 5 [0053.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.divx") returned 0 [0053.872] lstrlenA (lpString="*.divx") returned 6 [0053.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.mkv") returned 0 [0053.872] lstrlenA (lpString="*.mkv") returned 5 [0053.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.mp3") returned 0 [0053.872] lstrlenA (lpString="*.mp3") returned 5 [0053.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.wav") returned 0 [0053.872] lstrlenA (lpString="*.wav") returned 5 [0053.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.flac") returned 0 [0053.872] lstrlenA (lpString="*.flac") returned 6 [0053.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.ape") returned 0 [0053.872] lstrlenA (lpString="*.ape") returned 5 [0053.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.wma") returned 0 [0053.872] lstrlenA (lpString="*.wma") returned 5 [0053.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.ac3") returned 0 [0053.872] lstrlenA (lpString="*.ac3") returned 5 [0053.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", pszSpec="*.mxf") returned 0 [0053.872] lstrlenA (lpString="*.mxf") returned 5 [0053.872] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb340b00, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfb340b00, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0x2fd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301050.WMF", cAlternateFileName="")) returned 1 [0053.872] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.873] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0301050.WMF") returned -1 [0053.873] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0301050.WMF") returned -1 [0053.873] lstrcmpiA (lpString1="", lpString2="J0301050.WMF") returned -1 [0053.873] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF") returned="J0300912.WMF" [0053.873] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.873] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.873] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.873] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.873] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0301050.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF" [0053.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.zip") returned 0 [0053.873] lstrlenA (lpString="*.zip") returned 5 [0053.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.rar") returned 0 [0053.873] lstrlenA (lpString="*.rar") returned 5 [0053.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.7z") returned 0 [0053.873] lstrlenA (lpString="*.7z") returned 4 [0053.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.tar") returned 0 [0053.873] lstrlenA (lpString="*.tar") returned 5 [0053.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.gzip") returned 0 [0053.873] lstrlenA (lpString="*.gzip") returned 6 [0053.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.jpg") returned 0 [0053.873] lstrlenA (lpString="*.jpg") returned 5 [0053.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.jpeg") returned 0 [0053.873] lstrlenA (lpString="*.jpeg") returned 6 [0053.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.psd") returned 0 [0053.874] lstrlenA (lpString="*.psd") returned 5 [0053.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.gif") returned 0 [0053.874] lstrlenA (lpString="*.gif") returned 5 [0053.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.doc") returned 0 [0053.874] lstrlenA (lpString="*.doc") returned 5 [0053.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.docx") returned 0 [0053.874] lstrlenA (lpString="*.docx") returned 6 [0053.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.xls") returned 0 [0053.874] lstrlenA (lpString="*.xls") returned 5 [0053.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.xlsx") returned 0 [0053.874] lstrlenA (lpString="*.xlsx") returned 6 [0053.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.ppt") returned 0 [0053.874] lstrlenA (lpString="*.ppt") returned 5 [0053.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.pptx") returned 0 [0053.874] lstrlenA (lpString="*.pptx") returned 6 [0053.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.pdf") returned 0 [0053.874] lstrlenA (lpString="*.pdf") returned 5 [0053.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.mov") returned 0 [0053.874] lstrlenA (lpString="*.mov") returned 5 [0053.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.m2v") returned 0 [0053.874] lstrlenA (lpString="*.m2v") returned 5 [0053.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.3gp") returned 0 [0053.874] lstrlenA (lpString="*.3gp") returned 5 [0053.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.mpeg") returned 0 [0053.874] lstrlenA (lpString="*.mpeg") returned 6 [0053.874] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.mpg") returned 0 [0053.875] lstrlenA (lpString="*.mpg") returned 5 [0053.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.flv") returned 0 [0053.875] lstrlenA (lpString="*.flv") returned 5 [0053.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.avi") returned 0 [0053.875] lstrlenA (lpString="*.avi") returned 5 [0053.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.mp4") returned 0 [0053.875] lstrlenA (lpString="*.mp4") returned 5 [0053.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.wmv") returned 0 [0053.875] lstrlenA (lpString="*.wmv") returned 5 [0053.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.divx") returned 0 [0053.875] lstrlenA (lpString="*.divx") returned 6 [0053.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.mkv") returned 0 [0053.875] lstrlenA (lpString="*.mkv") returned 5 [0053.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.mp3") returned 0 [0053.875] lstrlenA (lpString="*.mp3") returned 5 [0053.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.wav") returned 0 [0053.875] lstrlenA (lpString="*.wav") returned 5 [0053.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.flac") returned 0 [0053.875] lstrlenA (lpString="*.flac") returned 6 [0053.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.ape") returned 0 [0053.875] lstrlenA (lpString="*.ape") returned 5 [0053.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.wma") returned 0 [0053.875] lstrlenA (lpString="*.wma") returned 5 [0053.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.ac3") returned 0 [0053.875] lstrlenA (lpString="*.ac3") returned 5 [0053.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", pszSpec="*.mxf") returned 0 [0053.875] lstrlenA (lpString="*.mxf") returned 5 [0053.876] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf780800, ftCreationTime.dwHighDateTime=0x1bf452e, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf780800, ftLastWriteTime.dwHighDateTime=0x1bf452e, nFileSizeHigh=0x0, nFileSizeLow=0x224e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301076.WMF", cAlternateFileName="")) returned 1 [0053.876] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.876] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0301076.WMF") returned -1 [0053.876] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0301076.WMF") returned -1 [0053.876] lstrcmpiA (lpString1="", lpString2="J0301076.WMF") returned -1 [0053.876] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF") returned="J0301050.WMF" [0053.876] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.876] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.876] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.876] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.876] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0301076.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF" [0053.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.zip") returned 0 [0053.876] lstrlenA (lpString="*.zip") returned 5 [0053.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.rar") returned 0 [0053.876] lstrlenA (lpString="*.rar") returned 5 [0053.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.7z") returned 0 [0053.876] lstrlenA (lpString="*.7z") returned 4 [0053.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.tar") returned 0 [0053.876] lstrlenA (lpString="*.tar") returned 5 [0053.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.gzip") returned 0 [0053.876] lstrlenA (lpString="*.gzip") returned 6 [0053.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.jpg") returned 0 [0053.876] lstrlenA (lpString="*.jpg") returned 5 [0053.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.jpeg") returned 0 [0053.877] lstrlenA (lpString="*.jpeg") returned 6 [0053.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.psd") returned 0 [0053.877] lstrlenA (lpString="*.psd") returned 5 [0053.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.gif") returned 0 [0053.877] lstrlenA (lpString="*.gif") returned 5 [0053.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.doc") returned 0 [0053.877] lstrlenA (lpString="*.doc") returned 5 [0053.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.docx") returned 0 [0053.877] lstrlenA (lpString="*.docx") returned 6 [0053.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.xls") returned 0 [0053.877] lstrlenA (lpString="*.xls") returned 5 [0053.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.xlsx") returned 0 [0053.877] lstrlenA (lpString="*.xlsx") returned 6 [0053.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.ppt") returned 0 [0053.877] lstrlenA (lpString="*.ppt") returned 5 [0053.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.pptx") returned 0 [0053.877] lstrlenA (lpString="*.pptx") returned 6 [0053.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.pdf") returned 0 [0053.877] lstrlenA (lpString="*.pdf") returned 5 [0053.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.mov") returned 0 [0053.877] lstrlenA (lpString="*.mov") returned 5 [0053.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.m2v") returned 0 [0053.877] lstrlenA (lpString="*.m2v") returned 5 [0053.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.3gp") returned 0 [0053.877] lstrlenA (lpString="*.3gp") returned 5 [0053.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.mpeg") returned 0 [0053.878] lstrlenA (lpString="*.mpeg") returned 6 [0053.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.mpg") returned 0 [0053.878] lstrlenA (lpString="*.mpg") returned 5 [0053.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.flv") returned 0 [0053.878] lstrlenA (lpString="*.flv") returned 5 [0053.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.avi") returned 0 [0053.878] lstrlenA (lpString="*.avi") returned 5 [0053.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.mp4") returned 0 [0053.878] lstrlenA (lpString="*.mp4") returned 5 [0053.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.wmv") returned 0 [0053.878] lstrlenA (lpString="*.wmv") returned 5 [0053.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.divx") returned 0 [0053.878] lstrlenA (lpString="*.divx") returned 6 [0053.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.mkv") returned 0 [0053.878] lstrlenA (lpString="*.mkv") returned 5 [0053.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.mp3") returned 0 [0053.878] lstrlenA (lpString="*.mp3") returned 5 [0053.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.wav") returned 0 [0053.878] lstrlenA (lpString="*.wav") returned 5 [0053.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.flac") returned 0 [0053.878] lstrlenA (lpString="*.flac") returned 6 [0053.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.ape") returned 0 [0053.878] lstrlenA (lpString="*.ape") returned 5 [0053.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.wma") returned 0 [0053.878] lstrlenA (lpString="*.wma") returned 5 [0053.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.ac3") returned 0 [0053.879] lstrlenA (lpString="*.ac3") returned 5 [0053.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", pszSpec="*.mxf") returned 0 [0053.879] lstrlenA (lpString="*.mxf") returned 5 [0053.879] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf91e7c00, ftCreationTime.dwHighDateTime=0x1bf452e, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf91e7c00, ftLastWriteTime.dwHighDateTime=0x1bf452e, nFileSizeHigh=0x0, nFileSizeLow=0x953a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301252.WMF", cAlternateFileName="")) returned 1 [0053.879] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.879] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0301252.WMF") returned -1 [0053.879] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0301252.WMF") returned -1 [0053.879] lstrcmpiA (lpString1="", lpString2="J0301252.WMF") returned -1 [0053.879] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF") returned="J0301076.WMF" [0053.879] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.879] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.879] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.879] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.879] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0301252.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF" [0053.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.zip") returned 0 [0053.879] lstrlenA (lpString="*.zip") returned 5 [0053.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.rar") returned 0 [0053.879] lstrlenA (lpString="*.rar") returned 5 [0053.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.7z") returned 0 [0053.879] lstrlenA (lpString="*.7z") returned 4 [0053.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.tar") returned 0 [0053.879] lstrlenA (lpString="*.tar") returned 5 [0053.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.gzip") returned 0 [0053.879] lstrlenA (lpString="*.gzip") returned 6 [0053.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.jpg") returned 0 [0053.880] lstrlenA (lpString="*.jpg") returned 5 [0053.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.jpeg") returned 0 [0053.880] lstrlenA (lpString="*.jpeg") returned 6 [0053.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.psd") returned 0 [0053.880] lstrlenA (lpString="*.psd") returned 5 [0053.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.gif") returned 0 [0053.880] lstrlenA (lpString="*.gif") returned 5 [0053.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.doc") returned 0 [0053.880] lstrlenA (lpString="*.doc") returned 5 [0053.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.docx") returned 0 [0053.880] lstrlenA (lpString="*.docx") returned 6 [0053.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.xls") returned 0 [0053.880] lstrlenA (lpString="*.xls") returned 5 [0053.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.xlsx") returned 0 [0053.880] lstrlenA (lpString="*.xlsx") returned 6 [0053.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.ppt") returned 0 [0053.880] lstrlenA (lpString="*.ppt") returned 5 [0053.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.pptx") returned 0 [0053.880] lstrlenA (lpString="*.pptx") returned 6 [0053.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.pdf") returned 0 [0053.880] lstrlenA (lpString="*.pdf") returned 5 [0053.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.mov") returned 0 [0053.880] lstrlenA (lpString="*.mov") returned 5 [0053.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.m2v") returned 0 [0053.880] lstrlenA (lpString="*.m2v") returned 5 [0053.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.3gp") returned 0 [0053.881] lstrlenA (lpString="*.3gp") returned 5 [0053.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.mpeg") returned 0 [0053.881] lstrlenA (lpString="*.mpeg") returned 6 [0053.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.mpg") returned 0 [0053.881] lstrlenA (lpString="*.mpg") returned 5 [0053.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.flv") returned 0 [0053.881] lstrlenA (lpString="*.flv") returned 5 [0053.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.avi") returned 0 [0053.881] lstrlenA (lpString="*.avi") returned 5 [0053.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.mp4") returned 0 [0053.881] lstrlenA (lpString="*.mp4") returned 5 [0053.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.wmv") returned 0 [0053.881] lstrlenA (lpString="*.wmv") returned 5 [0053.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.divx") returned 0 [0053.881] lstrlenA (lpString="*.divx") returned 6 [0053.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.mkv") returned 0 [0053.881] lstrlenA (lpString="*.mkv") returned 5 [0053.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.mp3") returned 0 [0053.881] lstrlenA (lpString="*.mp3") returned 5 [0053.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.wav") returned 0 [0053.881] lstrlenA (lpString="*.wav") returned 5 [0053.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.flac") returned 0 [0053.881] lstrlenA (lpString="*.flac") returned 6 [0053.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.ape") returned 0 [0053.881] lstrlenA (lpString="*.ape") returned 5 [0053.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.wma") returned 0 [0053.881] lstrlenA (lpString="*.wma") returned 5 [0053.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.ac3") returned 0 [0053.882] lstrlenA (lpString="*.ac3") returned 5 [0053.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", pszSpec="*.mxf") returned 0 [0053.882] lstrlenA (lpString="*.mxf") returned 5 [0053.882] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5570900, ftCreationTime.dwHighDateTime=0x1bf4530, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5570900, ftLastWriteTime.dwHighDateTime=0x1bf4530, nFileSizeHigh=0x0, nFileSizeLow=0x1f40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301480.WMF", cAlternateFileName="")) returned 1 [0053.882] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.882] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0301480.WMF") returned -1 [0053.882] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0301480.WMF") returned -1 [0053.882] lstrcmpiA (lpString1="", lpString2="J0301480.WMF") returned -1 [0053.882] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF") returned="J0301252.WMF" [0053.882] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.882] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.882] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.882] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.882] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0301480.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF" [0053.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.zip") returned 0 [0053.882] lstrlenA (lpString="*.zip") returned 5 [0053.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.rar") returned 0 [0053.882] lstrlenA (lpString="*.rar") returned 5 [0053.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.7z") returned 0 [0053.882] lstrlenA (lpString="*.7z") returned 4 [0053.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.tar") returned 0 [0053.882] lstrlenA (lpString="*.tar") returned 5 [0053.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.gzip") returned 0 [0053.883] lstrlenA (lpString="*.gzip") returned 6 [0053.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.jpg") returned 0 [0053.883] lstrlenA (lpString="*.jpg") returned 5 [0053.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.jpeg") returned 0 [0053.883] lstrlenA (lpString="*.jpeg") returned 6 [0053.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.psd") returned 0 [0053.883] lstrlenA (lpString="*.psd") returned 5 [0053.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.gif") returned 0 [0053.883] lstrlenA (lpString="*.gif") returned 5 [0053.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.doc") returned 0 [0053.883] lstrlenA (lpString="*.doc") returned 5 [0053.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.docx") returned 0 [0053.883] lstrlenA (lpString="*.docx") returned 6 [0053.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.xls") returned 0 [0053.883] lstrlenA (lpString="*.xls") returned 5 [0053.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.xlsx") returned 0 [0053.883] lstrlenA (lpString="*.xlsx") returned 6 [0053.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.ppt") returned 0 [0053.883] lstrlenA (lpString="*.ppt") returned 5 [0053.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.pptx") returned 0 [0053.883] lstrlenA (lpString="*.pptx") returned 6 [0053.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.pdf") returned 0 [0053.883] lstrlenA (lpString="*.pdf") returned 5 [0053.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.mov") returned 0 [0053.883] lstrlenA (lpString="*.mov") returned 5 [0053.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.m2v") returned 0 [0053.884] lstrlenA (lpString="*.m2v") returned 5 [0053.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.3gp") returned 0 [0053.884] lstrlenA (lpString="*.3gp") returned 5 [0053.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.mpeg") returned 0 [0053.884] lstrlenA (lpString="*.mpeg") returned 6 [0053.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.mpg") returned 0 [0053.884] lstrlenA (lpString="*.mpg") returned 5 [0053.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.flv") returned 0 [0053.884] lstrlenA (lpString="*.flv") returned 5 [0053.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.avi") returned 0 [0053.884] lstrlenA (lpString="*.avi") returned 5 [0053.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.mp4") returned 0 [0053.884] lstrlenA (lpString="*.mp4") returned 5 [0053.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.wmv") returned 0 [0053.884] lstrlenA (lpString="*.wmv") returned 5 [0053.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.divx") returned 0 [0053.884] lstrlenA (lpString="*.divx") returned 6 [0053.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.mkv") returned 0 [0053.884] lstrlenA (lpString="*.mkv") returned 5 [0053.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.mp3") returned 0 [0053.884] lstrlenA (lpString="*.mp3") returned 5 [0053.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.wav") returned 0 [0053.884] lstrlenA (lpString="*.wav") returned 5 [0053.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.flac") returned 0 [0053.884] lstrlenA (lpString="*.flac") returned 6 [0053.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.ape") returned 0 [0053.885] lstrlenA (lpString="*.ape") returned 5 [0053.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.wma") returned 0 [0053.885] lstrlenA (lpString="*.wma") returned 5 [0053.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.ac3") returned 0 [0053.885] lstrlenA (lpString="*.ac3") returned 5 [0053.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", pszSpec="*.mxf") returned 0 [0053.885] lstrlenA (lpString="*.mxf") returned 5 [0053.885] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xced53d00, ftCreationTime.dwHighDateTime=0x1bf4a9f, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xced53d00, ftLastWriteTime.dwHighDateTime=0x1bf4a9f, nFileSizeHigh=0x0, nFileSizeLow=0x5a2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0302827.JPG", cAlternateFileName="")) returned 1 [0053.885] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.885] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0302827.JPG") returned -1 [0053.885] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0302827.JPG") returned -1 [0053.885] lstrcmpiA (lpString1="", lpString2="J0302827.JPG") returned -1 [0053.885] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF") returned="J0301480.WMF" [0053.885] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.885] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.885] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.885] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.885] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0302827.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" [0053.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG", pszSpec="*.zip") returned 0 [0053.885] lstrlenA (lpString="*.zip") returned 5 [0053.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG", pszSpec="*.rar") returned 0 [0053.886] lstrlenA (lpString="*.rar") returned 5 [0053.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG", pszSpec="*.7z") returned 0 [0053.886] lstrlenA (lpString="*.7z") returned 4 [0053.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG", pszSpec="*.tar") returned 0 [0053.886] lstrlenA (lpString="*.tar") returned 5 [0053.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG", pszSpec="*.gzip") returned 0 [0053.886] lstrlenA (lpString="*.gzip") returned 6 [0053.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG", pszSpec="*.jpg") returned 1 [0053.886] lstrlenA (lpString="*.jpg") returned 5 [0053.886] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" [0053.886] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" [0053.886] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG." [0053.886] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.wannacry" [0053.886] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0053.887] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5a2b [0053.887] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xced53d00, dwHighDateTime=0x1bf4a9f), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd6b5ec0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xced53d00, dwHighDateTime=0x1bf4a9f)) returned 1 [0053.888] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0053.888] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x59ad, lpOverlapped=0x0) returned 1 [0053.890] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG") returned="J0302827.JPG" [0053.890] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0053.890] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x59ad, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x59ad, lpOverlapped=0x0) returned 1 [0053.890] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.890] CloseHandle (hObject=0x8c) returned 1 [0053.896] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg.wannacry")) returned 1 [0053.897] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33a69b00, ftCreationTime.dwHighDateTime=0x1bf4b65, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x33a69b00, ftLastWriteTime.dwHighDateTime=0x1bf4b65, nFileSizeHigh=0x0, nFileSizeLow=0x25c1, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="J0302953.JPG", cAlternateFileName="")) returned 1 [0053.897] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.897] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0302953.JPG") returned -1 [0053.897] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0302953.JPG") returned -1 [0053.897] lstrcmpiA (lpString1="", lpString2="J0302953.JPG") returned -1 [0053.897] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG") returned="J0302827.JPG" [0053.897] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.897] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.897] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.897] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.897] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0302953.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" [0053.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG", pszSpec="*.zip") returned 0 [0053.897] lstrlenA (lpString="*.zip") returned 5 [0053.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG", pszSpec="*.rar") returned 0 [0053.897] lstrlenA (lpString="*.rar") returned 5 [0053.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG", pszSpec="*.7z") returned 0 [0053.897] lstrlenA (lpString="*.7z") returned 4 [0053.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG", pszSpec="*.tar") returned 0 [0053.898] lstrlenA (lpString="*.tar") returned 5 [0053.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG", pszSpec="*.gzip") returned 0 [0053.898] lstrlenA (lpString="*.gzip") returned 6 [0053.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG", pszSpec="*.jpg") returned 1 [0053.898] lstrlenA (lpString="*.jpg") returned 5 [0053.898] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" [0053.898] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" [0053.898] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG." [0053.898] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.wannacry" [0053.898] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0053.898] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25c1 [0053.898] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x33a69b00, dwHighDateTime=0x1bf4b65), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd6b5ec0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x33a69b00, dwHighDateTime=0x1bf4b65)) returned 1 [0053.899] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0053.899] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2543, lpOverlapped=0x0) returned 1 [0053.901] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG") returned="J0302953.JPG" [0053.901] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0053.901] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2543, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2543, lpOverlapped=0x0) returned 1 [0053.901] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.901] CloseHandle (hObject=0x8c) returned 1 [0053.902] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg.wannacry")) returned 1 [0053.903] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa04dd00, ftCreationTime.dwHighDateTime=0x1bf4531, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfa04dd00, ftLastWriteTime.dwHighDateTime=0x1bf4531, nFileSizeHigh=0x0, nFileSizeLow=0x4d84, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="J0304933.WMF", cAlternateFileName="")) returned 1 [0053.903] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.903] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0304933.WMF") returned -1 [0053.903] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0304933.WMF") returned -1 [0053.903] lstrcmpiA (lpString1="", lpString2="J0304933.WMF") returned -1 [0053.903] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG") returned="J0302953.JPG" [0053.903] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.904] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.904] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.904] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.904] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0304933.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF" [0053.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.zip") returned 0 [0053.904] lstrlenA (lpString="*.zip") returned 5 [0053.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.rar") returned 0 [0053.904] lstrlenA (lpString="*.rar") returned 5 [0053.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.7z") returned 0 [0053.904] lstrlenA (lpString="*.7z") returned 4 [0053.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.tar") returned 0 [0053.904] lstrlenA (lpString="*.tar") returned 5 [0053.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.gzip") returned 0 [0053.904] lstrlenA (lpString="*.gzip") returned 6 [0053.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.jpg") returned 0 [0053.904] lstrlenA (lpString="*.jpg") returned 5 [0053.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.jpeg") returned 0 [0053.904] lstrlenA (lpString="*.jpeg") returned 6 [0053.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.psd") returned 0 [0053.904] lstrlenA (lpString="*.psd") returned 5 [0053.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.gif") returned 0 [0053.904] lstrlenA (lpString="*.gif") returned 5 [0053.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.doc") returned 0 [0053.905] lstrlenA (lpString="*.doc") returned 5 [0053.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.docx") returned 0 [0053.905] lstrlenA (lpString="*.docx") returned 6 [0053.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.xls") returned 0 [0053.905] lstrlenA (lpString="*.xls") returned 5 [0053.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.xlsx") returned 0 [0053.905] lstrlenA (lpString="*.xlsx") returned 6 [0053.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.ppt") returned 0 [0053.905] lstrlenA (lpString="*.ppt") returned 5 [0053.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.pptx") returned 0 [0053.905] lstrlenA (lpString="*.pptx") returned 6 [0053.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.pdf") returned 0 [0053.905] lstrlenA (lpString="*.pdf") returned 5 [0053.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.mov") returned 0 [0053.905] lstrlenA (lpString="*.mov") returned 5 [0053.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.m2v") returned 0 [0053.905] lstrlenA (lpString="*.m2v") returned 5 [0053.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.3gp") returned 0 [0053.905] lstrlenA (lpString="*.3gp") returned 5 [0053.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.mpeg") returned 0 [0053.905] lstrlenA (lpString="*.mpeg") returned 6 [0053.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.mpg") returned 0 [0053.905] lstrlenA (lpString="*.mpg") returned 5 [0053.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.flv") returned 0 [0053.905] lstrlenA (lpString="*.flv") returned 5 [0053.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.avi") returned 0 [0053.905] lstrlenA (lpString="*.avi") returned 5 [0053.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.mp4") returned 0 [0053.906] lstrlenA (lpString="*.mp4") returned 5 [0053.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.wmv") returned 0 [0053.906] lstrlenA (lpString="*.wmv") returned 5 [0053.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.divx") returned 0 [0053.906] lstrlenA (lpString="*.divx") returned 6 [0053.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.mkv") returned 0 [0053.906] lstrlenA (lpString="*.mkv") returned 5 [0053.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.mp3") returned 0 [0053.906] lstrlenA (lpString="*.mp3") returned 5 [0053.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.wav") returned 0 [0053.906] lstrlenA (lpString="*.wav") returned 5 [0053.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.flac") returned 0 [0053.906] lstrlenA (lpString="*.flac") returned 6 [0053.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.ape") returned 0 [0053.906] lstrlenA (lpString="*.ape") returned 5 [0053.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.wma") returned 0 [0053.906] lstrlenA (lpString="*.wma") returned 5 [0053.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.ac3") returned 0 [0053.906] lstrlenA (lpString="*.ac3") returned 5 [0053.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", pszSpec="*.mxf") returned 0 [0053.906] lstrlenA (lpString="*.mxf") returned 5 [0053.906] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ab12600, ftCreationTime.dwHighDateTime=0x1bf4533, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3ab12600, ftLastWriteTime.dwHighDateTime=0x1bf4533, nFileSizeHigh=0x0, nFileSizeLow=0x5af0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0305257.WMF", cAlternateFileName="")) returned 1 [0053.906] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.906] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0305257.WMF") returned -1 [0053.907] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0305257.WMF") returned -1 [0053.907] lstrcmpiA (lpString1="", lpString2="J0305257.WMF") returned -1 [0053.907] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF") returned="J0304933.WMF" [0053.907] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.907] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.907] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.907] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.907] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0305257.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF" [0053.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.zip") returned 0 [0053.907] lstrlenA (lpString="*.zip") returned 5 [0053.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.rar") returned 0 [0053.907] lstrlenA (lpString="*.rar") returned 5 [0053.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.7z") returned 0 [0053.908] lstrlenA (lpString="*.7z") returned 4 [0053.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.tar") returned 0 [0053.908] lstrlenA (lpString="*.tar") returned 5 [0053.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.gzip") returned 0 [0053.908] lstrlenA (lpString="*.gzip") returned 6 [0053.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.jpg") returned 0 [0053.908] lstrlenA (lpString="*.jpg") returned 5 [0053.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.jpeg") returned 0 [0053.908] lstrlenA (lpString="*.jpeg") returned 6 [0053.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.psd") returned 0 [0053.908] lstrlenA (lpString="*.psd") returned 5 [0053.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.gif") returned 0 [0053.908] lstrlenA (lpString="*.gif") returned 5 [0053.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.doc") returned 0 [0053.908] lstrlenA (lpString="*.doc") returned 5 [0053.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.docx") returned 0 [0053.908] lstrlenA (lpString="*.docx") returned 6 [0053.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.xls") returned 0 [0053.909] lstrlenA (lpString="*.xls") returned 5 [0053.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.xlsx") returned 0 [0053.909] lstrlenA (lpString="*.xlsx") returned 6 [0053.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.ppt") returned 0 [0053.909] lstrlenA (lpString="*.ppt") returned 5 [0053.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.pptx") returned 0 [0053.909] lstrlenA (lpString="*.pptx") returned 6 [0053.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.pdf") returned 0 [0053.909] lstrlenA (lpString="*.pdf") returned 5 [0053.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.mov") returned 0 [0053.909] lstrlenA (lpString="*.mov") returned 5 [0053.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.m2v") returned 0 [0053.909] lstrlenA (lpString="*.m2v") returned 5 [0053.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.3gp") returned 0 [0053.909] lstrlenA (lpString="*.3gp") returned 5 [0053.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.mpeg") returned 0 [0053.909] lstrlenA (lpString="*.mpeg") returned 6 [0053.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.mpg") returned 0 [0053.909] lstrlenA (lpString="*.mpg") returned 5 [0053.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.flv") returned 0 [0053.909] lstrlenA (lpString="*.flv") returned 5 [0053.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.avi") returned 0 [0053.909] lstrlenA (lpString="*.avi") returned 5 [0053.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.mp4") returned 0 [0053.909] lstrlenA (lpString="*.mp4") returned 5 [0053.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.wmv") returned 0 [0053.910] lstrlenA (lpString="*.wmv") returned 5 [0053.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.divx") returned 0 [0053.910] lstrlenA (lpString="*.divx") returned 6 [0053.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.mkv") returned 0 [0053.910] lstrlenA (lpString="*.mkv") returned 5 [0053.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.mp3") returned 0 [0053.910] lstrlenA (lpString="*.mp3") returned 5 [0053.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.wav") returned 0 [0053.910] lstrlenA (lpString="*.wav") returned 5 [0053.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.flac") returned 0 [0053.910] lstrlenA (lpString="*.flac") returned 6 [0053.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.ape") returned 0 [0053.910] lstrlenA (lpString="*.ape") returned 5 [0053.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.wma") returned 0 [0053.910] lstrlenA (lpString="*.wma") returned 5 [0053.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.ac3") returned 0 [0053.910] lstrlenA (lpString="*.ac3") returned 5 [0053.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", pszSpec="*.mxf") returned 0 [0053.910] lstrlenA (lpString="*.mxf") returned 5 [0053.910] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x494c0d00, ftCreationTime.dwHighDateTime=0x1bf4534, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x494c0d00, ftLastWriteTime.dwHighDateTime=0x1bf4534, nFileSizeHigh=0x0, nFileSizeLow=0x3372, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0305493.WMF", cAlternateFileName="")) returned 1 [0053.910] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.910] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0305493.WMF") returned -1 [0053.910] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0305493.WMF") returned -1 [0053.910] lstrcmpiA (lpString1="", lpString2="J0305493.WMF") returned -1 [0053.910] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF") returned="J0305257.WMF" [0053.911] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.911] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.911] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.911] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.911] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0305493.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF" [0053.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.zip") returned 0 [0053.911] lstrlenA (lpString="*.zip") returned 5 [0053.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.rar") returned 0 [0053.911] lstrlenA (lpString="*.rar") returned 5 [0053.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.7z") returned 0 [0053.911] lstrlenA (lpString="*.7z") returned 4 [0053.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.tar") returned 0 [0053.911] lstrlenA (lpString="*.tar") returned 5 [0053.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.gzip") returned 0 [0053.911] lstrlenA (lpString="*.gzip") returned 6 [0053.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.jpg") returned 0 [0053.911] lstrlenA (lpString="*.jpg") returned 5 [0053.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.jpeg") returned 0 [0053.911] lstrlenA (lpString="*.jpeg") returned 6 [0053.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.psd") returned 0 [0053.911] lstrlenA (lpString="*.psd") returned 5 [0053.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.gif") returned 0 [0053.911] lstrlenA (lpString="*.gif") returned 5 [0053.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.doc") returned 0 [0053.912] lstrlenA (lpString="*.doc") returned 5 [0053.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.docx") returned 0 [0053.912] lstrlenA (lpString="*.docx") returned 6 [0053.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.xls") returned 0 [0053.912] lstrlenA (lpString="*.xls") returned 5 [0053.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.xlsx") returned 0 [0053.912] lstrlenA (lpString="*.xlsx") returned 6 [0053.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.ppt") returned 0 [0053.912] lstrlenA (lpString="*.ppt") returned 5 [0053.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.pptx") returned 0 [0053.912] lstrlenA (lpString="*.pptx") returned 6 [0053.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.pdf") returned 0 [0053.912] lstrlenA (lpString="*.pdf") returned 5 [0053.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.mov") returned 0 [0053.912] lstrlenA (lpString="*.mov") returned 5 [0053.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.m2v") returned 0 [0053.912] lstrlenA (lpString="*.m2v") returned 5 [0053.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.3gp") returned 0 [0053.912] lstrlenA (lpString="*.3gp") returned 5 [0053.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.mpeg") returned 0 [0053.912] lstrlenA (lpString="*.mpeg") returned 6 [0053.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.mpg") returned 0 [0053.912] lstrlenA (lpString="*.mpg") returned 5 [0053.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.flv") returned 0 [0053.912] lstrlenA (lpString="*.flv") returned 5 [0053.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.avi") returned 0 [0053.913] lstrlenA (lpString="*.avi") returned 5 [0053.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.mp4") returned 0 [0053.913] lstrlenA (lpString="*.mp4") returned 5 [0053.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.wmv") returned 0 [0053.913] lstrlenA (lpString="*.wmv") returned 5 [0053.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.divx") returned 0 [0053.913] lstrlenA (lpString="*.divx") returned 6 [0053.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.mkv") returned 0 [0053.913] lstrlenA (lpString="*.mkv") returned 5 [0053.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.mp3") returned 0 [0053.913] lstrlenA (lpString="*.mp3") returned 5 [0053.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.wav") returned 0 [0053.913] lstrlenA (lpString="*.wav") returned 5 [0053.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.flac") returned 0 [0053.913] lstrlenA (lpString="*.flac") returned 6 [0053.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.ape") returned 0 [0053.913] lstrlenA (lpString="*.ape") returned 5 [0053.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.wma") returned 0 [0053.913] lstrlenA (lpString="*.wma") returned 5 [0053.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.ac3") returned 0 [0053.913] lstrlenA (lpString="*.ac3") returned 5 [0053.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", pszSpec="*.mxf") returned 0 [0053.913] lstrlenA (lpString="*.mxf") returned 5 [0053.913] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8598100, ftCreationTime.dwHighDateTime=0x1bf71c6, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb8598100, ftLastWriteTime.dwHighDateTime=0x1bf71c6, nFileSizeHigh=0x0, nFileSizeLow=0x60e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0315447.JPG", cAlternateFileName="")) returned 1 [0053.913] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.914] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0315447.JPG") returned -1 [0053.914] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0315447.JPG") returned -1 [0053.914] lstrcmpiA (lpString1="", lpString2="J0315447.JPG") returned -1 [0053.914] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF") returned="J0305493.WMF" [0053.914] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.914] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.914] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.914] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.914] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG", pszSpec="*.zip") returned 0 [0053.914] lstrlenA (lpString="*.zip") returned 5 [0053.914] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG", pszSpec="*.rar") returned 0 [0053.914] lstrlenA (lpString="*.rar") returned 5 [0053.914] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG", pszSpec="*.7z") returned 0 [0053.914] lstrlenA (lpString="*.7z") returned 4 [0053.914] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG", pszSpec="*.tar") returned 0 [0053.914] lstrlenA (lpString="*.tar") returned 5 [0053.914] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG", pszSpec="*.gzip") returned 0 [0053.914] lstrlenA (lpString="*.gzip") returned 6 [0053.914] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG", pszSpec="*.jpg") returned 1 [0053.914] lstrlenA (lpString="*.jpg") returned 5 [0053.914] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" [0053.915] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" [0053.915] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0053.916] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x60e4 [0053.916] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb8598100, dwHighDateTime=0x1bf71c6), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd6dc020, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb8598100, dwHighDateTime=0x1bf71c6)) returned 1 [0053.916] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0053.916] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x6066, lpOverlapped=0x0) returned 1 [0053.919] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG") returned="J0315447.JPG" [0053.919] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0053.919] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x6066, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x6066, lpOverlapped=0x0) returned 1 [0053.919] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0053.919] CloseHandle (hObject=0x8c) returned 1 [0053.921] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg.wannacry")) returned 1 [0053.922] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x653ad300, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x653ad300, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x5168, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="J0332268.WMF", cAlternateFileName="")) returned 1 [0053.922] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.922] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0332268.WMF") returned -1 [0053.922] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0332268.WMF") returned -1 [0053.922] lstrcmpiA (lpString1="", lpString2="J0332268.WMF") returned -1 [0053.922] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG") returned="J0315447.JPG" [0053.922] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.922] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.922] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.922] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.922] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0332268.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF" [0053.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.zip") returned 0 [0053.922] lstrlenA (lpString="*.zip") returned 5 [0053.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.rar") returned 0 [0053.922] lstrlenA (lpString="*.rar") returned 5 [0053.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.7z") returned 0 [0053.922] lstrlenA (lpString="*.7z") returned 4 [0053.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.tar") returned 0 [0053.922] lstrlenA (lpString="*.tar") returned 5 [0053.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.gzip") returned 0 [0053.923] lstrlenA (lpString="*.gzip") returned 6 [0053.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.jpg") returned 0 [0053.923] lstrlenA (lpString="*.jpg") returned 5 [0053.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.jpeg") returned 0 [0053.923] lstrlenA (lpString="*.jpeg") returned 6 [0053.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.psd") returned 0 [0053.923] lstrlenA (lpString="*.psd") returned 5 [0053.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.gif") returned 0 [0053.923] lstrlenA (lpString="*.gif") returned 5 [0053.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.doc") returned 0 [0053.923] lstrlenA (lpString="*.doc") returned 5 [0053.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.docx") returned 0 [0053.923] lstrlenA (lpString="*.docx") returned 6 [0053.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.xls") returned 0 [0053.923] lstrlenA (lpString="*.xls") returned 5 [0053.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.xlsx") returned 0 [0053.923] lstrlenA (lpString="*.xlsx") returned 6 [0053.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.ppt") returned 0 [0053.923] lstrlenA (lpString="*.ppt") returned 5 [0053.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.pptx") returned 0 [0053.923] lstrlenA (lpString="*.pptx") returned 6 [0053.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.pdf") returned 0 [0053.923] lstrlenA (lpString="*.pdf") returned 5 [0053.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.mov") returned 0 [0053.923] lstrlenA (lpString="*.mov") returned 5 [0053.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.m2v") returned 0 [0053.924] lstrlenA (lpString="*.m2v") returned 5 [0053.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.3gp") returned 0 [0053.924] lstrlenA (lpString="*.3gp") returned 5 [0053.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.mpeg") returned 0 [0053.924] lstrlenA (lpString="*.mpeg") returned 6 [0053.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.mpg") returned 0 [0053.924] lstrlenA (lpString="*.mpg") returned 5 [0053.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.flv") returned 0 [0053.924] lstrlenA (lpString="*.flv") returned 5 [0053.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.avi") returned 0 [0053.924] lstrlenA (lpString="*.avi") returned 5 [0053.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.mp4") returned 0 [0053.924] lstrlenA (lpString="*.mp4") returned 5 [0053.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.wmv") returned 0 [0053.924] lstrlenA (lpString="*.wmv") returned 5 [0053.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.divx") returned 0 [0053.925] lstrlenA (lpString="*.divx") returned 6 [0053.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.mkv") returned 0 [0053.925] lstrlenA (lpString="*.mkv") returned 5 [0053.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.mp3") returned 0 [0053.925] lstrlenA (lpString="*.mp3") returned 5 [0053.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.wav") returned 0 [0053.925] lstrlenA (lpString="*.wav") returned 5 [0053.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.flac") returned 0 [0053.925] lstrlenA (lpString="*.flac") returned 6 [0053.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.ape") returned 0 [0053.925] lstrlenA (lpString="*.ape") returned 5 [0053.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.wma") returned 0 [0053.925] lstrlenA (lpString="*.wma") returned 5 [0053.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.ac3") returned 0 [0053.925] lstrlenA (lpString="*.ac3") returned 5 [0053.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", pszSpec="*.mxf") returned 0 [0053.925] lstrlenA (lpString="*.mxf") returned 5 [0053.925] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x666c0000, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x666c0000, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x47c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0332364.WMF", cAlternateFileName="")) returned 1 [0053.925] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.925] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0332364.WMF") returned -1 [0053.925] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0332364.WMF") returned -1 [0053.925] lstrcmpiA (lpString1="", lpString2="J0332364.WMF") returned -1 [0053.925] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF") returned="J0332268.WMF" [0053.925] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.925] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.926] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.926] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.926] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0332364.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF" [0053.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.zip") returned 0 [0053.926] lstrlenA (lpString="*.zip") returned 5 [0053.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.rar") returned 0 [0053.926] lstrlenA (lpString="*.rar") returned 5 [0053.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.7z") returned 0 [0053.926] lstrlenA (lpString="*.7z") returned 4 [0053.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.tar") returned 0 [0053.926] lstrlenA (lpString="*.tar") returned 5 [0053.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.gzip") returned 0 [0053.926] lstrlenA (lpString="*.gzip") returned 6 [0053.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.jpg") returned 0 [0053.926] lstrlenA (lpString="*.jpg") returned 5 [0053.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.jpeg") returned 0 [0053.926] lstrlenA (lpString="*.jpeg") returned 6 [0053.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.psd") returned 0 [0053.926] lstrlenA (lpString="*.psd") returned 5 [0053.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.gif") returned 0 [0053.926] lstrlenA (lpString="*.gif") returned 5 [0053.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.doc") returned 0 [0053.926] lstrlenA (lpString="*.doc") returned 5 [0053.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.docx") returned 0 [0053.927] lstrlenA (lpString="*.docx") returned 6 [0053.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.xls") returned 0 [0053.927] lstrlenA (lpString="*.xls") returned 5 [0053.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.xlsx") returned 0 [0053.927] lstrlenA (lpString="*.xlsx") returned 6 [0053.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.ppt") returned 0 [0053.927] lstrlenA (lpString="*.ppt") returned 5 [0053.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.pptx") returned 0 [0053.927] lstrlenA (lpString="*.pptx") returned 6 [0053.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.pdf") returned 0 [0053.927] lstrlenA (lpString="*.pdf") returned 5 [0053.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.mov") returned 0 [0053.927] lstrlenA (lpString="*.mov") returned 5 [0053.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.m2v") returned 0 [0053.927] lstrlenA (lpString="*.m2v") returned 5 [0053.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.3gp") returned 0 [0053.927] lstrlenA (lpString="*.3gp") returned 5 [0053.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.mpeg") returned 0 [0053.927] lstrlenA (lpString="*.mpeg") returned 6 [0053.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.mpg") returned 0 [0053.927] lstrlenA (lpString="*.mpg") returned 5 [0053.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.flv") returned 0 [0053.927] lstrlenA (lpString="*.flv") returned 5 [0053.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.avi") returned 0 [0053.928] lstrlenA (lpString="*.avi") returned 5 [0053.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.mp4") returned 0 [0053.928] lstrlenA (lpString="*.mp4") returned 5 [0053.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.wmv") returned 0 [0053.928] lstrlenA (lpString="*.wmv") returned 5 [0053.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.divx") returned 0 [0053.928] lstrlenA (lpString="*.divx") returned 6 [0053.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.mkv") returned 0 [0053.928] lstrlenA (lpString="*.mkv") returned 5 [0053.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.mp3") returned 0 [0053.928] lstrlenA (lpString="*.mp3") returned 5 [0053.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.wav") returned 0 [0053.928] lstrlenA (lpString="*.wav") returned 5 [0053.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.flac") returned 0 [0053.928] lstrlenA (lpString="*.flac") returned 6 [0053.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.ape") returned 0 [0053.928] lstrlenA (lpString="*.ape") returned 5 [0053.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.wma") returned 0 [0053.928] lstrlenA (lpString="*.wma") returned 5 [0053.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.ac3") returned 0 [0053.928] lstrlenA (lpString="*.ac3") returned 5 [0053.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", pszSpec="*.mxf") returned 0 [0053.928] lstrlenA (lpString="*.mxf") returned 5 [0053.928] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5ca1000, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc5ca1000, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x1f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0335112.WMF", cAlternateFileName="")) returned 1 [0053.928] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.929] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0335112.WMF") returned -1 [0053.929] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0335112.WMF") returned -1 [0053.929] lstrcmpiA (lpString1="", lpString2="J0335112.WMF") returned -1 [0053.929] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF") returned="J0332364.WMF" [0053.929] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.929] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.929] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.929] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.929] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0335112.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF" [0053.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.zip") returned 0 [0053.929] lstrlenA (lpString="*.zip") returned 5 [0053.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.rar") returned 0 [0053.929] lstrlenA (lpString="*.rar") returned 5 [0053.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.7z") returned 0 [0053.929] lstrlenA (lpString="*.7z") returned 4 [0053.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.tar") returned 0 [0053.929] lstrlenA (lpString="*.tar") returned 5 [0053.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.gzip") returned 0 [0053.929] lstrlenA (lpString="*.gzip") returned 6 [0053.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.jpg") returned 0 [0053.929] lstrlenA (lpString="*.jpg") returned 5 [0053.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.jpeg") returned 0 [0053.929] lstrlenA (lpString="*.jpeg") returned 6 [0053.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.psd") returned 0 [0053.930] lstrlenA (lpString="*.psd") returned 5 [0053.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.gif") returned 0 [0053.930] lstrlenA (lpString="*.gif") returned 5 [0053.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.doc") returned 0 [0053.930] lstrlenA (lpString="*.doc") returned 5 [0053.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.docx") returned 0 [0053.930] lstrlenA (lpString="*.docx") returned 6 [0053.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.xls") returned 0 [0053.930] lstrlenA (lpString="*.xls") returned 5 [0053.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.xlsx") returned 0 [0053.930] lstrlenA (lpString="*.xlsx") returned 6 [0053.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.ppt") returned 0 [0053.930] lstrlenA (lpString="*.ppt") returned 5 [0053.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.pptx") returned 0 [0053.930] lstrlenA (lpString="*.pptx") returned 6 [0053.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.pdf") returned 0 [0053.930] lstrlenA (lpString="*.pdf") returned 5 [0053.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.mov") returned 0 [0053.930] lstrlenA (lpString="*.mov") returned 5 [0053.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.m2v") returned 0 [0053.930] lstrlenA (lpString="*.m2v") returned 5 [0053.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.3gp") returned 0 [0053.930] lstrlenA (lpString="*.3gp") returned 5 [0053.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.mpeg") returned 0 [0053.930] lstrlenA (lpString="*.mpeg") returned 6 [0053.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.mpg") returned 0 [0053.931] lstrlenA (lpString="*.mpg") returned 5 [0053.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.flv") returned 0 [0053.931] lstrlenA (lpString="*.flv") returned 5 [0053.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.avi") returned 0 [0053.931] lstrlenA (lpString="*.avi") returned 5 [0053.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.mp4") returned 0 [0053.931] lstrlenA (lpString="*.mp4") returned 5 [0053.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.wmv") returned 0 [0053.931] lstrlenA (lpString="*.wmv") returned 5 [0053.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.divx") returned 0 [0053.931] lstrlenA (lpString="*.divx") returned 6 [0053.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.mkv") returned 0 [0053.931] lstrlenA (lpString="*.mkv") returned 5 [0053.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.mp3") returned 0 [0053.931] lstrlenA (lpString="*.mp3") returned 5 [0053.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.wav") returned 0 [0053.931] lstrlenA (lpString="*.wav") returned 5 [0053.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.flac") returned 0 [0053.931] lstrlenA (lpString="*.flac") returned 6 [0053.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.ape") returned 0 [0053.931] lstrlenA (lpString="*.ape") returned 5 [0053.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.wma") returned 0 [0053.931] lstrlenA (lpString="*.wma") returned 5 [0053.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.ac3") returned 0 [0053.931] lstrlenA (lpString="*.ac3") returned 5 [0053.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", pszSpec="*.mxf") returned 0 [0053.932] lstrlenA (lpString="*.mxf") returned 5 [0053.932] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c046200, ftCreationTime.dwHighDateTime=0x1bfaf5c, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c046200, ftLastWriteTime.dwHighDateTime=0x1bfaf5c, nFileSizeHigh=0x0, nFileSizeLow=0xce9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0336075.WMF", cAlternateFileName="")) returned 1 [0053.932] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0053.932] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0336075.WMF") returned -1 [0053.932] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0336075.WMF") returned -1 [0053.932] lstrcmpiA (lpString1="", lpString2="J0336075.WMF") returned -1 [0053.932] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF") returned="J0335112.WMF" [0053.932] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0053.932] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="" [0053.932] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" [0053.932] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\how to decrypt files.txt")) returned 0x20 [0053.932] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", lpString2="J0336075.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF" [0053.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.zip") returned 0 [0053.932] lstrlenA (lpString="*.zip") returned 5 [0053.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.rar") returned 0 [0053.932] lstrlenA (lpString="*.rar") returned 5 [0053.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.7z") returned 0 [0053.932] lstrlenA (lpString="*.7z") returned 4 [0053.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.tar") returned 0 [0053.932] lstrlenA (lpString="*.tar") returned 5 [0053.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.gzip") returned 0 [0053.933] lstrlenA (lpString="*.gzip") returned 6 [0053.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.jpg") returned 0 [0053.933] lstrlenA (lpString="*.jpg") returned 5 [0053.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.jpeg") returned 0 [0053.933] lstrlenA (lpString="*.jpeg") returned 6 [0053.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.psd") returned 0 [0053.933] lstrlenA (lpString="*.psd") returned 5 [0053.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.gif") returned 0 [0053.933] lstrlenA (lpString="*.gif") returned 5 [0053.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.doc") returned 0 [0053.933] lstrlenA (lpString="*.doc") returned 5 [0053.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.docx") returned 0 [0053.933] lstrlenA (lpString="*.docx") returned 6 [0053.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.xls") returned 0 [0053.933] lstrlenA (lpString="*.xls") returned 5 [0053.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.xlsx") returned 0 [0053.933] lstrlenA (lpString="*.xlsx") returned 6 [0053.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.ppt") returned 0 [0053.933] lstrlenA (lpString="*.ppt") returned 5 [0053.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.pptx") returned 0 [0053.933] lstrlenA (lpString="*.pptx") returned 6 [0053.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.pdf") returned 0 [0053.933] lstrlenA (lpString="*.pdf") returned 5 [0053.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.mov") returned 0 [0053.933] lstrlenA (lpString="*.mov") returned 5 [0053.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.m2v") returned 0 [0053.934] lstrlenA (lpString="*.m2v") returned 5 [0053.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.3gp") returned 0 [0053.934] lstrlenA (lpString="*.3gp") returned 5 [0053.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.mpeg") returned 0 [0053.934] lstrlenA (lpString="*.mpeg") returned 6 [0053.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.mpg") returned 0 [0053.934] lstrlenA (lpString="*.mpg") returned 5 [0053.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.flv") returned 0 [0053.934] lstrlenA (lpString="*.flv") returned 5 [0053.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.avi") returned 0 [0053.934] lstrlenA (lpString="*.avi") returned 5 [0053.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.mp4") returned 0 [0053.934] lstrlenA (lpString="*.mp4") returned 5 [0053.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.wmv") returned 0 [0053.934] lstrlenA (lpString="*.wmv") returned 5 [0053.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.divx") returned 0 [0053.934] lstrlenA (lpString="*.divx") returned 6 [0053.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.mkv") returned 0 [0053.934] lstrlenA (lpString="*.mkv") returned 5 [0053.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.mp3") returned 0 [0053.934] lstrlenA (lpString="*.mp3") returned 5 [0053.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.wav") returned 0 [0053.934] lstrlenA (lpString="*.wav") returned 5 [0053.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.flac") returned 0 [0053.935] lstrlenA (lpString="*.flac") returned 6 [0053.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.ape") returned 0 [0053.935] lstrlenA (lpString="*.ape") returned 5 [0053.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.wma") returned 0 [0053.935] lstrlenA (lpString="*.wma") returned 5 [0053.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.ac3") returned 0 [0053.935] lstrlenA (lpString="*.ac3") returned 5 [0053.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", pszSpec="*.mxf") returned 0 [0053.935] lstrlenA (lpString="*.mxf") returned 5 [0053.935] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c046200, ftCreationTime.dwHighDateTime=0x1bfaf5c, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c046200, ftLastWriteTime.dwHighDateTime=0x1bfaf5c, nFileSizeHigh=0x0, nFileSizeLow=0xce9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0336075.WMF", cAlternateFileName="")) returned 0 [0053.935] FindClose (in: hFindFile=0x2d8070 | out: hFindFile=0x2d8070) returned 1 [0053.935] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0053.935] lstrcmpA (lpString1=".", lpString2="OFFICE14") returned -1 [0053.935] lstrcmpA (lpString1="..", lpString2="OFFICE14") returned -1 [0053.936] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\*.*") returned="*.*" [0053.936] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\", lpString2="OFFICE14" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" [0053.936] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14") returned 48 [0053.936] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d8070 [0053.938] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0053.938] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.938] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0053.938] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0053.939] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0053.939] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0053.939] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0053.939] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*.*") returned="*.*" [0053.939] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\", lpString2="1033" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033" [0053.939] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033") returned 53 [0053.939] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2d7ff8 [0053.939] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0053.939] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0053.939] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0053.939] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0053.939] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c438, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="OFFICE10.MML", cAlternateFileName="")) returned 1 [0053.939] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.939] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OFFICE10.MML") returned -1 [0053.939] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OFFICE10.MML") returned -1 [0053.940] lstrcmpiA (lpString1="", lpString2="OFFICE10.MML") returned -1 [0053.940] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*.*") returned="*.*" [0053.940] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\" [0053.940] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\") returned="" [0053.940] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\HOW TO DECRYPT FILES.txt" [0053.940] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\how to decrypt files.txt")) returned 0xffffffff [0053.940] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0053.941] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0053.941] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0053.942] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0053.942] CloseHandle (hObject=0x90) returned 1 [0053.942] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\", lpString2="OFFICE10.MML" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" [0053.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.zip") returned 0 [0053.942] lstrlenA (lpString="*.zip") returned 5 [0053.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.rar") returned 0 [0053.943] lstrlenA (lpString="*.rar") returned 5 [0053.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.7z") returned 0 [0053.943] lstrlenA (lpString="*.7z") returned 4 [0053.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.tar") returned 0 [0053.943] lstrlenA (lpString="*.tar") returned 5 [0053.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.gzip") returned 0 [0053.943] lstrlenA (lpString="*.gzip") returned 6 [0053.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.jpg") returned 0 [0053.943] lstrlenA (lpString="*.jpg") returned 5 [0053.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.jpeg") returned 0 [0053.943] lstrlenA (lpString="*.jpeg") returned 6 [0053.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.psd") returned 0 [0053.943] lstrlenA (lpString="*.psd") returned 5 [0053.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.gif") returned 0 [0053.943] lstrlenA (lpString="*.gif") returned 5 [0053.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.doc") returned 0 [0053.943] lstrlenA (lpString="*.doc") returned 5 [0053.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.docx") returned 0 [0053.943] lstrlenA (lpString="*.docx") returned 6 [0053.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.xls") returned 0 [0053.943] lstrlenA (lpString="*.xls") returned 5 [0053.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.xlsx") returned 0 [0053.943] lstrlenA (lpString="*.xlsx") returned 6 [0053.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.ppt") returned 0 [0053.943] lstrlenA (lpString="*.ppt") returned 5 [0053.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.pptx") returned 0 [0053.944] lstrlenA (lpString="*.pptx") returned 6 [0053.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.pdf") returned 0 [0053.944] lstrlenA (lpString="*.pdf") returned 5 [0053.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.mov") returned 0 [0053.944] lstrlenA (lpString="*.mov") returned 5 [0053.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.m2v") returned 0 [0053.944] lstrlenA (lpString="*.m2v") returned 5 [0053.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.3gp") returned 0 [0053.944] lstrlenA (lpString="*.3gp") returned 5 [0053.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.mpeg") returned 0 [0053.944] lstrlenA (lpString="*.mpeg") returned 6 [0053.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.mpg") returned 0 [0053.944] lstrlenA (lpString="*.mpg") returned 5 [0053.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.flv") returned 0 [0053.944] lstrlenA (lpString="*.flv") returned 5 [0053.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.avi") returned 0 [0053.944] lstrlenA (lpString="*.avi") returned 5 [0053.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.mp4") returned 0 [0053.944] lstrlenA (lpString="*.mp4") returned 5 [0053.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.wmv") returned 0 [0053.944] lstrlenA (lpString="*.wmv") returned 5 [0053.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.divx") returned 0 [0053.944] lstrlenA (lpString="*.divx") returned 6 [0053.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.mkv") returned 0 [0053.944] lstrlenA (lpString="*.mkv") returned 5 [0053.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.mp3") returned 0 [0053.945] lstrlenA (lpString="*.mp3") returned 5 [0053.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.wav") returned 0 [0053.945] lstrlenA (lpString="*.wav") returned 5 [0053.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.flac") returned 0 [0053.945] lstrlenA (lpString="*.flac") returned 6 [0053.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.ape") returned 0 [0053.945] lstrlenA (lpString="*.ape") returned 5 [0053.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.wma") returned 0 [0053.945] lstrlenA (lpString="*.wma") returned 5 [0053.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.ac3") returned 0 [0053.945] lstrlenA (lpString="*.ac3") returned 5 [0053.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", pszSpec="*.mxf") returned 0 [0053.945] lstrlenA (lpString="*.mxf") returned 5 [0053.945] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c438, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="OFFICE10.MML", cAlternateFileName="")) returned 0 [0053.945] FindClose (in: hFindFile=0x2d7ff8 | out: hFindFile=0x2d7ff8) returned 1 [0053.945] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="AUTOSHAP", cAlternateFileName="")) returned 1 [0053.946] lstrcmpA (lpString1=".", lpString2="AUTOSHAP") returned -1 [0053.946] lstrcmpA (lpString1="..", lpString2="AUTOSHAP") returned -1 [0053.946] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*.*") returned="*.*" [0053.946] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\", lpString2="AUTOSHAP" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0053.946] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned 57 [0053.946] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d7ff8 [0053.951] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0053.951] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.953] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0053.953] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0053.953] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AUTOSHAP.DLL", cAlternateFileName="")) returned 1 [0053.953] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.953] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AUTOSHAP.DLL") returned 1 [0053.953] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AUTOSHAP.DLL") returned 1 [0053.953] lstrcmpiA (lpString1="", lpString2="AUTOSHAP.DLL") returned -1 [0053.953] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*") returned="*.*" [0053.953] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.953] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.953] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.953] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0xffffffff [0053.954] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0053.955] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0053.955] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0053.956] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0053.956] CloseHandle (hObject=0x90) returned 1 [0053.957] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="AUTOSHAP.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" [0053.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.zip") returned 0 [0053.957] lstrlenA (lpString="*.zip") returned 5 [0053.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.rar") returned 0 [0053.957] lstrlenA (lpString="*.rar") returned 5 [0053.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.7z") returned 0 [0053.957] lstrlenA (lpString="*.7z") returned 4 [0053.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.tar") returned 0 [0053.957] lstrlenA (lpString="*.tar") returned 5 [0053.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.gzip") returned 0 [0053.957] lstrlenA (lpString="*.gzip") returned 6 [0053.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.jpg") returned 0 [0053.957] lstrlenA (lpString="*.jpg") returned 5 [0053.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.jpeg") returned 0 [0053.957] lstrlenA (lpString="*.jpeg") returned 6 [0053.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.psd") returned 0 [0053.957] lstrlenA (lpString="*.psd") returned 5 [0053.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.gif") returned 0 [0053.957] lstrlenA (lpString="*.gif") returned 5 [0053.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.doc") returned 0 [0053.957] lstrlenA (lpString="*.doc") returned 5 [0053.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.docx") returned 0 [0053.958] lstrlenA (lpString="*.docx") returned 6 [0053.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.xls") returned 0 [0053.958] lstrlenA (lpString="*.xls") returned 5 [0053.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.xlsx") returned 0 [0053.958] lstrlenA (lpString="*.xlsx") returned 6 [0053.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.ppt") returned 0 [0053.958] lstrlenA (lpString="*.ppt") returned 5 [0053.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.pptx") returned 0 [0053.958] lstrlenA (lpString="*.pptx") returned 6 [0053.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.pdf") returned 0 [0053.958] lstrlenA (lpString="*.pdf") returned 5 [0053.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.mov") returned 0 [0053.958] lstrlenA (lpString="*.mov") returned 5 [0053.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.m2v") returned 0 [0053.958] lstrlenA (lpString="*.m2v") returned 5 [0053.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.3gp") returned 0 [0053.958] lstrlenA (lpString="*.3gp") returned 5 [0053.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.mpeg") returned 0 [0053.958] lstrlenA (lpString="*.mpeg") returned 6 [0053.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.mpg") returned 0 [0053.958] lstrlenA (lpString="*.mpg") returned 5 [0053.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.flv") returned 0 [0053.958] lstrlenA (lpString="*.flv") returned 5 [0053.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.avi") returned 0 [0053.958] lstrlenA (lpString="*.avi") returned 5 [0053.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.mp4") returned 0 [0053.959] lstrlenA (lpString="*.mp4") returned 5 [0053.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.wmv") returned 0 [0053.959] lstrlenA (lpString="*.wmv") returned 5 [0053.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.divx") returned 0 [0053.959] lstrlenA (lpString="*.divx") returned 6 [0053.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.mkv") returned 0 [0053.959] lstrlenA (lpString="*.mkv") returned 5 [0053.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.mp3") returned 0 [0053.959] lstrlenA (lpString="*.mp3") returned 5 [0053.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.wav") returned 0 [0053.959] lstrlenA (lpString="*.wav") returned 5 [0053.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.flac") returned 0 [0053.959] lstrlenA (lpString="*.flac") returned 6 [0053.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.ape") returned 0 [0053.959] lstrlenA (lpString="*.ape") returned 5 [0053.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.wma") returned 0 [0053.959] lstrlenA (lpString="*.wma") returned 5 [0053.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.ac3") returned 0 [0053.959] lstrlenA (lpString="*.ac3") returned 5 [0053.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", pszSpec="*.mxf") returned 0 [0053.959] lstrlenA (lpString="*.mxf") returned 5 [0053.959] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6154e300, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6154e300, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x926, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18180_.WMF", cAlternateFileName="")) returned 1 [0053.959] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.959] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18180_.WMF") returned 1 [0053.959] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18180_.WMF") returned 1 [0053.960] lstrcmpiA (lpString1="", lpString2="BD18180_.WMF") returned -1 [0053.960] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned="AUTOSHAP.DLL" [0053.960] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.960] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.960] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.960] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.960] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18180_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF" [0053.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.zip") returned 0 [0053.960] lstrlenA (lpString="*.zip") returned 5 [0053.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.rar") returned 0 [0053.960] lstrlenA (lpString="*.rar") returned 5 [0053.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.7z") returned 0 [0053.960] lstrlenA (lpString="*.7z") returned 4 [0053.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.tar") returned 0 [0053.960] lstrlenA (lpString="*.tar") returned 5 [0053.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.gzip") returned 0 [0053.960] lstrlenA (lpString="*.gzip") returned 6 [0053.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.jpg") returned 0 [0053.960] lstrlenA (lpString="*.jpg") returned 5 [0053.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.jpeg") returned 0 [0053.960] lstrlenA (lpString="*.jpeg") returned 6 [0053.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.psd") returned 0 [0053.960] lstrlenA (lpString="*.psd") returned 5 [0053.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.gif") returned 0 [0053.961] lstrlenA (lpString="*.gif") returned 5 [0053.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.doc") returned 0 [0053.961] lstrlenA (lpString="*.doc") returned 5 [0053.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.docx") returned 0 [0053.961] lstrlenA (lpString="*.docx") returned 6 [0053.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.xls") returned 0 [0053.961] lstrlenA (lpString="*.xls") returned 5 [0053.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.xlsx") returned 0 [0053.961] lstrlenA (lpString="*.xlsx") returned 6 [0053.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.ppt") returned 0 [0053.961] lstrlenA (lpString="*.ppt") returned 5 [0053.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.pptx") returned 0 [0053.961] lstrlenA (lpString="*.pptx") returned 6 [0053.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.pdf") returned 0 [0053.961] lstrlenA (lpString="*.pdf") returned 5 [0053.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.mov") returned 0 [0053.961] lstrlenA (lpString="*.mov") returned 5 [0053.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.m2v") returned 0 [0053.961] lstrlenA (lpString="*.m2v") returned 5 [0053.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.3gp") returned 0 [0053.961] lstrlenA (lpString="*.3gp") returned 5 [0053.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.mpeg") returned 0 [0053.961] lstrlenA (lpString="*.mpeg") returned 6 [0053.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.mpg") returned 0 [0053.961] lstrlenA (lpString="*.mpg") returned 5 [0053.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.flv") returned 0 [0053.962] lstrlenA (lpString="*.flv") returned 5 [0053.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.avi") returned 0 [0053.962] lstrlenA (lpString="*.avi") returned 5 [0053.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.mp4") returned 0 [0053.962] lstrlenA (lpString="*.mp4") returned 5 [0053.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.wmv") returned 0 [0053.962] lstrlenA (lpString="*.wmv") returned 5 [0053.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.divx") returned 0 [0053.962] lstrlenA (lpString="*.divx") returned 6 [0053.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.mkv") returned 0 [0053.962] lstrlenA (lpString="*.mkv") returned 5 [0053.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.mp3") returned 0 [0053.962] lstrlenA (lpString="*.mp3") returned 5 [0053.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.wav") returned 0 [0053.962] lstrlenA (lpString="*.wav") returned 5 [0053.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.flac") returned 0 [0053.962] lstrlenA (lpString="*.flac") returned 6 [0053.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.ape") returned 0 [0053.962] lstrlenA (lpString="*.ape") returned 5 [0053.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.wma") returned 0 [0053.962] lstrlenA (lpString="*.wma") returned 5 [0053.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.ac3") returned 0 [0053.962] lstrlenA (lpString="*.ac3") returned 5 [0053.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", pszSpec="*.mxf") returned 0 [0053.962] lstrlenA (lpString="*.mxf") returned 5 [0053.962] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe4e1600, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe4e1600, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18181_.WMF", cAlternateFileName="")) returned 1 [0053.963] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.963] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18181_.WMF") returned 1 [0053.963] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18181_.WMF") returned 1 [0053.963] lstrcmpiA (lpString1="", lpString2="BD18181_.WMF") returned -1 [0053.963] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF") returned="BD18180_.WMF" [0053.963] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.963] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.963] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.963] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.963] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18181_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF" [0053.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.zip") returned 0 [0053.963] lstrlenA (lpString="*.zip") returned 5 [0053.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.rar") returned 0 [0053.963] lstrlenA (lpString="*.rar") returned 5 [0053.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.7z") returned 0 [0053.963] lstrlenA (lpString="*.7z") returned 4 [0053.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.tar") returned 0 [0053.963] lstrlenA (lpString="*.tar") returned 5 [0053.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.gzip") returned 0 [0053.963] lstrlenA (lpString="*.gzip") returned 6 [0053.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.jpg") returned 0 [0053.963] lstrlenA (lpString="*.jpg") returned 5 [0053.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.jpeg") returned 0 [0053.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.psd") returned 0 [0053.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.gif") returned 0 [0053.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.doc") returned 0 [0053.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.docx") returned 0 [0053.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.xls") returned 0 [0053.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.xlsx") returned 0 [0053.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.ppt") returned 0 [0053.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.pptx") returned 0 [0053.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.pdf") returned 0 [0053.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.mov") returned 0 [0053.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.m2v") returned 0 [0053.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.3gp") returned 0 [0053.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.mpeg") returned 0 [0053.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.mpg") returned 0 [0053.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.flv") returned 0 [0053.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.avi") returned 0 [0053.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.mp4") returned 0 [0053.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.wmv") returned 0 [0053.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.divx") returned 0 [0053.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.mkv") returned 0 [0053.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.mp3") returned 0 [0053.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.wav") returned 0 [0053.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.flac") returned 0 [0053.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.ape") returned 0 [0053.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.wma") returned 0 [0053.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.ac3") returned 0 [0053.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", pszSpec="*.mxf") returned 0 [0053.965] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ce0000, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa0ce0000, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18182_.WMF", cAlternateFileName="")) returned 1 [0053.965] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.965] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18182_.WMF") returned 1 [0053.965] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18182_.WMF") returned 1 [0053.965] lstrcmpiA (lpString1="", lpString2="BD18182_.WMF") returned -1 [0053.965] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF") returned="BD18181_.WMF" [0053.965] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.965] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.965] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.965] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.966] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18182_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF" [0053.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.zip") returned 0 [0053.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.rar") returned 0 [0053.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.7z") returned 0 [0053.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.tar") returned 0 [0053.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.gzip") returned 0 [0053.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.jpg") returned 0 [0053.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.jpeg") returned 0 [0053.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.psd") returned 0 [0053.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.gif") returned 0 [0053.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.doc") returned 0 [0053.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.docx") returned 0 [0053.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.xls") returned 0 [0053.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.xlsx") returned 0 [0053.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.ppt") returned 0 [0053.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.pptx") returned 0 [0053.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.pdf") returned 0 [0053.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.mov") returned 0 [0053.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.m2v") returned 0 [0053.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.3gp") returned 0 [0053.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.mpeg") returned 0 [0053.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.mpg") returned 0 [0053.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.flv") returned 0 [0053.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.avi") returned 0 [0053.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.mp4") returned 0 [0053.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.wmv") returned 0 [0053.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.divx") returned 0 [0053.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.mkv") returned 0 [0053.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.mp3") returned 0 [0053.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.wav") returned 0 [0053.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.flac") returned 0 [0053.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.ape") returned 0 [0053.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.wma") returned 0 [0053.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.ac3") returned 0 [0053.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", pszSpec="*.mxf") returned 0 [0053.967] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe12d7e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe12d7e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xd22, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18184_.WMF", cAlternateFileName="")) returned 1 [0053.967] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.967] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18184_.WMF") returned 1 [0053.967] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18184_.WMF") returned 1 [0053.968] lstrcmpiA (lpString1="", lpString2="BD18184_.WMF") returned -1 [0053.968] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF") returned="BD18182_.WMF" [0053.968] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.968] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.968] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.968] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.968] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18184_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF" [0053.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.zip") returned 0 [0053.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.rar") returned 0 [0053.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.7z") returned 0 [0053.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.tar") returned 0 [0053.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.gzip") returned 0 [0053.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.jpg") returned 0 [0053.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.jpeg") returned 0 [0053.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.psd") returned 0 [0053.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.gif") returned 0 [0053.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.doc") returned 0 [0053.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.docx") returned 0 [0053.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.xls") returned 0 [0053.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.xlsx") returned 0 [0053.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.ppt") returned 0 [0053.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.pptx") returned 0 [0053.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.pdf") returned 0 [0053.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.mov") returned 0 [0053.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.m2v") returned 0 [0053.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.3gp") returned 0 [0053.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.mpeg") returned 0 [0053.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.mpg") returned 0 [0053.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.flv") returned 0 [0053.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.avi") returned 0 [0053.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.mp4") returned 0 [0053.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.wmv") returned 0 [0053.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.divx") returned 0 [0053.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.mkv") returned 0 [0053.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.mp3") returned 0 [0053.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.wav") returned 0 [0053.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.flac") returned 0 [0053.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.ape") returned 0 [0053.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.wma") returned 0 [0053.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.ac3") returned 0 [0053.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", pszSpec="*.mxf") returned 0 [0053.970] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8867900, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd8867900, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0xd42, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18185_.WMF", cAlternateFileName="")) returned 1 [0053.970] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.970] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18185_.WMF") returned 1 [0053.970] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18185_.WMF") returned 1 [0053.970] lstrcmpiA (lpString1="", lpString2="BD18185_.WMF") returned -1 [0053.970] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF") returned="BD18184_.WMF" [0053.970] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.970] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.970] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.970] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.970] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18185_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF" [0053.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.zip") returned 0 [0053.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.rar") returned 0 [0053.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.7z") returned 0 [0053.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.tar") returned 0 [0053.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.gzip") returned 0 [0053.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.jpg") returned 0 [0053.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.jpeg") returned 0 [0053.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.psd") returned 0 [0053.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.gif") returned 0 [0053.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.doc") returned 0 [0053.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.docx") returned 0 [0053.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.xls") returned 0 [0053.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.xlsx") returned 0 [0053.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.ppt") returned 0 [0053.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.pptx") returned 0 [0053.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.pdf") returned 0 [0053.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.mov") returned 0 [0053.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.m2v") returned 0 [0053.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.3gp") returned 0 [0053.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.mpeg") returned 0 [0053.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.mpg") returned 0 [0053.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.flv") returned 0 [0053.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.avi") returned 0 [0053.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.mp4") returned 0 [0053.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.wmv") returned 0 [0053.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.divx") returned 0 [0053.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.mkv") returned 0 [0053.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.mp3") returned 0 [0053.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.wav") returned 0 [0053.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.flac") returned 0 [0053.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.ape") returned 0 [0053.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.wma") returned 0 [0053.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.ac3") returned 0 [0053.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", pszSpec="*.mxf") returned 0 [0053.972] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50bd100, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe50bd100, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x758, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18187_.WMF", cAlternateFileName="")) returned 1 [0053.972] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.972] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18187_.WMF") returned 1 [0053.973] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18187_.WMF") returned 1 [0053.973] lstrcmpiA (lpString1="", lpString2="BD18187_.WMF") returned -1 [0053.973] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF") returned="BD18185_.WMF" [0053.973] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.973] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.973] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.973] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.973] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18187_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF" [0053.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.zip") returned 0 [0053.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.rar") returned 0 [0053.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.7z") returned 0 [0053.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.tar") returned 0 [0053.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.gzip") returned 0 [0053.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.jpg") returned 0 [0053.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.jpeg") returned 0 [0053.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.psd") returned 0 [0053.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.gif") returned 0 [0053.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.doc") returned 0 [0053.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.docx") returned 0 [0053.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.xls") returned 0 [0053.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.xlsx") returned 0 [0053.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.ppt") returned 0 [0053.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.pptx") returned 0 [0053.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.pdf") returned 0 [0053.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.mov") returned 0 [0053.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.m2v") returned 0 [0053.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.3gp") returned 0 [0053.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.mpeg") returned 0 [0053.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.mpg") returned 0 [0053.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.flv") returned 0 [0053.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.avi") returned 0 [0053.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.mp4") returned 0 [0053.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.wmv") returned 0 [0053.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.divx") returned 0 [0053.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.mkv") returned 0 [0053.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.mp3") returned 0 [0053.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.wav") returned 0 [0053.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.flac") returned 0 [0053.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.ape") returned 0 [0053.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.wma") returned 0 [0053.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.ac3") returned 0 [0053.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", pszSpec="*.mxf") returned 0 [0053.975] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c95f00, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84c95f00, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18189_.WMF", cAlternateFileName="")) returned 1 [0053.975] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.975] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18189_.WMF") returned 1 [0053.975] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18189_.WMF") returned 1 [0053.975] lstrcmpiA (lpString1="", lpString2="BD18189_.WMF") returned -1 [0053.975] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF") returned="BD18187_.WMF" [0053.975] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.975] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.975] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.975] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.975] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18189_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF" [0053.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF", pszSpec="*.zip") returned 0 [0053.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF", pszSpec="*.rar") returned 0 [0053.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF", pszSpec="*.7z") returned 0 [0053.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF", pszSpec="*.tar") returned 0 [0053.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF", pszSpec="*.gzip") returned 0 [0053.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF", pszSpec="*.jpg") returned 0 [0053.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF", pszSpec="*.jpeg") returned 0 [0053.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF", pszSpec="*.psd") returned 0 [0053.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF", pszSpec="*.gif") returned 0 [0053.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF", pszSpec="*.doc") returned 0 [0053.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF", pszSpec="*.docx") returned 0 [0053.976] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea699700, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xea699700, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18190_.WMF", cAlternateFileName="")) returned 1 [0053.976] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.976] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18190_.WMF") returned 1 [0053.976] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18190_.WMF") returned 1 [0053.976] lstrcmpiA (lpString1="", lpString2="BD18190_.WMF") returned -1 [0053.976] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF") returned="BD18189_.WMF" [0053.976] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.976] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.976] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.977] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.977] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18190_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF" [0053.977] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x171d3300, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x171d3300, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0xc9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18191_.WMF", cAlternateFileName="")) returned 1 [0053.977] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.977] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18191_.WMF") returned 1 [0053.977] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18191_.WMF") returned 1 [0053.977] lstrcmpiA (lpString1="", lpString2="BD18191_.WMF") returned -1 [0053.977] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF") returned="BD18190_.WMF" [0053.977] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.977] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.977] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.977] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.977] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18191_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF" [0053.977] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6432a00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb6432a00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x2068, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18192_.WMF", cAlternateFileName="")) returned 1 [0053.977] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.977] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18192_.WMF") returned 1 [0053.977] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18192_.WMF") returned 1 [0053.977] lstrcmpiA (lpString1="", lpString2="BD18192_.WMF") returned -1 [0053.977] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF") returned="BD18191_.WMF" [0053.978] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.978] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.978] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.978] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.978] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18192_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF" [0053.978] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd07d0800, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd07d0800, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x128e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18193_.WMF", cAlternateFileName="")) returned 1 [0053.978] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.978] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18193_.WMF") returned 1 [0053.978] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18193_.WMF") returned 1 [0053.978] lstrcmpiA (lpString1="", lpString2="BD18193_.WMF") returned -1 [0053.978] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF") returned="BD18192_.WMF" [0053.978] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.978] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.978] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.978] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.978] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18193_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF" [0053.978] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29e33800, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29e33800, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0xdde, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18194_.WMF", cAlternateFileName="")) returned 1 [0053.978] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.978] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18194_.WMF") returned 1 [0053.978] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18194_.WMF") returned 1 [0053.979] lstrcmpiA (lpString1="", lpString2="BD18194_.WMF") returned -1 [0053.979] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF") returned="BD18193_.WMF" [0053.979] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.979] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.979] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.979] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.979] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18194_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF" [0053.979] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4404e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf4404e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18196_.WMF", cAlternateFileName="")) returned 1 [0053.979] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.979] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18196_.WMF") returned 1 [0053.979] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18196_.WMF") returned 1 [0053.979] lstrcmpiA (lpString1="", lpString2="BD18196_.WMF") returned -1 [0053.979] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF") returned="BD18194_.WMF" [0053.979] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.979] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.979] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.979] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.979] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18196_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF" [0053.979] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x5b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18197_.WMF", cAlternateFileName="")) returned 1 [0053.979] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.979] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18197_.WMF") returned 1 [0053.979] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18197_.WMF") returned 1 [0053.979] lstrcmpiA (lpString1="", lpString2="BD18197_.WMF") returned -1 [0053.979] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF") returned="BD18196_.WMF" [0053.979] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.980] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.980] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.980] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.980] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18197_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF" [0053.980] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x5c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18198_.WMF", cAlternateFileName="")) returned 1 [0053.980] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.980] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18198_.WMF") returned 1 [0053.980] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18198_.WMF") returned 1 [0053.980] lstrcmpiA (lpString1="", lpString2="BD18198_.WMF") returned -1 [0053.980] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF") returned="BD18197_.WMF" [0053.980] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.980] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.980] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.980] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.980] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18198_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF" [0053.980] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fdb1800, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2fdb1800, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xc3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18199_.WMF", cAlternateFileName="")) returned 1 [0053.980] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.980] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18199_.WMF") returned 1 [0053.980] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18199_.WMF") returned 1 [0053.981] lstrcmpiA (lpString1="", lpString2="BD18199_.WMF") returned -1 [0053.981] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF") returned="BD18198_.WMF" [0053.981] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.981] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.981] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.981] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.981] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18199_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF" [0053.981] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd302000, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfd302000, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18200_.WMF", cAlternateFileName="")) returned 1 [0053.981] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.981] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18200_.WMF") returned 1 [0053.981] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18200_.WMF") returned 1 [0053.981] lstrcmpiA (lpString1="", lpString2="BD18200_.WMF") returned -1 [0053.981] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF") returned="BD18199_.WMF" [0053.981] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.981] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.981] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.981] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.981] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18200_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF" [0053.981] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c3c400, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd3c3c400, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18201_.WMF", cAlternateFileName="")) returned 1 [0053.982] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.982] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18201_.WMF") returned 1 [0053.982] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18201_.WMF") returned 1 [0053.982] lstrcmpiA (lpString1="", lpString2="BD18201_.WMF") returned -1 [0053.982] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF") returned="BD18200_.WMF" [0053.982] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.982] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.982] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.982] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.982] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18201_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF" [0053.982] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18202_.WMF", cAlternateFileName="")) returned 1 [0053.982] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.982] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18202_.WMF") returned 1 [0053.982] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18202_.WMF") returned 1 [0053.982] lstrcmpiA (lpString1="", lpString2="BD18202_.WMF") returned -1 [0053.982] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF") returned="BD18201_.WMF" [0053.982] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.982] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.982] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.982] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.983] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18202_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF" [0053.983] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f586200, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3f586200, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18203_.WMF", cAlternateFileName="")) returned 1 [0053.983] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.983] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18203_.WMF") returned 1 [0053.983] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18203_.WMF") returned 1 [0053.983] lstrcmpiA (lpString1="", lpString2="BD18203_.WMF") returned -1 [0053.983] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF") returned="BD18202_.WMF" [0053.983] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.983] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.983] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.983] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.983] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18203_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF" [0053.983] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7db3a00, ftCreationTime.dwHighDateTime=0x1bddcb2, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd7db3a00, ftLastWriteTime.dwHighDateTime=0x1bddcb2, nFileSizeHigh=0x0, nFileSizeLow=0x814, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18204_.WMF", cAlternateFileName="")) returned 1 [0053.983] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.983] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18204_.WMF") returned 1 [0053.983] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18204_.WMF") returned 1 [0053.983] lstrcmpiA (lpString1="", lpString2="BD18204_.WMF") returned -1 [0053.983] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF") returned="BD18203_.WMF" [0053.983] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.984] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.984] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.984] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.984] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18204_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF" [0053.984] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58631200, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x58631200, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x8da, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18205_.WMF", cAlternateFileName="")) returned 1 [0053.984] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.984] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18205_.WMF") returned 1 [0053.984] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18205_.WMF") returned 1 [0053.984] lstrcmpiA (lpString1="", lpString2="BD18205_.WMF") returned -1 [0053.984] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF") returned="BD18204_.WMF" [0053.984] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.984] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.984] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.984] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.984] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18205_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF" [0053.984] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dd5a600, ftCreationTime.dwHighDateTime=0x1bddc9f, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4dd5a600, ftLastWriteTime.dwHighDateTime=0x1bddc9f, nFileSizeHigh=0x0, nFileSizeLow=0x8da, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18206_.WMF", cAlternateFileName="")) returned 1 [0053.984] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.984] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18206_.WMF") returned 1 [0053.984] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18206_.WMF") returned 1 [0053.984] lstrcmpiA (lpString1="", lpString2="BD18206_.WMF") returned -1 [0053.985] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF") returned="BD18205_.WMF" [0053.985] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.985] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.985] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.985] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.985] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18206_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF" [0053.985] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5e8e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf5e8e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xfbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18207_.WMF", cAlternateFileName="")) returned 1 [0053.985] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.985] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18207_.WMF") returned 1 [0053.985] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18207_.WMF") returned 1 [0053.985] lstrcmpiA (lpString1="", lpString2="BD18207_.WMF") returned -1 [0053.985] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF") returned="BD18206_.WMF" [0053.985] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.985] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.985] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.985] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.985] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18207_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF" [0053.985] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f714100, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4f714100, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x1b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18208_.WMF", cAlternateFileName="")) returned 1 [0053.986] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.986] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18208_.WMF") returned 1 [0053.986] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18208_.WMF") returned 1 [0053.986] lstrcmpiA (lpString1="", lpString2="BD18208_.WMF") returned -1 [0053.986] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF") returned="BD18207_.WMF" [0053.986] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.986] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.986] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.986] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.987] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18208_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF" [0053.987] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96603600, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x96603600, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xc6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18209_.WMF", cAlternateFileName="")) returned 1 [0053.987] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.987] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18209_.WMF") returned 1 [0053.987] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18209_.WMF") returned 1 [0053.987] lstrcmpiA (lpString1="", lpString2="BD18209_.WMF") returned -1 [0053.987] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF") returned="BD18208_.WMF" [0053.988] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.988] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.988] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18209_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF" [0053.988] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28673f00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x28673f00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xc4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18210_.WMF", cAlternateFileName="")) returned 1 [0053.988] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.988] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18210_.WMF") returned 1 [0053.988] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18210_.WMF") returned 1 [0053.988] lstrcmpiA (lpString1="", lpString2="BD18210_.WMF") returned -1 [0053.988] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF") returned="BD18209_.WMF" [0053.988] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.988] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.988] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18210_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF" [0053.988] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea699700, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xea699700, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18211_.WMF", cAlternateFileName="")) returned 1 [0053.988] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.989] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18211_.WMF") returned 1 [0053.989] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18211_.WMF") returned 1 [0053.989] lstrcmpiA (lpString1="", lpString2="BD18211_.WMF") returned -1 [0053.989] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF") returned="BD18210_.WMF" [0053.989] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.989] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.989] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.989] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.989] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18211_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF" [0053.989] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85941c00, ftCreationTime.dwHighDateTime=0x1bddca6, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85941c00, ftLastWriteTime.dwHighDateTime=0x1bddca6, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18212_.WMF", cAlternateFileName="")) returned 1 [0053.989] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.989] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18212_.WMF") returned 1 [0053.989] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18212_.WMF") returned 1 [0053.989] lstrcmpiA (lpString1="", lpString2="BD18212_.WMF") returned -1 [0053.989] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF") returned="BD18211_.WMF" [0053.989] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.989] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.989] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.989] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.989] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18212_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF" [0053.990] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1638d100, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1638d100, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x704, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18213_.WMF", cAlternateFileName="")) returned 1 [0053.990] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0053.990] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18213_.WMF") returned 1 [0053.990] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18213_.WMF") returned 1 [0053.990] lstrcmpiA (lpString1="", lpString2="BD18213_.WMF") returned -1 [0053.990] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF") returned="BD18212_.WMF" [0053.990] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0053.990] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0053.990] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0053.990] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0053.990] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18213_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF" [0053.990] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c0d7900, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6c0d7900, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18214_.WMF", cAlternateFileName="")) returned 1 [0053.990] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.008] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18214_.WMF") returned 1 [0054.008] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18214_.WMF") returned 1 [0054.008] lstrcmpiA (lpString1="", lpString2="BD18214_.WMF") returned -1 [0054.008] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF") returned="BD18213_.WMF" [0054.008] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.008] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.009] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.009] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.009] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18214_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF" [0054.009] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b613000, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2b613000, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x6a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18215_.WMF", cAlternateFileName="")) returned 1 [0054.009] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.009] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18215_.WMF") returned 1 [0054.009] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18215_.WMF") returned 1 [0054.009] lstrcmpiA (lpString1="", lpString2="BD18215_.WMF") returned -1 [0054.009] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF") returned="BD18214_.WMF" [0054.009] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.009] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.009] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.009] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.009] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18215_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF" [0054.010] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cab3c00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3cab3c00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x726, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18216_.WMF", cAlternateFileName="")) returned 1 [0054.010] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.010] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18216_.WMF") returned 1 [0054.010] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18216_.WMF") returned 1 [0054.010] lstrcmpiA (lpString1="", lpString2="BD18216_.WMF") returned -1 [0054.010] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF") returned="BD18215_.WMF" [0054.010] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.010] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.010] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.010] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.010] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18216_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF" [0054.010] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded1d00, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7ded1d00, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0x1552, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18217_.WMF", cAlternateFileName="")) returned 1 [0054.010] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.010] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18217_.WMF") returned 1 [0054.010] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18217_.WMF") returned 1 [0054.010] lstrcmpiA (lpString1="", lpString2="BD18217_.WMF") returned -1 [0054.010] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF") returned="BD18216_.WMF" [0054.010] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.010] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.011] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.011] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.011] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18217_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF" [0054.011] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fcec000, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8fcec000, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0x1212, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18218_.WMF", cAlternateFileName="")) returned 1 [0054.011] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.011] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18218_.WMF") returned 1 [0054.011] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18218_.WMF") returned 1 [0054.011] lstrcmpiA (lpString1="", lpString2="BD18218_.WMF") returned -1 [0054.011] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF") returned="BD18217_.WMF" [0054.011] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.011] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.011] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.011] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.011] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18218_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF" [0054.011] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f247600, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4f247600, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x1136, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18219_.WMF", cAlternateFileName="")) returned 1 [0054.011] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.011] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18219_.WMF") returned 1 [0054.011] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18219_.WMF") returned 1 [0054.012] lstrcmpiA (lpString1="", lpString2="BD18219_.WMF") returned -1 [0054.012] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF") returned="BD18218_.WMF" [0054.012] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.012] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.012] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.012] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.012] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18219_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF" [0054.012] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aadf500, ftCreationTime.dwHighDateTime=0x1bddca5, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2aadf500, ftLastWriteTime.dwHighDateTime=0x1bddca5, nFileSizeHigh=0x0, nFileSizeLow=0x213c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18220_.WMF", cAlternateFileName="")) returned 1 [0054.012] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.012] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18220_.WMF") returned 1 [0054.012] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18220_.WMF") returned 1 [0054.012] lstrcmpiA (lpString1="", lpString2="BD18220_.WMF") returned -1 [0054.012] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF") returned="BD18219_.WMF" [0054.012] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.012] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.012] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.012] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.012] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18220_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF" [0054.013] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0346a00, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa0346a00, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x72c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18221_.WMF", cAlternateFileName="")) returned 1 [0054.013] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.013] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18221_.WMF") returned 1 [0054.013] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18221_.WMF") returned 1 [0054.013] lstrcmpiA (lpString1="", lpString2="BD18221_.WMF") returned -1 [0054.013] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF") returned="BD18220_.WMF" [0054.013] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.013] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.013] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.013] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.013] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18221_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF" [0054.013] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5a99400, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb5a99400, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x756, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18222_.WMF", cAlternateFileName="")) returned 1 [0054.013] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.013] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18222_.WMF") returned 1 [0054.013] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18222_.WMF") returned 1 [0054.013] lstrcmpiA (lpString1="", lpString2="BD18222_.WMF") returned -1 [0054.013] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF") returned="BD18221_.WMF" [0054.013] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.013] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.013] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.013] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.014] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18222_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF" [0054.014] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ee4c100, ftCreationTime.dwHighDateTime=0x1bddb92, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ee4c100, ftLastWriteTime.dwHighDateTime=0x1bddb92, nFileSizeHigh=0x0, nFileSizeLow=0xc5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18223_.WMF", cAlternateFileName="")) returned 1 [0054.014] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.014] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18223_.WMF") returned 1 [0054.014] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18223_.WMF") returned 1 [0054.014] lstrcmpiA (lpString1="", lpString2="BD18223_.WMF") returned -1 [0054.014] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF") returned="BD18222_.WMF" [0054.014] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.014] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.014] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.014] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.014] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18223_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF" [0054.014] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9730600, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa9730600, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x680, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18224_.WMF", cAlternateFileName="")) returned 1 [0054.014] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.014] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18224_.WMF") returned 1 [0054.014] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18224_.WMF") returned 1 [0054.014] lstrcmpiA (lpString1="", lpString2="BD18224_.WMF") returned -1 [0054.014] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF") returned="BD18223_.WMF" [0054.014] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.015] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.015] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.015] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.015] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18224_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF" [0054.015] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2357bf00, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2357bf00, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0xd10, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18225_.WMF", cAlternateFileName="")) returned 1 [0054.015] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.015] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18225_.WMF") returned 1 [0054.015] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18225_.WMF") returned 1 [0054.015] lstrcmpiA (lpString1="", lpString2="BD18225_.WMF") returned -1 [0054.015] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF") returned="BD18224_.WMF" [0054.015] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.015] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.015] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.015] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.015] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18225_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF" [0054.015] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d10e600, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4d10e600, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x7b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18226_.WMF", cAlternateFileName="")) returned 1 [0054.015] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.015] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18226_.WMF") returned 1 [0054.016] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18226_.WMF") returned 1 [0054.016] lstrcmpiA (lpString1="", lpString2="BD18226_.WMF") returned -1 [0054.016] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF") returned="BD18225_.WMF" [0054.016] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.016] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.016] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.016] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.016] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18226_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF" [0054.016] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e4fd00, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x83e4fd00, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0xdec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18227_.WMF", cAlternateFileName="")) returned 1 [0054.016] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.016] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18227_.WMF") returned 1 [0054.016] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18227_.WMF") returned 1 [0054.016] lstrcmpiA (lpString1="", lpString2="BD18227_.WMF") returned -1 [0054.016] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF") returned="BD18226_.WMF" [0054.016] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.016] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.016] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.016] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.016] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18227_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF" [0054.017] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb337000, ftCreationTime.dwHighDateTime=0x1bdcf22, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb337000, ftLastWriteTime.dwHighDateTime=0x1bdcf22, nFileSizeHigh=0x0, nFileSizeLow=0x884, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18228_.WMF", cAlternateFileName="")) returned 1 [0054.017] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.017] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18228_.WMF") returned 1 [0054.017] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18228_.WMF") returned 1 [0054.017] lstrcmpiA (lpString1="", lpString2="BD18228_.WMF") returned -1 [0054.017] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF") returned="BD18227_.WMF" [0054.017] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.017] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.017] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.017] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.017] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18228_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF" [0054.017] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3405b200, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3405b200, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18229_.WMF", cAlternateFileName="")) returned 1 [0054.017] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.018] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18229_.WMF") returned 1 [0054.018] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18229_.WMF") returned 1 [0054.018] lstrcmpiA (lpString1="", lpString2="BD18229_.WMF") returned -1 [0054.018] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF") returned="BD18228_.WMF" [0054.018] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.018] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.018] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.018] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.018] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18229_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF" [0054.018] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef2cd000, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xef2cd000, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0x724, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18230_.WMF", cAlternateFileName="")) returned 1 [0054.018] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.018] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18230_.WMF") returned 1 [0054.018] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18230_.WMF") returned 1 [0054.018] lstrcmpiA (lpString1="", lpString2="BD18230_.WMF") returned -1 [0054.018] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF") returned="BD18229_.WMF" [0054.018] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.018] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.018] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.018] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.018] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18230_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF" [0054.019] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa3500, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcfa3500, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x67c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18231_.WMF", cAlternateFileName="")) returned 1 [0054.019] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.019] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18231_.WMF") returned 1 [0054.019] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18231_.WMF") returned 1 [0054.019] lstrcmpiA (lpString1="", lpString2="BD18231_.WMF") returned -1 [0054.019] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF") returned="BD18230_.WMF" [0054.019] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.019] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.019] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.019] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.019] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18231_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF" [0054.019] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4763d200, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4763d200, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18232_.WMF", cAlternateFileName="")) returned 1 [0054.019] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.019] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18232_.WMF") returned 1 [0054.019] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18232_.WMF") returned 1 [0054.019] lstrcmpiA (lpString1="", lpString2="BD18232_.WMF") returned -1 [0054.019] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF") returned="BD18231_.WMF" [0054.019] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.019] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.019] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.020] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.020] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18232_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF" [0054.020] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a76a200, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5a76a200, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18233_.WMF", cAlternateFileName="")) returned 1 [0054.020] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.020] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18233_.WMF") returned 1 [0054.020] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18233_.WMF") returned 1 [0054.020] lstrcmpiA (lpString1="", lpString2="BD18233_.WMF") returned -1 [0054.020] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF") returned="BD18232_.WMF" [0054.020] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.020] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.020] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.020] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.020] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18233_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF" [0054.020] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eba9f00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6eba9f00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x754, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18234_.WMF", cAlternateFileName="")) returned 1 [0054.020] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.020] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18234_.WMF") returned 1 [0054.020] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18234_.WMF") returned 1 [0054.020] lstrcmpiA (lpString1="", lpString2="BD18234_.WMF") returned -1 [0054.020] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF") returned="BD18233_.WMF" [0054.021] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.021] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.021] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.021] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.021] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18234_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF" [0054.021] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a25aa00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8a25aa00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18235_.WMF", cAlternateFileName="")) returned 1 [0054.021] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.021] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18235_.WMF") returned 1 [0054.021] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18235_.WMF") returned 1 [0054.021] lstrcmpiA (lpString1="", lpString2="BD18235_.WMF") returned -1 [0054.021] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF") returned="BD18234_.WMF" [0054.021] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.021] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.021] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.021] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.021] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18235_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF" [0054.021] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f9ad400, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9f9ad400, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x6d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18236_.WMF", cAlternateFileName="")) returned 1 [0054.021] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.022] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18236_.WMF") returned 1 [0054.022] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18236_.WMF") returned 1 [0054.022] lstrcmpiA (lpString1="", lpString2="BD18236_.WMF") returned -1 [0054.022] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF") returned="BD18235_.WMF" [0054.022] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.022] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.022] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.022] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.022] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18236_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF" [0054.022] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29966d00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29966d00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x5fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18237_.WMF", cAlternateFileName="")) returned 1 [0054.022] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.022] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18237_.WMF") returned 1 [0054.022] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18237_.WMF") returned 1 [0054.022] lstrcmpiA (lpString1="", lpString2="BD18237_.WMF") returned -1 [0054.022] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF") returned="BD18236_.WMF" [0054.022] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.022] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.022] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.022] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.023] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18237_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF" [0054.023] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb50ffe00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb50ffe00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18238_.WMF", cAlternateFileName="")) returned 1 [0054.023] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.023] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18238_.WMF") returned 1 [0054.023] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18238_.WMF") returned 1 [0054.023] lstrcmpiA (lpString1="", lpString2="BD18238_.WMF") returned -1 [0054.023] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF") returned="BD18237_.WMF" [0054.023] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.023] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.023] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.023] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.023] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18238_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF" [0054.023] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9086900, ftCreationTime.dwHighDateTime=0x1bddcaa, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd9086900, ftLastWriteTime.dwHighDateTime=0x1bddcaa, nFileSizeHigh=0x0, nFileSizeLow=0x93c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18239_.WMF", cAlternateFileName="")) returned 1 [0054.023] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.023] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18239_.WMF") returned 1 [0054.023] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18239_.WMF") returned 1 [0054.023] lstrcmpiA (lpString1="", lpString2="BD18239_.WMF") returned -1 [0054.023] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF") returned="BD18238_.WMF" [0054.023] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.023] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.024] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18239_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF" [0054.024] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2305400, ftCreationTime.dwHighDateTime=0x1bddca6, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa2305400, ftLastWriteTime.dwHighDateTime=0x1bddca6, nFileSizeHigh=0x0, nFileSizeLow=0xac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18241_.WMF", cAlternateFileName="")) returned 1 [0054.024] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.024] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18241_.WMF") returned 1 [0054.024] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18241_.WMF") returned 1 [0054.024] lstrcmpiA (lpString1="", lpString2="BD18241_.WMF") returned -1 [0054.024] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF") returned="BD18239_.WMF" [0054.024] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.024] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.024] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18241_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF" [0054.024] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a42b600, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6a42b600, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18242_.WMF", cAlternateFileName="")) returned 1 [0054.024] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.024] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18242_.WMF") returned 1 [0054.024] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18242_.WMF") returned 1 [0054.025] lstrcmpiA (lpString1="", lpString2="BD18242_.WMF") returned -1 [0054.025] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF") returned="BD18241_.WMF" [0054.025] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.025] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.025] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18242_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF" [0054.025] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fb7e000, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fb7e000, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18243_.WMF", cAlternateFileName="")) returned 1 [0054.025] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.025] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18243_.WMF") returned 1 [0054.025] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18243_.WMF") returned 1 [0054.025] lstrcmpiA (lpString1="", lpString2="BD18243_.WMF") returned -1 [0054.025] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF") returned="BD18242_.WMF" [0054.025] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.025] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.025] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18243_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF" [0054.026] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d151300, ftCreationTime.dwHighDateTime=0x1bdcf22, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1d151300, ftLastWriteTime.dwHighDateTime=0x1bdcf22, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18244_.WMF", cAlternateFileName="")) returned 1 [0054.026] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.026] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18244_.WMF") returned 1 [0054.026] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18244_.WMF") returned 1 [0054.026] lstrcmpiA (lpString1="", lpString2="BD18244_.WMF") returned -1 [0054.026] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF") returned="BD18243_.WMF" [0054.026] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.026] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.026] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18244_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF" [0054.026] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3027e300, ftCreationTime.dwHighDateTime=0x1bdcf22, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3027e300, ftLastWriteTime.dwHighDateTime=0x1bdcf22, nFileSizeHigh=0x0, nFileSizeLow=0xea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18245_.WMF", cAlternateFileName="")) returned 1 [0054.026] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.026] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18245_.WMF") returned 1 [0054.026] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18245_.WMF") returned 1 [0054.026] lstrcmpiA (lpString1="", lpString2="BD18245_.WMF") returned -1 [0054.026] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF") returned="BD18244_.WMF" [0054.026] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.026] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.026] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18245_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF" [0054.027] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc4feb00, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcc4feb00, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18246_.WMF", cAlternateFileName="")) returned 1 [0054.027] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.027] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18246_.WMF") returned 1 [0054.027] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18246_.WMF") returned 1 [0054.027] lstrcmpiA (lpString1="", lpString2="BD18246_.WMF") returned -1 [0054.027] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF") returned="BD18245_.WMF" [0054.027] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.027] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.027] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18246_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF" [0054.027] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba237c00, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xba237c00, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xd68, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18247_.WMF", cAlternateFileName="")) returned 1 [0054.027] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.027] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18247_.WMF") returned 1 [0054.027] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18247_.WMF") returned 1 [0054.027] lstrcmpiA (lpString1="", lpString2="BD18247_.WMF") returned -1 [0054.027] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF") returned="BD18246_.WMF" [0054.027] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.028] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.028] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18247_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF" [0054.028] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd364c00, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcd364c00, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xd70, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18248_.WMF", cAlternateFileName="")) returned 1 [0054.028] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.028] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18248_.WMF") returned 1 [0054.028] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18248_.WMF") returned 1 [0054.028] lstrcmpiA (lpString1="", lpString2="BD18248_.WMF") returned -1 [0054.028] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF") returned="BD18247_.WMF" [0054.028] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.028] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.028] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18248_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF" [0054.028] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2f4300, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3b2f4300, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x8a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18249_.WMF", cAlternateFileName="")) returned 1 [0054.028] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.028] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18249_.WMF") returned 1 [0054.029] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18249_.WMF") returned 1 [0054.029] lstrcmpiA (lpString1="", lpString2="BD18249_.WMF") returned -1 [0054.029] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF") returned="BD18248_.WMF" [0054.029] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.029] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.029] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.029] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.029] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18249_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF" [0054.029] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf17ef00, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf17ef00, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x142e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18250_.WMF", cAlternateFileName="")) returned 1 [0054.029] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.029] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18250_.WMF") returned 1 [0054.029] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18250_.WMF") returned 1 [0054.029] lstrcmpiA (lpString1="", lpString2="BD18250_.WMF") returned -1 [0054.029] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF") returned="BD18249_.WMF" [0054.029] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.029] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.029] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.029] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.029] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18250_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF" [0054.030] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefc86500, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xefc86500, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18251_.WMF", cAlternateFileName="")) returned 1 [0054.030] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.030] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18251_.WMF") returned 1 [0054.030] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18251_.WMF") returned 1 [0054.030] lstrcmpiA (lpString1="", lpString2="BD18251_.WMF") returned -1 [0054.030] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF") returned="BD18250_.WMF" [0054.030] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.030] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.030] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.030] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.030] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18251_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF" [0054.030] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8ec2300, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe8ec2300, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x756, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18252_.WMF", cAlternateFileName="")) returned 1 [0054.030] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.030] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18252_.WMF") returned 1 [0054.030] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18252_.WMF") returned 1 [0054.030] lstrcmpiA (lpString1="", lpString2="BD18252_.WMF") returned -1 [0054.030] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF") returned="BD18251_.WMF" [0054.030] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.030] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.031] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.031] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.031] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18252_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF" [0054.031] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb803b00, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb803b00, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x6ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18253_.WMF", cAlternateFileName="")) returned 1 [0054.031] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.031] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18253_.WMF") returned 1 [0054.031] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18253_.WMF") returned 1 [0054.031] lstrcmpiA (lpString1="", lpString2="BD18253_.WMF") returned -1 [0054.031] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF") returned="BD18252_.WMF" [0054.031] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.031] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.031] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.031] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.031] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18253_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF" [0054.031] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bca4100, ftCreationTime.dwHighDateTime=0x1bddcab, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1bca4100, ftLastWriteTime.dwHighDateTime=0x1bddcab, nFileSizeHigh=0x0, nFileSizeLow=0x796, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18254_.WMF", cAlternateFileName="")) returned 1 [0054.031] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.031] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18254_.WMF") returned 1 [0054.031] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18254_.WMF") returned 1 [0054.031] lstrcmpiA (lpString1="", lpString2="BD18254_.WMF") returned -1 [0054.032] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF") returned="BD18253_.WMF" [0054.032] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.032] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.032] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.032] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.032] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18254_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF" [0054.032] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55feb900, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x55feb900, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18255_.WMF", cAlternateFileName="")) returned 1 [0054.032] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.032] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18255_.WMF") returned 1 [0054.032] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18255_.WMF") returned 1 [0054.032] lstrcmpiA (lpString1="", lpString2="BD18255_.WMF") returned -1 [0054.032] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF") returned="BD18254_.WMF" [0054.032] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.032] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.032] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.032] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.032] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18255_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF" [0054.032] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7a21700, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd7a21700, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x8ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18256_.WMF", cAlternateFileName="")) returned 1 [0054.032] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.033] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18256_.WMF") returned 1 [0054.033] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18256_.WMF") returned 1 [0054.033] lstrcmpiA (lpString1="", lpString2="BD18256_.WMF") returned -1 [0054.033] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF") returned="BD18255_.WMF" [0054.033] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.033] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.033] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.033] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.033] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18256_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF" [0054.033] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd83b2900, ftCreationTime.dwHighDateTime=0x1bdfe4b, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd83b2900, ftLastWriteTime.dwHighDateTime=0x1bdfe4b, nFileSizeHigh=0x0, nFileSizeLow=0x12ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18257_.WMF", cAlternateFileName="")) returned 1 [0054.033] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.033] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD18257_.WMF") returned 1 [0054.033] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD18257_.WMF") returned 1 [0054.033] lstrcmpiA (lpString1="", lpString2="BD18257_.WMF") returned -1 [0054.033] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF") returned="BD18256_.WMF" [0054.033] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0054.033] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="" [0054.033] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" [0054.034] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\how to decrypt files.txt")) returned 0x20 [0054.034] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", lpString2="BD18257_.WMF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF" [0054.034] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x360, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0054.034] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.034] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0054.034] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0054.034] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x360, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 0 [0054.034] FindClose (in: hFindFile=0x2d7ff8 | out: hFindFile=0x2d7ff8) returned 1 [0054.034] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd42e760, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="BULLETS", cAlternateFileName="")) returned 1 [0054.034] lstrcmpA (lpString1=".", lpString2="BULLETS") returned -1 [0054.034] lstrcmpA (lpString1="..", lpString2="BULLETS") returned -1 [0054.034] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*.*") returned="*.*" [0054.034] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\", lpString2="BULLETS" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0054.035] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd42e760, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f66c, dwReserved1=0x4f0048, cFileName=".", cAlternateFileName="")) returned 0x2d7ff8 [0054.039] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0054.039] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd42e760, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.040] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0054.040] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0054.040] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x992c8400, ftCreationTime.dwHighDateTime=0x1bd5de4, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x992c8400, ftLastWriteTime.dwHighDateTime=0x1bd5de4, nFileSizeHigh=0x0, nFileSizeLow=0x967, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BD10253_.GIF", cAlternateFileName="")) returned 1 [0054.040] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.040] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD10253_.GIF") returned 1 [0054.040] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10253_.GIF") returned 1 [0054.040] lstrcmpiA (lpString1="", lpString2="BD10253_.GIF") returned -1 [0054.040] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*") returned="*.*" [0054.040] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.040] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.040] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.040] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0xffffffff [0054.041] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.046] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0054.046] CloseHandle (hObject=0x90) returned 1 [0054.050] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD10253_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF" [0054.050] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF" [0054.051] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF" [0054.051] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF." [0054.051] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF.wannacry" [0054.051] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10253_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.052] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x967 [0054.052] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x992c8400, dwHighDateTime=0x1bd5de4), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc847960, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x992c8400, dwHighDateTime=0x1bd5de4)) returned 1 [0054.052] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.052] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x8e9, lpOverlapped=0x0) returned 1 [0054.054] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF") returned="BD10253_.GIF" [0054.054] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.054] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x8e9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x8e9, lpOverlapped=0x0) returned 1 [0054.055] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.055] CloseHandle (hObject=0x90) returned 1 [0054.056] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10253_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10253_.gif.wannacry")) returned 1 [0054.057] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dec3400, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5dec3400, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD10254_.GIF", cAlternateFileName="")) returned 1 [0054.057] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.057] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD10254_.GIF") returned 1 [0054.057] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10254_.GIF") returned 1 [0054.057] lstrcmpiA (lpString1="", lpString2="BD10254_.GIF") returned -1 [0054.057] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF") returned="BD10253_.GIF" [0054.057] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.057] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.057] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD10254_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF" [0054.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF", pszSpec="*.zip") returned 0 [0054.057] lstrlenA (lpString="*.zip") returned 5 [0054.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF", pszSpec="*.rar") returned 0 [0054.057] lstrlenA (lpString="*.rar") returned 5 [0054.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF", pszSpec="*.7z") returned 0 [0054.058] lstrlenA (lpString="*.7z") returned 4 [0054.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF", pszSpec="*.tar") returned 0 [0054.058] lstrlenA (lpString="*.tar") returned 5 [0054.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF", pszSpec="*.gzip") returned 0 [0054.058] lstrlenA (lpString="*.gzip") returned 6 [0054.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF", pszSpec="*.jpg") returned 0 [0054.058] lstrlenA (lpString="*.jpg") returned 5 [0054.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF", pszSpec="*.jpeg") returned 0 [0054.058] lstrlenA (lpString="*.jpeg") returned 6 [0054.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF", pszSpec="*.psd") returned 0 [0054.058] lstrlenA (lpString="*.psd") returned 5 [0054.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF", pszSpec="*.gif") returned 1 [0054.058] lstrlenA (lpString="*.gif") returned 5 [0054.058] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF" [0054.058] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF" [0054.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF." [0054.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF.wannacry" [0054.058] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10254_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.059] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf0 [0054.060] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5dec3400, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc847960, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5dec3400, dwHighDateTime=0x1bd8f92)) returned 1 [0054.060] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.060] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x72, lpOverlapped=0x0) returned 1 [0054.061] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF") returned="BD10254_.GIF" [0054.061] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.061] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x72, lpOverlapped=0x0) returned 1 [0054.061] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.061] CloseHandle (hObject=0x90) returned 1 [0054.062] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10254_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10254_.gif.wannacry")) returned 1 [0054.063] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f1d6100, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f1d6100, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD10255_.GIF", cAlternateFileName="")) returned 1 [0054.063] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.063] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD10255_.GIF") returned 1 [0054.063] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10255_.GIF") returned 1 [0054.063] lstrcmpiA (lpString1="", lpString2="BD10255_.GIF") returned -1 [0054.063] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF") returned="BD10254_.GIF" [0054.063] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.063] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.063] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.063] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.064] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD10255_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF" [0054.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF", pszSpec="*.zip") returned 0 [0054.064] lstrlenA (lpString="*.zip") returned 5 [0054.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF", pszSpec="*.rar") returned 0 [0054.064] lstrlenA (lpString="*.rar") returned 5 [0054.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF", pszSpec="*.7z") returned 0 [0054.064] lstrlenA (lpString="*.7z") returned 4 [0054.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF", pszSpec="*.tar") returned 0 [0054.064] lstrlenA (lpString="*.tar") returned 5 [0054.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF", pszSpec="*.gzip") returned 0 [0054.064] lstrlenA (lpString="*.gzip") returned 6 [0054.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF", pszSpec="*.jpg") returned 0 [0054.064] lstrlenA (lpString="*.jpg") returned 5 [0054.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF", pszSpec="*.jpeg") returned 0 [0054.064] lstrlenA (lpString="*.jpeg") returned 6 [0054.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF", pszSpec="*.psd") returned 0 [0054.064] lstrlenA (lpString="*.psd") returned 5 [0054.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF", pszSpec="*.gif") returned 1 [0054.064] lstrlenA (lpString="*.gif") returned 5 [0054.064] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF" [0054.064] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF" [0054.064] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF." [0054.064] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF.wannacry" [0054.065] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10255_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.065] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xea [0054.065] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5f1d6100, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc847960, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5f1d6100, dwHighDateTime=0x1bd8f92)) returned 1 [0054.065] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.065] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x6c, lpOverlapped=0x0) returned 1 [0054.066] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF") returned="BD10255_.GIF" [0054.066] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.066] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x6c, lpOverlapped=0x0) returned 1 [0054.067] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.067] CloseHandle (hObject=0x90) returned 1 [0054.071] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10255_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10255_.gif.wannacry")) returned 1 [0054.072] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe10b8b00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe10b8b00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD10263_.GIF", cAlternateFileName="")) returned 1 [0054.072] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.072] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD10263_.GIF") returned 1 [0054.072] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10263_.GIF") returned 1 [0054.072] lstrcmpiA (lpString1="", lpString2="BD10263_.GIF") returned -1 [0054.072] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF") returned="BD10255_.GIF" [0054.072] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.072] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.072] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.072] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.072] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD10263_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF" [0054.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF", pszSpec="*.zip") returned 0 [0054.072] lstrlenA (lpString="*.zip") returned 5 [0054.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF", pszSpec="*.rar") returned 0 [0054.072] lstrlenA (lpString="*.rar") returned 5 [0054.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF", pszSpec="*.7z") returned 0 [0054.072] lstrlenA (lpString="*.7z") returned 4 [0054.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF", pszSpec="*.tar") returned 0 [0054.072] lstrlenA (lpString="*.tar") returned 5 [0054.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF", pszSpec="*.gzip") returned 0 [0054.073] lstrlenA (lpString="*.gzip") returned 6 [0054.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF", pszSpec="*.jpg") returned 0 [0054.073] lstrlenA (lpString="*.jpg") returned 5 [0054.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF", pszSpec="*.jpeg") returned 0 [0054.073] lstrlenA (lpString="*.jpeg") returned 6 [0054.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF", pszSpec="*.psd") returned 0 [0054.073] lstrlenA (lpString="*.psd") returned 5 [0054.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF", pszSpec="*.gif") returned 1 [0054.073] lstrlenA (lpString="*.gif") returned 5 [0054.073] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF" [0054.073] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF" [0054.073] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF." [0054.073] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF.wannacry" [0054.073] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10263_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.074] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x297 [0054.074] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe10b8b00, dwHighDateTime=0x1bd8f8e), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc86dac0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe10b8b00, dwHighDateTime=0x1bd8f8e)) returned 1 [0054.075] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.075] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x219, lpOverlapped=0x0) returned 1 [0054.076] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF") returned="BD10263_.GIF" [0054.076] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.076] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x219, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x219, lpOverlapped=0x0) returned 1 [0054.076] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.076] CloseHandle (hObject=0x90) returned 1 [0054.077] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10263_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10263_.gif.wannacry")) returned 1 [0054.081] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe10b8b00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe10b8b00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD10264_.GIF", cAlternateFileName="")) returned 1 [0054.081] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.081] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD10264_.GIF") returned 1 [0054.082] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10264_.GIF") returned 1 [0054.082] lstrcmpiA (lpString1="", lpString2="BD10264_.GIF") returned -1 [0054.082] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF") returned="BD10263_.GIF" [0054.082] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.082] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.082] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.082] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.082] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD10264_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF" [0054.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF", pszSpec="*.zip") returned 0 [0054.082] lstrlenA (lpString="*.zip") returned 5 [0054.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF", pszSpec="*.rar") returned 0 [0054.082] lstrlenA (lpString="*.rar") returned 5 [0054.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF", pszSpec="*.7z") returned 0 [0054.082] lstrlenA (lpString="*.7z") returned 4 [0054.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF", pszSpec="*.tar") returned 0 [0054.082] lstrlenA (lpString="*.tar") returned 5 [0054.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF", pszSpec="*.gzip") returned 0 [0054.082] lstrlenA (lpString="*.gzip") returned 6 [0054.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF", pszSpec="*.jpg") returned 0 [0054.082] lstrlenA (lpString="*.jpg") returned 5 [0054.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF", pszSpec="*.jpeg") returned 0 [0054.082] lstrlenA (lpString="*.jpeg") returned 6 [0054.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF", pszSpec="*.psd") returned 0 [0054.083] lstrlenA (lpString="*.psd") returned 5 [0054.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF", pszSpec="*.gif") returned 1 [0054.083] lstrlenA (lpString="*.gif") returned 5 [0054.083] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF" [0054.083] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF" [0054.083] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF." [0054.083] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF.wannacry" [0054.083] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10264_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.083] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9 [0054.083] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe10b8b00, dwHighDateTime=0x1bd8f8e), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc86dac0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe10b8b00, dwHighDateTime=0x1bd8f8e)) returned 1 [0054.083] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.084] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3b, lpOverlapped=0x0) returned 1 [0054.085] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF") returned="BD10264_.GIF" [0054.085] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.085] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3b, lpOverlapped=0x0) returned 1 [0054.085] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.085] CloseHandle (hObject=0x90) returned 1 [0054.087] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10264_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10264_.gif.wannacry")) returned 1 [0054.088] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe10b8b00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe10b8b00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x134, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD10265_.GIF", cAlternateFileName="")) returned 1 [0054.088] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.088] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD10265_.GIF") returned 1 [0054.088] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10265_.GIF") returned 1 [0054.088] lstrcmpiA (lpString1="", lpString2="BD10265_.GIF") returned -1 [0054.088] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF") returned="BD10264_.GIF" [0054.088] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.088] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.088] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.088] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.088] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD10265_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF" [0054.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF", pszSpec="*.zip") returned 0 [0054.088] lstrlenA (lpString="*.zip") returned 5 [0054.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF", pszSpec="*.rar") returned 0 [0054.088] lstrlenA (lpString="*.rar") returned 5 [0054.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF", pszSpec="*.7z") returned 0 [0054.088] lstrlenA (lpString="*.7z") returned 4 [0054.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF", pszSpec="*.tar") returned 0 [0054.088] lstrlenA (lpString="*.tar") returned 5 [0054.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF", pszSpec="*.gzip") returned 0 [0054.088] lstrlenA (lpString="*.gzip") returned 6 [0054.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF", pszSpec="*.jpg") returned 0 [0054.089] lstrlenA (lpString="*.jpg") returned 5 [0054.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF", pszSpec="*.jpeg") returned 0 [0054.089] lstrlenA (lpString="*.jpeg") returned 6 [0054.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF", pszSpec="*.psd") returned 0 [0054.089] lstrlenA (lpString="*.psd") returned 5 [0054.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF", pszSpec="*.gif") returned 1 [0054.089] lstrlenA (lpString="*.gif") returned 5 [0054.089] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF" [0054.089] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF" [0054.089] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF." [0054.089] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF.wannacry" [0054.089] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10265_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.091] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x134 [0054.091] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe10b8b00, dwHighDateTime=0x1bd8f8e), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc86dac0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe10b8b00, dwHighDateTime=0x1bd8f8e)) returned 1 [0054.091] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.091] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xb6, lpOverlapped=0x0) returned 1 [0054.092] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF") returned="BD10265_.GIF" [0054.092] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.092] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xb6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xb6, lpOverlapped=0x0) returned 1 [0054.093] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.093] CloseHandle (hObject=0x90) returned 1 [0054.095] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10265_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10265_.gif.wannacry")) returned 1 [0054.095] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23cb800, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe23cb800, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD10266_.GIF", cAlternateFileName="")) returned 1 [0054.095] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.095] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD10266_.GIF") returned 1 [0054.095] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10266_.GIF") returned 1 [0054.095] lstrcmpiA (lpString1="", lpString2="BD10266_.GIF") returned -1 [0054.095] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF") returned="BD10265_.GIF" [0054.096] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.096] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.096] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.096] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.096] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD10266_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF" [0054.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF", pszSpec="*.zip") returned 0 [0054.096] lstrlenA (lpString="*.zip") returned 5 [0054.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF", pszSpec="*.rar") returned 0 [0054.096] lstrlenA (lpString="*.rar") returned 5 [0054.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF", pszSpec="*.7z") returned 0 [0054.096] lstrlenA (lpString="*.7z") returned 4 [0054.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF", pszSpec="*.tar") returned 0 [0054.096] lstrlenA (lpString="*.tar") returned 5 [0054.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF", pszSpec="*.gzip") returned 0 [0054.096] lstrlenA (lpString="*.gzip") returned 6 [0054.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF", pszSpec="*.jpg") returned 0 [0054.096] lstrlenA (lpString="*.jpg") returned 5 [0054.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF", pszSpec="*.jpeg") returned 0 [0054.096] lstrlenA (lpString="*.jpeg") returned 6 [0054.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF", pszSpec="*.psd") returned 0 [0054.096] lstrlenA (lpString="*.psd") returned 5 [0054.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF", pszSpec="*.gif") returned 1 [0054.096] lstrlenA (lpString="*.gif") returned 5 [0054.096] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF" [0054.096] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF" [0054.096] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF." [0054.096] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF.wannacry" [0054.096] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10266_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.097] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb1 [0054.097] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe23cb800, dwHighDateTime=0x1bd8f8e), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc86dac0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe23cb800, dwHighDateTime=0x1bd8f8e)) returned 1 [0054.097] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.097] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x33, lpOverlapped=0x0) returned 1 [0054.098] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF") returned="BD10266_.GIF" [0054.098] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.098] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x33, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x33, lpOverlapped=0x0) returned 1 [0054.098] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.098] CloseHandle (hObject=0x90) returned 1 [0054.099] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10266_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10266_.gif.wannacry")) returned 1 [0054.100] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23cb800, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe23cb800, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x137, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD10267_.GIF", cAlternateFileName="")) returned 1 [0054.100] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.100] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD10267_.GIF") returned 1 [0054.100] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10267_.GIF") returned 1 [0054.100] lstrcmpiA (lpString1="", lpString2="BD10267_.GIF") returned -1 [0054.100] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF") returned="BD10266_.GIF" [0054.100] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.100] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.100] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.100] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.100] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD10267_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF" [0054.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF", pszSpec="*.zip") returned 0 [0054.100] lstrlenA (lpString="*.zip") returned 5 [0054.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF", pszSpec="*.rar") returned 0 [0054.101] lstrlenA (lpString="*.rar") returned 5 [0054.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF", pszSpec="*.7z") returned 0 [0054.101] lstrlenA (lpString="*.7z") returned 4 [0054.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF", pszSpec="*.tar") returned 0 [0054.101] lstrlenA (lpString="*.tar") returned 5 [0054.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF", pszSpec="*.gzip") returned 0 [0054.101] lstrlenA (lpString="*.gzip") returned 6 [0054.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF", pszSpec="*.jpg") returned 0 [0054.101] lstrlenA (lpString="*.jpg") returned 5 [0054.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF", pszSpec="*.jpeg") returned 0 [0054.101] lstrlenA (lpString="*.jpeg") returned 6 [0054.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF", pszSpec="*.psd") returned 0 [0054.101] lstrlenA (lpString="*.psd") returned 5 [0054.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF", pszSpec="*.gif") returned 1 [0054.101] lstrlenA (lpString="*.gif") returned 5 [0054.101] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF" [0054.101] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF" [0054.101] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF." [0054.101] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF.wannacry" [0054.101] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10267_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.102] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x137 [0054.102] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe23cb800, dwHighDateTime=0x1bd8f8e), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc86dac0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe23cb800, dwHighDateTime=0x1bd8f8e)) returned 1 [0054.102] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.102] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xb9, lpOverlapped=0x0) returned 1 [0054.103] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF") returned="BD10267_.GIF" [0054.103] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.103] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xb9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xb9, lpOverlapped=0x0) returned 1 [0054.103] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.103] CloseHandle (hObject=0x90) returned 1 [0054.105] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10267_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10267_.gif.wannacry")) returned 1 [0054.106] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23cb800, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe23cb800, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD10268_.GIF", cAlternateFileName="")) returned 1 [0054.106] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.106] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD10268_.GIF") returned 1 [0054.106] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10268_.GIF") returned 1 [0054.107] lstrcmpiA (lpString1="", lpString2="BD10268_.GIF") returned -1 [0054.107] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF") returned="BD10267_.GIF" [0054.107] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.107] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.107] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.107] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.107] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD10268_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF" [0054.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF", pszSpec="*.zip") returned 0 [0054.107] lstrlenA (lpString="*.zip") returned 5 [0054.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF", pszSpec="*.rar") returned 0 [0054.107] lstrlenA (lpString="*.rar") returned 5 [0054.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF", pszSpec="*.7z") returned 0 [0054.107] lstrlenA (lpString="*.7z") returned 4 [0054.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF", pszSpec="*.tar") returned 0 [0054.107] lstrlenA (lpString="*.tar") returned 5 [0054.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF", pszSpec="*.gzip") returned 0 [0054.107] lstrlenA (lpString="*.gzip") returned 6 [0054.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF", pszSpec="*.jpg") returned 0 [0054.107] lstrlenA (lpString="*.jpg") returned 5 [0054.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF", pszSpec="*.jpeg") returned 0 [0054.107] lstrlenA (lpString="*.jpeg") returned 6 [0054.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF", pszSpec="*.psd") returned 0 [0054.107] lstrlenA (lpString="*.psd") returned 5 [0054.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF", pszSpec="*.gif") returned 1 [0054.107] lstrlenA (lpString="*.gif") returned 5 [0054.107] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF" [0054.108] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF" [0054.108] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF." [0054.108] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF.wannacry" [0054.108] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10268_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.108] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb1 [0054.108] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe23cb800, dwHighDateTime=0x1bd8f8e), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc86dac0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe23cb800, dwHighDateTime=0x1bd8f8e)) returned 1 [0054.108] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.108] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x33, lpOverlapped=0x0) returned 1 [0054.109] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF") returned="BD10268_.GIF" [0054.109] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.109] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x33, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x33, lpOverlapped=0x0) returned 1 [0054.110] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.110] CloseHandle (hObject=0x90) returned 1 [0054.111] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10268_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10268_.gif.wannacry")) returned 1 [0054.112] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70656e00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x70656e00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x46b, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD10297_.GIF", cAlternateFileName="")) returned 1 [0054.112] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.112] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD10297_.GIF") returned 1 [0054.112] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10297_.GIF") returned 1 [0054.112] lstrcmpiA (lpString1="", lpString2="BD10297_.GIF") returned -1 [0054.112] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF") returned="BD10268_.GIF" [0054.112] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.112] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.112] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.112] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.112] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD10297_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF" [0054.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF", pszSpec="*.zip") returned 0 [0054.112] lstrlenA (lpString="*.zip") returned 5 [0054.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF", pszSpec="*.rar") returned 0 [0054.113] lstrlenA (lpString="*.rar") returned 5 [0054.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF", pszSpec="*.7z") returned 0 [0054.113] lstrlenA (lpString="*.7z") returned 4 [0054.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF", pszSpec="*.tar") returned 0 [0054.113] lstrlenA (lpString="*.tar") returned 5 [0054.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF", pszSpec="*.gzip") returned 0 [0054.113] lstrlenA (lpString="*.gzip") returned 6 [0054.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF", pszSpec="*.jpg") returned 0 [0054.113] lstrlenA (lpString="*.jpg") returned 5 [0054.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF", pszSpec="*.jpeg") returned 0 [0054.113] lstrlenA (lpString="*.jpeg") returned 6 [0054.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF", pszSpec="*.psd") returned 0 [0054.113] lstrlenA (lpString="*.psd") returned 5 [0054.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF", pszSpec="*.gif") returned 1 [0054.113] lstrlenA (lpString="*.gif") returned 5 [0054.113] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF" [0054.113] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF" [0054.113] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF." [0054.113] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF.wannacry" [0054.113] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10297_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.114] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46b [0054.114] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x70656e00, dwHighDateTime=0x1bd8f90), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc893c20, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x70656e00, dwHighDateTime=0x1bd8f90)) returned 1 [0054.114] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.115] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3ed, lpOverlapped=0x0) returned 1 [0054.116] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF") returned="BD10297_.GIF" [0054.116] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.116] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3ed, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3ed, lpOverlapped=0x0) returned 1 [0054.117] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.117] CloseHandle (hObject=0x90) returned 1 [0054.118] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10297_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10297_.gif.wannacry")) returned 1 [0054.119] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70656e00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x70656e00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x467, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD10298_.GIF", cAlternateFileName="")) returned 1 [0054.119] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.119] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD10298_.GIF") returned 1 [0054.119] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10298_.GIF") returned 1 [0054.119] lstrcmpiA (lpString1="", lpString2="BD10298_.GIF") returned -1 [0054.119] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF") returned="BD10297_.GIF" [0054.119] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.119] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.119] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.119] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.119] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD10298_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF" [0054.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF", pszSpec="*.zip") returned 0 [0054.119] lstrlenA (lpString="*.zip") returned 5 [0054.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF", pszSpec="*.rar") returned 0 [0054.119] lstrlenA (lpString="*.rar") returned 5 [0054.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF", pszSpec="*.7z") returned 0 [0054.119] lstrlenA (lpString="*.7z") returned 4 [0054.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF", pszSpec="*.tar") returned 0 [0054.119] lstrlenA (lpString="*.tar") returned 5 [0054.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF", pszSpec="*.gzip") returned 0 [0054.119] lstrlenA (lpString="*.gzip") returned 6 [0054.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF", pszSpec="*.jpg") returned 0 [0054.120] lstrlenA (lpString="*.jpg") returned 5 [0054.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF", pszSpec="*.jpeg") returned 0 [0054.120] lstrlenA (lpString="*.jpeg") returned 6 [0054.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF", pszSpec="*.psd") returned 0 [0054.120] lstrlenA (lpString="*.psd") returned 5 [0054.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF", pszSpec="*.gif") returned 1 [0054.120] lstrlenA (lpString="*.gif") returned 5 [0054.120] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF" [0054.120] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF" [0054.120] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF." [0054.120] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF.wannacry" [0054.120] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10298_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.121] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x467 [0054.121] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x70656e00, dwHighDateTime=0x1bd8f90), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc893c20, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x70656e00, dwHighDateTime=0x1bd8f90)) returned 1 [0054.121] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.121] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3e9, lpOverlapped=0x0) returned 1 [0054.123] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF") returned="BD10298_.GIF" [0054.123] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.123] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3e9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3e9, lpOverlapped=0x0) returned 1 [0054.123] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.123] CloseHandle (hObject=0x90) returned 1 [0054.125] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10298_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10298_.gif.wannacry")) returned 1 [0054.126] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71969b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x71969b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x13b, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD10299_.GIF", cAlternateFileName="")) returned 1 [0054.126] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.126] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD10299_.GIF") returned 1 [0054.126] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10299_.GIF") returned 1 [0054.126] lstrcmpiA (lpString1="", lpString2="BD10299_.GIF") returned -1 [0054.126] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF") returned="BD10298_.GIF" [0054.126] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.126] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.127] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.127] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.127] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD10299_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF" [0054.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF", pszSpec="*.zip") returned 0 [0054.127] lstrlenA (lpString="*.zip") returned 5 [0054.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF", pszSpec="*.rar") returned 0 [0054.127] lstrlenA (lpString="*.rar") returned 5 [0054.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF", pszSpec="*.7z") returned 0 [0054.127] lstrlenA (lpString="*.7z") returned 4 [0054.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF", pszSpec="*.tar") returned 0 [0054.127] lstrlenA (lpString="*.tar") returned 5 [0054.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF", pszSpec="*.gzip") returned 0 [0054.127] lstrlenA (lpString="*.gzip") returned 6 [0054.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF", pszSpec="*.jpg") returned 0 [0054.127] lstrlenA (lpString="*.jpg") returned 5 [0054.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF", pszSpec="*.jpeg") returned 0 [0054.127] lstrlenA (lpString="*.jpeg") returned 6 [0054.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF", pszSpec="*.psd") returned 0 [0054.127] lstrlenA (lpString="*.psd") returned 5 [0054.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF", pszSpec="*.gif") returned 1 [0054.127] lstrlenA (lpString="*.gif") returned 5 [0054.127] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF" [0054.128] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF" [0054.128] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF." [0054.128] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF.wannacry" [0054.128] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10299_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.129] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13b [0054.129] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x71969b00, dwHighDateTime=0x1bd8f90), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc893c20, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x71969b00, dwHighDateTime=0x1bd8f90)) returned 1 [0054.129] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.129] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xbd, lpOverlapped=0x0) returned 1 [0054.130] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF") returned="BD10299_.GIF" [0054.130] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.130] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xbd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xbd, lpOverlapped=0x0) returned 1 [0054.130] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.130] CloseHandle (hObject=0x90) returned 1 [0054.132] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10299_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10299_.gif.wannacry")) returned 1 [0054.132] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71969b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x71969b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD10300_.GIF", cAlternateFileName="")) returned 1 [0054.132] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.133] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD10300_.GIF") returned 1 [0054.133] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10300_.GIF") returned 1 [0054.133] lstrcmpiA (lpString1="", lpString2="BD10300_.GIF") returned -1 [0054.133] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF") returned="BD10299_.GIF" [0054.133] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.133] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.133] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.133] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.133] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD10300_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF" [0054.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF", pszSpec="*.zip") returned 0 [0054.133] lstrlenA (lpString="*.zip") returned 5 [0054.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF", pszSpec="*.rar") returned 0 [0054.133] lstrlenA (lpString="*.rar") returned 5 [0054.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF", pszSpec="*.7z") returned 0 [0054.133] lstrlenA (lpString="*.7z") returned 4 [0054.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF", pszSpec="*.tar") returned 0 [0054.133] lstrlenA (lpString="*.tar") returned 5 [0054.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF", pszSpec="*.gzip") returned 0 [0054.133] lstrlenA (lpString="*.gzip") returned 6 [0054.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF", pszSpec="*.jpg") returned 0 [0054.133] lstrlenA (lpString="*.jpg") returned 5 [0054.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF", pszSpec="*.jpeg") returned 0 [0054.133] lstrlenA (lpString="*.jpeg") returned 6 [0054.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF", pszSpec="*.psd") returned 0 [0054.133] lstrlenA (lpString="*.psd") returned 5 [0054.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF", pszSpec="*.gif") returned 1 [0054.133] lstrlenA (lpString="*.gif") returned 5 [0054.133] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF" [0054.133] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF" [0054.133] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF." [0054.133] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF.wannacry" [0054.134] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10300_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.134] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x105 [0054.134] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x71969b00, dwHighDateTime=0x1bd8f90), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc893c20, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x71969b00, dwHighDateTime=0x1bd8f90)) returned 1 [0054.134] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.134] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x87, lpOverlapped=0x0) returned 1 [0054.135] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF") returned="BD10300_.GIF" [0054.135] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.135] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x87, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x87, lpOverlapped=0x0) returned 1 [0054.135] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.135] CloseHandle (hObject=0x90) returned 1 [0054.136] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10300_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10300_.gif.wannacry")) returned 1 [0054.137] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71969b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x71969b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD10301_.GIF", cAlternateFileName="")) returned 1 [0054.137] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.137] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD10301_.GIF") returned 1 [0054.137] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10301_.GIF") returned 1 [0054.137] lstrcmpiA (lpString1="", lpString2="BD10301_.GIF") returned -1 [0054.137] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF") returned="BD10300_.GIF" [0054.137] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.137] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.137] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.137] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.137] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD10301_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF" [0054.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF", pszSpec="*.zip") returned 0 [0054.137] lstrlenA (lpString="*.zip") returned 5 [0054.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF", pszSpec="*.rar") returned 0 [0054.137] lstrlenA (lpString="*.rar") returned 5 [0054.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF", pszSpec="*.7z") returned 0 [0054.137] lstrlenA (lpString="*.7z") returned 4 [0054.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF", pszSpec="*.tar") returned 0 [0054.137] lstrlenA (lpString="*.tar") returned 5 [0054.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF", pszSpec="*.gzip") returned 0 [0054.137] lstrlenA (lpString="*.gzip") returned 6 [0054.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF", pszSpec="*.jpg") returned 0 [0054.137] lstrlenA (lpString="*.jpg") returned 5 [0054.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF", pszSpec="*.jpeg") returned 0 [0054.138] lstrlenA (lpString="*.jpeg") returned 6 [0054.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF", pszSpec="*.psd") returned 0 [0054.138] lstrlenA (lpString="*.psd") returned 5 [0054.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF", pszSpec="*.gif") returned 1 [0054.138] lstrlenA (lpString="*.gif") returned 5 [0054.138] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF" [0054.138] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF" [0054.138] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF." [0054.138] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF.wannacry" [0054.138] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10301_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.138] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x109 [0054.138] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x71969b00, dwHighDateTime=0x1bd8f90), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc893c20, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x71969b00, dwHighDateTime=0x1bd8f90)) returned 1 [0054.138] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.138] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x8b, lpOverlapped=0x0) returned 1 [0054.139] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF") returned="BD10301_.GIF" [0054.139] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.139] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x8b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x8b, lpOverlapped=0x0) returned 1 [0054.139] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.139] CloseHandle (hObject=0x90) returned 1 [0054.141] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10301_.gif.wannacry")) returned 1 [0054.141] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72c7c800, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72c7c800, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD10302_.GIF", cAlternateFileName="")) returned 1 [0054.141] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.142] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD10302_.GIF") returned 1 [0054.142] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10302_.GIF") returned 1 [0054.142] lstrcmpiA (lpString1="", lpString2="BD10302_.GIF") returned -1 [0054.142] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF") returned="BD10301_.GIF" [0054.142] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.142] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.142] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.142] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.142] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD10302_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF" [0054.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF", pszSpec="*.zip") returned 0 [0054.142] lstrlenA (lpString="*.zip") returned 5 [0054.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF", pszSpec="*.rar") returned 0 [0054.142] lstrlenA (lpString="*.rar") returned 5 [0054.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF", pszSpec="*.7z") returned 0 [0054.142] lstrlenA (lpString="*.7z") returned 4 [0054.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF", pszSpec="*.tar") returned 0 [0054.142] lstrlenA (lpString="*.tar") returned 5 [0054.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF", pszSpec="*.gzip") returned 0 [0054.142] lstrlenA (lpString="*.gzip") returned 6 [0054.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF", pszSpec="*.jpg") returned 0 [0054.142] lstrlenA (lpString="*.jpg") returned 5 [0054.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF", pszSpec="*.jpeg") returned 0 [0054.142] lstrlenA (lpString="*.jpeg") returned 6 [0054.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF", pszSpec="*.psd") returned 0 [0054.142] lstrlenA (lpString="*.psd") returned 5 [0054.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF", pszSpec="*.gif") returned 1 [0054.142] lstrlenA (lpString="*.gif") returned 5 [0054.142] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF" [0054.142] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF" [0054.142] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF." [0054.142] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF.wannacry" [0054.143] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10302_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.143] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfd [0054.143] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x72c7c800, dwHighDateTime=0x1bd8f90), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc8b9d80, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x72c7c800, dwHighDateTime=0x1bd8f90)) returned 1 [0054.143] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.143] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x7f, lpOverlapped=0x0) returned 1 [0054.144] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF") returned="BD10302_.GIF" [0054.144] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.144] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x7f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x7f, lpOverlapped=0x0) returned 1 [0054.144] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.144] CloseHandle (hObject=0x90) returned 1 [0054.147] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10302_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10302_.gif.wannacry")) returned 1 [0054.147] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604e8e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x604e8e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD10335_.GIF", cAlternateFileName="")) returned 1 [0054.147] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.147] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD10335_.GIF") returned 1 [0054.147] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10335_.GIF") returned 1 [0054.147] lstrcmpiA (lpString1="", lpString2="BD10335_.GIF") returned -1 [0054.147] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF") returned="BD10302_.GIF" [0054.148] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.148] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.148] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.148] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.148] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD10335_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF" [0054.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF", pszSpec="*.zip") returned 0 [0054.148] lstrlenA (lpString="*.zip") returned 5 [0054.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF", pszSpec="*.rar") returned 0 [0054.148] lstrlenA (lpString="*.rar") returned 5 [0054.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF", pszSpec="*.7z") returned 0 [0054.148] lstrlenA (lpString="*.7z") returned 4 [0054.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF", pszSpec="*.tar") returned 0 [0054.148] lstrlenA (lpString="*.tar") returned 5 [0054.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF", pszSpec="*.gzip") returned 0 [0054.148] lstrlenA (lpString="*.gzip") returned 6 [0054.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF", pszSpec="*.jpg") returned 0 [0054.148] lstrlenA (lpString="*.jpg") returned 5 [0054.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF", pszSpec="*.jpeg") returned 0 [0054.148] lstrlenA (lpString="*.jpeg") returned 6 [0054.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF", pszSpec="*.psd") returned 0 [0054.148] lstrlenA (lpString="*.psd") returned 5 [0054.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF", pszSpec="*.gif") returned 1 [0054.148] lstrlenA (lpString="*.gif") returned 5 [0054.148] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF" [0054.148] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF" [0054.148] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF." [0054.148] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF.wannacry" [0054.148] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10335_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.149] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11a [0054.149] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x604e8e00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc8b9d80, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x604e8e00, dwHighDateTime=0x1bd8f92)) returned 1 [0054.149] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.149] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x9c, lpOverlapped=0x0) returned 1 [0054.150] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF") returned="BD10335_.GIF" [0054.150] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.150] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x9c, lpOverlapped=0x0) returned 1 [0054.151] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.151] CloseHandle (hObject=0x90) returned 1 [0054.151] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10335_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10335_.gif.wannacry")) returned 1 [0054.152] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604e8e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x604e8e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD10336_.GIF", cAlternateFileName="")) returned 1 [0054.152] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.152] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD10336_.GIF") returned 1 [0054.152] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10336_.GIF") returned 1 [0054.152] lstrcmpiA (lpString1="", lpString2="BD10336_.GIF") returned -1 [0054.152] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF") returned="BD10335_.GIF" [0054.152] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.152] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.152] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD10336_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF" [0054.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF", pszSpec="*.zip") returned 0 [0054.152] lstrlenA (lpString="*.zip") returned 5 [0054.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF", pszSpec="*.rar") returned 0 [0054.153] lstrlenA (lpString="*.rar") returned 5 [0054.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF", pszSpec="*.7z") returned 0 [0054.153] lstrlenA (lpString="*.7z") returned 4 [0054.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF", pszSpec="*.tar") returned 0 [0054.153] lstrlenA (lpString="*.tar") returned 5 [0054.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF", pszSpec="*.gzip") returned 0 [0054.153] lstrlenA (lpString="*.gzip") returned 6 [0054.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF", pszSpec="*.jpg") returned 0 [0054.153] lstrlenA (lpString="*.jpg") returned 5 [0054.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF", pszSpec="*.jpeg") returned 0 [0054.153] lstrlenA (lpString="*.jpeg") returned 6 [0054.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF", pszSpec="*.psd") returned 0 [0054.153] lstrlenA (lpString="*.psd") returned 5 [0054.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF", pszSpec="*.gif") returned 1 [0054.153] lstrlenA (lpString="*.gif") returned 5 [0054.153] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF" [0054.153] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF" [0054.153] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF." [0054.153] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF.wannacry" [0054.153] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10336_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.153] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcc [0054.153] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x604e8e00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc8b9d80, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x604e8e00, dwHighDateTime=0x1bd8f92)) returned 1 [0054.154] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.154] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4e, lpOverlapped=0x0) returned 1 [0054.154] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF") returned="BD10336_.GIF" [0054.154] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.155] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4e, lpOverlapped=0x0) returned 1 [0054.155] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.155] CloseHandle (hObject=0x90) returned 1 [0054.159] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10336_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10336_.gif.wannacry")) returned 1 [0054.160] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604e8e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x604e8e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD10337_.GIF", cAlternateFileName="")) returned 1 [0054.160] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.160] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD10337_.GIF") returned 1 [0054.160] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10337_.GIF") returned 1 [0054.160] lstrcmpiA (lpString1="", lpString2="BD10337_.GIF") returned -1 [0054.160] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF") returned="BD10336_.GIF" [0054.160] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.160] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.160] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.160] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.160] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD10337_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF" [0054.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF", pszSpec="*.zip") returned 0 [0054.160] lstrlenA (lpString="*.zip") returned 5 [0054.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF", pszSpec="*.rar") returned 0 [0054.160] lstrlenA (lpString="*.rar") returned 5 [0054.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF", pszSpec="*.7z") returned 0 [0054.161] lstrlenA (lpString="*.7z") returned 4 [0054.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF", pszSpec="*.tar") returned 0 [0054.161] lstrlenA (lpString="*.tar") returned 5 [0054.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF", pszSpec="*.gzip") returned 0 [0054.161] lstrlenA (lpString="*.gzip") returned 6 [0054.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF", pszSpec="*.jpg") returned 0 [0054.161] lstrlenA (lpString="*.jpg") returned 5 [0054.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF", pszSpec="*.jpeg") returned 0 [0054.161] lstrlenA (lpString="*.jpeg") returned 6 [0054.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF", pszSpec="*.psd") returned 0 [0054.161] lstrlenA (lpString="*.psd") returned 5 [0054.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF", pszSpec="*.gif") returned 1 [0054.161] lstrlenA (lpString="*.gif") returned 5 [0054.161] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF" [0054.161] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF" [0054.161] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF." [0054.161] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF.wannacry" [0054.161] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10337_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.163] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf0 [0054.163] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x604e8e00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc8b9d80, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x604e8e00, dwHighDateTime=0x1bd8f92)) returned 1 [0054.163] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.163] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x72, lpOverlapped=0x0) returned 1 [0054.164] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF") returned="BD10337_.GIF" [0054.164] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.164] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x72, lpOverlapped=0x0) returned 1 [0054.164] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.164] CloseHandle (hObject=0x90) returned 1 [0054.167] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10337_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10337_.gif.wannacry")) returned 1 [0054.168] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ebfa00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7ebfa00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14513_.GIF", cAlternateFileName="")) returned 1 [0054.168] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.168] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14513_.GIF") returned 1 [0054.168] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14513_.GIF") returned 1 [0054.168] lstrcmpiA (lpString1="", lpString2="BD14513_.GIF") returned -1 [0054.168] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.168] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.168] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.168] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.168] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14513_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF" [0054.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF", pszSpec="*.zip") returned 0 [0054.168] lstrlenA (lpString="*.zip") returned 5 [0054.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF", pszSpec="*.rar") returned 0 [0054.168] lstrlenA (lpString="*.rar") returned 5 [0054.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF", pszSpec="*.7z") returned 0 [0054.168] lstrlenA (lpString="*.7z") returned 4 [0054.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF", pszSpec="*.tar") returned 0 [0054.168] lstrlenA (lpString="*.tar") returned 5 [0054.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF", pszSpec="*.gzip") returned 0 [0054.168] lstrlenA (lpString="*.gzip") returned 6 [0054.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF", pszSpec="*.jpg") returned 0 [0054.168] lstrlenA (lpString="*.jpg") returned 5 [0054.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF", pszSpec="*.jpeg") returned 0 [0054.168] lstrlenA (lpString="*.jpeg") returned 6 [0054.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF", pszSpec="*.psd") returned 0 [0054.168] lstrlenA (lpString="*.psd") returned 5 [0054.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF", pszSpec="*.gif") returned 1 [0054.169] lstrlenA (lpString="*.gif") returned 5 [0054.169] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF" [0054.169] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF" [0054.169] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF." [0054.169] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF.wannacry" [0054.169] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14513_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.170] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xce [0054.170] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb7ebfa00, dwHighDateTime=0x1bd8f90), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc8dfee0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb7ebfa00, dwHighDateTime=0x1bd8f90)) returned 1 [0054.170] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.170] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x50, lpOverlapped=0x0) returned 1 [0054.171] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.171] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x50, lpOverlapped=0x0) returned 1 [0054.171] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.171] CloseHandle (hObject=0x90) returned 1 [0054.172] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14513_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14513_.gif.wannacry")) returned 1 [0054.173] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91d2700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb91d2700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14514_.GIF", cAlternateFileName="")) returned 1 [0054.173] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.173] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14514_.GIF") returned 1 [0054.173] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14514_.GIF") returned 1 [0054.173] lstrcmpiA (lpString1="", lpString2="BD14514_.GIF") returned -1 [0054.173] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF") returned="BD14513_.GIF" [0054.173] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.173] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.173] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.173] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.174] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14514_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF" [0054.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF", pszSpec="*.zip") returned 0 [0054.174] lstrlenA (lpString="*.zip") returned 5 [0054.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF", pszSpec="*.rar") returned 0 [0054.174] lstrlenA (lpString="*.rar") returned 5 [0054.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF", pszSpec="*.7z") returned 0 [0054.174] lstrlenA (lpString="*.7z") returned 4 [0054.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF", pszSpec="*.tar") returned 0 [0054.174] lstrlenA (lpString="*.tar") returned 5 [0054.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF", pszSpec="*.gzip") returned 0 [0054.174] lstrlenA (lpString="*.gzip") returned 6 [0054.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF", pszSpec="*.jpg") returned 0 [0054.174] lstrlenA (lpString="*.jpg") returned 5 [0054.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF", pszSpec="*.jpeg") returned 0 [0054.174] lstrlenA (lpString="*.jpeg") returned 6 [0054.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF", pszSpec="*.psd") returned 0 [0054.174] lstrlenA (lpString="*.psd") returned 5 [0054.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF", pszSpec="*.gif") returned 1 [0054.174] lstrlenA (lpString="*.gif") returned 5 [0054.174] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF" [0054.174] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF" [0054.174] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF." [0054.174] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF.wannacry" [0054.174] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14514_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.175] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0054.175] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb91d2700, dwHighDateTime=0x1bd8f90), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc8dfee0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb91d2700, dwHighDateTime=0x1bd8f90)) returned 1 [0054.175] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.175] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x35, lpOverlapped=0x0) returned 1 [0054.176] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF") returned="BD14514_.GIF" [0054.176] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.176] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x35, lpOverlapped=0x0) returned 1 [0054.176] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.176] CloseHandle (hObject=0x90) returned 1 [0054.179] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14514_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14514_.gif.wannacry")) returned 1 [0054.179] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91d2700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb91d2700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14515_.GIF", cAlternateFileName="")) returned 1 [0054.179] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.179] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14515_.GIF") returned 1 [0054.179] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14515_.GIF") returned 1 [0054.179] lstrcmpiA (lpString1="", lpString2="BD14515_.GIF") returned -1 [0054.179] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF") returned="BD14514_.GIF" [0054.179] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.180] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.180] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.180] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.180] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14515_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF" [0054.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF", pszSpec="*.zip") returned 0 [0054.180] lstrlenA (lpString="*.zip") returned 5 [0054.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF", pszSpec="*.rar") returned 0 [0054.180] lstrlenA (lpString="*.rar") returned 5 [0054.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF", pszSpec="*.7z") returned 0 [0054.180] lstrlenA (lpString="*.7z") returned 4 [0054.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF", pszSpec="*.tar") returned 0 [0054.180] lstrlenA (lpString="*.tar") returned 5 [0054.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF", pszSpec="*.gzip") returned 0 [0054.180] lstrlenA (lpString="*.gzip") returned 6 [0054.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF", pszSpec="*.jpg") returned 0 [0054.180] lstrlenA (lpString="*.jpg") returned 5 [0054.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF", pszSpec="*.jpeg") returned 0 [0054.180] lstrlenA (lpString="*.jpeg") returned 6 [0054.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF", pszSpec="*.psd") returned 0 [0054.180] lstrlenA (lpString="*.psd") returned 5 [0054.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF", pszSpec="*.gif") returned 1 [0054.180] lstrlenA (lpString="*.gif") returned 5 [0054.180] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF" [0054.180] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF" [0054.180] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF." [0054.180] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF.wannacry" [0054.180] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14515_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.181] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0054.181] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb91d2700, dwHighDateTime=0x1bd8f90), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc8dfee0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb91d2700, dwHighDateTime=0x1bd8f90)) returned 1 [0054.181] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.181] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x35, lpOverlapped=0x0) returned 1 [0054.182] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF") returned="BD14515_.GIF" [0054.182] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.182] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x35, lpOverlapped=0x0) returned 1 [0054.183] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.183] CloseHandle (hObject=0x90) returned 1 [0054.185] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14515_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14515_.gif.wannacry")) returned 1 [0054.185] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd05b1500, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd05b1500, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14528_.GIF", cAlternateFileName="")) returned 1 [0054.185] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.185] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14528_.GIF") returned 1 [0054.185] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14528_.GIF") returned 1 [0054.185] lstrcmpiA (lpString1="", lpString2="BD14528_.GIF") returned -1 [0054.185] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF") returned="BD14515_.GIF" [0054.186] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.186] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.186] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.186] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.186] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14528_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF" [0054.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF", pszSpec="*.zip") returned 0 [0054.186] lstrlenA (lpString="*.zip") returned 5 [0054.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF", pszSpec="*.rar") returned 0 [0054.186] lstrlenA (lpString="*.rar") returned 5 [0054.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF", pszSpec="*.7z") returned 0 [0054.186] lstrlenA (lpString="*.7z") returned 4 [0054.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF", pszSpec="*.tar") returned 0 [0054.186] lstrlenA (lpString="*.tar") returned 5 [0054.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF", pszSpec="*.gzip") returned 0 [0054.186] lstrlenA (lpString="*.gzip") returned 6 [0054.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF", pszSpec="*.jpg") returned 0 [0054.186] lstrlenA (lpString="*.jpg") returned 5 [0054.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF", pszSpec="*.jpeg") returned 0 [0054.186] lstrlenA (lpString="*.jpeg") returned 6 [0054.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF", pszSpec="*.psd") returned 0 [0054.186] lstrlenA (lpString="*.psd") returned 5 [0054.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF", pszSpec="*.gif") returned 1 [0054.186] lstrlenA (lpString="*.gif") returned 5 [0054.186] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF" [0054.187] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF" [0054.187] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF." [0054.187] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14528_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.187] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x111 [0054.187] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd05b1500, dwHighDateTime=0x1bd8f8e), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc8dfee0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd05b1500, dwHighDateTime=0x1bd8f8e)) returned 1 [0054.187] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.187] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x93, lpOverlapped=0x0) returned 1 [0054.188] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF") returned="BD14528_.GIF" [0054.188] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.188] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x93, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x93, lpOverlapped=0x0) returned 1 [0054.188] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.188] CloseHandle (hObject=0x90) returned 1 [0054.189] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14528_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14528_.gif.wannacry")) returned 1 [0054.190] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd18c4200, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd18c4200, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14529_.GIF", cAlternateFileName="")) returned 1 [0054.190] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.190] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14529_.GIF") returned 1 [0054.190] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14529_.GIF") returned 1 [0054.190] lstrcmpiA (lpString1="", lpString2="BD14529_.GIF") returned -1 [0054.190] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF") returned="BD14528_.GIF" [0054.190] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.190] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.190] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14529_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF" [0054.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF", pszSpec="*.zip") returned 0 [0054.190] lstrlenA (lpString="*.zip") returned 5 [0054.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF", pszSpec="*.rar") returned 0 [0054.191] lstrlenA (lpString="*.rar") returned 5 [0054.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF", pszSpec="*.7z") returned 0 [0054.191] lstrlenA (lpString="*.7z") returned 4 [0054.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF", pszSpec="*.tar") returned 0 [0054.191] lstrlenA (lpString="*.tar") returned 5 [0054.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF", pszSpec="*.gzip") returned 0 [0054.191] lstrlenA (lpString="*.gzip") returned 6 [0054.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF", pszSpec="*.jpg") returned 0 [0054.191] lstrlenA (lpString="*.jpg") returned 5 [0054.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF", pszSpec="*.jpeg") returned 0 [0054.191] lstrlenA (lpString="*.jpeg") returned 6 [0054.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF", pszSpec="*.psd") returned 0 [0054.191] lstrlenA (lpString="*.psd") returned 5 [0054.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF", pszSpec="*.gif") returned 1 [0054.191] lstrlenA (lpString="*.gif") returned 5 [0054.191] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF" [0054.191] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF" [0054.191] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF." [0054.191] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF.wannacry" [0054.191] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14529_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.191] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x112 [0054.192] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd18c4200, dwHighDateTime=0x1bd8f8e), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc8dfee0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd18c4200, dwHighDateTime=0x1bd8f8e)) returned 1 [0054.192] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.192] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x94, lpOverlapped=0x0) returned 1 [0054.192] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF") returned="BD14529_.GIF" [0054.193] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.193] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x94, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x94, lpOverlapped=0x0) returned 1 [0054.193] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.193] CloseHandle (hObject=0x90) returned 1 [0054.195] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14529_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14529_.gif.wannacry")) returned 1 [0054.195] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd18c4200, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd18c4200, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x13c, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14530_.GIF", cAlternateFileName="")) returned 1 [0054.195] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.195] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14530_.GIF") returned 1 [0054.195] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14530_.GIF") returned 1 [0054.195] lstrcmpiA (lpString1="", lpString2="BD14530_.GIF") returned -1 [0054.195] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF") returned="BD14529_.GIF" [0054.196] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.196] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.196] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.196] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.196] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14530_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF" [0054.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF", pszSpec="*.zip") returned 0 [0054.196] lstrlenA (lpString="*.zip") returned 5 [0054.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF", pszSpec="*.rar") returned 0 [0054.196] lstrlenA (lpString="*.rar") returned 5 [0054.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF", pszSpec="*.7z") returned 0 [0054.196] lstrlenA (lpString="*.7z") returned 4 [0054.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF", pszSpec="*.tar") returned 0 [0054.196] lstrlenA (lpString="*.tar") returned 5 [0054.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF", pszSpec="*.gzip") returned 0 [0054.196] lstrlenA (lpString="*.gzip") returned 6 [0054.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF", pszSpec="*.jpg") returned 0 [0054.196] lstrlenA (lpString="*.jpg") returned 5 [0054.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF", pszSpec="*.jpeg") returned 0 [0054.196] lstrlenA (lpString="*.jpeg") returned 6 [0054.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF", pszSpec="*.psd") returned 0 [0054.196] lstrlenA (lpString="*.psd") returned 5 [0054.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF", pszSpec="*.gif") returned 1 [0054.196] lstrlenA (lpString="*.gif") returned 5 [0054.196] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF" [0054.196] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF" [0054.196] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF." [0054.196] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF.wannacry" [0054.196] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14530_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.197] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13c [0054.197] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd18c4200, dwHighDateTime=0x1bd8f8e), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc8dfee0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd18c4200, dwHighDateTime=0x1bd8f8e)) returned 1 [0054.197] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.197] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xbe, lpOverlapped=0x0) returned 1 [0054.198] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF") returned="BD14530_.GIF" [0054.198] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.198] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xbe, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xbe, lpOverlapped=0x0) returned 1 [0054.198] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.198] CloseHandle (hObject=0x90) returned 1 [0054.199] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14530_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14530_.gif.wannacry")) returned 1 [0054.200] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2bd6f00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd2bd6f00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14531_.GIF", cAlternateFileName="")) returned 1 [0054.200] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.200] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14531_.GIF") returned 1 [0054.200] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14531_.GIF") returned 1 [0054.200] lstrcmpiA (lpString1="", lpString2="BD14531_.GIF") returned -1 [0054.200] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF") returned="BD14530_.GIF" [0054.200] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.200] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.200] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.200] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.200] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14531_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF" [0054.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF", pszSpec="*.zip") returned 0 [0054.200] lstrlenA (lpString="*.zip") returned 5 [0054.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF", pszSpec="*.rar") returned 0 [0054.200] lstrlenA (lpString="*.rar") returned 5 [0054.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF", pszSpec="*.7z") returned 0 [0054.200] lstrlenA (lpString="*.7z") returned 4 [0054.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF", pszSpec="*.tar") returned 0 [0054.200] lstrlenA (lpString="*.tar") returned 5 [0054.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF", pszSpec="*.gzip") returned 0 [0054.200] lstrlenA (lpString="*.gzip") returned 6 [0054.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF", pszSpec="*.jpg") returned 0 [0054.200] lstrlenA (lpString="*.jpg") returned 5 [0054.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF", pszSpec="*.jpeg") returned 0 [0054.200] lstrlenA (lpString="*.jpeg") returned 6 [0054.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF", pszSpec="*.psd") returned 0 [0054.201] lstrlenA (lpString="*.psd") returned 5 [0054.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF", pszSpec="*.gif") returned 1 [0054.201] lstrlenA (lpString="*.gif") returned 5 [0054.201] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF" [0054.201] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF" [0054.201] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF." [0054.201] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF.wannacry" [0054.201] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14531_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.201] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf5 [0054.201] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd2bd6f00, dwHighDateTime=0x1bd8f8e), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc906040, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd2bd6f00, dwHighDateTime=0x1bd8f8e)) returned 1 [0054.201] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.201] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x77, lpOverlapped=0x0) returned 1 [0054.202] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF") returned="BD14531_.GIF" [0054.202] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.203] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x77, lpOverlapped=0x0) returned 1 [0054.203] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.203] CloseHandle (hObject=0x90) returned 1 [0054.204] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14531_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14531_.gif.wannacry")) returned 1 [0054.207] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2bd6f00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd2bd6f00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14532_.GIF", cAlternateFileName="")) returned 1 [0054.207] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.207] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14532_.GIF") returned 1 [0054.207] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14532_.GIF") returned 1 [0054.207] lstrcmpiA (lpString1="", lpString2="BD14532_.GIF") returned -1 [0054.207] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF") returned="BD14531_.GIF" [0054.207] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.207] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.207] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.207] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.207] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14532_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF" [0054.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF", pszSpec="*.zip") returned 0 [0054.207] lstrlenA (lpString="*.zip") returned 5 [0054.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF", pszSpec="*.rar") returned 0 [0054.207] lstrlenA (lpString="*.rar") returned 5 [0054.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF", pszSpec="*.7z") returned 0 [0054.207] lstrlenA (lpString="*.7z") returned 4 [0054.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF", pszSpec="*.tar") returned 0 [0054.208] lstrlenA (lpString="*.tar") returned 5 [0054.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF", pszSpec="*.gzip") returned 0 [0054.208] lstrlenA (lpString="*.gzip") returned 6 [0054.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF", pszSpec="*.jpg") returned 0 [0054.208] lstrlenA (lpString="*.jpg") returned 5 [0054.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF", pszSpec="*.jpeg") returned 0 [0054.208] lstrlenA (lpString="*.jpeg") returned 6 [0054.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF", pszSpec="*.psd") returned 0 [0054.208] lstrlenA (lpString="*.psd") returned 5 [0054.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF", pszSpec="*.gif") returned 1 [0054.208] lstrlenA (lpString="*.gif") returned 5 [0054.208] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF" [0054.208] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF" [0054.208] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF." [0054.208] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF.wannacry" [0054.208] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14532_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.208] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf5 [0054.208] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd2bd6f00, dwHighDateTime=0x1bd8f8e), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc906040, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd2bd6f00, dwHighDateTime=0x1bd8f8e)) returned 1 [0054.208] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.208] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x77, lpOverlapped=0x0) returned 1 [0054.209] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF") returned="BD14532_.GIF" [0054.209] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.209] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x77, lpOverlapped=0x0) returned 1 [0054.210] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.210] CloseHandle (hObject=0x90) returned 1 [0054.211] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14532_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14532_.gif.wannacry")) returned 1 [0054.211] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2bd6f00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd2bd6f00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14533_.GIF", cAlternateFileName="")) returned 1 [0054.211] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.211] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14533_.GIF") returned 1 [0054.211] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14533_.GIF") returned 1 [0054.211] lstrcmpiA (lpString1="", lpString2="BD14533_.GIF") returned -1 [0054.211] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF") returned="BD14532_.GIF" [0054.211] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.211] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.212] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.212] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.212] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14533_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF" [0054.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF", pszSpec="*.zip") returned 0 [0054.212] lstrlenA (lpString="*.zip") returned 5 [0054.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF", pszSpec="*.rar") returned 0 [0054.212] lstrlenA (lpString="*.rar") returned 5 [0054.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF", pszSpec="*.7z") returned 0 [0054.212] lstrlenA (lpString="*.7z") returned 4 [0054.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF", pszSpec="*.tar") returned 0 [0054.212] lstrlenA (lpString="*.tar") returned 5 [0054.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF", pszSpec="*.gzip") returned 0 [0054.212] lstrlenA (lpString="*.gzip") returned 6 [0054.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF", pszSpec="*.jpg") returned 0 [0054.212] lstrlenA (lpString="*.jpg") returned 5 [0054.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF", pszSpec="*.jpeg") returned 0 [0054.212] lstrlenA (lpString="*.jpeg") returned 6 [0054.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF", pszSpec="*.psd") returned 0 [0054.212] lstrlenA (lpString="*.psd") returned 5 [0054.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF", pszSpec="*.gif") returned 1 [0054.212] lstrlenA (lpString="*.gif") returned 5 [0054.212] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF" [0054.212] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF" [0054.212] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF." [0054.212] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF.wannacry" [0054.212] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14533_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.213] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf5 [0054.213] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd2bd6f00, dwHighDateTime=0x1bd8f8e), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc906040, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd2bd6f00, dwHighDateTime=0x1bd8f8e)) returned 1 [0054.213] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.213] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x77, lpOverlapped=0x0) returned 1 [0054.214] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF") returned="BD14533_.GIF" [0054.214] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.214] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x77, lpOverlapped=0x0) returned 1 [0054.214] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.214] CloseHandle (hObject=0x90) returned 1 [0054.219] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14533_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14533_.gif.wannacry")) returned 1 [0054.219] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe7b7100, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe7b7100, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14565_.GIF", cAlternateFileName="")) returned 1 [0054.220] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.220] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14565_.GIF") returned 1 [0054.220] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14565_.GIF") returned 1 [0054.220] lstrcmpiA (lpString1="", lpString2="BD14565_.GIF") returned -1 [0054.220] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF") returned="BD14533_.GIF" [0054.220] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.220] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.220] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.220] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.220] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14565_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF" [0054.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF", pszSpec="*.zip") returned 0 [0054.220] lstrlenA (lpString="*.zip") returned 5 [0054.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF", pszSpec="*.rar") returned 0 [0054.220] lstrlenA (lpString="*.rar") returned 5 [0054.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF", pszSpec="*.7z") returned 0 [0054.220] lstrlenA (lpString="*.7z") returned 4 [0054.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF", pszSpec="*.tar") returned 0 [0054.220] lstrlenA (lpString="*.tar") returned 5 [0054.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF", pszSpec="*.gzip") returned 0 [0054.220] lstrlenA (lpString="*.gzip") returned 6 [0054.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF", pszSpec="*.jpg") returned 0 [0054.220] lstrlenA (lpString="*.jpg") returned 5 [0054.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF", pszSpec="*.jpeg") returned 0 [0054.220] lstrlenA (lpString="*.jpeg") returned 6 [0054.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF", pszSpec="*.psd") returned 0 [0054.220] lstrlenA (lpString="*.psd") returned 5 [0054.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF", pszSpec="*.gif") returned 1 [0054.221] lstrlenA (lpString="*.gif") returned 5 [0054.221] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF" [0054.221] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF" [0054.221] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF." [0054.221] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF.wannacry" [0054.221] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14565_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.222] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb7 [0054.222] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbe7b7100, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc92c1a0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbe7b7100, dwHighDateTime=0x1bd8f92)) returned 1 [0054.222] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.222] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x39, lpOverlapped=0x0) returned 1 [0054.223] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF") returned="BD14565_.GIF" [0054.223] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.223] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x39, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x39, lpOverlapped=0x0) returned 1 [0054.223] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.223] CloseHandle (hObject=0x90) returned 1 [0054.224] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14565_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14565_.gif.wannacry")) returned 1 [0054.225] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7eb38a00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7eb38a00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14578_.GIF", cAlternateFileName="")) returned 1 [0054.225] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.225] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14578_.GIF") returned 1 [0054.225] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14578_.GIF") returned 1 [0054.225] lstrcmpiA (lpString1="", lpString2="BD14578_.GIF") returned -1 [0054.225] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF") returned="BD14565_.GIF" [0054.225] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.225] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.225] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.225] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.225] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14578_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF" [0054.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF", pszSpec="*.zip") returned 0 [0054.226] lstrlenA (lpString="*.zip") returned 5 [0054.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF", pszSpec="*.rar") returned 0 [0054.226] lstrlenA (lpString="*.rar") returned 5 [0054.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF", pszSpec="*.7z") returned 0 [0054.226] lstrlenA (lpString="*.7z") returned 4 [0054.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF", pszSpec="*.tar") returned 0 [0054.226] lstrlenA (lpString="*.tar") returned 5 [0054.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF", pszSpec="*.gzip") returned 0 [0054.226] lstrlenA (lpString="*.gzip") returned 6 [0054.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF", pszSpec="*.jpg") returned 0 [0054.226] lstrlenA (lpString="*.jpg") returned 5 [0054.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF", pszSpec="*.jpeg") returned 0 [0054.226] lstrlenA (lpString="*.jpeg") returned 6 [0054.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF", pszSpec="*.psd") returned 0 [0054.226] lstrlenA (lpString="*.psd") returned 5 [0054.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF", pszSpec="*.gif") returned 1 [0054.226] lstrlenA (lpString="*.gif") returned 5 [0054.226] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF" [0054.226] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF" [0054.226] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF." [0054.226] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF.wannacry" [0054.226] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14578_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.227] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc8 [0054.227] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7eb38a00, dwHighDateTime=0x1bd8f90), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc92c1a0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7eb38a00, dwHighDateTime=0x1bd8f90)) returned 1 [0054.227] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.227] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4a, lpOverlapped=0x0) returned 1 [0054.228] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF") returned="BD14578_.GIF" [0054.228] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.228] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4a, lpOverlapped=0x0) returned 1 [0054.228] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.228] CloseHandle (hObject=0x90) returned 1 [0054.229] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14578_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14578_.gif.wannacry")) returned 1 [0054.230] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7eb38a00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7eb38a00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14579_.GIF", cAlternateFileName="")) returned 1 [0054.230] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.230] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14579_.GIF") returned 1 [0054.230] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14579_.GIF") returned 1 [0054.230] lstrcmpiA (lpString1="", lpString2="BD14579_.GIF") returned -1 [0054.230] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF") returned="BD14578_.GIF" [0054.230] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.230] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.230] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.230] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.230] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14579_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF" [0054.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF", pszSpec="*.zip") returned 0 [0054.230] lstrlenA (lpString="*.zip") returned 5 [0054.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF", pszSpec="*.rar") returned 0 [0054.230] lstrlenA (lpString="*.rar") returned 5 [0054.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF", pszSpec="*.7z") returned 0 [0054.230] lstrlenA (lpString="*.7z") returned 4 [0054.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF", pszSpec="*.tar") returned 0 [0054.230] lstrlenA (lpString="*.tar") returned 5 [0054.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF", pszSpec="*.gzip") returned 0 [0054.230] lstrlenA (lpString="*.gzip") returned 6 [0054.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF", pszSpec="*.jpg") returned 0 [0054.230] lstrlenA (lpString="*.jpg") returned 5 [0054.230] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF", pszSpec="*.jpeg") returned 0 [0054.230] lstrlenA (lpString="*.jpeg") returned 6 [0054.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF", pszSpec="*.psd") returned 0 [0054.231] lstrlenA (lpString="*.psd") returned 5 [0054.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF", pszSpec="*.gif") returned 1 [0054.231] lstrlenA (lpString="*.gif") returned 5 [0054.231] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF" [0054.231] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF" [0054.231] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF." [0054.231] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF.wannacry" [0054.231] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14579_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.232] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10b [0054.232] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7eb38a00, dwHighDateTime=0x1bd8f90), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc92c1a0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7eb38a00, dwHighDateTime=0x1bd8f90)) returned 1 [0054.232] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.232] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x8d, lpOverlapped=0x0) returned 1 [0054.233] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF") returned="BD14579_.GIF" [0054.233] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.233] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x8d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x8d, lpOverlapped=0x0) returned 1 [0054.233] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.233] CloseHandle (hObject=0x90) returned 1 [0054.234] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14579_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14579_.gif.wannacry")) returned 1 [0054.235] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe4b700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fe4b700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14580_.GIF", cAlternateFileName="")) returned 1 [0054.235] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.235] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14580_.GIF") returned 1 [0054.235] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14580_.GIF") returned 1 [0054.235] lstrcmpiA (lpString1="", lpString2="BD14580_.GIF") returned -1 [0054.235] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF") returned="BD14579_.GIF" [0054.235] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.235] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.235] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.235] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.235] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14580_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF" [0054.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF", pszSpec="*.zip") returned 0 [0054.235] lstrlenA (lpString="*.zip") returned 5 [0054.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF", pszSpec="*.rar") returned 0 [0054.235] lstrlenA (lpString="*.rar") returned 5 [0054.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF", pszSpec="*.7z") returned 0 [0054.235] lstrlenA (lpString="*.7z") returned 4 [0054.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF", pszSpec="*.tar") returned 0 [0054.235] lstrlenA (lpString="*.tar") returned 5 [0054.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF", pszSpec="*.gzip") returned 0 [0054.235] lstrlenA (lpString="*.gzip") returned 6 [0054.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF", pszSpec="*.jpg") returned 0 [0054.235] lstrlenA (lpString="*.jpg") returned 5 [0054.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF", pszSpec="*.jpeg") returned 0 [0054.235] lstrlenA (lpString="*.jpeg") returned 6 [0054.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF", pszSpec="*.psd") returned 0 [0054.236] lstrlenA (lpString="*.psd") returned 5 [0054.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF", pszSpec="*.gif") returned 1 [0054.236] lstrlenA (lpString="*.gif") returned 5 [0054.236] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF" [0054.236] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF" [0054.236] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF." [0054.236] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF.wannacry" [0054.236] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14580_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.236] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9 [0054.236] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7fe4b700, dwHighDateTime=0x1bd8f90), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc92c1a0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7fe4b700, dwHighDateTime=0x1bd8f90)) returned 1 [0054.236] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.237] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3b, lpOverlapped=0x0) returned 1 [0054.237] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF") returned="BD14580_.GIF" [0054.238] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.238] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3b, lpOverlapped=0x0) returned 1 [0054.238] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.238] CloseHandle (hObject=0x90) returned 1 [0054.239] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14580_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14580_.gif.wannacry")) returned 1 [0054.239] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe4b700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fe4b700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14581_.GIF", cAlternateFileName="")) returned 1 [0054.239] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.239] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14581_.GIF") returned 1 [0054.239] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14581_.GIF") returned 1 [0054.239] lstrcmpiA (lpString1="", lpString2="BD14581_.GIF") returned -1 [0054.239] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF") returned="BD14580_.GIF" [0054.239] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.240] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.240] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.240] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.240] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14581_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF" [0054.240] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF", pszSpec="*.zip") returned 0 [0054.240] lstrlenA (lpString="*.zip") returned 5 [0054.240] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF", pszSpec="*.rar") returned 0 [0054.240] lstrlenA (lpString="*.rar") returned 5 [0054.240] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF", pszSpec="*.7z") returned 0 [0054.240] lstrlenA (lpString="*.7z") returned 4 [0054.240] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF", pszSpec="*.tar") returned 0 [0054.240] lstrlenA (lpString="*.tar") returned 5 [0054.240] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF", pszSpec="*.gzip") returned 0 [0054.240] lstrlenA (lpString="*.gzip") returned 6 [0054.240] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF", pszSpec="*.jpg") returned 0 [0054.240] lstrlenA (lpString="*.jpg") returned 5 [0054.240] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF", pszSpec="*.jpeg") returned 0 [0054.240] lstrlenA (lpString="*.jpeg") returned 6 [0054.240] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF", pszSpec="*.psd") returned 0 [0054.240] lstrlenA (lpString="*.psd") returned 5 [0054.240] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF", pszSpec="*.gif") returned 1 [0054.240] lstrlenA (lpString="*.gif") returned 5 [0054.240] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF" [0054.240] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF" [0054.240] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF." [0054.240] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF.wannacry" [0054.240] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14581_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.241] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xce [0054.241] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7fe4b700, dwHighDateTime=0x1bd8f90), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc92c1a0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7fe4b700, dwHighDateTime=0x1bd8f90)) returned 1 [0054.241] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.241] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x50, lpOverlapped=0x0) returned 1 [0054.242] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF") returned="BD14581_.GIF" [0054.242] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.242] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x50, lpOverlapped=0x0) returned 1 [0054.242] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.242] CloseHandle (hObject=0x90) returned 1 [0054.247] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14581_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14581_.gif.wannacry")) returned 1 [0054.248] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe4b700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fe4b700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14582_.GIF", cAlternateFileName="")) returned 1 [0054.248] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.248] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14582_.GIF") returned 1 [0054.248] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14582_.GIF") returned 1 [0054.248] lstrcmpiA (lpString1="", lpString2="BD14582_.GIF") returned -1 [0054.248] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF") returned="BD14581_.GIF" [0054.248] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.248] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.248] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.248] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.248] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14582_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF" [0054.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF", pszSpec="*.zip") returned 0 [0054.248] lstrlenA (lpString="*.zip") returned 5 [0054.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF", pszSpec="*.rar") returned 0 [0054.248] lstrlenA (lpString="*.rar") returned 5 [0054.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF", pszSpec="*.7z") returned 0 [0054.248] lstrlenA (lpString="*.7z") returned 4 [0054.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF", pszSpec="*.tar") returned 0 [0054.248] lstrlenA (lpString="*.tar") returned 5 [0054.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF", pszSpec="*.gzip") returned 0 [0054.248] lstrlenA (lpString="*.gzip") returned 6 [0054.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF", pszSpec="*.jpg") returned 0 [0054.248] lstrlenA (lpString="*.jpg") returned 5 [0054.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF", pszSpec="*.jpeg") returned 0 [0054.248] lstrlenA (lpString="*.jpeg") returned 6 [0054.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF", pszSpec="*.psd") returned 0 [0054.248] lstrlenA (lpString="*.psd") returned 5 [0054.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF", pszSpec="*.gif") returned 1 [0054.249] lstrlenA (lpString="*.gif") returned 5 [0054.249] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF" [0054.249] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF" [0054.249] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF." [0054.249] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF.wannacry" [0054.249] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.249] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9 [0054.249] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7fe4b700, dwHighDateTime=0x1bd8f90), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc92c1a0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7fe4b700, dwHighDateTime=0x1bd8f90)) returned 1 [0054.249] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.249] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3b, lpOverlapped=0x0) returned 1 [0054.250] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF") returned="BD14582_.GIF" [0054.250] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.250] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3b, lpOverlapped=0x0) returned 1 [0054.250] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.251] CloseHandle (hObject=0x90) returned 1 [0054.252] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14582_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14582_.gif.wannacry")) returned 1 [0054.252] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8115e400, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8115e400, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14583_.GIF", cAlternateFileName="")) returned 1 [0054.254] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.254] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14583_.GIF") returned 1 [0054.254] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14583_.GIF") returned 1 [0054.254] lstrcmpiA (lpString1="", lpString2="BD14583_.GIF") returned -1 [0054.254] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF") returned="BD14582_.GIF" [0054.254] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.254] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.254] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.254] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.254] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14583_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF" [0054.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF", pszSpec="*.zip") returned 0 [0054.254] lstrlenA (lpString="*.zip") returned 5 [0054.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF", pszSpec="*.rar") returned 0 [0054.254] lstrlenA (lpString="*.rar") returned 5 [0054.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF", pszSpec="*.7z") returned 0 [0054.254] lstrlenA (lpString="*.7z") returned 4 [0054.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF", pszSpec="*.tar") returned 0 [0054.255] lstrlenA (lpString="*.tar") returned 5 [0054.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF", pszSpec="*.gzip") returned 0 [0054.255] lstrlenA (lpString="*.gzip") returned 6 [0054.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF", pszSpec="*.jpg") returned 0 [0054.255] lstrlenA (lpString="*.jpg") returned 5 [0054.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF", pszSpec="*.jpeg") returned 0 [0054.255] lstrlenA (lpString="*.jpeg") returned 6 [0054.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF", pszSpec="*.psd") returned 0 [0054.255] lstrlenA (lpString="*.psd") returned 5 [0054.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF", pszSpec="*.gif") returned 1 [0054.255] lstrlenA (lpString="*.gif") returned 5 [0054.255] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF" [0054.255] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF" [0054.255] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF." [0054.255] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF.wannacry" [0054.255] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14583_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.256] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaf [0054.256] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8115e400, dwHighDateTime=0x1bd8f90), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc952300, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8115e400, dwHighDateTime=0x1bd8f90)) returned 1 [0054.256] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.256] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x31, lpOverlapped=0x0) returned 1 [0054.257] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF") returned="BD14583_.GIF" [0054.257] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.257] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x31, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x31, lpOverlapped=0x0) returned 1 [0054.257] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.257] CloseHandle (hObject=0x90) returned 1 [0054.258] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14583_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14583_.gif.wannacry")) returned 1 [0054.259] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4a53e00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb4a53e00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14654_.GIF", cAlternateFileName="")) returned 1 [0054.259] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.259] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14654_.GIF") returned 1 [0054.259] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14654_.GIF") returned 1 [0054.259] lstrcmpiA (lpString1="", lpString2="BD14654_.GIF") returned -1 [0054.259] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF") returned="BD14583_.GIF" [0054.259] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.259] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.259] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.259] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.260] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14654_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF" [0054.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF", pszSpec="*.zip") returned 0 [0054.260] lstrlenA (lpString="*.zip") returned 5 [0054.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF", pszSpec="*.rar") returned 0 [0054.260] lstrlenA (lpString="*.rar") returned 5 [0054.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF", pszSpec="*.7z") returned 0 [0054.260] lstrlenA (lpString="*.7z") returned 4 [0054.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF", pszSpec="*.tar") returned 0 [0054.260] lstrlenA (lpString="*.tar") returned 5 [0054.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF", pszSpec="*.gzip") returned 0 [0054.260] lstrlenA (lpString="*.gzip") returned 6 [0054.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF", pszSpec="*.jpg") returned 0 [0054.260] lstrlenA (lpString="*.jpg") returned 5 [0054.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF", pszSpec="*.jpeg") returned 0 [0054.260] lstrlenA (lpString="*.jpeg") returned 6 [0054.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF", pszSpec="*.psd") returned 0 [0054.260] lstrlenA (lpString="*.psd") returned 5 [0054.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF", pszSpec="*.gif") returned 1 [0054.260] lstrlenA (lpString="*.gif") returned 5 [0054.260] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF" [0054.260] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF" [0054.260] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF." [0054.260] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF.wannacry" [0054.260] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14654_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.261] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9 [0054.261] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb4a53e00, dwHighDateTime=0x1bd8f91), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc952300, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb4a53e00, dwHighDateTime=0x1bd8f91)) returned 1 [0054.261] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.261] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3b, lpOverlapped=0x0) returned 1 [0054.262] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF") returned="BD14654_.GIF" [0054.262] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.262] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3b, lpOverlapped=0x0) returned 1 [0054.262] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.262] CloseHandle (hObject=0x90) returned 1 [0054.267] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14654_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14654_.gif.wannacry")) returned 1 [0054.268] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4a53e00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb4a53e00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14655_.GIF", cAlternateFileName="")) returned 1 [0054.268] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.268] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14655_.GIF") returned 1 [0054.268] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14655_.GIF") returned 1 [0054.268] lstrcmpiA (lpString1="", lpString2="BD14655_.GIF") returned -1 [0054.268] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF") returned="BD14654_.GIF" [0054.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.268] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.268] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14655_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF" [0054.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF", pszSpec="*.zip") returned 0 [0054.268] lstrlenA (lpString="*.zip") returned 5 [0054.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF", pszSpec="*.rar") returned 0 [0054.268] lstrlenA (lpString="*.rar") returned 5 [0054.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF", pszSpec="*.7z") returned 0 [0054.268] lstrlenA (lpString="*.7z") returned 4 [0054.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF", pszSpec="*.tar") returned 0 [0054.268] lstrlenA (lpString="*.tar") returned 5 [0054.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF", pszSpec="*.gzip") returned 0 [0054.268] lstrlenA (lpString="*.gzip") returned 6 [0054.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF", pszSpec="*.jpg") returned 0 [0054.269] lstrlenA (lpString="*.jpg") returned 5 [0054.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF", pszSpec="*.jpeg") returned 0 [0054.269] lstrlenA (lpString="*.jpeg") returned 6 [0054.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF", pszSpec="*.psd") returned 0 [0054.269] lstrlenA (lpString="*.psd") returned 5 [0054.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF", pszSpec="*.gif") returned 1 [0054.269] lstrlenA (lpString="*.gif") returned 5 [0054.269] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF" [0054.269] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF" [0054.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF." [0054.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF.wannacry" [0054.269] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14655_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.270] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xad [0054.270] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb4a53e00, dwHighDateTime=0x1bd8f91), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc952300, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb4a53e00, dwHighDateTime=0x1bd8f91)) returned 1 [0054.270] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.270] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2f, lpOverlapped=0x0) returned 1 [0054.271] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF") returned="BD14655_.GIF" [0054.271] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.271] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2f, lpOverlapped=0x0) returned 1 [0054.272] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.272] CloseHandle (hObject=0x90) returned 1 [0054.275] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14655_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14655_.gif.wannacry")) returned 1 [0054.275] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5d66b00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb5d66b00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14656_.GIF", cAlternateFileName="")) returned 1 [0054.275] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.275] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14656_.GIF") returned 1 [0054.276] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14656_.GIF") returned 1 [0054.276] lstrcmpiA (lpString1="", lpString2="BD14656_.GIF") returned -1 [0054.276] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF") returned="BD14655_.GIF" [0054.276] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.276] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.276] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.276] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.276] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14656_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF" [0054.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF", pszSpec="*.zip") returned 0 [0054.276] lstrlenA (lpString="*.zip") returned 5 [0054.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF", pszSpec="*.rar") returned 0 [0054.276] lstrlenA (lpString="*.rar") returned 5 [0054.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF", pszSpec="*.7z") returned 0 [0054.276] lstrlenA (lpString="*.7z") returned 4 [0054.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF", pszSpec="*.tar") returned 0 [0054.276] lstrlenA (lpString="*.tar") returned 5 [0054.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF", pszSpec="*.gzip") returned 0 [0054.276] lstrlenA (lpString="*.gzip") returned 6 [0054.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF", pszSpec="*.jpg") returned 0 [0054.277] lstrlenA (lpString="*.jpg") returned 5 [0054.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF", pszSpec="*.jpeg") returned 0 [0054.277] lstrlenA (lpString="*.jpeg") returned 6 [0054.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF", pszSpec="*.psd") returned 0 [0054.277] lstrlenA (lpString="*.psd") returned 5 [0054.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF", pszSpec="*.gif") returned 1 [0054.277] lstrlenA (lpString="*.gif") returned 5 [0054.277] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF" [0054.277] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF" [0054.277] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF." [0054.277] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF.wannacry" [0054.277] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14656_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.277] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xad [0054.277] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5d66b00, dwHighDateTime=0x1bd8f91), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc952300, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5d66b00, dwHighDateTime=0x1bd8f91)) returned 1 [0054.277] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.277] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2f, lpOverlapped=0x0) returned 1 [0054.278] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF") returned="BD14656_.GIF" [0054.278] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.278] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2f, lpOverlapped=0x0) returned 1 [0054.279] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.279] CloseHandle (hObject=0x90) returned 1 [0054.280] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14656_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14656_.gif.wannacry")) returned 1 [0054.281] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4248700, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc4248700, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14691_.GIF", cAlternateFileName="")) returned 1 [0054.281] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.281] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14691_.GIF") returned 1 [0054.281] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14691_.GIF") returned 1 [0054.281] lstrcmpiA (lpString1="", lpString2="BD14691_.GIF") returned -1 [0054.281] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF") returned="BD14656_.GIF" [0054.281] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.281] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.281] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.281] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.281] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14691_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF" [0054.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF", pszSpec="*.zip") returned 0 [0054.281] lstrlenA (lpString="*.zip") returned 5 [0054.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF", pszSpec="*.rar") returned 0 [0054.281] lstrlenA (lpString="*.rar") returned 5 [0054.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF", pszSpec="*.7z") returned 0 [0054.282] lstrlenA (lpString="*.7z") returned 4 [0054.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF", pszSpec="*.tar") returned 0 [0054.282] lstrlenA (lpString="*.tar") returned 5 [0054.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF", pszSpec="*.gzip") returned 0 [0054.282] lstrlenA (lpString="*.gzip") returned 6 [0054.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF", pszSpec="*.jpg") returned 0 [0054.282] lstrlenA (lpString="*.jpg") returned 5 [0054.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF", pszSpec="*.jpeg") returned 0 [0054.282] lstrlenA (lpString="*.jpeg") returned 6 [0054.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF", pszSpec="*.psd") returned 0 [0054.282] lstrlenA (lpString="*.psd") returned 5 [0054.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF", pszSpec="*.gif") returned 1 [0054.282] lstrlenA (lpString="*.gif") returned 5 [0054.282] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF" [0054.282] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF" [0054.282] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF." [0054.282] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF.wannacry" [0054.282] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14691_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.282] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9 [0054.283] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc4248700, dwHighDateTime=0x1bd8f91), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc978460, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc4248700, dwHighDateTime=0x1bd8f91)) returned 1 [0054.283] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.283] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3b, lpOverlapped=0x0) returned 1 [0054.284] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF") returned="BD14691_.GIF" [0054.284] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.284] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3b, lpOverlapped=0x0) returned 1 [0054.284] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.284] CloseHandle (hObject=0x90) returned 1 [0054.287] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14691_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14691_.gif.wannacry")) returned 1 [0054.288] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4248700, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc4248700, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14692_.GIF", cAlternateFileName="")) returned 1 [0054.288] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.288] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14692_.GIF") returned 1 [0054.288] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14692_.GIF") returned 1 [0054.288] lstrcmpiA (lpString1="", lpString2="BD14692_.GIF") returned -1 [0054.288] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF") returned="BD14691_.GIF" [0054.288] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.288] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.288] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.288] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.288] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14692_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF" [0054.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF", pszSpec="*.zip") returned 0 [0054.288] lstrlenA (lpString="*.zip") returned 5 [0054.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF", pszSpec="*.rar") returned 0 [0054.288] lstrlenA (lpString="*.rar") returned 5 [0054.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF", pszSpec="*.7z") returned 0 [0054.288] lstrlenA (lpString="*.7z") returned 4 [0054.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF", pszSpec="*.tar") returned 0 [0054.288] lstrlenA (lpString="*.tar") returned 5 [0054.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF", pszSpec="*.gzip") returned 0 [0054.288] lstrlenA (lpString="*.gzip") returned 6 [0054.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF", pszSpec="*.jpg") returned 0 [0054.288] lstrlenA (lpString="*.jpg") returned 5 [0054.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF", pszSpec="*.jpeg") returned 0 [0054.289] lstrlenA (lpString="*.jpeg") returned 6 [0054.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF", pszSpec="*.psd") returned 0 [0054.289] lstrlenA (lpString="*.psd") returned 5 [0054.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF", pszSpec="*.gif") returned 1 [0054.289] lstrlenA (lpString="*.gif") returned 5 [0054.289] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF" [0054.289] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF" [0054.289] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF." [0054.289] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF.wannacry" [0054.289] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14692_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.290] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb1 [0054.290] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc4248700, dwHighDateTime=0x1bd8f91), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc978460, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc4248700, dwHighDateTime=0x1bd8f91)) returned 1 [0054.290] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.290] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x33, lpOverlapped=0x0) returned 1 [0054.291] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF") returned="BD14692_.GIF" [0054.292] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.292] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x33, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x33, lpOverlapped=0x0) returned 1 [0054.292] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.292] CloseHandle (hObject=0x90) returned 1 [0054.293] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14692_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14692_.gif.wannacry")) returned 1 [0054.297] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc555b400, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc555b400, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14693_.GIF", cAlternateFileName="")) returned 1 [0054.297] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.297] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14693_.GIF") returned 1 [0054.297] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14693_.GIF") returned 1 [0054.297] lstrcmpiA (lpString1="", lpString2="BD14693_.GIF") returned -1 [0054.297] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF") returned="BD14692_.GIF" [0054.297] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.297] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.297] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.297] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.298] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14693_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF" [0054.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF", pszSpec="*.zip") returned 0 [0054.298] lstrlenA (lpString="*.zip") returned 5 [0054.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF", pszSpec="*.rar") returned 0 [0054.298] lstrlenA (lpString="*.rar") returned 5 [0054.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF", pszSpec="*.7z") returned 0 [0054.298] lstrlenA (lpString="*.7z") returned 4 [0054.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF", pszSpec="*.tar") returned 0 [0054.298] lstrlenA (lpString="*.tar") returned 5 [0054.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF", pszSpec="*.gzip") returned 0 [0054.298] lstrlenA (lpString="*.gzip") returned 6 [0054.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF", pszSpec="*.jpg") returned 0 [0054.298] lstrlenA (lpString="*.jpg") returned 5 [0054.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF", pszSpec="*.jpeg") returned 0 [0054.298] lstrlenA (lpString="*.jpeg") returned 6 [0054.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF", pszSpec="*.psd") returned 0 [0054.299] lstrlenA (lpString="*.psd") returned 5 [0054.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF", pszSpec="*.gif") returned 1 [0054.299] lstrlenA (lpString="*.gif") returned 5 [0054.299] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF" [0054.299] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF" [0054.299] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF." [0054.299] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF.wannacry" [0054.299] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14693_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.299] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xad [0054.299] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc555b400, dwHighDateTime=0x1bd8f91), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc978460, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc555b400, dwHighDateTime=0x1bd8f91)) returned 1 [0054.299] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.299] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2f, lpOverlapped=0x0) returned 1 [0054.300] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF") returned="BD14693_.GIF" [0054.300] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.300] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2f, lpOverlapped=0x0) returned 1 [0054.300] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.301] CloseHandle (hObject=0x90) returned 1 [0054.301] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14693_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14693_.gif.wannacry")) returned 1 [0054.302] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecac8100, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xecac8100, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14752_.GIF", cAlternateFileName="")) returned 1 [0054.302] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.302] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14752_.GIF") returned 1 [0054.302] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14752_.GIF") returned 1 [0054.302] lstrcmpiA (lpString1="", lpString2="BD14752_.GIF") returned -1 [0054.302] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF") returned="BD14693_.GIF" [0054.303] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.303] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.303] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.303] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.303] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14752_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF" [0054.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF", pszSpec="*.zip") returned 0 [0054.303] lstrlenA (lpString="*.zip") returned 5 [0054.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF", pszSpec="*.rar") returned 0 [0054.303] lstrlenA (lpString="*.rar") returned 5 [0054.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF", pszSpec="*.7z") returned 0 [0054.303] lstrlenA (lpString="*.7z") returned 4 [0054.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF", pszSpec="*.tar") returned 0 [0054.303] lstrlenA (lpString="*.tar") returned 5 [0054.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF", pszSpec="*.gzip") returned 0 [0054.303] lstrlenA (lpString="*.gzip") returned 6 [0054.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF", pszSpec="*.jpg") returned 0 [0054.303] lstrlenA (lpString="*.jpg") returned 5 [0054.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF", pszSpec="*.jpeg") returned 0 [0054.303] lstrlenA (lpString="*.jpeg") returned 6 [0054.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF", pszSpec="*.psd") returned 0 [0054.303] lstrlenA (lpString="*.psd") returned 5 [0054.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF", pszSpec="*.gif") returned 1 [0054.303] lstrlenA (lpString="*.gif") returned 5 [0054.303] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF" [0054.303] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF" [0054.303] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF." [0054.303] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF.wannacry" [0054.303] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14752_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.304] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29b [0054.305] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xecac8100, dwHighDateTime=0x1bd8f91), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc978460, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xecac8100, dwHighDateTime=0x1bd8f91)) returned 1 [0054.305] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.305] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x21d, lpOverlapped=0x0) returned 1 [0054.306] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF") returned="BD14752_.GIF" [0054.306] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.306] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x21d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x21d, lpOverlapped=0x0) returned 1 [0054.306] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.306] CloseHandle (hObject=0x90) returned 1 [0054.307] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14752_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14752_.gif.wannacry")) returned 1 [0054.309] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecac8100, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xecac8100, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xbc, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14753_.GIF", cAlternateFileName="")) returned 1 [0054.309] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.309] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14753_.GIF") returned 1 [0054.309] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14753_.GIF") returned 1 [0054.309] lstrcmpiA (lpString1="", lpString2="BD14753_.GIF") returned -1 [0054.309] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF") returned="BD14752_.GIF" [0054.309] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.309] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.309] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.309] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.309] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14753_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF" [0054.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF", pszSpec="*.zip") returned 0 [0054.310] lstrlenA (lpString="*.zip") returned 5 [0054.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF", pszSpec="*.rar") returned 0 [0054.310] lstrlenA (lpString="*.rar") returned 5 [0054.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF", pszSpec="*.7z") returned 0 [0054.310] lstrlenA (lpString="*.7z") returned 4 [0054.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF", pszSpec="*.tar") returned 0 [0054.310] lstrlenA (lpString="*.tar") returned 5 [0054.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF", pszSpec="*.gzip") returned 0 [0054.310] lstrlenA (lpString="*.gzip") returned 6 [0054.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF", pszSpec="*.jpg") returned 0 [0054.310] lstrlenA (lpString="*.jpg") returned 5 [0054.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF", pszSpec="*.jpeg") returned 0 [0054.310] lstrlenA (lpString="*.jpeg") returned 6 [0054.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF", pszSpec="*.psd") returned 0 [0054.310] lstrlenA (lpString="*.psd") returned 5 [0054.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF", pszSpec="*.gif") returned 1 [0054.310] lstrlenA (lpString="*.gif") returned 5 [0054.310] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF" [0054.310] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF" [0054.310] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF." [0054.310] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF.wannacry" [0054.310] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14753_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.311] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbc [0054.311] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xecac8100, dwHighDateTime=0x1bd8f91), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc99e5c0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xecac8100, dwHighDateTime=0x1bd8f91)) returned 1 [0054.311] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.311] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3e, lpOverlapped=0x0) returned 1 [0054.312] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF") returned="BD14753_.GIF" [0054.312] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.312] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3e, lpOverlapped=0x0) returned 1 [0054.312] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.313] CloseHandle (hObject=0x90) returned 1 [0054.314] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14753_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14753_.gif.wannacry")) returned 1 [0054.314] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecac8100, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xecac8100, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14754_.GIF", cAlternateFileName="")) returned 1 [0054.314] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.314] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14754_.GIF") returned 1 [0054.314] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14754_.GIF") returned 1 [0054.314] lstrcmpiA (lpString1="", lpString2="BD14754_.GIF") returned -1 [0054.314] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF") returned="BD14753_.GIF" [0054.314] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.315] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.315] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.315] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.315] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14754_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF" [0054.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF", pszSpec="*.zip") returned 0 [0054.315] lstrlenA (lpString="*.zip") returned 5 [0054.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF", pszSpec="*.rar") returned 0 [0054.315] lstrlenA (lpString="*.rar") returned 5 [0054.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF", pszSpec="*.7z") returned 0 [0054.315] lstrlenA (lpString="*.7z") returned 4 [0054.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF", pszSpec="*.tar") returned 0 [0054.315] lstrlenA (lpString="*.tar") returned 5 [0054.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF", pszSpec="*.gzip") returned 0 [0054.315] lstrlenA (lpString="*.gzip") returned 6 [0054.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF", pszSpec="*.jpg") returned 0 [0054.315] lstrlenA (lpString="*.jpg") returned 5 [0054.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF", pszSpec="*.jpeg") returned 0 [0054.315] lstrlenA (lpString="*.jpeg") returned 6 [0054.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF", pszSpec="*.psd") returned 0 [0054.315] lstrlenA (lpString="*.psd") returned 5 [0054.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF", pszSpec="*.gif") returned 1 [0054.315] lstrlenA (lpString="*.gif") returned 5 [0054.315] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF" [0054.315] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF" [0054.315] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF." [0054.315] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF.wannacry" [0054.315] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14754_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.316] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb0 [0054.316] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xecac8100, dwHighDateTime=0x1bd8f91), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc99e5c0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xecac8100, dwHighDateTime=0x1bd8f91)) returned 1 [0054.316] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.316] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x32, lpOverlapped=0x0) returned 1 [0054.317] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF") returned="BD14754_.GIF" [0054.317] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.317] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x32, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x32, lpOverlapped=0x0) returned 1 [0054.317] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.317] CloseHandle (hObject=0x90) returned 1 [0054.318] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14754_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14754_.gif.wannacry")) returned 1 [0054.319] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fd2f700, ftCreationTime.dwHighDateTime=0x1bd4f43, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2fd2f700, ftLastWriteTime.dwHighDateTime=0x1bd4f43, nFileSizeHigh=0x0, nFileSizeLow=0x44, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14755_.GIF", cAlternateFileName="")) returned 1 [0054.319] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.319] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14755_.GIF") returned 1 [0054.319] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14755_.GIF") returned 1 [0054.319] lstrcmpiA (lpString1="", lpString2="BD14755_.GIF") returned -1 [0054.319] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF") returned="BD14754_.GIF" [0054.319] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.319] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.319] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.319] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.319] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14755_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF" [0054.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF", pszSpec="*.zip") returned 0 [0054.319] lstrlenA (lpString="*.zip") returned 5 [0054.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF", pszSpec="*.rar") returned 0 [0054.319] lstrlenA (lpString="*.rar") returned 5 [0054.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF", pszSpec="*.7z") returned 0 [0054.319] lstrlenA (lpString="*.7z") returned 4 [0054.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF", pszSpec="*.tar") returned 0 [0054.319] lstrlenA (lpString="*.tar") returned 5 [0054.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF", pszSpec="*.gzip") returned 0 [0054.319] lstrlenA (lpString="*.gzip") returned 6 [0054.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF", pszSpec="*.jpg") returned 0 [0054.319] lstrlenA (lpString="*.jpg") returned 5 [0054.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF", pszSpec="*.jpeg") returned 0 [0054.319] lstrlenA (lpString="*.jpeg") returned 6 [0054.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF", pszSpec="*.psd") returned 0 [0054.319] lstrlenA (lpString="*.psd") returned 5 [0054.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF", pszSpec="*.gif") returned 1 [0054.319] lstrlenA (lpString="*.gif") returned 5 [0054.319] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF" [0054.320] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF" [0054.320] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF." [0054.320] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF.wannacry" [0054.320] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14755_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.320] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x44 [0054.320] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x2fd2f700, dwHighDateTime=0x1bd4f43), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc99e5c0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x2fd2f700, dwHighDateTime=0x1bd4f43)) returned 1 [0054.320] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.320] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0054.320] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.320] CloseHandle (hObject=0x90) returned 1 [0054.320] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14755_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14755_.gif.wannacry")) returned 1 [0054.321] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedddae00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xedddae00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14756_.GIF", cAlternateFileName="")) returned 1 [0054.321] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.321] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14756_.GIF") returned 1 [0054.321] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14756_.GIF") returned 1 [0054.321] lstrcmpiA (lpString1="", lpString2="BD14756_.GIF") returned -1 [0054.321] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF") returned="BD14755_.GIF" [0054.321] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.321] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.321] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.321] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.321] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14756_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF" [0054.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF", pszSpec="*.zip") returned 0 [0054.321] lstrlenA (lpString="*.zip") returned 5 [0054.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF", pszSpec="*.rar") returned 0 [0054.321] lstrlenA (lpString="*.rar") returned 5 [0054.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF", pszSpec="*.7z") returned 0 [0054.321] lstrlenA (lpString="*.7z") returned 4 [0054.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF", pszSpec="*.tar") returned 0 [0054.321] lstrlenA (lpString="*.tar") returned 5 [0054.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF", pszSpec="*.gzip") returned 0 [0054.322] lstrlenA (lpString="*.gzip") returned 6 [0054.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF", pszSpec="*.jpg") returned 0 [0054.322] lstrlenA (lpString="*.jpg") returned 5 [0054.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF", pszSpec="*.jpeg") returned 0 [0054.322] lstrlenA (lpString="*.jpeg") returned 6 [0054.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF", pszSpec="*.psd") returned 0 [0054.322] lstrlenA (lpString="*.psd") returned 5 [0054.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF", pszSpec="*.gif") returned 1 [0054.322] lstrlenA (lpString="*.gif") returned 5 [0054.322] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF" [0054.322] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF" [0054.322] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF." [0054.322] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF.wannacry" [0054.322] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14756_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.323] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbf [0054.323] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xedddae00, dwHighDateTime=0x1bd8f91), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc99e5c0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xedddae00, dwHighDateTime=0x1bd8f91)) returned 1 [0054.323] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.323] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x41, lpOverlapped=0x0) returned 1 [0054.324] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF") returned="BD14756_.GIF" [0054.324] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.324] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x41, lpOverlapped=0x0) returned 1 [0054.324] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.324] CloseHandle (hObject=0x90) returned 1 [0054.328] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14756_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14756_.gif.wannacry")) returned 1 [0054.328] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedddae00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xedddae00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14757_.GIF", cAlternateFileName="")) returned 1 [0054.328] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.328] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14757_.GIF") returned 1 [0054.328] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14757_.GIF") returned 1 [0054.328] lstrcmpiA (lpString1="", lpString2="BD14757_.GIF") returned -1 [0054.328] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF") returned="BD14756_.GIF" [0054.328] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.328] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.328] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.328] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.328] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14757_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF" [0054.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF", pszSpec="*.zip") returned 0 [0054.329] lstrlenA (lpString="*.zip") returned 5 [0054.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF", pszSpec="*.rar") returned 0 [0054.329] lstrlenA (lpString="*.rar") returned 5 [0054.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF", pszSpec="*.7z") returned 0 [0054.329] lstrlenA (lpString="*.7z") returned 4 [0054.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF", pszSpec="*.tar") returned 0 [0054.329] lstrlenA (lpString="*.tar") returned 5 [0054.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF", pszSpec="*.gzip") returned 0 [0054.329] lstrlenA (lpString="*.gzip") returned 6 [0054.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF", pszSpec="*.jpg") returned 0 [0054.329] lstrlenA (lpString="*.jpg") returned 5 [0054.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF", pszSpec="*.jpeg") returned 0 [0054.329] lstrlenA (lpString="*.jpeg") returned 6 [0054.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF", pszSpec="*.psd") returned 0 [0054.329] lstrlenA (lpString="*.psd") returned 5 [0054.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF", pszSpec="*.gif") returned 1 [0054.329] lstrlenA (lpString="*.gif") returned 5 [0054.329] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF" [0054.329] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF" [0054.329] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF." [0054.329] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF.wannacry" [0054.329] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14757_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.330] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0054.330] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xedddae00, dwHighDateTime=0x1bd8f91), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc99e5c0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xedddae00, dwHighDateTime=0x1bd8f91)) returned 1 [0054.330] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.330] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x35, lpOverlapped=0x0) returned 1 [0054.331] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF") returned="BD14757_.GIF" [0054.331] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.331] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x35, lpOverlapped=0x0) returned 1 [0054.331] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.331] CloseHandle (hObject=0x90) returned 1 [0054.336] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14757_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14757_.gif.wannacry")) returned 1 [0054.337] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfafa9d00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfafa9d00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14790_.GIF", cAlternateFileName="")) returned 1 [0054.337] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.337] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14790_.GIF") returned 1 [0054.337] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14790_.GIF") returned 1 [0054.337] lstrcmpiA (lpString1="", lpString2="BD14790_.GIF") returned -1 [0054.337] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF") returned="BD14757_.GIF" [0054.337] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.337] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.337] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.337] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.337] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14790_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF" [0054.337] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF", pszSpec="*.zip") returned 0 [0054.337] lstrlenA (lpString="*.zip") returned 5 [0054.337] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF", pszSpec="*.rar") returned 0 [0054.337] lstrlenA (lpString="*.rar") returned 5 [0054.337] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF", pszSpec="*.7z") returned 0 [0054.337] lstrlenA (lpString="*.7z") returned 4 [0054.337] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF", pszSpec="*.tar") returned 0 [0054.337] lstrlenA (lpString="*.tar") returned 5 [0054.337] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF", pszSpec="*.gzip") returned 0 [0054.337] lstrlenA (lpString="*.gzip") returned 6 [0054.337] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF", pszSpec="*.jpg") returned 0 [0054.337] lstrlenA (lpString="*.jpg") returned 5 [0054.337] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF", pszSpec="*.jpeg") returned 0 [0054.337] lstrlenA (lpString="*.jpeg") returned 6 [0054.337] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF", pszSpec="*.psd") returned 0 [0054.338] lstrlenA (lpString="*.psd") returned 5 [0054.338] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF", pszSpec="*.gif") returned 1 [0054.338] lstrlenA (lpString="*.gif") returned 5 [0054.338] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF" [0054.338] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF" [0054.338] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF." [0054.338] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF.wannacry" [0054.338] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14790_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.340] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x111 [0054.340] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfafa9d00, dwHighDateTime=0x1bd8f91), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc9c4720, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xfafa9d00, dwHighDateTime=0x1bd8f91)) returned 1 [0054.340] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.341] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x93, lpOverlapped=0x0) returned 1 [0054.341] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF") returned="BD14790_.GIF" [0054.341] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.341] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x93, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x93, lpOverlapped=0x0) returned 1 [0054.342] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.342] CloseHandle (hObject=0x90) returned 1 [0054.346] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14790_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14790_.gif.wannacry")) returned 1 [0054.347] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfafa9d00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfafa9d00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x45b, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14791_.GIF", cAlternateFileName="")) returned 1 [0054.347] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.347] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14791_.GIF") returned 1 [0054.347] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14791_.GIF") returned 1 [0054.347] lstrcmpiA (lpString1="", lpString2="BD14791_.GIF") returned -1 [0054.347] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF") returned="BD14790_.GIF" [0054.347] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.347] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.347] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.347] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.347] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14791_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF" [0054.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF", pszSpec="*.zip") returned 0 [0054.347] lstrlenA (lpString="*.zip") returned 5 [0054.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF", pszSpec="*.rar") returned 0 [0054.347] lstrlenA (lpString="*.rar") returned 5 [0054.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF", pszSpec="*.7z") returned 0 [0054.347] lstrlenA (lpString="*.7z") returned 4 [0054.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF", pszSpec="*.tar") returned 0 [0054.347] lstrlenA (lpString="*.tar") returned 5 [0054.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF", pszSpec="*.gzip") returned 0 [0054.347] lstrlenA (lpString="*.gzip") returned 6 [0054.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF", pszSpec="*.jpg") returned 0 [0054.348] lstrlenA (lpString="*.jpg") returned 5 [0054.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF", pszSpec="*.jpeg") returned 0 [0054.348] lstrlenA (lpString="*.jpeg") returned 6 [0054.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF", pszSpec="*.psd") returned 0 [0054.348] lstrlenA (lpString="*.psd") returned 5 [0054.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF", pszSpec="*.gif") returned 1 [0054.348] lstrlenA (lpString="*.gif") returned 5 [0054.348] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF" [0054.348] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF" [0054.348] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF." [0054.348] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF.wannacry" [0054.348] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14791_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.348] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x45b [0054.348] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfafa9d00, dwHighDateTime=0x1bd8f91), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc9c4720, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xfafa9d00, dwHighDateTime=0x1bd8f91)) returned 1 [0054.348] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.348] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3dd, lpOverlapped=0x0) returned 1 [0054.350] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF") returned="BD14791_.GIF" [0054.350] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.350] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3dd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3dd, lpOverlapped=0x0) returned 1 [0054.351] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.351] CloseHandle (hObject=0x90) returned 1 [0054.352] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14791_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14791_.gif.wannacry")) returned 1 [0054.352] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfafa9d00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfafa9d00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14792_.GIF", cAlternateFileName="")) returned 1 [0054.353] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.353] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14792_.GIF") returned 1 [0054.353] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14792_.GIF") returned 1 [0054.353] lstrcmpiA (lpString1="", lpString2="BD14792_.GIF") returned -1 [0054.353] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF") returned="BD14791_.GIF" [0054.353] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.353] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.353] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.353] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.353] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14792_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF" [0054.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF", pszSpec="*.zip") returned 0 [0054.353] lstrlenA (lpString="*.zip") returned 5 [0054.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF", pszSpec="*.rar") returned 0 [0054.353] lstrlenA (lpString="*.rar") returned 5 [0054.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF", pszSpec="*.7z") returned 0 [0054.353] lstrlenA (lpString="*.7z") returned 4 [0054.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF", pszSpec="*.tar") returned 0 [0054.353] lstrlenA (lpString="*.tar") returned 5 [0054.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF", pszSpec="*.gzip") returned 0 [0054.353] lstrlenA (lpString="*.gzip") returned 6 [0054.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF", pszSpec="*.jpg") returned 0 [0054.353] lstrlenA (lpString="*.jpg") returned 5 [0054.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF", pszSpec="*.jpeg") returned 0 [0054.353] lstrlenA (lpString="*.jpeg") returned 6 [0054.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF", pszSpec="*.psd") returned 0 [0054.353] lstrlenA (lpString="*.psd") returned 5 [0054.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF", pszSpec="*.gif") returned 1 [0054.354] lstrlenA (lpString="*.gif") returned 5 [0054.354] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF" [0054.354] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF" [0054.354] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF." [0054.354] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF.wannacry" [0054.354] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14792_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.354] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfb [0054.354] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfafa9d00, dwHighDateTime=0x1bd8f91), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc9c4720, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xfafa9d00, dwHighDateTime=0x1bd8f91)) returned 1 [0054.354] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.354] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x7d, lpOverlapped=0x0) returned 1 [0054.356] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF") returned="BD14792_.GIF" [0054.356] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.356] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x7d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x7d, lpOverlapped=0x0) returned 1 [0054.356] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.356] CloseHandle (hObject=0x90) returned 1 [0054.357] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14792_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14792_.gif.wannacry")) returned 1 [0054.357] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc2bca00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfc2bca00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14793_.GIF", cAlternateFileName="")) returned 1 [0054.357] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.357] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14793_.GIF") returned 1 [0054.357] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14793_.GIF") returned 1 [0054.358] lstrcmpiA (lpString1="", lpString2="BD14793_.GIF") returned -1 [0054.358] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF") returned="BD14792_.GIF" [0054.358] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.358] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.358] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.358] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.358] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14793_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF" [0054.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF", pszSpec="*.zip") returned 0 [0054.358] lstrlenA (lpString="*.zip") returned 5 [0054.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF", pszSpec="*.rar") returned 0 [0054.358] lstrlenA (lpString="*.rar") returned 5 [0054.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF", pszSpec="*.7z") returned 0 [0054.358] lstrlenA (lpString="*.7z") returned 4 [0054.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF", pszSpec="*.tar") returned 0 [0054.358] lstrlenA (lpString="*.tar") returned 5 [0054.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF", pszSpec="*.gzip") returned 0 [0054.358] lstrlenA (lpString="*.gzip") returned 6 [0054.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF", pszSpec="*.jpg") returned 0 [0054.358] lstrlenA (lpString="*.jpg") returned 5 [0054.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF", pszSpec="*.jpeg") returned 0 [0054.358] lstrlenA (lpString="*.jpeg") returned 6 [0054.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF", pszSpec="*.psd") returned 0 [0054.358] lstrlenA (lpString="*.psd") returned 5 [0054.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF", pszSpec="*.gif") returned 1 [0054.358] lstrlenA (lpString="*.gif") returned 5 [0054.358] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF" [0054.358] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF" [0054.358] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF." [0054.359] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF.wannacry" [0054.359] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14793_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.359] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf0 [0054.359] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfc2bca00, dwHighDateTime=0x1bd8f91), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc9c4720, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xfc2bca00, dwHighDateTime=0x1bd8f91)) returned 1 [0054.359] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.359] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x72, lpOverlapped=0x0) returned 1 [0054.360] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF") returned="BD14793_.GIF" [0054.360] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.360] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x72, lpOverlapped=0x0) returned 1 [0054.360] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.360] CloseHandle (hObject=0x90) returned 1 [0054.362] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14793_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14793_.gif.wannacry")) returned 1 [0054.362] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc2bca00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfc2bca00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14794_.GIF", cAlternateFileName="")) returned 1 [0054.362] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.362] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14794_.GIF") returned 1 [0054.362] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14794_.GIF") returned 1 [0054.363] lstrcmpiA (lpString1="", lpString2="BD14794_.GIF") returned -1 [0054.363] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF") returned="BD14793_.GIF" [0054.363] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.363] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.363] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.363] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.363] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14794_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF" [0054.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF", pszSpec="*.zip") returned 0 [0054.363] lstrlenA (lpString="*.zip") returned 5 [0054.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF", pszSpec="*.rar") returned 0 [0054.363] lstrlenA (lpString="*.rar") returned 5 [0054.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF", pszSpec="*.7z") returned 0 [0054.363] lstrlenA (lpString="*.7z") returned 4 [0054.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF", pszSpec="*.tar") returned 0 [0054.363] lstrlenA (lpString="*.tar") returned 5 [0054.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF", pszSpec="*.gzip") returned 0 [0054.363] lstrlenA (lpString="*.gzip") returned 6 [0054.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF", pszSpec="*.jpg") returned 0 [0054.363] lstrlenA (lpString="*.jpg") returned 5 [0054.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF", pszSpec="*.jpeg") returned 0 [0054.363] lstrlenA (lpString="*.jpeg") returned 6 [0054.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF", pszSpec="*.psd") returned 0 [0054.363] lstrlenA (lpString="*.psd") returned 5 [0054.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF", pszSpec="*.gif") returned 1 [0054.364] lstrlenA (lpString="*.gif") returned 5 [0054.364] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF" [0054.364] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF" [0054.364] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF." [0054.364] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF.wannacry" [0054.364] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14794_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.365] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x103 [0054.365] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfc2bca00, dwHighDateTime=0x1bd8f91), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc9c4720, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xfc2bca00, dwHighDateTime=0x1bd8f91)) returned 1 [0054.365] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.365] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x85, lpOverlapped=0x0) returned 1 [0054.366] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF") returned="BD14794_.GIF" [0054.366] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.366] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x85, lpOverlapped=0x0) returned 1 [0054.366] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.366] CloseHandle (hObject=0x90) returned 1 [0054.367] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14794_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14794_.gif.wannacry")) returned 1 [0054.368] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc2bca00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfc2bca00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14795_.GIF", cAlternateFileName="")) returned 1 [0054.368] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.368] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14795_.GIF") returned 1 [0054.368] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14795_.GIF") returned 1 [0054.368] lstrcmpiA (lpString1="", lpString2="BD14795_.GIF") returned -1 [0054.368] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF") returned="BD14794_.GIF" [0054.368] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.368] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.368] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.368] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.368] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14795_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF" [0054.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF", pszSpec="*.zip") returned 0 [0054.368] lstrlenA (lpString="*.zip") returned 5 [0054.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF", pszSpec="*.rar") returned 0 [0054.368] lstrlenA (lpString="*.rar") returned 5 [0054.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF", pszSpec="*.7z") returned 0 [0054.368] lstrlenA (lpString="*.7z") returned 4 [0054.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF", pszSpec="*.tar") returned 0 [0054.368] lstrlenA (lpString="*.tar") returned 5 [0054.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF", pszSpec="*.gzip") returned 0 [0054.369] lstrlenA (lpString="*.gzip") returned 6 [0054.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF", pszSpec="*.jpg") returned 0 [0054.369] lstrlenA (lpString="*.jpg") returned 5 [0054.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF", pszSpec="*.jpeg") returned 0 [0054.369] lstrlenA (lpString="*.jpeg") returned 6 [0054.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF", pszSpec="*.psd") returned 0 [0054.369] lstrlenA (lpString="*.psd") returned 5 [0054.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF", pszSpec="*.gif") returned 1 [0054.369] lstrlenA (lpString="*.gif") returned 5 [0054.369] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF" [0054.369] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF" [0054.369] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF." [0054.369] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF.wannacry" [0054.369] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14795_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.370] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdb [0054.370] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfc2bca00, dwHighDateTime=0x1bd8f91), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc9c4720, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xfc2bca00, dwHighDateTime=0x1bd8f91)) returned 1 [0054.370] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.370] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x5d, lpOverlapped=0x0) returned 1 [0054.371] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF") returned="BD14795_.GIF" [0054.371] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.371] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x5d, lpOverlapped=0x0) returned 1 [0054.371] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.371] CloseHandle (hObject=0x90) returned 1 [0054.372] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14795_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14795_.gif.wannacry")) returned 1 [0054.373] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948b900, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x948b900, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xc0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14828_.GIF", cAlternateFileName="")) returned 1 [0054.373] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.373] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14828_.GIF") returned 1 [0054.373] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14828_.GIF") returned 1 [0054.373] lstrcmpiA (lpString1="", lpString2="BD14828_.GIF") returned -1 [0054.373] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF") returned="BD14795_.GIF" [0054.373] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.373] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.373] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.374] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.374] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14828_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF" [0054.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF", pszSpec="*.zip") returned 0 [0054.374] lstrlenA (lpString="*.zip") returned 5 [0054.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF", pszSpec="*.rar") returned 0 [0054.374] lstrlenA (lpString="*.rar") returned 5 [0054.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF", pszSpec="*.7z") returned 0 [0054.374] lstrlenA (lpString="*.7z") returned 4 [0054.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF", pszSpec="*.tar") returned 0 [0054.374] lstrlenA (lpString="*.tar") returned 5 [0054.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF", pszSpec="*.gzip") returned 0 [0054.374] lstrlenA (lpString="*.gzip") returned 6 [0054.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF", pszSpec="*.jpg") returned 0 [0054.374] lstrlenA (lpString="*.jpg") returned 5 [0054.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF", pszSpec="*.jpeg") returned 0 [0054.374] lstrlenA (lpString="*.jpeg") returned 6 [0054.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF", pszSpec="*.psd") returned 0 [0054.374] lstrlenA (lpString="*.psd") returned 5 [0054.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF", pszSpec="*.gif") returned 1 [0054.374] lstrlenA (lpString="*.gif") returned 5 [0054.374] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF" [0054.374] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF" [0054.374] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF." [0054.375] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF.wannacry" [0054.375] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14828_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.376] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc0 [0054.376] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x948b900, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc9ea880, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x948b900, dwHighDateTime=0x1bd8f92)) returned 1 [0054.376] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.376] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x42, lpOverlapped=0x0) returned 1 [0054.377] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF") returned="BD14828_.GIF" [0054.377] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.377] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x42, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x42, lpOverlapped=0x0) returned 1 [0054.378] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.378] CloseHandle (hObject=0x90) returned 1 [0054.379] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14828_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14828_.gif.wannacry")) returned 1 [0054.379] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948b900, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x948b900, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14829_.GIF", cAlternateFileName="")) returned 1 [0054.379] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.379] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14829_.GIF") returned 1 [0054.379] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14829_.GIF") returned 1 [0054.380] lstrcmpiA (lpString1="", lpString2="BD14829_.GIF") returned -1 [0054.380] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF") returned="BD14828_.GIF" [0054.380] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.380] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.380] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.380] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.380] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14829_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF" [0054.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF", pszSpec="*.zip") returned 0 [0054.380] lstrlenA (lpString="*.zip") returned 5 [0054.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF", pszSpec="*.rar") returned 0 [0054.380] lstrlenA (lpString="*.rar") returned 5 [0054.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF", pszSpec="*.7z") returned 0 [0054.380] lstrlenA (lpString="*.7z") returned 4 [0054.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF", pszSpec="*.tar") returned 0 [0054.380] lstrlenA (lpString="*.tar") returned 5 [0054.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF", pszSpec="*.gzip") returned 0 [0054.380] lstrlenA (lpString="*.gzip") returned 6 [0054.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF", pszSpec="*.jpg") returned 0 [0054.380] lstrlenA (lpString="*.jpg") returned 5 [0054.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF", pszSpec="*.jpeg") returned 0 [0054.380] lstrlenA (lpString="*.jpeg") returned 6 [0054.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF", pszSpec="*.psd") returned 0 [0054.381] lstrlenA (lpString="*.psd") returned 5 [0054.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF", pszSpec="*.gif") returned 1 [0054.381] lstrlenA (lpString="*.gif") returned 5 [0054.381] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF" [0054.381] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF" [0054.381] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF." [0054.381] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF.wannacry" [0054.381] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14829_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.381] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbf [0054.381] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x948b900, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc9ea880, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x948b900, dwHighDateTime=0x1bd8f92)) returned 1 [0054.381] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.381] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x41, lpOverlapped=0x0) returned 1 [0054.382] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF") returned="BD14829_.GIF" [0054.382] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.382] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x41, lpOverlapped=0x0) returned 1 [0054.383] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.383] CloseHandle (hObject=0x90) returned 1 [0054.384] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14829_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14829_.gif.wannacry")) returned 1 [0054.384] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa79e600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa79e600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb8, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14830_.GIF", cAlternateFileName="")) returned 1 [0054.384] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.384] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14830_.GIF") returned 1 [0054.384] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14830_.GIF") returned 1 [0054.385] lstrcmpiA (lpString1="", lpString2="BD14830_.GIF") returned -1 [0054.385] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF") returned="BD14829_.GIF" [0054.385] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.385] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.385] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.385] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.385] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14830_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF" [0054.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF", pszSpec="*.zip") returned 0 [0054.385] lstrlenA (lpString="*.zip") returned 5 [0054.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF", pszSpec="*.rar") returned 0 [0054.385] lstrlenA (lpString="*.rar") returned 5 [0054.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF", pszSpec="*.7z") returned 0 [0054.385] lstrlenA (lpString="*.7z") returned 4 [0054.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF", pszSpec="*.tar") returned 0 [0054.385] lstrlenA (lpString="*.tar") returned 5 [0054.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF", pszSpec="*.gzip") returned 0 [0054.385] lstrlenA (lpString="*.gzip") returned 6 [0054.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF", pszSpec="*.jpg") returned 0 [0054.385] lstrlenA (lpString="*.jpg") returned 5 [0054.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF", pszSpec="*.jpeg") returned 0 [0054.385] lstrlenA (lpString="*.jpeg") returned 6 [0054.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF", pszSpec="*.psd") returned 0 [0054.385] lstrlenA (lpString="*.psd") returned 5 [0054.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF", pszSpec="*.gif") returned 1 [0054.386] lstrlenA (lpString="*.gif") returned 5 [0054.386] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF" [0054.386] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF" [0054.386] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF." [0054.386] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF.wannacry" [0054.386] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14830_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.386] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb8 [0054.386] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa79e600, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc9ea880, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa79e600, dwHighDateTime=0x1bd8f92)) returned 1 [0054.386] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.386] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3a, lpOverlapped=0x0) returned 1 [0054.388] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF") returned="BD14830_.GIF" [0054.388] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.388] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3a, lpOverlapped=0x0) returned 1 [0054.388] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.388] CloseHandle (hObject=0x90) returned 1 [0054.391] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14830_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14830_.gif.wannacry")) returned 1 [0054.392] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa79e600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa79e600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14831_.GIF", cAlternateFileName="")) returned 1 [0054.392] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.392] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14831_.GIF") returned 1 [0054.392] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14831_.GIF") returned 1 [0054.392] lstrcmpiA (lpString1="", lpString2="BD14831_.GIF") returned -1 [0054.392] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF") returned="BD14830_.GIF" [0054.392] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.392] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.392] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.392] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.393] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14831_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF" [0054.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF", pszSpec="*.zip") returned 0 [0054.393] lstrlenA (lpString="*.zip") returned 5 [0054.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF", pszSpec="*.rar") returned 0 [0054.393] lstrlenA (lpString="*.rar") returned 5 [0054.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF", pszSpec="*.7z") returned 0 [0054.393] lstrlenA (lpString="*.7z") returned 4 [0054.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF", pszSpec="*.tar") returned 0 [0054.393] lstrlenA (lpString="*.tar") returned 5 [0054.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF", pszSpec="*.gzip") returned 0 [0054.393] lstrlenA (lpString="*.gzip") returned 6 [0054.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF", pszSpec="*.jpg") returned 0 [0054.393] lstrlenA (lpString="*.jpg") returned 5 [0054.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF", pszSpec="*.jpeg") returned 0 [0054.393] lstrlenA (lpString="*.jpeg") returned 6 [0054.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF", pszSpec="*.psd") returned 0 [0054.393] lstrlenA (lpString="*.psd") returned 5 [0054.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF", pszSpec="*.gif") returned 1 [0054.393] lstrlenA (lpString="*.gif") returned 5 [0054.393] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF" [0054.393] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF" [0054.393] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF." [0054.393] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF.wannacry" [0054.393] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14831_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.394] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0054.394] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa79e600, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc9ea880, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa79e600, dwHighDateTime=0x1bd8f92)) returned 1 [0054.394] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.394] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x35, lpOverlapped=0x0) returned 1 [0054.395] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF") returned="BD14831_.GIF" [0054.395] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.395] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x35, lpOverlapped=0x0) returned 1 [0054.395] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.395] CloseHandle (hObject=0x90) returned 1 [0054.396] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14831_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14831_.gif.wannacry")) returned 1 [0054.397] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa79e600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa79e600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14832_.GIF", cAlternateFileName="")) returned 1 [0054.397] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.397] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14832_.GIF") returned 1 [0054.397] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14832_.GIF") returned 1 [0054.397] lstrcmpiA (lpString1="", lpString2="BD14832_.GIF") returned -1 [0054.397] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF") returned="BD14831_.GIF" [0054.397] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.397] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.397] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14832_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF" [0054.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF", pszSpec="*.zip") returned 0 [0054.398] lstrlenA (lpString="*.zip") returned 5 [0054.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF", pszSpec="*.rar") returned 0 [0054.398] lstrlenA (lpString="*.rar") returned 5 [0054.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF", pszSpec="*.7z") returned 0 [0054.398] lstrlenA (lpString="*.7z") returned 4 [0054.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF", pszSpec="*.tar") returned 0 [0054.398] lstrlenA (lpString="*.tar") returned 5 [0054.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF", pszSpec="*.gzip") returned 0 [0054.398] lstrlenA (lpString="*.gzip") returned 6 [0054.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF", pszSpec="*.jpg") returned 0 [0054.398] lstrlenA (lpString="*.jpg") returned 5 [0054.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF", pszSpec="*.jpeg") returned 0 [0054.398] lstrlenA (lpString="*.jpeg") returned 6 [0054.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF", pszSpec="*.psd") returned 0 [0054.398] lstrlenA (lpString="*.psd") returned 5 [0054.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF", pszSpec="*.gif") returned 1 [0054.398] lstrlenA (lpString="*.gif") returned 5 [0054.398] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF" [0054.398] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF" [0054.398] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF." [0054.398] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF.wannacry" [0054.398] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14832_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.399] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb4 [0054.399] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa79e600, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc9ea880, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa79e600, dwHighDateTime=0x1bd8f92)) returned 1 [0054.399] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.399] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x36, lpOverlapped=0x0) returned 1 [0054.400] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF") returned="BD14832_.GIF" [0054.400] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.400] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x36, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x36, lpOverlapped=0x0) returned 1 [0054.401] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.401] CloseHandle (hObject=0x90) returned 1 [0054.408] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14832_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14832_.gif.wannacry")) returned 1 [0054.409] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa79e600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa79e600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14833_.GIF", cAlternateFileName="")) returned 1 [0054.409] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.409] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14833_.GIF") returned 1 [0054.409] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14833_.GIF") returned 1 [0054.409] lstrcmpiA (lpString1="", lpString2="BD14833_.GIF") returned -1 [0054.410] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF") returned="BD14832_.GIF" [0054.410] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.410] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.410] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.410] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.410] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14833_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF" [0054.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF", pszSpec="*.zip") returned 0 [0054.410] lstrlenA (lpString="*.zip") returned 5 [0054.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF", pszSpec="*.rar") returned 0 [0054.410] lstrlenA (lpString="*.rar") returned 5 [0054.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF", pszSpec="*.7z") returned 0 [0054.410] lstrlenA (lpString="*.7z") returned 4 [0054.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF", pszSpec="*.tar") returned 0 [0054.410] lstrlenA (lpString="*.tar") returned 5 [0054.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF", pszSpec="*.gzip") returned 0 [0054.410] lstrlenA (lpString="*.gzip") returned 6 [0054.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF", pszSpec="*.jpg") returned 0 [0054.410] lstrlenA (lpString="*.jpg") returned 5 [0054.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF", pszSpec="*.jpeg") returned 0 [0054.410] lstrlenA (lpString="*.jpeg") returned 6 [0054.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF", pszSpec="*.psd") returned 0 [0054.410] lstrlenA (lpString="*.psd") returned 5 [0054.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF", pszSpec="*.gif") returned 1 [0054.410] lstrlenA (lpString="*.gif") returned 5 [0054.410] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF" [0054.410] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF" [0054.410] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF." [0054.410] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF.wannacry" [0054.410] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14833_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.411] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb2 [0054.411] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa79e600, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbca109e0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa79e600, dwHighDateTime=0x1bd8f92)) returned 1 [0054.411] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.411] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x34, lpOverlapped=0x0) returned 1 [0054.412] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF") returned="BD14833_.GIF" [0054.412] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.412] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x34, lpOverlapped=0x0) returned 1 [0054.412] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.412] CloseHandle (hObject=0x90) returned 1 [0054.413] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14833_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14833_.gif.wannacry")) returned 1 [0054.414] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1796d500, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1796d500, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14866_.GIF", cAlternateFileName="")) returned 1 [0054.414] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.414] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14866_.GIF") returned 1 [0054.414] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14866_.GIF") returned 1 [0054.414] lstrcmpiA (lpString1="", lpString2="BD14866_.GIF") returned -1 [0054.414] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF") returned="BD14833_.GIF" [0054.414] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.414] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.414] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.414] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.414] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14866_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF" [0054.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF", pszSpec="*.zip") returned 0 [0054.415] lstrlenA (lpString="*.zip") returned 5 [0054.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF", pszSpec="*.rar") returned 0 [0054.415] lstrlenA (lpString="*.rar") returned 5 [0054.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF", pszSpec="*.7z") returned 0 [0054.415] lstrlenA (lpString="*.7z") returned 4 [0054.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF", pszSpec="*.tar") returned 0 [0054.415] lstrlenA (lpString="*.tar") returned 5 [0054.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF", pszSpec="*.gzip") returned 0 [0054.415] lstrlenA (lpString="*.gzip") returned 6 [0054.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF", pszSpec="*.jpg") returned 0 [0054.415] lstrlenA (lpString="*.jpg") returned 5 [0054.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF", pszSpec="*.jpeg") returned 0 [0054.415] lstrlenA (lpString="*.jpeg") returned 6 [0054.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF", pszSpec="*.psd") returned 0 [0054.415] lstrlenA (lpString="*.psd") returned 5 [0054.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF", pszSpec="*.gif") returned 1 [0054.415] lstrlenA (lpString="*.gif") returned 5 [0054.415] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14866_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.416] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f5 [0054.416] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1796d500, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbca109e0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1796d500, dwHighDateTime=0x1bd8f92)) returned 1 [0054.417] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.417] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x177, lpOverlapped=0x0) returned 1 [0054.418] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF") returned="BD14866_.GIF" [0054.418] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.418] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x177, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x177, lpOverlapped=0x0) returned 1 [0054.418] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.418] CloseHandle (hObject=0x90) returned 1 [0054.419] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14866_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14866_.gif.wannacry")) returned 1 [0054.420] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18c80200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x18c80200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14867_.GIF", cAlternateFileName="")) returned 1 [0054.420] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.420] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14867_.GIF") returned 1 [0054.420] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14867_.GIF") returned 1 [0054.420] lstrcmpiA (lpString1="", lpString2="BD14867_.GIF") returned -1 [0054.420] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF") returned="BD14866_.GIF" [0054.420] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.420] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.421] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.421] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14867_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF" [0054.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF", pszSpec="*.zip") returned 0 [0054.421] lstrlenA (lpString="*.zip") returned 5 [0054.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF", pszSpec="*.rar") returned 0 [0054.421] lstrlenA (lpString="*.rar") returned 5 [0054.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF", pszSpec="*.7z") returned 0 [0054.421] lstrlenA (lpString="*.7z") returned 4 [0054.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF", pszSpec="*.tar") returned 0 [0054.421] lstrlenA (lpString="*.tar") returned 5 [0054.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF", pszSpec="*.gzip") returned 0 [0054.421] lstrlenA (lpString="*.gzip") returned 6 [0054.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF", pszSpec="*.jpg") returned 0 [0054.421] lstrlenA (lpString="*.jpg") returned 5 [0054.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF", pszSpec="*.jpeg") returned 0 [0054.421] lstrlenA (lpString="*.jpeg") returned 6 [0054.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF", pszSpec="*.psd") returned 0 [0054.421] lstrlenA (lpString="*.psd") returned 5 [0054.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF", pszSpec="*.gif") returned 1 [0054.421] lstrlenA (lpString="*.gif") returned 5 [0054.421] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF" [0054.421] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF" [0054.421] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF." [0054.421] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF.wannacry" [0054.422] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14867_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.422] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfd [0054.422] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x18c80200, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbca109e0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x18c80200, dwHighDateTime=0x1bd8f92)) returned 1 [0054.422] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.422] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x7f, lpOverlapped=0x0) returned 1 [0054.424] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF") returned="BD14867_.GIF" [0054.424] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.424] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x7f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x7f, lpOverlapped=0x0) returned 1 [0054.424] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.424] CloseHandle (hObject=0x90) returned 1 [0054.427] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14867_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14867_.gif.wannacry")) returned 1 [0054.428] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18c80200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x18c80200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14868_.GIF", cAlternateFileName="")) returned 1 [0054.428] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.428] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14868_.GIF") returned 1 [0054.428] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14868_.GIF") returned 1 [0054.428] lstrcmpiA (lpString1="", lpString2="BD14868_.GIF") returned -1 [0054.428] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF") returned="BD14867_.GIF" [0054.428] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.428] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.428] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.428] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.428] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14868_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF" [0054.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF", pszSpec="*.zip") returned 0 [0054.428] lstrlenA (lpString="*.zip") returned 5 [0054.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF", pszSpec="*.rar") returned 0 [0054.429] lstrlenA (lpString="*.rar") returned 5 [0054.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF", pszSpec="*.7z") returned 0 [0054.429] lstrlenA (lpString="*.7z") returned 4 [0054.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF", pszSpec="*.tar") returned 0 [0054.429] lstrlenA (lpString="*.tar") returned 5 [0054.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF", pszSpec="*.gzip") returned 0 [0054.429] lstrlenA (lpString="*.gzip") returned 6 [0054.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF", pszSpec="*.jpg") returned 0 [0054.429] lstrlenA (lpString="*.jpg") returned 5 [0054.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF", pszSpec="*.jpeg") returned 0 [0054.429] lstrlenA (lpString="*.jpeg") returned 6 [0054.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF", pszSpec="*.psd") returned 0 [0054.429] lstrlenA (lpString="*.psd") returned 5 [0054.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF", pszSpec="*.gif") returned 1 [0054.429] lstrlenA (lpString="*.gif") returned 5 [0054.429] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF" [0054.429] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF" [0054.429] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF." [0054.429] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF.wannacry" [0054.429] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14868_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.430] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a3 [0054.430] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x18c80200, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbca109e0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x18c80200, dwHighDateTime=0x1bd8f92)) returned 1 [0054.430] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.430] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x125, lpOverlapped=0x0) returned 1 [0054.431] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF") returned="BD14868_.GIF" [0054.431] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.431] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x125, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x125, lpOverlapped=0x0) returned 1 [0054.431] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.431] CloseHandle (hObject=0x90) returned 1 [0054.435] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14868_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14868_.gif.wannacry")) returned 1 [0054.436] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18c80200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x18c80200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14869_.GIF", cAlternateFileName="")) returned 1 [0054.436] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.436] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14869_.GIF") returned 1 [0054.436] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14869_.GIF") returned 1 [0054.436] lstrcmpiA (lpString1="", lpString2="BD14869_.GIF") returned -1 [0054.436] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF") returned="BD14868_.GIF" [0054.436] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.436] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.436] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.436] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.436] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14869_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF" [0054.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF", pszSpec="*.zip") returned 0 [0054.436] lstrlenA (lpString="*.zip") returned 5 [0054.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF", pszSpec="*.rar") returned 0 [0054.437] lstrlenA (lpString="*.rar") returned 5 [0054.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF", pszSpec="*.7z") returned 0 [0054.437] lstrlenA (lpString="*.7z") returned 4 [0054.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF", pszSpec="*.tar") returned 0 [0054.437] lstrlenA (lpString="*.tar") returned 5 [0054.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF", pszSpec="*.gzip") returned 0 [0054.437] lstrlenA (lpString="*.gzip") returned 6 [0054.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF", pszSpec="*.jpg") returned 0 [0054.437] lstrlenA (lpString="*.jpg") returned 5 [0054.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF", pszSpec="*.jpeg") returned 0 [0054.437] lstrlenA (lpString="*.jpeg") returned 6 [0054.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF", pszSpec="*.psd") returned 0 [0054.437] lstrlenA (lpString="*.psd") returned 5 [0054.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF", pszSpec="*.gif") returned 1 [0054.437] lstrlenA (lpString="*.gif") returned 5 [0054.437] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF" [0054.437] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF" [0054.437] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF." [0054.437] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF.wannacry" [0054.437] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14869_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.438] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc4 [0054.438] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x18c80200, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbca109e0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x18c80200, dwHighDateTime=0x1bd8f92)) returned 1 [0054.438] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.438] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x46, lpOverlapped=0x0) returned 1 [0054.439] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF") returned="BD14869_.GIF" [0054.439] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.439] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x46, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x46, lpOverlapped=0x0) returned 1 [0054.440] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.440] CloseHandle (hObject=0x90) returned 1 [0054.441] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14869_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14869_.gif.wannacry")) returned 1 [0054.442] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f92f00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x19f92f00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14870_.GIF", cAlternateFileName="")) returned 1 [0054.442] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.442] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14870_.GIF") returned 1 [0054.442] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14870_.GIF") returned 1 [0054.442] lstrcmpiA (lpString1="", lpString2="BD14870_.GIF") returned -1 [0054.442] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF") returned="BD14869_.GIF" [0054.442] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.442] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.442] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.443] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.443] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14870_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF" [0054.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF", pszSpec="*.zip") returned 0 [0054.443] lstrlenA (lpString="*.zip") returned 5 [0054.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF", pszSpec="*.rar") returned 0 [0054.443] lstrlenA (lpString="*.rar") returned 5 [0054.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF", pszSpec="*.7z") returned 0 [0054.443] lstrlenA (lpString="*.7z") returned 4 [0054.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF", pszSpec="*.tar") returned 0 [0054.443] lstrlenA (lpString="*.tar") returned 5 [0054.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF", pszSpec="*.gzip") returned 0 [0054.443] lstrlenA (lpString="*.gzip") returned 6 [0054.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF", pszSpec="*.jpg") returned 0 [0054.443] lstrlenA (lpString="*.jpg") returned 5 [0054.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF", pszSpec="*.jpeg") returned 0 [0054.443] lstrlenA (lpString="*.jpeg") returned 6 [0054.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF", pszSpec="*.psd") returned 0 [0054.443] lstrlenA (lpString="*.psd") returned 5 [0054.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF", pszSpec="*.gif") returned 1 [0054.443] lstrlenA (lpString="*.gif") returned 5 [0054.443] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF" [0054.443] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF" [0054.443] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF." [0054.443] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF.wannacry" [0054.444] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14870_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.445] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a4 [0054.445] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x19f92f00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbca36b40, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x19f92f00, dwHighDateTime=0x1bd8f92)) returned 1 [0054.445] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.445] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x126, lpOverlapped=0x0) returned 1 [0054.446] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF") returned="BD14870_.GIF" [0054.446] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.446] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x126, lpOverlapped=0x0) returned 1 [0054.446] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.447] CloseHandle (hObject=0x90) returned 1 [0054.449] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14870_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14870_.gif.wannacry")) returned 1 [0054.450] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f92f00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x19f92f00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xc2, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14871_.GIF", cAlternateFileName="")) returned 1 [0054.450] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.450] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14871_.GIF") returned 1 [0054.450] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14871_.GIF") returned 1 [0054.450] lstrcmpiA (lpString1="", lpString2="BD14871_.GIF") returned -1 [0054.450] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF") returned="BD14870_.GIF" [0054.450] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.450] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.450] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.450] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.450] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14871_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF" [0054.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF", pszSpec="*.zip") returned 0 [0054.450] lstrlenA (lpString="*.zip") returned 5 [0054.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF", pszSpec="*.rar") returned 0 [0054.450] lstrlenA (lpString="*.rar") returned 5 [0054.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF", pszSpec="*.7z") returned 0 [0054.450] lstrlenA (lpString="*.7z") returned 4 [0054.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF", pszSpec="*.tar") returned 0 [0054.450] lstrlenA (lpString="*.tar") returned 5 [0054.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF", pszSpec="*.gzip") returned 0 [0054.450] lstrlenA (lpString="*.gzip") returned 6 [0054.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF", pszSpec="*.jpg") returned 0 [0054.451] lstrlenA (lpString="*.jpg") returned 5 [0054.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF", pszSpec="*.jpeg") returned 0 [0054.451] lstrlenA (lpString="*.jpeg") returned 6 [0054.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF", pszSpec="*.psd") returned 0 [0054.451] lstrlenA (lpString="*.psd") returned 5 [0054.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF", pszSpec="*.gif") returned 1 [0054.451] lstrlenA (lpString="*.gif") returned 5 [0054.451] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF" [0054.451] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF" [0054.451] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF." [0054.451] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF.wannacry" [0054.451] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14871_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.451] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc2 [0054.452] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x19f92f00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbca36b40, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x19f92f00, dwHighDateTime=0x1bd8f92)) returned 1 [0054.452] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.452] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x44, lpOverlapped=0x0) returned 1 [0054.453] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF") returned="BD14871_.GIF" [0054.453] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.453] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x44, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x44, lpOverlapped=0x0) returned 1 [0054.453] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.453] CloseHandle (hObject=0x90) returned 1 [0054.457] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14871_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14871_.gif.wannacry")) returned 1 [0054.458] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c3a5000, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6c3a5000, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14980_.GIF", cAlternateFileName="")) returned 1 [0054.458] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.458] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14980_.GIF") returned 1 [0054.458] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14980_.GIF") returned 1 [0054.458] lstrcmpiA (lpString1="", lpString2="BD14980_.GIF") returned -1 [0054.458] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF") returned="BD14871_.GIF" [0054.458] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.459] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.459] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.459] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.459] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14980_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF" [0054.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF", pszSpec="*.zip") returned 0 [0054.459] lstrlenA (lpString="*.zip") returned 5 [0054.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF", pszSpec="*.rar") returned 0 [0054.459] lstrlenA (lpString="*.rar") returned 5 [0054.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF", pszSpec="*.7z") returned 0 [0054.459] lstrlenA (lpString="*.7z") returned 4 [0054.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF", pszSpec="*.tar") returned 0 [0054.459] lstrlenA (lpString="*.tar") returned 5 [0054.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF", pszSpec="*.gzip") returned 0 [0054.459] lstrlenA (lpString="*.gzip") returned 6 [0054.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF", pszSpec="*.jpg") returned 0 [0054.459] lstrlenA (lpString="*.jpg") returned 5 [0054.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF", pszSpec="*.jpeg") returned 0 [0054.459] lstrlenA (lpString="*.jpeg") returned 6 [0054.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF", pszSpec="*.psd") returned 0 [0054.459] lstrlenA (lpString="*.psd") returned 5 [0054.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF", pszSpec="*.gif") returned 1 [0054.459] lstrlenA (lpString="*.gif") returned 5 [0054.460] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF" [0054.460] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF" [0054.460] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF." [0054.460] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF.wannacry" [0054.460] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14980_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.461] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1cf [0054.461] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6c3a5000, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbca36b40, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6c3a5000, dwHighDateTime=0x1bd8f92)) returned 1 [0054.461] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.461] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x151, lpOverlapped=0x0) returned 1 [0054.463] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF") returned="BD14980_.GIF" [0054.463] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.463] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x151, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x151, lpOverlapped=0x0) returned 1 [0054.463] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.463] CloseHandle (hObject=0x90) returned 1 [0054.464] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14980_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14980_.gif.wannacry")) returned 1 [0054.465] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d6b7d00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6d6b7d00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x164, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14981_.GIF", cAlternateFileName="")) returned 1 [0054.465] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.465] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14981_.GIF") returned 1 [0054.465] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14981_.GIF") returned 1 [0054.465] lstrcmpiA (lpString1="", lpString2="BD14981_.GIF") returned -1 [0054.465] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF") returned="BD14980_.GIF" [0054.465] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.465] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.465] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.465] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.466] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14981_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF" [0054.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF", pszSpec="*.zip") returned 0 [0054.466] lstrlenA (lpString="*.zip") returned 5 [0054.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF", pszSpec="*.rar") returned 0 [0054.466] lstrlenA (lpString="*.rar") returned 5 [0054.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF", pszSpec="*.7z") returned 0 [0054.466] lstrlenA (lpString="*.7z") returned 4 [0054.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF", pszSpec="*.tar") returned 0 [0054.466] lstrlenA (lpString="*.tar") returned 5 [0054.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF", pszSpec="*.gzip") returned 0 [0054.466] lstrlenA (lpString="*.gzip") returned 6 [0054.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF", pszSpec="*.jpg") returned 0 [0054.466] lstrlenA (lpString="*.jpg") returned 5 [0054.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF", pszSpec="*.jpeg") returned 0 [0054.466] lstrlenA (lpString="*.jpeg") returned 6 [0054.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF", pszSpec="*.psd") returned 0 [0054.466] lstrlenA (lpString="*.psd") returned 5 [0054.466] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF", pszSpec="*.gif") returned 1 [0054.466] lstrlenA (lpString="*.gif") returned 5 [0054.466] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF" [0054.466] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF" [0054.466] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF." [0054.466] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF.wannacry" [0054.466] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14981_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.467] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x164 [0054.467] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6d6b7d00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbca36b40, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6d6b7d00, dwHighDateTime=0x1bd8f92)) returned 1 [0054.467] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.467] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xe6, lpOverlapped=0x0) returned 1 [0054.468] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF") returned="BD14981_.GIF" [0054.468] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.468] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xe6, lpOverlapped=0x0) returned 1 [0054.469] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.469] CloseHandle (hObject=0x90) returned 1 [0054.472] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14981_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14981_.gif.wannacry")) returned 1 [0054.473] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56d8700, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc56d8700, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14982_.GIF", cAlternateFileName="")) returned 1 [0054.473] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.473] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14982_.GIF") returned 1 [0054.473] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14982_.GIF") returned 1 [0054.473] lstrcmpiA (lpString1="", lpString2="BD14982_.GIF") returned -1 [0054.473] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF") returned="BD14981_.GIF" [0054.473] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.473] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.473] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.473] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.473] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14982_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF" [0054.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF", pszSpec="*.zip") returned 0 [0054.473] lstrlenA (lpString="*.zip") returned 5 [0054.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF", pszSpec="*.rar") returned 0 [0054.473] lstrlenA (lpString="*.rar") returned 5 [0054.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF", pszSpec="*.7z") returned 0 [0054.473] lstrlenA (lpString="*.7z") returned 4 [0054.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF", pszSpec="*.tar") returned 0 [0054.473] lstrlenA (lpString="*.tar") returned 5 [0054.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF", pszSpec="*.gzip") returned 0 [0054.473] lstrlenA (lpString="*.gzip") returned 6 [0054.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF", pszSpec="*.jpg") returned 0 [0054.474] lstrlenA (lpString="*.jpg") returned 5 [0054.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF", pszSpec="*.jpeg") returned 0 [0054.474] lstrlenA (lpString="*.jpeg") returned 6 [0054.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF", pszSpec="*.psd") returned 0 [0054.474] lstrlenA (lpString="*.psd") returned 5 [0054.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF", pszSpec="*.gif") returned 1 [0054.474] lstrlenA (lpString="*.gif") returned 5 [0054.474] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF" [0054.474] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF" [0054.474] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF." [0054.474] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF.wannacry" [0054.474] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14982_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.475] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc6 [0054.475] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc56d8700, dwHighDateTime=0x1bd4f41), lpLastAccessTime=0x407536*(dwLowDateTime=0xbca5cca0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc56d8700, dwHighDateTime=0x1bd4f41)) returned 1 [0054.475] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.475] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x48, lpOverlapped=0x0) returned 1 [0054.476] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF") returned="BD14982_.GIF" [0054.476] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.476] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x48, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x48, lpOverlapped=0x0) returned 1 [0054.476] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.476] CloseHandle (hObject=0x90) returned 1 [0054.477] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14982_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14982_.gif.wannacry")) returned 1 [0054.478] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc43c5a00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc43c5a00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x7c, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14983_.GIF", cAlternateFileName="")) returned 1 [0054.479] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.479] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14983_.GIF") returned 1 [0054.479] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14983_.GIF") returned 1 [0054.479] lstrcmpiA (lpString1="", lpString2="BD14983_.GIF") returned -1 [0054.480] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF") returned="BD14982_.GIF" [0054.480] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.480] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.480] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.480] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.480] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14983_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF" [0054.480] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF", pszSpec="*.zip") returned 0 [0054.480] lstrlenA (lpString="*.zip") returned 5 [0054.480] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF", pszSpec="*.rar") returned 0 [0054.480] lstrlenA (lpString="*.rar") returned 5 [0054.480] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF", pszSpec="*.7z") returned 0 [0054.480] lstrlenA (lpString="*.7z") returned 4 [0054.480] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF", pszSpec="*.tar") returned 0 [0054.480] lstrlenA (lpString="*.tar") returned 5 [0054.480] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF", pszSpec="*.gzip") returned 0 [0054.480] lstrlenA (lpString="*.gzip") returned 6 [0054.480] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF", pszSpec="*.jpg") returned 0 [0054.480] lstrlenA (lpString="*.jpg") returned 5 [0054.480] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF", pszSpec="*.jpeg") returned 0 [0054.480] lstrlenA (lpString="*.jpeg") returned 6 [0054.480] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF", pszSpec="*.psd") returned 0 [0054.480] lstrlenA (lpString="*.psd") returned 5 [0054.480] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF", pszSpec="*.gif") returned 1 [0054.480] lstrlenA (lpString="*.gif") returned 5 [0054.480] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF" [0054.481] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF" [0054.481] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF." [0054.481] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF.wannacry" [0054.481] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14983_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.481] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7c [0054.481] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc43c5a00, dwHighDateTime=0x1bd4f41), lpLastAccessTime=0x407536*(dwLowDateTime=0xbca5cca0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc43c5a00, dwHighDateTime=0x1bd4f41)) returned 1 [0054.481] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.481] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0054.481] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.481] CloseHandle (hObject=0x90) returned 1 [0054.482] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14983_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14983_.gif.wannacry")) returned 1 [0054.483] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc30b2d00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc30b2d00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14984_.GIF", cAlternateFileName="")) returned 1 [0054.483] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.483] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14984_.GIF") returned 1 [0054.483] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14984_.GIF") returned 1 [0054.483] lstrcmpiA (lpString1="", lpString2="BD14984_.GIF") returned -1 [0054.483] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF") returned="BD14983_.GIF" [0054.483] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.483] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.483] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.483] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.483] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14984_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF" [0054.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF", pszSpec="*.zip") returned 0 [0054.483] lstrlenA (lpString="*.zip") returned 5 [0054.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF", pszSpec="*.rar") returned 0 [0054.483] lstrlenA (lpString="*.rar") returned 5 [0054.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF", pszSpec="*.7z") returned 0 [0054.483] lstrlenA (lpString="*.7z") returned 4 [0054.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF", pszSpec="*.tar") returned 0 [0054.483] lstrlenA (lpString="*.tar") returned 5 [0054.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF", pszSpec="*.gzip") returned 0 [0054.484] lstrlenA (lpString="*.gzip") returned 6 [0054.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF", pszSpec="*.jpg") returned 0 [0054.484] lstrlenA (lpString="*.jpg") returned 5 [0054.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF", pszSpec="*.jpeg") returned 0 [0054.484] lstrlenA (lpString="*.jpeg") returned 6 [0054.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF", pszSpec="*.psd") returned 0 [0054.484] lstrlenA (lpString="*.psd") returned 5 [0054.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF", pszSpec="*.gif") returned 1 [0054.484] lstrlenA (lpString="*.gif") returned 5 [0054.484] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF" [0054.484] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF" [0054.484] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF." [0054.484] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF.wannacry" [0054.484] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14984_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.485] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb6 [0054.485] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc30b2d00, dwHighDateTime=0x1bd4f41), lpLastAccessTime=0x407536*(dwLowDateTime=0xbca5cca0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc30b2d00, dwHighDateTime=0x1bd4f41)) returned 1 [0054.486] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.486] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x38, lpOverlapped=0x0) returned 1 [0054.487] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF") returned="BD14984_.GIF" [0054.487] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.487] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x38, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x38, lpOverlapped=0x0) returned 1 [0054.487] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.487] CloseHandle (hObject=0x90) returned 1 [0054.488] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14984_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14984_.gif.wannacry")) returned 1 [0054.489] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1da0000, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc1da0000, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x40, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14985_.GIF", cAlternateFileName="")) returned 1 [0054.489] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.489] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14985_.GIF") returned 1 [0054.489] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14985_.GIF") returned 1 [0054.489] lstrcmpiA (lpString1="", lpString2="BD14985_.GIF") returned -1 [0054.489] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF") returned="BD14984_.GIF" [0054.489] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.489] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.489] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.489] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.489] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD14985_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF" [0054.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF", pszSpec="*.zip") returned 0 [0054.490] lstrlenA (lpString="*.zip") returned 5 [0054.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF", pszSpec="*.rar") returned 0 [0054.490] lstrlenA (lpString="*.rar") returned 5 [0054.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF", pszSpec="*.7z") returned 0 [0054.490] lstrlenA (lpString="*.7z") returned 4 [0054.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF", pszSpec="*.tar") returned 0 [0054.490] lstrlenA (lpString="*.tar") returned 5 [0054.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF", pszSpec="*.gzip") returned 0 [0054.490] lstrlenA (lpString="*.gzip") returned 6 [0054.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF", pszSpec="*.jpg") returned 0 [0054.490] lstrlenA (lpString="*.jpg") returned 5 [0054.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF", pszSpec="*.jpeg") returned 0 [0054.490] lstrlenA (lpString="*.jpeg") returned 6 [0054.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF", pszSpec="*.psd") returned 0 [0054.490] lstrlenA (lpString="*.psd") returned 5 [0054.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF", pszSpec="*.gif") returned 1 [0054.490] lstrlenA (lpString="*.gif") returned 5 [0054.490] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF" [0054.490] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF" [0054.490] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF." [0054.490] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF.wannacry" [0054.490] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14985_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.491] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40 [0054.491] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc1da0000, dwHighDateTime=0x1bd4f41), lpLastAccessTime=0x407536*(dwLowDateTime=0xbca5cca0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc1da0000, dwHighDateTime=0x1bd4f41)) returned 1 [0054.491] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.491] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0054.491] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.491] CloseHandle (hObject=0x90) returned 1 [0054.491] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14985_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14985_.gif.wannacry")) returned 1 [0054.492] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57254000, ftCreationTime.dwHighDateTime=0x1bd5ec1, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x57254000, ftLastWriteTime.dwHighDateTime=0x1bd5ec1, nFileSizeHigh=0x0, nFileSizeLow=0x40f6, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15018_.GIF", cAlternateFileName="")) returned 1 [0054.492] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.492] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15018_.GIF") returned 1 [0054.492] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15018_.GIF") returned 1 [0054.492] lstrcmpiA (lpString1="", lpString2="BD15018_.GIF") returned -1 [0054.492] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF") returned="BD14985_.GIF" [0054.492] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.492] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.492] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.492] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.492] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD15018_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF" [0054.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF", pszSpec="*.zip") returned 0 [0054.492] lstrlenA (lpString="*.zip") returned 5 [0054.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF", pszSpec="*.rar") returned 0 [0054.493] lstrlenA (lpString="*.rar") returned 5 [0054.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF", pszSpec="*.7z") returned 0 [0054.493] lstrlenA (lpString="*.7z") returned 4 [0054.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF", pszSpec="*.tar") returned 0 [0054.493] lstrlenA (lpString="*.tar") returned 5 [0054.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF", pszSpec="*.gzip") returned 0 [0054.493] lstrlenA (lpString="*.gzip") returned 6 [0054.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF", pszSpec="*.jpg") returned 0 [0054.493] lstrlenA (lpString="*.jpg") returned 5 [0054.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF", pszSpec="*.jpeg") returned 0 [0054.493] lstrlenA (lpString="*.jpeg") returned 6 [0054.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF", pszSpec="*.psd") returned 0 [0054.493] lstrlenA (lpString="*.psd") returned 5 [0054.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF", pszSpec="*.gif") returned 1 [0054.493] lstrlenA (lpString="*.gif") returned 5 [0054.493] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF" [0054.493] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF" [0054.493] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF." [0054.493] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF.wannacry" [0054.493] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15018_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.495] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40f6 [0054.495] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x57254000, dwHighDateTime=0x1bd5ec1), lpLastAccessTime=0x407536*(dwLowDateTime=0xbca5cca0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x57254000, dwHighDateTime=0x1bd5ec1)) returned 1 [0054.495] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.495] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4078, lpOverlapped=0x0) returned 1 [0054.497] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF") returned="BD15018_.GIF" [0054.497] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.497] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4078, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4078, lpOverlapped=0x0) returned 1 [0054.497] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.497] CloseHandle (hObject=0x90) returned 1 [0054.499] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15018_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15018_.gif.wannacry")) returned 1 [0054.499] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bb99900, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7bb99900, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15019_.GIF", cAlternateFileName="")) returned 1 [0054.500] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.500] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15019_.GIF") returned 1 [0054.500] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15019_.GIF") returned 1 [0054.500] lstrcmpiA (lpString1="", lpString2="BD15019_.GIF") returned -1 [0054.500] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF") returned="BD15018_.GIF" [0054.500] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.500] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.500] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.500] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.500] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD15019_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF" [0054.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF", pszSpec="*.zip") returned 0 [0054.500] lstrlenA (lpString="*.zip") returned 5 [0054.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF", pszSpec="*.rar") returned 0 [0054.500] lstrlenA (lpString="*.rar") returned 5 [0054.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF", pszSpec="*.7z") returned 0 [0054.500] lstrlenA (lpString="*.7z") returned 4 [0054.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF", pszSpec="*.tar") returned 0 [0054.500] lstrlenA (lpString="*.tar") returned 5 [0054.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF", pszSpec="*.gzip") returned 0 [0054.500] lstrlenA (lpString="*.gzip") returned 6 [0054.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF", pszSpec="*.jpg") returned 0 [0054.500] lstrlenA (lpString="*.jpg") returned 5 [0054.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF", pszSpec="*.jpeg") returned 0 [0054.500] lstrlenA (lpString="*.jpeg") returned 6 [0054.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF", pszSpec="*.psd") returned 0 [0054.501] lstrlenA (lpString="*.psd") returned 5 [0054.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF", pszSpec="*.gif") returned 1 [0054.501] lstrlenA (lpString="*.gif") returned 5 [0054.501] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF" [0054.501] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF" [0054.501] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF." [0054.501] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF.wannacry" [0054.501] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15019_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.501] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfe [0054.501] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7bb99900, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbca82e00, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7bb99900, dwHighDateTime=0x1bd8f92)) returned 1 [0054.501] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.502] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x80, lpOverlapped=0x0) returned 1 [0054.503] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF") returned="BD15019_.GIF" [0054.503] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.503] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x80, lpOverlapped=0x0) returned 1 [0054.503] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.503] CloseHandle (hObject=0x90) returned 1 [0054.504] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15019_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15019_.gif.wannacry")) returned 1 [0054.505] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83dcdc00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x83dcdc00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x63, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15020_.GIF", cAlternateFileName="")) returned 1 [0054.505] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.505] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15020_.GIF") returned 1 [0054.505] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15020_.GIF") returned 1 [0054.505] lstrcmpiA (lpString1="", lpString2="BD15020_.GIF") returned -1 [0054.505] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF") returned="BD15019_.GIF" [0054.505] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.505] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.505] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.505] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.505] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD15020_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF" [0054.505] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF", pszSpec="*.zip") returned 0 [0054.505] lstrlenA (lpString="*.zip") returned 5 [0054.505] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF", pszSpec="*.rar") returned 0 [0054.505] lstrlenA (lpString="*.rar") returned 5 [0054.505] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF", pszSpec="*.7z") returned 0 [0054.505] lstrlenA (lpString="*.7z") returned 4 [0054.505] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF", pszSpec="*.tar") returned 0 [0054.505] lstrlenA (lpString="*.tar") returned 5 [0054.505] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF", pszSpec="*.gzip") returned 0 [0054.506] lstrlenA (lpString="*.gzip") returned 6 [0054.506] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF", pszSpec="*.jpg") returned 0 [0054.506] lstrlenA (lpString="*.jpg") returned 5 [0054.506] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF", pszSpec="*.jpeg") returned 0 [0054.506] lstrlenA (lpString="*.jpeg") returned 6 [0054.506] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF", pszSpec="*.psd") returned 0 [0054.506] lstrlenA (lpString="*.psd") returned 5 [0054.506] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF", pszSpec="*.gif") returned 1 [0054.506] lstrlenA (lpString="*.gif") returned 5 [0054.506] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF" [0054.506] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF" [0054.506] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF." [0054.506] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF.wannacry" [0054.506] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15020_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.506] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x63 [0054.507] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83dcdc00, dwHighDateTime=0x1bd4f41), lpLastAccessTime=0x407536*(dwLowDateTime=0xbca82e00, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83dcdc00, dwHighDateTime=0x1bd4f41)) returned 1 [0054.507] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.507] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0054.507] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.507] CloseHandle (hObject=0x90) returned 1 [0054.507] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15020_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15020_.gif.wannacry")) returned 1 [0054.508] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82abaf00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x82abaf00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15021_.GIF", cAlternateFileName="")) returned 1 [0054.508] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.508] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15021_.GIF") returned 1 [0054.508] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15021_.GIF") returned 1 [0054.508] lstrcmpiA (lpString1="", lpString2="BD15021_.GIF") returned -1 [0054.508] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF") returned="BD15020_.GIF" [0054.508] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.508] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.508] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.508] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.508] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD15021_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF" [0054.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF", pszSpec="*.zip") returned 0 [0054.508] lstrlenA (lpString="*.zip") returned 5 [0054.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF", pszSpec="*.rar") returned 0 [0054.508] lstrlenA (lpString="*.rar") returned 5 [0054.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF", pszSpec="*.7z") returned 0 [0054.508] lstrlenA (lpString="*.7z") returned 4 [0054.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF", pszSpec="*.tar") returned 0 [0054.508] lstrlenA (lpString="*.tar") returned 5 [0054.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF", pszSpec="*.gzip") returned 0 [0054.508] lstrlenA (lpString="*.gzip") returned 6 [0054.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF", pszSpec="*.jpg") returned 0 [0054.509] lstrlenA (lpString="*.jpg") returned 5 [0054.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF", pszSpec="*.jpeg") returned 0 [0054.509] lstrlenA (lpString="*.jpeg") returned 6 [0054.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF", pszSpec="*.psd") returned 0 [0054.509] lstrlenA (lpString="*.psd") returned 5 [0054.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF", pszSpec="*.gif") returned 1 [0054.509] lstrlenA (lpString="*.gif") returned 5 [0054.509] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF" [0054.509] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF" [0054.509] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF." [0054.509] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF.wannacry" [0054.509] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.509] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4a [0054.509] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x82abaf00, dwHighDateTime=0x1bd4f41), lpLastAccessTime=0x407536*(dwLowDateTime=0xbca82e00, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x82abaf00, dwHighDateTime=0x1bd4f41)) returned 1 [0054.509] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.509] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0054.510] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.510] CloseHandle (hObject=0x90) returned 1 [0054.510] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15021_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15021_.gif.wannacry")) returned 1 [0054.510] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x817a8200, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x817a8200, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15022_.GIF", cAlternateFileName="")) returned 1 [0054.510] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.511] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15022_.GIF") returned 1 [0054.511] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15022_.GIF") returned 1 [0054.511] lstrcmpiA (lpString1="", lpString2="BD15022_.GIF") returned -1 [0054.511] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF") returned="BD15021_.GIF" [0054.511] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.511] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.511] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.511] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.511] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD15022_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF" [0054.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF", pszSpec="*.zip") returned 0 [0054.511] lstrlenA (lpString="*.zip") returned 5 [0054.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF", pszSpec="*.rar") returned 0 [0054.511] lstrlenA (lpString="*.rar") returned 5 [0054.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF", pszSpec="*.7z") returned 0 [0054.511] lstrlenA (lpString="*.7z") returned 4 [0054.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF", pszSpec="*.tar") returned 0 [0054.511] lstrlenA (lpString="*.tar") returned 5 [0054.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF", pszSpec="*.gzip") returned 0 [0054.511] lstrlenA (lpString="*.gzip") returned 6 [0054.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF", pszSpec="*.jpg") returned 0 [0054.511] lstrlenA (lpString="*.jpg") returned 5 [0054.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF", pszSpec="*.jpeg") returned 0 [0054.511] lstrlenA (lpString="*.jpeg") returned 6 [0054.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF", pszSpec="*.psd") returned 0 [0054.512] lstrlenA (lpString="*.psd") returned 5 [0054.512] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF", pszSpec="*.gif") returned 1 [0054.512] lstrlenA (lpString="*.gif") returned 5 [0054.512] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF" [0054.512] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF" [0054.512] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF." [0054.512] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF.wannacry" [0054.512] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15022_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.513] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x61 [0054.513] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x817a8200, dwHighDateTime=0x1bd4f41), lpLastAccessTime=0x407536*(dwLowDateTime=0xbca82e00, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x817a8200, dwHighDateTime=0x1bd4f41)) returned 1 [0054.514] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.514] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0054.514] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.514] CloseHandle (hObject=0x90) returned 1 [0054.514] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15022_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15022_.gif.wannacry")) returned 1 [0054.515] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80495500, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x80495500, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x7a, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15023_.GIF", cAlternateFileName="")) returned 1 [0054.515] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.515] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15023_.GIF") returned 1 [0054.515] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15023_.GIF") returned 1 [0054.515] lstrcmpiA (lpString1="", lpString2="BD15023_.GIF") returned -1 [0054.515] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF") returned="BD15022_.GIF" [0054.515] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.515] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.515] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.515] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.515] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD15023_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF" [0054.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF", pszSpec="*.zip") returned 0 [0054.515] lstrlenA (lpString="*.zip") returned 5 [0054.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF", pszSpec="*.rar") returned 0 [0054.515] lstrlenA (lpString="*.rar") returned 5 [0054.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF", pszSpec="*.7z") returned 0 [0054.515] lstrlenA (lpString="*.7z") returned 4 [0054.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF", pszSpec="*.tar") returned 0 [0054.516] lstrlenA (lpString="*.tar") returned 5 [0054.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF", pszSpec="*.gzip") returned 0 [0054.516] lstrlenA (lpString="*.gzip") returned 6 [0054.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF", pszSpec="*.jpg") returned 0 [0054.516] lstrlenA (lpString="*.jpg") returned 5 [0054.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF", pszSpec="*.jpeg") returned 0 [0054.516] lstrlenA (lpString="*.jpeg") returned 6 [0054.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF", pszSpec="*.psd") returned 0 [0054.516] lstrlenA (lpString="*.psd") returned 5 [0054.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF", pszSpec="*.gif") returned 1 [0054.516] lstrlenA (lpString="*.gif") returned 5 [0054.516] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF" [0054.516] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF" [0054.516] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF." [0054.516] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF.wannacry" [0054.516] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15023_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.517] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7a [0054.517] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x80495500, dwHighDateTime=0x1bd4f41), lpLastAccessTime=0x407536*(dwLowDateTime=0xbca82e00, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x80495500, dwHighDateTime=0x1bd4f41)) returned 1 [0054.517] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.517] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0054.517] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.517] CloseHandle (hObject=0x90) returned 1 [0054.517] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15023_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15023_.gif.wannacry")) returned 1 [0054.518] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95f37700, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x95f37700, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15056_.GIF", cAlternateFileName="")) returned 1 [0054.518] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.518] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15056_.GIF") returned 1 [0054.518] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15056_.GIF") returned 1 [0054.518] lstrcmpiA (lpString1="", lpString2="BD15056_.GIF") returned -1 [0054.518] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF") returned="BD15023_.GIF" [0054.518] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.518] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.518] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.518] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.518] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD15056_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF" [0054.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF", pszSpec="*.zip") returned 0 [0054.519] lstrlenA (lpString="*.zip") returned 5 [0054.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF", pszSpec="*.rar") returned 0 [0054.519] lstrlenA (lpString="*.rar") returned 5 [0054.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF", pszSpec="*.7z") returned 0 [0054.519] lstrlenA (lpString="*.7z") returned 4 [0054.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF", pszSpec="*.tar") returned 0 [0054.519] lstrlenA (lpString="*.tar") returned 5 [0054.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF", pszSpec="*.gzip") returned 0 [0054.519] lstrlenA (lpString="*.gzip") returned 6 [0054.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF", pszSpec="*.jpg") returned 0 [0054.519] lstrlenA (lpString="*.jpg") returned 5 [0054.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF", pszSpec="*.jpeg") returned 0 [0054.519] lstrlenA (lpString="*.jpeg") returned 6 [0054.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF", pszSpec="*.psd") returned 0 [0054.519] lstrlenA (lpString="*.psd") returned 5 [0054.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF", pszSpec="*.gif") returned 1 [0054.519] lstrlenA (lpString="*.gif") returned 5 [0054.519] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF" [0054.519] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF" [0054.519] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF." [0054.519] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF.wannacry" [0054.519] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15056_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.521] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xda [0054.521] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x95f37700, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcaa8f60, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x95f37700, dwHighDateTime=0x1bd8f92)) returned 1 [0054.521] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.521] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x5c, lpOverlapped=0x0) returned 1 [0054.522] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF") returned="BD15056_.GIF" [0054.522] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.522] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x5c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x5c, lpOverlapped=0x0) returned 1 [0054.522] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.522] CloseHandle (hObject=0x90) returned 1 [0054.522] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15056_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15056_.gif.wannacry")) returned 1 [0054.523] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95f37700, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x95f37700, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15057_.GIF", cAlternateFileName="")) returned 1 [0054.523] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.523] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15057_.GIF") returned 1 [0054.523] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15057_.GIF") returned 1 [0054.523] lstrcmpiA (lpString1="", lpString2="BD15057_.GIF") returned -1 [0054.523] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF") returned="BD15056_.GIF" [0054.523] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.523] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.523] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.523] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.523] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD15057_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF" [0054.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF", pszSpec="*.zip") returned 0 [0054.523] lstrlenA (lpString="*.zip") returned 5 [0054.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF", pszSpec="*.rar") returned 0 [0054.524] lstrlenA (lpString="*.rar") returned 5 [0054.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF", pszSpec="*.7z") returned 0 [0054.524] lstrlenA (lpString="*.7z") returned 4 [0054.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF", pszSpec="*.tar") returned 0 [0054.524] lstrlenA (lpString="*.tar") returned 5 [0054.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF", pszSpec="*.gzip") returned 0 [0054.524] lstrlenA (lpString="*.gzip") returned 6 [0054.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF", pszSpec="*.jpg") returned 0 [0054.524] lstrlenA (lpString="*.jpg") returned 5 [0054.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF", pszSpec="*.jpeg") returned 0 [0054.524] lstrlenA (lpString="*.jpeg") returned 6 [0054.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF", pszSpec="*.psd") returned 0 [0054.524] lstrlenA (lpString="*.psd") returned 5 [0054.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF", pszSpec="*.gif") returned 1 [0054.524] lstrlenA (lpString="*.gif") returned 5 [0054.524] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF" [0054.524] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF" [0054.524] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF." [0054.524] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF.wannacry" [0054.524] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.525] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xda [0054.525] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x95f37700, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcaa8f60, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x95f37700, dwHighDateTime=0x1bd8f92)) returned 1 [0054.525] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.525] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x5c, lpOverlapped=0x0) returned 1 [0054.526] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF") returned="BD15057_.GIF" [0054.526] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.526] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x5c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x5c, lpOverlapped=0x0) returned 1 [0054.526] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.526] CloseHandle (hObject=0x90) returned 1 [0054.526] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15057_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15057_.gif.wannacry")) returned 1 [0054.527] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9724a400, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9724a400, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15058_.GIF", cAlternateFileName="")) returned 1 [0054.527] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.527] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15058_.GIF") returned 1 [0054.527] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15058_.GIF") returned 1 [0054.527] lstrcmpiA (lpString1="", lpString2="BD15058_.GIF") returned -1 [0054.527] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF") returned="BD15057_.GIF" [0054.527] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.527] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.527] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.527] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.527] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD15058_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF" [0054.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF", pszSpec="*.zip") returned 0 [0054.527] lstrlenA (lpString="*.zip") returned 5 [0054.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF", pszSpec="*.rar") returned 0 [0054.527] lstrlenA (lpString="*.rar") returned 5 [0054.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF", pszSpec="*.7z") returned 0 [0054.528] lstrlenA (lpString="*.7z") returned 4 [0054.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF", pszSpec="*.tar") returned 0 [0054.528] lstrlenA (lpString="*.tar") returned 5 [0054.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF", pszSpec="*.gzip") returned 0 [0054.528] lstrlenA (lpString="*.gzip") returned 6 [0054.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF", pszSpec="*.jpg") returned 0 [0054.528] lstrlenA (lpString="*.jpg") returned 5 [0054.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF", pszSpec="*.jpeg") returned 0 [0054.528] lstrlenA (lpString="*.jpeg") returned 6 [0054.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF", pszSpec="*.psd") returned 0 [0054.528] lstrlenA (lpString="*.psd") returned 5 [0054.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF", pszSpec="*.gif") returned 1 [0054.528] lstrlenA (lpString="*.gif") returned 5 [0054.528] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF" [0054.528] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF" [0054.528] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF." [0054.528] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF.wannacry" [0054.528] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15058_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.528] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc7 [0054.529] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9724a400, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcaa8f60, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9724a400, dwHighDateTime=0x1bd8f92)) returned 1 [0054.529] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.529] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x49, lpOverlapped=0x0) returned 1 [0054.531] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF") returned="BD15058_.GIF" [0054.531] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.531] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x49, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x49, lpOverlapped=0x0) returned 1 [0054.531] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.531] CloseHandle (hObject=0x90) returned 1 [0054.531] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15058_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15058_.gif.wannacry")) returned 1 [0054.532] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x319bbb00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x319bbb00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15059_.GIF", cAlternateFileName="")) returned 1 [0054.532] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.532] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15059_.GIF") returned 1 [0054.532] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15059_.GIF") returned 1 [0054.532] lstrcmpiA (lpString1="", lpString2="BD15059_.GIF") returned -1 [0054.532] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF") returned="BD15058_.GIF" [0054.532] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.532] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.532] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.532] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.532] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD15059_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF" [0054.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF", pszSpec="*.zip") returned 0 [0054.532] lstrlenA (lpString="*.zip") returned 5 [0054.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF", pszSpec="*.rar") returned 0 [0054.532] lstrlenA (lpString="*.rar") returned 5 [0054.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF", pszSpec="*.7z") returned 0 [0054.532] lstrlenA (lpString="*.7z") returned 4 [0054.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF", pszSpec="*.tar") returned 0 [0054.533] lstrlenA (lpString="*.tar") returned 5 [0054.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF", pszSpec="*.gzip") returned 0 [0054.533] lstrlenA (lpString="*.gzip") returned 6 [0054.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF", pszSpec="*.jpg") returned 0 [0054.533] lstrlenA (lpString="*.jpg") returned 5 [0054.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF", pszSpec="*.jpeg") returned 0 [0054.533] lstrlenA (lpString="*.jpeg") returned 6 [0054.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF", pszSpec="*.psd") returned 0 [0054.533] lstrlenA (lpString="*.psd") returned 5 [0054.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF", pszSpec="*.gif") returned 1 [0054.533] lstrlenA (lpString="*.gif") returned 5 [0054.533] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF" [0054.533] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF" [0054.533] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF." [0054.533] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF.wannacry" [0054.533] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15059_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.534] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaa [0054.534] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x319bbb00, dwHighDateTime=0x1bd4f41), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcaa8f60, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x319bbb00, dwHighDateTime=0x1bd4f41)) returned 1 [0054.534] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.534] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2c, lpOverlapped=0x0) returned 1 [0054.535] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF") returned="BD15059_.GIF" [0054.535] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.535] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2c, lpOverlapped=0x0) returned 1 [0054.536] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.536] CloseHandle (hObject=0x90) returned 1 [0054.536] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15059_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15059_.gif.wannacry")) returned 1 [0054.536] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x306a8e00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x306a8e00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x78, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15060_.GIF", cAlternateFileName="")) returned 1 [0054.536] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.537] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15060_.GIF") returned 1 [0054.537] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15060_.GIF") returned 1 [0054.537] lstrcmpiA (lpString1="", lpString2="BD15060_.GIF") returned -1 [0054.537] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF") returned="BD15059_.GIF" [0054.537] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.537] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.537] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.537] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.537] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD15060_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF" [0054.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF", pszSpec="*.zip") returned 0 [0054.537] lstrlenA (lpString="*.zip") returned 5 [0054.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF", pszSpec="*.rar") returned 0 [0054.537] lstrlenA (lpString="*.rar") returned 5 [0054.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF", pszSpec="*.7z") returned 0 [0054.537] lstrlenA (lpString="*.7z") returned 4 [0054.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF", pszSpec="*.tar") returned 0 [0054.537] lstrlenA (lpString="*.tar") returned 5 [0054.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF", pszSpec="*.gzip") returned 0 [0054.537] lstrlenA (lpString="*.gzip") returned 6 [0054.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF", pszSpec="*.jpg") returned 0 [0054.537] lstrlenA (lpString="*.jpg") returned 5 [0054.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF", pszSpec="*.jpeg") returned 0 [0054.537] lstrlenA (lpString="*.jpeg") returned 6 [0054.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF", pszSpec="*.psd") returned 0 [0054.537] lstrlenA (lpString="*.psd") returned 5 [0054.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF", pszSpec="*.gif") returned 1 [0054.537] lstrlenA (lpString="*.gif") returned 5 [0054.537] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF" [0054.537] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF" [0054.537] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF." [0054.537] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF.wannacry" [0054.538] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15060_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.538] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x78 [0054.539] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x306a8e00, dwHighDateTime=0x1bd4f41), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcaa8f60, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x306a8e00, dwHighDateTime=0x1bd4f41)) returned 1 [0054.539] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.539] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0054.539] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.539] CloseHandle (hObject=0x90) returned 1 [0054.539] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15060_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15060_.gif.wannacry")) returned 1 [0054.542] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f396100, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2f396100, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x77, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15061_.GIF", cAlternateFileName="")) returned 1 [0054.542] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.542] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15061_.GIF") returned 1 [0054.542] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15061_.GIF") returned 1 [0054.542] lstrcmpiA (lpString1="", lpString2="BD15061_.GIF") returned -1 [0054.542] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF") returned="BD15060_.GIF" [0054.542] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.542] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.542] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.542] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.542] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD15061_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF" [0054.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF", pszSpec="*.zip") returned 0 [0054.542] lstrlenA (lpString="*.zip") returned 5 [0054.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF", pszSpec="*.rar") returned 0 [0054.542] lstrlenA (lpString="*.rar") returned 5 [0054.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF", pszSpec="*.7z") returned 0 [0054.542] lstrlenA (lpString="*.7z") returned 4 [0054.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF", pszSpec="*.tar") returned 0 [0054.543] lstrlenA (lpString="*.tar") returned 5 [0054.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF", pszSpec="*.gzip") returned 0 [0054.543] lstrlenA (lpString="*.gzip") returned 6 [0054.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF", pszSpec="*.jpg") returned 0 [0054.543] lstrlenA (lpString="*.jpg") returned 5 [0054.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF", pszSpec="*.jpeg") returned 0 [0054.543] lstrlenA (lpString="*.jpeg") returned 6 [0054.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF", pszSpec="*.psd") returned 0 [0054.543] lstrlenA (lpString="*.psd") returned 5 [0054.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF", pszSpec="*.gif") returned 1 [0054.543] lstrlenA (lpString="*.gif") returned 5 [0054.543] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF" [0054.543] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF" [0054.543] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF." [0054.543] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF.wannacry" [0054.543] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15061_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.543] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x77 [0054.543] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x2f396100, dwHighDateTime=0x1bd4f41), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcaa8f60, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x2f396100, dwHighDateTime=0x1bd4f41)) returned 1 [0054.543] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.543] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0054.543] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.544] CloseHandle (hObject=0x90) returned 1 [0054.544] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15061_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15061_.gif.wannacry")) returned 1 [0054.545] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfac9e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbfac9e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15132_.GIF", cAlternateFileName="")) returned 1 [0054.545] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.545] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15132_.GIF") returned 1 [0054.545] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15132_.GIF") returned 1 [0054.545] lstrcmpiA (lpString1="", lpString2="BD15132_.GIF") returned -1 [0054.545] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF") returned="BD15061_.GIF" [0054.545] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.545] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.545] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.546] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.546] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD15132_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF" [0054.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF", pszSpec="*.zip") returned 0 [0054.546] lstrlenA (lpString="*.zip") returned 5 [0054.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF", pszSpec="*.rar") returned 0 [0054.546] lstrlenA (lpString="*.rar") returned 5 [0054.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF", pszSpec="*.7z") returned 0 [0054.546] lstrlenA (lpString="*.7z") returned 4 [0054.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF", pszSpec="*.tar") returned 0 [0054.546] lstrlenA (lpString="*.tar") returned 5 [0054.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF", pszSpec="*.gzip") returned 0 [0054.546] lstrlenA (lpString="*.gzip") returned 6 [0054.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF", pszSpec="*.jpg") returned 0 [0054.546] lstrlenA (lpString="*.jpg") returned 5 [0054.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF", pszSpec="*.jpeg") returned 0 [0054.546] lstrlenA (lpString="*.jpeg") returned 6 [0054.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF", pszSpec="*.psd") returned 0 [0054.546] lstrlenA (lpString="*.psd") returned 5 [0054.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF", pszSpec="*.gif") returned 1 [0054.546] lstrlenA (lpString="*.gif") returned 5 [0054.546] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF" [0054.546] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF" [0054.546] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF." [0054.546] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF.wannacry" [0054.546] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15132_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.547] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9 [0054.547] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbfac9e00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcacf0c0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbfac9e00, dwHighDateTime=0x1bd8f92)) returned 1 [0054.547] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.547] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3b, lpOverlapped=0x0) returned 1 [0054.549] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF") returned="BD15132_.GIF" [0054.549] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.549] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3b, lpOverlapped=0x0) returned 1 [0054.549] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.549] CloseHandle (hObject=0x90) returned 1 [0054.550] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15132_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15132_.gif.wannacry")) returned 1 [0054.550] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0ddcb00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc0ddcb00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15133_.GIF", cAlternateFileName="")) returned 1 [0054.550] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.550] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15133_.GIF") returned 1 [0054.550] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15133_.GIF") returned 1 [0054.550] lstrcmpiA (lpString1="", lpString2="BD15133_.GIF") returned -1 [0054.550] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF") returned="BD15132_.GIF" [0054.550] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.550] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.550] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.550] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.551] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD15133_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF" [0054.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF", pszSpec="*.zip") returned 0 [0054.551] lstrlenA (lpString="*.zip") returned 5 [0054.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF", pszSpec="*.rar") returned 0 [0054.551] lstrlenA (lpString="*.rar") returned 5 [0054.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF", pszSpec="*.7z") returned 0 [0054.551] lstrlenA (lpString="*.7z") returned 4 [0054.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF", pszSpec="*.tar") returned 0 [0054.551] lstrlenA (lpString="*.tar") returned 5 [0054.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF", pszSpec="*.gzip") returned 0 [0054.551] lstrlenA (lpString="*.gzip") returned 6 [0054.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF", pszSpec="*.jpg") returned 0 [0054.551] lstrlenA (lpString="*.jpg") returned 5 [0054.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF", pszSpec="*.jpeg") returned 0 [0054.551] lstrlenA (lpString="*.jpeg") returned 6 [0054.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF", pszSpec="*.psd") returned 0 [0054.551] lstrlenA (lpString="*.psd") returned 5 [0054.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF", pszSpec="*.gif") returned 1 [0054.551] lstrlenA (lpString="*.gif") returned 5 [0054.551] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF" [0054.551] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF" [0054.551] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF." [0054.551] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF.wannacry" [0054.551] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15133_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.552] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb0 [0054.552] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc0ddcb00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcacf0c0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc0ddcb00, dwHighDateTime=0x1bd8f92)) returned 1 [0054.552] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.552] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x32, lpOverlapped=0x0) returned 1 [0054.553] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF") returned="BD15133_.GIF" [0054.553] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.553] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x32, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x32, lpOverlapped=0x0) returned 1 [0054.553] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.553] CloseHandle (hObject=0x90) returned 1 [0054.553] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15133_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15133_.gif.wannacry")) returned 1 [0054.554] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0ddcb00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc0ddcb00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15134_.GIF", cAlternateFileName="")) returned 1 [0054.554] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.554] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15134_.GIF") returned 1 [0054.554] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15134_.GIF") returned 1 [0054.554] lstrcmpiA (lpString1="", lpString2="BD15134_.GIF") returned -1 [0054.554] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF") returned="BD15133_.GIF" [0054.554] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.554] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.554] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.554] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.554] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD15134_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF" [0054.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF", pszSpec="*.zip") returned 0 [0054.554] lstrlenA (lpString="*.zip") returned 5 [0054.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF", pszSpec="*.rar") returned 0 [0054.554] lstrlenA (lpString="*.rar") returned 5 [0054.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF", pszSpec="*.7z") returned 0 [0054.554] lstrlenA (lpString="*.7z") returned 4 [0054.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF", pszSpec="*.tar") returned 0 [0054.554] lstrlenA (lpString="*.tar") returned 5 [0054.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF", pszSpec="*.gzip") returned 0 [0054.554] lstrlenA (lpString="*.gzip") returned 6 [0054.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF", pszSpec="*.jpg") returned 0 [0054.554] lstrlenA (lpString="*.jpg") returned 5 [0054.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF", pszSpec="*.jpeg") returned 0 [0054.554] lstrlenA (lpString="*.jpeg") returned 6 [0054.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF", pszSpec="*.psd") returned 0 [0054.554] lstrlenA (lpString="*.psd") returned 5 [0054.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF", pszSpec="*.gif") returned 1 [0054.555] lstrlenA (lpString="*.gif") returned 5 [0054.555] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF" [0054.555] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF" [0054.555] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF." [0054.555] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF.wannacry" [0054.555] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15134_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.555] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb1 [0054.555] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc0ddcb00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcacf0c0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc0ddcb00, dwHighDateTime=0x1bd8f92)) returned 1 [0054.555] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.555] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x33, lpOverlapped=0x0) returned 1 [0054.556] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF") returned="BD15134_.GIF" [0054.556] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.556] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x33, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x33, lpOverlapped=0x0) returned 1 [0054.556] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.556] CloseHandle (hObject=0x90) returned 1 [0054.556] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15134_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15134_.gif.wannacry")) returned 1 [0054.557] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0ddcb00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc0ddcb00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15135_.GIF", cAlternateFileName="")) returned 1 [0054.557] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.557] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15135_.GIF") returned 1 [0054.557] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15135_.GIF") returned 1 [0054.557] lstrcmpiA (lpString1="", lpString2="BD15135_.GIF") returned -1 [0054.557] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF") returned="BD15134_.GIF" [0054.557] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.557] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.557] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.557] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.557] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD15135_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF" [0054.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF", pszSpec="*.zip") returned 0 [0054.557] lstrlenA (lpString="*.zip") returned 5 [0054.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF", pszSpec="*.rar") returned 0 [0054.557] lstrlenA (lpString="*.rar") returned 5 [0054.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF", pszSpec="*.7z") returned 0 [0054.557] lstrlenA (lpString="*.7z") returned 4 [0054.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF", pszSpec="*.tar") returned 0 [0054.557] lstrlenA (lpString="*.tar") returned 5 [0054.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF", pszSpec="*.gzip") returned 0 [0054.558] lstrlenA (lpString="*.gzip") returned 6 [0054.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF", pszSpec="*.jpg") returned 0 [0054.558] lstrlenA (lpString="*.jpg") returned 5 [0054.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF", pszSpec="*.jpeg") returned 0 [0054.558] lstrlenA (lpString="*.jpeg") returned 6 [0054.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF", pszSpec="*.psd") returned 0 [0054.558] lstrlenA (lpString="*.psd") returned 5 [0054.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF", pszSpec="*.gif") returned 1 [0054.558] lstrlenA (lpString="*.gif") returned 5 [0054.558] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF" [0054.558] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF" [0054.558] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF." [0054.558] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF.wannacry" [0054.558] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.558] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaf [0054.558] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc0ddcb00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcacf0c0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc0ddcb00, dwHighDateTime=0x1bd8f92)) returned 1 [0054.558] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.558] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x31, lpOverlapped=0x0) returned 1 [0054.559] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF") returned="BD15135_.GIF" [0054.559] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.559] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x31, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x31, lpOverlapped=0x0) returned 1 [0054.559] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.560] CloseHandle (hObject=0x90) returned 1 [0054.560] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15135_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15135_.gif.wannacry")) returned 1 [0054.560] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc20ef800, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc20ef800, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15136_.GIF", cAlternateFileName="")) returned 1 [0054.560] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.560] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15136_.GIF") returned 1 [0054.560] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15136_.GIF") returned 1 [0054.560] lstrcmpiA (lpString1="", lpString2="BD15136_.GIF") returned -1 [0054.560] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF") returned="BD15135_.GIF" [0054.560] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.560] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.560] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.560] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.560] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD15136_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF" [0054.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF", pszSpec="*.zip") returned 0 [0054.561] lstrlenA (lpString="*.zip") returned 5 [0054.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF", pszSpec="*.rar") returned 0 [0054.561] lstrlenA (lpString="*.rar") returned 5 [0054.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF", pszSpec="*.7z") returned 0 [0054.561] lstrlenA (lpString="*.7z") returned 4 [0054.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF", pszSpec="*.tar") returned 0 [0054.561] lstrlenA (lpString="*.tar") returned 5 [0054.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF", pszSpec="*.gzip") returned 0 [0054.561] lstrlenA (lpString="*.gzip") returned 6 [0054.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF", pszSpec="*.jpg") returned 0 [0054.561] lstrlenA (lpString="*.jpg") returned 5 [0054.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF", pszSpec="*.jpeg") returned 0 [0054.561] lstrlenA (lpString="*.jpeg") returned 6 [0054.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF", pszSpec="*.psd") returned 0 [0054.561] lstrlenA (lpString="*.psd") returned 5 [0054.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF", pszSpec="*.gif") returned 1 [0054.561] lstrlenA (lpString="*.gif") returned 5 [0054.561] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF" [0054.561] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF" [0054.561] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF." [0054.561] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF.wannacry" [0054.561] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15136_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.572] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaf [0054.572] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc20ef800, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcaf5220, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc20ef800, dwHighDateTime=0x1bd8f92)) returned 1 [0054.572] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.573] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x31, lpOverlapped=0x0) returned 1 [0054.574] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF") returned="BD15136_.GIF" [0054.574] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.574] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x31, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x31, lpOverlapped=0x0) returned 1 [0054.574] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.575] CloseHandle (hObject=0x90) returned 1 [0054.575] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15136_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15136_.gif.wannacry")) returned 1 [0054.576] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfaba00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcdfaba00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x14b, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15168_.GIF", cAlternateFileName="")) returned 1 [0054.576] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.576] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15168_.GIF") returned 1 [0054.576] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15168_.GIF") returned 1 [0054.576] lstrcmpiA (lpString1="", lpString2="BD15168_.GIF") returned -1 [0054.576] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF") returned="BD15136_.GIF" [0054.577] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.577] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.577] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.577] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.577] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD15168_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF" [0054.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF", pszSpec="*.zip") returned 0 [0054.577] lstrlenA (lpString="*.zip") returned 5 [0054.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF", pszSpec="*.rar") returned 0 [0054.577] lstrlenA (lpString="*.rar") returned 5 [0054.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF", pszSpec="*.7z") returned 0 [0054.577] lstrlenA (lpString="*.7z") returned 4 [0054.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF", pszSpec="*.tar") returned 0 [0054.577] lstrlenA (lpString="*.tar") returned 5 [0054.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF", pszSpec="*.gzip") returned 0 [0054.577] lstrlenA (lpString="*.gzip") returned 6 [0054.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF", pszSpec="*.jpg") returned 0 [0054.578] lstrlenA (lpString="*.jpg") returned 5 [0054.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF", pszSpec="*.jpeg") returned 0 [0054.578] lstrlenA (lpString="*.jpeg") returned 6 [0054.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF", pszSpec="*.psd") returned 0 [0054.578] lstrlenA (lpString="*.psd") returned 5 [0054.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF", pszSpec="*.gif") returned 1 [0054.578] lstrlenA (lpString="*.gif") returned 5 [0054.578] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF" [0054.578] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF" [0054.578] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF." [0054.578] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF.wannacry" [0054.578] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15168_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.579] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14b [0054.579] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcdfaba00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcaf5220, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcdfaba00, dwHighDateTime=0x1bd8f92)) returned 1 [0054.579] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.579] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xcd, lpOverlapped=0x0) returned 1 [0054.580] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF") returned="BD15168_.GIF" [0054.580] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.581] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xcd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xcd, lpOverlapped=0x0) returned 1 [0054.581] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.581] CloseHandle (hObject=0x90) returned 1 [0054.581] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15168_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15168_.gif.wannacry")) returned 1 [0054.582] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfaba00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcdfaba00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15169_.GIF", cAlternateFileName="")) returned 1 [0054.582] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.582] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15169_.GIF") returned 1 [0054.582] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15169_.GIF") returned 1 [0054.582] lstrcmpiA (lpString1="", lpString2="BD15169_.GIF") returned -1 [0054.582] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF") returned="BD15168_.GIF" [0054.583] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.583] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.583] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.583] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.583] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD15169_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF" [0054.583] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF", pszSpec="*.zip") returned 0 [0054.583] lstrlenA (lpString="*.zip") returned 5 [0054.583] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF", pszSpec="*.rar") returned 0 [0054.583] lstrlenA (lpString="*.rar") returned 5 [0054.583] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF", pszSpec="*.7z") returned 0 [0054.583] lstrlenA (lpString="*.7z") returned 4 [0054.583] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF", pszSpec="*.tar") returned 0 [0054.583] lstrlenA (lpString="*.tar") returned 5 [0054.583] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF", pszSpec="*.gzip") returned 0 [0054.583] lstrlenA (lpString="*.gzip") returned 6 [0054.583] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF", pszSpec="*.jpg") returned 0 [0054.583] lstrlenA (lpString="*.jpg") returned 5 [0054.583] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF", pszSpec="*.jpeg") returned 0 [0054.583] lstrlenA (lpString="*.jpeg") returned 6 [0054.583] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF", pszSpec="*.psd") returned 0 [0054.583] lstrlenA (lpString="*.psd") returned 5 [0054.583] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF", pszSpec="*.gif") returned 1 [0054.584] lstrlenA (lpString="*.gif") returned 5 [0054.584] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF" [0054.584] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF" [0054.584] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF." [0054.584] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF.wannacry" [0054.584] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.585] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x154 [0054.585] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcdfaba00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcaf5220, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcdfaba00, dwHighDateTime=0x1bd8f92)) returned 1 [0054.585] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.585] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd6, lpOverlapped=0x0) returned 1 [0054.586] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF") returned="BD15169_.GIF" [0054.586] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.586] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd6, lpOverlapped=0x0) returned 1 [0054.586] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.586] CloseHandle (hObject=0x90) returned 1 [0054.586] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15169_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15169_.gif.wannacry")) returned 1 [0054.587] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf2be700, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcf2be700, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15170_.GIF", cAlternateFileName="")) returned 1 [0054.587] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.587] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15170_.GIF") returned 1 [0054.587] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15170_.GIF") returned 1 [0054.587] lstrcmpiA (lpString1="", lpString2="BD15170_.GIF") returned -1 [0054.587] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF") returned="BD15169_.GIF" [0054.587] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.587] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.587] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.587] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.587] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD15170_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF" [0054.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF", pszSpec="*.zip") returned 0 [0054.588] lstrlenA (lpString="*.zip") returned 5 [0054.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF", pszSpec="*.rar") returned 0 [0054.588] lstrlenA (lpString="*.rar") returned 5 [0054.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF", pszSpec="*.7z") returned 0 [0054.588] lstrlenA (lpString="*.7z") returned 4 [0054.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF", pszSpec="*.tar") returned 0 [0054.588] lstrlenA (lpString="*.tar") returned 5 [0054.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF", pszSpec="*.gzip") returned 0 [0054.588] lstrlenA (lpString="*.gzip") returned 6 [0054.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF", pszSpec="*.jpg") returned 0 [0054.588] lstrlenA (lpString="*.jpg") returned 5 [0054.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF", pszSpec="*.jpeg") returned 0 [0054.588] lstrlenA (lpString="*.jpeg") returned 6 [0054.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF", pszSpec="*.psd") returned 0 [0054.588] lstrlenA (lpString="*.psd") returned 5 [0054.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF", pszSpec="*.gif") returned 1 [0054.588] lstrlenA (lpString="*.gif") returned 5 [0054.588] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF" [0054.588] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF" [0054.588] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF." [0054.588] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF.wannacry" [0054.588] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.589] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x101 [0054.589] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcf2be700, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcaf5220, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcf2be700, dwHighDateTime=0x1bd8f92)) returned 1 [0054.589] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.589] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x83, lpOverlapped=0x0) returned 1 [0054.590] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF") returned="BD15170_.GIF" [0054.590] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.590] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x83, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x83, lpOverlapped=0x0) returned 1 [0054.590] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.590] CloseHandle (hObject=0x90) returned 1 [0054.590] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15170_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15170_.gif.wannacry")) returned 1 [0054.591] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a06a900, ftCreationTime.dwHighDateTime=0x1bd4f40, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7a06a900, ftLastWriteTime.dwHighDateTime=0x1bd4f40, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15171_.GIF", cAlternateFileName="")) returned 1 [0054.591] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.591] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15171_.GIF") returned 1 [0054.591] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15171_.GIF") returned 1 [0054.591] lstrcmpiA (lpString1="", lpString2="BD15171_.GIF") returned -1 [0054.591] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF") returned="BD15170_.GIF" [0054.591] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.591] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.591] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.591] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.591] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD15171_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF" [0054.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF", pszSpec="*.zip") returned 0 [0054.591] lstrlenA (lpString="*.zip") returned 5 [0054.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF", pszSpec="*.rar") returned 0 [0054.591] lstrlenA (lpString="*.rar") returned 5 [0054.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF", pszSpec="*.7z") returned 0 [0054.591] lstrlenA (lpString="*.7z") returned 4 [0054.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF", pszSpec="*.tar") returned 0 [0054.591] lstrlenA (lpString="*.tar") returned 5 [0054.591] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF", pszSpec="*.gzip") returned 0 [0054.592] lstrlenA (lpString="*.gzip") returned 6 [0054.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF", pszSpec="*.jpg") returned 0 [0054.592] lstrlenA (lpString="*.jpg") returned 5 [0054.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF", pszSpec="*.jpeg") returned 0 [0054.592] lstrlenA (lpString="*.jpeg") returned 6 [0054.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF", pszSpec="*.psd") returned 0 [0054.592] lstrlenA (lpString="*.psd") returned 5 [0054.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF", pszSpec="*.gif") returned 1 [0054.592] lstrlenA (lpString="*.gif") returned 5 [0054.592] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF" [0054.592] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF" [0054.592] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF." [0054.592] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF.wannacry" [0054.592] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.592] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x91 [0054.592] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7a06a900, dwHighDateTime=0x1bd4f40), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcaf5220, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7a06a900, dwHighDateTime=0x1bd4f40)) returned 1 [0054.592] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.592] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x13, lpOverlapped=0x0) returned 1 [0054.594] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF") returned="BD15171_.GIF" [0054.594] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.594] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x13, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x13, lpOverlapped=0x0) returned 1 [0054.594] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.594] CloseHandle (hObject=0x90) returned 1 [0054.594] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15171_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15171_.gif.wannacry")) returned 1 [0054.595] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf2be700, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcf2be700, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15172_.GIF", cAlternateFileName="")) returned 1 [0054.595] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.595] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15172_.GIF") returned 1 [0054.595] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15172_.GIF") returned 1 [0054.595] lstrcmpiA (lpString1="", lpString2="BD15172_.GIF") returned -1 [0054.595] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF") returned="BD15171_.GIF" [0054.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.595] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.595] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.595] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.595] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD15172_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF" [0054.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF", pszSpec="*.zip") returned 0 [0054.595] lstrlenA (lpString="*.zip") returned 5 [0054.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF", pszSpec="*.rar") returned 0 [0054.595] lstrlenA (lpString="*.rar") returned 5 [0054.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF", pszSpec="*.7z") returned 0 [0054.595] lstrlenA (lpString="*.7z") returned 4 [0054.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF", pszSpec="*.tar") returned 0 [0054.595] lstrlenA (lpString="*.tar") returned 5 [0054.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF", pszSpec="*.gzip") returned 0 [0054.595] lstrlenA (lpString="*.gzip") returned 6 [0054.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF", pszSpec="*.jpg") returned 0 [0054.595] lstrlenA (lpString="*.jpg") returned 5 [0054.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF", pszSpec="*.jpeg") returned 0 [0054.595] lstrlenA (lpString="*.jpeg") returned 6 [0054.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF", pszSpec="*.psd") returned 0 [0054.595] lstrlenA (lpString="*.psd") returned 5 [0054.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF", pszSpec="*.gif") returned 1 [0054.596] lstrlenA (lpString="*.gif") returned 5 [0054.596] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF" [0054.596] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF" [0054.596] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF." [0054.596] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF.wannacry" [0054.596] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.596] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x130 [0054.596] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcf2be700, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcb1b380, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcf2be700, dwHighDateTime=0x1bd8f92)) returned 1 [0054.596] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.596] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xb2, lpOverlapped=0x0) returned 1 [0054.597] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF") returned="BD15172_.GIF" [0054.597] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.597] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xb2, lpOverlapped=0x0) returned 1 [0054.597] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.597] CloseHandle (hObject=0x90) returned 1 [0054.598] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15172_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15172_.gif.wannacry")) returned 1 [0054.598] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77a44f00, ftCreationTime.dwHighDateTime=0x1bd4f40, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x77a44f00, ftLastWriteTime.dwHighDateTime=0x1bd4f40, nFileSizeHigh=0x0, nFileSizeLow=0x8a, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15173_.GIF", cAlternateFileName="")) returned 1 [0054.598] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.598] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15173_.GIF") returned 1 [0054.598] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15173_.GIF") returned 1 [0054.598] lstrcmpiA (lpString1="", lpString2="BD15173_.GIF") returned -1 [0054.598] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF") returned="BD15172_.GIF" [0054.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.598] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.598] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.598] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.598] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD15173_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF" [0054.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF", pszSpec="*.zip") returned 0 [0054.599] lstrlenA (lpString="*.zip") returned 5 [0054.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF", pszSpec="*.rar") returned 0 [0054.599] lstrlenA (lpString="*.rar") returned 5 [0054.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF", pszSpec="*.7z") returned 0 [0054.599] lstrlenA (lpString="*.7z") returned 4 [0054.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF", pszSpec="*.tar") returned 0 [0054.599] lstrlenA (lpString="*.tar") returned 5 [0054.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF", pszSpec="*.gzip") returned 0 [0054.599] lstrlenA (lpString="*.gzip") returned 6 [0054.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF", pszSpec="*.jpg") returned 0 [0054.599] lstrlenA (lpString="*.jpg") returned 5 [0054.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF", pszSpec="*.jpeg") returned 0 [0054.599] lstrlenA (lpString="*.jpeg") returned 6 [0054.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF", pszSpec="*.psd") returned 0 [0054.599] lstrlenA (lpString="*.psd") returned 5 [0054.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF", pszSpec="*.gif") returned 1 [0054.599] lstrlenA (lpString="*.gif") returned 5 [0054.599] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF" [0054.599] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF" [0054.599] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF." [0054.599] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF.wannacry" [0054.599] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15173_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.603] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8a [0054.603] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x77a44f00, dwHighDateTime=0x1bd4f40), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcb1b380, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x77a44f00, dwHighDateTime=0x1bd4f40)) returned 1 [0054.603] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.603] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xc, lpOverlapped=0x0) returned 1 [0054.604] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF") returned="BD15173_.GIF" [0054.604] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.604] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xc, lpOverlapped=0x0) returned 1 [0054.604] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.604] CloseHandle (hObject=0x90) returned 1 [0054.604] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15173_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15173_.gif.wannacry")) returned 1 [0054.605] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb476800, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfb476800, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15272_.GIF", cAlternateFileName="")) returned 1 [0054.605] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.605] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15272_.GIF") returned 1 [0054.605] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15272_.GIF") returned 1 [0054.605] lstrcmpiA (lpString1="", lpString2="BD15272_.GIF") returned -1 [0054.605] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF") returned="BD15173_.GIF" [0054.605] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.605] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.605] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.605] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.605] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD15272_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF" [0054.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF", pszSpec="*.zip") returned 0 [0054.605] lstrlenA (lpString="*.zip") returned 5 [0054.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF", pszSpec="*.rar") returned 0 [0054.605] lstrlenA (lpString="*.rar") returned 5 [0054.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF", pszSpec="*.7z") returned 0 [0054.605] lstrlenA (lpString="*.7z") returned 4 [0054.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF", pszSpec="*.tar") returned 0 [0054.605] lstrlenA (lpString="*.tar") returned 5 [0054.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF", pszSpec="*.gzip") returned 0 [0054.605] lstrlenA (lpString="*.gzip") returned 6 [0054.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF", pszSpec="*.jpg") returned 0 [0054.605] lstrlenA (lpString="*.jpg") returned 5 [0054.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF", pszSpec="*.jpeg") returned 0 [0054.605] lstrlenA (lpString="*.jpeg") returned 6 [0054.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF", pszSpec="*.psd") returned 0 [0054.605] lstrlenA (lpString="*.psd") returned 5 [0054.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF", pszSpec="*.gif") returned 1 [0054.606] lstrlenA (lpString="*.gif") returned 5 [0054.606] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF" [0054.606] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF" [0054.606] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF." [0054.606] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF.wannacry" [0054.606] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15272_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.606] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c8 [0054.606] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfb476800, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcb1b380, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xfb476800, dwHighDateTime=0x1bd8f92)) returned 1 [0054.606] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.606] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x14a, lpOverlapped=0x0) returned 1 [0054.607] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF") returned="BD15272_.GIF" [0054.607] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.607] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x14a, lpOverlapped=0x0) returned 1 [0054.607] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.608] CloseHandle (hObject=0x90) returned 1 [0054.608] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15272_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15272_.gif.wannacry")) returned 1 [0054.608] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc789500, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfc789500, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15273_.GIF", cAlternateFileName="")) returned 1 [0054.608] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.609] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15273_.GIF") returned 1 [0054.609] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15273_.GIF") returned 1 [0054.609] lstrcmpiA (lpString1="", lpString2="BD15273_.GIF") returned -1 [0054.609] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF") returned="BD15272_.GIF" [0054.609] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.609] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.609] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.609] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.609] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD15273_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF" [0054.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF", pszSpec="*.zip") returned 0 [0054.609] lstrlenA (lpString="*.zip") returned 5 [0054.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF", pszSpec="*.rar") returned 0 [0054.609] lstrlenA (lpString="*.rar") returned 5 [0054.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF", pszSpec="*.7z") returned 0 [0054.609] lstrlenA (lpString="*.7z") returned 4 [0054.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF", pszSpec="*.tar") returned 0 [0054.609] lstrlenA (lpString="*.tar") returned 5 [0054.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF", pszSpec="*.gzip") returned 0 [0054.609] lstrlenA (lpString="*.gzip") returned 6 [0054.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF", pszSpec="*.jpg") returned 0 [0054.609] lstrlenA (lpString="*.jpg") returned 5 [0054.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF", pszSpec="*.jpeg") returned 0 [0054.609] lstrlenA (lpString="*.jpeg") returned 6 [0054.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF", pszSpec="*.psd") returned 0 [0054.610] lstrlenA (lpString="*.psd") returned 5 [0054.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF", pszSpec="*.gif") returned 1 [0054.610] lstrlenA (lpString="*.gif") returned 5 [0054.610] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF" [0054.610] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF" [0054.610] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF." [0054.610] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF.wannacry" [0054.610] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15273_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.621] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9 [0054.621] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfc789500, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcb1b380, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xfc789500, dwHighDateTime=0x1bd8f92)) returned 1 [0054.621] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.621] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3b, lpOverlapped=0x0) returned 1 [0054.622] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF") returned="BD15273_.GIF" [0054.622] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.622] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3b, lpOverlapped=0x0) returned 1 [0054.622] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.622] CloseHandle (hObject=0x90) returned 1 [0054.622] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15273_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15273_.gif.wannacry")) returned 1 [0054.623] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc998a500, ftCreationTime.dwHighDateTime=0x1bd4f3f, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc998a500, ftLastWriteTime.dwHighDateTime=0x1bd4f3f, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15274_.GIF", cAlternateFileName="")) returned 1 [0054.623] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.623] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15274_.GIF") returned 1 [0054.623] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15274_.GIF") returned 1 [0054.623] lstrcmpiA (lpString1="", lpString2="BD15274_.GIF") returned -1 [0054.623] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF") returned="BD15273_.GIF" [0054.624] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.624] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.624] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.624] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.624] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD15274_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF" [0054.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF", pszSpec="*.zip") returned 0 [0054.624] lstrlenA (lpString="*.zip") returned 5 [0054.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF", pszSpec="*.rar") returned 0 [0054.624] lstrlenA (lpString="*.rar") returned 5 [0054.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF", pszSpec="*.7z") returned 0 [0054.624] lstrlenA (lpString="*.7z") returned 4 [0054.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF", pszSpec="*.tar") returned 0 [0054.624] lstrlenA (lpString="*.tar") returned 5 [0054.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF", pszSpec="*.gzip") returned 0 [0054.624] lstrlenA (lpString="*.gzip") returned 6 [0054.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF", pszSpec="*.jpg") returned 0 [0054.624] lstrlenA (lpString="*.jpg") returned 5 [0054.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF", pszSpec="*.jpeg") returned 0 [0054.624] lstrlenA (lpString="*.jpeg") returned 6 [0054.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF", pszSpec="*.psd") returned 0 [0054.624] lstrlenA (lpString="*.psd") returned 5 [0054.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF", pszSpec="*.gif") returned 1 [0054.624] lstrlenA (lpString="*.gif") returned 5 [0054.624] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF" [0054.624] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF" [0054.624] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF." [0054.624] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF.wannacry" [0054.624] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15274_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.625] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd0 [0054.625] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc998a500, dwHighDateTime=0x1bd4f3f), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcb414e0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc998a500, dwHighDateTime=0x1bd4f3f)) returned 1 [0054.625] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.625] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x52, lpOverlapped=0x0) returned 1 [0054.626] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF") returned="BD15274_.GIF" [0054.626] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.626] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x52, lpOverlapped=0x0) returned 1 [0054.627] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.627] CloseHandle (hObject=0x90) returned 1 [0054.627] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15274_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15274_.gif.wannacry")) returned 1 [0054.628] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7364b00, ftCreationTime.dwHighDateTime=0x1bd4f3f, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc7364b00, ftLastWriteTime.dwHighDateTime=0x1bd4f3f, nFileSizeHigh=0x0, nFileSizeLow=0x3f, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15275_.GIF", cAlternateFileName="")) returned 1 [0054.628] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.628] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15275_.GIF") returned 1 [0054.628] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15275_.GIF") returned 1 [0054.628] lstrcmpiA (lpString1="", lpString2="BD15275_.GIF") returned -1 [0054.628] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF") returned="BD15274_.GIF" [0054.628] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.628] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.628] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.628] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.628] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD15275_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF" [0054.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF", pszSpec="*.zip") returned 0 [0054.628] lstrlenA (lpString="*.zip") returned 5 [0054.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF", pszSpec="*.rar") returned 0 [0054.628] lstrlenA (lpString="*.rar") returned 5 [0054.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF", pszSpec="*.7z") returned 0 [0054.628] lstrlenA (lpString="*.7z") returned 4 [0054.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF", pszSpec="*.tar") returned 0 [0054.628] lstrlenA (lpString="*.tar") returned 5 [0054.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF", pszSpec="*.gzip") returned 0 [0054.628] lstrlenA (lpString="*.gzip") returned 6 [0054.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF", pszSpec="*.jpg") returned 0 [0054.628] lstrlenA (lpString="*.jpg") returned 5 [0054.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF", pszSpec="*.jpeg") returned 0 [0054.629] lstrlenA (lpString="*.jpeg") returned 6 [0054.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF", pszSpec="*.psd") returned 0 [0054.629] lstrlenA (lpString="*.psd") returned 5 [0054.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF", pszSpec="*.gif") returned 1 [0054.629] lstrlenA (lpString="*.gif") returned 5 [0054.629] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF" [0054.629] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF" [0054.629] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF." [0054.629] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF.wannacry" [0054.629] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15275_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.629] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f [0054.629] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc7364b00, dwHighDateTime=0x1bd4f3f), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcb414e0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc7364b00, dwHighDateTime=0x1bd4f3f)) returned 1 [0054.629] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.629] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0054.629] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.630] CloseHandle (hObject=0x90) returned 1 [0054.630] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15275_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15275_.gif.wannacry")) returned 1 [0054.630] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3a2c400, ftCreationTime.dwHighDateTime=0x1bd4f3f, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc3a2c400, ftLastWriteTime.dwHighDateTime=0x1bd4f3f, nFileSizeHigh=0x0, nFileSizeLow=0x49, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15276_.GIF", cAlternateFileName="")) returned 1 [0054.630] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.630] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15276_.GIF") returned 1 [0054.630] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15276_.GIF") returned 1 [0054.630] lstrcmpiA (lpString1="", lpString2="BD15276_.GIF") returned -1 [0054.630] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF") returned="BD15275_.GIF" [0054.630] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.630] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.630] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.630] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.631] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD15276_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF" [0054.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF", pszSpec="*.zip") returned 0 [0054.631] lstrlenA (lpString="*.zip") returned 5 [0054.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF", pszSpec="*.rar") returned 0 [0054.631] lstrlenA (lpString="*.rar") returned 5 [0054.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF", pszSpec="*.7z") returned 0 [0054.631] lstrlenA (lpString="*.7z") returned 4 [0054.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF", pszSpec="*.tar") returned 0 [0054.631] lstrlenA (lpString="*.tar") returned 5 [0054.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF", pszSpec="*.gzip") returned 0 [0054.631] lstrlenA (lpString="*.gzip") returned 6 [0054.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF", pszSpec="*.jpg") returned 0 [0054.631] lstrlenA (lpString="*.jpg") returned 5 [0054.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF", pszSpec="*.jpeg") returned 0 [0054.631] lstrlenA (lpString="*.jpeg") returned 6 [0054.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF", pszSpec="*.psd") returned 0 [0054.631] lstrlenA (lpString="*.psd") returned 5 [0054.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF", pszSpec="*.gif") returned 1 [0054.631] lstrlenA (lpString="*.gif") returned 5 [0054.631] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF" [0054.631] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF" [0054.631] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF." [0054.631] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF.wannacry" [0054.631] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15276_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.632] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x49 [0054.632] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc3a2c400, dwHighDateTime=0x1bd4f3f), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcb414e0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc3a2c400, dwHighDateTime=0x1bd4f3f)) returned 1 [0054.632] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.632] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0054.632] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.632] CloseHandle (hObject=0x90) returned 1 [0054.632] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15276_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15276_.gif.wannacry")) returned 1 [0054.633] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2719700, ftCreationTime.dwHighDateTime=0x1bd4f3f, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc2719700, ftLastWriteTime.dwHighDateTime=0x1bd4f3f, nFileSizeHigh=0x0, nFileSizeLow=0x3c, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15277_.GIF", cAlternateFileName="")) returned 1 [0054.633] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.633] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15277_.GIF") returned 1 [0054.633] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15277_.GIF") returned 1 [0054.633] lstrcmpiA (lpString1="", lpString2="BD15277_.GIF") returned -1 [0054.633] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF") returned="BD15276_.GIF" [0054.633] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.633] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.633] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.633] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.633] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD15277_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF" [0054.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF", pszSpec="*.zip") returned 0 [0054.633] lstrlenA (lpString="*.zip") returned 5 [0054.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF", pszSpec="*.rar") returned 0 [0054.633] lstrlenA (lpString="*.rar") returned 5 [0054.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF", pszSpec="*.7z") returned 0 [0054.633] lstrlenA (lpString="*.7z") returned 4 [0054.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF", pszSpec="*.tar") returned 0 [0054.633] lstrlenA (lpString="*.tar") returned 5 [0054.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF", pszSpec="*.gzip") returned 0 [0054.633] lstrlenA (lpString="*.gzip") returned 6 [0054.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF", pszSpec="*.jpg") returned 0 [0054.633] lstrlenA (lpString="*.jpg") returned 5 [0054.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF", pszSpec="*.jpeg") returned 0 [0054.633] lstrlenA (lpString="*.jpeg") returned 6 [0054.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF", pszSpec="*.psd") returned 0 [0054.633] lstrlenA (lpString="*.psd") returned 5 [0054.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF", pszSpec="*.gif") returned 1 [0054.633] lstrlenA (lpString="*.gif") returned 5 [0054.633] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF" [0054.634] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF" [0054.634] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF." [0054.634] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF.wannacry" [0054.634] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15277_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.635] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c [0054.635] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc2719700, dwHighDateTime=0x1bd4f3f), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcb414e0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc2719700, dwHighDateTime=0x1bd4f3f)) returned 1 [0054.635] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.635] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0054.635] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.635] CloseHandle (hObject=0x90) returned 1 [0054.635] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15277_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15277_.gif.wannacry")) returned 1 [0054.636] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42390f00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x42390f00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x7a, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21294_.GIF", cAlternateFileName="")) returned 1 [0054.636] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.636] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21294_.GIF") returned 1 [0054.636] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21294_.GIF") returned 1 [0054.636] lstrcmpiA (lpString1="", lpString2="BD21294_.GIF") returned -1 [0054.636] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF") returned="BD15277_.GIF" [0054.636] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.636] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.636] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.636] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.636] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21294_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF" [0054.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF", pszSpec="*.zip") returned 0 [0054.636] lstrlenA (lpString="*.zip") returned 5 [0054.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF", pszSpec="*.rar") returned 0 [0054.636] lstrlenA (lpString="*.rar") returned 5 [0054.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF", pszSpec="*.7z") returned 0 [0054.636] lstrlenA (lpString="*.7z") returned 4 [0054.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF", pszSpec="*.tar") returned 0 [0054.636] lstrlenA (lpString="*.tar") returned 5 [0054.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF", pszSpec="*.gzip") returned 0 [0054.636] lstrlenA (lpString="*.gzip") returned 6 [0054.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF", pszSpec="*.jpg") returned 0 [0054.636] lstrlenA (lpString="*.jpg") returned 5 [0054.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF", pszSpec="*.jpeg") returned 0 [0054.636] lstrlenA (lpString="*.jpeg") returned 6 [0054.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF", pszSpec="*.psd") returned 0 [0054.636] lstrlenA (lpString="*.psd") returned 5 [0054.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF", pszSpec="*.gif") returned 1 [0054.636] lstrlenA (lpString="*.gif") returned 5 [0054.636] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF" [0054.636] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF" [0054.637] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF." [0054.637] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF.wannacry" [0054.637] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21294_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.638] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7a [0054.638] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x42390f00, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcd0a560, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x42390f00, dwHighDateTime=0x1bd4d50)) returned 1 [0054.638] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.638] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0054.638] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.638] CloseHandle (hObject=0x90) returned 1 [0054.638] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21294_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21294_.gif.wannacry")) returned 1 [0054.639] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436a3c00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x436a3c00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21295_.GIF", cAlternateFileName="")) returned 1 [0054.639] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.639] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21295_.GIF") returned 1 [0054.639] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21295_.GIF") returned 1 [0054.639] lstrcmpiA (lpString1="", lpString2="BD21295_.GIF") returned -1 [0054.639] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF") returned="BD21294_.GIF" [0054.639] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.639] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.639] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.639] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.639] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21295_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF" [0054.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF", pszSpec="*.zip") returned 0 [0054.639] lstrlenA (lpString="*.zip") returned 5 [0054.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF", pszSpec="*.rar") returned 0 [0054.639] lstrlenA (lpString="*.rar") returned 5 [0054.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF", pszSpec="*.7z") returned 0 [0054.639] lstrlenA (lpString="*.7z") returned 4 [0054.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF", pszSpec="*.tar") returned 0 [0054.639] lstrlenA (lpString="*.tar") returned 5 [0054.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF", pszSpec="*.gzip") returned 0 [0054.639] lstrlenA (lpString="*.gzip") returned 6 [0054.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF", pszSpec="*.jpg") returned 0 [0054.639] lstrlenA (lpString="*.jpg") returned 5 [0054.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF", pszSpec="*.jpeg") returned 0 [0054.639] lstrlenA (lpString="*.jpeg") returned 6 [0054.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF", pszSpec="*.psd") returned 0 [0054.639] lstrlenA (lpString="*.psd") returned 5 [0054.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF", pszSpec="*.gif") returned 1 [0054.640] lstrlenA (lpString="*.gif") returned 5 [0054.640] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF" [0054.640] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF" [0054.640] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF." [0054.640] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF.wannacry" [0054.640] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21295_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.640] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x96 [0054.640] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x436a3c00, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcd0a560, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x436a3c00, dwHighDateTime=0x1bd4d50)) returned 1 [0054.640] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.640] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x18, lpOverlapped=0x0) returned 1 [0054.641] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF") returned="BD21295_.GIF" [0054.641] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.641] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x18, lpOverlapped=0x0) returned 1 [0054.641] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.641] CloseHandle (hObject=0x90) returned 1 [0054.642] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21295_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21295_.gif.wannacry")) returned 1 [0054.642] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45cc9600, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x45cc9600, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21296_.GIF", cAlternateFileName="")) returned 1 [0054.643] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.643] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21296_.GIF") returned 1 [0054.643] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21296_.GIF") returned 1 [0054.643] lstrcmpiA (lpString1="", lpString2="BD21296_.GIF") returned -1 [0054.643] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF") returned="BD21295_.GIF" [0054.643] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.643] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.643] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.643] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.643] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21296_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF" [0054.643] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF", pszSpec="*.zip") returned 0 [0054.643] lstrlenA (lpString="*.zip") returned 5 [0054.643] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF", pszSpec="*.rar") returned 0 [0054.643] lstrlenA (lpString="*.rar") returned 5 [0054.643] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF", pszSpec="*.7z") returned 0 [0054.643] lstrlenA (lpString="*.7z") returned 4 [0054.643] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF", pszSpec="*.tar") returned 0 [0054.643] lstrlenA (lpString="*.tar") returned 5 [0054.643] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF", pszSpec="*.gzip") returned 0 [0054.643] lstrlenA (lpString="*.gzip") returned 6 [0054.643] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF", pszSpec="*.jpg") returned 0 [0054.644] lstrlenA (lpString="*.jpg") returned 5 [0054.644] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF", pszSpec="*.jpeg") returned 0 [0054.644] lstrlenA (lpString="*.jpeg") returned 6 [0054.644] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF", pszSpec="*.psd") returned 0 [0054.644] lstrlenA (lpString="*.psd") returned 5 [0054.644] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF", pszSpec="*.gif") returned 1 [0054.644] lstrlenA (lpString="*.gif") returned 5 [0054.644] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF" [0054.644] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF" [0054.644] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF." [0054.644] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF.wannacry" [0054.644] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21296_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.644] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x94 [0054.644] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45cc9600, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcd0a560, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45cc9600, dwHighDateTime=0x1bd4d50)) returned 1 [0054.644] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.644] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x16, lpOverlapped=0x0) returned 1 [0054.645] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF") returned="BD21296_.GIF" [0054.645] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.646] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x16, lpOverlapped=0x0) returned 1 [0054.646] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.646] CloseHandle (hObject=0x90) returned 1 [0054.646] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21296_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21296_.gif.wannacry")) returned 1 [0054.647] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x449b6900, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x449b6900, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21297_.GIF", cAlternateFileName="")) returned 1 [0054.647] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.647] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21297_.GIF") returned 1 [0054.647] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21297_.GIF") returned 1 [0054.647] lstrcmpiA (lpString1="", lpString2="BD21297_.GIF") returned -1 [0054.647] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF") returned="BD21296_.GIF" [0054.647] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.647] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.647] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.647] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.647] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21297_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF" [0054.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF", pszSpec="*.zip") returned 0 [0054.647] lstrlenA (lpString="*.zip") returned 5 [0054.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF", pszSpec="*.rar") returned 0 [0054.647] lstrlenA (lpString="*.rar") returned 5 [0054.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF", pszSpec="*.7z") returned 0 [0054.647] lstrlenA (lpString="*.7z") returned 4 [0054.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF", pszSpec="*.tar") returned 0 [0054.647] lstrlenA (lpString="*.tar") returned 5 [0054.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF", pszSpec="*.gzip") returned 0 [0054.647] lstrlenA (lpString="*.gzip") returned 6 [0054.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF", pszSpec="*.jpg") returned 0 [0054.647] lstrlenA (lpString="*.jpg") returned 5 [0054.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF", pszSpec="*.jpeg") returned 0 [0054.647] lstrlenA (lpString="*.jpeg") returned 6 [0054.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF", pszSpec="*.psd") returned 0 [0054.648] lstrlenA (lpString="*.psd") returned 5 [0054.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF", pszSpec="*.gif") returned 1 [0054.648] lstrlenA (lpString="*.gif") returned 5 [0054.648] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF" [0054.648] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF" [0054.648] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF." [0054.648] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF.wannacry" [0054.648] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21297_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.648] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x370 [0054.648] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x449b6900, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcd0a560, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x449b6900, dwHighDateTime=0x1bd4d50)) returned 1 [0054.648] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.648] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2f2, lpOverlapped=0x0) returned 1 [0054.650] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF") returned="BD21297_.GIF" [0054.650] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.650] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2f2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2f2, lpOverlapped=0x0) returned 1 [0054.651] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.651] CloseHandle (hObject=0x90) returned 1 [0054.651] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21297_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21297_.gif.wannacry")) returned 1 [0054.651] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a914a00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4a914a00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21298_.GIF", cAlternateFileName="")) returned 1 [0054.651] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.651] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21298_.GIF") returned 1 [0054.651] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21298_.GIF") returned 1 [0054.651] lstrcmpiA (lpString1="", lpString2="BD21298_.GIF") returned -1 [0054.651] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF") returned="BD21297_.GIF" [0054.651] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.651] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.652] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.652] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.652] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21298_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF" [0054.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF", pszSpec="*.zip") returned 0 [0054.652] lstrlenA (lpString="*.zip") returned 5 [0054.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF", pszSpec="*.rar") returned 0 [0054.652] lstrlenA (lpString="*.rar") returned 5 [0054.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF", pszSpec="*.7z") returned 0 [0054.652] lstrlenA (lpString="*.7z") returned 4 [0054.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF", pszSpec="*.tar") returned 0 [0054.652] lstrlenA (lpString="*.tar") returned 5 [0054.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF", pszSpec="*.gzip") returned 0 [0054.652] lstrlenA (lpString="*.gzip") returned 6 [0054.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF", pszSpec="*.jpg") returned 0 [0054.652] lstrlenA (lpString="*.jpg") returned 5 [0054.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF", pszSpec="*.jpeg") returned 0 [0054.652] lstrlenA (lpString="*.jpeg") returned 6 [0054.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF", pszSpec="*.psd") returned 0 [0054.652] lstrlenA (lpString="*.psd") returned 5 [0054.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF", pszSpec="*.gif") returned 1 [0054.652] lstrlenA (lpString="*.gif") returned 5 [0054.652] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF" [0054.652] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF" [0054.652] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF." [0054.652] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF.wannacry" [0054.652] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21298_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.653] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x65 [0054.653] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4a914a00, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcd0a560, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4a914a00, dwHighDateTime=0x1bd4d50)) returned 1 [0054.653] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.653] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0054.654] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.654] CloseHandle (hObject=0x90) returned 1 [0054.654] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21298_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21298_.gif.wannacry")) returned 1 [0054.654] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49601d00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x49601d00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x4f, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21299_.GIF", cAlternateFileName="")) returned 1 [0054.654] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.654] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21299_.GIF") returned 1 [0054.654] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21299_.GIF") returned 1 [0054.654] lstrcmpiA (lpString1="", lpString2="BD21299_.GIF") returned -1 [0054.655] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF") returned="BD21298_.GIF" [0054.655] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.655] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.655] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.655] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.655] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21299_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF" [0054.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF", pszSpec="*.zip") returned 0 [0054.655] lstrlenA (lpString="*.zip") returned 5 [0054.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF", pszSpec="*.rar") returned 0 [0054.655] lstrlenA (lpString="*.rar") returned 5 [0054.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF", pszSpec="*.7z") returned 0 [0054.655] lstrlenA (lpString="*.7z") returned 4 [0054.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF", pszSpec="*.tar") returned 0 [0054.655] lstrlenA (lpString="*.tar") returned 5 [0054.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF", pszSpec="*.gzip") returned 0 [0054.655] lstrlenA (lpString="*.gzip") returned 6 [0054.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF", pszSpec="*.jpg") returned 0 [0054.655] lstrlenA (lpString="*.jpg") returned 5 [0054.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF", pszSpec="*.jpeg") returned 0 [0054.655] lstrlenA (lpString="*.jpeg") returned 6 [0054.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF", pszSpec="*.psd") returned 0 [0054.655] lstrlenA (lpString="*.psd") returned 5 [0054.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF", pszSpec="*.gif") returned 1 [0054.655] lstrlenA (lpString="*.gif") returned 5 [0054.655] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF" [0054.655] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF" [0054.655] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF." [0054.655] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF.wannacry" [0054.655] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21299_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.656] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f [0054.656] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x49601d00, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcd0a560, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x49601d00, dwHighDateTime=0x1bd4d50)) returned 1 [0054.656] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.656] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0054.656] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.656] CloseHandle (hObject=0x90) returned 1 [0054.656] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21299_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21299_.gif.wannacry")) returned 1 [0054.657] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x482ef000, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x482ef000, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x8c, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21300_.GIF", cAlternateFileName="")) returned 1 [0054.657] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.657] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21300_.GIF") returned 1 [0054.657] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21300_.GIF") returned 1 [0054.657] lstrcmpiA (lpString1="", lpString2="BD21300_.GIF") returned -1 [0054.657] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF") returned="BD21299_.GIF" [0054.657] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.657] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.657] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.657] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.657] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21300_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF" [0054.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF", pszSpec="*.zip") returned 0 [0054.658] lstrlenA (lpString="*.zip") returned 5 [0054.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF", pszSpec="*.rar") returned 0 [0054.658] lstrlenA (lpString="*.rar") returned 5 [0054.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF", pszSpec="*.7z") returned 0 [0054.658] lstrlenA (lpString="*.7z") returned 4 [0054.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF", pszSpec="*.tar") returned 0 [0054.658] lstrlenA (lpString="*.tar") returned 5 [0054.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF", pszSpec="*.gzip") returned 0 [0054.658] lstrlenA (lpString="*.gzip") returned 6 [0054.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF", pszSpec="*.jpg") returned 0 [0054.658] lstrlenA (lpString="*.jpg") returned 5 [0054.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF", pszSpec="*.jpeg") returned 0 [0054.658] lstrlenA (lpString="*.jpeg") returned 6 [0054.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF", pszSpec="*.psd") returned 0 [0054.658] lstrlenA (lpString="*.psd") returned 5 [0054.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF", pszSpec="*.gif") returned 1 [0054.658] lstrlenA (lpString="*.gif") returned 5 [0054.658] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF" [0054.658] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF" [0054.658] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF." [0054.658] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF.wannacry" [0054.658] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21300_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.658] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8c [0054.659] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x482ef000, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcd306c0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x482ef000, dwHighDateTime=0x1bd4d50)) returned 1 [0054.659] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.659] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xe, lpOverlapped=0x0) returned 1 [0054.659] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF") returned="BD21300_.GIF" [0054.659] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.660] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xe, lpOverlapped=0x0) returned 1 [0054.660] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.660] CloseHandle (hObject=0x90) returned 1 [0054.660] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21300_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21300_.gif.wannacry")) returned 1 [0054.660] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51b85800, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51b85800, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21301_.GIF", cAlternateFileName="")) returned 1 [0054.660] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.660] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21301_.GIF") returned 1 [0054.660] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21301_.GIF") returned 1 [0054.660] lstrcmpiA (lpString1="", lpString2="BD21301_.GIF") returned -1 [0054.660] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF") returned="BD21300_.GIF" [0054.661] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.661] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.661] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.661] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.661] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21301_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF" [0054.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF", pszSpec="*.zip") returned 0 [0054.661] lstrlenA (lpString="*.zip") returned 5 [0054.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF", pszSpec="*.rar") returned 0 [0054.661] lstrlenA (lpString="*.rar") returned 5 [0054.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF", pszSpec="*.7z") returned 0 [0054.661] lstrlenA (lpString="*.7z") returned 4 [0054.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF", pszSpec="*.tar") returned 0 [0054.661] lstrlenA (lpString="*.tar") returned 5 [0054.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF", pszSpec="*.gzip") returned 0 [0054.661] lstrlenA (lpString="*.gzip") returned 6 [0054.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF", pszSpec="*.jpg") returned 0 [0054.661] lstrlenA (lpString="*.jpg") returned 5 [0054.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF", pszSpec="*.jpeg") returned 0 [0054.661] lstrlenA (lpString="*.jpeg") returned 6 [0054.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF", pszSpec="*.psd") returned 0 [0054.661] lstrlenA (lpString="*.psd") returned 5 [0054.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF", pszSpec="*.gif") returned 1 [0054.661] lstrlenA (lpString="*.gif") returned 5 [0054.661] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF" [0054.661] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF" [0054.661] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF." [0054.661] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF.wannacry" [0054.661] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21301_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.662] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcc [0054.662] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x51b85800, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcd306c0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x51b85800, dwHighDateTime=0x1bd4d50)) returned 1 [0054.662] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.662] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4e, lpOverlapped=0x0) returned 1 [0054.663] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF") returned="BD21301_.GIF" [0054.663] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.663] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4e, lpOverlapped=0x0) returned 1 [0054.663] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.663] CloseHandle (hObject=0x90) returned 1 [0054.663] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21301_.gif.wannacry")) returned 1 [0054.664] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50872b00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x50872b00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x11d, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21302_.GIF", cAlternateFileName="")) returned 1 [0054.664] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.664] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21302_.GIF") returned 1 [0054.664] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21302_.GIF") returned 1 [0054.664] lstrcmpiA (lpString1="", lpString2="BD21302_.GIF") returned -1 [0054.664] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF") returned="BD21301_.GIF" [0054.664] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.664] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.664] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.664] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.664] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21302_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF" [0054.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF", pszSpec="*.zip") returned 0 [0054.664] lstrlenA (lpString="*.zip") returned 5 [0054.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF", pszSpec="*.rar") returned 0 [0054.664] lstrlenA (lpString="*.rar") returned 5 [0054.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF", pszSpec="*.7z") returned 0 [0054.664] lstrlenA (lpString="*.7z") returned 4 [0054.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF", pszSpec="*.tar") returned 0 [0054.664] lstrlenA (lpString="*.tar") returned 5 [0054.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF", pszSpec="*.gzip") returned 0 [0054.664] lstrlenA (lpString="*.gzip") returned 6 [0054.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF", pszSpec="*.jpg") returned 0 [0054.664] lstrlenA (lpString="*.jpg") returned 5 [0054.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF", pszSpec="*.jpeg") returned 0 [0054.664] lstrlenA (lpString="*.jpeg") returned 6 [0054.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF", pszSpec="*.psd") returned 0 [0054.664] lstrlenA (lpString="*.psd") returned 5 [0054.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF", pszSpec="*.gif") returned 1 [0054.664] lstrlenA (lpString="*.gif") returned 5 [0054.664] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF" [0054.664] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF" [0054.665] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF." [0054.665] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF.wannacry" [0054.665] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21302_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.670] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11d [0054.670] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x50872b00, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcd306c0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x50872b00, dwHighDateTime=0x1bd4d50)) returned 1 [0054.670] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.670] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x9f, lpOverlapped=0x0) returned 1 [0054.671] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF") returned="BD21302_.GIF" [0054.671] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.671] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x9f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x9f, lpOverlapped=0x0) returned 1 [0054.671] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.671] CloseHandle (hObject=0x90) returned 1 [0054.671] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21302_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21302_.gif.wannacry")) returned 1 [0054.672] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cf3a400, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4cf3a400, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21304_.GIF", cAlternateFileName="")) returned 1 [0054.672] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.672] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21304_.GIF") returned 1 [0054.672] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21304_.GIF") returned 1 [0054.672] lstrcmpiA (lpString1="", lpString2="BD21304_.GIF") returned -1 [0054.672] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF") returned="BD21302_.GIF" [0054.672] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.672] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.672] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.672] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.672] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21304_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF" [0054.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF", pszSpec="*.zip") returned 0 [0054.673] lstrlenA (lpString="*.zip") returned 5 [0054.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF", pszSpec="*.rar") returned 0 [0054.673] lstrlenA (lpString="*.rar") returned 5 [0054.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF", pszSpec="*.7z") returned 0 [0054.673] lstrlenA (lpString="*.7z") returned 4 [0054.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF", pszSpec="*.tar") returned 0 [0054.673] lstrlenA (lpString="*.tar") returned 5 [0054.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF", pszSpec="*.gzip") returned 0 [0054.673] lstrlenA (lpString="*.gzip") returned 6 [0054.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF", pszSpec="*.jpg") returned 0 [0054.673] lstrlenA (lpString="*.jpg") returned 5 [0054.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF", pszSpec="*.jpeg") returned 0 [0054.673] lstrlenA (lpString="*.jpeg") returned 6 [0054.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF", pszSpec="*.psd") returned 0 [0054.673] lstrlenA (lpString="*.psd") returned 5 [0054.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF", pszSpec="*.gif") returned 1 [0054.673] lstrlenA (lpString="*.gif") returned 5 [0054.673] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF" [0054.673] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF" [0054.673] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF." [0054.673] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF.wannacry" [0054.673] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21304_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.674] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24f [0054.674] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4cf3a400, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcd306c0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4cf3a400, dwHighDateTime=0x1bd4d50)) returned 1 [0054.674] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.674] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1d1, lpOverlapped=0x0) returned 1 [0054.675] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF") returned="BD21304_.GIF" [0054.675] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.675] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1d1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1d1, lpOverlapped=0x0) returned 1 [0054.675] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.675] CloseHandle (hObject=0x90) returned 1 [0054.675] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21304_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21304_.gif.wannacry")) returned 1 [0054.677] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bc27700, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4bc27700, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21306_.GIF", cAlternateFileName="")) returned 1 [0054.677] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.677] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21306_.GIF") returned 1 [0054.677] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21306_.GIF") returned 1 [0054.677] lstrcmpiA (lpString1="", lpString2="BD21306_.GIF") returned -1 [0054.677] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF") returned="BD21304_.GIF" [0054.677] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.677] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.677] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.677] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.677] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21306_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF" [0054.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF", pszSpec="*.zip") returned 0 [0054.677] lstrlenA (lpString="*.zip") returned 5 [0054.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF", pszSpec="*.rar") returned 0 [0054.677] lstrlenA (lpString="*.rar") returned 5 [0054.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF", pszSpec="*.7z") returned 0 [0054.677] lstrlenA (lpString="*.7z") returned 4 [0054.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF", pszSpec="*.tar") returned 0 [0054.677] lstrlenA (lpString="*.tar") returned 5 [0054.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF", pszSpec="*.gzip") returned 0 [0054.677] lstrlenA (lpString="*.gzip") returned 6 [0054.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF", pszSpec="*.jpg") returned 0 [0054.677] lstrlenA (lpString="*.jpg") returned 5 [0054.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF", pszSpec="*.jpeg") returned 0 [0054.678] lstrlenA (lpString="*.jpeg") returned 6 [0054.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF", pszSpec="*.psd") returned 0 [0054.678] lstrlenA (lpString="*.psd") returned 5 [0054.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF", pszSpec="*.gif") returned 1 [0054.678] lstrlenA (lpString="*.gif") returned 5 [0054.678] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF" [0054.678] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF" [0054.678] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF." [0054.678] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF.wannacry" [0054.678] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21306_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.679] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24f [0054.679] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4bc27700, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcd306c0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4bc27700, dwHighDateTime=0x1bd4d50)) returned 1 [0054.679] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.679] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1d1, lpOverlapped=0x0) returned 1 [0054.680] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF") returned="BD21306_.GIF" [0054.680] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.680] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1d1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1d1, lpOverlapped=0x0) returned 1 [0054.680] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.680] CloseHandle (hObject=0x90) returned 1 [0054.680] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21306_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21306_.gif.wannacry")) returned 1 [0054.681] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4107e200, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4107e200, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x3d7, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21308_.GIF", cAlternateFileName="")) returned 1 [0054.681] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.681] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21308_.GIF") returned 1 [0054.681] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21308_.GIF") returned 1 [0054.681] lstrcmpiA (lpString1="", lpString2="BD21308_.GIF") returned -1 [0054.681] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF") returned="BD21306_.GIF" [0054.681] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.681] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.682] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.682] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.682] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21308_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF" [0054.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF", pszSpec="*.zip") returned 0 [0054.682] lstrlenA (lpString="*.zip") returned 5 [0054.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF", pszSpec="*.rar") returned 0 [0054.682] lstrlenA (lpString="*.rar") returned 5 [0054.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF", pszSpec="*.7z") returned 0 [0054.682] lstrlenA (lpString="*.7z") returned 4 [0054.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF", pszSpec="*.tar") returned 0 [0054.682] lstrlenA (lpString="*.tar") returned 5 [0054.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF", pszSpec="*.gzip") returned 0 [0054.682] lstrlenA (lpString="*.gzip") returned 6 [0054.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF", pszSpec="*.jpg") returned 0 [0054.682] lstrlenA (lpString="*.jpg") returned 5 [0054.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF", pszSpec="*.jpeg") returned 0 [0054.682] lstrlenA (lpString="*.jpeg") returned 6 [0054.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF", pszSpec="*.psd") returned 0 [0054.682] lstrlenA (lpString="*.psd") returned 5 [0054.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF", pszSpec="*.gif") returned 1 [0054.682] lstrlenA (lpString="*.gif") returned 5 [0054.682] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF" [0054.682] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF" [0054.682] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF." [0054.682] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF.wannacry" [0054.682] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21308_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.683] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d7 [0054.683] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4107e200, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcd56820, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4107e200, dwHighDateTime=0x1bd4d50)) returned 1 [0054.683] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.683] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x359, lpOverlapped=0x0) returned 1 [0054.684] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF") returned="BD21308_.GIF" [0054.684] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.684] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x359, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x359, lpOverlapped=0x0) returned 1 [0054.685] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.685] CloseHandle (hObject=0x90) returned 1 [0054.685] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21308_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21308_.gif.wannacry")) returned 1 [0054.685] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea58800, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3ea58800, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x3d4, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21310_.GIF", cAlternateFileName="")) returned 1 [0054.685] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.685] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21310_.GIF") returned 1 [0054.685] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21310_.GIF") returned 1 [0054.685] lstrcmpiA (lpString1="", lpString2="BD21310_.GIF") returned -1 [0054.685] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF") returned="BD21308_.GIF" [0054.686] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.686] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.686] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21310_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF" [0054.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF", pszSpec="*.zip") returned 0 [0054.686] lstrlenA (lpString="*.zip") returned 5 [0054.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF", pszSpec="*.rar") returned 0 [0054.686] lstrlenA (lpString="*.rar") returned 5 [0054.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF", pszSpec="*.7z") returned 0 [0054.686] lstrlenA (lpString="*.7z") returned 4 [0054.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF", pszSpec="*.tar") returned 0 [0054.686] lstrlenA (lpString="*.tar") returned 5 [0054.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF", pszSpec="*.gzip") returned 0 [0054.686] lstrlenA (lpString="*.gzip") returned 6 [0054.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF", pszSpec="*.jpg") returned 0 [0054.686] lstrlenA (lpString="*.jpg") returned 5 [0054.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF", pszSpec="*.jpeg") returned 0 [0054.686] lstrlenA (lpString="*.jpeg") returned 6 [0054.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF", pszSpec="*.psd") returned 0 [0054.686] lstrlenA (lpString="*.psd") returned 5 [0054.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF", pszSpec="*.gif") returned 1 [0054.686] lstrlenA (lpString="*.gif") returned 5 [0054.686] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF" [0054.686] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF" [0054.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF." [0054.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF.wannacry" [0054.686] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21310_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.687] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d4 [0054.687] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3ea58800, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcd56820, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3ea58800, dwHighDateTime=0x1bd4d50)) returned 1 [0054.687] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.687] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x356, lpOverlapped=0x0) returned 1 [0054.689] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF") returned="BD21310_.GIF" [0054.689] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.689] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x356, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x356, lpOverlapped=0x0) returned 1 [0054.689] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.689] CloseHandle (hObject=0x90) returned 1 [0054.689] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21310_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21310_.gif.wannacry")) returned 1 [0054.690] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c432e00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3c432e00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21312_.GIF", cAlternateFileName="")) returned 1 [0054.690] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.690] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21312_.GIF") returned 1 [0054.690] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21312_.GIF") returned 1 [0054.690] lstrcmpiA (lpString1="", lpString2="BD21312_.GIF") returned -1 [0054.690] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF") returned="BD21310_.GIF" [0054.690] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.690] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.690] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.690] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.690] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21312_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF" [0054.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF", pszSpec="*.zip") returned 0 [0054.691] lstrlenA (lpString="*.zip") returned 5 [0054.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF", pszSpec="*.rar") returned 0 [0054.691] lstrlenA (lpString="*.rar") returned 5 [0054.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF", pszSpec="*.7z") returned 0 [0054.691] lstrlenA (lpString="*.7z") returned 4 [0054.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF", pszSpec="*.tar") returned 0 [0054.691] lstrlenA (lpString="*.tar") returned 5 [0054.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF", pszSpec="*.gzip") returned 0 [0054.691] lstrlenA (lpString="*.gzip") returned 6 [0054.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF", pszSpec="*.jpg") returned 0 [0054.691] lstrlenA (lpString="*.jpg") returned 5 [0054.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF", pszSpec="*.jpeg") returned 0 [0054.691] lstrlenA (lpString="*.jpeg") returned 6 [0054.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF", pszSpec="*.psd") returned 0 [0054.691] lstrlenA (lpString="*.psd") returned 5 [0054.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF", pszSpec="*.gif") returned 1 [0054.691] lstrlenA (lpString="*.gif") returned 5 [0054.691] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF" [0054.691] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF" [0054.691] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF." [0054.691] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF.wannacry" [0054.691] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21312_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.691] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x101 [0054.692] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3c432e00, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcd56820, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3c432e00, dwHighDateTime=0x1bd4d50)) returned 1 [0054.692] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.692] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x83, lpOverlapped=0x0) returned 1 [0054.693] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF") returned="BD21312_.GIF" [0054.693] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.693] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x83, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x83, lpOverlapped=0x0) returned 1 [0054.693] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.693] CloseHandle (hObject=0x90) returned 1 [0054.693] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21312_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21312_.gif.wannacry")) returned 1 [0054.694] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38afa700, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x38afa700, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x45, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21314_.GIF", cAlternateFileName="")) returned 1 [0054.694] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.694] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21314_.GIF") returned 1 [0054.694] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21314_.GIF") returned 1 [0054.694] lstrcmpiA (lpString1="", lpString2="BD21314_.GIF") returned -1 [0054.694] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF") returned="BD21312_.GIF" [0054.694] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.694] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.694] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.694] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.694] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21314_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF" [0054.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF", pszSpec="*.zip") returned 0 [0054.694] lstrlenA (lpString="*.zip") returned 5 [0054.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF", pszSpec="*.rar") returned 0 [0054.694] lstrlenA (lpString="*.rar") returned 5 [0054.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF", pszSpec="*.7z") returned 0 [0054.694] lstrlenA (lpString="*.7z") returned 4 [0054.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF", pszSpec="*.tar") returned 0 [0054.694] lstrlenA (lpString="*.tar") returned 5 [0054.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF", pszSpec="*.gzip") returned 0 [0054.694] lstrlenA (lpString="*.gzip") returned 6 [0054.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF", pszSpec="*.jpg") returned 0 [0054.694] lstrlenA (lpString="*.jpg") returned 5 [0054.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF", pszSpec="*.jpeg") returned 0 [0054.694] lstrlenA (lpString="*.jpeg") returned 6 [0054.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF", pszSpec="*.psd") returned 0 [0054.695] lstrlenA (lpString="*.psd") returned 5 [0054.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF", pszSpec="*.gif") returned 1 [0054.695] lstrlenA (lpString="*.gif") returned 5 [0054.695] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF" [0054.695] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF" [0054.695] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF." [0054.695] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF.wannacry" [0054.695] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21314_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.696] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x45 [0054.696] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x38afa700, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcd7c980, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x38afa700, dwHighDateTime=0x1bd4d50)) returned 1 [0054.696] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.696] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0054.696] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.696] CloseHandle (hObject=0x90) returned 1 [0054.696] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21314_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21314_.gif.wannacry")) returned 1 [0054.697] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33eaf300, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x33eaf300, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x113, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21316_.GIF", cAlternateFileName="")) returned 1 [0054.697] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.697] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21316_.GIF") returned 1 [0054.697] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21316_.GIF") returned 1 [0054.697] lstrcmpiA (lpString1="", lpString2="BD21316_.GIF") returned -1 [0054.697] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF") returned="BD21314_.GIF" [0054.697] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.697] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.697] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.697] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.697] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21316_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF" [0054.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF", pszSpec="*.zip") returned 0 [0054.697] lstrlenA (lpString="*.zip") returned 5 [0054.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF", pszSpec="*.rar") returned 0 [0054.697] lstrlenA (lpString="*.rar") returned 5 [0054.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF", pszSpec="*.7z") returned 0 [0054.697] lstrlenA (lpString="*.7z") returned 4 [0054.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF", pszSpec="*.tar") returned 0 [0054.697] lstrlenA (lpString="*.tar") returned 5 [0054.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF", pszSpec="*.gzip") returned 0 [0054.697] lstrlenA (lpString="*.gzip") returned 6 [0054.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF", pszSpec="*.jpg") returned 0 [0054.697] lstrlenA (lpString="*.jpg") returned 5 [0054.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF", pszSpec="*.jpeg") returned 0 [0054.697] lstrlenA (lpString="*.jpeg") returned 6 [0054.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF", pszSpec="*.psd") returned 0 [0054.697] lstrlenA (lpString="*.psd") returned 5 [0054.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF", pszSpec="*.gif") returned 1 [0054.698] lstrlenA (lpString="*.gif") returned 5 [0054.698] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF" [0054.698] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF" [0054.698] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF." [0054.698] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF.wannacry" [0054.698] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21316_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.698] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x113 [0054.698] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x33eaf300, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcd7c980, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x33eaf300, dwHighDateTime=0x1bd4d50)) returned 1 [0054.698] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.698] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x95, lpOverlapped=0x0) returned 1 [0054.699] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF") returned="BD21316_.GIF" [0054.699] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.699] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x95, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x95, lpOverlapped=0x0) returned 1 [0054.699] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.699] CloseHandle (hObject=0x90) returned 1 [0054.699] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21316_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21316_.gif.wannacry")) returned 1 [0054.700] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cc3e500, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2cc3e500, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21327_.GIF", cAlternateFileName="")) returned 1 [0054.700] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.700] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21327_.GIF") returned 1 [0054.700] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21327_.GIF") returned 1 [0054.700] lstrcmpiA (lpString1="", lpString2="BD21327_.GIF") returned -1 [0054.700] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF") returned="BD21316_.GIF" [0054.700] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.700] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.700] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.700] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.700] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21327_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF" [0054.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF", pszSpec="*.zip") returned 0 [0054.700] lstrlenA (lpString="*.zip") returned 5 [0054.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF", pszSpec="*.rar") returned 0 [0054.700] lstrlenA (lpString="*.rar") returned 5 [0054.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF", pszSpec="*.7z") returned 0 [0054.700] lstrlenA (lpString="*.7z") returned 4 [0054.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF", pszSpec="*.tar") returned 0 [0054.700] lstrlenA (lpString="*.tar") returned 5 [0054.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF", pszSpec="*.gzip") returned 0 [0054.701] lstrlenA (lpString="*.gzip") returned 6 [0054.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF", pszSpec="*.jpg") returned 0 [0054.701] lstrlenA (lpString="*.jpg") returned 5 [0054.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF", pszSpec="*.jpeg") returned 0 [0054.701] lstrlenA (lpString="*.jpeg") returned 6 [0054.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF", pszSpec="*.psd") returned 0 [0054.701] lstrlenA (lpString="*.psd") returned 5 [0054.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF", pszSpec="*.gif") returned 1 [0054.701] lstrlenA (lpString="*.gif") returned 5 [0054.701] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF" [0054.701] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF" [0054.701] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF." [0054.701] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF.wannacry" [0054.701] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21327_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.702] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae [0054.702] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x2cc3e500, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcda2ae0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x2cc3e500, dwHighDateTime=0x1bd4d50)) returned 1 [0054.702] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.702] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x30, lpOverlapped=0x0) returned 1 [0054.703] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF") returned="BD21327_.GIF" [0054.703] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.703] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x30, lpOverlapped=0x0) returned 1 [0054.703] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.703] CloseHandle (hObject=0x90) returned 1 [0054.703] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21327_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21327_.gif.wannacry")) returned 1 [0054.704] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29305e00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29305e00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x131, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21329_.GIF", cAlternateFileName="")) returned 1 [0054.704] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.704] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21329_.GIF") returned 1 [0054.704] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21329_.GIF") returned 1 [0054.704] lstrcmpiA (lpString1="", lpString2="BD21329_.GIF") returned -1 [0054.704] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF") returned="BD21327_.GIF" [0054.704] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.704] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.704] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.704] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.704] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21329_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF" [0054.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF", pszSpec="*.zip") returned 0 [0054.704] lstrlenA (lpString="*.zip") returned 5 [0054.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF", pszSpec="*.rar") returned 0 [0054.704] lstrlenA (lpString="*.rar") returned 5 [0054.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF", pszSpec="*.7z") returned 0 [0054.704] lstrlenA (lpString="*.7z") returned 4 [0054.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF", pszSpec="*.tar") returned 0 [0054.705] lstrlenA (lpString="*.tar") returned 5 [0054.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF", pszSpec="*.gzip") returned 0 [0054.705] lstrlenA (lpString="*.gzip") returned 6 [0054.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF", pszSpec="*.jpg") returned 0 [0054.705] lstrlenA (lpString="*.jpg") returned 5 [0054.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF", pszSpec="*.jpeg") returned 0 [0054.705] lstrlenA (lpString="*.jpeg") returned 6 [0054.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF", pszSpec="*.psd") returned 0 [0054.705] lstrlenA (lpString="*.psd") returned 5 [0054.705] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF", pszSpec="*.gif") returned 1 [0054.705] lstrlenA (lpString="*.gif") returned 5 [0054.705] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF" [0054.705] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF" [0054.705] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF." [0054.705] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF.wannacry" [0054.705] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21329_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.705] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x131 [0054.705] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x29305e00, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcdc8c40, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x29305e00, dwHighDateTime=0x1bd4d50)) returned 1 [0054.705] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.705] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xb3, lpOverlapped=0x0) returned 1 [0054.706] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF") returned="BD21329_.GIF" [0054.706] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.706] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xb3, lpOverlapped=0x0) returned 1 [0054.706] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.707] CloseHandle (hObject=0x90) returned 1 [0054.707] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21329_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21329_.gif.wannacry")) returned 1 [0054.707] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x259cd700, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x259cd700, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21331_.GIF", cAlternateFileName="")) returned 1 [0054.707] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.707] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21331_.GIF") returned 1 [0054.707] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21331_.GIF") returned 1 [0054.707] lstrcmpiA (lpString1="", lpString2="BD21331_.GIF") returned -1 [0054.707] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF") returned="BD21329_.GIF" [0054.707] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.707] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.707] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.707] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.707] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21331_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF" [0054.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF", pszSpec="*.zip") returned 0 [0054.708] lstrlenA (lpString="*.zip") returned 5 [0054.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF", pszSpec="*.rar") returned 0 [0054.708] lstrlenA (lpString="*.rar") returned 5 [0054.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF", pszSpec="*.7z") returned 0 [0054.708] lstrlenA (lpString="*.7z") returned 4 [0054.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF", pszSpec="*.tar") returned 0 [0054.708] lstrlenA (lpString="*.tar") returned 5 [0054.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF", pszSpec="*.gzip") returned 0 [0054.708] lstrlenA (lpString="*.gzip") returned 6 [0054.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF", pszSpec="*.jpg") returned 0 [0054.708] lstrlenA (lpString="*.jpg") returned 5 [0054.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF", pszSpec="*.jpeg") returned 0 [0054.708] lstrlenA (lpString="*.jpeg") returned 6 [0054.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF", pszSpec="*.psd") returned 0 [0054.708] lstrlenA (lpString="*.psd") returned 5 [0054.708] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF", pszSpec="*.gif") returned 1 [0054.708] lstrlenA (lpString="*.gif") returned 5 [0054.708] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF" [0054.708] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF" [0054.708] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF." [0054.708] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF.wannacry" [0054.708] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21331_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.709] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x460 [0054.709] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x259cd700, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcdc8c40, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x259cd700, dwHighDateTime=0x1bd4d50)) returned 1 [0054.709] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.709] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3e2, lpOverlapped=0x0) returned 1 [0054.711] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF") returned="BD21331_.GIF" [0054.711] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.711] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3e2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3e2, lpOverlapped=0x0) returned 1 [0054.711] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.711] CloseHandle (hObject=0x90) returned 1 [0054.711] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21331_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21331_.gif.wannacry")) returned 1 [0054.712] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20d82300, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x20d82300, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21333_.GIF", cAlternateFileName="")) returned 1 [0054.712] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.712] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21333_.GIF") returned 1 [0054.712] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21333_.GIF") returned 1 [0054.712] lstrcmpiA (lpString1="", lpString2="BD21333_.GIF") returned -1 [0054.712] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF") returned="BD21331_.GIF" [0054.712] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.712] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.712] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.712] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.712] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21333_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF" [0054.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF", pszSpec="*.zip") returned 0 [0054.712] lstrlenA (lpString="*.zip") returned 5 [0054.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF", pszSpec="*.rar") returned 0 [0054.712] lstrlenA (lpString="*.rar") returned 5 [0054.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF", pszSpec="*.7z") returned 0 [0054.712] lstrlenA (lpString="*.7z") returned 4 [0054.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF", pszSpec="*.tar") returned 0 [0054.713] lstrlenA (lpString="*.tar") returned 5 [0054.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF", pszSpec="*.gzip") returned 0 [0054.713] lstrlenA (lpString="*.gzip") returned 6 [0054.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF", pszSpec="*.jpg") returned 0 [0054.713] lstrlenA (lpString="*.jpg") returned 5 [0054.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF", pszSpec="*.jpeg") returned 0 [0054.713] lstrlenA (lpString="*.jpeg") returned 6 [0054.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF", pszSpec="*.psd") returned 0 [0054.713] lstrlenA (lpString="*.psd") returned 5 [0054.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF", pszSpec="*.gif") returned 1 [0054.713] lstrlenA (lpString="*.gif") returned 5 [0054.713] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF" [0054.713] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF" [0054.713] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF." [0054.713] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF.wannacry" [0054.713] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21333_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.713] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a0 [0054.713] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x20d82300, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcdc8c40, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x20d82300, dwHighDateTime=0x1bd4d50)) returned 1 [0054.713] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.713] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x122, lpOverlapped=0x0) returned 1 [0054.714] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF") returned="BD21333_.GIF" [0054.714] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.714] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x122, lpOverlapped=0x0) returned 1 [0054.715] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.715] CloseHandle (hObject=0x90) returned 1 [0054.715] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21333_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21333_.gif.wannacry")) returned 1 [0054.715] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d449c00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1d449c00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x3cb, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21335_.GIF", cAlternateFileName="")) returned 1 [0054.715] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.715] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21335_.GIF") returned 1 [0054.715] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21335_.GIF") returned 1 [0054.715] lstrcmpiA (lpString1="", lpString2="BD21335_.GIF") returned -1 [0054.715] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF") returned="BD21333_.GIF" [0054.715] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.715] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.716] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.716] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.716] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21335_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF" [0054.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF", pszSpec="*.zip") returned 0 [0054.716] lstrlenA (lpString="*.zip") returned 5 [0054.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF", pszSpec="*.rar") returned 0 [0054.716] lstrlenA (lpString="*.rar") returned 5 [0054.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF", pszSpec="*.7z") returned 0 [0054.716] lstrlenA (lpString="*.7z") returned 4 [0054.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF", pszSpec="*.tar") returned 0 [0054.716] lstrlenA (lpString="*.tar") returned 5 [0054.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF", pszSpec="*.gzip") returned 0 [0054.716] lstrlenA (lpString="*.gzip") returned 6 [0054.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF", pszSpec="*.jpg") returned 0 [0054.716] lstrlenA (lpString="*.jpg") returned 5 [0054.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF", pszSpec="*.jpeg") returned 0 [0054.716] lstrlenA (lpString="*.jpeg") returned 6 [0054.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF", pszSpec="*.psd") returned 0 [0054.716] lstrlenA (lpString="*.psd") returned 5 [0054.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF", pszSpec="*.gif") returned 1 [0054.716] lstrlenA (lpString="*.gif") returned 5 [0054.716] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF" [0054.716] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF" [0054.716] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF." [0054.716] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF.wannacry" [0054.716] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21335_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.717] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3cb [0054.717] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1d449c00, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcdeeda0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1d449c00, dwHighDateTime=0x1bd4d50)) returned 1 [0054.717] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.717] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x34d, lpOverlapped=0x0) returned 1 [0054.719] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF") returned="BD21335_.GIF" [0054.719] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.719] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x34d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x34d, lpOverlapped=0x0) returned 1 [0054.720] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.720] CloseHandle (hObject=0x90) returned 1 [0054.720] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21335_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21335_.gif.wannacry")) returned 1 [0054.721] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c136f00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1c136f00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21337_.GIF", cAlternateFileName="")) returned 1 [0054.721] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.721] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21337_.GIF") returned 1 [0054.721] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21337_.GIF") returned 1 [0054.721] lstrcmpiA (lpString1="", lpString2="BD21337_.GIF") returned -1 [0054.721] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF") returned="BD21335_.GIF" [0054.721] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.721] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.721] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.721] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.721] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21337_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF" [0054.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF", pszSpec="*.zip") returned 0 [0054.721] lstrlenA (lpString="*.zip") returned 5 [0054.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF", pszSpec="*.rar") returned 0 [0054.721] lstrlenA (lpString="*.rar") returned 5 [0054.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF", pszSpec="*.7z") returned 0 [0054.721] lstrlenA (lpString="*.7z") returned 4 [0054.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF", pszSpec="*.tar") returned 0 [0054.721] lstrlenA (lpString="*.tar") returned 5 [0054.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF", pszSpec="*.gzip") returned 0 [0054.722] lstrlenA (lpString="*.gzip") returned 6 [0054.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF", pszSpec="*.jpg") returned 0 [0054.722] lstrlenA (lpString="*.jpg") returned 5 [0054.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF", pszSpec="*.jpeg") returned 0 [0054.722] lstrlenA (lpString="*.jpeg") returned 6 [0054.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF", pszSpec="*.psd") returned 0 [0054.722] lstrlenA (lpString="*.psd") returned 5 [0054.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF", pszSpec="*.gif") returned 1 [0054.722] lstrlenA (lpString="*.gif") returned 5 [0054.722] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF" [0054.722] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF" [0054.722] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF." [0054.722] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF.wannacry" [0054.722] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21337_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.722] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x146 [0054.722] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1c136f00, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcdeeda0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1c136f00, dwHighDateTime=0x1bd4d50)) returned 1 [0054.722] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.723] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xc8, lpOverlapped=0x0) returned 1 [0054.723] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF") returned="BD21337_.GIF" [0054.723] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.723] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xc8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xc8, lpOverlapped=0x0) returned 1 [0054.724] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.724] CloseHandle (hObject=0x90) returned 1 [0054.724] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21337_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21337_.gif.wannacry")) returned 1 [0054.727] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19b11500, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x19b11500, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x6c, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21339_.GIF", cAlternateFileName="")) returned 1 [0054.727] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.727] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21339_.GIF") returned 1 [0054.727] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21339_.GIF") returned 1 [0054.727] lstrcmpiA (lpString1="", lpString2="BD21339_.GIF") returned -1 [0054.727] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF") returned="BD21337_.GIF" [0054.727] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.727] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.727] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.727] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF", pszSpec="*.zip") returned 0 [0054.728] lstrlenA (lpString="*.zip") returned 5 [0054.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF", pszSpec="*.rar") returned 0 [0054.728] lstrlenA (lpString="*.rar") returned 5 [0054.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF", pszSpec="*.7z") returned 0 [0054.728] lstrlenA (lpString="*.7z") returned 4 [0054.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF", pszSpec="*.tar") returned 0 [0054.728] lstrlenA (lpString="*.tar") returned 5 [0054.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF", pszSpec="*.gzip") returned 0 [0054.728] lstrlenA (lpString="*.gzip") returned 6 [0054.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF", pszSpec="*.jpg") returned 0 [0054.728] lstrlenA (lpString="*.jpg") returned 5 [0054.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF", pszSpec="*.jpeg") returned 0 [0054.728] lstrlenA (lpString="*.jpeg") returned 6 [0054.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF", pszSpec="*.psd") returned 0 [0054.728] lstrlenA (lpString="*.psd") returned 5 [0054.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF", pszSpec="*.gif") returned 1 [0054.728] lstrlenA (lpString="*.gif") returned 5 [0054.728] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF" [0054.728] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF" [0054.728] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21339_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.729] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6c [0054.729] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x19b11500, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcdeeda0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x19b11500, dwHighDateTime=0x1bd4d50)) returned 1 [0054.729] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.729] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0054.729] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.729] CloseHandle (hObject=0x90) returned 1 [0054.730] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21339_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21339_.gif.wannacry")) returned 1 [0054.730] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d01a600, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbce14f00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8d01a600, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21342_.GIF", cAlternateFileName="")) returned 1 [0054.730] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.730] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21342_.GIF") returned 1 [0054.730] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21342_.GIF") returned 1 [0054.730] lstrcmpiA (lpString1="", lpString2="BD21342_.GIF") returned -1 [0054.730] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF") returned="BD21339_.GIF" [0054.730] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.730] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.730] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.730] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.731] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21342_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF" [0054.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF", pszSpec="*.zip") returned 0 [0054.731] lstrlenA (lpString="*.zip") returned 5 [0054.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF", pszSpec="*.rar") returned 0 [0054.731] lstrlenA (lpString="*.rar") returned 5 [0054.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF", pszSpec="*.7z") returned 0 [0054.731] lstrlenA (lpString="*.7z") returned 4 [0054.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF", pszSpec="*.tar") returned 0 [0054.731] lstrlenA (lpString="*.tar") returned 5 [0054.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF", pszSpec="*.gzip") returned 0 [0054.731] lstrlenA (lpString="*.gzip") returned 6 [0054.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF", pszSpec="*.jpg") returned 0 [0054.731] lstrlenA (lpString="*.jpg") returned 5 [0054.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF", pszSpec="*.jpeg") returned 0 [0054.731] lstrlenA (lpString="*.jpeg") returned 6 [0054.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF", pszSpec="*.psd") returned 0 [0054.731] lstrlenA (lpString="*.psd") returned 5 [0054.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF", pszSpec="*.gif") returned 1 [0054.731] lstrlenA (lpString="*.gif") returned 5 [0054.731] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF" [0054.731] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF" [0054.731] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF." [0054.731] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF.wannacry" [0054.731] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21342_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.732] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10a [0054.732] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d01a600, dwHighDateTime=0x1bd8f90), lpLastAccessTime=0x407536*(dwLowDateTime=0xbce14f00, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d01a600, dwHighDateTime=0x1bd8f90)) returned 1 [0054.732] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.732] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x8c, lpOverlapped=0x0) returned 1 [0054.733] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF") returned="BD21342_.GIF" [0054.733] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.733] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x8c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x8c, lpOverlapped=0x0) returned 1 [0054.733] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.733] CloseHandle (hObject=0x90) returned 1 [0054.733] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21342_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21342_.gif.wannacry")) returned 1 [0054.734] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d01a600, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbce14f00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8d01a600, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21343_.GIF", cAlternateFileName="")) returned 1 [0054.734] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.734] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21343_.GIF") returned 1 [0054.734] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21343_.GIF") returned 1 [0054.734] lstrcmpiA (lpString1="", lpString2="BD21343_.GIF") returned -1 [0054.734] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF") returned="BD21342_.GIF" [0054.734] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.734] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.734] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.734] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.734] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21343_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF" [0054.734] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF", pszSpec="*.zip") returned 0 [0054.734] lstrlenA (lpString="*.zip") returned 5 [0054.734] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF", pszSpec="*.rar") returned 0 [0054.734] lstrlenA (lpString="*.rar") returned 5 [0054.734] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF", pszSpec="*.7z") returned 0 [0054.734] lstrlenA (lpString="*.7z") returned 4 [0054.734] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF", pszSpec="*.tar") returned 0 [0054.734] lstrlenA (lpString="*.tar") returned 5 [0054.734] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF", pszSpec="*.gzip") returned 0 [0054.734] lstrlenA (lpString="*.gzip") returned 6 [0054.734] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF", pszSpec="*.jpg") returned 0 [0054.734] lstrlenA (lpString="*.jpg") returned 5 [0054.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF", pszSpec="*.jpeg") returned 0 [0054.735] lstrlenA (lpString="*.jpeg") returned 6 [0054.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF", pszSpec="*.psd") returned 0 [0054.735] lstrlenA (lpString="*.psd") returned 5 [0054.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF", pszSpec="*.gif") returned 1 [0054.735] lstrlenA (lpString="*.gif") returned 5 [0054.735] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF" [0054.735] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF" [0054.735] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF." [0054.735] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF.wannacry" [0054.735] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21343_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.735] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb6 [0054.735] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d01a600, dwHighDateTime=0x1bd8f90), lpLastAccessTime=0x407536*(dwLowDateTime=0xbce14f00, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d01a600, dwHighDateTime=0x1bd8f90)) returned 1 [0054.736] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.736] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x38, lpOverlapped=0x0) returned 1 [0054.736] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF") returned="BD21343_.GIF" [0054.737] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.737] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x38, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x38, lpOverlapped=0x0) returned 1 [0054.737] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.737] CloseHandle (hObject=0x90) returned 1 [0054.737] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21343_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21343_.gif.wannacry")) returned 1 [0054.737] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e32d300, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8e32d300, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21344_.GIF", cAlternateFileName="")) returned 1 [0054.737] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.737] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21344_.GIF") returned 1 [0054.737] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21344_.GIF") returned 1 [0054.738] lstrcmpiA (lpString1="", lpString2="BD21344_.GIF") returned -1 [0054.738] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF") returned="BD21343_.GIF" [0054.738] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.738] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.738] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.738] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.738] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21344_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF" [0054.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF", pszSpec="*.zip") returned 0 [0054.738] lstrlenA (lpString="*.zip") returned 5 [0054.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF", pszSpec="*.rar") returned 0 [0054.738] lstrlenA (lpString="*.rar") returned 5 [0054.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF", pszSpec="*.7z") returned 0 [0054.738] lstrlenA (lpString="*.7z") returned 4 [0054.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF", pszSpec="*.tar") returned 0 [0054.738] lstrlenA (lpString="*.tar") returned 5 [0054.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF", pszSpec="*.gzip") returned 0 [0054.738] lstrlenA (lpString="*.gzip") returned 6 [0054.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF", pszSpec="*.jpg") returned 0 [0054.738] lstrlenA (lpString="*.jpg") returned 5 [0054.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF", pszSpec="*.jpeg") returned 0 [0054.738] lstrlenA (lpString="*.jpeg") returned 6 [0054.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF", pszSpec="*.psd") returned 0 [0054.738] lstrlenA (lpString="*.psd") returned 5 [0054.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF", pszSpec="*.gif") returned 1 [0054.738] lstrlenA (lpString="*.gif") returned 5 [0054.738] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF" [0054.739] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF" [0054.739] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF." [0054.739] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF.wannacry" [0054.739] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21344_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.739] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb2 [0054.740] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8e32d300, dwHighDateTime=0x1bd8f90), lpLastAccessTime=0x407536*(dwLowDateTime=0xbce3b060, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8e32d300, dwHighDateTime=0x1bd8f90)) returned 1 [0054.740] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.740] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x34, lpOverlapped=0x0) returned 1 [0054.741] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF") returned="BD21344_.GIF" [0054.741] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.741] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x34, lpOverlapped=0x0) returned 1 [0054.741] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.741] CloseHandle (hObject=0x90) returned 1 [0054.741] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21344_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21344_.gif.wannacry")) returned 1 [0054.741] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52007200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x52007200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21364_.GIF", cAlternateFileName="")) returned 1 [0054.741] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.741] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21364_.GIF") returned 1 [0054.741] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21364_.GIF") returned 1 [0054.742] lstrcmpiA (lpString1="", lpString2="BD21364_.GIF") returned -1 [0054.742] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF") returned="BD21344_.GIF" [0054.742] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.742] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.742] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.742] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.742] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21364_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF" [0054.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF", pszSpec="*.zip") returned 0 [0054.742] lstrlenA (lpString="*.zip") returned 5 [0054.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF", pszSpec="*.rar") returned 0 [0054.742] lstrlenA (lpString="*.rar") returned 5 [0054.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF", pszSpec="*.7z") returned 0 [0054.742] lstrlenA (lpString="*.7z") returned 4 [0054.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF", pszSpec="*.tar") returned 0 [0054.742] lstrlenA (lpString="*.tar") returned 5 [0054.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF", pszSpec="*.gzip") returned 0 [0054.742] lstrlenA (lpString="*.gzip") returned 6 [0054.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF", pszSpec="*.jpg") returned 0 [0054.742] lstrlenA (lpString="*.jpg") returned 5 [0054.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF", pszSpec="*.jpeg") returned 0 [0054.742] lstrlenA (lpString="*.jpeg") returned 6 [0054.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF", pszSpec="*.psd") returned 0 [0054.742] lstrlenA (lpString="*.psd") returned 5 [0054.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF", pszSpec="*.gif") returned 1 [0054.742] lstrlenA (lpString="*.gif") returned 5 [0054.742] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF" [0054.742] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF" [0054.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF." [0054.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF.wannacry" [0054.743] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21364_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.743] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf5 [0054.743] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52007200, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbce3b060, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x52007200, dwHighDateTime=0x1bd8f92)) returned 1 [0054.743] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.743] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x77, lpOverlapped=0x0) returned 1 [0054.744] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF") returned="BD21364_.GIF" [0054.744] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.744] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x77, lpOverlapped=0x0) returned 1 [0054.744] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.744] CloseHandle (hObject=0x90) returned 1 [0054.744] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21364_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21364_.gif.wannacry")) returned 1 [0054.745] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52007200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x52007200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21365_.GIF", cAlternateFileName="")) returned 1 [0054.745] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.745] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21365_.GIF") returned 1 [0054.745] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21365_.GIF") returned 1 [0054.745] lstrcmpiA (lpString1="", lpString2="BD21365_.GIF") returned -1 [0054.745] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF") returned="BD21364_.GIF" [0054.745] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.745] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.745] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.745] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.745] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21365_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF" [0054.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF", pszSpec="*.zip") returned 0 [0054.745] lstrlenA (lpString="*.zip") returned 5 [0054.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF", pszSpec="*.rar") returned 0 [0054.745] lstrlenA (lpString="*.rar") returned 5 [0054.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF", pszSpec="*.7z") returned 0 [0054.745] lstrlenA (lpString="*.7z") returned 4 [0054.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF", pszSpec="*.tar") returned 0 [0054.745] lstrlenA (lpString="*.tar") returned 5 [0054.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF", pszSpec="*.gzip") returned 0 [0054.745] lstrlenA (lpString="*.gzip") returned 6 [0054.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF", pszSpec="*.jpg") returned 0 [0054.745] lstrlenA (lpString="*.jpg") returned 5 [0054.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF", pszSpec="*.jpeg") returned 0 [0054.746] lstrlenA (lpString="*.jpeg") returned 6 [0054.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF", pszSpec="*.psd") returned 0 [0054.746] lstrlenA (lpString="*.psd") returned 5 [0054.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF", pszSpec="*.gif") returned 1 [0054.746] lstrlenA (lpString="*.gif") returned 5 [0054.746] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF" [0054.746] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF" [0054.746] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF." [0054.746] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF.wannacry" [0054.746] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21365_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.746] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xec [0054.746] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52007200, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbce3b060, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x52007200, dwHighDateTime=0x1bd8f92)) returned 1 [0054.746] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.746] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x6e, lpOverlapped=0x0) returned 1 [0054.747] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF") returned="BD21365_.GIF" [0054.747] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.747] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x6e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x6e, lpOverlapped=0x0) returned 1 [0054.747] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.747] CloseHandle (hObject=0x90) returned 1 [0054.748] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21365_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21365_.gif.wannacry")) returned 1 [0054.748] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52007200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x52007200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21366_.GIF", cAlternateFileName="")) returned 1 [0054.748] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.748] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21366_.GIF") returned 1 [0054.748] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21366_.GIF") returned 1 [0054.748] lstrcmpiA (lpString1="", lpString2="BD21366_.GIF") returned -1 [0054.748] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF") returned="BD21365_.GIF" [0054.748] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.748] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.748] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.748] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.748] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21366_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF" [0054.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF", pszSpec="*.zip") returned 0 [0054.749] lstrlenA (lpString="*.zip") returned 5 [0054.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF", pszSpec="*.rar") returned 0 [0054.749] lstrlenA (lpString="*.rar") returned 5 [0054.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF", pszSpec="*.7z") returned 0 [0054.749] lstrlenA (lpString="*.7z") returned 4 [0054.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF", pszSpec="*.tar") returned 0 [0054.749] lstrlenA (lpString="*.tar") returned 5 [0054.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF", pszSpec="*.gzip") returned 0 [0054.749] lstrlenA (lpString="*.gzip") returned 6 [0054.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF", pszSpec="*.jpg") returned 0 [0054.749] lstrlenA (lpString="*.jpg") returned 5 [0054.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF", pszSpec="*.jpeg") returned 0 [0054.749] lstrlenA (lpString="*.jpeg") returned 6 [0054.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF", pszSpec="*.psd") returned 0 [0054.749] lstrlenA (lpString="*.psd") returned 5 [0054.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF", pszSpec="*.gif") returned 1 [0054.749] lstrlenA (lpString="*.gif") returned 5 [0054.749] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF" [0054.749] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF" [0054.749] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF." [0054.749] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF.wannacry" [0054.749] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21366_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.750] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc8 [0054.750] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52007200, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbce3b060, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x52007200, dwHighDateTime=0x1bd8f92)) returned 1 [0054.750] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.750] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4a, lpOverlapped=0x0) returned 1 [0054.751] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF") returned="BD21366_.GIF" [0054.751] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.751] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4a, lpOverlapped=0x0) returned 1 [0054.752] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.752] CloseHandle (hObject=0x90) returned 1 [0054.752] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21366_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21366_.gif.wannacry")) returned 1 [0054.752] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88d68800, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x88d68800, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21375_.GIF", cAlternateFileName="")) returned 1 [0054.752] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.752] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21375_.GIF") returned 1 [0054.753] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21375_.GIF") returned 1 [0054.753] lstrcmpiA (lpString1="", lpString2="BD21375_.GIF") returned -1 [0054.753] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF") returned="BD21366_.GIF" [0054.753] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.753] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.753] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.753] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.753] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21375_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF" [0054.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF", pszSpec="*.zip") returned 0 [0054.753] lstrlenA (lpString="*.zip") returned 5 [0054.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF", pszSpec="*.rar") returned 0 [0054.753] lstrlenA (lpString="*.rar") returned 5 [0054.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF", pszSpec="*.7z") returned 0 [0054.753] lstrlenA (lpString="*.7z") returned 4 [0054.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF", pszSpec="*.tar") returned 0 [0054.753] lstrlenA (lpString="*.tar") returned 5 [0054.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF", pszSpec="*.gzip") returned 0 [0054.753] lstrlenA (lpString="*.gzip") returned 6 [0054.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF", pszSpec="*.jpg") returned 0 [0054.753] lstrlenA (lpString="*.jpg") returned 5 [0054.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF", pszSpec="*.jpeg") returned 0 [0054.753] lstrlenA (lpString="*.jpeg") returned 6 [0054.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF", pszSpec="*.psd") returned 0 [0054.753] lstrlenA (lpString="*.psd") returned 5 [0054.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF", pszSpec="*.gif") returned 1 [0054.753] lstrlenA (lpString="*.gif") returned 5 [0054.753] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF" [0054.753] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF" [0054.753] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF." [0054.754] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF.wannacry" [0054.754] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21375_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.754] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd4 [0054.754] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x88d68800, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbce611c0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x88d68800, dwHighDateTime=0x1bd8f92)) returned 1 [0054.754] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.754] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x56, lpOverlapped=0x0) returned 1 [0054.755] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF") returned="BD21375_.GIF" [0054.755] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.755] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x56, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x56, lpOverlapped=0x0) returned 1 [0054.755] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.755] CloseHandle (hObject=0x90) returned 1 [0054.755] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21375_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21375_.gif.wannacry")) returned 1 [0054.756] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a07b500, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8a07b500, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21376_.GIF", cAlternateFileName="")) returned 1 [0054.756] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.756] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21376_.GIF") returned 1 [0054.756] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21376_.GIF") returned 1 [0054.756] lstrcmpiA (lpString1="", lpString2="BD21376_.GIF") returned -1 [0054.756] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF") returned="BD21375_.GIF" [0054.756] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.756] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.756] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.756] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.756] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21376_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF" [0054.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF", pszSpec="*.zip") returned 0 [0054.756] lstrlenA (lpString="*.zip") returned 5 [0054.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF", pszSpec="*.rar") returned 0 [0054.756] lstrlenA (lpString="*.rar") returned 5 [0054.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF", pszSpec="*.7z") returned 0 [0054.756] lstrlenA (lpString="*.7z") returned 4 [0054.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF", pszSpec="*.tar") returned 0 [0054.756] lstrlenA (lpString="*.tar") returned 5 [0054.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF", pszSpec="*.gzip") returned 0 [0054.756] lstrlenA (lpString="*.gzip") returned 6 [0054.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF", pszSpec="*.jpg") returned 0 [0054.757] lstrlenA (lpString="*.jpg") returned 5 [0054.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF", pszSpec="*.jpeg") returned 0 [0054.757] lstrlenA (lpString="*.jpeg") returned 6 [0054.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF", pszSpec="*.psd") returned 0 [0054.757] lstrlenA (lpString="*.psd") returned 5 [0054.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF", pszSpec="*.gif") returned 1 [0054.757] lstrlenA (lpString="*.gif") returned 5 [0054.757] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF" [0054.757] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF" [0054.757] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF." [0054.757] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF.wannacry" [0054.757] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21376_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.757] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb4 [0054.757] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8a07b500, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbce611c0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8a07b500, dwHighDateTime=0x1bd8f92)) returned 1 [0054.757] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.757] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x36, lpOverlapped=0x0) returned 1 [0054.758] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF") returned="BD21376_.GIF" [0054.758] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.759] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x36, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x36, lpOverlapped=0x0) returned 1 [0054.759] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.759] CloseHandle (hObject=0x90) returned 1 [0054.759] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21376_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21376_.gif.wannacry")) returned 1 [0054.759] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a07b500, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8a07b500, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21377_.GIF", cAlternateFileName="")) returned 1 [0054.759] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.759] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21377_.GIF") returned 1 [0054.759] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21377_.GIF") returned 1 [0054.759] lstrcmpiA (lpString1="", lpString2="BD21377_.GIF") returned -1 [0054.760] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF") returned="BD21376_.GIF" [0054.760] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.760] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.760] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.760] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.760] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21377_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF" [0054.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF", pszSpec="*.zip") returned 0 [0054.760] lstrlenA (lpString="*.zip") returned 5 [0054.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF", pszSpec="*.rar") returned 0 [0054.760] lstrlenA (lpString="*.rar") returned 5 [0054.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF", pszSpec="*.7z") returned 0 [0054.760] lstrlenA (lpString="*.7z") returned 4 [0054.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF", pszSpec="*.tar") returned 0 [0054.760] lstrlenA (lpString="*.tar") returned 5 [0054.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF", pszSpec="*.gzip") returned 0 [0054.760] lstrlenA (lpString="*.gzip") returned 6 [0054.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF", pszSpec="*.jpg") returned 0 [0054.760] lstrlenA (lpString="*.jpg") returned 5 [0054.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF", pszSpec="*.jpeg") returned 0 [0054.760] lstrlenA (lpString="*.jpeg") returned 6 [0054.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF", pszSpec="*.psd") returned 0 [0054.760] lstrlenA (lpString="*.psd") returned 5 [0054.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF", pszSpec="*.gif") returned 1 [0054.760] lstrlenA (lpString="*.gif") returned 5 [0054.760] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF" [0054.760] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF" [0054.760] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF." [0054.760] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF.wannacry" [0054.760] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21377_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.761] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaf [0054.761] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8a07b500, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbce611c0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8a07b500, dwHighDateTime=0x1bd8f92)) returned 1 [0054.762] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.762] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x31, lpOverlapped=0x0) returned 1 [0054.762] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF") returned="BD21377_.GIF" [0054.762] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.763] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x31, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x31, lpOverlapped=0x0) returned 1 [0054.763] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.763] CloseHandle (hObject=0x90) returned 1 [0054.763] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21377_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21377_.gif.wannacry")) returned 1 [0054.763] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb28faf00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb28faf00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21398_.GIF", cAlternateFileName="")) returned 1 [0054.763] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.763] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21398_.GIF") returned 1 [0054.763] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21398_.GIF") returned 1 [0054.763] lstrcmpiA (lpString1="", lpString2="BD21398_.GIF") returned -1 [0054.764] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF") returned="BD21377_.GIF" [0054.764] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.764] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.764] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.764] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.764] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21398_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF" [0054.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF", pszSpec="*.zip") returned 0 [0054.764] lstrlenA (lpString="*.zip") returned 5 [0054.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF", pszSpec="*.rar") returned 0 [0054.764] lstrlenA (lpString="*.rar") returned 5 [0054.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF", pszSpec="*.7z") returned 0 [0054.764] lstrlenA (lpString="*.7z") returned 4 [0054.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF", pszSpec="*.tar") returned 0 [0054.764] lstrlenA (lpString="*.tar") returned 5 [0054.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF", pszSpec="*.gzip") returned 0 [0054.764] lstrlenA (lpString="*.gzip") returned 6 [0054.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF", pszSpec="*.jpg") returned 0 [0054.764] lstrlenA (lpString="*.jpg") returned 5 [0054.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF", pszSpec="*.jpeg") returned 0 [0054.764] lstrlenA (lpString="*.jpeg") returned 6 [0054.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF", pszSpec="*.psd") returned 0 [0054.764] lstrlenA (lpString="*.psd") returned 5 [0054.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF", pszSpec="*.gif") returned 1 [0054.764] lstrlenA (lpString="*.gif") returned 5 [0054.764] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF" [0054.764] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF" [0054.764] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF." [0054.764] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF.wannacry" [0054.765] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21398_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.765] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x146 [0054.765] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb28faf00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbce611c0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb28faf00, dwHighDateTime=0x1bd8f92)) returned 1 [0054.765] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.765] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xc8, lpOverlapped=0x0) returned 1 [0054.766] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF") returned="BD21398_.GIF" [0054.766] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.766] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xc8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xc8, lpOverlapped=0x0) returned 1 [0054.766] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.766] CloseHandle (hObject=0x90) returned 1 [0054.766] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21398_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21398_.gif.wannacry")) returned 1 [0054.767] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c0dc00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb3c0dc00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21399_.GIF", cAlternateFileName="")) returned 1 [0054.767] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.767] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21399_.GIF") returned 1 [0054.767] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21399_.GIF") returned 1 [0054.767] lstrcmpiA (lpString1="", lpString2="BD21399_.GIF") returned -1 [0054.767] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF") returned="BD21398_.GIF" [0054.767] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.767] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.767] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.767] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.767] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21399_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF" [0054.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF", pszSpec="*.zip") returned 0 [0054.767] lstrlenA (lpString="*.zip") returned 5 [0054.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF", pszSpec="*.rar") returned 0 [0054.767] lstrlenA (lpString="*.rar") returned 5 [0054.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF", pszSpec="*.7z") returned 0 [0054.767] lstrlenA (lpString="*.7z") returned 4 [0054.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF", pszSpec="*.tar") returned 0 [0054.767] lstrlenA (lpString="*.tar") returned 5 [0054.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF", pszSpec="*.gzip") returned 0 [0054.767] lstrlenA (lpString="*.gzip") returned 6 [0054.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF", pszSpec="*.jpg") returned 0 [0054.768] lstrlenA (lpString="*.jpg") returned 5 [0054.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF", pszSpec="*.jpeg") returned 0 [0054.768] lstrlenA (lpString="*.jpeg") returned 6 [0054.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF", pszSpec="*.psd") returned 0 [0054.768] lstrlenA (lpString="*.psd") returned 5 [0054.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF", pszSpec="*.gif") returned 1 [0054.768] lstrlenA (lpString="*.gif") returned 5 [0054.768] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF" [0054.768] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF" [0054.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF." [0054.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF.wannacry" [0054.768] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21399_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.768] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x102 [0054.768] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb3c0dc00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbce611c0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb3c0dc00, dwHighDateTime=0x1bd8f92)) returned 1 [0054.768] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.768] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x84, lpOverlapped=0x0) returned 1 [0054.769] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF") returned="BD21399_.GIF" [0054.769] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.769] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x84, lpOverlapped=0x0) returned 1 [0054.769] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.769] CloseHandle (hObject=0x90) returned 1 [0054.770] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21399_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21399_.gif.wannacry")) returned 1 [0054.770] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c0dc00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb3c0dc00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21400_.GIF", cAlternateFileName="")) returned 1 [0054.770] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.770] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21400_.GIF") returned 1 [0054.770] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21400_.GIF") returned 1 [0054.770] lstrcmpiA (lpString1="", lpString2="BD21400_.GIF") returned -1 [0054.770] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF") returned="BD21399_.GIF" [0054.770] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.770] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.770] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.770] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.770] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21400_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF" [0054.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF", pszSpec="*.zip") returned 0 [0054.771] lstrlenA (lpString="*.zip") returned 5 [0054.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF", pszSpec="*.rar") returned 0 [0054.771] lstrlenA (lpString="*.rar") returned 5 [0054.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF", pszSpec="*.7z") returned 0 [0054.771] lstrlenA (lpString="*.7z") returned 4 [0054.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF", pszSpec="*.tar") returned 0 [0054.771] lstrlenA (lpString="*.tar") returned 5 [0054.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF", pszSpec="*.gzip") returned 0 [0054.771] lstrlenA (lpString="*.gzip") returned 6 [0054.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF", pszSpec="*.jpg") returned 0 [0054.771] lstrlenA (lpString="*.jpg") returned 5 [0054.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF", pszSpec="*.jpeg") returned 0 [0054.771] lstrlenA (lpString="*.jpeg") returned 6 [0054.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF", pszSpec="*.psd") returned 0 [0054.771] lstrlenA (lpString="*.psd") returned 5 [0054.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF", pszSpec="*.gif") returned 1 [0054.771] lstrlenA (lpString="*.gif") returned 5 [0054.771] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF" [0054.771] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF" [0054.771] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF." [0054.771] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF.wannacry" [0054.771] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21400_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.772] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe9 [0054.772] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb3c0dc00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbce87320, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb3c0dc00, dwHighDateTime=0x1bd8f92)) returned 1 [0054.772] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.772] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x6b, lpOverlapped=0x0) returned 1 [0054.773] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF") returned="BD21400_.GIF" [0054.773] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.773] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x6b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x6b, lpOverlapped=0x0) returned 1 [0054.773] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.773] CloseHandle (hObject=0x90) returned 1 [0054.773] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21400_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21400_.gif.wannacry")) returned 1 [0054.774] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac6b100, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac6b100, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x11f, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21421_.GIF", cAlternateFileName="")) returned 1 [0054.774] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.774] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21421_.GIF") returned 1 [0054.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21421_.GIF") returned 1 [0054.774] lstrcmpiA (lpString1="", lpString2="BD21421_.GIF") returned -1 [0054.774] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF") returned="BD21400_.GIF" [0054.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.774] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.774] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.774] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.774] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21421_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF" [0054.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF", pszSpec="*.zip") returned 0 [0054.774] lstrlenA (lpString="*.zip") returned 5 [0054.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF", pszSpec="*.rar") returned 0 [0054.775] lstrlenA (lpString="*.rar") returned 5 [0054.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF", pszSpec="*.7z") returned 0 [0054.775] lstrlenA (lpString="*.7z") returned 4 [0054.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF", pszSpec="*.tar") returned 0 [0054.775] lstrlenA (lpString="*.tar") returned 5 [0054.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF", pszSpec="*.gzip") returned 0 [0054.775] lstrlenA (lpString="*.gzip") returned 6 [0054.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF", pszSpec="*.jpg") returned 0 [0054.775] lstrlenA (lpString="*.jpg") returned 5 [0054.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF", pszSpec="*.jpeg") returned 0 [0054.775] lstrlenA (lpString="*.jpeg") returned 6 [0054.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF", pszSpec="*.psd") returned 0 [0054.775] lstrlenA (lpString="*.psd") returned 5 [0054.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF", pszSpec="*.gif") returned 1 [0054.775] lstrlenA (lpString="*.gif") returned 5 [0054.775] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF" [0054.775] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF" [0054.775] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF." [0054.775] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF.wannacry" [0054.775] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21421_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.775] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11f [0054.775] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xac6b100, dwHighDateTime=0x1bd8f93), lpLastAccessTime=0x407536*(dwLowDateTime=0xbce87320, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xac6b100, dwHighDateTime=0x1bd8f93)) returned 1 [0054.775] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.776] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xa1, lpOverlapped=0x0) returned 1 [0054.776] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF") returned="BD21421_.GIF" [0054.776] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.776] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xa1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xa1, lpOverlapped=0x0) returned 1 [0054.777] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.777] CloseHandle (hObject=0x90) returned 1 [0054.777] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21421_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21421_.gif.wannacry")) returned 1 [0054.777] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac6b100, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac6b100, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21422_.GIF", cAlternateFileName="")) returned 1 [0054.777] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.777] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21422_.GIF") returned 1 [0054.778] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21422_.GIF") returned 1 [0054.778] lstrcmpiA (lpString1="", lpString2="BD21422_.GIF") returned -1 [0054.778] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF") returned="BD21421_.GIF" [0054.778] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.778] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.778] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.778] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.778] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21422_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF" [0054.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF", pszSpec="*.zip") returned 0 [0054.778] lstrlenA (lpString="*.zip") returned 5 [0054.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF", pszSpec="*.rar") returned 0 [0054.778] lstrlenA (lpString="*.rar") returned 5 [0054.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF", pszSpec="*.7z") returned 0 [0054.778] lstrlenA (lpString="*.7z") returned 4 [0054.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF", pszSpec="*.tar") returned 0 [0054.778] lstrlenA (lpString="*.tar") returned 5 [0054.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF", pszSpec="*.gzip") returned 0 [0054.778] lstrlenA (lpString="*.gzip") returned 6 [0054.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF", pszSpec="*.jpg") returned 0 [0054.778] lstrlenA (lpString="*.jpg") returned 5 [0054.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF", pszSpec="*.jpeg") returned 0 [0054.778] lstrlenA (lpString="*.jpeg") returned 6 [0054.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF", pszSpec="*.psd") returned 0 [0054.778] lstrlenA (lpString="*.psd") returned 5 [0054.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF", pszSpec="*.gif") returned 1 [0054.778] lstrlenA (lpString="*.gif") returned 5 [0054.778] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF" [0054.778] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF" [0054.778] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF." [0054.778] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF.wannacry" [0054.779] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21422_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.779] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x101 [0054.779] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xac6b100, dwHighDateTime=0x1bd8f93), lpLastAccessTime=0x407536*(dwLowDateTime=0xbce87320, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xac6b100, dwHighDateTime=0x1bd8f93)) returned 1 [0054.779] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.779] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x83, lpOverlapped=0x0) returned 1 [0054.780] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF") returned="BD21422_.GIF" [0054.780] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.780] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x83, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x83, lpOverlapped=0x0) returned 1 [0054.780] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.780] CloseHandle (hObject=0x90) returned 1 [0054.781] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21422_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21422_.gif.wannacry")) returned 1 [0054.781] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf7de00, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbf7de00, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21423_.GIF", cAlternateFileName="")) returned 1 [0054.781] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.781] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21423_.GIF") returned 1 [0054.781] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21423_.GIF") returned 1 [0054.781] lstrcmpiA (lpString1="", lpString2="BD21423_.GIF") returned -1 [0054.781] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF") returned="BD21422_.GIF" [0054.781] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.781] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.781] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.782] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21423_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF" [0054.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF", pszSpec="*.zip") returned 0 [0054.782] lstrlenA (lpString="*.zip") returned 5 [0054.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF", pszSpec="*.rar") returned 0 [0054.782] lstrlenA (lpString="*.rar") returned 5 [0054.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF", pszSpec="*.7z") returned 0 [0054.782] lstrlenA (lpString="*.7z") returned 4 [0054.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF", pszSpec="*.tar") returned 0 [0054.782] lstrlenA (lpString="*.tar") returned 5 [0054.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF", pszSpec="*.gzip") returned 0 [0054.782] lstrlenA (lpString="*.gzip") returned 6 [0054.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF", pszSpec="*.jpg") returned 0 [0054.782] lstrlenA (lpString="*.jpg") returned 5 [0054.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF", pszSpec="*.jpeg") returned 0 [0054.782] lstrlenA (lpString="*.jpeg") returned 6 [0054.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF", pszSpec="*.psd") returned 0 [0054.782] lstrlenA (lpString="*.psd") returned 5 [0054.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF", pszSpec="*.gif") returned 1 [0054.782] lstrlenA (lpString="*.gif") returned 5 [0054.782] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF" [0054.782] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF" [0054.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF." [0054.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF.wannacry" [0054.782] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21423_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.783] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe9 [0054.783] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbf7de00, dwHighDateTime=0x1bd8f93), lpLastAccessTime=0x407536*(dwLowDateTime=0xbce87320, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbf7de00, dwHighDateTime=0x1bd8f93)) returned 1 [0054.784] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.784] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x6b, lpOverlapped=0x0) returned 1 [0054.784] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF") returned="BD21423_.GIF" [0054.784] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.785] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x6b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x6b, lpOverlapped=0x0) returned 1 [0054.785] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.785] CloseHandle (hObject=0x90) returned 1 [0054.785] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21423_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21423_.gif.wannacry")) returned 1 [0054.785] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91c65a00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x91c65a00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21433_.GIF", cAlternateFileName="")) returned 1 [0054.785] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.785] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21433_.GIF") returned 1 [0054.785] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21433_.GIF") returned 1 [0054.785] lstrcmpiA (lpString1="", lpString2="BD21433_.GIF") returned -1 [0054.786] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF") returned="BD21423_.GIF" [0054.786] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.786] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.786] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21433_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF" [0054.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF", pszSpec="*.zip") returned 0 [0054.786] lstrlenA (lpString="*.zip") returned 5 [0054.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF", pszSpec="*.rar") returned 0 [0054.786] lstrlenA (lpString="*.rar") returned 5 [0054.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF", pszSpec="*.7z") returned 0 [0054.786] lstrlenA (lpString="*.7z") returned 4 [0054.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF", pszSpec="*.tar") returned 0 [0054.786] lstrlenA (lpString="*.tar") returned 5 [0054.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF", pszSpec="*.gzip") returned 0 [0054.786] lstrlenA (lpString="*.gzip") returned 6 [0054.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF", pszSpec="*.jpg") returned 0 [0054.786] lstrlenA (lpString="*.jpg") returned 5 [0054.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF", pszSpec="*.jpeg") returned 0 [0054.786] lstrlenA (lpString="*.jpeg") returned 6 [0054.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF", pszSpec="*.psd") returned 0 [0054.786] lstrlenA (lpString="*.psd") returned 5 [0054.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF", pszSpec="*.gif") returned 1 [0054.786] lstrlenA (lpString="*.gif") returned 5 [0054.786] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF" [0054.786] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF" [0054.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF." [0054.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF.wannacry" [0054.786] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21433_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.787] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9 [0054.787] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x91c65a00, dwHighDateTime=0x1bd8f90), lpLastAccessTime=0x407536*(dwLowDateTime=0xbce87320, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x91c65a00, dwHighDateTime=0x1bd8f90)) returned 1 [0054.787] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.787] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3b, lpOverlapped=0x0) returned 1 [0054.788] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF") returned="BD21433_.GIF" [0054.788] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.788] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3b, lpOverlapped=0x0) returned 1 [0054.788] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.788] CloseHandle (hObject=0x90) returned 1 [0054.788] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21433_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21433_.gif.wannacry")) returned 1 [0054.789] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91c65a00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbcead480, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x91c65a00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21434_.GIF", cAlternateFileName="")) returned 1 [0054.789] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.789] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21434_.GIF") returned 1 [0054.789] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21434_.GIF") returned 1 [0054.789] lstrcmpiA (lpString1="", lpString2="BD21434_.GIF") returned -1 [0054.789] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF") returned="BD21433_.GIF" [0054.789] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.789] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.789] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.789] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.789] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21434_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF" [0054.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF", pszSpec="*.zip") returned 0 [0054.789] lstrlenA (lpString="*.zip") returned 5 [0054.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF", pszSpec="*.rar") returned 0 [0054.789] lstrlenA (lpString="*.rar") returned 5 [0054.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF", pszSpec="*.7z") returned 0 [0054.789] lstrlenA (lpString="*.7z") returned 4 [0054.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF", pszSpec="*.tar") returned 0 [0054.789] lstrlenA (lpString="*.tar") returned 5 [0054.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF", pszSpec="*.gzip") returned 0 [0054.790] lstrlenA (lpString="*.gzip") returned 6 [0054.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF", pszSpec="*.jpg") returned 0 [0054.790] lstrlenA (lpString="*.jpg") returned 5 [0054.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF", pszSpec="*.jpeg") returned 0 [0054.790] lstrlenA (lpString="*.jpeg") returned 6 [0054.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF", pszSpec="*.psd") returned 0 [0054.790] lstrlenA (lpString="*.psd") returned 5 [0054.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF", pszSpec="*.gif") returned 1 [0054.790] lstrlenA (lpString="*.gif") returned 5 [0054.790] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF" [0054.790] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF" [0054.790] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF." [0054.790] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF.wannacry" [0054.790] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21434_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.790] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb1 [0054.790] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x91c65a00, dwHighDateTime=0x1bd8f90), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcead480, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x91c65a00, dwHighDateTime=0x1bd8f90)) returned 1 [0054.790] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.790] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x33, lpOverlapped=0x0) returned 1 [0054.791] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF") returned="BD21434_.GIF" [0054.791] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.791] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x33, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x33, lpOverlapped=0x0) returned 1 [0054.791] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.791] CloseHandle (hObject=0x90) returned 1 [0054.792] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21434_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21434_.gif.wannacry")) returned 1 [0054.792] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f78700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbcead480, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x92f78700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21435_.GIF", cAlternateFileName="")) returned 1 [0054.792] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.792] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21435_.GIF") returned 1 [0054.792] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21435_.GIF") returned 1 [0054.792] lstrcmpiA (lpString1="", lpString2="BD21435_.GIF") returned -1 [0054.792] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF") returned="BD21434_.GIF" [0054.792] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.792] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.792] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.792] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.792] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21435_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF" [0054.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF", pszSpec="*.zip") returned 0 [0054.792] lstrlenA (lpString="*.zip") returned 5 [0054.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF", pszSpec="*.rar") returned 0 [0054.793] lstrlenA (lpString="*.rar") returned 5 [0054.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF", pszSpec="*.7z") returned 0 [0054.793] lstrlenA (lpString="*.7z") returned 4 [0054.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF", pszSpec="*.tar") returned 0 [0054.793] lstrlenA (lpString="*.tar") returned 5 [0054.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF", pszSpec="*.gzip") returned 0 [0054.793] lstrlenA (lpString="*.gzip") returned 6 [0054.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF", pszSpec="*.jpg") returned 0 [0054.793] lstrlenA (lpString="*.jpg") returned 5 [0054.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF", pszSpec="*.jpeg") returned 0 [0054.793] lstrlenA (lpString="*.jpeg") returned 6 [0054.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF", pszSpec="*.psd") returned 0 [0054.793] lstrlenA (lpString="*.psd") returned 5 [0054.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF", pszSpec="*.gif") returned 1 [0054.793] lstrlenA (lpString="*.gif") returned 5 [0054.793] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF" [0054.793] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF" [0054.793] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF." [0054.793] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF.wannacry" [0054.793] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21435_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.794] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xad [0054.794] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x92f78700, dwHighDateTime=0x1bd8f90), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcead480, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x92f78700, dwHighDateTime=0x1bd8f90)) returned 1 [0054.794] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.794] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2f, lpOverlapped=0x0) returned 1 [0054.795] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF") returned="BD21435_.GIF" [0054.795] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.795] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2f, lpOverlapped=0x0) returned 1 [0054.795] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.795] CloseHandle (hObject=0x90) returned 1 [0054.795] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21435_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21435_.gif.wannacry")) returned 1 [0054.796] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5593f900, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcead480, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5593f900, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21480_.GIF", cAlternateFileName="")) returned 1 [0054.796] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.796] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21480_.GIF") returned 1 [0054.796] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21480_.GIF") returned 1 [0054.796] lstrcmpiA (lpString1="", lpString2="BD21480_.GIF") returned -1 [0054.796] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF") returned="BD21435_.GIF" [0054.796] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.796] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.796] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.796] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.796] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21480_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF" [0054.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF", pszSpec="*.zip") returned 0 [0054.796] lstrlenA (lpString="*.zip") returned 5 [0054.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF", pszSpec="*.rar") returned 0 [0054.796] lstrlenA (lpString="*.rar") returned 5 [0054.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF", pszSpec="*.7z") returned 0 [0054.796] lstrlenA (lpString="*.7z") returned 4 [0054.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF", pszSpec="*.tar") returned 0 [0054.796] lstrlenA (lpString="*.tar") returned 5 [0054.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF", pszSpec="*.gzip") returned 0 [0054.796] lstrlenA (lpString="*.gzip") returned 6 [0054.797] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF", pszSpec="*.jpg") returned 0 [0054.797] lstrlenA (lpString="*.jpg") returned 5 [0054.797] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF", pszSpec="*.jpeg") returned 0 [0054.797] lstrlenA (lpString="*.jpeg") returned 6 [0054.797] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF", pszSpec="*.psd") returned 0 [0054.797] lstrlenA (lpString="*.psd") returned 5 [0054.797] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF", pszSpec="*.gif") returned 1 [0054.797] lstrlenA (lpString="*.gif") returned 5 [0054.797] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF" [0054.797] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF" [0054.797] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF." [0054.797] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF.wannacry" [0054.797] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21480_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.797] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14e [0054.797] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5593f900, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcead480, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5593f900, dwHighDateTime=0x1bd8f92)) returned 1 [0054.797] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.797] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd0, lpOverlapped=0x0) returned 1 [0054.798] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF") returned="BD21480_.GIF" [0054.798] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.798] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd0, lpOverlapped=0x0) returned 1 [0054.799] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.799] CloseHandle (hObject=0x90) returned 1 [0054.799] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21480_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21480_.gif.wannacry")) returned 1 [0054.799] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56c52600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcead480, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x56c52600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21481_.GIF", cAlternateFileName="")) returned 1 [0054.799] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.799] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21481_.GIF") returned 1 [0054.799] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21481_.GIF") returned 1 [0054.799] lstrcmpiA (lpString1="", lpString2="BD21481_.GIF") returned -1 [0054.799] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF") returned="BD21480_.GIF" [0054.799] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.799] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.799] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.800] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.800] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21481_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF" [0054.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF", pszSpec="*.zip") returned 0 [0054.800] lstrlenA (lpString="*.zip") returned 5 [0054.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF", pszSpec="*.rar") returned 0 [0054.800] lstrlenA (lpString="*.rar") returned 5 [0054.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF", pszSpec="*.7z") returned 0 [0054.800] lstrlenA (lpString="*.7z") returned 4 [0054.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF", pszSpec="*.tar") returned 0 [0054.800] lstrlenA (lpString="*.tar") returned 5 [0054.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF", pszSpec="*.gzip") returned 0 [0054.800] lstrlenA (lpString="*.gzip") returned 6 [0054.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF", pszSpec="*.jpg") returned 0 [0054.800] lstrlenA (lpString="*.jpg") returned 5 [0054.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF", pszSpec="*.jpeg") returned 0 [0054.800] lstrlenA (lpString="*.jpeg") returned 6 [0054.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF", pszSpec="*.psd") returned 0 [0054.800] lstrlenA (lpString="*.psd") returned 5 [0054.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF", pszSpec="*.gif") returned 1 [0054.800] lstrlenA (lpString="*.gif") returned 5 [0054.800] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF" [0054.800] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF" [0054.800] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF." [0054.800] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF.wannacry" [0054.800] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21481_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.801] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeb [0054.801] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x56c52600, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcead480, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x56c52600, dwHighDateTime=0x1bd8f92)) returned 1 [0054.801] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.801] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x6d, lpOverlapped=0x0) returned 1 [0054.802] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF") returned="BD21481_.GIF" [0054.802] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.802] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x6d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x6d, lpOverlapped=0x0) returned 1 [0054.802] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.802] CloseHandle (hObject=0x90) returned 1 [0054.802] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21481_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21481_.gif.wannacry")) returned 1 [0054.803] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56c52600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcead480, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x56c52600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21482_.GIF", cAlternateFileName="")) returned 1 [0054.803] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.803] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21482_.GIF") returned 1 [0054.803] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21482_.GIF") returned 1 [0054.803] lstrcmpiA (lpString1="", lpString2="BD21482_.GIF") returned -1 [0054.803] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF") returned="BD21481_.GIF" [0054.803] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.803] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.803] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.803] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.803] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21482_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF" [0054.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF", pszSpec="*.zip") returned 0 [0054.803] lstrlenA (lpString="*.zip") returned 5 [0054.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF", pszSpec="*.rar") returned 0 [0054.803] lstrlenA (lpString="*.rar") returned 5 [0054.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF", pszSpec="*.7z") returned 0 [0054.803] lstrlenA (lpString="*.7z") returned 4 [0054.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF", pszSpec="*.tar") returned 0 [0054.803] lstrlenA (lpString="*.tar") returned 5 [0054.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF", pszSpec="*.gzip") returned 0 [0054.803] lstrlenA (lpString="*.gzip") returned 6 [0054.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF", pszSpec="*.jpg") returned 0 [0054.803] lstrlenA (lpString="*.jpg") returned 5 [0054.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF", pszSpec="*.jpeg") returned 0 [0054.803] lstrlenA (lpString="*.jpeg") returned 6 [0054.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF", pszSpec="*.psd") returned 0 [0054.803] lstrlenA (lpString="*.psd") returned 5 [0054.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF", pszSpec="*.gif") returned 1 [0054.803] lstrlenA (lpString="*.gif") returned 5 [0054.803] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21482_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.804] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf7 [0054.804] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x56c52600, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcead480, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x56c52600, dwHighDateTime=0x1bd8f92)) returned 1 [0054.804] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.805] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x79, lpOverlapped=0x0) returned 1 [0054.805] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF") returned="BD21482_.GIF" [0054.805] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.805] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x79, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x79, lpOverlapped=0x0) returned 1 [0054.806] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.806] CloseHandle (hObject=0x90) returned 1 [0054.806] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21482_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21482_.gif.wannacry")) returned 1 [0054.806] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ffd9600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbced35e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8ffd9600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21503_.GIF", cAlternateFileName="")) returned 1 [0054.806] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.806] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21503_.GIF") returned 1 [0054.806] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21503_.GIF") returned 1 [0054.806] lstrcmpiA (lpString1="", lpString2="BD21503_.GIF") returned -1 [0054.806] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF") returned="BD21482_.GIF" [0054.806] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.806] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.807] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.807] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21503_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF" [0054.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF", pszSpec="*.zip") returned 0 [0054.807] lstrlenA (lpString="*.zip") returned 5 [0054.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF", pszSpec="*.rar") returned 0 [0054.807] lstrlenA (lpString="*.rar") returned 5 [0054.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF", pszSpec="*.7z") returned 0 [0054.807] lstrlenA (lpString="*.7z") returned 4 [0054.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF", pszSpec="*.tar") returned 0 [0054.807] lstrlenA (lpString="*.tar") returned 5 [0054.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF", pszSpec="*.gzip") returned 0 [0054.807] lstrlenA (lpString="*.gzip") returned 6 [0054.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF", pszSpec="*.jpg") returned 0 [0054.807] lstrlenA (lpString="*.jpg") returned 5 [0054.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF", pszSpec="*.jpeg") returned 0 [0054.807] lstrlenA (lpString="*.jpeg") returned 6 [0054.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF", pszSpec="*.psd") returned 0 [0054.807] lstrlenA (lpString="*.psd") returned 5 [0054.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF", pszSpec="*.gif") returned 1 [0054.807] lstrlenA (lpString="*.gif") returned 5 [0054.807] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF" [0054.807] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF" [0054.807] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF." [0054.807] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF.wannacry" [0054.807] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21503_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.808] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfe [0054.808] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8ffd9600, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbced35e0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8ffd9600, dwHighDateTime=0x1bd8f92)) returned 1 [0054.808] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.808] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x80, lpOverlapped=0x0) returned 1 [0054.809] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF") returned="BD21503_.GIF" [0054.809] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.809] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x80, lpOverlapped=0x0) returned 1 [0054.809] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.809] CloseHandle (hObject=0x90) returned 1 [0054.809] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21503_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21503_.gif.wannacry")) returned 1 [0054.809] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ec300, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbced35e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x912ec300, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21504_.GIF", cAlternateFileName="")) returned 1 [0054.809] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.809] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21504_.GIF") returned 1 [0054.809] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21504_.GIF") returned 1 [0054.809] lstrcmpiA (lpString1="", lpString2="BD21504_.GIF") returned -1 [0054.810] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF") returned="BD21503_.GIF" [0054.810] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.810] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.810] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.810] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.810] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21504_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF" [0054.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF", pszSpec="*.zip") returned 0 [0054.810] lstrlenA (lpString="*.zip") returned 5 [0054.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF", pszSpec="*.rar") returned 0 [0054.810] lstrlenA (lpString="*.rar") returned 5 [0054.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF", pszSpec="*.7z") returned 0 [0054.810] lstrlenA (lpString="*.7z") returned 4 [0054.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF", pszSpec="*.tar") returned 0 [0054.810] lstrlenA (lpString="*.tar") returned 5 [0054.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF", pszSpec="*.gzip") returned 0 [0054.810] lstrlenA (lpString="*.gzip") returned 6 [0054.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF", pszSpec="*.jpg") returned 0 [0054.810] lstrlenA (lpString="*.jpg") returned 5 [0054.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF", pszSpec="*.jpeg") returned 0 [0054.810] lstrlenA (lpString="*.jpeg") returned 6 [0054.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF", pszSpec="*.psd") returned 0 [0054.810] lstrlenA (lpString="*.psd") returned 5 [0054.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF", pszSpec="*.gif") returned 1 [0054.810] lstrlenA (lpString="*.gif") returned 5 [0054.810] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF" [0054.810] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF" [0054.810] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF." [0054.810] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF.wannacry" [0054.810] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21504_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.811] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb6 [0054.811] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x912ec300, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbced35e0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x912ec300, dwHighDateTime=0x1bd8f92)) returned 1 [0054.811] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.811] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x38, lpOverlapped=0x0) returned 1 [0054.812] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF") returned="BD21504_.GIF" [0054.812] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.812] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x38, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x38, lpOverlapped=0x0) returned 1 [0054.812] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.812] CloseHandle (hObject=0x90) returned 1 [0054.812] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21504_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21504_.gif.wannacry")) returned 1 [0054.813] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ec300, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcef9740, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x912ec300, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21505_.GIF", cAlternateFileName="")) returned 1 [0054.813] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.813] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21505_.GIF") returned 1 [0054.813] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21505_.GIF") returned 1 [0054.813] lstrcmpiA (lpString1="", lpString2="BD21505_.GIF") returned -1 [0054.813] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF") returned="BD21504_.GIF" [0054.813] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.813] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.813] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.813] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.813] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21505_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF" [0054.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF", pszSpec="*.zip") returned 0 [0054.813] lstrlenA (lpString="*.zip") returned 5 [0054.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF", pszSpec="*.rar") returned 0 [0054.813] lstrlenA (lpString="*.rar") returned 5 [0054.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF", pszSpec="*.7z") returned 0 [0054.813] lstrlenA (lpString="*.7z") returned 4 [0054.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF", pszSpec="*.tar") returned 0 [0054.813] lstrlenA (lpString="*.tar") returned 5 [0054.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF", pszSpec="*.gzip") returned 0 [0054.813] lstrlenA (lpString="*.gzip") returned 6 [0054.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF", pszSpec="*.jpg") returned 0 [0054.813] lstrlenA (lpString="*.jpg") returned 5 [0054.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF", pszSpec="*.jpeg") returned 0 [0054.813] lstrlenA (lpString="*.jpeg") returned 6 [0054.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF", pszSpec="*.psd") returned 0 [0054.813] lstrlenA (lpString="*.psd") returned 5 [0054.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF", pszSpec="*.gif") returned 1 [0054.814] lstrlenA (lpString="*.gif") returned 5 [0054.814] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF" [0054.814] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF" [0054.814] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF." [0054.814] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF.wannacry" [0054.814] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21505_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.815] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaf [0054.815] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x912ec300, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcef9740, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x912ec300, dwHighDateTime=0x1bd8f92)) returned 1 [0054.815] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.815] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x31, lpOverlapped=0x0) returned 1 [0054.816] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF") returned="BD21505_.GIF" [0054.816] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.816] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x31, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x31, lpOverlapped=0x0) returned 1 [0054.816] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.816] CloseHandle (hObject=0x90) returned 1 [0054.816] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21505_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21505_.gif.wannacry")) returned 1 [0054.817] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b6bd00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcef9740, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb9b6bd00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21518_.GIF", cAlternateFileName="")) returned 1 [0054.817] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.817] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21518_.GIF") returned 1 [0054.817] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21518_.GIF") returned 1 [0054.817] lstrcmpiA (lpString1="", lpString2="BD21518_.GIF") returned -1 [0054.817] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF") returned="BD21505_.GIF" [0054.817] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.817] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.817] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.817] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.817] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21518_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF" [0054.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF", pszSpec="*.zip") returned 0 [0054.817] lstrlenA (lpString="*.zip") returned 5 [0054.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF", pszSpec="*.rar") returned 0 [0054.817] lstrlenA (lpString="*.rar") returned 5 [0054.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF", pszSpec="*.7z") returned 0 [0054.817] lstrlenA (lpString="*.7z") returned 4 [0054.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF", pszSpec="*.tar") returned 0 [0054.817] lstrlenA (lpString="*.tar") returned 5 [0054.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF", pszSpec="*.gzip") returned 0 [0054.817] lstrlenA (lpString="*.gzip") returned 6 [0054.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF", pszSpec="*.jpg") returned 0 [0054.817] lstrlenA (lpString="*.jpg") returned 5 [0054.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF", pszSpec="*.jpeg") returned 0 [0054.817] lstrlenA (lpString="*.jpeg") returned 6 [0054.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF", pszSpec="*.psd") returned 0 [0054.818] lstrlenA (lpString="*.psd") returned 5 [0054.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF", pszSpec="*.gif") returned 1 [0054.818] lstrlenA (lpString="*.gif") returned 5 [0054.818] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF" [0054.818] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF" [0054.818] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF." [0054.818] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF.wannacry" [0054.818] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21518_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.818] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xff [0054.818] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb9b6bd00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcef9740, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb9b6bd00, dwHighDateTime=0x1bd8f92)) returned 1 [0054.818] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.818] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x81, lpOverlapped=0x0) returned 1 [0054.819] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF") returned="BD21518_.GIF" [0054.819] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.819] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x81, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x81, lpOverlapped=0x0) returned 1 [0054.819] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.819] CloseHandle (hObject=0x90) returned 1 [0054.819] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21518_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21518_.gif.wannacry")) returned 1 [0054.820] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbae7ea00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcef9740, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbae7ea00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21519_.GIF", cAlternateFileName="")) returned 1 [0054.820] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.820] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21519_.GIF") returned 1 [0054.820] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21519_.GIF") returned 1 [0054.820] lstrcmpiA (lpString1="", lpString2="BD21519_.GIF") returned -1 [0054.820] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF") returned="BD21518_.GIF" [0054.820] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.820] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.820] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.820] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.820] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21519_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF" [0054.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF", pszSpec="*.zip") returned 0 [0054.820] lstrlenA (lpString="*.zip") returned 5 [0054.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF", pszSpec="*.rar") returned 0 [0054.820] lstrlenA (lpString="*.rar") returned 5 [0054.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF", pszSpec="*.7z") returned 0 [0054.820] lstrlenA (lpString="*.7z") returned 4 [0054.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF", pszSpec="*.tar") returned 0 [0054.820] lstrlenA (lpString="*.tar") returned 5 [0054.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF", pszSpec="*.gzip") returned 0 [0054.821] lstrlenA (lpString="*.gzip") returned 6 [0054.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF", pszSpec="*.jpg") returned 0 [0054.821] lstrlenA (lpString="*.jpg") returned 5 [0054.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF", pszSpec="*.jpeg") returned 0 [0054.821] lstrlenA (lpString="*.jpeg") returned 6 [0054.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF", pszSpec="*.psd") returned 0 [0054.821] lstrlenA (lpString="*.psd") returned 5 [0054.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF", pszSpec="*.gif") returned 1 [0054.821] lstrlenA (lpString="*.gif") returned 5 [0054.821] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF" [0054.821] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF" [0054.821] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF." [0054.821] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF.wannacry" [0054.821] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21519_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.821] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb0 [0054.821] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbae7ea00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcef9740, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbae7ea00, dwHighDateTime=0x1bd8f92)) returned 1 [0054.821] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.821] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x32, lpOverlapped=0x0) returned 1 [0054.822] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF") returned="BD21519_.GIF" [0054.822] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.822] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x32, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x32, lpOverlapped=0x0) returned 1 [0054.822] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.822] CloseHandle (hObject=0x90) returned 1 [0054.823] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21519_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21519_.gif.wannacry")) returned 1 [0054.823] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbae7ea00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcef9740, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbae7ea00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21520_.GIF", cAlternateFileName="")) returned 1 [0054.823] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.823] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21520_.GIF") returned 1 [0054.823] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21520_.GIF") returned 1 [0054.823] lstrcmpiA (lpString1="", lpString2="BD21520_.GIF") returned -1 [0054.823] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF") returned="BD21519_.GIF" [0054.823] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.823] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.823] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.823] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.823] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21520_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF" [0054.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF", pszSpec="*.zip") returned 0 [0054.823] lstrlenA (lpString="*.zip") returned 5 [0054.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF", pszSpec="*.rar") returned 0 [0054.823] lstrlenA (lpString="*.rar") returned 5 [0054.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF", pszSpec="*.7z") returned 0 [0054.824] lstrlenA (lpString="*.7z") returned 4 [0054.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF", pszSpec="*.tar") returned 0 [0054.824] lstrlenA (lpString="*.tar") returned 5 [0054.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF", pszSpec="*.gzip") returned 0 [0054.824] lstrlenA (lpString="*.gzip") returned 6 [0054.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF", pszSpec="*.jpg") returned 0 [0054.824] lstrlenA (lpString="*.jpg") returned 5 [0054.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF", pszSpec="*.jpeg") returned 0 [0054.824] lstrlenA (lpString="*.jpeg") returned 6 [0054.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF", pszSpec="*.psd") returned 0 [0054.824] lstrlenA (lpString="*.psd") returned 5 [0054.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF", pszSpec="*.gif") returned 1 [0054.824] lstrlenA (lpString="*.gif") returned 5 [0054.824] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF" [0054.824] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF" [0054.824] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF." [0054.824] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF.wannacry" [0054.824] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21520_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.825] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb0 [0054.825] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbae7ea00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcef9740, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbae7ea00, dwHighDateTime=0x1bd8f92)) returned 1 [0054.825] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.825] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x32, lpOverlapped=0x0) returned 1 [0054.826] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF") returned="BD21520_.GIF" [0054.826] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.826] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x32, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x32, lpOverlapped=0x0) returned 1 [0054.827] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.827] CloseHandle (hObject=0x90) returned 1 [0054.827] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21520_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21520_.gif.wannacry")) returned 1 [0054.829] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8b6500, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbcf1f8a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf8b6500, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21533_.GIF", cAlternateFileName="")) returned 1 [0054.829] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.829] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21533_.GIF") returned 1 [0054.829] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21533_.GIF") returned 1 [0054.829] lstrcmpiA (lpString1="", lpString2="BD21533_.GIF") returned -1 [0054.829] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF") returned="BD21520_.GIF" [0054.829] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.829] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.829] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.829] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.829] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21533_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF" [0054.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF", pszSpec="*.zip") returned 0 [0054.830] lstrlenA (lpString="*.zip") returned 5 [0054.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF", pszSpec="*.rar") returned 0 [0054.830] lstrlenA (lpString="*.rar") returned 5 [0054.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF", pszSpec="*.7z") returned 0 [0054.830] lstrlenA (lpString="*.7z") returned 4 [0054.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF", pszSpec="*.tar") returned 0 [0054.830] lstrlenA (lpString="*.tar") returned 5 [0054.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF", pszSpec="*.gzip") returned 0 [0054.830] lstrlenA (lpString="*.gzip") returned 6 [0054.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF", pszSpec="*.jpg") returned 0 [0054.830] lstrlenA (lpString="*.jpg") returned 5 [0054.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF", pszSpec="*.jpeg") returned 0 [0054.830] lstrlenA (lpString="*.jpeg") returned 6 [0054.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF", pszSpec="*.psd") returned 0 [0054.830] lstrlenA (lpString="*.psd") returned 5 [0054.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF", pszSpec="*.gif") returned 1 [0054.830] lstrlenA (lpString="*.gif") returned 5 [0054.830] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF" [0054.830] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF" [0054.830] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF." [0054.830] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF.wannacry" [0054.830] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21533_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.831] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x148 [0054.831] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf8b6500, dwHighDateTime=0x1bd8f93), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcf1f8a0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf8b6500, dwHighDateTime=0x1bd8f93)) returned 1 [0054.831] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.831] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xca, lpOverlapped=0x0) returned 1 [0054.832] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF") returned="BD21533_.GIF" [0054.832] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.832] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xca, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xca, lpOverlapped=0x0) returned 1 [0054.832] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.832] CloseHandle (hObject=0x90) returned 1 [0054.832] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21533_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21533_.gif.wannacry")) returned 1 [0054.832] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8b6500, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbcf1f8a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf8b6500, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21534_.GIF", cAlternateFileName="")) returned 1 [0054.832] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.832] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21534_.GIF") returned 1 [0054.832] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21534_.GIF") returned 1 [0054.833] lstrcmpiA (lpString1="", lpString2="BD21534_.GIF") returned -1 [0054.833] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF") returned="BD21533_.GIF" [0054.833] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.833] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.833] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.833] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.833] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21534_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF" [0054.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF", pszSpec="*.zip") returned 0 [0054.833] lstrlenA (lpString="*.zip") returned 5 [0054.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF", pszSpec="*.rar") returned 0 [0054.833] lstrlenA (lpString="*.rar") returned 5 [0054.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF", pszSpec="*.7z") returned 0 [0054.833] lstrlenA (lpString="*.7z") returned 4 [0054.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF", pszSpec="*.tar") returned 0 [0054.833] lstrlenA (lpString="*.tar") returned 5 [0054.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF", pszSpec="*.gzip") returned 0 [0054.833] lstrlenA (lpString="*.gzip") returned 6 [0054.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF", pszSpec="*.jpg") returned 0 [0054.833] lstrlenA (lpString="*.jpg") returned 5 [0054.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF", pszSpec="*.jpeg") returned 0 [0054.833] lstrlenA (lpString="*.jpeg") returned 6 [0054.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF", pszSpec="*.psd") returned 0 [0054.833] lstrlenA (lpString="*.psd") returned 5 [0054.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF", pszSpec="*.gif") returned 1 [0054.833] lstrlenA (lpString="*.gif") returned 5 [0054.833] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF" [0054.833] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF" [0054.833] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF." [0054.833] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF.wannacry" [0054.834] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21534_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.834] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf0 [0054.834] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf8b6500, dwHighDateTime=0x1bd8f93), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcf1f8a0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf8b6500, dwHighDateTime=0x1bd8f93)) returned 1 [0054.834] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.834] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x72, lpOverlapped=0x0) returned 1 [0054.835] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF") returned="BD21534_.GIF" [0054.835] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.835] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x72, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x72, lpOverlapped=0x0) returned 1 [0054.835] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.835] CloseHandle (hObject=0x90) returned 1 [0054.835] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21534_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21534_.gif.wannacry")) returned 1 [0054.836] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8b6500, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbcf1f8a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf8b6500, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x12b, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21535_.GIF", cAlternateFileName="")) returned 1 [0054.836] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.836] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21535_.GIF") returned 1 [0054.836] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21535_.GIF") returned 1 [0054.836] lstrcmpiA (lpString1="", lpString2="BD21535_.GIF") returned -1 [0054.836] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF") returned="BD21534_.GIF" [0054.836] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.836] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.836] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.836] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.836] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BD21535_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF" [0054.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF", pszSpec="*.zip") returned 0 [0054.836] lstrlenA (lpString="*.zip") returned 5 [0054.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF", pszSpec="*.rar") returned 0 [0054.836] lstrlenA (lpString="*.rar") returned 5 [0054.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF", pszSpec="*.7z") returned 0 [0054.836] lstrlenA (lpString="*.7z") returned 4 [0054.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF", pszSpec="*.tar") returned 0 [0054.836] lstrlenA (lpString="*.tar") returned 5 [0054.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF", pszSpec="*.gzip") returned 0 [0054.836] lstrlenA (lpString="*.gzip") returned 6 [0054.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF", pszSpec="*.jpg") returned 0 [0054.836] lstrlenA (lpString="*.jpg") returned 5 [0054.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF", pszSpec="*.jpeg") returned 0 [0054.836] lstrlenA (lpString="*.jpeg") returned 6 [0054.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF", pszSpec="*.psd") returned 0 [0054.836] lstrlenA (lpString="*.psd") returned 5 [0054.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF", pszSpec="*.gif") returned 1 [0054.837] lstrlenA (lpString="*.gif") returned 5 [0054.837] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF" [0054.837] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF" [0054.837] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF." [0054.837] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF.wannacry" [0054.837] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21535_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.837] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12b [0054.837] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf8b6500, dwHighDateTime=0x1bd8f93), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcf1f8a0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf8b6500, dwHighDateTime=0x1bd8f93)) returned 1 [0054.837] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.837] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xad, lpOverlapped=0x0) returned 1 [0054.838] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF") returned="BD21535_.GIF" [0054.838] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.838] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xad, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xad, lpOverlapped=0x0) returned 1 [0054.838] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.838] CloseHandle (hObject=0x90) returned 1 [0054.838] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21535_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21535_.gif.wannacry")) returned 1 [0054.839] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51b201b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3ba0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BULLETS.DLL", cAlternateFileName="")) returned 1 [0054.839] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.839] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BULLETS.DLL") returned 1 [0054.839] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BULLETS.DLL") returned 1 [0054.839] lstrcmpiA (lpString1="", lpString2="BULLETS.DLL") returned -1 [0054.839] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF") returned="BD21535_.GIF" [0054.839] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.839] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.839] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.839] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.839] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="BULLETS.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" [0054.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.zip") returned 0 [0054.839] lstrlenA (lpString="*.zip") returned 5 [0054.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.rar") returned 0 [0054.840] lstrlenA (lpString="*.rar") returned 5 [0054.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.7z") returned 0 [0054.840] lstrlenA (lpString="*.7z") returned 4 [0054.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.tar") returned 0 [0054.840] lstrlenA (lpString="*.tar") returned 5 [0054.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.gzip") returned 0 [0054.840] lstrlenA (lpString="*.gzip") returned 6 [0054.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.jpg") returned 0 [0054.840] lstrlenA (lpString="*.jpg") returned 5 [0054.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.jpeg") returned 0 [0054.840] lstrlenA (lpString="*.jpeg") returned 6 [0054.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.psd") returned 0 [0054.840] lstrlenA (lpString="*.psd") returned 5 [0054.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.gif") returned 0 [0054.840] lstrlenA (lpString="*.gif") returned 5 [0054.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.doc") returned 0 [0054.840] lstrlenA (lpString="*.doc") returned 5 [0054.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.docx") returned 0 [0054.840] lstrlenA (lpString="*.docx") returned 6 [0054.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.xls") returned 0 [0054.840] lstrlenA (lpString="*.xls") returned 5 [0054.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.xlsx") returned 0 [0054.840] lstrlenA (lpString="*.xlsx") returned 6 [0054.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.ppt") returned 0 [0054.840] lstrlenA (lpString="*.ppt") returned 5 [0054.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.pptx") returned 0 [0054.840] lstrlenA (lpString="*.pptx") returned 6 [0054.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.pdf") returned 0 [0054.840] lstrlenA (lpString="*.pdf") returned 5 [0054.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.mov") returned 0 [0054.840] lstrlenA (lpString="*.mov") returned 5 [0054.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.m2v") returned 0 [0054.840] lstrlenA (lpString="*.m2v") returned 5 [0054.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.3gp") returned 0 [0054.841] lstrlenA (lpString="*.3gp") returned 5 [0054.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.mpeg") returned 0 [0054.841] lstrlenA (lpString="*.mpeg") returned 6 [0054.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.mpg") returned 0 [0054.841] lstrlenA (lpString="*.mpg") returned 5 [0054.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.flv") returned 0 [0054.841] lstrlenA (lpString="*.flv") returned 5 [0054.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.avi") returned 0 [0054.841] lstrlenA (lpString="*.avi") returned 5 [0054.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.mp4") returned 0 [0054.841] lstrlenA (lpString="*.mp4") returned 5 [0054.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.wmv") returned 0 [0054.841] lstrlenA (lpString="*.wmv") returned 5 [0054.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.divx") returned 0 [0054.841] lstrlenA (lpString="*.divx") returned 6 [0054.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.mkv") returned 0 [0054.841] lstrlenA (lpString="*.mkv") returned 5 [0054.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.mp3") returned 0 [0054.841] lstrlenA (lpString="*.mp3") returned 5 [0054.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.wav") returned 0 [0054.841] lstrlenA (lpString="*.wav") returned 5 [0054.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.flac") returned 0 [0054.841] lstrlenA (lpString="*.flac") returned 6 [0054.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.ape") returned 0 [0054.841] lstrlenA (lpString="*.ape") returned 5 [0054.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.wma") returned 0 [0054.841] lstrlenA (lpString="*.wma") returned 5 [0054.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.ac3") returned 0 [0054.841] lstrlenA (lpString="*.ac3") returned 5 [0054.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", pszSpec="*.mxf") returned 0 [0054.841] lstrlenA (lpString="*.mxf") returned 5 [0054.841] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x360, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0054.841] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.842] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0054.842] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0054.842] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2f35a00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc2f35a00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x18f66c, dwReserved1=0x4f0048, cFileName="J0115834.GIF", cAlternateFileName="")) returned 1 [0054.842] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.842] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0115834.GIF") returned -1 [0054.842] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0115834.GIF") returned -1 [0054.842] lstrcmpiA (lpString1="", lpString2="J0115834.GIF") returned -1 [0054.842] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned="BULLETS.DLL" [0054.842] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.842] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.842] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.842] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.842] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="J0115834.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF" [0054.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF", pszSpec="*.zip") returned 0 [0054.842] lstrlenA (lpString="*.zip") returned 5 [0054.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF", pszSpec="*.rar") returned 0 [0054.842] lstrlenA (lpString="*.rar") returned 5 [0054.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF", pszSpec="*.7z") returned 0 [0054.842] lstrlenA (lpString="*.7z") returned 4 [0054.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF", pszSpec="*.tar") returned 0 [0054.842] lstrlenA (lpString="*.tar") returned 5 [0054.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF", pszSpec="*.gzip") returned 0 [0054.842] lstrlenA (lpString="*.gzip") returned 6 [0054.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF", pszSpec="*.jpg") returned 0 [0054.842] lstrlenA (lpString="*.jpg") returned 5 [0054.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF", pszSpec="*.jpeg") returned 0 [0054.842] lstrlenA (lpString="*.jpeg") returned 6 [0054.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF", pszSpec="*.psd") returned 0 [0054.842] lstrlenA (lpString="*.psd") returned 5 [0054.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF", pszSpec="*.gif") returned 1 [0054.843] lstrlenA (lpString="*.gif") returned 5 [0054.843] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF" [0054.843] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF" [0054.843] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF." [0054.843] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF.wannacry" [0054.843] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115834.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.844] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9 [0054.844] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc2f35a00, dwHighDateTime=0x1bd8f91), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd3e24a0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc2f35a00, dwHighDateTime=0x1bd8f91)) returned 1 [0054.844] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.844] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3b, lpOverlapped=0x0) returned 1 [0054.845] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF") returned="J0115834.GIF" [0054.845] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.845] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3b, lpOverlapped=0x0) returned 1 [0054.845] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.845] CloseHandle (hObject=0x90) returned 1 [0054.845] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115834.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115834.gif.wannacry")) returned 1 [0054.846] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4248700, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc4248700, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="J0115835.GIF", cAlternateFileName="")) returned 1 [0054.846] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.846] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0115835.GIF") returned -1 [0054.846] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0115835.GIF") returned -1 [0054.846] lstrcmpiA (lpString1="", lpString2="J0115835.GIF") returned -1 [0054.846] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF") returned="J0115834.GIF" [0054.846] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.846] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.846] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.846] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.846] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="J0115835.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF" [0054.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF", pszSpec="*.zip") returned 0 [0054.846] lstrlenA (lpString="*.zip") returned 5 [0054.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF", pszSpec="*.rar") returned 0 [0054.846] lstrlenA (lpString="*.rar") returned 5 [0054.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF", pszSpec="*.7z") returned 0 [0054.846] lstrlenA (lpString="*.7z") returned 4 [0054.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF", pszSpec="*.tar") returned 0 [0054.846] lstrlenA (lpString="*.tar") returned 5 [0054.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF", pszSpec="*.gzip") returned 0 [0054.846] lstrlenA (lpString="*.gzip") returned 6 [0054.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF", pszSpec="*.jpg") returned 0 [0054.847] lstrlenA (lpString="*.jpg") returned 5 [0054.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF", pszSpec="*.jpeg") returned 0 [0054.847] lstrlenA (lpString="*.jpeg") returned 6 [0054.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF", pszSpec="*.psd") returned 0 [0054.847] lstrlenA (lpString="*.psd") returned 5 [0054.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF", pszSpec="*.gif") returned 1 [0054.847] lstrlenA (lpString="*.gif") returned 5 [0054.847] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF" [0054.847] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF" [0054.847] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF." [0054.847] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF.wannacry" [0054.847] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115835.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.847] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb1 [0054.847] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc4248700, dwHighDateTime=0x1bd8f91), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd3e24a0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc4248700, dwHighDateTime=0x1bd8f91)) returned 1 [0054.847] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.847] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x33, lpOverlapped=0x0) returned 1 [0054.848] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF") returned="J0115835.GIF" [0054.848] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.849] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x33, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x33, lpOverlapped=0x0) returned 1 [0054.849] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.849] CloseHandle (hObject=0x90) returned 1 [0054.849] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115835.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115835.gif.wannacry")) returned 1 [0054.849] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc555b400, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc555b400, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="J0115836.GIF", cAlternateFileName="")) returned 1 [0054.849] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.849] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0115836.GIF") returned -1 [0054.849] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0115836.GIF") returned -1 [0054.849] lstrcmpiA (lpString1="", lpString2="J0115836.GIF") returned -1 [0054.849] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF") returned="J0115835.GIF" [0054.850] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.850] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.850] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.850] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.850] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="J0115836.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF" [0054.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF", pszSpec="*.zip") returned 0 [0054.850] lstrlenA (lpString="*.zip") returned 5 [0054.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF", pszSpec="*.rar") returned 0 [0054.850] lstrlenA (lpString="*.rar") returned 5 [0054.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF", pszSpec="*.7z") returned 0 [0054.850] lstrlenA (lpString="*.7z") returned 4 [0054.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF", pszSpec="*.tar") returned 0 [0054.850] lstrlenA (lpString="*.tar") returned 5 [0054.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF", pszSpec="*.gzip") returned 0 [0054.850] lstrlenA (lpString="*.gzip") returned 6 [0054.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF", pszSpec="*.jpg") returned 0 [0054.850] lstrlenA (lpString="*.jpg") returned 5 [0054.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF", pszSpec="*.jpeg") returned 0 [0054.850] lstrlenA (lpString="*.jpeg") returned 6 [0054.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF", pszSpec="*.psd") returned 0 [0054.850] lstrlenA (lpString="*.psd") returned 5 [0054.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF", pszSpec="*.gif") returned 1 [0054.850] lstrlenA (lpString="*.gif") returned 5 [0054.850] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF" [0054.850] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF" [0054.850] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF." [0054.850] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF.wannacry" [0054.850] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115836.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.864] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xad [0054.864] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc555b400, dwHighDateTime=0x1bd8f91), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd3e24a0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc555b400, dwHighDateTime=0x1bd8f91)) returned 1 [0054.864] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.864] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2f, lpOverlapped=0x0) returned 1 [0054.865] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF") returned="J0115836.GIF" [0054.865] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.865] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2f, lpOverlapped=0x0) returned 1 [0054.865] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.865] CloseHandle (hObject=0x90) returned 1 [0054.866] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115836.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115836.gif.wannacry")) returned 1 [0054.867] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x497bb300, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x497bb300, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="J0115839.GIF", cAlternateFileName="")) returned 1 [0054.867] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.867] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0115839.GIF") returned -1 [0054.867] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0115839.GIF") returned -1 [0054.867] lstrcmpiA (lpString1="", lpString2="J0115839.GIF") returned -1 [0054.867] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF") returned="J0115836.GIF" [0054.867] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.867] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.867] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.867] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.867] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="J0115839.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF" [0054.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF", pszSpec="*.zip") returned 0 [0054.867] lstrlenA (lpString="*.zip") returned 5 [0054.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF", pszSpec="*.rar") returned 0 [0054.867] lstrlenA (lpString="*.rar") returned 5 [0054.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF", pszSpec="*.7z") returned 0 [0054.867] lstrlenA (lpString="*.7z") returned 4 [0054.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF", pszSpec="*.tar") returned 0 [0054.867] lstrlenA (lpString="*.tar") returned 5 [0054.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF", pszSpec="*.gzip") returned 0 [0054.868] lstrlenA (lpString="*.gzip") returned 6 [0054.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF", pszSpec="*.jpg") returned 0 [0054.868] lstrlenA (lpString="*.jpg") returned 5 [0054.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF", pszSpec="*.jpeg") returned 0 [0054.868] lstrlenA (lpString="*.jpeg") returned 6 [0054.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF", pszSpec="*.psd") returned 0 [0054.868] lstrlenA (lpString="*.psd") returned 5 [0054.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF", pszSpec="*.gif") returned 1 [0054.868] lstrlenA (lpString="*.gif") returned 5 [0054.868] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF" [0054.868] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF" [0054.868] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF." [0054.868] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF.wannacry" [0054.868] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115839.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.869] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbe [0054.869] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x497bb300, dwHighDateTime=0x1bd9367), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd3e24a0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x497bb300, dwHighDateTime=0x1bd9367)) returned 1 [0054.869] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.869] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x40, lpOverlapped=0x0) returned 1 [0054.870] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF") returned="J0115839.GIF" [0054.870] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.870] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x40, lpOverlapped=0x0) returned 1 [0054.870] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.871] CloseHandle (hObject=0x90) returned 1 [0054.871] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115839.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115839.gif.wannacry")) returned 1 [0054.871] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aace000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4aace000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="J0115840.GIF", cAlternateFileName="")) returned 1 [0054.871] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.871] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0115840.GIF") returned -1 [0054.871] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0115840.GIF") returned -1 [0054.871] lstrcmpiA (lpString1="", lpString2="J0115840.GIF") returned -1 [0054.871] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF") returned="J0115839.GIF" [0054.871] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.872] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.872] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.872] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.872] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="J0115840.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF" [0054.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF", pszSpec="*.zip") returned 0 [0054.872] lstrlenA (lpString="*.zip") returned 5 [0054.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF", pszSpec="*.rar") returned 0 [0054.872] lstrlenA (lpString="*.rar") returned 5 [0054.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF", pszSpec="*.7z") returned 0 [0054.872] lstrlenA (lpString="*.7z") returned 4 [0054.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF", pszSpec="*.tar") returned 0 [0054.872] lstrlenA (lpString="*.tar") returned 5 [0054.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF", pszSpec="*.gzip") returned 0 [0054.872] lstrlenA (lpString="*.gzip") returned 6 [0054.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF", pszSpec="*.jpg") returned 0 [0054.872] lstrlenA (lpString="*.jpg") returned 5 [0054.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF", pszSpec="*.jpeg") returned 0 [0054.872] lstrlenA (lpString="*.jpeg") returned 6 [0054.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF", pszSpec="*.psd") returned 0 [0054.872] lstrlenA (lpString="*.psd") returned 5 [0054.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF", pszSpec="*.gif") returned 1 [0054.872] lstrlenA (lpString="*.gif") returned 5 [0054.872] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF" [0054.872] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF" [0054.872] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF." [0054.872] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF.wannacry" [0054.872] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115840.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.873] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbe [0054.873] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4aace000, dwHighDateTime=0x1bd9367), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd408600, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4aace000, dwHighDateTime=0x1bd9367)) returned 1 [0054.873] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.873] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x40, lpOverlapped=0x0) returned 1 [0054.874] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF") returned="J0115840.GIF" [0054.874] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.874] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x40, lpOverlapped=0x0) returned 1 [0054.874] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.874] CloseHandle (hObject=0x90) returned 1 [0054.874] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115840.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115840.gif.wannacry")) returned 1 [0054.875] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aace000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4aace000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="J0115841.GIF", cAlternateFileName="")) returned 1 [0054.875] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.875] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0115841.GIF") returned -1 [0054.875] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0115841.GIF") returned -1 [0054.875] lstrcmpiA (lpString1="", lpString2="J0115841.GIF") returned -1 [0054.875] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF") returned="J0115840.GIF" [0054.875] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.875] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.875] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.875] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.876] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="J0115841.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF" [0054.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF", pszSpec="*.zip") returned 0 [0054.876] lstrlenA (lpString="*.zip") returned 5 [0054.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF", pszSpec="*.rar") returned 0 [0054.876] lstrlenA (lpString="*.rar") returned 5 [0054.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF", pszSpec="*.7z") returned 0 [0054.876] lstrlenA (lpString="*.7z") returned 4 [0054.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF", pszSpec="*.tar") returned 0 [0054.876] lstrlenA (lpString="*.tar") returned 5 [0054.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF", pszSpec="*.gzip") returned 0 [0054.876] lstrlenA (lpString="*.gzip") returned 6 [0054.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF", pszSpec="*.jpg") returned 0 [0054.876] lstrlenA (lpString="*.jpg") returned 5 [0054.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF", pszSpec="*.jpeg") returned 0 [0054.876] lstrlenA (lpString="*.jpeg") returned 6 [0054.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF", pszSpec="*.psd") returned 0 [0054.876] lstrlenA (lpString="*.psd") returned 5 [0054.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF", pszSpec="*.gif") returned 1 [0054.876] lstrlenA (lpString="*.gif") returned 5 [0054.876] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF" [0054.876] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF" [0054.876] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF." [0054.876] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF.wannacry" [0054.876] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115841.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.877] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb1 [0054.877] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4aace000, dwHighDateTime=0x1bd9367), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd408600, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4aace000, dwHighDateTime=0x1bd9367)) returned 1 [0054.877] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.877] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x33, lpOverlapped=0x0) returned 1 [0054.878] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF") returned="J0115841.GIF" [0054.878] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.878] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x33, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x33, lpOverlapped=0x0) returned 1 [0054.878] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.878] CloseHandle (hObject=0x90) returned 1 [0054.878] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115841.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115841.gif.wannacry")) returned 1 [0054.879] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aace000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4aace000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="J0115842.GIF", cAlternateFileName="")) returned 1 [0054.879] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.879] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0115842.GIF") returned -1 [0054.879] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0115842.GIF") returned -1 [0054.879] lstrcmpiA (lpString1="", lpString2="J0115842.GIF") returned -1 [0054.879] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF") returned="J0115841.GIF" [0054.879] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.879] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.879] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.879] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.879] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="J0115842.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF" [0054.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF", pszSpec="*.zip") returned 0 [0054.879] lstrlenA (lpString="*.zip") returned 5 [0054.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF", pszSpec="*.rar") returned 0 [0054.879] lstrlenA (lpString="*.rar") returned 5 [0054.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF", pszSpec="*.7z") returned 0 [0054.879] lstrlenA (lpString="*.7z") returned 4 [0054.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF", pszSpec="*.tar") returned 0 [0054.879] lstrlenA (lpString="*.tar") returned 5 [0054.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF", pszSpec="*.gzip") returned 0 [0054.879] lstrlenA (lpString="*.gzip") returned 6 [0054.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF", pszSpec="*.jpg") returned 0 [0054.879] lstrlenA (lpString="*.jpg") returned 5 [0054.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF", pszSpec="*.jpeg") returned 0 [0054.879] lstrlenA (lpString="*.jpeg") returned 6 [0054.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF", pszSpec="*.psd") returned 0 [0054.879] lstrlenA (lpString="*.psd") returned 5 [0054.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF", pszSpec="*.gif") returned 1 [0054.879] lstrlenA (lpString="*.gif") returned 5 [0054.879] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF" [0054.879] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF" [0054.880] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF." [0054.880] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF.wannacry" [0054.880] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115842.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.880] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb0 [0054.881] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4aace000, dwHighDateTime=0x1bd9367), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd408600, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4aace000, dwHighDateTime=0x1bd9367)) returned 1 [0054.881] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.881] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x32, lpOverlapped=0x0) returned 1 [0054.881] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF") returned="J0115842.GIF" [0054.882] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.882] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x32, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x32, lpOverlapped=0x0) returned 1 [0054.882] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.882] CloseHandle (hObject=0x90) returned 1 [0054.882] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115842.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115842.gif.wannacry")) returned 1 [0054.882] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aace000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4aace000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="J0115843.GIF", cAlternateFileName="")) returned 1 [0054.882] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.882] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0115843.GIF") returned -1 [0054.882] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0115843.GIF") returned -1 [0054.882] lstrcmpiA (lpString1="", lpString2="J0115843.GIF") returned -1 [0054.883] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF") returned="J0115842.GIF" [0054.883] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.883] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.883] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.883] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.883] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="J0115843.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF" [0054.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF", pszSpec="*.zip") returned 0 [0054.883] lstrlenA (lpString="*.zip") returned 5 [0054.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF", pszSpec="*.rar") returned 0 [0054.883] lstrlenA (lpString="*.rar") returned 5 [0054.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF", pszSpec="*.7z") returned 0 [0054.883] lstrlenA (lpString="*.7z") returned 4 [0054.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF", pszSpec="*.tar") returned 0 [0054.883] lstrlenA (lpString="*.tar") returned 5 [0054.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF", pszSpec="*.gzip") returned 0 [0054.883] lstrlenA (lpString="*.gzip") returned 6 [0054.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF", pszSpec="*.jpg") returned 0 [0054.883] lstrlenA (lpString="*.jpg") returned 5 [0054.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF", pszSpec="*.jpeg") returned 0 [0054.883] lstrlenA (lpString="*.jpeg") returned 6 [0054.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF", pszSpec="*.psd") returned 0 [0054.883] lstrlenA (lpString="*.psd") returned 5 [0054.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF", pszSpec="*.gif") returned 1 [0054.883] lstrlenA (lpString="*.gif") returned 5 [0054.883] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF" [0054.883] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF" [0054.883] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF." [0054.883] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF.wannacry" [0054.883] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115843.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.884] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb0 [0054.884] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4aace000, dwHighDateTime=0x1bd9367), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd408600, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4aace000, dwHighDateTime=0x1bd9367)) returned 1 [0054.884] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.884] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x32, lpOverlapped=0x0) returned 1 [0054.885] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF") returned="J0115843.GIF" [0054.885] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.885] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x32, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x32, lpOverlapped=0x0) returned 1 [0054.885] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.885] CloseHandle (hObject=0x90) returned 1 [0054.885] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115843.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115843.gif.wannacry")) returned 1 [0054.888] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bde0d00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4bde0d00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="J0115844.GIF", cAlternateFileName="")) returned 1 [0054.888] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.888] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0115844.GIF") returned -1 [0054.888] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0115844.GIF") returned -1 [0054.888] lstrcmpiA (lpString1="", lpString2="J0115844.GIF") returned -1 [0054.888] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF") returned="J0115843.GIF" [0054.888] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.888] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.888] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.889] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.889] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="J0115844.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF" [0054.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF", pszSpec="*.zip") returned 0 [0054.889] lstrlenA (lpString="*.zip") returned 5 [0054.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF", pszSpec="*.rar") returned 0 [0054.889] lstrlenA (lpString="*.rar") returned 5 [0054.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF", pszSpec="*.7z") returned 0 [0054.889] lstrlenA (lpString="*.7z") returned 4 [0054.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF", pszSpec="*.tar") returned 0 [0054.889] lstrlenA (lpString="*.tar") returned 5 [0054.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF", pszSpec="*.gzip") returned 0 [0054.889] lstrlenA (lpString="*.gzip") returned 6 [0054.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF", pszSpec="*.jpg") returned 0 [0054.889] lstrlenA (lpString="*.jpg") returned 5 [0054.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF", pszSpec="*.jpeg") returned 0 [0054.889] lstrlenA (lpString="*.jpeg") returned 6 [0054.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF", pszSpec="*.psd") returned 0 [0054.889] lstrlenA (lpString="*.psd") returned 5 [0054.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF", pszSpec="*.gif") returned 1 [0054.889] lstrlenA (lpString="*.gif") returned 5 [0054.889] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF" [0054.889] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF" [0054.889] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF." [0054.889] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF.wannacry" [0054.889] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115844.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.890] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb0 [0054.890] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4bde0d00, dwHighDateTime=0x1bd9367), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd408600, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4bde0d00, dwHighDateTime=0x1bd9367)) returned 1 [0054.890] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.890] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x32, lpOverlapped=0x0) returned 1 [0054.891] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF") returned="J0115844.GIF" [0054.891] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.892] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x32, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x32, lpOverlapped=0x0) returned 1 [0054.892] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.892] CloseHandle (hObject=0x90) returned 1 [0054.892] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115844.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115844.gif.wannacry")) returned 1 [0054.893] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57c9cf00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x57c9cf00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="J0115863.GIF", cAlternateFileName="")) returned 1 [0054.893] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.893] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0115863.GIF") returned -1 [0054.893] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0115863.GIF") returned -1 [0054.893] lstrcmpiA (lpString1="", lpString2="J0115863.GIF") returned -1 [0054.893] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF") returned="J0115844.GIF" [0054.893] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.893] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.893] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.894] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.894] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="J0115863.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF" [0054.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF", pszSpec="*.zip") returned 0 [0054.894] lstrlenA (lpString="*.zip") returned 5 [0054.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF", pszSpec="*.rar") returned 0 [0054.894] lstrlenA (lpString="*.rar") returned 5 [0054.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF", pszSpec="*.7z") returned 0 [0054.894] lstrlenA (lpString="*.7z") returned 4 [0054.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF", pszSpec="*.tar") returned 0 [0054.894] lstrlenA (lpString="*.tar") returned 5 [0054.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF", pszSpec="*.gzip") returned 0 [0054.894] lstrlenA (lpString="*.gzip") returned 6 [0054.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF", pszSpec="*.jpg") returned 0 [0054.894] lstrlenA (lpString="*.jpg") returned 5 [0054.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF", pszSpec="*.jpeg") returned 0 [0054.894] lstrlenA (lpString="*.jpeg") returned 6 [0054.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF", pszSpec="*.psd") returned 0 [0054.894] lstrlenA (lpString="*.psd") returned 5 [0054.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF", pszSpec="*.gif") returned 1 [0054.894] lstrlenA (lpString="*.gif") returned 5 [0054.894] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF" [0054.894] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF" [0054.894] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF." [0054.894] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF.wannacry" [0054.894] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115863.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.895] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed [0054.896] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x57c9cf00, dwHighDateTime=0x1bd9367), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd42e760, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x57c9cf00, dwHighDateTime=0x1bd9367)) returned 1 [0054.896] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.896] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x6f, lpOverlapped=0x0) returned 1 [0054.897] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF") returned="J0115863.GIF" [0054.897] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.897] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x6f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x6f, lpOverlapped=0x0) returned 1 [0054.897] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.897] CloseHandle (hObject=0x90) returned 1 [0054.897] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115863.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115863.gif.wannacry")) returned 1 [0054.898] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57c9cf00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x57c9cf00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="J0115864.GIF", cAlternateFileName="")) returned 1 [0054.898] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.898] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0115864.GIF") returned -1 [0054.898] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0115864.GIF") returned -1 [0054.898] lstrcmpiA (lpString1="", lpString2="J0115864.GIF") returned -1 [0054.898] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF") returned="J0115863.GIF" [0054.898] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.898] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.898] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.898] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.898] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="J0115864.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF" [0054.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF", pszSpec="*.zip") returned 0 [0054.898] lstrlenA (lpString="*.zip") returned 5 [0054.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF", pszSpec="*.rar") returned 0 [0054.898] lstrlenA (lpString="*.rar") returned 5 [0054.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF", pszSpec="*.7z") returned 0 [0054.898] lstrlenA (lpString="*.7z") returned 4 [0054.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF", pszSpec="*.tar") returned 0 [0054.898] lstrlenA (lpString="*.tar") returned 5 [0054.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF", pszSpec="*.gzip") returned 0 [0054.898] lstrlenA (lpString="*.gzip") returned 6 [0054.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF", pszSpec="*.jpg") returned 0 [0054.898] lstrlenA (lpString="*.jpg") returned 5 [0054.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF", pszSpec="*.jpeg") returned 0 [0054.898] lstrlenA (lpString="*.jpeg") returned 6 [0054.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF", pszSpec="*.psd") returned 0 [0054.899] lstrlenA (lpString="*.psd") returned 5 [0054.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF", pszSpec="*.gif") returned 1 [0054.899] lstrlenA (lpString="*.gif") returned 5 [0054.899] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF" [0054.899] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF" [0054.899] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF." [0054.899] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF.wannacry" [0054.899] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115864.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.899] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9 [0054.899] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x57c9cf00, dwHighDateTime=0x1bd9367), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd42e760, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x57c9cf00, dwHighDateTime=0x1bd9367)) returned 1 [0054.899] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.899] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3b, lpOverlapped=0x0) returned 1 [0054.900] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF") returned="J0115864.GIF" [0054.900] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.900] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3b, lpOverlapped=0x0) returned 1 [0054.900] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.900] CloseHandle (hObject=0x90) returned 1 [0054.901] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115864.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115864.gif.wannacry")) returned 1 [0054.901] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57c9cf00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x57c9cf00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="J0115865.GIF", cAlternateFileName="")) returned 1 [0054.901] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.901] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0115865.GIF") returned -1 [0054.901] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0115865.GIF") returned -1 [0054.901] lstrcmpiA (lpString1="", lpString2="J0115865.GIF") returned -1 [0054.901] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF") returned="J0115864.GIF" [0054.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.901] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.901] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.901] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.901] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="J0115865.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF" [0054.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF", pszSpec="*.zip") returned 0 [0054.902] lstrlenA (lpString="*.zip") returned 5 [0054.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF", pszSpec="*.rar") returned 0 [0054.902] lstrlenA (lpString="*.rar") returned 5 [0054.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF", pszSpec="*.7z") returned 0 [0054.902] lstrlenA (lpString="*.7z") returned 4 [0054.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF", pszSpec="*.tar") returned 0 [0054.902] lstrlenA (lpString="*.tar") returned 5 [0054.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF", pszSpec="*.gzip") returned 0 [0054.902] lstrlenA (lpString="*.gzip") returned 6 [0054.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF", pszSpec="*.jpg") returned 0 [0054.902] lstrlenA (lpString="*.jpg") returned 5 [0054.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF", pszSpec="*.jpeg") returned 0 [0054.902] lstrlenA (lpString="*.jpeg") returned 6 [0054.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF", pszSpec="*.psd") returned 0 [0054.902] lstrlenA (lpString="*.psd") returned 5 [0054.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF", pszSpec="*.gif") returned 1 [0054.902] lstrlenA (lpString="*.gif") returned 5 [0054.902] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF" [0054.902] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF" [0054.902] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF." [0054.902] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF.wannacry" [0054.902] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115865.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.903] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0054.903] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x57c9cf00, dwHighDateTime=0x1bd9367), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd42e760, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x57c9cf00, dwHighDateTime=0x1bd9367)) returned 1 [0054.903] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.903] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x62, lpOverlapped=0x0) returned 1 [0054.904] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF") returned="J0115865.GIF" [0054.904] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.904] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x62, lpOverlapped=0x0) returned 1 [0054.904] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.904] CloseHandle (hObject=0x90) returned 1 [0054.904] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115865.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115865.gif.wannacry")) returned 1 [0054.905] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58fafc00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x58fafc00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="J0115866.GIF", cAlternateFileName="")) returned 1 [0054.905] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.905] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0115866.GIF") returned -1 [0054.905] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0115866.GIF") returned -1 [0054.905] lstrcmpiA (lpString1="", lpString2="J0115866.GIF") returned -1 [0054.905] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF") returned="J0115865.GIF" [0054.905] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.905] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.905] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="J0115866.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF" [0054.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF", pszSpec="*.zip") returned 0 [0054.905] lstrlenA (lpString="*.zip") returned 5 [0054.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF", pszSpec="*.rar") returned 0 [0054.906] lstrlenA (lpString="*.rar") returned 5 [0054.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF", pszSpec="*.7z") returned 0 [0054.906] lstrlenA (lpString="*.7z") returned 4 [0054.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF", pszSpec="*.tar") returned 0 [0054.906] lstrlenA (lpString="*.tar") returned 5 [0054.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF", pszSpec="*.gzip") returned 0 [0054.906] lstrlenA (lpString="*.gzip") returned 6 [0054.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF", pszSpec="*.jpg") returned 0 [0054.906] lstrlenA (lpString="*.jpg") returned 5 [0054.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF", pszSpec="*.jpeg") returned 0 [0054.906] lstrlenA (lpString="*.jpeg") returned 6 [0054.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF", pszSpec="*.psd") returned 0 [0054.906] lstrlenA (lpString="*.psd") returned 5 [0054.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF", pszSpec="*.gif") returned 1 [0054.906] lstrlenA (lpString="*.gif") returned 5 [0054.906] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF" [0054.906] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF" [0054.906] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF." [0054.906] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF.wannacry" [0054.906] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115866.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.908] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0054.908] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x58fafc00, dwHighDateTime=0x1bd9367), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd42e760, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x58fafc00, dwHighDateTime=0x1bd9367)) returned 1 [0054.908] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.908] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x62, lpOverlapped=0x0) returned 1 [0054.909] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF") returned="J0115866.GIF" [0054.909] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.909] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x62, lpOverlapped=0x0) returned 1 [0054.909] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.910] CloseHandle (hObject=0x90) returned 1 [0054.910] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115866.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115866.gif.wannacry")) returned 1 [0054.910] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58fafc00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x58fafc00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="J0115867.GIF", cAlternateFileName="")) returned 1 [0054.910] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.910] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0115867.GIF") returned -1 [0054.910] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0115867.GIF") returned -1 [0054.910] lstrcmpiA (lpString1="", lpString2="J0115867.GIF") returned -1 [0054.910] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF") returned="J0115866.GIF" [0054.910] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.910] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.910] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.910] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.911] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="J0115867.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF" [0054.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF", pszSpec="*.zip") returned 0 [0054.911] lstrlenA (lpString="*.zip") returned 5 [0054.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF", pszSpec="*.rar") returned 0 [0054.911] lstrlenA (lpString="*.rar") returned 5 [0054.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF", pszSpec="*.7z") returned 0 [0054.911] lstrlenA (lpString="*.7z") returned 4 [0054.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF", pszSpec="*.tar") returned 0 [0054.911] lstrlenA (lpString="*.tar") returned 5 [0054.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF", pszSpec="*.gzip") returned 0 [0054.911] lstrlenA (lpString="*.gzip") returned 6 [0054.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF", pszSpec="*.jpg") returned 0 [0054.911] lstrlenA (lpString="*.jpg") returned 5 [0054.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF", pszSpec="*.jpeg") returned 0 [0054.911] lstrlenA (lpString="*.jpeg") returned 6 [0054.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF", pszSpec="*.psd") returned 0 [0054.911] lstrlenA (lpString="*.psd") returned 5 [0054.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF", pszSpec="*.gif") returned 1 [0054.911] lstrlenA (lpString="*.gif") returned 5 [0054.911] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF" [0054.911] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF" [0054.911] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF." [0054.911] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF.wannacry" [0054.911] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115867.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.912] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0054.912] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x58fafc00, dwHighDateTime=0x1bd9367), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd42e760, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x58fafc00, dwHighDateTime=0x1bd9367)) returned 1 [0054.912] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.912] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x62, lpOverlapped=0x0) returned 1 [0054.912] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF") returned="J0115867.GIF" [0054.913] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.913] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x62, lpOverlapped=0x0) returned 1 [0054.913] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.913] CloseHandle (hObject=0x90) returned 1 [0054.913] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115867.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115867.gif.wannacry")) returned 1 [0054.913] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58fafc00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x58fafc00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="J0115868.GIF", cAlternateFileName="")) returned 1 [0054.913] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.913] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0115868.GIF") returned -1 [0054.913] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0115868.GIF") returned -1 [0054.913] lstrcmpiA (lpString1="", lpString2="J0115868.GIF") returned -1 [0054.914] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF") returned="J0115867.GIF" [0054.914] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0054.914] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="" [0054.914] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" [0054.914] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\how to decrypt files.txt")) returned 0x20 [0054.914] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", lpString2="J0115868.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF" [0054.914] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF", pszSpec="*.zip") returned 0 [0054.914] lstrlenA (lpString="*.zip") returned 5 [0054.914] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF", pszSpec="*.rar") returned 0 [0054.914] lstrlenA (lpString="*.rar") returned 5 [0054.914] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF", pszSpec="*.7z") returned 0 [0054.914] lstrlenA (lpString="*.7z") returned 4 [0054.914] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF", pszSpec="*.tar") returned 0 [0054.914] lstrlenA (lpString="*.tar") returned 5 [0054.914] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF", pszSpec="*.gzip") returned 0 [0054.914] lstrlenA (lpString="*.gzip") returned 6 [0054.914] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF", pszSpec="*.jpg") returned 0 [0054.914] lstrlenA (lpString="*.jpg") returned 5 [0054.914] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF", pszSpec="*.jpeg") returned 0 [0054.914] lstrlenA (lpString="*.jpeg") returned 6 [0054.914] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF", pszSpec="*.psd") returned 0 [0054.914] lstrlenA (lpString="*.psd") returned 5 [0054.914] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF", pszSpec="*.gif") returned 1 [0054.914] lstrlenA (lpString="*.gif") returned 5 [0054.914] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF" [0054.914] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF" [0054.914] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF." [0054.914] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF.wannacry" [0054.914] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115868.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.915] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0054.915] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x58fafc00, dwHighDateTime=0x1bd9367), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd42e760, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x58fafc00, dwHighDateTime=0x1bd9367)) returned 1 [0054.915] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.915] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x62, lpOverlapped=0x0) returned 1 [0054.916] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF") returned="J0115868.GIF" [0054.916] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.916] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x62, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x62, lpOverlapped=0x0) returned 1 [0054.916] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.916] CloseHandle (hObject=0x90) returned 1 [0054.916] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115868.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115868.gif.wannacry")) returned 1 [0054.917] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58fafc00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x58fafc00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="J0115868.GIF", cAlternateFileName="")) returned 0 [0054.917] FindClose (in: hFindFile=0x2d7ff8 | out: hFindFile=0x2d7ff8) returned 1 [0054.917] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4548c0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d80b0, dwReserved1=0x3, cFileName="LINES", cAlternateFileName="")) returned 1 [0054.917] lstrcmpA (lpString1=".", lpString2="LINES") returned -1 [0054.917] lstrcmpA (lpString1="..", lpString2="LINES") returned -1 [0054.917] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*.*") returned="*.*" [0054.917] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\", lpString2="LINES" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0054.917] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned 54 [0054.917] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4548c0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName=".", cAlternateFileName="")) returned 0x2d7ff8 [0054.920] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0054.920] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4548c0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.921] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0054.921] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0054.921] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0e4a00, ftCreationTime.dwHighDateTime=0x1bd5ead, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9b0e4a00, ftLastWriteTime.dwHighDateTime=0x1bd5ead, nFileSizeHigh=0x0, nFileSizeLow=0x3d2, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BD10219_.GIF", cAlternateFileName="")) returned 1 [0054.921] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.921] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD10219_.GIF") returned 1 [0054.921] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10219_.GIF") returned 1 [0054.921] lstrcmpiA (lpString1="", lpString2="BD10219_.GIF") returned -1 [0054.921] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\*.*") returned="*.*" [0054.921] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0054.921] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0054.921] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0054.921] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0xffffffff [0054.922] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.923] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0054.923] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0054.924] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0054.924] CloseHandle (hObject=0x90) returned 1 [0054.924] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD10219_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF" [0054.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF", pszSpec="*.zip") returned 0 [0054.924] lstrlenA (lpString="*.zip") returned 5 [0054.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF", pszSpec="*.rar") returned 0 [0054.924] lstrlenA (lpString="*.rar") returned 5 [0054.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF", pszSpec="*.7z") returned 0 [0054.924] lstrlenA (lpString="*.7z") returned 4 [0054.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF", pszSpec="*.tar") returned 0 [0054.924] lstrlenA (lpString="*.tar") returned 5 [0054.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF", pszSpec="*.gzip") returned 0 [0054.925] lstrlenA (lpString="*.gzip") returned 6 [0054.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF", pszSpec="*.jpg") returned 0 [0054.925] lstrlenA (lpString="*.jpg") returned 5 [0054.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF", pszSpec="*.jpeg") returned 0 [0054.925] lstrlenA (lpString="*.jpeg") returned 6 [0054.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF", pszSpec="*.psd") returned 0 [0054.925] lstrlenA (lpString="*.psd") returned 5 [0054.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF", pszSpec="*.gif") returned 1 [0054.925] lstrlenA (lpString="*.gif") returned 5 [0054.925] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF" [0054.925] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF" [0054.925] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF." [0054.925] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF.wannacry" [0054.925] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10219_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.925] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d2 [0054.925] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b0e4a00, dwHighDateTime=0x1bd5ead), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc847960, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b0e4a00, dwHighDateTime=0x1bd5ead)) returned 1 [0054.925] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.925] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x354, lpOverlapped=0x0) returned 1 [0054.929] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF") returned="BD10219_.GIF" [0054.929] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.929] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x354, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x354, lpOverlapped=0x0) returned 1 [0054.929] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.929] CloseHandle (hObject=0x90) returned 1 [0054.929] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10219_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10219_.gif.wannacry")) returned 1 [0054.930] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8d9c300, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8d9c300, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x97e, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD10256_.GIF", cAlternateFileName="")) returned 1 [0054.930] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.930] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD10256_.GIF") returned 1 [0054.930] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10256_.GIF") returned 1 [0054.930] lstrcmpiA (lpString1="", lpString2="BD10256_.GIF") returned -1 [0054.930] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF") returned="BD10219_.GIF" [0054.930] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0054.930] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0054.930] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0054.930] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0054.930] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD10256_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF" [0054.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF", pszSpec="*.zip") returned 0 [0054.930] lstrlenA (lpString="*.zip") returned 5 [0054.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF", pszSpec="*.rar") returned 0 [0054.930] lstrlenA (lpString="*.rar") returned 5 [0054.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF", pszSpec="*.7z") returned 0 [0054.931] lstrlenA (lpString="*.7z") returned 4 [0054.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF", pszSpec="*.tar") returned 0 [0054.931] lstrlenA (lpString="*.tar") returned 5 [0054.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF", pszSpec="*.gzip") returned 0 [0054.931] lstrlenA (lpString="*.gzip") returned 6 [0054.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF", pszSpec="*.jpg") returned 0 [0054.931] lstrlenA (lpString="*.jpg") returned 5 [0054.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF", pszSpec="*.jpeg") returned 0 [0054.931] lstrlenA (lpString="*.jpeg") returned 6 [0054.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF", pszSpec="*.psd") returned 0 [0054.931] lstrlenA (lpString="*.psd") returned 5 [0054.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF", pszSpec="*.gif") returned 1 [0054.931] lstrlenA (lpString="*.gif") returned 5 [0054.931] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF" [0054.931] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF" [0054.931] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF." [0054.931] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF.wannacry" [0054.931] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10256_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.931] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x97e [0054.931] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa8d9c300, dwHighDateTime=0x1bd9367), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc847960, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa8d9c300, dwHighDateTime=0x1bd9367)) returned 1 [0054.931] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.931] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x900, lpOverlapped=0x0) returned 1 [0054.933] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF") returned="BD10256_.GIF" [0054.933] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.933] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x900, lpOverlapped=0x0) returned 1 [0054.933] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.933] CloseHandle (hObject=0x90) returned 1 [0054.933] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10256_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10256_.gif.wannacry")) returned 1 [0054.934] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e031400, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e031400, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD10289_.GIF", cAlternateFileName="")) returned 1 [0054.934] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.934] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD10289_.GIF") returned 1 [0054.934] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10289_.GIF") returned 1 [0054.934] lstrcmpiA (lpString1="", lpString2="BD10289_.GIF") returned -1 [0054.934] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF") returned="BD10256_.GIF" [0054.934] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0054.934] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0054.934] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0054.934] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0054.934] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD10289_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF" [0054.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF", pszSpec="*.zip") returned 0 [0054.934] lstrlenA (lpString="*.zip") returned 5 [0054.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF", pszSpec="*.rar") returned 0 [0054.934] lstrlenA (lpString="*.rar") returned 5 [0054.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF", pszSpec="*.7z") returned 0 [0054.934] lstrlenA (lpString="*.7z") returned 4 [0054.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF", pszSpec="*.tar") returned 0 [0054.934] lstrlenA (lpString="*.tar") returned 5 [0054.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF", pszSpec="*.gzip") returned 0 [0054.935] lstrlenA (lpString="*.gzip") returned 6 [0054.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF", pszSpec="*.jpg") returned 0 [0054.935] lstrlenA (lpString="*.jpg") returned 5 [0054.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF", pszSpec="*.jpeg") returned 0 [0054.935] lstrlenA (lpString="*.jpeg") returned 6 [0054.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF", pszSpec="*.psd") returned 0 [0054.935] lstrlenA (lpString="*.psd") returned 5 [0054.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF", pszSpec="*.gif") returned 1 [0054.935] lstrlenA (lpString="*.gif") returned 5 [0054.935] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF" [0054.935] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF" [0054.935] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF." [0054.935] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF.wannacry" [0054.935] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10289_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.936] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x124 [0054.936] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6e031400, dwHighDateTime=0x1bd8f90), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc893c20, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6e031400, dwHighDateTime=0x1bd8f90)) returned 1 [0054.936] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.936] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xa6, lpOverlapped=0x0) returned 1 [0054.937] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF") returned="BD10289_.GIF" [0054.937] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.937] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xa6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xa6, lpOverlapped=0x0) returned 1 [0054.937] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.937] CloseHandle (hObject=0x90) returned 1 [0054.937] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10289_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10289_.gif.wannacry")) returned 1 [0054.938] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e031400, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e031400, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x134, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD10290_.GIF", cAlternateFileName="")) returned 1 [0054.938] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.938] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD10290_.GIF") returned 1 [0054.938] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10290_.GIF") returned 1 [0054.938] lstrcmpiA (lpString1="", lpString2="BD10290_.GIF") returned -1 [0054.938] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF") returned="BD10289_.GIF" [0054.938] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0054.938] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0054.938] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0054.938] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0054.938] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD10290_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF" [0054.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF", pszSpec="*.zip") returned 0 [0054.938] lstrlenA (lpString="*.zip") returned 5 [0054.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF", pszSpec="*.rar") returned 0 [0054.938] lstrlenA (lpString="*.rar") returned 5 [0054.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF", pszSpec="*.7z") returned 0 [0054.938] lstrlenA (lpString="*.7z") returned 4 [0054.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF", pszSpec="*.tar") returned 0 [0054.938] lstrlenA (lpString="*.tar") returned 5 [0054.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF", pszSpec="*.gzip") returned 0 [0054.939] lstrlenA (lpString="*.gzip") returned 6 [0054.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF", pszSpec="*.jpg") returned 0 [0054.939] lstrlenA (lpString="*.jpg") returned 5 [0054.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF", pszSpec="*.jpeg") returned 0 [0054.939] lstrlenA (lpString="*.jpeg") returned 6 [0054.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF", pszSpec="*.psd") returned 0 [0054.939] lstrlenA (lpString="*.psd") returned 5 [0054.939] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF", pszSpec="*.gif") returned 1 [0054.939] lstrlenA (lpString="*.gif") returned 5 [0054.939] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF" [0054.939] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF" [0054.939] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF." [0054.939] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF.wannacry" [0054.939] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10290_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.939] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x134 [0054.939] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6e031400, dwHighDateTime=0x1bd8f90), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc893c20, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6e031400, dwHighDateTime=0x1bd8f90)) returned 1 [0054.939] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.939] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xb6, lpOverlapped=0x0) returned 1 [0054.940] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF") returned="BD10290_.GIF" [0054.940] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.940] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xb6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xb6, lpOverlapped=0x0) returned 1 [0054.940] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.940] CloseHandle (hObject=0x90) returned 1 [0054.941] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10290_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10290_.gif.wannacry")) returned 1 [0054.941] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73f8f500, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73f8f500, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x497, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD10307_.GIF", cAlternateFileName="")) returned 1 [0054.941] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.941] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD10307_.GIF") returned 1 [0054.941] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10307_.GIF") returned 1 [0054.941] lstrcmpiA (lpString1="", lpString2="BD10307_.GIF") returned -1 [0054.941] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF") returned="BD10290_.GIF" [0054.941] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0054.941] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0054.941] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0054.941] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0054.941] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD10307_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF" [0054.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF", pszSpec="*.zip") returned 0 [0054.942] lstrlenA (lpString="*.zip") returned 5 [0054.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF", pszSpec="*.rar") returned 0 [0054.942] lstrlenA (lpString="*.rar") returned 5 [0054.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF", pszSpec="*.7z") returned 0 [0054.942] lstrlenA (lpString="*.7z") returned 4 [0054.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF", pszSpec="*.tar") returned 0 [0054.942] lstrlenA (lpString="*.tar") returned 5 [0054.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF", pszSpec="*.gzip") returned 0 [0054.942] lstrlenA (lpString="*.gzip") returned 6 [0054.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF", pszSpec="*.jpg") returned 0 [0054.942] lstrlenA (lpString="*.jpg") returned 5 [0054.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF", pszSpec="*.jpeg") returned 0 [0054.942] lstrlenA (lpString="*.jpeg") returned 6 [0054.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF", pszSpec="*.psd") returned 0 [0054.942] lstrlenA (lpString="*.psd") returned 5 [0054.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF", pszSpec="*.gif") returned 1 [0054.942] lstrlenA (lpString="*.gif") returned 5 [0054.942] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF" [0054.942] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF" [0054.942] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF." [0054.942] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF.wannacry" [0054.942] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10307_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.942] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x497 [0054.942] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x73f8f500, dwHighDateTime=0x1bd8f90), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc8b9d80, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x73f8f500, dwHighDateTime=0x1bd8f90)) returned 1 [0054.943] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.943] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x419, lpOverlapped=0x0) returned 1 [0054.944] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF") returned="BD10307_.GIF" [0054.944] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.944] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x419, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x419, lpOverlapped=0x0) returned 1 [0054.944] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.945] CloseHandle (hObject=0x90) returned 1 [0054.945] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10307_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10307_.gif.wannacry")) returned 1 [0054.945] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x752a2200, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x752a2200, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x27d, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD10308_.GIF", cAlternateFileName="")) returned 1 [0054.945] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.945] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD10308_.GIF") returned 1 [0054.945] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10308_.GIF") returned 1 [0054.945] lstrcmpiA (lpString1="", lpString2="BD10308_.GIF") returned -1 [0054.945] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF") returned="BD10307_.GIF" [0054.945] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0054.945] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0054.946] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0054.946] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0054.946] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD10308_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF" [0054.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF", pszSpec="*.zip") returned 0 [0054.946] lstrlenA (lpString="*.zip") returned 5 [0054.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF", pszSpec="*.rar") returned 0 [0054.946] lstrlenA (lpString="*.rar") returned 5 [0054.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF", pszSpec="*.7z") returned 0 [0054.946] lstrlenA (lpString="*.7z") returned 4 [0054.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF", pszSpec="*.tar") returned 0 [0054.946] lstrlenA (lpString="*.tar") returned 5 [0054.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF", pszSpec="*.gzip") returned 0 [0054.946] lstrlenA (lpString="*.gzip") returned 6 [0054.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF", pszSpec="*.jpg") returned 0 [0054.946] lstrlenA (lpString="*.jpg") returned 5 [0054.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF", pszSpec="*.jpeg") returned 0 [0054.946] lstrlenA (lpString="*.jpeg") returned 6 [0054.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF", pszSpec="*.psd") returned 0 [0054.946] lstrlenA (lpString="*.psd") returned 5 [0054.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF", pszSpec="*.gif") returned 1 [0054.946] lstrlenA (lpString="*.gif") returned 5 [0054.946] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF" [0054.946] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF" [0054.946] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF." [0054.946] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF.wannacry" [0054.947] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10308_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.947] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x27d [0054.947] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x752a2200, dwHighDateTime=0x1bd8f90), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc8b9d80, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x752a2200, dwHighDateTime=0x1bd8f90)) returned 1 [0054.947] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.947] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1ff, lpOverlapped=0x0) returned 1 [0054.948] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF") returned="BD10308_.GIF" [0054.948] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.948] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1ff, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1ff, lpOverlapped=0x0) returned 1 [0054.948] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.948] CloseHandle (hObject=0x90) returned 1 [0054.948] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10308_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10308_.gif.wannacry")) returned 1 [0054.950] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68a6c900, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x68a6c900, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x3a4, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD10358_.GIF", cAlternateFileName="")) returned 1 [0054.950] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.950] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD10358_.GIF") returned 1 [0054.950] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD10358_.GIF") returned 1 [0054.950] lstrcmpiA (lpString1="", lpString2="BD10358_.GIF") returned -1 [0054.950] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF") returned="BD10308_.GIF" [0054.950] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0054.950] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0054.950] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0054.950] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0054.950] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD10358_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF" [0054.950] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF", pszSpec="*.zip") returned 0 [0054.950] lstrlenA (lpString="*.zip") returned 5 [0054.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF", pszSpec="*.rar") returned 0 [0054.951] lstrlenA (lpString="*.rar") returned 5 [0054.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF", pszSpec="*.7z") returned 0 [0054.951] lstrlenA (lpString="*.7z") returned 4 [0054.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF", pszSpec="*.tar") returned 0 [0054.951] lstrlenA (lpString="*.tar") returned 5 [0054.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF", pszSpec="*.gzip") returned 0 [0054.951] lstrlenA (lpString="*.gzip") returned 6 [0054.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF", pszSpec="*.jpg") returned 0 [0054.951] lstrlenA (lpString="*.jpg") returned 5 [0054.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF", pszSpec="*.jpeg") returned 0 [0054.951] lstrlenA (lpString="*.jpeg") returned 6 [0054.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF", pszSpec="*.psd") returned 0 [0054.951] lstrlenA (lpString="*.psd") returned 5 [0054.951] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF", pszSpec="*.gif") returned 1 [0054.951] lstrlenA (lpString="*.gif") returned 5 [0054.951] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF" [0054.951] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF" [0054.951] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF." [0054.951] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF.wannacry" [0054.951] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10358_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.951] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a4 [0054.951] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x68a6c900, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc8b9d80, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x68a6c900, dwHighDateTime=0x1bd8f92)) returned 1 [0054.952] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.952] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x326, lpOverlapped=0x0) returned 1 [0054.953] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF") returned="BD10358_.GIF" [0054.953] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.953] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x326, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x326, lpOverlapped=0x0) returned 1 [0054.954] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.954] CloseHandle (hObject=0x90) returned 1 [0054.954] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10358_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10358_.gif.wannacry")) returned 1 [0054.954] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91d2700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb91d2700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14516_.GIF", cAlternateFileName="")) returned 1 [0054.954] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.954] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14516_.GIF") returned 1 [0054.954] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14516_.GIF") returned 1 [0054.954] lstrcmpiA (lpString1="", lpString2="BD14516_.GIF") returned -1 [0054.954] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF") returned="BD10358_.GIF" [0054.955] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0054.955] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0054.955] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0054.955] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0054.955] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD14516_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF" [0054.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF", pszSpec="*.zip") returned 0 [0054.955] lstrlenA (lpString="*.zip") returned 5 [0054.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF", pszSpec="*.rar") returned 0 [0054.955] lstrlenA (lpString="*.rar") returned 5 [0054.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF", pszSpec="*.7z") returned 0 [0054.955] lstrlenA (lpString="*.7z") returned 4 [0054.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF", pszSpec="*.tar") returned 0 [0054.955] lstrlenA (lpString="*.tar") returned 5 [0054.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF", pszSpec="*.gzip") returned 0 [0054.955] lstrlenA (lpString="*.gzip") returned 6 [0054.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF", pszSpec="*.jpg") returned 0 [0054.955] lstrlenA (lpString="*.jpg") returned 5 [0054.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF", pszSpec="*.jpeg") returned 0 [0054.955] lstrlenA (lpString="*.jpeg") returned 6 [0054.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF", pszSpec="*.psd") returned 0 [0054.955] lstrlenA (lpString="*.psd") returned 5 [0054.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF", pszSpec="*.gif") returned 1 [0054.955] lstrlenA (lpString="*.gif") returned 5 [0054.955] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF" [0054.955] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF" [0054.955] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF." [0054.955] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF.wannacry" [0054.955] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14516_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.956] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x160 [0054.956] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb91d2700, dwHighDateTime=0x1bd8f90), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc8dfee0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb91d2700, dwHighDateTime=0x1bd8f90)) returned 1 [0054.956] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.956] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xe2, lpOverlapped=0x0) returned 1 [0054.957] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF") returned="BD14516_.GIF" [0054.958] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.958] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xe2, lpOverlapped=0x0) returned 1 [0054.958] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.958] CloseHandle (hObject=0x90) returned 1 [0054.958] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14516_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14516_.gif.wannacry")) returned 1 [0054.959] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8d9c300, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8d9c300, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x617, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14538_.GIF", cAlternateFileName="")) returned 1 [0054.959] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.959] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14538_.GIF") returned 1 [0054.959] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14538_.GIF") returned 1 [0054.960] lstrcmpiA (lpString1="", lpString2="BD14538_.GIF") returned -1 [0054.960] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF") returned="BD14516_.GIF" [0054.960] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0054.960] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0054.960] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0054.960] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0054.960] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD14538_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF" [0054.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF", pszSpec="*.zip") returned 0 [0054.960] lstrlenA (lpString="*.zip") returned 5 [0054.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF", pszSpec="*.rar") returned 0 [0054.960] lstrlenA (lpString="*.rar") returned 5 [0054.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF", pszSpec="*.7z") returned 0 [0054.960] lstrlenA (lpString="*.7z") returned 4 [0054.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF", pszSpec="*.tar") returned 0 [0054.960] lstrlenA (lpString="*.tar") returned 5 [0054.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF", pszSpec="*.gzip") returned 0 [0054.960] lstrlenA (lpString="*.gzip") returned 6 [0054.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF", pszSpec="*.jpg") returned 0 [0054.960] lstrlenA (lpString="*.jpg") returned 5 [0054.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF", pszSpec="*.jpeg") returned 0 [0054.960] lstrlenA (lpString="*.jpeg") returned 6 [0054.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF", pszSpec="*.psd") returned 0 [0054.960] lstrlenA (lpString="*.psd") returned 5 [0054.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF", pszSpec="*.gif") returned 1 [0054.960] lstrlenA (lpString="*.gif") returned 5 [0054.960] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF" [0054.960] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF" [0054.960] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF." [0054.960] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF.wannacry" [0054.960] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14538_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.961] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x617 [0054.961] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa8d9c300, dwHighDateTime=0x1bd9367), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc906040, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa8d9c300, dwHighDateTime=0x1bd9367)) returned 1 [0054.961] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.961] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x599, lpOverlapped=0x0) returned 1 [0054.962] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF") returned="BD14538_.GIF" [0054.962] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.962] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x599, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x599, lpOverlapped=0x0) returned 1 [0054.963] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.963] CloseHandle (hObject=0x90) returned 1 [0054.963] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14538_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14538_.gif.wannacry")) returned 1 [0054.963] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0af000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa0af000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x5ab, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14539_.GIF", cAlternateFileName="")) returned 1 [0054.963] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.963] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14539_.GIF") returned 1 [0054.963] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14539_.GIF") returned 1 [0054.963] lstrcmpiA (lpString1="", lpString2="BD14539_.GIF") returned -1 [0054.963] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF") returned="BD14538_.GIF" [0054.963] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0054.964] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0054.964] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0054.964] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0054.964] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD14539_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF" [0054.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF", pszSpec="*.zip") returned 0 [0054.964] lstrlenA (lpString="*.zip") returned 5 [0054.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF", pszSpec="*.rar") returned 0 [0054.964] lstrlenA (lpString="*.rar") returned 5 [0054.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF", pszSpec="*.7z") returned 0 [0054.964] lstrlenA (lpString="*.7z") returned 4 [0054.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF", pszSpec="*.tar") returned 0 [0054.964] lstrlenA (lpString="*.tar") returned 5 [0054.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF", pszSpec="*.gzip") returned 0 [0054.964] lstrlenA (lpString="*.gzip") returned 6 [0054.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF", pszSpec="*.jpg") returned 0 [0054.964] lstrlenA (lpString="*.jpg") returned 5 [0054.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF", pszSpec="*.jpeg") returned 0 [0054.964] lstrlenA (lpString="*.jpeg") returned 6 [0054.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF", pszSpec="*.psd") returned 0 [0054.964] lstrlenA (lpString="*.psd") returned 5 [0054.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF", pszSpec="*.gif") returned 1 [0054.964] lstrlenA (lpString="*.gif") returned 5 [0054.964] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF" [0054.964] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF" [0054.964] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF." [0054.964] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF.wannacry" [0054.964] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14539_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.965] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5ab [0054.965] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xaa0af000, dwHighDateTime=0x1bd9367), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc906040, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xaa0af000, dwHighDateTime=0x1bd9367)) returned 1 [0054.965] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.965] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x52d, lpOverlapped=0x0) returned 1 [0054.966] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF") returned="BD14539_.GIF" [0054.966] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.966] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x52d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x52d, lpOverlapped=0x0) returned 1 [0054.967] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.967] CloseHandle (hObject=0x90) returned 1 [0054.967] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14539_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14539_.gif.wannacry")) returned 1 [0054.967] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a96b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84a96b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x25b, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14594_.GIF", cAlternateFileName="")) returned 1 [0054.967] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.967] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14594_.GIF") returned 1 [0054.967] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14594_.GIF") returned 1 [0054.967] lstrcmpiA (lpString1="", lpString2="BD14594_.GIF") returned -1 [0054.967] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF") returned="BD14539_.GIF" [0054.967] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0054.967] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0054.967] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0054.967] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0054.968] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD14594_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF" [0054.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF", pszSpec="*.zip") returned 0 [0054.968] lstrlenA (lpString="*.zip") returned 5 [0054.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF", pszSpec="*.rar") returned 0 [0054.968] lstrlenA (lpString="*.rar") returned 5 [0054.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF", pszSpec="*.7z") returned 0 [0054.968] lstrlenA (lpString="*.7z") returned 4 [0054.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF", pszSpec="*.tar") returned 0 [0054.968] lstrlenA (lpString="*.tar") returned 5 [0054.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF", pszSpec="*.gzip") returned 0 [0054.968] lstrlenA (lpString="*.gzip") returned 6 [0054.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF", pszSpec="*.jpg") returned 0 [0054.968] lstrlenA (lpString="*.jpg") returned 5 [0054.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF", pszSpec="*.jpeg") returned 0 [0054.968] lstrlenA (lpString="*.jpeg") returned 6 [0054.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF", pszSpec="*.psd") returned 0 [0054.968] lstrlenA (lpString="*.psd") returned 5 [0054.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF", pszSpec="*.gif") returned 1 [0054.968] lstrlenA (lpString="*.gif") returned 5 [0054.968] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF" [0054.968] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF" [0054.968] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF." [0054.968] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF.wannacry" [0054.968] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14594_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.969] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25b [0054.969] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84a96b00, dwHighDateTime=0x1bd8f90), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc952300, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84a96b00, dwHighDateTime=0x1bd8f90)) returned 1 [0054.969] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.969] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1dd, lpOverlapped=0x0) returned 1 [0054.970] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF") returned="BD14594_.GIF" [0054.970] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.970] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1dd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1dd, lpOverlapped=0x0) returned 1 [0054.970] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.970] CloseHandle (hObject=0x90) returned 1 [0054.970] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14594_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14594_.gif.wannacry")) returned 1 [0054.971] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a96b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84a96b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14595_.GIF", cAlternateFileName="")) returned 1 [0054.971] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.971] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14595_.GIF") returned 1 [0054.971] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14595_.GIF") returned 1 [0054.971] lstrcmpiA (lpString1="", lpString2="BD14595_.GIF") returned -1 [0054.971] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF") returned="BD14594_.GIF" [0054.971] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0054.972] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0054.972] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0054.972] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0054.972] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD14595_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF" [0054.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF", pszSpec="*.zip") returned 0 [0054.972] lstrlenA (lpString="*.zip") returned 5 [0054.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF", pszSpec="*.rar") returned 0 [0054.972] lstrlenA (lpString="*.rar") returned 5 [0054.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF", pszSpec="*.7z") returned 0 [0054.972] lstrlenA (lpString="*.7z") returned 4 [0054.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF", pszSpec="*.tar") returned 0 [0054.972] lstrlenA (lpString="*.tar") returned 5 [0054.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF", pszSpec="*.gzip") returned 0 [0054.972] lstrlenA (lpString="*.gzip") returned 6 [0054.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF", pszSpec="*.jpg") returned 0 [0054.972] lstrlenA (lpString="*.jpg") returned 5 [0054.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF", pszSpec="*.jpeg") returned 0 [0054.972] lstrlenA (lpString="*.jpeg") returned 6 [0054.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF", pszSpec="*.psd") returned 0 [0054.972] lstrlenA (lpString="*.psd") returned 5 [0054.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF", pszSpec="*.gif") returned 1 [0054.972] lstrlenA (lpString="*.gif") returned 5 [0054.972] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF" [0054.972] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF" [0054.972] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF." [0054.973] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF.wannacry" [0054.973] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14595_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.973] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d7 [0054.973] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84a96b00, dwHighDateTime=0x1bd8f90), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc952300, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84a96b00, dwHighDateTime=0x1bd8f90)) returned 1 [0054.973] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.973] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x159, lpOverlapped=0x0) returned 1 [0054.974] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF") returned="BD14595_.GIF" [0054.974] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.974] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x159, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x159, lpOverlapped=0x0) returned 1 [0054.974] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.975] CloseHandle (hObject=0x90) returned 1 [0054.975] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14595_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14595_.gif.wannacry")) returned 1 [0054.975] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe2ea600, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe2ea600, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x11c, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14677_.GIF", cAlternateFileName="")) returned 1 [0054.975] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.975] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14677_.GIF") returned 1 [0054.975] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14677_.GIF") returned 1 [0054.976] lstrcmpiA (lpString1="", lpString2="BD14677_.GIF") returned -1 [0054.976] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF") returned="BD14595_.GIF" [0054.976] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0054.976] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0054.976] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0054.976] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0054.976] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD14677_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF" [0054.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF", pszSpec="*.zip") returned 0 [0054.976] lstrlenA (lpString="*.zip") returned 5 [0054.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF", pszSpec="*.rar") returned 0 [0054.976] lstrlenA (lpString="*.rar") returned 5 [0054.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF", pszSpec="*.7z") returned 0 [0054.976] lstrlenA (lpString="*.7z") returned 4 [0054.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF", pszSpec="*.tar") returned 0 [0054.976] lstrlenA (lpString="*.tar") returned 5 [0054.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF", pszSpec="*.gzip") returned 0 [0054.976] lstrlenA (lpString="*.gzip") returned 6 [0054.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF", pszSpec="*.jpg") returned 0 [0054.976] lstrlenA (lpString="*.jpg") returned 5 [0054.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF", pszSpec="*.jpeg") returned 0 [0054.976] lstrlenA (lpString="*.jpeg") returned 6 [0054.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF", pszSpec="*.psd") returned 0 [0054.976] lstrlenA (lpString="*.psd") returned 5 [0054.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF", pszSpec="*.gif") returned 1 [0054.976] lstrlenA (lpString="*.gif") returned 5 [0054.977] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF" [0054.977] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF" [0054.977] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF." [0054.977] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF.wannacry" [0054.977] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14677_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.977] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11c [0054.977] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbe2ea600, dwHighDateTime=0x1bd8f91), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc952300, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbe2ea600, dwHighDateTime=0x1bd8f91)) returned 1 [0054.977] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.977] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x9e, lpOverlapped=0x0) returned 1 [0054.978] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF") returned="BD14677_.GIF" [0054.978] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.978] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x9e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x9e, lpOverlapped=0x0) returned 1 [0054.979] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.979] CloseHandle (hObject=0x90) returned 1 [0054.979] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14677_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14677_.gif.wannacry")) returned 1 [0054.979] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdadef00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcdadef00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14710_.GIF", cAlternateFileName="")) returned 1 [0054.979] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.979] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14710_.GIF") returned 1 [0054.980] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14710_.GIF") returned 1 [0054.980] lstrcmpiA (lpString1="", lpString2="BD14710_.GIF") returned -1 [0054.980] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF") returned="BD14677_.GIF" [0054.980] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0054.980] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0054.980] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0054.980] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0054.980] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD14710_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF" [0054.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF", pszSpec="*.zip") returned 0 [0054.980] lstrlenA (lpString="*.zip") returned 5 [0054.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF", pszSpec="*.rar") returned 0 [0054.980] lstrlenA (lpString="*.rar") returned 5 [0054.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF", pszSpec="*.7z") returned 0 [0054.980] lstrlenA (lpString="*.7z") returned 4 [0054.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF", pszSpec="*.tar") returned 0 [0054.980] lstrlenA (lpString="*.tar") returned 5 [0054.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF", pszSpec="*.gzip") returned 0 [0054.980] lstrlenA (lpString="*.gzip") returned 6 [0054.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF", pszSpec="*.jpg") returned 0 [0054.980] lstrlenA (lpString="*.jpg") returned 5 [0054.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF", pszSpec="*.jpeg") returned 0 [0054.980] lstrlenA (lpString="*.jpeg") returned 6 [0054.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF", pszSpec="*.psd") returned 0 [0054.980] lstrlenA (lpString="*.psd") returned 5 [0054.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF", pszSpec="*.gif") returned 1 [0054.981] lstrlenA (lpString="*.gif") returned 5 [0054.981] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF" [0054.981] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF" [0054.981] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF." [0054.981] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF.wannacry" [0054.981] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14710_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.981] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2fe [0054.981] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcdadef00, dwHighDateTime=0x1bd8f91), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc978460, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcdadef00, dwHighDateTime=0x1bd8f91)) returned 1 [0054.981] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.981] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x280, lpOverlapped=0x0) returned 1 [0054.983] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF") returned="BD14710_.GIF" [0054.983] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.983] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x280, lpOverlapped=0x0) returned 1 [0054.983] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.984] CloseHandle (hObject=0x90) returned 1 [0054.984] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14710_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14710_.gif.wannacry")) returned 1 [0054.984] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdadef00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcdadef00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xa97, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14711_.GIF", cAlternateFileName="")) returned 1 [0054.985] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.985] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14711_.GIF") returned 1 [0054.985] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14711_.GIF") returned 1 [0054.985] lstrcmpiA (lpString1="", lpString2="BD14711_.GIF") returned -1 [0054.985] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF") returned="BD14710_.GIF" [0054.985] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0054.985] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0054.985] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0054.985] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0054.985] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD14711_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF" [0054.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF", pszSpec="*.zip") returned 0 [0054.986] lstrlenA (lpString="*.zip") returned 5 [0054.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF", pszSpec="*.rar") returned 0 [0054.986] lstrlenA (lpString="*.rar") returned 5 [0054.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF", pszSpec="*.7z") returned 0 [0054.986] lstrlenA (lpString="*.7z") returned 4 [0054.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF", pszSpec="*.tar") returned 0 [0054.986] lstrlenA (lpString="*.tar") returned 5 [0054.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF", pszSpec="*.gzip") returned 0 [0054.986] lstrlenA (lpString="*.gzip") returned 6 [0054.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF", pszSpec="*.jpg") returned 0 [0054.986] lstrlenA (lpString="*.jpg") returned 5 [0054.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF", pszSpec="*.jpeg") returned 0 [0054.986] lstrlenA (lpString="*.jpeg") returned 6 [0054.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF", pszSpec="*.psd") returned 0 [0054.986] lstrlenA (lpString="*.psd") returned 5 [0054.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF", pszSpec="*.gif") returned 1 [0054.986] lstrlenA (lpString="*.gif") returned 5 [0054.986] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF" [0054.986] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF" [0054.986] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF." [0054.986] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF.wannacry" [0054.986] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14711_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.987] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa97 [0054.987] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcdadef00, dwHighDateTime=0x1bd8f91), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc978460, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcdadef00, dwHighDateTime=0x1bd8f91)) returned 1 [0054.987] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.987] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xa19, lpOverlapped=0x0) returned 1 [0054.989] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF") returned="BD14711_.GIF" [0054.989] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.989] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xa19, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xa19, lpOverlapped=0x0) returned 1 [0054.989] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.989] CloseHandle (hObject=0x90) returned 1 [0054.989] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14711_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14711_.gif.wannacry")) returned 1 [0054.990] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a26200, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf2a26200, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14768_.GIF", cAlternateFileName="")) returned 1 [0054.990] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.990] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14768_.GIF") returned 1 [0054.990] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14768_.GIF") returned 1 [0054.990] lstrcmpiA (lpString1="", lpString2="BD14768_.GIF") returned -1 [0054.990] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF") returned="BD14711_.GIF" [0054.990] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0054.990] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0054.990] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0054.990] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0054.990] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD14768_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF" [0054.990] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF", pszSpec="*.zip") returned 0 [0054.990] lstrlenA (lpString="*.zip") returned 5 [0054.991] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF", pszSpec="*.rar") returned 0 [0054.991] lstrlenA (lpString="*.rar") returned 5 [0054.991] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF", pszSpec="*.7z") returned 0 [0054.991] lstrlenA (lpString="*.7z") returned 4 [0054.991] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF", pszSpec="*.tar") returned 0 [0054.991] lstrlenA (lpString="*.tar") returned 5 [0054.991] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF", pszSpec="*.gzip") returned 0 [0054.991] lstrlenA (lpString="*.gzip") returned 6 [0054.991] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF", pszSpec="*.jpg") returned 0 [0054.991] lstrlenA (lpString="*.jpg") returned 5 [0054.991] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF", pszSpec="*.jpeg") returned 0 [0054.991] lstrlenA (lpString="*.jpeg") returned 6 [0054.991] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF", pszSpec="*.psd") returned 0 [0054.991] lstrlenA (lpString="*.psd") returned 5 [0054.991] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF", pszSpec="*.gif") returned 1 [0054.991] lstrlenA (lpString="*.gif") returned 5 [0054.991] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF" [0054.991] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF" [0054.991] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF." [0054.991] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF.wannacry" [0054.991] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14768_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.992] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a7 [0054.992] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf2a26200, dwHighDateTime=0x1bd8f91), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc99e5c0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf2a26200, dwHighDateTime=0x1bd8f91)) returned 1 [0054.992] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.992] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x129, lpOverlapped=0x0) returned 1 [0054.993] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF") returned="BD14768_.GIF" [0054.993] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.993] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x129, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x129, lpOverlapped=0x0) returned 1 [0054.993] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.994] CloseHandle (hObject=0x90) returned 1 [0054.994] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14768_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14768_.gif.wannacry")) returned 1 [0054.994] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a26200, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf2a26200, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14769_.GIF", cAlternateFileName="")) returned 1 [0054.994] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.994] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14769_.GIF") returned 1 [0054.994] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14769_.GIF") returned 1 [0054.995] lstrcmpiA (lpString1="", lpString2="BD14769_.GIF") returned -1 [0054.995] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF") returned="BD14768_.GIF" [0054.995] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0054.995] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0054.995] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0054.995] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0054.995] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD14769_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF" [0054.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF", pszSpec="*.zip") returned 0 [0054.995] lstrlenA (lpString="*.zip") returned 5 [0054.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF", pszSpec="*.rar") returned 0 [0054.995] lstrlenA (lpString="*.rar") returned 5 [0054.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF", pszSpec="*.7z") returned 0 [0054.995] lstrlenA (lpString="*.7z") returned 4 [0054.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF", pszSpec="*.tar") returned 0 [0054.995] lstrlenA (lpString="*.tar") returned 5 [0054.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF", pszSpec="*.gzip") returned 0 [0054.995] lstrlenA (lpString="*.gzip") returned 6 [0054.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF", pszSpec="*.jpg") returned 0 [0054.995] lstrlenA (lpString="*.jpg") returned 5 [0054.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF", pszSpec="*.jpeg") returned 0 [0054.995] lstrlenA (lpString="*.jpeg") returned 6 [0054.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF", pszSpec="*.psd") returned 0 [0054.995] lstrlenA (lpString="*.psd") returned 5 [0054.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF", pszSpec="*.gif") returned 1 [0054.995] lstrlenA (lpString="*.gif") returned 5 [0054.996] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF" [0054.996] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF" [0054.996] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF." [0054.996] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF.wannacry" [0054.996] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14769_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0054.996] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16a [0054.996] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf2a26200, dwHighDateTime=0x1bd8f91), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc99e5c0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf2a26200, dwHighDateTime=0x1bd8f91)) returned 1 [0054.996] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.996] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xec, lpOverlapped=0x0) returned 1 [0054.997] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF") returned="BD14769_.GIF" [0054.997] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0054.997] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xec, lpOverlapped=0x0) returned 1 [0054.998] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0054.998] CloseHandle (hObject=0x90) returned 1 [0054.998] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14769_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14769_.gif.wannacry")) returned 1 [0054.998] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0af000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa0af000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x1f3, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14800_.GIF", cAlternateFileName="")) returned 1 [0054.999] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0054.999] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14800_.GIF") returned 1 [0054.999] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14800_.GIF") returned 1 [0054.999] lstrcmpiA (lpString1="", lpString2="BD14800_.GIF") returned -1 [0054.999] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF") returned="BD14769_.GIF" [0054.999] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0054.999] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0054.999] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0054.999] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0054.999] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD14800_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF" [0054.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF", pszSpec="*.zip") returned 0 [0054.999] lstrlenA (lpString="*.zip") returned 5 [0054.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF", pszSpec="*.rar") returned 0 [0054.999] lstrlenA (lpString="*.rar") returned 5 [0054.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF", pszSpec="*.7z") returned 0 [0054.999] lstrlenA (lpString="*.7z") returned 4 [0054.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF", pszSpec="*.tar") returned 0 [0054.999] lstrlenA (lpString="*.tar") returned 5 [0054.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF", pszSpec="*.gzip") returned 0 [0054.999] lstrlenA (lpString="*.gzip") returned 6 [0054.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF", pszSpec="*.jpg") returned 0 [0054.999] lstrlenA (lpString="*.jpg") returned 5 [0054.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF", pszSpec="*.jpeg") returned 0 [0054.999] lstrlenA (lpString="*.jpeg") returned 6 [0055.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF", pszSpec="*.psd") returned 0 [0055.000] lstrlenA (lpString="*.psd") returned 5 [0055.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF", pszSpec="*.gif") returned 1 [0055.000] lstrlenA (lpString="*.gif") returned 5 [0055.000] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF" [0055.000] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF" [0055.000] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF." [0055.000] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF.wannacry" [0055.000] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14800_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.001] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f3 [0055.001] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xaa0af000, dwHighDateTime=0x1bd9367), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc9c4720, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xaa0af000, dwHighDateTime=0x1bd9367)) returned 1 [0055.001] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.001] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x175, lpOverlapped=0x0) returned 1 [0055.002] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF") returned="BD14800_.GIF" [0055.002] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.002] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x175, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x175, lpOverlapped=0x0) returned 1 [0055.002] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.002] CloseHandle (hObject=0x90) returned 1 [0055.002] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14800_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14800_.gif.wannacry")) returned 1 [0055.003] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0af000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa0af000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14801_.GIF", cAlternateFileName="")) returned 1 [0055.003] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.003] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14801_.GIF") returned 1 [0055.003] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14801_.GIF") returned 1 [0055.003] lstrcmpiA (lpString1="", lpString2="BD14801_.GIF") returned -1 [0055.003] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF") returned="BD14800_.GIF" [0055.003] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.003] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.003] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.004] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.004] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD14801_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF" [0055.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF", pszSpec="*.zip") returned 0 [0055.004] lstrlenA (lpString="*.zip") returned 5 [0055.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF", pszSpec="*.rar") returned 0 [0055.004] lstrlenA (lpString="*.rar") returned 5 [0055.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF", pszSpec="*.7z") returned 0 [0055.004] lstrlenA (lpString="*.7z") returned 4 [0055.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF", pszSpec="*.tar") returned 0 [0055.004] lstrlenA (lpString="*.tar") returned 5 [0055.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF", pszSpec="*.gzip") returned 0 [0055.004] lstrlenA (lpString="*.gzip") returned 6 [0055.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF", pszSpec="*.jpg") returned 0 [0055.004] lstrlenA (lpString="*.jpg") returned 5 [0055.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF", pszSpec="*.jpeg") returned 0 [0055.004] lstrlenA (lpString="*.jpeg") returned 6 [0055.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF", pszSpec="*.psd") returned 0 [0055.004] lstrlenA (lpString="*.psd") returned 5 [0055.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF", pszSpec="*.gif") returned 1 [0055.004] lstrlenA (lpString="*.gif") returned 5 [0055.004] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF" [0055.004] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF" [0055.004] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF." [0055.004] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF.wannacry" [0055.004] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14801_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.005] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x384 [0055.005] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xaa0af000, dwHighDateTime=0x1bd9367), lpLastAccessTime=0x407536*(dwLowDateTime=0xbc9ea880, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xaa0af000, dwHighDateTime=0x1bd9367)) returned 1 [0055.005] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.005] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x306, lpOverlapped=0x0) returned 1 [0055.007] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF") returned="BD14801_.GIF" [0055.007] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.007] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x306, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x306, lpOverlapped=0x0) returned 1 [0055.007] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.007] CloseHandle (hObject=0x90) returned 1 [0055.007] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14801_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14801_.gif.wannacry")) returned 1 [0055.008] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3e9a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf3e9a00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x13c, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14844_.GIF", cAlternateFileName="")) returned 1 [0055.008] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.008] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14844_.GIF") returned 1 [0055.008] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14844_.GIF") returned 1 [0055.008] lstrcmpiA (lpString1="", lpString2="BD14844_.GIF") returned -1 [0055.008] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF") returned="BD14801_.GIF" [0055.008] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.008] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.008] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.008] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.009] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD14844_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF" [0055.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF", pszSpec="*.zip") returned 0 [0055.009] lstrlenA (lpString="*.zip") returned 5 [0055.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF", pszSpec="*.rar") returned 0 [0055.009] lstrlenA (lpString="*.rar") returned 5 [0055.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF", pszSpec="*.7z") returned 0 [0055.009] lstrlenA (lpString="*.7z") returned 4 [0055.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF", pszSpec="*.tar") returned 0 [0055.009] lstrlenA (lpString="*.tar") returned 5 [0055.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF", pszSpec="*.gzip") returned 0 [0055.009] lstrlenA (lpString="*.gzip") returned 6 [0055.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF", pszSpec="*.jpg") returned 0 [0055.009] lstrlenA (lpString="*.jpg") returned 5 [0055.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF", pszSpec="*.jpeg") returned 0 [0055.009] lstrlenA (lpString="*.jpeg") returned 6 [0055.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF", pszSpec="*.psd") returned 0 [0055.009] lstrlenA (lpString="*.psd") returned 5 [0055.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF", pszSpec="*.gif") returned 1 [0055.009] lstrlenA (lpString="*.gif") returned 5 [0055.009] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF" [0055.009] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF" [0055.009] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF." [0055.009] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF.wannacry" [0055.009] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14844_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.010] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13c [0055.010] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf3e9a00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbca109e0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf3e9a00, dwHighDateTime=0x1bd8f92)) returned 1 [0055.010] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.010] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xbe, lpOverlapped=0x0) returned 1 [0055.011] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF") returned="BD14844_.GIF" [0055.011] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.011] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xbe, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xbe, lpOverlapped=0x0) returned 1 [0055.011] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.011] CloseHandle (hObject=0x90) returned 1 [0055.012] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14844_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14844_.gif.wannacry")) returned 1 [0055.012] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3e9a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf3e9a00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14845_.GIF", cAlternateFileName="")) returned 1 [0055.012] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.012] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14845_.GIF") returned 1 [0055.012] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14845_.GIF") returned 1 [0055.012] lstrcmpiA (lpString1="", lpString2="BD14845_.GIF") returned -1 [0055.012] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF") returned="BD14844_.GIF" [0055.012] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.012] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.013] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.013] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.013] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD14845_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF" [0055.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF", pszSpec="*.zip") returned 0 [0055.013] lstrlenA (lpString="*.zip") returned 5 [0055.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF", pszSpec="*.rar") returned 0 [0055.013] lstrlenA (lpString="*.rar") returned 5 [0055.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF", pszSpec="*.7z") returned 0 [0055.013] lstrlenA (lpString="*.7z") returned 4 [0055.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF", pszSpec="*.tar") returned 0 [0055.013] lstrlenA (lpString="*.tar") returned 5 [0055.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF", pszSpec="*.gzip") returned 0 [0055.013] lstrlenA (lpString="*.gzip") returned 6 [0055.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF", pszSpec="*.jpg") returned 0 [0055.013] lstrlenA (lpString="*.jpg") returned 5 [0055.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF", pszSpec="*.jpeg") returned 0 [0055.013] lstrlenA (lpString="*.jpeg") returned 6 [0055.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF", pszSpec="*.psd") returned 0 [0055.013] lstrlenA (lpString="*.psd") returned 5 [0055.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF", pszSpec="*.gif") returned 1 [0055.013] lstrlenA (lpString="*.gif") returned 5 [0055.013] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF" [0055.013] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF" [0055.013] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF." [0055.013] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF.wannacry" [0055.014] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14845_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.014] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x117 [0055.014] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf3e9a00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbca109e0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf3e9a00, dwHighDateTime=0x1bd8f92)) returned 1 [0055.014] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.014] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x99, lpOverlapped=0x0) returned 1 [0055.015] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF") returned="BD14845_.GIF" [0055.015] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.015] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x99, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x99, lpOverlapped=0x0) returned 1 [0055.015] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.016] CloseHandle (hObject=0x90) returned 1 [0055.016] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14845_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14845_.gif.wannacry")) returned 1 [0055.017] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ebde300, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1ebde300, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14882_.GIF", cAlternateFileName="")) returned 1 [0055.017] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.017] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14882_.GIF") returned 1 [0055.017] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14882_.GIF") returned 1 [0055.017] lstrcmpiA (lpString1="", lpString2="BD14882_.GIF") returned -1 [0055.017] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF") returned="BD14845_.GIF" [0055.017] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.017] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.017] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.017] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.017] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD14882_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF" [0055.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF", pszSpec="*.zip") returned 0 [0055.017] lstrlenA (lpString="*.zip") returned 5 [0055.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF", pszSpec="*.rar") returned 0 [0055.017] lstrlenA (lpString="*.rar") returned 5 [0055.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF", pszSpec="*.7z") returned 0 [0055.017] lstrlenA (lpString="*.7z") returned 4 [0055.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF", pszSpec="*.tar") returned 0 [0055.017] lstrlenA (lpString="*.tar") returned 5 [0055.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF", pszSpec="*.gzip") returned 0 [0055.017] lstrlenA (lpString="*.gzip") returned 6 [0055.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF", pszSpec="*.jpg") returned 0 [0055.017] lstrlenA (lpString="*.jpg") returned 5 [0055.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF", pszSpec="*.jpeg") returned 0 [0055.017] lstrlenA (lpString="*.jpeg") returned 6 [0055.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF", pszSpec="*.psd") returned 0 [0055.018] lstrlenA (lpString="*.psd") returned 5 [0055.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF", pszSpec="*.gif") returned 1 [0055.018] lstrlenA (lpString="*.gif") returned 5 [0055.018] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF" [0055.018] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF" [0055.018] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF." [0055.018] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF.wannacry" [0055.018] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14882_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.018] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17d [0055.018] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1ebde300, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbca36b40, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1ebde300, dwHighDateTime=0x1bd8f92)) returned 1 [0055.018] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.018] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xff, lpOverlapped=0x0) returned 1 [0055.020] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF") returned="BD14882_.GIF" [0055.020] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.020] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xff, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xff, lpOverlapped=0x0) returned 1 [0055.020] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.020] CloseHandle (hObject=0x90) returned 1 [0055.020] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14882_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14882_.gif.wannacry")) returned 1 [0055.021] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ebde300, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1ebde300, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14883_.GIF", cAlternateFileName="")) returned 1 [0055.021] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.021] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14883_.GIF") returned 1 [0055.021] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14883_.GIF") returned 1 [0055.021] lstrcmpiA (lpString1="", lpString2="BD14883_.GIF") returned -1 [0055.021] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF") returned="BD14882_.GIF" [0055.021] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.021] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.021] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.021] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.021] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD14883_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF" [0055.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF", pszSpec="*.zip") returned 0 [0055.021] lstrlenA (lpString="*.zip") returned 5 [0055.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF", pszSpec="*.rar") returned 0 [0055.021] lstrlenA (lpString="*.rar") returned 5 [0055.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF", pszSpec="*.7z") returned 0 [0055.021] lstrlenA (lpString="*.7z") returned 4 [0055.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF", pszSpec="*.tar") returned 0 [0055.021] lstrlenA (lpString="*.tar") returned 5 [0055.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF", pszSpec="*.gzip") returned 0 [0055.022] lstrlenA (lpString="*.gzip") returned 6 [0055.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF", pszSpec="*.jpg") returned 0 [0055.022] lstrlenA (lpString="*.jpg") returned 5 [0055.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF", pszSpec="*.jpeg") returned 0 [0055.022] lstrlenA (lpString="*.jpeg") returned 6 [0055.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF", pszSpec="*.psd") returned 0 [0055.022] lstrlenA (lpString="*.psd") returned 5 [0055.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF", pszSpec="*.gif") returned 1 [0055.022] lstrlenA (lpString="*.gif") returned 5 [0055.022] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF" [0055.022] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF" [0055.022] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF." [0055.022] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF.wannacry" [0055.022] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14883_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.022] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x144 [0055.023] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1ebde300, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbca36b40, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1ebde300, dwHighDateTime=0x1bd8f92)) returned 1 [0055.023] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.023] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xc6, lpOverlapped=0x0) returned 1 [0055.024] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF") returned="BD14883_.GIF" [0055.024] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.024] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xc6, lpOverlapped=0x0) returned 1 [0055.024] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.024] CloseHandle (hObject=0x90) returned 1 [0055.024] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14883_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14883_.gif.wannacry")) returned 1 [0055.025] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73615e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73615e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14996_.GIF", cAlternateFileName="")) returned 1 [0055.025] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.025] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14996_.GIF") returned 1 [0055.025] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14996_.GIF") returned 1 [0055.025] lstrcmpiA (lpString1="", lpString2="BD14996_.GIF") returned -1 [0055.025] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF") returned="BD14883_.GIF" [0055.025] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.025] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.025] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD14996_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF" [0055.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF", pszSpec="*.zip") returned 0 [0055.025] lstrlenA (lpString="*.zip") returned 5 [0055.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF", pszSpec="*.rar") returned 0 [0055.025] lstrlenA (lpString="*.rar") returned 5 [0055.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF", pszSpec="*.7z") returned 0 [0055.026] lstrlenA (lpString="*.7z") returned 4 [0055.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF", pszSpec="*.tar") returned 0 [0055.026] lstrlenA (lpString="*.tar") returned 5 [0055.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF", pszSpec="*.gzip") returned 0 [0055.026] lstrlenA (lpString="*.gzip") returned 6 [0055.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF", pszSpec="*.jpg") returned 0 [0055.026] lstrlenA (lpString="*.jpg") returned 5 [0055.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF", pszSpec="*.jpeg") returned 0 [0055.026] lstrlenA (lpString="*.jpeg") returned 6 [0055.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF", pszSpec="*.psd") returned 0 [0055.026] lstrlenA (lpString="*.psd") returned 5 [0055.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF", pszSpec="*.gif") returned 1 [0055.026] lstrlenA (lpString="*.gif") returned 5 [0055.026] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF" [0055.026] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF" [0055.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF." [0055.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF.wannacry" [0055.026] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14996_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.027] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d7 [0055.027] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x73615e00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbca5cca0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x73615e00, dwHighDateTime=0x1bd8f92)) returned 1 [0055.027] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.027] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x259, lpOverlapped=0x0) returned 1 [0055.029] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF") returned="BD14996_.GIF" [0055.029] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.030] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x259, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x259, lpOverlapped=0x0) returned 1 [0055.030] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.030] CloseHandle (hObject=0x90) returned 1 [0055.030] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14996_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14996_.gif.wannacry")) returned 1 [0055.032] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73615e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73615e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD14997_.GIF", cAlternateFileName="")) returned 1 [0055.032] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.032] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD14997_.GIF") returned 1 [0055.032] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD14997_.GIF") returned 1 [0055.032] lstrcmpiA (lpString1="", lpString2="BD14997_.GIF") returned -1 [0055.032] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF") returned="BD14996_.GIF" [0055.032] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.032] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.032] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.032] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.032] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD14997_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF" [0055.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF", pszSpec="*.zip") returned 0 [0055.033] lstrlenA (lpString="*.zip") returned 5 [0055.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF", pszSpec="*.rar") returned 0 [0055.033] lstrlenA (lpString="*.rar") returned 5 [0055.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF", pszSpec="*.7z") returned 0 [0055.033] lstrlenA (lpString="*.7z") returned 4 [0055.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF", pszSpec="*.tar") returned 0 [0055.033] lstrlenA (lpString="*.tar") returned 5 [0055.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF", pszSpec="*.gzip") returned 0 [0055.033] lstrlenA (lpString="*.gzip") returned 6 [0055.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF", pszSpec="*.jpg") returned 0 [0055.033] lstrlenA (lpString="*.jpg") returned 5 [0055.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF", pszSpec="*.jpeg") returned 0 [0055.033] lstrlenA (lpString="*.jpeg") returned 6 [0055.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF", pszSpec="*.psd") returned 0 [0055.033] lstrlenA (lpString="*.psd") returned 5 [0055.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF", pszSpec="*.gif") returned 1 [0055.033] lstrlenA (lpString="*.gif") returned 5 [0055.033] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF" [0055.033] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF" [0055.033] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF." [0055.033] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF.wannacry" [0055.033] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14997_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.034] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ae [0055.034] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x73615e00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbca5cca0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x73615e00, dwHighDateTime=0x1bd8f92)) returned 1 [0055.034] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.034] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x230, lpOverlapped=0x0) returned 1 [0055.035] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF") returned="BD14997_.GIF" [0055.035] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.035] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x230, lpOverlapped=0x0) returned 1 [0055.035] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.035] CloseHandle (hObject=0x90) returned 1 [0055.036] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14997_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14997_.gif.wannacry")) returned 1 [0055.037] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81af7a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81af7a00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x220, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15034_.GIF", cAlternateFileName="")) returned 1 [0055.037] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.037] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15034_.GIF") returned 1 [0055.037] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15034_.GIF") returned 1 [0055.037] lstrcmpiA (lpString1="", lpString2="BD15034_.GIF") returned -1 [0055.037] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF") returned="BD14997_.GIF" [0055.038] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.038] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.038] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.038] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.038] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD15034_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF" [0055.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF", pszSpec="*.zip") returned 0 [0055.038] lstrlenA (lpString="*.zip") returned 5 [0055.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF", pszSpec="*.rar") returned 0 [0055.038] lstrlenA (lpString="*.rar") returned 5 [0055.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF", pszSpec="*.7z") returned 0 [0055.038] lstrlenA (lpString="*.7z") returned 4 [0055.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF", pszSpec="*.tar") returned 0 [0055.038] lstrlenA (lpString="*.tar") returned 5 [0055.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF", pszSpec="*.gzip") returned 0 [0055.038] lstrlenA (lpString="*.gzip") returned 6 [0055.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF", pszSpec="*.jpg") returned 0 [0055.038] lstrlenA (lpString="*.jpg") returned 5 [0055.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF", pszSpec="*.jpeg") returned 0 [0055.038] lstrlenA (lpString="*.jpeg") returned 6 [0055.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF", pszSpec="*.psd") returned 0 [0055.038] lstrlenA (lpString="*.psd") returned 5 [0055.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF", pszSpec="*.gif") returned 1 [0055.038] lstrlenA (lpString="*.gif") returned 5 [0055.039] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF" [0055.039] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF" [0055.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF." [0055.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF.wannacry" [0055.039] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15034_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.039] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x220 [0055.039] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x81af7a00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbca82e00, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x81af7a00, dwHighDateTime=0x1bd8f92)) returned 1 [0055.039] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.039] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1a2, lpOverlapped=0x0) returned 1 [0055.040] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF") returned="BD15034_.GIF" [0055.040] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.041] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1a2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1a2, lpOverlapped=0x0) returned 1 [0055.041] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.041] CloseHandle (hObject=0x90) returned 1 [0055.041] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15034_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15034_.gif.wannacry")) returned 1 [0055.042] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81af7a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81af7a00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x16e, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15035_.GIF", cAlternateFileName="")) returned 1 [0055.042] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.042] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15035_.GIF") returned 1 [0055.042] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15035_.GIF") returned 1 [0055.042] lstrcmpiA (lpString1="", lpString2="BD15035_.GIF") returned -1 [0055.042] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF") returned="BD15034_.GIF" [0055.042] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.042] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.042] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.042] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.042] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD15035_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF" [0055.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF", pszSpec="*.zip") returned 0 [0055.042] lstrlenA (lpString="*.zip") returned 5 [0055.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF", pszSpec="*.rar") returned 0 [0055.042] lstrlenA (lpString="*.rar") returned 5 [0055.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF", pszSpec="*.7z") returned 0 [0055.042] lstrlenA (lpString="*.7z") returned 4 [0055.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF", pszSpec="*.tar") returned 0 [0055.042] lstrlenA (lpString="*.tar") returned 5 [0055.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF", pszSpec="*.gzip") returned 0 [0055.043] lstrlenA (lpString="*.gzip") returned 6 [0055.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF", pszSpec="*.jpg") returned 0 [0055.043] lstrlenA (lpString="*.jpg") returned 5 [0055.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF", pszSpec="*.jpeg") returned 0 [0055.043] lstrlenA (lpString="*.jpeg") returned 6 [0055.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF", pszSpec="*.psd") returned 0 [0055.043] lstrlenA (lpString="*.psd") returned 5 [0055.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF", pszSpec="*.gif") returned 1 [0055.043] lstrlenA (lpString="*.gif") returned 5 [0055.043] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF" [0055.043] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF" [0055.043] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF." [0055.043] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF.wannacry" [0055.043] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15035_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.043] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16e [0055.044] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x81af7a00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcaa8f60, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x81af7a00, dwHighDateTime=0x1bd8f92)) returned 1 [0055.044] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.044] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xf0, lpOverlapped=0x0) returned 1 [0055.045] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF") returned="BD15035_.GIF" [0055.045] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.045] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xf0, lpOverlapped=0x0) returned 1 [0055.045] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.045] CloseHandle (hObject=0x90) returned 1 [0055.045] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15035_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15035_.gif.wannacry")) returned 1 [0055.046] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9be95800, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9be95800, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15072_.GIF", cAlternateFileName="")) returned 1 [0055.046] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.046] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15072_.GIF") returned 1 [0055.046] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15072_.GIF") returned 1 [0055.046] lstrcmpiA (lpString1="", lpString2="BD15072_.GIF") returned -1 [0055.046] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF") returned="BD15035_.GIF" [0055.046] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.046] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.046] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.046] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.046] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD15072_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF" [0055.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF", pszSpec="*.zip") returned 0 [0055.047] lstrlenA (lpString="*.zip") returned 5 [0055.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF", pszSpec="*.rar") returned 0 [0055.047] lstrlenA (lpString="*.rar") returned 5 [0055.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF", pszSpec="*.7z") returned 0 [0055.047] lstrlenA (lpString="*.7z") returned 4 [0055.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF", pszSpec="*.tar") returned 0 [0055.047] lstrlenA (lpString="*.tar") returned 5 [0055.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF", pszSpec="*.gzip") returned 0 [0055.047] lstrlenA (lpString="*.gzip") returned 6 [0055.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF", pszSpec="*.jpg") returned 0 [0055.047] lstrlenA (lpString="*.jpg") returned 5 [0055.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF", pszSpec="*.jpeg") returned 0 [0055.047] lstrlenA (lpString="*.jpeg") returned 6 [0055.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF", pszSpec="*.psd") returned 0 [0055.047] lstrlenA (lpString="*.psd") returned 5 [0055.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF", pszSpec="*.gif") returned 1 [0055.047] lstrlenA (lpString="*.gif") returned 5 [0055.047] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF" [0055.048] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF" [0055.048] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF." [0055.048] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF.wannacry" [0055.048] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15072_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.048] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a7 [0055.048] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9be95800, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcacf0c0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9be95800, dwHighDateTime=0x1bd8f92)) returned 1 [0055.048] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.048] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x129, lpOverlapped=0x0) returned 1 [0055.049] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF") returned="BD15072_.GIF" [0055.049] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.050] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x129, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x129, lpOverlapped=0x0) returned 1 [0055.050] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.050] CloseHandle (hObject=0x90) returned 1 [0055.050] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15072_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15072_.gif.wannacry")) returned 1 [0055.051] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1a8500, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9d1a8500, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15073_.GIF", cAlternateFileName="")) returned 1 [0055.051] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.051] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15073_.GIF") returned 1 [0055.051] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15073_.GIF") returned 1 [0055.051] lstrcmpiA (lpString1="", lpString2="BD15073_.GIF") returned -1 [0055.051] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF") returned="BD15072_.GIF" [0055.051] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.051] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.051] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.051] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.051] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD15073_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF" [0055.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF", pszSpec="*.zip") returned 0 [0055.051] lstrlenA (lpString="*.zip") returned 5 [0055.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF", pszSpec="*.rar") returned 0 [0055.051] lstrlenA (lpString="*.rar") returned 5 [0055.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF", pszSpec="*.7z") returned 0 [0055.051] lstrlenA (lpString="*.7z") returned 4 [0055.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF", pszSpec="*.tar") returned 0 [0055.051] lstrlenA (lpString="*.tar") returned 5 [0055.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF", pszSpec="*.gzip") returned 0 [0055.051] lstrlenA (lpString="*.gzip") returned 6 [0055.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF", pszSpec="*.jpg") returned 0 [0055.052] lstrlenA (lpString="*.jpg") returned 5 [0055.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF", pszSpec="*.jpeg") returned 0 [0055.052] lstrlenA (lpString="*.jpeg") returned 6 [0055.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF", pszSpec="*.psd") returned 0 [0055.052] lstrlenA (lpString="*.psd") returned 5 [0055.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF", pszSpec="*.gif") returned 1 [0055.052] lstrlenA (lpString="*.gif") returned 5 [0055.052] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF" [0055.052] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF" [0055.052] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF." [0055.052] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF.wannacry" [0055.052] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15073_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.052] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x186 [0055.052] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9d1a8500, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcacf0c0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9d1a8500, dwHighDateTime=0x1bd8f92)) returned 1 [0055.053] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.053] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x108, lpOverlapped=0x0) returned 1 [0055.054] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF") returned="BD15073_.GIF" [0055.054] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.054] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x108, lpOverlapped=0x0) returned 1 [0055.054] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.054] CloseHandle (hObject=0x90) returned 1 [0055.054] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15073_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15073_.gif.wannacry")) returned 1 [0055.055] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab3c1d00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xab3c1d00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15155_.GIF", cAlternateFileName="")) returned 1 [0055.055] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.055] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15155_.GIF") returned 1 [0055.055] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15155_.GIF") returned 1 [0055.055] lstrcmpiA (lpString1="", lpString2="BD15155_.GIF") returned -1 [0055.055] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF") returned="BD15073_.GIF" [0055.055] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.055] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.055] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD15155_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF" [0055.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF", pszSpec="*.zip") returned 0 [0055.055] lstrlenA (lpString="*.zip") returned 5 [0055.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF", pszSpec="*.rar") returned 0 [0055.056] lstrlenA (lpString="*.rar") returned 5 [0055.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF", pszSpec="*.7z") returned 0 [0055.056] lstrlenA (lpString="*.7z") returned 4 [0055.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF", pszSpec="*.tar") returned 0 [0055.056] lstrlenA (lpString="*.tar") returned 5 [0055.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF", pszSpec="*.gzip") returned 0 [0055.056] lstrlenA (lpString="*.gzip") returned 6 [0055.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF", pszSpec="*.jpg") returned 0 [0055.056] lstrlenA (lpString="*.jpg") returned 5 [0055.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF", pszSpec="*.jpeg") returned 0 [0055.056] lstrlenA (lpString="*.jpeg") returned 6 [0055.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF", pszSpec="*.psd") returned 0 [0055.056] lstrlenA (lpString="*.psd") returned 5 [0055.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF", pszSpec="*.gif") returned 1 [0055.056] lstrlenA (lpString="*.gif") returned 5 [0055.056] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF" [0055.056] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF" [0055.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF." [0055.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF.wannacry" [0055.056] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15155_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.057] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x115 [0055.057] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xab3c1d00, dwHighDateTime=0x1bd9367), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcaf5220, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xab3c1d00, dwHighDateTime=0x1bd9367)) returned 1 [0055.057] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.057] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x97, lpOverlapped=0x0) returned 1 [0055.058] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF") returned="BD15155_.GIF" [0055.058] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.058] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x97, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x97, lpOverlapped=0x0) returned 1 [0055.058] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.058] CloseHandle (hObject=0x90) returned 1 [0055.058] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15155_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15155_.gif.wannacry")) returned 1 [0055.059] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab3c1d00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xab3c1d00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x143, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15156_.GIF", cAlternateFileName="")) returned 1 [0055.059] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.059] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15156_.GIF") returned 1 [0055.059] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15156_.GIF") returned 1 [0055.059] lstrcmpiA (lpString1="", lpString2="BD15156_.GIF") returned -1 [0055.059] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF") returned="BD15155_.GIF" [0055.059] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.059] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.059] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.059] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.060] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD15156_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF" [0055.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF", pszSpec="*.zip") returned 0 [0055.060] lstrlenA (lpString="*.zip") returned 5 [0055.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF", pszSpec="*.rar") returned 0 [0055.060] lstrlenA (lpString="*.rar") returned 5 [0055.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF", pszSpec="*.7z") returned 0 [0055.060] lstrlenA (lpString="*.7z") returned 4 [0055.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF", pszSpec="*.tar") returned 0 [0055.060] lstrlenA (lpString="*.tar") returned 5 [0055.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF", pszSpec="*.gzip") returned 0 [0055.060] lstrlenA (lpString="*.gzip") returned 6 [0055.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF", pszSpec="*.jpg") returned 0 [0055.060] lstrlenA (lpString="*.jpg") returned 5 [0055.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF", pszSpec="*.jpeg") returned 0 [0055.060] lstrlenA (lpString="*.jpeg") returned 6 [0055.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF", pszSpec="*.psd") returned 0 [0055.060] lstrlenA (lpString="*.psd") returned 5 [0055.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF", pszSpec="*.gif") returned 1 [0055.060] lstrlenA (lpString="*.gif") returned 5 [0055.060] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF" [0055.060] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF" [0055.060] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF." [0055.060] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF.wannacry" [0055.060] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15156_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.061] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x143 [0055.061] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xab3c1d00, dwHighDateTime=0x1bd9367), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcaf5220, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xab3c1d00, dwHighDateTime=0x1bd9367)) returned 1 [0055.061] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.061] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xc5, lpOverlapped=0x0) returned 1 [0055.062] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF") returned="BD15156_.GIF" [0055.062] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.062] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xc5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xc5, lpOverlapped=0x0) returned 1 [0055.062] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.066] CloseHandle (hObject=0x90) returned 1 [0055.066] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15156_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15156_.gif.wannacry")) returned 1 [0055.067] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f09b00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd3f09b00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15184_.GIF", cAlternateFileName="")) returned 1 [0055.067] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.067] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15184_.GIF") returned 1 [0055.067] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15184_.GIF") returned 1 [0055.067] lstrcmpiA (lpString1="", lpString2="BD15184_.GIF") returned -1 [0055.067] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF") returned="BD15156_.GIF" [0055.067] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.067] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.067] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.067] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.067] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD15184_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF" [0055.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF", pszSpec="*.zip") returned 0 [0055.067] lstrlenA (lpString="*.zip") returned 5 [0055.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF", pszSpec="*.rar") returned 0 [0055.067] lstrlenA (lpString="*.rar") returned 5 [0055.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF", pszSpec="*.7z") returned 0 [0055.068] lstrlenA (lpString="*.7z") returned 4 [0055.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF", pszSpec="*.tar") returned 0 [0055.068] lstrlenA (lpString="*.tar") returned 5 [0055.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF", pszSpec="*.gzip") returned 0 [0055.068] lstrlenA (lpString="*.gzip") returned 6 [0055.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF", pszSpec="*.jpg") returned 0 [0055.068] lstrlenA (lpString="*.jpg") returned 5 [0055.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF", pszSpec="*.jpeg") returned 0 [0055.068] lstrlenA (lpString="*.jpeg") returned 6 [0055.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF", pszSpec="*.psd") returned 0 [0055.068] lstrlenA (lpString="*.psd") returned 5 [0055.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF", pszSpec="*.gif") returned 1 [0055.068] lstrlenA (lpString="*.gif") returned 5 [0055.068] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF" [0055.068] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF" [0055.068] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF." [0055.068] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF.wannacry" [0055.068] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15184_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.069] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x482 [0055.069] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd3f09b00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcb1b380, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd3f09b00, dwHighDateTime=0x1bd8f92)) returned 1 [0055.069] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.069] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x404, lpOverlapped=0x0) returned 1 [0055.071] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF") returned="BD15184_.GIF" [0055.071] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.071] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x404, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x404, lpOverlapped=0x0) returned 1 [0055.071] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.071] CloseHandle (hObject=0x90) returned 1 [0055.071] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15184_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15184_.gif.wannacry")) returned 1 [0055.072] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f09b00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd3f09b00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15185_.GIF", cAlternateFileName="")) returned 1 [0055.072] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.072] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15185_.GIF") returned 1 [0055.072] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15185_.GIF") returned 1 [0055.072] lstrcmpiA (lpString1="", lpString2="BD15185_.GIF") returned -1 [0055.072] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF") returned="BD15184_.GIF" [0055.072] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.072] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.072] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.073] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.073] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD15185_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF" [0055.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF", pszSpec="*.zip") returned 0 [0055.073] lstrlenA (lpString="*.zip") returned 5 [0055.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF", pszSpec="*.rar") returned 0 [0055.073] lstrlenA (lpString="*.rar") returned 5 [0055.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF", pszSpec="*.7z") returned 0 [0055.073] lstrlenA (lpString="*.7z") returned 4 [0055.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF", pszSpec="*.tar") returned 0 [0055.073] lstrlenA (lpString="*.tar") returned 5 [0055.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF", pszSpec="*.gzip") returned 0 [0055.073] lstrlenA (lpString="*.gzip") returned 6 [0055.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF", pszSpec="*.jpg") returned 0 [0055.073] lstrlenA (lpString="*.jpg") returned 5 [0055.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF", pszSpec="*.jpeg") returned 0 [0055.073] lstrlenA (lpString="*.jpeg") returned 6 [0055.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF", pszSpec="*.psd") returned 0 [0055.073] lstrlenA (lpString="*.psd") returned 5 [0055.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF", pszSpec="*.gif") returned 1 [0055.073] lstrlenA (lpString="*.gif") returned 5 [0055.073] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF" [0055.073] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF" [0055.073] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF." [0055.073] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF.wannacry" [0055.074] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15185_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.074] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x482 [0055.074] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd3f09b00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcb1b380, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd3f09b00, dwHighDateTime=0x1bd8f92)) returned 1 [0055.074] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.074] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x404, lpOverlapped=0x0) returned 1 [0055.076] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF") returned="BD15185_.GIF" [0055.076] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.076] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x404, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x404, lpOverlapped=0x0) returned 1 [0055.076] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.077] CloseHandle (hObject=0x90) returned 1 [0055.077] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15185_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15185_.gif.wannacry")) returned 1 [0055.077] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac6d4a00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac6d4a00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15301_.GIF", cAlternateFileName="")) returned 1 [0055.077] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.077] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15301_.GIF") returned 1 [0055.077] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15301_.GIF") returned 1 [0055.078] lstrcmpiA (lpString1="", lpString2="BD15301_.GIF") returned -1 [0055.078] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF") returned="BD15185_.GIF" [0055.078] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.078] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.078] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.078] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.078] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD15301_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF" [0055.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF", pszSpec="*.zip") returned 0 [0055.078] lstrlenA (lpString="*.zip") returned 5 [0055.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF", pszSpec="*.rar") returned 0 [0055.078] lstrlenA (lpString="*.rar") returned 5 [0055.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF", pszSpec="*.7z") returned 0 [0055.078] lstrlenA (lpString="*.7z") returned 4 [0055.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF", pszSpec="*.tar") returned 0 [0055.078] lstrlenA (lpString="*.tar") returned 5 [0055.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF", pszSpec="*.gzip") returned 0 [0055.078] lstrlenA (lpString="*.gzip") returned 6 [0055.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF", pszSpec="*.jpg") returned 0 [0055.079] lstrlenA (lpString="*.jpg") returned 5 [0055.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF", pszSpec="*.jpeg") returned 0 [0055.079] lstrlenA (lpString="*.jpeg") returned 6 [0055.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF", pszSpec="*.psd") returned 0 [0055.079] lstrlenA (lpString="*.psd") returned 5 [0055.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF", pszSpec="*.gif") returned 1 [0055.079] lstrlenA (lpString="*.gif") returned 5 [0055.079] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF" [0055.079] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF" [0055.079] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF." [0055.079] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF.wannacry" [0055.079] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15301_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.079] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2fe [0055.079] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xac6d4a00, dwHighDateTime=0x1bd9367), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcb414e0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xac6d4a00, dwHighDateTime=0x1bd9367)) returned 1 [0055.080] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.080] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x280, lpOverlapped=0x0) returned 1 [0055.081] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF") returned="BD15301_.GIF" [0055.081] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.081] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x280, lpOverlapped=0x0) returned 1 [0055.082] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.082] CloseHandle (hObject=0x90) returned 1 [0055.082] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15301_.gif.wannacry")) returned 1 [0055.083] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7332a00, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7332a00, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD15302_.GIF", cAlternateFileName="")) returned 1 [0055.083] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.083] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD15302_.GIF") returned 1 [0055.083] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD15302_.GIF") returned 1 [0055.083] lstrcmpiA (lpString1="", lpString2="BD15302_.GIF") returned -1 [0055.083] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF") returned="BD15301_.GIF" [0055.083] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.083] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.083] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.083] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.083] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD15302_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF" [0055.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF", pszSpec="*.zip") returned 0 [0055.083] lstrlenA (lpString="*.zip") returned 5 [0055.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF", pszSpec="*.rar") returned 0 [0055.083] lstrlenA (lpString="*.rar") returned 5 [0055.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF", pszSpec="*.7z") returned 0 [0055.083] lstrlenA (lpString="*.7z") returned 4 [0055.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF", pszSpec="*.tar") returned 0 [0055.083] lstrlenA (lpString="*.tar") returned 5 [0055.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF", pszSpec="*.gzip") returned 0 [0055.083] lstrlenA (lpString="*.gzip") returned 6 [0055.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF", pszSpec="*.jpg") returned 0 [0055.084] lstrlenA (lpString="*.jpg") returned 5 [0055.084] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF", pszSpec="*.jpeg") returned 0 [0055.084] lstrlenA (lpString="*.jpeg") returned 6 [0055.084] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF", pszSpec="*.psd") returned 0 [0055.084] lstrlenA (lpString="*.psd") returned 5 [0055.084] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF", pszSpec="*.gif") returned 1 [0055.084] lstrlenA (lpString="*.gif") returned 5 [0055.084] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF" [0055.084] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF" [0055.084] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF." [0055.084] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF.wannacry" [0055.084] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15302_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.084] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ba [0055.084] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7332a00, dwHighDateTime=0x1bd8f93), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcb414e0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7332a00, dwHighDateTime=0x1bd8f93)) returned 1 [0055.084] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.085] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x13c, lpOverlapped=0x0) returned 1 [0055.086] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF") returned="BD15302_.GIF" [0055.086] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.086] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x13c, lpOverlapped=0x0) returned 1 [0055.086] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.086] CloseHandle (hObject=0x90) returned 1 [0055.086] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15302_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15302_.gif.wannacry")) returned 1 [0055.087] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e24d100, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4e24d100, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21303_.GIF", cAlternateFileName="")) returned 1 [0055.087] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.087] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21303_.GIF") returned 1 [0055.087] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21303_.GIF") returned 1 [0055.087] lstrcmpiA (lpString1="", lpString2="BD21303_.GIF") returned -1 [0055.087] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF") returned="BD15302_.GIF" [0055.087] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.087] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.087] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.087] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.087] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21303_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF" [0055.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF", pszSpec="*.zip") returned 0 [0055.087] lstrlenA (lpString="*.zip") returned 5 [0055.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF", pszSpec="*.rar") returned 0 [0055.087] lstrlenA (lpString="*.rar") returned 5 [0055.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF", pszSpec="*.7z") returned 0 [0055.087] lstrlenA (lpString="*.7z") returned 4 [0055.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF", pszSpec="*.tar") returned 0 [0055.088] lstrlenA (lpString="*.tar") returned 5 [0055.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF", pszSpec="*.gzip") returned 0 [0055.088] lstrlenA (lpString="*.gzip") returned 6 [0055.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF", pszSpec="*.jpg") returned 0 [0055.088] lstrlenA (lpString="*.jpg") returned 5 [0055.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF", pszSpec="*.jpeg") returned 0 [0055.088] lstrlenA (lpString="*.jpeg") returned 6 [0055.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF", pszSpec="*.psd") returned 0 [0055.088] lstrlenA (lpString="*.psd") returned 5 [0055.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF", pszSpec="*.gif") returned 1 [0055.088] lstrlenA (lpString="*.gif") returned 5 [0055.088] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF" [0055.088] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF" [0055.088] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF." [0055.088] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF.wannacry" [0055.088] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21303_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.088] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb04 [0055.089] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4e24d100, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcd306c0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4e24d100, dwHighDateTime=0x1bd4d50)) returned 1 [0055.089] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.089] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xa86, lpOverlapped=0x0) returned 1 [0055.091] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF") returned="BD21303_.GIF" [0055.091] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.091] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xa86, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xa86, lpOverlapped=0x0) returned 1 [0055.091] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.091] CloseHandle (hObject=0x90) returned 1 [0055.091] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21303_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21303_.gif.wannacry")) returned 1 [0055.092] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0150b00, ftCreationTime.dwHighDateTime=0x1bd4f54, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf0150b00, ftLastWriteTime.dwHighDateTime=0x1bd4f54, nFileSizeHigh=0x0, nFileSizeLow=0x616, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21305_.GIF", cAlternateFileName="")) returned 1 [0055.092] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.092] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21305_.GIF") returned 1 [0055.092] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21305_.GIF") returned 1 [0055.092] lstrcmpiA (lpString1="", lpString2="BD21305_.GIF") returned -1 [0055.092] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF") returned="BD21303_.GIF" [0055.092] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.092] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.092] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.092] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.092] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21305_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF" [0055.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF", pszSpec="*.zip") returned 0 [0055.092] lstrlenA (lpString="*.zip") returned 5 [0055.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF", pszSpec="*.rar") returned 0 [0055.092] lstrlenA (lpString="*.rar") returned 5 [0055.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF", pszSpec="*.7z") returned 0 [0055.092] lstrlenA (lpString="*.7z") returned 4 [0055.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF", pszSpec="*.tar") returned 0 [0055.093] lstrlenA (lpString="*.tar") returned 5 [0055.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF", pszSpec="*.gzip") returned 0 [0055.093] lstrlenA (lpString="*.gzip") returned 6 [0055.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF", pszSpec="*.jpg") returned 0 [0055.093] lstrlenA (lpString="*.jpg") returned 5 [0055.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF", pszSpec="*.jpeg") returned 0 [0055.093] lstrlenA (lpString="*.jpeg") returned 6 [0055.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF", pszSpec="*.psd") returned 0 [0055.093] lstrlenA (lpString="*.psd") returned 5 [0055.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF", pszSpec="*.gif") returned 1 [0055.093] lstrlenA (lpString="*.gif") returned 5 [0055.093] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF" [0055.093] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF" [0055.093] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF." [0055.093] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF.wannacry" [0055.093] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21305_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.093] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x616 [0055.094] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf0150b00, dwHighDateTime=0x1bd4f54), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcd306c0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf0150b00, dwHighDateTime=0x1bd4f54)) returned 1 [0055.094] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.094] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x598, lpOverlapped=0x0) returned 1 [0055.097] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF") returned="BD21305_.GIF" [0055.097] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.097] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x598, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x598, lpOverlapped=0x0) returned 1 [0055.097] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.097] CloseHandle (hObject=0x90) returned 1 [0055.097] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21305_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21305_.gif.wannacry")) returned 1 [0055.098] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf17ca00, ftCreationTime.dwHighDateTime=0x1bd4f53, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf17ca00, ftLastWriteTime.dwHighDateTime=0x1bd4f53, nFileSizeHigh=0x0, nFileSizeLow=0x328, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21307_.GIF", cAlternateFileName="")) returned 1 [0055.098] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.098] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21307_.GIF") returned 1 [0055.098] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21307_.GIF") returned 1 [0055.098] lstrcmpiA (lpString1="", lpString2="BD21307_.GIF") returned -1 [0055.098] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF") returned="BD21305_.GIF" [0055.098] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.098] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.099] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.099] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.099] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21307_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF" [0055.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF", pszSpec="*.zip") returned 0 [0055.099] lstrlenA (lpString="*.zip") returned 5 [0055.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF", pszSpec="*.rar") returned 0 [0055.099] lstrlenA (lpString="*.rar") returned 5 [0055.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF", pszSpec="*.7z") returned 0 [0055.099] lstrlenA (lpString="*.7z") returned 4 [0055.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF", pszSpec="*.tar") returned 0 [0055.099] lstrlenA (lpString="*.tar") returned 5 [0055.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF", pszSpec="*.gzip") returned 0 [0055.099] lstrlenA (lpString="*.gzip") returned 6 [0055.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF", pszSpec="*.jpg") returned 0 [0055.099] lstrlenA (lpString="*.jpg") returned 5 [0055.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF", pszSpec="*.jpeg") returned 0 [0055.099] lstrlenA (lpString="*.jpeg") returned 6 [0055.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF", pszSpec="*.psd") returned 0 [0055.099] lstrlenA (lpString="*.psd") returned 5 [0055.099] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF", pszSpec="*.gif") returned 1 [0055.099] lstrlenA (lpString="*.gif") returned 5 [0055.099] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF" [0055.099] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF" [0055.099] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF." [0055.100] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF.wannacry" [0055.100] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21307_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.100] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x328 [0055.100] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xdf17ca00, dwHighDateTime=0x1bd4f53), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcd56820, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xdf17ca00, dwHighDateTime=0x1bd4f53)) returned 1 [0055.100] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.100] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2aa, lpOverlapped=0x0) returned 1 [0055.102] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF") returned="BD21307_.GIF" [0055.102] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.102] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2aa, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2aa, lpOverlapped=0x0) returned 1 [0055.102] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.102] CloseHandle (hObject=0x90) returned 1 [0055.102] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21307_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21307_.gif.wannacry")) returned 1 [0055.103] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56009300, ftCreationTime.dwHighDateTime=0x1bd4f53, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x56009300, ftLastWriteTime.dwHighDateTime=0x1bd4f53, nFileSizeHigh=0x0, nFileSizeLow=0xd1d, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21309_.GIF", cAlternateFileName="")) returned 1 [0055.103] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.103] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21309_.GIF") returned 1 [0055.103] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21309_.GIF") returned 1 [0055.103] lstrcmpiA (lpString1="", lpString2="BD21309_.GIF") returned -1 [0055.103] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF") returned="BD21307_.GIF" [0055.103] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.103] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.103] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.103] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.103] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21309_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF" [0055.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF", pszSpec="*.zip") returned 0 [0055.104] lstrlenA (lpString="*.zip") returned 5 [0055.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF", pszSpec="*.rar") returned 0 [0055.104] lstrlenA (lpString="*.rar") returned 5 [0055.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF", pszSpec="*.7z") returned 0 [0055.104] lstrlenA (lpString="*.7z") returned 4 [0055.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF", pszSpec="*.tar") returned 0 [0055.104] lstrlenA (lpString="*.tar") returned 5 [0055.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF", pszSpec="*.gzip") returned 0 [0055.104] lstrlenA (lpString="*.gzip") returned 6 [0055.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF", pszSpec="*.jpg") returned 0 [0055.104] lstrlenA (lpString="*.jpg") returned 5 [0055.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF", pszSpec="*.jpeg") returned 0 [0055.104] lstrlenA (lpString="*.jpeg") returned 6 [0055.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF", pszSpec="*.psd") returned 0 [0055.104] lstrlenA (lpString="*.psd") returned 5 [0055.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF", pszSpec="*.gif") returned 1 [0055.104] lstrlenA (lpString="*.gif") returned 5 [0055.104] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF" [0055.104] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF" [0055.104] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF." [0055.104] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF.wannacry" [0055.104] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21309_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.105] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd1d [0055.105] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x56009300, dwHighDateTime=0x1bd4f53), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcd56820, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x56009300, dwHighDateTime=0x1bd4f53)) returned 1 [0055.105] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.105] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xc9f, lpOverlapped=0x0) returned 1 [0055.107] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF") returned="BD21309_.GIF" [0055.107] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.107] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xc9f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xc9f, lpOverlapped=0x0) returned 1 [0055.107] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.107] CloseHandle (hObject=0x90) returned 1 [0055.108] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21309_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21309_.gif.wannacry")) returned 1 [0055.108] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d745b00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3d745b00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x901, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21311_.GIF", cAlternateFileName="")) returned 1 [0055.108] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.108] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21311_.GIF") returned 1 [0055.108] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21311_.GIF") returned 1 [0055.108] lstrcmpiA (lpString1="", lpString2="BD21311_.GIF") returned -1 [0055.108] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF") returned="BD21309_.GIF" [0055.109] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.109] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.109] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.109] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.109] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21311_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF" [0055.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF", pszSpec="*.zip") returned 0 [0055.109] lstrlenA (lpString="*.zip") returned 5 [0055.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF", pszSpec="*.rar") returned 0 [0055.109] lstrlenA (lpString="*.rar") returned 5 [0055.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF", pszSpec="*.7z") returned 0 [0055.109] lstrlenA (lpString="*.7z") returned 4 [0055.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF", pszSpec="*.tar") returned 0 [0055.109] lstrlenA (lpString="*.tar") returned 5 [0055.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF", pszSpec="*.gzip") returned 0 [0055.109] lstrlenA (lpString="*.gzip") returned 6 [0055.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF", pszSpec="*.jpg") returned 0 [0055.110] lstrlenA (lpString="*.jpg") returned 5 [0055.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF", pszSpec="*.jpeg") returned 0 [0055.110] lstrlenA (lpString="*.jpeg") returned 6 [0055.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF", pszSpec="*.psd") returned 0 [0055.110] lstrlenA (lpString="*.psd") returned 5 [0055.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF", pszSpec="*.gif") returned 1 [0055.110] lstrlenA (lpString="*.gif") returned 5 [0055.110] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF" [0055.110] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF" [0055.110] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF." [0055.110] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF.wannacry" [0055.110] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21311_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.110] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x901 [0055.110] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3d745b00, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcd56820, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3d745b00, dwHighDateTime=0x1bd4d50)) returned 1 [0055.110] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.111] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x883, lpOverlapped=0x0) returned 1 [0055.112] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF") returned="BD21311_.GIF" [0055.112] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.113] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x883, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x883, lpOverlapped=0x0) returned 1 [0055.113] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.113] CloseHandle (hObject=0x90) returned 1 [0055.113] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21311_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21311_.gif.wannacry")) returned 1 [0055.114] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b120100, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3b120100, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x1a15, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21313_.GIF", cAlternateFileName="")) returned 1 [0055.114] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.114] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21313_.GIF") returned 1 [0055.114] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21313_.GIF") returned 1 [0055.114] lstrcmpiA (lpString1="", lpString2="BD21313_.GIF") returned -1 [0055.114] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF") returned="BD21311_.GIF" [0055.114] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.114] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.114] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.114] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.114] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21313_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF" [0055.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF", pszSpec="*.zip") returned 0 [0055.114] lstrlenA (lpString="*.zip") returned 5 [0055.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF", pszSpec="*.rar") returned 0 [0055.114] lstrlenA (lpString="*.rar") returned 5 [0055.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF", pszSpec="*.7z") returned 0 [0055.115] lstrlenA (lpString="*.7z") returned 4 [0055.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF", pszSpec="*.tar") returned 0 [0055.115] lstrlenA (lpString="*.tar") returned 5 [0055.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF", pszSpec="*.gzip") returned 0 [0055.115] lstrlenA (lpString="*.gzip") returned 6 [0055.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF", pszSpec="*.jpg") returned 0 [0055.115] lstrlenA (lpString="*.jpg") returned 5 [0055.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF", pszSpec="*.jpeg") returned 0 [0055.115] lstrlenA (lpString="*.jpeg") returned 6 [0055.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF", pszSpec="*.psd") returned 0 [0055.115] lstrlenA (lpString="*.psd") returned 5 [0055.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF", pszSpec="*.gif") returned 1 [0055.115] lstrlenA (lpString="*.gif") returned 5 [0055.115] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF" [0055.115] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF" [0055.115] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF." [0055.115] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF.wannacry" [0055.115] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21313_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.116] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a15 [0055.116] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3b120100, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcd7c980, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3b120100, dwHighDateTime=0x1bd4d50)) returned 1 [0055.116] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.116] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1997, lpOverlapped=0x0) returned 1 [0055.118] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF") returned="BD21313_.GIF" [0055.118] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.118] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1997, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1997, lpOverlapped=0x0) returned 1 [0055.118] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.118] CloseHandle (hObject=0x90) returned 1 [0055.119] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21313_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21313_.gif.wannacry")) returned 1 [0055.119] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x364d4d00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x364d4d00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21315_.GIF", cAlternateFileName="")) returned 1 [0055.119] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.119] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21315_.GIF") returned 1 [0055.119] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21315_.GIF") returned 1 [0055.119] lstrcmpiA (lpString1="", lpString2="BD21315_.GIF") returned -1 [0055.119] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF") returned="BD21313_.GIF" [0055.120] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.120] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.120] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.120] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.120] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21315_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF" [0055.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF", pszSpec="*.zip") returned 0 [0055.120] lstrlenA (lpString="*.zip") returned 5 [0055.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF", pszSpec="*.rar") returned 0 [0055.120] lstrlenA (lpString="*.rar") returned 5 [0055.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF", pszSpec="*.7z") returned 0 [0055.120] lstrlenA (lpString="*.7z") returned 4 [0055.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF", pszSpec="*.tar") returned 0 [0055.120] lstrlenA (lpString="*.tar") returned 5 [0055.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF", pszSpec="*.gzip") returned 0 [0055.120] lstrlenA (lpString="*.gzip") returned 6 [0055.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF", pszSpec="*.jpg") returned 0 [0055.120] lstrlenA (lpString="*.jpg") returned 5 [0055.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF", pszSpec="*.jpeg") returned 0 [0055.120] lstrlenA (lpString="*.jpeg") returned 6 [0055.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF", pszSpec="*.psd") returned 0 [0055.120] lstrlenA (lpString="*.psd") returned 5 [0055.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF", pszSpec="*.gif") returned 1 [0055.120] lstrlenA (lpString="*.gif") returned 5 [0055.120] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF" [0055.121] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF" [0055.121] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF." [0055.121] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF.wannacry" [0055.121] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21315_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.121] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x148 [0055.121] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x364d4d00, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcd7c980, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x364d4d00, dwHighDateTime=0x1bd4d50)) returned 1 [0055.121] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.121] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xca, lpOverlapped=0x0) returned 1 [0055.122] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF") returned="BD21315_.GIF" [0055.122] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.122] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xca, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xca, lpOverlapped=0x0) returned 1 [0055.123] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.123] CloseHandle (hObject=0x90) returned 1 [0055.123] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21315_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21315_.gif.wannacry")) returned 1 [0055.124] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb568300, ftCreationTime.dwHighDateTime=0x1bd4f57, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbb568300, ftLastWriteTime.dwHighDateTime=0x1bd4f57, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21318_.GIF", cAlternateFileName="")) returned 1 [0055.124] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.124] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21318_.GIF") returned 1 [0055.124] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21318_.GIF") returned 1 [0055.124] lstrcmpiA (lpString1="", lpString2="BD21318_.GIF") returned -1 [0055.124] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF") returned="BD21315_.GIF" [0055.124] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.124] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.124] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.124] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.124] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21318_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF" [0055.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF", pszSpec="*.zip") returned 0 [0055.124] lstrlenA (lpString="*.zip") returned 5 [0055.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF", pszSpec="*.rar") returned 0 [0055.124] lstrlenA (lpString="*.rar") returned 5 [0055.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF", pszSpec="*.7z") returned 0 [0055.124] lstrlenA (lpString="*.7z") returned 4 [0055.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF", pszSpec="*.tar") returned 0 [0055.124] lstrlenA (lpString="*.tar") returned 5 [0055.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF", pszSpec="*.gzip") returned 0 [0055.124] lstrlenA (lpString="*.gzip") returned 6 [0055.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF", pszSpec="*.jpg") returned 0 [0055.124] lstrlenA (lpString="*.jpg") returned 5 [0055.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF", pszSpec="*.jpeg") returned 0 [0055.125] lstrlenA (lpString="*.jpeg") returned 6 [0055.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF", pszSpec="*.psd") returned 0 [0055.125] lstrlenA (lpString="*.psd") returned 5 [0055.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF", pszSpec="*.gif") returned 1 [0055.125] lstrlenA (lpString="*.gif") returned 5 [0055.125] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF" [0055.125] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF" [0055.125] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF." [0055.125] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF.wannacry" [0055.125] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21318_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.125] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11e [0055.125] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbb568300, dwHighDateTime=0x1bd4f57), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcd7c980, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbb568300, dwHighDateTime=0x1bd4f57)) returned 1 [0055.126] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.126] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xa0, lpOverlapped=0x0) returned 1 [0055.127] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF") returned="BD21318_.GIF" [0055.127] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.127] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xa0, lpOverlapped=0x0) returned 1 [0055.127] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.127] CloseHandle (hObject=0x90) returned 1 [0055.127] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21318_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21318_.gif.wannacry")) returned 1 [0055.130] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7128600, ftCreationTime.dwHighDateTime=0x1bd4f57, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa7128600, ftLastWriteTime.dwHighDateTime=0x1bd4f57, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21319_.GIF", cAlternateFileName="")) returned 1 [0055.130] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.130] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21319_.GIF") returned 1 [0055.130] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21319_.GIF") returned 1 [0055.130] lstrcmpiA (lpString1="", lpString2="BD21319_.GIF") returned -1 [0055.130] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF") returned="BD21318_.GIF" [0055.130] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.130] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.130] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.130] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.131] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21319_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF" [0055.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF", pszSpec="*.zip") returned 0 [0055.131] lstrlenA (lpString="*.zip") returned 5 [0055.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF", pszSpec="*.rar") returned 0 [0055.131] lstrlenA (lpString="*.rar") returned 5 [0055.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF", pszSpec="*.7z") returned 0 [0055.131] lstrlenA (lpString="*.7z") returned 4 [0055.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF", pszSpec="*.tar") returned 0 [0055.131] lstrlenA (lpString="*.tar") returned 5 [0055.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF", pszSpec="*.gzip") returned 0 [0055.131] lstrlenA (lpString="*.gzip") returned 6 [0055.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF", pszSpec="*.jpg") returned 0 [0055.131] lstrlenA (lpString="*.jpg") returned 5 [0055.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF", pszSpec="*.jpeg") returned 0 [0055.131] lstrlenA (lpString="*.jpeg") returned 6 [0055.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF", pszSpec="*.psd") returned 0 [0055.131] lstrlenA (lpString="*.psd") returned 5 [0055.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF", pszSpec="*.gif") returned 1 [0055.131] lstrlenA (lpString="*.gif") returned 5 [0055.131] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF" [0055.131] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF" [0055.131] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF." [0055.131] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF.wannacry" [0055.131] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21319_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.133] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x193 [0055.133] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa7128600, dwHighDateTime=0x1bd4f57), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcd7c980, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa7128600, dwHighDateTime=0x1bd4f57)) returned 1 [0055.133] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.133] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x115, lpOverlapped=0x0) returned 1 [0055.134] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF") returned="BD21319_.GIF" [0055.134] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.134] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x115, lpOverlapped=0x0) returned 1 [0055.134] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.134] CloseHandle (hObject=0x90) returned 1 [0055.134] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21319_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21319_.gif.wannacry")) returned 1 [0055.135] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97933d00, ftCreationTime.dwHighDateTime=0x1bd4f57, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x97933d00, ftLastWriteTime.dwHighDateTime=0x1bd4f57, nFileSizeHigh=0x0, nFileSizeLow=0x664, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21320_.GIF", cAlternateFileName="")) returned 1 [0055.135] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.135] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21320_.GIF") returned 1 [0055.135] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21320_.GIF") returned 1 [0055.135] lstrcmpiA (lpString1="", lpString2="BD21320_.GIF") returned -1 [0055.135] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF") returned="BD21319_.GIF" [0055.135] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.135] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.135] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.135] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.136] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21320_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF" [0055.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF", pszSpec="*.zip") returned 0 [0055.136] lstrlenA (lpString="*.zip") returned 5 [0055.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF", pszSpec="*.rar") returned 0 [0055.136] lstrlenA (lpString="*.rar") returned 5 [0055.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF", pszSpec="*.7z") returned 0 [0055.136] lstrlenA (lpString="*.7z") returned 4 [0055.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF", pszSpec="*.tar") returned 0 [0055.136] lstrlenA (lpString="*.tar") returned 5 [0055.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF", pszSpec="*.gzip") returned 0 [0055.136] lstrlenA (lpString="*.gzip") returned 6 [0055.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF", pszSpec="*.jpg") returned 0 [0055.136] lstrlenA (lpString="*.jpg") returned 5 [0055.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF", pszSpec="*.jpeg") returned 0 [0055.136] lstrlenA (lpString="*.jpeg") returned 6 [0055.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF", pszSpec="*.psd") returned 0 [0055.136] lstrlenA (lpString="*.psd") returned 5 [0055.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF", pszSpec="*.gif") returned 1 [0055.136] lstrlenA (lpString="*.gif") returned 5 [0055.136] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF" [0055.136] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF" [0055.136] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF." [0055.136] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF.wannacry" [0055.136] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21320_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.137] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x664 [0055.137] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x97933d00, dwHighDateTime=0x1bd4f57), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcd7c980, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x97933d00, dwHighDateTime=0x1bd4f57)) returned 1 [0055.137] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.137] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x5e6, lpOverlapped=0x0) returned 1 [0055.139] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF") returned="BD21320_.GIF" [0055.139] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.139] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x5e6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x5e6, lpOverlapped=0x0) returned 1 [0055.139] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.139] CloseHandle (hObject=0x90) returned 1 [0055.139] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21320_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21320_.gif.wannacry")) returned 1 [0055.140] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b19a00, ftCreationTime.dwHighDateTime=0x1bd4f57, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85b19a00, ftLastWriteTime.dwHighDateTime=0x1bd4f57, nFileSizeHigh=0x0, nFileSizeLow=0x9c5, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21321_.GIF", cAlternateFileName="")) returned 1 [0055.140] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.140] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21321_.GIF") returned 1 [0055.140] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21321_.GIF") returned 1 [0055.140] lstrcmpiA (lpString1="", lpString2="BD21321_.GIF") returned -1 [0055.140] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF") returned="BD21320_.GIF" [0055.140] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.140] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.140] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.140] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.141] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21321_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF" [0055.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF", pszSpec="*.zip") returned 0 [0055.141] lstrlenA (lpString="*.zip") returned 5 [0055.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF", pszSpec="*.rar") returned 0 [0055.141] lstrlenA (lpString="*.rar") returned 5 [0055.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF", pszSpec="*.7z") returned 0 [0055.141] lstrlenA (lpString="*.7z") returned 4 [0055.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF", pszSpec="*.tar") returned 0 [0055.141] lstrlenA (lpString="*.tar") returned 5 [0055.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF", pszSpec="*.gzip") returned 0 [0055.141] lstrlenA (lpString="*.gzip") returned 6 [0055.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF", pszSpec="*.jpg") returned 0 [0055.141] lstrlenA (lpString="*.jpg") returned 5 [0055.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF", pszSpec="*.jpeg") returned 0 [0055.141] lstrlenA (lpString="*.jpeg") returned 6 [0055.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF", pszSpec="*.psd") returned 0 [0055.141] lstrlenA (lpString="*.psd") returned 5 [0055.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF", pszSpec="*.gif") returned 1 [0055.141] lstrlenA (lpString="*.gif") returned 5 [0055.141] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF" [0055.141] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF" [0055.141] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF." [0055.141] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF.wannacry" [0055.141] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21321_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.142] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9c5 [0055.142] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x85b19a00, dwHighDateTime=0x1bd4f57), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcd7c980, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x85b19a00, dwHighDateTime=0x1bd4f57)) returned 1 [0055.142] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.142] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x947, lpOverlapped=0x0) returned 1 [0055.144] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF") returned="BD21321_.GIF" [0055.144] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.144] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x947, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x947, lpOverlapped=0x0) returned 1 [0055.144] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.144] CloseHandle (hObject=0x90) returned 1 [0055.145] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21321_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21321_.gif.wannacry")) returned 1 [0055.145] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f5c3b00, ftCreationTime.dwHighDateTime=0x1bd4f57, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3f5c3b00, ftLastWriteTime.dwHighDateTime=0x1bd4f57, nFileSizeHigh=0x0, nFileSizeLow=0x4d3, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21322_.GIF", cAlternateFileName="")) returned 1 [0055.145] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.145] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21322_.GIF") returned 1 [0055.145] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21322_.GIF") returned 1 [0055.145] lstrcmpiA (lpString1="", lpString2="BD21322_.GIF") returned -1 [0055.145] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF") returned="BD21321_.GIF" [0055.146] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.146] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.146] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.146] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.146] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21322_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF" [0055.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF", pszSpec="*.zip") returned 0 [0055.146] lstrlenA (lpString="*.zip") returned 5 [0055.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF", pszSpec="*.rar") returned 0 [0055.146] lstrlenA (lpString="*.rar") returned 5 [0055.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF", pszSpec="*.7z") returned 0 [0055.146] lstrlenA (lpString="*.7z") returned 4 [0055.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF", pszSpec="*.tar") returned 0 [0055.146] lstrlenA (lpString="*.tar") returned 5 [0055.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF", pszSpec="*.gzip") returned 0 [0055.146] lstrlenA (lpString="*.gzip") returned 6 [0055.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF", pszSpec="*.jpg") returned 0 [0055.146] lstrlenA (lpString="*.jpg") returned 5 [0055.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF", pszSpec="*.jpeg") returned 0 [0055.146] lstrlenA (lpString="*.jpeg") returned 6 [0055.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF", pszSpec="*.psd") returned 0 [0055.146] lstrlenA (lpString="*.psd") returned 5 [0055.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF", pszSpec="*.gif") returned 1 [0055.146] lstrlenA (lpString="*.gif") returned 5 [0055.146] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF" [0055.147] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF" [0055.147] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF." [0055.147] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF.wannacry" [0055.147] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21322_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.147] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4d3 [0055.147] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3f5c3b00, dwHighDateTime=0x1bd4f57), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcda2ae0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3f5c3b00, dwHighDateTime=0x1bd4f57)) returned 1 [0055.147] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.147] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x455, lpOverlapped=0x0) returned 1 [0055.149] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF") returned="BD21322_.GIF" [0055.149] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.149] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x455, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x455, lpOverlapped=0x0) returned 1 [0055.150] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.150] CloseHandle (hObject=0x90) returned 1 [0055.150] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21322_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21322_.gif.wannacry")) returned 1 [0055.151] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b9c600, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x32b9c600, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x395, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21323_.GIF", cAlternateFileName="")) returned 1 [0055.151] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.151] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21323_.GIF") returned 1 [0055.151] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21323_.GIF") returned 1 [0055.151] lstrcmpiA (lpString1="", lpString2="BD21323_.GIF") returned -1 [0055.151] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF") returned="BD21322_.GIF" [0055.151] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.151] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.151] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.151] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.151] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21323_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF" [0055.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF", pszSpec="*.zip") returned 0 [0055.151] lstrlenA (lpString="*.zip") returned 5 [0055.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF", pszSpec="*.rar") returned 0 [0055.151] lstrlenA (lpString="*.rar") returned 5 [0055.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF", pszSpec="*.7z") returned 0 [0055.151] lstrlenA (lpString="*.7z") returned 4 [0055.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF", pszSpec="*.tar") returned 0 [0055.151] lstrlenA (lpString="*.tar") returned 5 [0055.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF", pszSpec="*.gzip") returned 0 [0055.152] lstrlenA (lpString="*.gzip") returned 6 [0055.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF", pszSpec="*.jpg") returned 0 [0055.152] lstrlenA (lpString="*.jpg") returned 5 [0055.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF", pszSpec="*.jpeg") returned 0 [0055.152] lstrlenA (lpString="*.jpeg") returned 6 [0055.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF", pszSpec="*.psd") returned 0 [0055.152] lstrlenA (lpString="*.psd") returned 5 [0055.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF", pszSpec="*.gif") returned 1 [0055.152] lstrlenA (lpString="*.gif") returned 5 [0055.152] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF" [0055.152] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF" [0055.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF." [0055.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF.wannacry" [0055.152] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21323_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.153] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x395 [0055.153] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x32b9c600, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcda2ae0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x32b9c600, dwHighDateTime=0x1bd4d50)) returned 1 [0055.153] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.153] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x317, lpOverlapped=0x0) returned 1 [0055.155] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF") returned="BD21323_.GIF" [0055.155] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.155] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x317, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x317, lpOverlapped=0x0) returned 1 [0055.155] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.156] CloseHandle (hObject=0x90) returned 1 [0055.156] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21323_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21323_.gif.wannacry")) returned 1 [0055.156] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30576c00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x30576c00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x395, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21324_.GIF", cAlternateFileName="")) returned 1 [0055.156] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.156] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21324_.GIF") returned 1 [0055.157] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21324_.GIF") returned 1 [0055.157] lstrcmpiA (lpString1="", lpString2="BD21324_.GIF") returned -1 [0055.157] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF") returned="BD21323_.GIF" [0055.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.157] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.157] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21324_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF" [0055.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF", pszSpec="*.zip") returned 0 [0055.157] lstrlenA (lpString="*.zip") returned 5 [0055.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF", pszSpec="*.rar") returned 0 [0055.157] lstrlenA (lpString="*.rar") returned 5 [0055.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF", pszSpec="*.7z") returned 0 [0055.157] lstrlenA (lpString="*.7z") returned 4 [0055.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF", pszSpec="*.tar") returned 0 [0055.157] lstrlenA (lpString="*.tar") returned 5 [0055.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF", pszSpec="*.gzip") returned 0 [0055.157] lstrlenA (lpString="*.gzip") returned 6 [0055.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF", pszSpec="*.jpg") returned 0 [0055.157] lstrlenA (lpString="*.jpg") returned 5 [0055.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF", pszSpec="*.jpeg") returned 0 [0055.157] lstrlenA (lpString="*.jpeg") returned 6 [0055.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF", pszSpec="*.psd") returned 0 [0055.157] lstrlenA (lpString="*.psd") returned 5 [0055.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF", pszSpec="*.gif") returned 1 [0055.158] lstrlenA (lpString="*.gif") returned 5 [0055.158] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF" [0055.158] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF" [0055.158] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF." [0055.158] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF.wannacry" [0055.158] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21324_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.158] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x395 [0055.158] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x30576c00, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcda2ae0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x30576c00, dwHighDateTime=0x1bd4d50)) returned 1 [0055.158] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.158] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x317, lpOverlapped=0x0) returned 1 [0055.160] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF") returned="BD21324_.GIF" [0055.160] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.160] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x317, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x317, lpOverlapped=0x0) returned 1 [0055.161] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.161] CloseHandle (hObject=0x90) returned 1 [0055.161] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21324_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21324_.gif.wannacry")) returned 1 [0055.163] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2df51200, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2df51200, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x5e0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21325_.GIF", cAlternateFileName="")) returned 1 [0055.163] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.163] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21325_.GIF") returned 1 [0055.163] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21325_.GIF") returned 1 [0055.163] lstrcmpiA (lpString1="", lpString2="BD21325_.GIF") returned -1 [0055.163] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF") returned="BD21324_.GIF" [0055.163] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.163] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.163] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.163] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.163] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21325_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF" [0055.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF", pszSpec="*.zip") returned 0 [0055.163] lstrlenA (lpString="*.zip") returned 5 [0055.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF", pszSpec="*.rar") returned 0 [0055.163] lstrlenA (lpString="*.rar") returned 5 [0055.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF", pszSpec="*.7z") returned 0 [0055.163] lstrlenA (lpString="*.7z") returned 4 [0055.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF", pszSpec="*.tar") returned 0 [0055.163] lstrlenA (lpString="*.tar") returned 5 [0055.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF", pszSpec="*.gzip") returned 0 [0055.164] lstrlenA (lpString="*.gzip") returned 6 [0055.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF", pszSpec="*.jpg") returned 0 [0055.164] lstrlenA (lpString="*.jpg") returned 5 [0055.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF", pszSpec="*.jpeg") returned 0 [0055.164] lstrlenA (lpString="*.jpeg") returned 6 [0055.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF", pszSpec="*.psd") returned 0 [0055.164] lstrlenA (lpString="*.psd") returned 5 [0055.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF", pszSpec="*.gif") returned 1 [0055.164] lstrlenA (lpString="*.gif") returned 5 [0055.164] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF" [0055.164] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF" [0055.164] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF." [0055.164] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF.wannacry" [0055.164] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21325_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.164] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5e0 [0055.164] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x2df51200, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcda2ae0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x2df51200, dwHighDateTime=0x1bd4d50)) returned 1 [0055.165] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.165] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x562, lpOverlapped=0x0) returned 1 [0055.166] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF") returned="BD21325_.GIF" [0055.166] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.166] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x562, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x562, lpOverlapped=0x0) returned 1 [0055.167] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.167] CloseHandle (hObject=0x90) returned 1 [0055.167] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21325_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21325_.gif.wannacry")) returned 1 [0055.168] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dae8400, ftCreationTime.dwHighDateTime=0x1bd4f56, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1dae8400, ftLastWriteTime.dwHighDateTime=0x1bd4f56, nFileSizeHigh=0x0, nFileSizeLow=0x6f9, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21326_.GIF", cAlternateFileName="")) returned 1 [0055.168] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.168] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21326_.GIF") returned 1 [0055.168] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21326_.GIF") returned 1 [0055.168] lstrcmpiA (lpString1="", lpString2="BD21326_.GIF") returned -1 [0055.168] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF") returned="BD21325_.GIF" [0055.168] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.168] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.168] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.168] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.168] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21326_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF" [0055.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF", pszSpec="*.zip") returned 0 [0055.168] lstrlenA (lpString="*.zip") returned 5 [0055.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF", pszSpec="*.rar") returned 0 [0055.168] lstrlenA (lpString="*.rar") returned 5 [0055.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF", pszSpec="*.7z") returned 0 [0055.168] lstrlenA (lpString="*.7z") returned 4 [0055.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF", pszSpec="*.tar") returned 0 [0055.168] lstrlenA (lpString="*.tar") returned 5 [0055.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF", pszSpec="*.gzip") returned 0 [0055.168] lstrlenA (lpString="*.gzip") returned 6 [0055.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF", pszSpec="*.jpg") returned 0 [0055.169] lstrlenA (lpString="*.jpg") returned 5 [0055.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF", pszSpec="*.jpeg") returned 0 [0055.169] lstrlenA (lpString="*.jpeg") returned 6 [0055.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF", pszSpec="*.psd") returned 0 [0055.169] lstrlenA (lpString="*.psd") returned 5 [0055.169] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF", pszSpec="*.gif") returned 1 [0055.169] lstrlenA (lpString="*.gif") returned 5 [0055.169] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF" [0055.169] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF" [0055.169] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF." [0055.169] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF.wannacry" [0055.169] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21326_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.169] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6f9 [0055.169] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1dae8400, dwHighDateTime=0x1bd4f56), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcda2ae0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1dae8400, dwHighDateTime=0x1bd4f56)) returned 1 [0055.169] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.170] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x67b, lpOverlapped=0x0) returned 1 [0055.171] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF") returned="BD21326_.GIF" [0055.171] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.171] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x67b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x67b, lpOverlapped=0x0) returned 1 [0055.172] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.172] CloseHandle (hObject=0x90) returned 1 [0055.172] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21326_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21326_.gif.wannacry")) returned 1 [0055.173] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a618b00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2a618b00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x185, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21328_.GIF", cAlternateFileName="")) returned 1 [0055.173] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.173] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21328_.GIF") returned 1 [0055.173] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21328_.GIF") returned 1 [0055.173] lstrcmpiA (lpString1="", lpString2="BD21328_.GIF") returned -1 [0055.173] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF") returned="BD21326_.GIF" [0055.173] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.173] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.173] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.173] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.173] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21328_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF" [0055.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF", pszSpec="*.zip") returned 0 [0055.173] lstrlenA (lpString="*.zip") returned 5 [0055.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF", pszSpec="*.rar") returned 0 [0055.173] lstrlenA (lpString="*.rar") returned 5 [0055.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF", pszSpec="*.7z") returned 0 [0055.173] lstrlenA (lpString="*.7z") returned 4 [0055.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF", pszSpec="*.tar") returned 0 [0055.173] lstrlenA (lpString="*.tar") returned 5 [0055.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF", pszSpec="*.gzip") returned 0 [0055.174] lstrlenA (lpString="*.gzip") returned 6 [0055.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF", pszSpec="*.jpg") returned 0 [0055.174] lstrlenA (lpString="*.jpg") returned 5 [0055.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF", pszSpec="*.jpeg") returned 0 [0055.174] lstrlenA (lpString="*.jpeg") returned 6 [0055.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF", pszSpec="*.psd") returned 0 [0055.174] lstrlenA (lpString="*.psd") returned 5 [0055.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF", pszSpec="*.gif") returned 1 [0055.174] lstrlenA (lpString="*.gif") returned 5 [0055.174] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF" [0055.174] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF" [0055.174] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF." [0055.174] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF.wannacry" [0055.174] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21328_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.174] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x185 [0055.175] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x2a618b00, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcdc8c40, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x2a618b00, dwHighDateTime=0x1bd4d50)) returned 1 [0055.175] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.175] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x107, lpOverlapped=0x0) returned 1 [0055.176] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF") returned="BD21328_.GIF" [0055.176] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.176] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x107, lpOverlapped=0x0) returned 1 [0055.176] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.176] CloseHandle (hObject=0x90) returned 1 [0055.176] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21328_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21328_.gif.wannacry")) returned 1 [0055.177] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ff3100, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x27ff3100, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21330_.GIF", cAlternateFileName="")) returned 1 [0055.177] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.177] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21330_.GIF") returned 1 [0055.177] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21330_.GIF") returned 1 [0055.177] lstrcmpiA (lpString1="", lpString2="BD21330_.GIF") returned -1 [0055.177] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF") returned="BD21328_.GIF" [0055.177] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.177] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.177] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.177] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.177] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21330_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF" [0055.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF", pszSpec="*.zip") returned 0 [0055.177] lstrlenA (lpString="*.zip") returned 5 [0055.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF", pszSpec="*.rar") returned 0 [0055.178] lstrlenA (lpString="*.rar") returned 5 [0055.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF", pszSpec="*.7z") returned 0 [0055.178] lstrlenA (lpString="*.7z") returned 4 [0055.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF", pszSpec="*.tar") returned 0 [0055.178] lstrlenA (lpString="*.tar") returned 5 [0055.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF", pszSpec="*.gzip") returned 0 [0055.178] lstrlenA (lpString="*.gzip") returned 6 [0055.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF", pszSpec="*.jpg") returned 0 [0055.178] lstrlenA (lpString="*.jpg") returned 5 [0055.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF", pszSpec="*.jpeg") returned 0 [0055.178] lstrlenA (lpString="*.jpeg") returned 6 [0055.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF", pszSpec="*.psd") returned 0 [0055.178] lstrlenA (lpString="*.psd") returned 5 [0055.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF", pszSpec="*.gif") returned 1 [0055.178] lstrlenA (lpString="*.gif") returned 5 [0055.178] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF" [0055.178] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF" [0055.178] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF." [0055.178] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF.wannacry" [0055.178] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21330_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.179] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d0 [0055.179] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x27ff3100, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcdc8c40, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x27ff3100, dwHighDateTime=0x1bd4d50)) returned 1 [0055.179] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.179] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x152, lpOverlapped=0x0) returned 1 [0055.180] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF") returned="BD21330_.GIF" [0055.180] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.180] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x152, lpOverlapped=0x0) returned 1 [0055.180] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.180] CloseHandle (hObject=0x90) returned 1 [0055.180] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21330_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21330_.gif.wannacry")) returned 1 [0055.181] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x246baa00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x246baa00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x1f91, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21332_.GIF", cAlternateFileName="")) returned 1 [0055.181] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.181] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21332_.GIF") returned 1 [0055.181] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21332_.GIF") returned 1 [0055.181] lstrcmpiA (lpString1="", lpString2="BD21332_.GIF") returned -1 [0055.181] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF") returned="BD21330_.GIF" [0055.181] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.181] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.181] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.181] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.182] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21332_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF" [0055.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF", pszSpec="*.zip") returned 0 [0055.182] lstrlenA (lpString="*.zip") returned 5 [0055.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF", pszSpec="*.rar") returned 0 [0055.182] lstrlenA (lpString="*.rar") returned 5 [0055.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF", pszSpec="*.7z") returned 0 [0055.182] lstrlenA (lpString="*.7z") returned 4 [0055.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF", pszSpec="*.tar") returned 0 [0055.182] lstrlenA (lpString="*.tar") returned 5 [0055.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF", pszSpec="*.gzip") returned 0 [0055.182] lstrlenA (lpString="*.gzip") returned 6 [0055.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF", pszSpec="*.jpg") returned 0 [0055.182] lstrlenA (lpString="*.jpg") returned 5 [0055.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF", pszSpec="*.jpeg") returned 0 [0055.182] lstrlenA (lpString="*.jpeg") returned 6 [0055.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF", pszSpec="*.psd") returned 0 [0055.182] lstrlenA (lpString="*.psd") returned 5 [0055.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF", pszSpec="*.gif") returned 1 [0055.182] lstrlenA (lpString="*.gif") returned 5 [0055.182] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF" [0055.182] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF" [0055.182] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF." [0055.182] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF.wannacry" [0055.183] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21332_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.183] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f91 [0055.183] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x246baa00, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcdc8c40, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x246baa00, dwHighDateTime=0x1bd4d50)) returned 1 [0055.183] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.183] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1f13, lpOverlapped=0x0) returned 1 [0055.185] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF") returned="BD21332_.GIF" [0055.185] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.185] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1f13, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1f13, lpOverlapped=0x0) returned 1 [0055.185] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.185] CloseHandle (hObject=0x90) returned 1 [0055.186] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21332_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21332_.gif.wannacry")) returned 1 [0055.189] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e75c900, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1e75c900, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x888, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21334_.GIF", cAlternateFileName="")) returned 1 [0055.189] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.189] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21334_.GIF") returned 1 [0055.189] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21334_.GIF") returned 1 [0055.189] lstrcmpiA (lpString1="", lpString2="BD21334_.GIF") returned -1 [0055.189] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF") returned="BD21332_.GIF" [0055.189] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.189] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.189] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.189] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.189] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21334_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF" [0055.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF", pszSpec="*.zip") returned 0 [0055.189] lstrlenA (lpString="*.zip") returned 5 [0055.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF", pszSpec="*.rar") returned 0 [0055.189] lstrlenA (lpString="*.rar") returned 5 [0055.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF", pszSpec="*.7z") returned 0 [0055.189] lstrlenA (lpString="*.7z") returned 4 [0055.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF", pszSpec="*.tar") returned 0 [0055.190] lstrlenA (lpString="*.tar") returned 5 [0055.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF", pszSpec="*.gzip") returned 0 [0055.190] lstrlenA (lpString="*.gzip") returned 6 [0055.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF", pszSpec="*.jpg") returned 0 [0055.190] lstrlenA (lpString="*.jpg") returned 5 [0055.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF", pszSpec="*.jpeg") returned 0 [0055.190] lstrlenA (lpString="*.jpeg") returned 6 [0055.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF", pszSpec="*.psd") returned 0 [0055.190] lstrlenA (lpString="*.psd") returned 5 [0055.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF", pszSpec="*.gif") returned 1 [0055.190] lstrlenA (lpString="*.gif") returned 5 [0055.190] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF" [0055.190] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF" [0055.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF." [0055.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF.wannacry" [0055.190] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21334_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.191] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x888 [0055.191] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1e75c900, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcdeeda0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1e75c900, dwHighDateTime=0x1bd4d50)) returned 1 [0055.191] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.191] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x80a, lpOverlapped=0x0) returned 1 [0055.193] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF") returned="BD21334_.GIF" [0055.193] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.193] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x80a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x80a, lpOverlapped=0x0) returned 1 [0055.193] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.193] CloseHandle (hObject=0x90) returned 1 [0055.194] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21334_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21334_.gif.wannacry")) returned 1 [0055.194] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4465be00, ftCreationTime.dwHighDateTime=0x1bd4f48, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4465be00, ftLastWriteTime.dwHighDateTime=0x1bd4f48, nFileSizeHigh=0x0, nFileSizeLow=0xaeb, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21336_.GIF", cAlternateFileName="")) returned 1 [0055.194] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.194] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21336_.GIF") returned 1 [0055.194] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21336_.GIF") returned 1 [0055.194] lstrcmpiA (lpString1="", lpString2="BD21336_.GIF") returned -1 [0055.195] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF") returned="BD21334_.GIF" [0055.195] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.195] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.195] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.195] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.195] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21336_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF" [0055.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF", pszSpec="*.zip") returned 0 [0055.195] lstrlenA (lpString="*.zip") returned 5 [0055.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF", pszSpec="*.rar") returned 0 [0055.195] lstrlenA (lpString="*.rar") returned 5 [0055.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF", pszSpec="*.7z") returned 0 [0055.195] lstrlenA (lpString="*.7z") returned 4 [0055.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF", pszSpec="*.tar") returned 0 [0055.195] lstrlenA (lpString="*.tar") returned 5 [0055.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF", pszSpec="*.gzip") returned 0 [0055.195] lstrlenA (lpString="*.gzip") returned 6 [0055.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF", pszSpec="*.jpg") returned 0 [0055.195] lstrlenA (lpString="*.jpg") returned 5 [0055.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF", pszSpec="*.jpeg") returned 0 [0055.195] lstrlenA (lpString="*.jpeg") returned 6 [0055.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF", pszSpec="*.psd") returned 0 [0055.195] lstrlenA (lpString="*.psd") returned 5 [0055.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF", pszSpec="*.gif") returned 1 [0055.195] lstrlenA (lpString="*.gif") returned 5 [0055.195] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF" [0055.196] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF" [0055.196] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF." [0055.196] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF.wannacry" [0055.196] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21336_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.196] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaeb [0055.196] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4465be00, dwHighDateTime=0x1bd4f48), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcdeeda0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4465be00, dwHighDateTime=0x1bd4f48)) returned 1 [0055.196] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.196] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xa6d, lpOverlapped=0x0) returned 1 [0055.198] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF") returned="BD21336_.GIF" [0055.198] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.198] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xa6d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xa6d, lpOverlapped=0x0) returned 1 [0055.198] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.199] CloseHandle (hObject=0x90) returned 1 [0055.199] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21336_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21336_.gif.wannacry")) returned 1 [0055.199] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ae24200, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1ae24200, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21338_.GIF", cAlternateFileName="")) returned 1 [0055.199] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.199] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21338_.GIF") returned 1 [0055.200] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21338_.GIF") returned 1 [0055.200] lstrcmpiA (lpString1="", lpString2="BD21338_.GIF") returned -1 [0055.200] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF") returned="BD21336_.GIF" [0055.200] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.200] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.200] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.200] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.200] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21338_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF" [0055.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF", pszSpec="*.zip") returned 0 [0055.200] lstrlenA (lpString="*.zip") returned 5 [0055.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF", pszSpec="*.rar") returned 0 [0055.200] lstrlenA (lpString="*.rar") returned 5 [0055.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF", pszSpec="*.7z") returned 0 [0055.200] lstrlenA (lpString="*.7z") returned 4 [0055.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF", pszSpec="*.tar") returned 0 [0055.200] lstrlenA (lpString="*.tar") returned 5 [0055.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF", pszSpec="*.gzip") returned 0 [0055.200] lstrlenA (lpString="*.gzip") returned 6 [0055.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF", pszSpec="*.jpg") returned 0 [0055.200] lstrlenA (lpString="*.jpg") returned 5 [0055.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF", pszSpec="*.jpeg") returned 0 [0055.200] lstrlenA (lpString="*.jpeg") returned 6 [0055.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF", pszSpec="*.psd") returned 0 [0055.200] lstrlenA (lpString="*.psd") returned 5 [0055.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF", pszSpec="*.gif") returned 1 [0055.201] lstrlenA (lpString="*.gif") returned 5 [0055.201] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF" [0055.201] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF" [0055.201] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF." [0055.201] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF.wannacry" [0055.201] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21338_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.201] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x344 [0055.201] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1ae24200, dwHighDateTime=0x1bd4d50), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcdeeda0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1ae24200, dwHighDateTime=0x1bd4d50)) returned 1 [0055.201] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.201] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2c6, lpOverlapped=0x0) returned 1 [0055.203] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF") returned="BD21338_.GIF" [0055.203] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.203] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2c6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2c6, lpOverlapped=0x0) returned 1 [0055.204] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.204] CloseHandle (hObject=0x90) returned 1 [0055.204] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21338_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21338_.gif.wannacry")) returned 1 [0055.205] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a537400, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbce14f00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7a537400, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21340_.GIF", cAlternateFileName="")) returned 1 [0055.205] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.205] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21340_.GIF") returned 1 [0055.205] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21340_.GIF") returned 1 [0055.205] lstrcmpiA (lpString1="", lpString2="BD21340_.GIF") returned -1 [0055.205] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF") returned="BD21338_.GIF" [0055.205] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.205] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.205] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.205] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.205] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21340_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF" [0055.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF", pszSpec="*.zip") returned 0 [0055.205] lstrlenA (lpString="*.zip") returned 5 [0055.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF", pszSpec="*.rar") returned 0 [0055.205] lstrlenA (lpString="*.rar") returned 5 [0055.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF", pszSpec="*.7z") returned 0 [0055.205] lstrlenA (lpString="*.7z") returned 4 [0055.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF", pszSpec="*.tar") returned 0 [0055.205] lstrlenA (lpString="*.tar") returned 5 [0055.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF", pszSpec="*.gzip") returned 0 [0055.205] lstrlenA (lpString="*.gzip") returned 6 [0055.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF", pszSpec="*.jpg") returned 0 [0055.206] lstrlenA (lpString="*.jpg") returned 5 [0055.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF", pszSpec="*.jpeg") returned 0 [0055.206] lstrlenA (lpString="*.jpeg") returned 6 [0055.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF", pszSpec="*.psd") returned 0 [0055.206] lstrlenA (lpString="*.psd") returned 5 [0055.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF", pszSpec="*.gif") returned 1 [0055.206] lstrlenA (lpString="*.gif") returned 5 [0055.206] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF" [0055.206] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF" [0055.206] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF." [0055.206] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF.wannacry" [0055.206] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21340_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.206] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x96 [0055.206] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7a537400, dwHighDateTime=0x1bd4f41), lpLastAccessTime=0x407536*(dwLowDateTime=0xbce14f00, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7a537400, dwHighDateTime=0x1bd4f41)) returned 1 [0055.207] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.207] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x18, lpOverlapped=0x0) returned 1 [0055.208] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF") returned="BD21340_.GIF" [0055.208] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.208] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x18, lpOverlapped=0x0) returned 1 [0055.208] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.208] CloseHandle (hObject=0x90) returned 1 [0055.208] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21340_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21340_.gif.wannacry")) returned 1 [0055.209] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7a89600, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa7a89600, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x46b, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21348_.GIF", cAlternateFileName="")) returned 1 [0055.209] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.209] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21348_.GIF") returned 1 [0055.209] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21348_.GIF") returned 1 [0055.209] lstrcmpiA (lpString1="", lpString2="BD21348_.GIF") returned -1 [0055.209] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF") returned="BD21340_.GIF" [0055.209] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.209] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.209] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.209] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.209] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21348_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF" [0055.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF", pszSpec="*.zip") returned 0 [0055.209] lstrlenA (lpString="*.zip") returned 5 [0055.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF", pszSpec="*.rar") returned 0 [0055.209] lstrlenA (lpString="*.rar") returned 5 [0055.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF", pszSpec="*.7z") returned 0 [0055.210] lstrlenA (lpString="*.7z") returned 4 [0055.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF", pszSpec="*.tar") returned 0 [0055.210] lstrlenA (lpString="*.tar") returned 5 [0055.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF", pszSpec="*.gzip") returned 0 [0055.210] lstrlenA (lpString="*.gzip") returned 6 [0055.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF", pszSpec="*.jpg") returned 0 [0055.210] lstrlenA (lpString="*.jpg") returned 5 [0055.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF", pszSpec="*.jpeg") returned 0 [0055.210] lstrlenA (lpString="*.jpeg") returned 6 [0055.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF", pszSpec="*.psd") returned 0 [0055.210] lstrlenA (lpString="*.psd") returned 5 [0055.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF", pszSpec="*.gif") returned 1 [0055.210] lstrlenA (lpString="*.gif") returned 5 [0055.210] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF" [0055.210] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF" [0055.210] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF." [0055.210] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF.wannacry" [0055.210] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21348_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.211] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46b [0055.211] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa7a89600, dwHighDateTime=0x1bd9367), lpLastAccessTime=0x407536*(dwLowDateTime=0xbce3b060, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa7a89600, dwHighDateTime=0x1bd9367)) returned 1 [0055.211] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.211] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3ed, lpOverlapped=0x0) returned 1 [0055.213] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF") returned="BD21348_.GIF" [0055.213] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.213] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3ed, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3ed, lpOverlapped=0x0) returned 1 [0055.213] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.213] CloseHandle (hObject=0x90) returned 1 [0055.213] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21348_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21348_.gif.wannacry")) returned 1 [0055.214] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5462cc00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5462cc00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x8e3, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21370_.GIF", cAlternateFileName="")) returned 1 [0055.214] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.214] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21370_.GIF") returned 1 [0055.214] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21370_.GIF") returned 1 [0055.214] lstrcmpiA (lpString1="", lpString2="BD21370_.GIF") returned -1 [0055.214] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF") returned="BD21348_.GIF" [0055.214] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.214] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.214] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.214] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.214] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21370_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF" [0055.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF", pszSpec="*.zip") returned 0 [0055.214] lstrlenA (lpString="*.zip") returned 5 [0055.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF", pszSpec="*.rar") returned 0 [0055.214] lstrlenA (lpString="*.rar") returned 5 [0055.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF", pszSpec="*.7z") returned 0 [0055.214] lstrlenA (lpString="*.7z") returned 4 [0055.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF", pszSpec="*.tar") returned 0 [0055.215] lstrlenA (lpString="*.tar") returned 5 [0055.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF", pszSpec="*.gzip") returned 0 [0055.215] lstrlenA (lpString="*.gzip") returned 6 [0055.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF", pszSpec="*.jpg") returned 0 [0055.215] lstrlenA (lpString="*.jpg") returned 5 [0055.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF", pszSpec="*.jpeg") returned 0 [0055.215] lstrlenA (lpString="*.jpeg") returned 6 [0055.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF", pszSpec="*.psd") returned 0 [0055.215] lstrlenA (lpString="*.psd") returned 5 [0055.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF", pszSpec="*.gif") returned 1 [0055.215] lstrlenA (lpString="*.gif") returned 5 [0055.215] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF" [0055.215] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF" [0055.215] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF." [0055.215] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF.wannacry" [0055.215] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21370_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.216] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8e3 [0055.216] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5462cc00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbce3b060, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5462cc00, dwHighDateTime=0x1bd8f92)) returned 1 [0055.216] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.216] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x865, lpOverlapped=0x0) returned 1 [0055.218] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF") returned="BD21370_.GIF" [0055.218] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.218] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x865, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x865, lpOverlapped=0x0) returned 1 [0055.218] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.218] CloseHandle (hObject=0x90) returned 1 [0055.218] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21370_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21370_.gif.wannacry")) returned 1 [0055.219] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d9b3c00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8d9b3c00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21390_.GIF", cAlternateFileName="")) returned 1 [0055.219] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.219] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21390_.GIF") returned 1 [0055.219] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21390_.GIF") returned 1 [0055.219] lstrcmpiA (lpString1="", lpString2="BD21390_.GIF") returned -1 [0055.219] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF") returned="BD21370_.GIF" [0055.219] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.219] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.219] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21390_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF" [0055.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF", pszSpec="*.zip") returned 0 [0055.219] lstrlenA (lpString="*.zip") returned 5 [0055.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF", pszSpec="*.rar") returned 0 [0055.220] lstrlenA (lpString="*.rar") returned 5 [0055.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF", pszSpec="*.7z") returned 0 [0055.220] lstrlenA (lpString="*.7z") returned 4 [0055.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF", pszSpec="*.tar") returned 0 [0055.220] lstrlenA (lpString="*.tar") returned 5 [0055.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF", pszSpec="*.gzip") returned 0 [0055.220] lstrlenA (lpString="*.gzip") returned 6 [0055.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF", pszSpec="*.jpg") returned 0 [0055.220] lstrlenA (lpString="*.jpg") returned 5 [0055.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF", pszSpec="*.jpeg") returned 0 [0055.220] lstrlenA (lpString="*.jpeg") returned 6 [0055.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF", pszSpec="*.psd") returned 0 [0055.220] lstrlenA (lpString="*.psd") returned 5 [0055.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF", pszSpec="*.gif") returned 1 [0055.220] lstrlenA (lpString="*.gif") returned 5 [0055.220] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF" [0055.220] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF" [0055.220] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF." [0055.220] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF.wannacry" [0055.220] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21390_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.221] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15e [0055.221] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d9b3c00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbce611c0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d9b3c00, dwHighDateTime=0x1bd8f92)) returned 1 [0055.221] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.221] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xe0, lpOverlapped=0x0) returned 1 [0055.222] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF") returned="BD21390_.GIF" [0055.222] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.222] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xe0, lpOverlapped=0x0) returned 1 [0055.222] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.222] CloseHandle (hObject=0x90) returned 1 [0055.222] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21390_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21390_.gif.wannacry")) returned 1 [0055.223] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7546300, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7546300, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x3de, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21413_.GIF", cAlternateFileName="")) returned 1 [0055.223] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.223] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21413_.GIF") returned 1 [0055.223] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21413_.GIF") returned 1 [0055.223] lstrcmpiA (lpString1="", lpString2="BD21413_.GIF") returned -1 [0055.223] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF") returned="BD21390_.GIF" [0055.223] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.223] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.223] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.224] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.224] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21413_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF" [0055.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF", pszSpec="*.zip") returned 0 [0055.224] lstrlenA (lpString="*.zip") returned 5 [0055.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF", pszSpec="*.rar") returned 0 [0055.224] lstrlenA (lpString="*.rar") returned 5 [0055.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF", pszSpec="*.7z") returned 0 [0055.224] lstrlenA (lpString="*.7z") returned 4 [0055.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF", pszSpec="*.tar") returned 0 [0055.224] lstrlenA (lpString="*.tar") returned 5 [0055.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF", pszSpec="*.gzip") returned 0 [0055.224] lstrlenA (lpString="*.gzip") returned 6 [0055.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF", pszSpec="*.jpg") returned 0 [0055.224] lstrlenA (lpString="*.jpg") returned 5 [0055.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF", pszSpec="*.jpeg") returned 0 [0055.224] lstrlenA (lpString="*.jpeg") returned 6 [0055.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF", pszSpec="*.psd") returned 0 [0055.224] lstrlenA (lpString="*.psd") returned 5 [0055.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF", pszSpec="*.gif") returned 1 [0055.224] lstrlenA (lpString="*.gif") returned 5 [0055.224] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF" [0055.224] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF" [0055.224] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF." [0055.224] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF.wannacry" [0055.225] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21413_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.225] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3de [0055.225] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb7546300, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbce87320, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb7546300, dwHighDateTime=0x1bd8f92)) returned 1 [0055.225] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.225] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x360, lpOverlapped=0x0) returned 1 [0055.227] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF") returned="BD21413_.GIF" [0055.227] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.227] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0055.227] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.227] CloseHandle (hObject=0x90) returned 1 [0055.227] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21413_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21413_.gif.wannacry")) returned 1 [0055.228] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd290b00, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd290b00, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x770, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21427_.GIF", cAlternateFileName="")) returned 1 [0055.228] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.228] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21427_.GIF") returned 1 [0055.228] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21427_.GIF") returned 1 [0055.228] lstrcmpiA (lpString1="", lpString2="BD21427_.GIF") returned -1 [0055.228] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF") returned="BD21413_.GIF" [0055.228] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.228] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.228] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.228] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.229] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21427_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF" [0055.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF", pszSpec="*.zip") returned 0 [0055.229] lstrlenA (lpString="*.zip") returned 5 [0055.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF", pszSpec="*.rar") returned 0 [0055.229] lstrlenA (lpString="*.rar") returned 5 [0055.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF", pszSpec="*.7z") returned 0 [0055.229] lstrlenA (lpString="*.7z") returned 4 [0055.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF", pszSpec="*.tar") returned 0 [0055.229] lstrlenA (lpString="*.tar") returned 5 [0055.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF", pszSpec="*.gzip") returned 0 [0055.229] lstrlenA (lpString="*.gzip") returned 6 [0055.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF", pszSpec="*.jpg") returned 0 [0055.229] lstrlenA (lpString="*.jpg") returned 5 [0055.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF", pszSpec="*.jpeg") returned 0 [0055.229] lstrlenA (lpString="*.jpeg") returned 6 [0055.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF", pszSpec="*.psd") returned 0 [0055.229] lstrlenA (lpString="*.psd") returned 5 [0055.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF", pszSpec="*.gif") returned 1 [0055.229] lstrlenA (lpString="*.gif") returned 5 [0055.229] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF" [0055.229] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF" [0055.229] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF." [0055.229] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF.wannacry" [0055.229] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21427_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.230] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x770 [0055.230] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd290b00, dwHighDateTime=0x1bd8f93), lpLastAccessTime=0x407536*(dwLowDateTime=0xbce87320, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd290b00, dwHighDateTime=0x1bd8f93)) returned 1 [0055.230] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.230] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x6f2, lpOverlapped=0x0) returned 1 [0055.233] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF") returned="BD21427_.GIF" [0055.233] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.233] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x6f2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x6f2, lpOverlapped=0x0) returned 1 [0055.233] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.233] CloseHandle (hObject=0x90) returned 1 [0055.233] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21427_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21427_.gif.wannacry")) returned 1 [0055.234] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97bc3b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbcead480, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x97bc3b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x11c, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21448_.GIF", cAlternateFileName="")) returned 1 [0055.234] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.234] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21448_.GIF") returned 1 [0055.234] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21448_.GIF") returned 1 [0055.234] lstrcmpiA (lpString1="", lpString2="BD21448_.GIF") returned -1 [0055.234] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF") returned="BD21427_.GIF" [0055.234] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.234] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.234] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.235] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.235] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21448_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF" [0055.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF", pszSpec="*.zip") returned 0 [0055.235] lstrlenA (lpString="*.zip") returned 5 [0055.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF", pszSpec="*.rar") returned 0 [0055.235] lstrlenA (lpString="*.rar") returned 5 [0055.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF", pszSpec="*.7z") returned 0 [0055.235] lstrlenA (lpString="*.7z") returned 4 [0055.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF", pszSpec="*.tar") returned 0 [0055.235] lstrlenA (lpString="*.tar") returned 5 [0055.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF", pszSpec="*.gzip") returned 0 [0055.235] lstrlenA (lpString="*.gzip") returned 6 [0055.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF", pszSpec="*.jpg") returned 0 [0055.235] lstrlenA (lpString="*.jpg") returned 5 [0055.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF", pszSpec="*.jpeg") returned 0 [0055.235] lstrlenA (lpString="*.jpeg") returned 6 [0055.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF", pszSpec="*.psd") returned 0 [0055.235] lstrlenA (lpString="*.psd") returned 5 [0055.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF", pszSpec="*.gif") returned 1 [0055.235] lstrlenA (lpString="*.gif") returned 5 [0055.235] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF" [0055.235] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF" [0055.235] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF." [0055.235] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF.wannacry" [0055.236] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21448_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.236] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11c [0055.236] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x97bc3b00, dwHighDateTime=0x1bd8f90), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcead480, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x97bc3b00, dwHighDateTime=0x1bd8f90)) returned 1 [0055.236] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.236] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x9e, lpOverlapped=0x0) returned 1 [0055.237] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF") returned="BD21448_.GIF" [0055.237] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.237] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x9e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x9e, lpOverlapped=0x0) returned 1 [0055.237] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.238] CloseHandle (hObject=0x90) returned 1 [0055.238] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21448_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21448_.gif.wannacry")) returned 1 [0055.238] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b89da00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbced35e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5b89da00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x2da, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21495_.GIF", cAlternateFileName="")) returned 1 [0055.238] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.238] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21495_.GIF") returned 1 [0055.238] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21495_.GIF") returned 1 [0055.239] lstrcmpiA (lpString1="", lpString2="BD21495_.GIF") returned -1 [0055.239] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF") returned="BD21448_.GIF" [0055.239] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.239] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.239] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.239] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.239] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21495_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF" [0055.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF", pszSpec="*.zip") returned 0 [0055.239] lstrlenA (lpString="*.zip") returned 5 [0055.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF", pszSpec="*.rar") returned 0 [0055.239] lstrlenA (lpString="*.rar") returned 5 [0055.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF", pszSpec="*.7z") returned 0 [0055.239] lstrlenA (lpString="*.7z") returned 4 [0055.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF", pszSpec="*.tar") returned 0 [0055.239] lstrlenA (lpString="*.tar") returned 5 [0055.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF", pszSpec="*.gzip") returned 0 [0055.239] lstrlenA (lpString="*.gzip") returned 6 [0055.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF", pszSpec="*.jpg") returned 0 [0055.239] lstrlenA (lpString="*.jpg") returned 5 [0055.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF", pszSpec="*.jpeg") returned 0 [0055.239] lstrlenA (lpString="*.jpeg") returned 6 [0055.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF", pszSpec="*.psd") returned 0 [0055.239] lstrlenA (lpString="*.psd") returned 5 [0055.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF", pszSpec="*.gif") returned 1 [0055.239] lstrlenA (lpString="*.gif") returned 5 [0055.240] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF" [0055.240] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF" [0055.240] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF." [0055.240] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF.wannacry" [0055.240] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21495_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.240] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2da [0055.240] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5b89da00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbced35e0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5b89da00, dwHighDateTime=0x1bd8f92)) returned 1 [0055.240] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.240] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x25c, lpOverlapped=0x0) returned 1 [0055.242] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF") returned="BD21495_.GIF" [0055.242] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.242] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x25c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x25c, lpOverlapped=0x0) returned 1 [0055.242] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.243] CloseHandle (hObject=0x90) returned 1 [0055.243] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21495_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21495_.gif.wannacry")) returned 1 [0055.243] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93911d00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcef9740, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x93911d00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x34d, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21512_.GIF", cAlternateFileName="")) returned 1 [0055.243] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.243] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21512_.GIF") returned 1 [0055.243] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21512_.GIF") returned 1 [0055.243] lstrcmpiA (lpString1="", lpString2="BD21512_.GIF") returned -1 [0055.244] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF") returned="BD21495_.GIF" [0055.244] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.244] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.244] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.244] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.244] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21512_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF" [0055.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF", pszSpec="*.zip") returned 0 [0055.244] lstrlenA (lpString="*.zip") returned 5 [0055.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF", pszSpec="*.rar") returned 0 [0055.244] lstrlenA (lpString="*.rar") returned 5 [0055.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF", pszSpec="*.7z") returned 0 [0055.244] lstrlenA (lpString="*.7z") returned 4 [0055.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF", pszSpec="*.tar") returned 0 [0055.244] lstrlenA (lpString="*.tar") returned 5 [0055.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF", pszSpec="*.gzip") returned 0 [0055.244] lstrlenA (lpString="*.gzip") returned 6 [0055.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF", pszSpec="*.jpg") returned 0 [0055.244] lstrlenA (lpString="*.jpg") returned 5 [0055.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF", pszSpec="*.jpeg") returned 0 [0055.244] lstrlenA (lpString="*.jpeg") returned 6 [0055.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF", pszSpec="*.psd") returned 0 [0055.244] lstrlenA (lpString="*.psd") returned 5 [0055.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF", pszSpec="*.gif") returned 1 [0055.245] lstrlenA (lpString="*.gif") returned 5 [0055.245] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF" [0055.245] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF" [0055.245] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF." [0055.245] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF.wannacry" [0055.245] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21512_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.245] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34d [0055.245] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93911d00, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcef9740, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93911d00, dwHighDateTime=0x1bd8f92)) returned 1 [0055.245] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.245] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2cf, lpOverlapped=0x0) returned 1 [0055.247] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF") returned="BD21512_.GIF" [0055.247] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.247] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2cf, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2cf, lpOverlapped=0x0) returned 1 [0055.247] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.248] CloseHandle (hObject=0x90) returned 1 [0055.248] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21512_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21512_.gif.wannacry")) returned 1 [0055.248] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd4a4400, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcef9740, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4a4400, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x24e, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21527_.GIF", cAlternateFileName="")) returned 1 [0055.248] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.248] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21527_.GIF") returned 1 [0055.248] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21527_.GIF") returned 1 [0055.248] lstrcmpiA (lpString1="", lpString2="BD21527_.GIF") returned -1 [0055.248] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF") returned="BD21512_.GIF" [0055.249] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.249] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.249] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.249] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.249] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21527_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF" [0055.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF", pszSpec="*.zip") returned 0 [0055.249] lstrlenA (lpString="*.zip") returned 5 [0055.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF", pszSpec="*.rar") returned 0 [0055.249] lstrlenA (lpString="*.rar") returned 5 [0055.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF", pszSpec="*.7z") returned 0 [0055.249] lstrlenA (lpString="*.7z") returned 4 [0055.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF", pszSpec="*.tar") returned 0 [0055.249] lstrlenA (lpString="*.tar") returned 5 [0055.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF", pszSpec="*.gzip") returned 0 [0055.249] lstrlenA (lpString="*.gzip") returned 6 [0055.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF", pszSpec="*.jpg") returned 0 [0055.249] lstrlenA (lpString="*.jpg") returned 5 [0055.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF", pszSpec="*.jpeg") returned 0 [0055.249] lstrlenA (lpString="*.jpeg") returned 6 [0055.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF", pszSpec="*.psd") returned 0 [0055.249] lstrlenA (lpString="*.psd") returned 5 [0055.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF", pszSpec="*.gif") returned 1 [0055.249] lstrlenA (lpString="*.gif") returned 5 [0055.249] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF" [0055.249] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF" [0055.250] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF." [0055.250] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF.wannacry" [0055.250] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21527_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.250] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24e [0055.250] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbd4a4400, dwHighDateTime=0x1bd8f92), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcef9740, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbd4a4400, dwHighDateTime=0x1bd8f92)) returned 1 [0055.250] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.250] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1d0, lpOverlapped=0x0) returned 1 [0055.251] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF") returned="BD21527_.GIF" [0055.251] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.252] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1d0, lpOverlapped=0x0) returned 1 [0055.252] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.252] CloseHandle (hObject=0x90) returned 1 [0055.252] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21527_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21527_.gif.wannacry")) returned 1 [0055.254] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15814600, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbcf1f8a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x15814600, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x73d, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BD21548_.GIF", cAlternateFileName="")) returned 1 [0055.254] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.254] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BD21548_.GIF") returned 1 [0055.254] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BD21548_.GIF") returned 1 [0055.254] lstrcmpiA (lpString1="", lpString2="BD21548_.GIF") returned -1 [0055.254] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF") returned="BD21527_.GIF" [0055.254] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.254] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.254] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.255] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.255] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="BD21548_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF" [0055.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF", pszSpec="*.zip") returned 0 [0055.255] lstrlenA (lpString="*.zip") returned 5 [0055.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF", pszSpec="*.rar") returned 0 [0055.255] lstrlenA (lpString="*.rar") returned 5 [0055.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF", pszSpec="*.7z") returned 0 [0055.255] lstrlenA (lpString="*.7z") returned 4 [0055.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF", pszSpec="*.tar") returned 0 [0055.255] lstrlenA (lpString="*.tar") returned 5 [0055.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF", pszSpec="*.gzip") returned 0 [0055.255] lstrlenA (lpString="*.gzip") returned 6 [0055.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF", pszSpec="*.jpg") returned 0 [0055.255] lstrlenA (lpString="*.jpg") returned 5 [0055.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF", pszSpec="*.jpeg") returned 0 [0055.255] lstrlenA (lpString="*.jpeg") returned 6 [0055.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF", pszSpec="*.psd") returned 0 [0055.255] lstrlenA (lpString="*.psd") returned 5 [0055.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF", pszSpec="*.gif") returned 1 [0055.255] lstrlenA (lpString="*.gif") returned 5 [0055.255] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF" [0055.255] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF" [0055.255] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF." [0055.255] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF.wannacry" [0055.256] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21548_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.256] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x73d [0055.256] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x15814600, dwHighDateTime=0x1bd8f93), lpLastAccessTime=0x407536*(dwLowDateTime=0xbcf1f8a0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x15814600, dwHighDateTime=0x1bd8f93)) returned 1 [0055.256] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.256] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x6bf, lpOverlapped=0x0) returned 1 [0055.258] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF") returned="BD21548_.GIF" [0055.258] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.258] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x6bf, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x6bf, lpOverlapped=0x0) returned 1 [0055.258] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.258] CloseHandle (hObject=0x90) returned 1 [0055.258] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21548_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21548_.gif.wannacry")) returned 1 [0055.259] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x360, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0055.259] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.259] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0055.259] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0055.259] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51d3ee00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51d3ee00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x18f66c, dwReserved1=0x4f0048, cFileName="J0115855.GIF", cAlternateFileName="")) returned 1 [0055.259] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.259] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0115855.GIF") returned -1 [0055.259] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0115855.GIF") returned -1 [0055.259] lstrcmpiA (lpString1="", lpString2="J0115855.GIF") returned -1 [0055.259] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF") returned="BD21548_.GIF" [0055.259] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.259] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.259] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.260] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.260] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="J0115855.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF" [0055.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF", pszSpec="*.zip") returned 0 [0055.260] lstrlenA (lpString="*.zip") returned 5 [0055.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF", pszSpec="*.rar") returned 0 [0055.260] lstrlenA (lpString="*.rar") returned 5 [0055.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF", pszSpec="*.7z") returned 0 [0055.260] lstrlenA (lpString="*.7z") returned 4 [0055.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF", pszSpec="*.tar") returned 0 [0055.260] lstrlenA (lpString="*.tar") returned 5 [0055.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF", pszSpec="*.gzip") returned 0 [0055.260] lstrlenA (lpString="*.gzip") returned 6 [0055.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF", pszSpec="*.jpg") returned 0 [0055.260] lstrlenA (lpString="*.jpg") returned 5 [0055.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF", pszSpec="*.jpeg") returned 0 [0055.260] lstrlenA (lpString="*.jpeg") returned 6 [0055.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF", pszSpec="*.psd") returned 0 [0055.260] lstrlenA (lpString="*.psd") returned 5 [0055.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF", pszSpec="*.gif") returned 1 [0055.260] lstrlenA (lpString="*.gif") returned 5 [0055.260] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF" [0055.260] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF" [0055.260] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF." [0055.260] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF.wannacry" [0055.261] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115855.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.261] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11a [0055.261] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x51d3ee00, dwHighDateTime=0x1bd9367), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd408600, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x51d3ee00, dwHighDateTime=0x1bd9367)) returned 1 [0055.261] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.261] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x9c, lpOverlapped=0x0) returned 1 [0055.262] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF") returned="J0115855.GIF" [0055.262] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.262] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x9c, lpOverlapped=0x0) returned 1 [0055.263] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.263] CloseHandle (hObject=0x90) returned 1 [0055.263] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115855.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115855.gif.wannacry")) returned 1 [0055.268] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51d3ee00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51d3ee00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="J0115856.GIF", cAlternateFileName="")) returned 1 [0055.268] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.269] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0115856.GIF") returned -1 [0055.269] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0115856.GIF") returned -1 [0055.269] lstrcmpiA (lpString1="", lpString2="J0115856.GIF") returned -1 [0055.269] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF") returned="J0115855.GIF" [0055.269] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.269] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.269] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="J0115856.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF" [0055.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF", pszSpec="*.zip") returned 0 [0055.269] lstrlenA (lpString="*.zip") returned 5 [0055.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF", pszSpec="*.rar") returned 0 [0055.269] lstrlenA (lpString="*.rar") returned 5 [0055.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF", pszSpec="*.7z") returned 0 [0055.269] lstrlenA (lpString="*.7z") returned 4 [0055.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF", pszSpec="*.tar") returned 0 [0055.269] lstrlenA (lpString="*.tar") returned 5 [0055.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF", pszSpec="*.gzip") returned 0 [0055.269] lstrlenA (lpString="*.gzip") returned 6 [0055.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF", pszSpec="*.jpg") returned 0 [0055.269] lstrlenA (lpString="*.jpg") returned 5 [0055.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF", pszSpec="*.jpeg") returned 0 [0055.269] lstrlenA (lpString="*.jpeg") returned 6 [0055.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF", pszSpec="*.psd") returned 0 [0055.269] lstrlenA (lpString="*.psd") returned 5 [0055.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF", pszSpec="*.gif") returned 1 [0055.270] lstrlenA (lpString="*.gif") returned 5 [0055.270] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF" [0055.270] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF" [0055.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF." [0055.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF.wannacry" [0055.270] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115856.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.270] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11a [0055.270] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x51d3ee00, dwHighDateTime=0x1bd9367), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd408600, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x51d3ee00, dwHighDateTime=0x1bd9367)) returned 1 [0055.270] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.270] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x9c, lpOverlapped=0x0) returned 1 [0055.272] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF") returned="J0115856.GIF" [0055.272] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.272] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x9c, lpOverlapped=0x0) returned 1 [0055.272] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.272] CloseHandle (hObject=0x90) returned 1 [0055.272] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115856.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115856.gif.wannacry")) returned 1 [0055.273] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60220a00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x60220a00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="J0115875.GIF", cAlternateFileName="")) returned 1 [0055.273] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.273] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0115875.GIF") returned -1 [0055.273] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0115875.GIF") returned -1 [0055.273] lstrcmpiA (lpString1="", lpString2="J0115875.GIF") returned -1 [0055.273] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF") returned="J0115856.GIF" [0055.273] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.273] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.273] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.273] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.273] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="J0115875.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF" [0055.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF", pszSpec="*.zip") returned 0 [0055.274] lstrlenA (lpString="*.zip") returned 5 [0055.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF", pszSpec="*.rar") returned 0 [0055.274] lstrlenA (lpString="*.rar") returned 5 [0055.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF", pszSpec="*.7z") returned 0 [0055.274] lstrlenA (lpString="*.7z") returned 4 [0055.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF", pszSpec="*.tar") returned 0 [0055.274] lstrlenA (lpString="*.tar") returned 5 [0055.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF", pszSpec="*.gzip") returned 0 [0055.274] lstrlenA (lpString="*.gzip") returned 6 [0055.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF", pszSpec="*.jpg") returned 0 [0055.274] lstrlenA (lpString="*.jpg") returned 5 [0055.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF", pszSpec="*.jpeg") returned 0 [0055.274] lstrlenA (lpString="*.jpeg") returned 6 [0055.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF", pszSpec="*.psd") returned 0 [0055.274] lstrlenA (lpString="*.psd") returned 5 [0055.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF", pszSpec="*.gif") returned 1 [0055.274] lstrlenA (lpString="*.gif") returned 5 [0055.274] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF" [0055.274] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF" [0055.274] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF." [0055.274] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF.wannacry" [0055.274] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115875.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.275] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d3 [0055.275] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x60220a00, dwHighDateTime=0x1bd9367), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd42e760, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x60220a00, dwHighDateTime=0x1bd9367)) returned 1 [0055.275] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.275] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x155, lpOverlapped=0x0) returned 1 [0055.277] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF") returned="J0115875.GIF" [0055.277] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.277] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x155, lpOverlapped=0x0) returned 1 [0055.277] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.277] CloseHandle (hObject=0x90) returned 1 [0055.278] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115875.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115875.gif.wannacry")) returned 1 [0055.278] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60220a00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x60220a00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="J0115876.GIF", cAlternateFileName="")) returned 1 [0055.278] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.278] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="J0115876.GIF") returned -1 [0055.278] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="J0115876.GIF") returned -1 [0055.278] lstrcmpiA (lpString1="", lpString2="J0115876.GIF") returned -1 [0055.278] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF") returned="J0115875.GIF" [0055.278] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.279] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.279] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.279] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.279] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="J0115876.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF" [0055.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF", pszSpec="*.zip") returned 0 [0055.279] lstrlenA (lpString="*.zip") returned 5 [0055.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF", pszSpec="*.rar") returned 0 [0055.279] lstrlenA (lpString="*.rar") returned 5 [0055.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF", pszSpec="*.7z") returned 0 [0055.279] lstrlenA (lpString="*.7z") returned 4 [0055.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF", pszSpec="*.tar") returned 0 [0055.279] lstrlenA (lpString="*.tar") returned 5 [0055.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF", pszSpec="*.gzip") returned 0 [0055.279] lstrlenA (lpString="*.gzip") returned 6 [0055.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF", pszSpec="*.jpg") returned 0 [0055.279] lstrlenA (lpString="*.jpg") returned 5 [0055.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF", pszSpec="*.jpeg") returned 0 [0055.279] lstrlenA (lpString="*.jpeg") returned 6 [0055.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF", pszSpec="*.psd") returned 0 [0055.279] lstrlenA (lpString="*.psd") returned 5 [0055.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF", pszSpec="*.gif") returned 1 [0055.279] lstrlenA (lpString="*.gif") returned 5 [0055.279] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF" [0055.279] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF" [0055.279] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF.") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF." [0055.280] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF.wannacry" [0055.280] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115876.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.281] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15e [0055.281] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x60220a00, dwHighDateTime=0x1bd9367), lpLastAccessTime=0x407536*(dwLowDateTime=0xbd4548c0, dwHighDateTime=0x1d305f1), lpLastWriteTime=0x40753e*(dwLowDateTime=0x60220a00, dwHighDateTime=0x1bd9367)) returned 1 [0055.281] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.281] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xe0, lpOverlapped=0x0) returned 1 [0055.282] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF") returned="J0115876.GIF" [0055.282] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.282] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xe0, lpOverlapped=0x0) returned 1 [0055.282] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.282] CloseHandle (hObject=0x90) returned 1 [0055.283] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115876.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115876.gif.wannacry")) returned 1 [0055.283] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3b98, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="LINES.DLL", cAlternateFileName="")) returned 1 [0055.283] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.283] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LINES.DLL") returned -1 [0055.283] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LINES.DLL") returned -1 [0055.283] lstrcmpiA (lpString1="", lpString2="LINES.DLL") returned -1 [0055.283] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF") returned="J0115876.GIF" [0055.284] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0055.284] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="" [0055.284] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" [0055.284] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\how to decrypt files.txt")) returned 0x20 [0055.284] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\", lpString2="LINES.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" [0055.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.zip") returned 0 [0055.284] lstrlenA (lpString="*.zip") returned 5 [0055.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.rar") returned 0 [0055.284] lstrlenA (lpString="*.rar") returned 5 [0055.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.7z") returned 0 [0055.284] lstrlenA (lpString="*.7z") returned 4 [0055.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.tar") returned 0 [0055.284] lstrlenA (lpString="*.tar") returned 5 [0055.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.gzip") returned 0 [0055.284] lstrlenA (lpString="*.gzip") returned 6 [0055.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.jpg") returned 0 [0055.284] lstrlenA (lpString="*.jpg") returned 5 [0055.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.jpeg") returned 0 [0055.284] lstrlenA (lpString="*.jpeg") returned 6 [0055.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.psd") returned 0 [0055.284] lstrlenA (lpString="*.psd") returned 5 [0055.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.gif") returned 0 [0055.284] lstrlenA (lpString="*.gif") returned 5 [0055.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.doc") returned 0 [0055.284] lstrlenA (lpString="*.doc") returned 5 [0055.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.docx") returned 0 [0055.285] lstrlenA (lpString="*.docx") returned 6 [0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.xls") returned 0 [0055.285] lstrlenA (lpString="*.xls") returned 5 [0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.xlsx") returned 0 [0055.285] lstrlenA (lpString="*.xlsx") returned 6 [0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.ppt") returned 0 [0055.285] lstrlenA (lpString="*.ppt") returned 5 [0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.pptx") returned 0 [0055.285] lstrlenA (lpString="*.pptx") returned 6 [0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.pdf") returned 0 [0055.285] lstrlenA (lpString="*.pdf") returned 5 [0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.mov") returned 0 [0055.285] lstrlenA (lpString="*.mov") returned 5 [0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.m2v") returned 0 [0055.285] lstrlenA (lpString="*.m2v") returned 5 [0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.3gp") returned 0 [0055.285] lstrlenA (lpString="*.3gp") returned 5 [0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.mpeg") returned 0 [0055.285] lstrlenA (lpString="*.mpeg") returned 6 [0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.mpg") returned 0 [0055.285] lstrlenA (lpString="*.mpg") returned 5 [0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.flv") returned 0 [0055.285] lstrlenA (lpString="*.flv") returned 5 [0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.avi") returned 0 [0055.285] lstrlenA (lpString="*.avi") returned 5 [0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.mp4") returned 0 [0055.285] lstrlenA (lpString="*.mp4") returned 5 [0055.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.wmv") returned 0 [0055.285] lstrlenA (lpString="*.wmv") returned 5 [0055.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.divx") returned 0 [0055.286] lstrlenA (lpString="*.divx") returned 6 [0055.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.mkv") returned 0 [0055.286] lstrlenA (lpString="*.mkv") returned 5 [0055.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.mp3") returned 0 [0055.286] lstrlenA (lpString="*.mp3") returned 5 [0055.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.wav") returned 0 [0055.286] lstrlenA (lpString="*.wav") returned 5 [0055.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.flac") returned 0 [0055.286] lstrlenA (lpString="*.flac") returned 6 [0055.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.ape") returned 0 [0055.286] lstrlenA (lpString="*.ape") returned 5 [0055.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.wma") returned 0 [0055.286] lstrlenA (lpString="*.wma") returned 5 [0055.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.ac3") returned 0 [0055.286] lstrlenA (lpString="*.ac3") returned 5 [0055.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", pszSpec="*.mxf") returned 0 [0055.286] lstrlenA (lpString="*.mxf") returned 5 [0055.286] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3b98, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="LINES.DLL", cAlternateFileName="")) returned 0 [0055.286] FindClose (in: hFindFile=0x2d7ff8 | out: hFindFile=0x2d7ff8) returned 1 [0055.286] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="OFFICE10.DLL", cAlternateFileName="")) returned 1 [0055.286] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.286] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OFFICE10.DLL") returned -1 [0055.286] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OFFICE10.DLL") returned -1 [0055.286] lstrcmpiA (lpString1="", lpString2="OFFICE10.DLL") returned -1 [0055.286] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*.*") returned="*.*" [0055.287] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\" [0055.287] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\") returned="" [0055.287] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\HOW TO DECRYPT FILES.txt" [0055.287] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\how to decrypt files.txt")) returned 0xffffffff [0055.287] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0055.289] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0055.289] WriteFile (in: hFile=0x8c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0055.291] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0055.291] CloseHandle (hObject=0x8c) returned 1 [0055.291] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\", lpString2="OFFICE10.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" [0055.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.zip") returned 0 [0055.291] lstrlenA (lpString="*.zip") returned 5 [0055.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.rar") returned 0 [0055.291] lstrlenA (lpString="*.rar") returned 5 [0055.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.7z") returned 0 [0055.291] lstrlenA (lpString="*.7z") returned 4 [0055.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.tar") returned 0 [0055.291] lstrlenA (lpString="*.tar") returned 5 [0055.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.gzip") returned 0 [0055.291] lstrlenA (lpString="*.gzip") returned 6 [0055.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.jpg") returned 0 [0055.291] lstrlenA (lpString="*.jpg") returned 5 [0055.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.jpeg") returned 0 [0055.291] lstrlenA (lpString="*.jpeg") returned 6 [0055.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.psd") returned 0 [0055.291] lstrlenA (lpString="*.psd") returned 5 [0055.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.gif") returned 0 [0055.291] lstrlenA (lpString="*.gif") returned 5 [0055.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.doc") returned 0 [0055.292] lstrlenA (lpString="*.doc") returned 5 [0055.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.docx") returned 0 [0055.292] lstrlenA (lpString="*.docx") returned 6 [0055.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.xls") returned 0 [0055.292] lstrlenA (lpString="*.xls") returned 5 [0055.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.xlsx") returned 0 [0055.292] lstrlenA (lpString="*.xlsx") returned 6 [0055.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.ppt") returned 0 [0055.292] lstrlenA (lpString="*.ppt") returned 5 [0055.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.pptx") returned 0 [0055.292] lstrlenA (lpString="*.pptx") returned 6 [0055.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.pdf") returned 0 [0055.292] lstrlenA (lpString="*.pdf") returned 5 [0055.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.mov") returned 0 [0055.292] lstrlenA (lpString="*.mov") returned 5 [0055.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.m2v") returned 0 [0055.292] lstrlenA (lpString="*.m2v") returned 5 [0055.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.3gp") returned 0 [0055.292] lstrlenA (lpString="*.3gp") returned 5 [0055.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.mpeg") returned 0 [0055.292] lstrlenA (lpString="*.mpeg") returned 6 [0055.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.mpg") returned 0 [0055.292] lstrlenA (lpString="*.mpg") returned 5 [0055.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.flv") returned 0 [0055.292] lstrlenA (lpString="*.flv") returned 5 [0055.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.avi") returned 0 [0055.292] lstrlenA (lpString="*.avi") returned 5 [0055.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.mp4") returned 0 [0055.293] lstrlenA (lpString="*.mp4") returned 5 [0055.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.wmv") returned 0 [0055.293] lstrlenA (lpString="*.wmv") returned 5 [0055.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.divx") returned 0 [0055.293] lstrlenA (lpString="*.divx") returned 6 [0055.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.mkv") returned 0 [0055.293] lstrlenA (lpString="*.mkv") returned 5 [0055.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.mp3") returned 0 [0055.293] lstrlenA (lpString="*.mp3") returned 5 [0055.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.wav") returned 0 [0055.293] lstrlenA (lpString="*.wav") returned 5 [0055.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.flac") returned 0 [0055.293] lstrlenA (lpString="*.flac") returned 6 [0055.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.ape") returned 0 [0055.293] lstrlenA (lpString="*.ape") returned 5 [0055.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.wma") returned 0 [0055.293] lstrlenA (lpString="*.wma") returned 5 [0055.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.ac3") returned 0 [0055.293] lstrlenA (lpString="*.ac3") returned 5 [0055.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", pszSpec="*.mxf") returned 0 [0055.293] lstrlenA (lpString="*.mxf") returned 5 [0055.293] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156c5e00, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x156c5e00, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x78450, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.MMW", cAlternateFileName="")) returned 1 [0055.293] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.293] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OFFICE10.MMW") returned -1 [0055.293] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OFFICE10.MMW") returned -1 [0055.293] lstrcmpiA (lpString1="", lpString2="OFFICE10.MMW") returned -1 [0055.293] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned="OFFICE10.DLL" [0055.294] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\" [0055.294] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\") returned="" [0055.294] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\HOW TO DECRYPT FILES.txt" [0055.294] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\how to decrypt files.txt")) returned 0x20 [0055.294] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\", lpString2="OFFICE10.MMW" | out: lpString1="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" [0055.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.zip") returned 0 [0055.294] lstrlenA (lpString="*.zip") returned 5 [0055.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.rar") returned 0 [0055.294] lstrlenA (lpString="*.rar") returned 5 [0055.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.7z") returned 0 [0055.294] lstrlenA (lpString="*.7z") returned 4 [0055.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.tar") returned 0 [0055.294] lstrlenA (lpString="*.tar") returned 5 [0055.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.gzip") returned 0 [0055.294] lstrlenA (lpString="*.gzip") returned 6 [0055.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.jpg") returned 0 [0055.294] lstrlenA (lpString="*.jpg") returned 5 [0055.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.jpeg") returned 0 [0055.294] lstrlenA (lpString="*.jpeg") returned 6 [0055.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.psd") returned 0 [0055.294] lstrlenA (lpString="*.psd") returned 5 [0055.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.gif") returned 0 [0055.294] lstrlenA (lpString="*.gif") returned 5 [0055.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.doc") returned 0 [0055.294] lstrlenA (lpString="*.doc") returned 5 [0055.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.docx") returned 0 [0055.295] lstrlenA (lpString="*.docx") returned 6 [0055.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.xls") returned 0 [0055.295] lstrlenA (lpString="*.xls") returned 5 [0055.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.xlsx") returned 0 [0055.295] lstrlenA (lpString="*.xlsx") returned 6 [0055.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.ppt") returned 0 [0055.295] lstrlenA (lpString="*.ppt") returned 5 [0055.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.pptx") returned 0 [0055.295] lstrlenA (lpString="*.pptx") returned 6 [0055.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.pdf") returned 0 [0055.295] lstrlenA (lpString="*.pdf") returned 5 [0055.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.mov") returned 0 [0055.295] lstrlenA (lpString="*.mov") returned 5 [0055.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.m2v") returned 0 [0055.295] lstrlenA (lpString="*.m2v") returned 5 [0055.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.3gp") returned 0 [0055.295] lstrlenA (lpString="*.3gp") returned 5 [0055.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.mpeg") returned 0 [0055.295] lstrlenA (lpString="*.mpeg") returned 6 [0055.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.mpg") returned 0 [0055.295] lstrlenA (lpString="*.mpg") returned 5 [0055.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.flv") returned 0 [0055.295] lstrlenA (lpString="*.flv") returned 5 [0055.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.avi") returned 0 [0055.295] lstrlenA (lpString="*.avi") returned 5 [0055.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.mp4") returned 0 [0055.295] lstrlenA (lpString="*.mp4") returned 5 [0055.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.wmv") returned 0 [0055.296] lstrlenA (lpString="*.wmv") returned 5 [0055.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.divx") returned 0 [0055.296] lstrlenA (lpString="*.divx") returned 6 [0055.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.mkv") returned 0 [0055.296] lstrlenA (lpString="*.mkv") returned 5 [0055.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.mp3") returned 0 [0055.296] lstrlenA (lpString="*.mp3") returned 5 [0055.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.wav") returned 0 [0055.296] lstrlenA (lpString="*.wav") returned 5 [0055.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.flac") returned 0 [0055.296] lstrlenA (lpString="*.flac") returned 6 [0055.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.ape") returned 0 [0055.296] lstrlenA (lpString="*.ape") returned 5 [0055.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.wma") returned 0 [0055.296] lstrlenA (lpString="*.wma") returned 5 [0055.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.ac3") returned 0 [0055.296] lstrlenA (lpString="*.ac3") returned 5 [0055.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", pszSpec="*.mxf") returned 0 [0055.296] lstrlenA (lpString="*.mxf") returned 5 [0055.296] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156c5e00, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x156c5e00, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x78450, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.MMW", cAlternateFileName="")) returned 0 [0055.296] FindClose (in: hFindFile=0x2d8070 | out: hFindFile=0x2d8070) returned 1 [0055.296] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="OFFICE14", cAlternateFileName="")) returned 0 [0055.297] FindClose (in: hFindFile=0x2d6f58 | out: hFindFile=0x2d6f58) returned 1 [0055.297] FindNextFileA (in: hFindFile=0x2d6fb0, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004d, dwReserved1=0x3, cFileName="Office14", cAlternateFileName="")) returned 1 [0055.297] lstrcmpA (lpString1=".", lpString2="Office14") returned -1 [0055.297] lstrcmpA (lpString1="..", lpString2="Office14") returned -1 [0055.297] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\*.*") returned="*.*" [0055.297] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\", lpString2="Office14" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0055.297] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14") returned 42 [0055.297] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2d6f58 [0055.297] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0055.297] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.301] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0055.301] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0055.301] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0055.301] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0055.301] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0055.301] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*" [0055.301] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="1033" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0055.301] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned 47 [0055.301] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2d8068 [0055.302] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0055.302] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0055.303] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0055.303] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0055.303] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x14e98550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x53b0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ACCDDSUI.DLL", cAlternateFileName="")) returned 1 [0055.303] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.303] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACCDDSUI.DLL") returned 1 [0055.303] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACCDDSUI.DLL") returned 1 [0055.303] lstrcmpiA (lpString1="", lpString2="ACCDDSUI.DLL") returned -1 [0055.303] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\*.*") returned="*.*" [0055.303] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.303] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0055.303] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0055.303] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0xffffffff [0055.303] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0055.304] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0055.304] WriteFile (in: hFile=0x8c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0055.306] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0055.306] CloseHandle (hObject=0x8c) returned 1 [0055.306] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="ACCDDSUI.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" [0055.306] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.zip") returned 0 [0055.306] lstrlenA (lpString="*.zip") returned 5 [0055.306] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.rar") returned 0 [0055.306] lstrlenA (lpString="*.rar") returned 5 [0055.306] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.7z") returned 0 [0055.306] lstrlenA (lpString="*.7z") returned 4 [0055.306] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.tar") returned 0 [0055.306] lstrlenA (lpString="*.tar") returned 5 [0055.306] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.gzip") returned 0 [0055.306] lstrlenA (lpString="*.gzip") returned 6 [0055.306] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.jpg") returned 0 [0055.306] lstrlenA (lpString="*.jpg") returned 5 [0055.306] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.jpeg") returned 0 [0055.306] lstrlenA (lpString="*.jpeg") returned 6 [0055.306] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.psd") returned 0 [0055.307] lstrlenA (lpString="*.psd") returned 5 [0055.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.gif") returned 0 [0055.307] lstrlenA (lpString="*.gif") returned 5 [0055.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.doc") returned 0 [0055.307] lstrlenA (lpString="*.doc") returned 5 [0055.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.docx") returned 0 [0055.307] lstrlenA (lpString="*.docx") returned 6 [0055.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.xls") returned 0 [0055.307] lstrlenA (lpString="*.xls") returned 5 [0055.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.xlsx") returned 0 [0055.307] lstrlenA (lpString="*.xlsx") returned 6 [0055.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.ppt") returned 0 [0055.307] lstrlenA (lpString="*.ppt") returned 5 [0055.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.pptx") returned 0 [0055.307] lstrlenA (lpString="*.pptx") returned 6 [0055.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.pdf") returned 0 [0055.307] lstrlenA (lpString="*.pdf") returned 5 [0055.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.mov") returned 0 [0055.307] lstrlenA (lpString="*.mov") returned 5 [0055.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.m2v") returned 0 [0055.307] lstrlenA (lpString="*.m2v") returned 5 [0055.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.3gp") returned 0 [0055.307] lstrlenA (lpString="*.3gp") returned 5 [0055.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.mpeg") returned 0 [0055.307] lstrlenA (lpString="*.mpeg") returned 6 [0055.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.mpg") returned 0 [0055.307] lstrlenA (lpString="*.mpg") returned 5 [0055.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.flv") returned 0 [0055.308] lstrlenA (lpString="*.flv") returned 5 [0055.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.avi") returned 0 [0055.308] lstrlenA (lpString="*.avi") returned 5 [0055.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.mp4") returned 0 [0055.308] lstrlenA (lpString="*.mp4") returned 5 [0055.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.wmv") returned 0 [0055.308] lstrlenA (lpString="*.wmv") returned 5 [0055.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.divx") returned 0 [0055.308] lstrlenA (lpString="*.divx") returned 6 [0055.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.mkv") returned 0 [0055.308] lstrlenA (lpString="*.mkv") returned 5 [0055.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.mp3") returned 0 [0055.308] lstrlenA (lpString="*.mp3") returned 5 [0055.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.wav") returned 0 [0055.308] lstrlenA (lpString="*.wav") returned 5 [0055.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.flac") returned 0 [0055.308] lstrlenA (lpString="*.flac") returned 6 [0055.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.ape") returned 0 [0055.308] lstrlenA (lpString="*.ape") returned 5 [0055.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.wma") returned 0 [0055.308] lstrlenA (lpString="*.wma") returned 5 [0055.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.ac3") returned 0 [0055.308] lstrlenA (lpString="*.ac3") returned 5 [0055.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", pszSpec="*.mxf") returned 0 [0055.308] lstrlenA (lpString="*.mxf") returned 5 [0055.309] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d407000, ftCreationTime.dwHighDateTime=0x1ca8d26, ftLastAccessTime.dwLowDateTime=0x14ebe6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9d407000, ftLastWriteTime.dwHighDateTime=0x1ca8d26, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCESS12.ACC", cAlternateFileName="")) returned 1 [0055.309] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.309] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACCESS12.ACC") returned 1 [0055.309] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACCESS12.ACC") returned 1 [0055.309] lstrcmpiA (lpString1="", lpString2="ACCESS12.ACC") returned -1 [0055.309] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned="ACCDDSUI.DLL" [0055.309] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.309] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0055.309] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0055.309] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0055.309] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="ACCESS12.ACC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" [0055.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.zip") returned 0 [0055.309] lstrlenA (lpString="*.zip") returned 5 [0055.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.rar") returned 0 [0055.309] lstrlenA (lpString="*.rar") returned 5 [0055.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.7z") returned 0 [0055.309] lstrlenA (lpString="*.7z") returned 4 [0055.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.tar") returned 0 [0055.309] lstrlenA (lpString="*.tar") returned 5 [0055.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.gzip") returned 0 [0055.309] lstrlenA (lpString="*.gzip") returned 6 [0055.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.jpg") returned 0 [0055.310] lstrlenA (lpString="*.jpg") returned 5 [0055.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.jpeg") returned 0 [0055.310] lstrlenA (lpString="*.jpeg") returned 6 [0055.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.psd") returned 0 [0055.310] lstrlenA (lpString="*.psd") returned 5 [0055.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.gif") returned 0 [0055.310] lstrlenA (lpString="*.gif") returned 5 [0055.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.doc") returned 0 [0055.310] lstrlenA (lpString="*.doc") returned 5 [0055.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.docx") returned 0 [0055.310] lstrlenA (lpString="*.docx") returned 6 [0055.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.xls") returned 0 [0055.310] lstrlenA (lpString="*.xls") returned 5 [0055.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.xlsx") returned 0 [0055.310] lstrlenA (lpString="*.xlsx") returned 6 [0055.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.ppt") returned 0 [0055.310] lstrlenA (lpString="*.ppt") returned 5 [0055.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.pptx") returned 0 [0055.310] lstrlenA (lpString="*.pptx") returned 6 [0055.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.pdf") returned 0 [0055.310] lstrlenA (lpString="*.pdf") returned 5 [0055.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.mov") returned 0 [0055.310] lstrlenA (lpString="*.mov") returned 5 [0055.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.m2v") returned 0 [0055.310] lstrlenA (lpString="*.m2v") returned 5 [0055.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.3gp") returned 0 [0055.311] lstrlenA (lpString="*.3gp") returned 5 [0055.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.mpeg") returned 0 [0055.311] lstrlenA (lpString="*.mpeg") returned 6 [0055.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.mpg") returned 0 [0055.311] lstrlenA (lpString="*.mpg") returned 5 [0055.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.flv") returned 0 [0055.311] lstrlenA (lpString="*.flv") returned 5 [0055.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.avi") returned 0 [0055.311] lstrlenA (lpString="*.avi") returned 5 [0055.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.mp4") returned 0 [0055.311] lstrlenA (lpString="*.mp4") returned 5 [0055.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.wmv") returned 0 [0055.311] lstrlenA (lpString="*.wmv") returned 5 [0055.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.divx") returned 0 [0055.311] lstrlenA (lpString="*.divx") returned 6 [0055.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.mkv") returned 0 [0055.311] lstrlenA (lpString="*.mkv") returned 5 [0055.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.mp3") returned 0 [0055.311] lstrlenA (lpString="*.mp3") returned 5 [0055.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.wav") returned 0 [0055.311] lstrlenA (lpString="*.wav") returned 5 [0055.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.flac") returned 0 [0055.311] lstrlenA (lpString="*.flac") returned 6 [0055.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.ape") returned 0 [0055.311] lstrlenA (lpString="*.ape") returned 5 [0055.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.wma") returned 0 [0055.312] lstrlenA (lpString="*.wma") returned 5 [0055.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.ac3") returned 0 [0055.312] lstrlenA (lpString="*.ac3") returned 5 [0055.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", pszSpec="*.mxf") returned 0 [0055.312] lstrlenA (lpString="*.mxf") returned 5 [0055.312] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x33b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCOLKI.DLL", cAlternateFileName="")) returned 1 [0055.312] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.312] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACCOLKI.DLL") returned 1 [0055.312] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACCOLKI.DLL") returned 1 [0055.312] lstrcmpiA (lpString1="", lpString2="ACCOLKI.DLL") returned -1 [0055.312] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned="ACCESS12.ACC" [0055.312] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.312] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0055.312] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0055.312] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0055.312] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="ACCOLKI.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" [0055.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.zip") returned 0 [0055.312] lstrlenA (lpString="*.zip") returned 5 [0055.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.rar") returned 0 [0055.313] lstrlenA (lpString="*.rar") returned 5 [0055.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.7z") returned 0 [0055.313] lstrlenA (lpString="*.7z") returned 4 [0055.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.tar") returned 0 [0055.313] lstrlenA (lpString="*.tar") returned 5 [0055.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.gzip") returned 0 [0055.313] lstrlenA (lpString="*.gzip") returned 6 [0055.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.jpg") returned 0 [0055.313] lstrlenA (lpString="*.jpg") returned 5 [0055.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.jpeg") returned 0 [0055.313] lstrlenA (lpString="*.jpeg") returned 6 [0055.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.psd") returned 0 [0055.313] lstrlenA (lpString="*.psd") returned 5 [0055.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.gif") returned 0 [0055.313] lstrlenA (lpString="*.gif") returned 5 [0055.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.doc") returned 0 [0055.313] lstrlenA (lpString="*.doc") returned 5 [0055.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.docx") returned 0 [0055.313] lstrlenA (lpString="*.docx") returned 6 [0055.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.xls") returned 0 [0055.313] lstrlenA (lpString="*.xls") returned 5 [0055.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.xlsx") returned 0 [0055.313] lstrlenA (lpString="*.xlsx") returned 6 [0055.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.ppt") returned 0 [0055.313] lstrlenA (lpString="*.ppt") returned 5 [0055.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.pptx") returned 0 [0055.313] lstrlenA (lpString="*.pptx") returned 6 [0055.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.pdf") returned 0 [0055.314] lstrlenA (lpString="*.pdf") returned 5 [0055.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.mov") returned 0 [0055.314] lstrlenA (lpString="*.mov") returned 5 [0055.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.m2v") returned 0 [0055.314] lstrlenA (lpString="*.m2v") returned 5 [0055.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.3gp") returned 0 [0055.314] lstrlenA (lpString="*.3gp") returned 5 [0055.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.mpeg") returned 0 [0055.314] lstrlenA (lpString="*.mpeg") returned 6 [0055.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.mpg") returned 0 [0055.314] lstrlenA (lpString="*.mpg") returned 5 [0055.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.flv") returned 0 [0055.314] lstrlenA (lpString="*.flv") returned 5 [0055.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.avi") returned 0 [0055.314] lstrlenA (lpString="*.avi") returned 5 [0055.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.mp4") returned 0 [0055.314] lstrlenA (lpString="*.mp4") returned 5 [0055.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.wmv") returned 0 [0055.314] lstrlenA (lpString="*.wmv") returned 5 [0055.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.divx") returned 0 [0055.314] lstrlenA (lpString="*.divx") returned 6 [0055.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.mkv") returned 0 [0055.314] lstrlenA (lpString="*.mkv") returned 5 [0055.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.mp3") returned 0 [0055.314] lstrlenA (lpString="*.mp3") returned 5 [0055.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.wav") returned 0 [0055.314] lstrlenA (lpString="*.wav") returned 5 [0055.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.flac") returned 0 [0055.315] lstrlenA (lpString="*.flac") returned 6 [0055.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.ape") returned 0 [0055.315] lstrlenA (lpString="*.ape") returned 5 [0055.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.wma") returned 0 [0055.315] lstrlenA (lpString="*.wma") returned 5 [0055.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.ac3") returned 0 [0055.315] lstrlenA (lpString="*.ac3") returned 5 [0055.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", pszSpec="*.mxf") returned 0 [0055.315] lstrlenA (lpString="*.mxf") returned 5 [0055.315] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6146600, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6146600, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x26b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCVDTUI.DLL", cAlternateFileName="")) returned 1 [0055.315] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.315] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACCVDTUI.DLL") returned 1 [0055.315] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACCVDTUI.DLL") returned 1 [0055.315] lstrcmpiA (lpString1="", lpString2="ACCVDTUI.DLL") returned -1 [0055.315] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned="ACCOLKI.DLL" [0055.315] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.315] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0055.315] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0055.315] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0055.315] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="ACCVDTUI.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" [0055.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.zip") returned 0 [0055.315] lstrlenA (lpString="*.zip") returned 5 [0055.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.rar") returned 0 [0055.315] lstrlenA (lpString="*.rar") returned 5 [0055.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.7z") returned 0 [0055.316] lstrlenA (lpString="*.7z") returned 4 [0055.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.tar") returned 0 [0055.316] lstrlenA (lpString="*.tar") returned 5 [0055.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.gzip") returned 0 [0055.316] lstrlenA (lpString="*.gzip") returned 6 [0055.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.jpg") returned 0 [0055.316] lstrlenA (lpString="*.jpg") returned 5 [0055.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.jpeg") returned 0 [0055.316] lstrlenA (lpString="*.jpeg") returned 6 [0055.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.psd") returned 0 [0055.316] lstrlenA (lpString="*.psd") returned 5 [0055.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.gif") returned 0 [0055.316] lstrlenA (lpString="*.gif") returned 5 [0055.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.doc") returned 0 [0055.316] lstrlenA (lpString="*.doc") returned 5 [0055.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.docx") returned 0 [0055.316] lstrlenA (lpString="*.docx") returned 6 [0055.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.xls") returned 0 [0055.316] lstrlenA (lpString="*.xls") returned 5 [0055.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.xlsx") returned 0 [0055.316] lstrlenA (lpString="*.xlsx") returned 6 [0055.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.ppt") returned 0 [0055.316] lstrlenA (lpString="*.ppt") returned 5 [0055.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.pptx") returned 0 [0055.316] lstrlenA (lpString="*.pptx") returned 6 [0055.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.pdf") returned 0 [0055.316] lstrlenA (lpString="*.pdf") returned 5 [0055.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.mov") returned 0 [0055.317] lstrlenA (lpString="*.mov") returned 5 [0055.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.m2v") returned 0 [0055.317] lstrlenA (lpString="*.m2v") returned 5 [0055.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.3gp") returned 0 [0055.317] lstrlenA (lpString="*.3gp") returned 5 [0055.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.mpeg") returned 0 [0055.317] lstrlenA (lpString="*.mpeg") returned 6 [0055.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.mpg") returned 0 [0055.317] lstrlenA (lpString="*.mpg") returned 5 [0055.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.flv") returned 0 [0055.317] lstrlenA (lpString="*.flv") returned 5 [0055.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.avi") returned 0 [0055.317] lstrlenA (lpString="*.avi") returned 5 [0055.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.mp4") returned 0 [0055.317] lstrlenA (lpString="*.mp4") returned 5 [0055.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.wmv") returned 0 [0055.317] lstrlenA (lpString="*.wmv") returned 5 [0055.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.divx") returned 0 [0055.317] lstrlenA (lpString="*.divx") returned 6 [0055.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.mkv") returned 0 [0055.317] lstrlenA (lpString="*.mkv") returned 5 [0055.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.mp3") returned 0 [0055.317] lstrlenA (lpString="*.mp3") returned 5 [0055.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.wav") returned 0 [0055.317] lstrlenA (lpString="*.wav") returned 5 [0055.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.flac") returned 0 [0055.317] lstrlenA (lpString="*.flac") returned 6 [0055.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.ape") returned 0 [0055.318] lstrlenA (lpString="*.ape") returned 5 [0055.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.wma") returned 0 [0055.318] lstrlenA (lpString="*.wma") returned 5 [0055.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.ac3") returned 0 [0055.318] lstrlenA (lpString="*.ac3") returned 5 [0055.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", pszSpec="*.mxf") returned 0 [0055.318] lstrlenA (lpString="*.mxf") returned 5 [0055.318] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a36c100, ftCreationTime.dwHighDateTime=0x1c6af9a, ftLastAccessTime.dwLowDateTime=0x150ad890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a36c100, ftLastWriteTime.dwHighDateTime=0x1c6af9a, nFileSizeHigh=0x0, nFileSizeLow=0x53de0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIP10.HLP", cAlternateFileName="")) returned 1 [0055.318] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.318] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACTIP10.HLP") returned 1 [0055.318] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACTIP10.HLP") returned 1 [0055.318] lstrcmpiA (lpString1="", lpString2="ACTIP10.HLP") returned -1 [0055.318] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned="ACCVDTUI.DLL" [0055.318] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.318] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0055.318] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0055.318] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0055.318] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="ACTIP10.HLP" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" [0055.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.zip") returned 0 [0055.318] lstrlenA (lpString="*.zip") returned 5 [0055.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.rar") returned 0 [0055.318] lstrlenA (lpString="*.rar") returned 5 [0055.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.7z") returned 0 [0055.318] lstrlenA (lpString="*.7z") returned 4 [0055.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.tar") returned 0 [0055.319] lstrlenA (lpString="*.tar") returned 5 [0055.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.gzip") returned 0 [0055.319] lstrlenA (lpString="*.gzip") returned 6 [0055.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.jpg") returned 0 [0055.319] lstrlenA (lpString="*.jpg") returned 5 [0055.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.jpeg") returned 0 [0055.319] lstrlenA (lpString="*.jpeg") returned 6 [0055.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.psd") returned 0 [0055.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.gif") returned 0 [0055.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.doc") returned 0 [0055.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.docx") returned 0 [0055.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.xls") returned 0 [0055.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.xlsx") returned 0 [0055.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.ppt") returned 0 [0055.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.pptx") returned 0 [0055.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.pdf") returned 0 [0055.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.mov") returned 0 [0055.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.m2v") returned 0 [0055.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.3gp") returned 0 [0055.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.mpeg") returned 0 [0055.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.mpg") returned 0 [0055.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.flv") returned 0 [0055.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.avi") returned 0 [0055.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.mp4") returned 0 [0055.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.wmv") returned 0 [0055.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.divx") returned 0 [0055.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.mkv") returned 0 [0055.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.mp3") returned 0 [0055.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.wav") returned 0 [0055.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.flac") returned 0 [0055.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.ape") returned 0 [0055.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.wma") returned 0 [0055.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.ac3") returned 0 [0055.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", pszSpec="*.mxf") returned 0 [0055.320] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefafd800, ftCreationTime.dwHighDateTime=0x1ca674a, ftLastAccessTime.dwLowDateTime=0x150ad890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefafd800, ftLastWriteTime.dwHighDateTime=0x1ca674a, nFileSizeHigh=0x0, nFileSizeLow=0x43590, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWIZRC.DLL", cAlternateFileName="")) returned 1 [0055.320] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.320] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACWIZRC.DLL") returned 1 [0055.320] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACWIZRC.DLL") returned 1 [0055.320] lstrcmpiA (lpString1="", lpString2="ACWIZRC.DLL") returned -1 [0055.320] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned="ACTIP10.HLP" [0055.320] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.320] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0055.320] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0055.320] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0055.321] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="ACWIZRC.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" [0055.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.zip") returned 0 [0055.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.rar") returned 0 [0055.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.7z") returned 0 [0055.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.tar") returned 0 [0055.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.gzip") returned 0 [0055.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.jpg") returned 0 [0055.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.jpeg") returned 0 [0055.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.psd") returned 0 [0055.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.gif") returned 0 [0055.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.doc") returned 0 [0055.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.docx") returned 0 [0055.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.xls") returned 0 [0055.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.xlsx") returned 0 [0055.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.ppt") returned 0 [0055.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.pptx") returned 0 [0055.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.pdf") returned 0 [0055.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.mov") returned 0 [0055.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.m2v") returned 0 [0055.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.3gp") returned 0 [0055.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.mpeg") returned 0 [0055.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.mpg") returned 0 [0055.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.flv") returned 0 [0055.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.avi") returned 0 [0055.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.mp4") returned 0 [0055.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.wmv") returned 0 [0055.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.divx") returned 0 [0055.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.mkv") returned 0 [0055.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.mp3") returned 0 [0055.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.wav") returned 0 [0055.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.flac") returned 0 [0055.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.ape") returned 0 [0055.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.wma") returned 0 [0055.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.ac3") returned 0 [0055.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", pszSpec="*.mxf") returned 0 [0055.322] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ab4f00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5054cac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb4ab4f00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x10f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="AEC.VSL", cAlternateFileName="")) returned 1 [0055.322] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.322] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AEC.VSL") returned 1 [0055.322] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AEC.VSL") returned 1 [0055.322] lstrcmpiA (lpString1="", lpString2="AEC.VSL") returned -1 [0055.322] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned="ACWIZRC.DLL" [0055.323] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.323] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0055.323] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0055.323] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0055.323] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="AEC.VSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" [0055.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.zip") returned 0 [0055.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.rar") returned 0 [0055.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.7z") returned 0 [0055.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.tar") returned 0 [0055.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.gzip") returned 0 [0055.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.jpg") returned 0 [0055.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.jpeg") returned 0 [0055.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.psd") returned 0 [0055.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.gif") returned 0 [0055.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.doc") returned 0 [0055.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.docx") returned 0 [0055.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.xls") returned 0 [0055.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.xlsx") returned 0 [0055.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.ppt") returned 0 [0055.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.pptx") returned 0 [0055.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.pdf") returned 0 [0055.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.mov") returned 0 [0055.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.m2v") returned 0 [0055.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.3gp") returned 0 [0055.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.mpeg") returned 0 [0055.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.mpg") returned 0 [0055.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.flv") returned 0 [0055.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.avi") returned 0 [0055.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.mp4") returned 0 [0055.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.wmv") returned 0 [0055.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.divx") returned 0 [0055.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.mkv") returned 0 [0055.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.mp3") returned 0 [0055.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.wav") returned 0 [0055.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.flac") returned 0 [0055.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.ape") returned 0 [0055.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.wma") returned 0 [0055.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.ac3") returned 0 [0055.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", pszSpec="*.mxf") returned 0 [0055.324] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5054cac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0x0, dwReserved1=0x0, cFileName="AECUTILS.VSL", cAlternateFileName="")) returned 1 [0055.324] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.324] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AECUTILS.VSL") returned 1 [0055.325] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AECUTILS.VSL") returned 1 [0055.325] lstrcmpiA (lpString1="", lpString2="AECUTILS.VSL") returned -1 [0055.325] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned="AEC.VSL" [0055.325] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.325] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0055.325] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0055.325] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0055.325] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="AECUTILS.VSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" [0055.325] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL", pszSpec="*.zip") returned 0 [0055.325] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL", pszSpec="*.rar") returned 0 [0055.325] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL", pszSpec="*.7z") returned 0 [0055.325] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL", pszSpec="*.tar") returned 0 [0055.325] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL", pszSpec="*.gzip") returned 0 [0055.325] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL", pszSpec="*.jpg") returned 0 [0055.325] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL", pszSpec="*.jpeg") returned 0 [0055.325] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL", pszSpec="*.psd") returned 0 [0055.325] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL", pszSpec="*.gif") returned 0 [0055.325] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL", pszSpec="*.doc") returned 0 [0055.325] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL", pszSpec="*.docx") returned 0 [0055.326] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2b17900, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x50598d80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe2b17900, ftLastWriteTime.dwHighDateTime=0x1c55530, nFileSizeHigh=0x0, nFileSizeLow=0x69e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ASSET.VRD", cAlternateFileName="")) returned 1 [0055.326] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.326] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ASSET.VRD") returned 1 [0055.326] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ASSET.VRD") returned 1 [0055.326] lstrcmpiA (lpString1="", lpString2="ASSET.VRD") returned -1 [0055.326] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.326] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0055.326] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0055.326] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0055.326] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="ASSET.VRD" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" [0055.326] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3375600, ftCreationTime.dwHighDateTime=0x1c2fe69, ftLastAccessTime.dwLowDateTime=0x505e5040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc3375600, ftLastWriteTime.dwHighDateTime=0x1c2fe69, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASIC.HTM", cAlternateFileName="")) returned 1 [0055.326] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.327] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BASIC.HTM") returned 1 [0055.327] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BASIC.HTM") returned 1 [0055.327] lstrcmpiA (lpString1="", lpString2="BASIC.HTM") returned -1 [0055.327] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.327] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0055.327] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0055.327] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0055.327] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="BASIC.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM" [0055.327] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x6180, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSRuntimeRes.dll", cAlternateFileName="BCSRUN~1.DLL")) returned 1 [0055.327] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.327] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BCSRuntimeRes.dll") returned 1 [0055.327] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCSRuntimeRes.dll") returned 1 [0055.327] lstrcmpiA (lpString1="", lpString2="BCSRuntimeRes.dll") returned -1 [0055.327] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.327] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0055.327] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0055.327] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0055.327] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="BCSRuntimeRes.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" [0055.328] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b056800, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3b056800, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x2778, dwReserved0=0x0, dwReserved1=0x0, cFileName="BHOINTL.DLL", cAlternateFileName="")) returned 1 [0055.328] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.328] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BHOINTL.DLL") returned 1 [0055.328] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BHOINTL.DLL") returned 1 [0055.328] lstrcmpiA (lpString1="", lpString2="BHOINTL.DLL") returned -1 [0055.328] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.328] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0055.328] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0055.328] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0055.328] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="BHOINTL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" [0055.328] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e1bb530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bibliography", cAlternateFileName="BIBLIO~1")) returned 1 [0055.328] lstrcmpA (lpString1=".", lpString2="Bibliography") returned -1 [0055.328] lstrcmpA (lpString1="..", lpString2="Bibliography") returned -1 [0055.328] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="Bibliography" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography" [0055.328] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e1bb530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d8138, cFileName=".", cAlternateFileName="")) returned 0x2d7ff8 [0055.330] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0055.330] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e1bb530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0055.330] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0055.330] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0055.330] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b715800, ftCreationTime.dwHighDateTime=0x1c8bfc3, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b715800, ftLastWriteTime.dwHighDateTime=0x1c8bfc3, nFileSizeHigh=0x0, nFileSizeLow=0x165e2, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BIBFORM.XML", cAlternateFileName="")) returned 1 [0055.330] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.330] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BIBFORM.XML") returned 1 [0055.330] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BIBFORM.XML") returned 1 [0055.330] lstrcmpiA (lpString1="", lpString2="BIBFORM.XML") returned -1 [0055.330] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\" [0055.330] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\") returned="" [0055.330] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\HOW TO DECRYPT FILES.txt" [0055.330] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bibliography\\how to decrypt files.txt")) returned 0xffffffff [0055.330] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bibliography\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.334] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0055.334] CloseHandle (hObject=0x90) returned 1 [0055.334] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\", lpString2="BIBFORM.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\BIBFORM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\BIBFORM.XML" [0055.334] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b715800, ftCreationTime.dwHighDateTime=0x1c8bfc3, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b715800, ftLastWriteTime.dwHighDateTime=0x1c8bfc3, nFileSizeHigh=0x0, nFileSizeLow=0x165e2, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BIBFORM.XML", cAlternateFileName="")) returned 0 [0055.334] FindClose (in: hFindFile=0x2d7ff8 | out: hFindFile=0x2d7ff8) returned 1 [0055.334] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5067d5c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xb390, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="BSTORM.VSL", cAlternateFileName="")) returned 1 [0055.335] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.335] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BSTORM.VSL") returned 1 [0055.335] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BSTORM.VSL") returned 1 [0055.335] lstrcmpiA (lpString1="", lpString2="BSTORM.VSL") returned -1 [0055.335] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.335] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0055.335] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0055.335] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0055.335] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="BSTORM.VSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" [0055.335] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x506a3720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BW.CSS", cAlternateFileName="")) returned 1 [0055.335] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.335] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BW.CSS") returned 1 [0055.335] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BW.CSS") returned 1 [0055.335] lstrcmpiA (lpString1="", lpString2="BW.CSS") returned -1 [0055.335] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.335] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0055.335] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0055.335] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0055.335] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="BW.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS" [0055.336] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb09b400, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x506a3720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xeb09b400, ftLastWriteTime.dwHighDateTime=0x1c55530, nFileSizeHigh=0x0, nFileSizeLow=0x860, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALEVENT.VRD", cAlternateFileName="")) returned 1 [0055.336] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.336] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CALEVENT.VRD") returned 1 [0055.336] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CALEVENT.VRD") returned 1 [0055.336] lstrcmpiA (lpString1="", lpString2="CALEVENT.VRD") returned -1 [0055.336] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.336] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0055.336] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0055.336] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0055.336] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="CALEVENT.VRD" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" [0055.336] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="CERTINTL.DLL", cAlternateFileName="")) returned 1 [0055.336] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.336] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CERTINTL.DLL") returned 1 [0055.336] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CERTINTL.DLL") returned 1 [0055.336] lstrcmpiA (lpString1="", lpString2="CERTINTL.DLL") returned -1 [0055.336] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.336] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0055.336] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0055.336] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0055.336] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="CERTINTL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" [0055.337] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49538400, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0xeec9ffd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49538400, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x4da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLVWINTL.DLL", cAlternateFileName="")) returned 1 [0055.337] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.337] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CLVWINTL.DLL") returned 1 [0055.337] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CLVWINTL.DLL") returned 1 [0055.337] lstrcmpiA (lpString1="", lpString2="CLVWINTL.DLL") returned -1 [0055.337] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.337] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0055.337] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0055.337] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0055.337] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="CLVWINTL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" [0055.337] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5073bca0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x8990, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMAXRES.DLL", cAlternateFileName="")) returned 1 [0055.337] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.337] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CMAXRES.DLL") returned 1 [0055.337] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CMAXRES.DLL") returned 1 [0055.337] lstrcmpiA (lpString1="", lpString2="CMAXRES.DLL") returned -1 [0055.337] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.337] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0055.337] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0055.337] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0055.337] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="CMAXRES.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" [0055.338] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x5073bca0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="COFFEE.CSS", cAlternateFileName="")) returned 1 [0055.338] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.338] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="COFFEE.CSS") returned 1 [0055.338] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="COFFEE.CSS") returned 1 [0055.338] lstrcmpiA (lpString1="", lpString2="COFFEE.CSS") returned -1 [0055.338] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.338] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0055.338] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0055.338] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0055.338] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="COFFEE.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS" [0055.338] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc4600, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeec9ffd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62bc4600, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x35be, dwReserved0=0x0, dwReserved1=0x0, cFileName="CollectSignatures_Init.xsn", cAlternateFileName="COLLEC~1.XSN")) returned 1 [0055.338] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.338] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CollectSignatures_Init.xsn") returned 1 [0055.338] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CollectSignatures_Init.xsn") returned 1 [0055.338] lstrcmpiA (lpString1="", lpString2="CollectSignatures_Init.xsn") returned -1 [0055.338] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.338] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0055.338] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0055.338] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0055.338] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="CollectSignatures_Init.xsn" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn" [0055.339] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618b1900, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x618b1900, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x36fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="CollectSignatures_Sign.xsn", cAlternateFileName="COLLEC~2.XSN")) returned 1 [0055.339] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.339] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CollectSignatures_Sign.xsn") returned 1 [0055.339] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CollectSignatures_Sign.xsn") returned 1 [0055.339] lstrcmpiA (lpString1="", lpString2="CollectSignatures_Sign.xsn") returned -1 [0055.339] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.339] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0055.339] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0055.339] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0055.339] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="CollectSignatures_Sign.xsn" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn" [0055.339] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63409700, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x63409700, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContactPickerIntl.dll", cAlternateFileName="CONTAC~1.DLL")) returned 1 [0055.339] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.339] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ContactPickerIntl.dll") returned 1 [0055.339] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ContactPickerIntl.dll") returned 1 [0055.339] lstrcmpiA (lpString1="", lpString2="ContactPickerIntl.dll") returned -1 [0055.339] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.339] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0055.339] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0055.339] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0055.339] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="ContactPickerIntl.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" [0055.340] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73908200, ftCreationTime.dwHighDateTime=0x1ca7ab5, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x73908200, ftLastWriteTime.dwHighDateTime=0x1ca7ab5, nFileSizeHigh=0x0, nFileSizeLow=0x17b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="CT_ROOTS.XML", cAlternateFileName="")) returned 1 [0055.340] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.340] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CT_ROOTS.XML") returned 1 [0055.340] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CT_ROOTS.XML") returned 1 [0055.340] lstrcmpiA (lpString1="", lpString2="CT_ROOTS.XML") returned -1 [0055.340] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.340] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0055.340] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0055.340] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0055.340] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="CT_ROOTS.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML" [0055.340] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecec290, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataServices", cAlternateFileName="DATASE~1")) returned 1 [0055.340] lstrcmpA (lpString1=".", lpString2="DataServices") returned -1 [0055.340] lstrcmpA (lpString1="..", lpString2="DataServices") returned -1 [0055.340] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="DataServices" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices" [0055.340] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices") returned 60 [0055.340] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecec290, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d8138, cFileName=".", cAlternateFileName="")) returned 0x2d7ff8 [0055.343] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0055.343] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecec290, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0055.343] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0055.343] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0055.343] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa887a200, ftCreationTime.dwHighDateTime=0x1c026ae, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa887a200, ftLastWriteTime.dwHighDateTime=0x1c026ae, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="+Connect to New Data Source.odc", cAlternateFileName="_CONNE~1.ODC")) returned 1 [0055.343] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.343] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="+Connect to New Data Source.odc") returned 1 [0055.343] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="+Connect to New Data Source.odc") returned 1 [0055.343] lstrcmpiA (lpString1="", lpString2="+Connect to New Data Source.odc") returned -1 [0055.343] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\*.*") returned="*.*" [0055.343] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\" [0055.343] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\") returned="" [0055.344] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\HOW TO DECRYPT FILES.txt" [0055.344] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\how to decrypt files.txt")) returned 0xffffffff [0055.344] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.344] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0055.344] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0055.346] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0055.346] CloseHandle (hObject=0x90) returned 1 [0055.346] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\", lpString2="+Connect to New Data Source.odc" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc" [0055.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.zip") returned 0 [0055.346] lstrlenA (lpString="*.zip") returned 5 [0055.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.rar") returned 0 [0055.346] lstrlenA (lpString="*.rar") returned 5 [0055.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.7z") returned 0 [0055.346] lstrlenA (lpString="*.7z") returned 4 [0055.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.tar") returned 0 [0055.346] lstrlenA (lpString="*.tar") returned 5 [0055.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.gzip") returned 0 [0055.347] lstrlenA (lpString="*.gzip") returned 6 [0055.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.jpg") returned 0 [0055.347] lstrlenA (lpString="*.jpg") returned 5 [0055.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.jpeg") returned 0 [0055.347] lstrlenA (lpString="*.jpeg") returned 6 [0055.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.psd") returned 0 [0055.347] lstrlenA (lpString="*.psd") returned 5 [0055.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.gif") returned 0 [0055.347] lstrlenA (lpString="*.gif") returned 5 [0055.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.doc") returned 0 [0055.347] lstrlenA (lpString="*.doc") returned 5 [0055.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.docx") returned 0 [0055.347] lstrlenA (lpString="*.docx") returned 6 [0055.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.xls") returned 0 [0055.347] lstrlenA (lpString="*.xls") returned 5 [0055.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.xlsx") returned 0 [0055.347] lstrlenA (lpString="*.xlsx") returned 6 [0055.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.ppt") returned 0 [0055.347] lstrlenA (lpString="*.ppt") returned 5 [0055.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.pptx") returned 0 [0055.347] lstrlenA (lpString="*.pptx") returned 6 [0055.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.pdf") returned 0 [0055.347] lstrlenA (lpString="*.pdf") returned 5 [0055.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.mov") returned 0 [0055.347] lstrlenA (lpString="*.mov") returned 5 [0055.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.m2v") returned 0 [0055.347] lstrlenA (lpString="*.m2v") returned 5 [0055.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.3gp") returned 0 [0055.348] lstrlenA (lpString="*.3gp") returned 5 [0055.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.mpeg") returned 0 [0055.348] lstrlenA (lpString="*.mpeg") returned 6 [0055.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.mpg") returned 0 [0055.348] lstrlenA (lpString="*.mpg") returned 5 [0055.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.flv") returned 0 [0055.348] lstrlenA (lpString="*.flv") returned 5 [0055.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.avi") returned 0 [0055.348] lstrlenA (lpString="*.avi") returned 5 [0055.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.mp4") returned 0 [0055.348] lstrlenA (lpString="*.mp4") returned 5 [0055.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.wmv") returned 0 [0055.348] lstrlenA (lpString="*.wmv") returned 5 [0055.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.divx") returned 0 [0055.348] lstrlenA (lpString="*.divx") returned 6 [0055.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.mkv") returned 0 [0055.348] lstrlenA (lpString="*.mkv") returned 5 [0055.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.mp3") returned 0 [0055.348] lstrlenA (lpString="*.mp3") returned 5 [0055.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.wav") returned 0 [0055.348] lstrlenA (lpString="*.wav") returned 5 [0055.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.flac") returned 0 [0055.348] lstrlenA (lpString="*.flac") returned 6 [0055.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.ape") returned 0 [0055.348] lstrlenA (lpString="*.ape") returned 5 [0055.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.wma") returned 0 [0055.348] lstrlenA (lpString="*.wma") returned 5 [0055.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.ac3") returned 0 [0055.349] lstrlenA (lpString="*.ac3") returned 5 [0055.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", pszSpec="*.mxf") returned 0 [0055.349] lstrlenA (lpString="*.mxf") returned 5 [0055.349] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6254800, ftCreationTime.dwHighDateTime=0x1c026ae, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa6254800, ftLastWriteTime.dwHighDateTime=0x1c026ae, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="+NewSQLServerConnection.odc", cAlternateFileName="_NEWSQ~1.ODC")) returned 1 [0055.349] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.349] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="+NewSQLServerConnection.odc") returned 1 [0055.349] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="+NewSQLServerConnection.odc") returned 1 [0055.349] lstrcmpiA (lpString1="", lpString2="+NewSQLServerConnection.odc") returned -1 [0055.349] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc") returned="+Connect to New Data Source.odc" [0055.349] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\" [0055.349] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\") returned="" [0055.349] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\HOW TO DECRYPT FILES.txt" [0055.349] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\how to decrypt files.txt")) returned 0x20 [0055.349] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\", lpString2="+NewSQLServerConnection.odc" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc" [0055.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.zip") returned 0 [0055.349] lstrlenA (lpString="*.zip") returned 5 [0055.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.rar") returned 0 [0055.349] lstrlenA (lpString="*.rar") returned 5 [0055.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.7z") returned 0 [0055.349] lstrlenA (lpString="*.7z") returned 4 [0055.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.tar") returned 0 [0055.349] lstrlenA (lpString="*.tar") returned 5 [0055.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.gzip") returned 0 [0055.349] lstrlenA (lpString="*.gzip") returned 6 [0055.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.jpg") returned 0 [0055.350] lstrlenA (lpString="*.jpg") returned 5 [0055.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.jpeg") returned 0 [0055.350] lstrlenA (lpString="*.jpeg") returned 6 [0055.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.psd") returned 0 [0055.350] lstrlenA (lpString="*.psd") returned 5 [0055.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.gif") returned 0 [0055.350] lstrlenA (lpString="*.gif") returned 5 [0055.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.doc") returned 0 [0055.350] lstrlenA (lpString="*.doc") returned 5 [0055.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.docx") returned 0 [0055.350] lstrlenA (lpString="*.docx") returned 6 [0055.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.xls") returned 0 [0055.350] lstrlenA (lpString="*.xls") returned 5 [0055.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.xlsx") returned 0 [0055.350] lstrlenA (lpString="*.xlsx") returned 6 [0055.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.ppt") returned 0 [0055.350] lstrlenA (lpString="*.ppt") returned 5 [0055.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.pptx") returned 0 [0055.350] lstrlenA (lpString="*.pptx") returned 6 [0055.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.pdf") returned 0 [0055.350] lstrlenA (lpString="*.pdf") returned 5 [0055.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.mov") returned 0 [0055.350] lstrlenA (lpString="*.mov") returned 5 [0055.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.m2v") returned 0 [0055.350] lstrlenA (lpString="*.m2v") returned 5 [0055.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.3gp") returned 0 [0055.350] lstrlenA (lpString="*.3gp") returned 5 [0055.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.mpeg") returned 0 [0055.351] lstrlenA (lpString="*.mpeg") returned 6 [0055.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.mpg") returned 0 [0055.351] lstrlenA (lpString="*.mpg") returned 5 [0055.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.flv") returned 0 [0055.351] lstrlenA (lpString="*.flv") returned 5 [0055.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.avi") returned 0 [0055.351] lstrlenA (lpString="*.avi") returned 5 [0055.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.mp4") returned 0 [0055.351] lstrlenA (lpString="*.mp4") returned 5 [0055.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.wmv") returned 0 [0055.351] lstrlenA (lpString="*.wmv") returned 5 [0055.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.divx") returned 0 [0055.351] lstrlenA (lpString="*.divx") returned 6 [0055.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.mkv") returned 0 [0055.351] lstrlenA (lpString="*.mkv") returned 5 [0055.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.mp3") returned 0 [0055.351] lstrlenA (lpString="*.mp3") returned 5 [0055.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.wav") returned 0 [0055.351] lstrlenA (lpString="*.wav") returned 5 [0055.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.flac") returned 0 [0055.351] lstrlenA (lpString="*.flac") returned 6 [0055.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.ape") returned 0 [0055.351] lstrlenA (lpString="*.ape") returned 5 [0055.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.wma") returned 0 [0055.351] lstrlenA (lpString="*.wma") returned 5 [0055.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.ac3") returned 0 [0055.351] lstrlenA (lpString="*.ac3") returned 5 [0055.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", pszSpec="*.mxf") returned 0 [0055.352] lstrlenA (lpString="*.mxf") returned 5 [0055.352] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5811c800, ftCreationTime.dwHighDateTime=0x1bff783, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5811c800, ftLastWriteTime.dwHighDateTime=0x1bff783, nFileSizeHigh=0x0, nFileSizeLow=0x46, dwReserved0=0x74, dwReserved1=0x0, cFileName="DESKTOP.INI", cAlternateFileName="")) returned 1 [0055.352] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.352] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DESKTOP.INI") returned 1 [0055.352] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DESKTOP.INI") returned 1 [0055.352] lstrcmpiA (lpString1="", lpString2="DESKTOP.INI") returned -1 [0055.352] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc") returned="+NewSQLServerConnection.odc" [0055.352] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\" [0055.352] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\") returned="" [0055.352] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\HOW TO DECRYPT FILES.txt" [0055.352] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\how to decrypt files.txt")) returned 0x20 [0055.352] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\", lpString2="DESKTOP.INI" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI" [0055.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.zip") returned 0 [0055.352] lstrlenA (lpString="*.zip") returned 5 [0055.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.rar") returned 0 [0055.352] lstrlenA (lpString="*.rar") returned 5 [0055.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.7z") returned 0 [0055.352] lstrlenA (lpString="*.7z") returned 4 [0055.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.tar") returned 0 [0055.352] lstrlenA (lpString="*.tar") returned 5 [0055.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.gzip") returned 0 [0055.352] lstrlenA (lpString="*.gzip") returned 6 [0055.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.jpg") returned 0 [0055.352] lstrlenA (lpString="*.jpg") returned 5 [0055.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.jpeg") returned 0 [0055.353] lstrlenA (lpString="*.jpeg") returned 6 [0055.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.psd") returned 0 [0055.353] lstrlenA (lpString="*.psd") returned 5 [0055.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.gif") returned 0 [0055.353] lstrlenA (lpString="*.gif") returned 5 [0055.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.doc") returned 0 [0055.353] lstrlenA (lpString="*.doc") returned 5 [0055.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.docx") returned 0 [0055.353] lstrlenA (lpString="*.docx") returned 6 [0055.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.xls") returned 0 [0055.353] lstrlenA (lpString="*.xls") returned 5 [0055.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.xlsx") returned 0 [0055.353] lstrlenA (lpString="*.xlsx") returned 6 [0055.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.ppt") returned 0 [0055.353] lstrlenA (lpString="*.ppt") returned 5 [0055.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.pptx") returned 0 [0055.353] lstrlenA (lpString="*.pptx") returned 6 [0055.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.pdf") returned 0 [0055.353] lstrlenA (lpString="*.pdf") returned 5 [0055.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.mov") returned 0 [0055.353] lstrlenA (lpString="*.mov") returned 5 [0055.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.m2v") returned 0 [0055.353] lstrlenA (lpString="*.m2v") returned 5 [0055.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.3gp") returned 0 [0055.353] lstrlenA (lpString="*.3gp") returned 5 [0055.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.mpeg") returned 0 [0055.353] lstrlenA (lpString="*.mpeg") returned 6 [0055.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.mpg") returned 0 [0055.353] lstrlenA (lpString="*.mpg") returned 5 [0055.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.flv") returned 0 [0055.354] lstrlenA (lpString="*.flv") returned 5 [0055.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.avi") returned 0 [0055.354] lstrlenA (lpString="*.avi") returned 5 [0055.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.mp4") returned 0 [0055.354] lstrlenA (lpString="*.mp4") returned 5 [0055.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.wmv") returned 0 [0055.354] lstrlenA (lpString="*.wmv") returned 5 [0055.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.divx") returned 0 [0055.354] lstrlenA (lpString="*.divx") returned 6 [0055.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.mkv") returned 0 [0055.354] lstrlenA (lpString="*.mkv") returned 5 [0055.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.mp3") returned 0 [0055.354] lstrlenA (lpString="*.mp3") returned 5 [0055.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.wav") returned 0 [0055.354] lstrlenA (lpString="*.wav") returned 5 [0055.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.flac") returned 0 [0055.354] lstrlenA (lpString="*.flac") returned 6 [0055.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.ape") returned 0 [0055.354] lstrlenA (lpString="*.ape") returned 5 [0055.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.wma") returned 0 [0055.354] lstrlenA (lpString="*.wma") returned 5 [0055.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.ac3") returned 0 [0055.354] lstrlenA (lpString="*.ac3") returned 5 [0055.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", pszSpec="*.mxf") returned 0 [0055.354] lstrlenA (lpString="*.mxf") returned 5 [0055.354] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x952b9800, ftCreationTime.dwHighDateTime=0x1bff81f, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x952b9800, ftLastWriteTime.dwHighDateTime=0x1bff81f, nFileSizeHigh=0x0, nFileSizeLow=0x1266, dwReserved0=0x74, dwReserved1=0x0, cFileName="FOLDER.ICO", cAlternateFileName="")) returned 1 [0055.354] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.355] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FOLDER.ICO") returned -1 [0055.355] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FOLDER.ICO") returned 1 [0055.355] lstrcmpiA (lpString1="", lpString2="FOLDER.ICO") returned -1 [0055.355] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI") returned="DESKTOP.INI" [0055.355] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\" [0055.355] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\") returned="" [0055.355] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\HOW TO DECRYPT FILES.txt" [0055.355] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\how to decrypt files.txt")) returned 0x20 [0055.355] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\", lpString2="FOLDER.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" [0055.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.zip") returned 0 [0055.355] lstrlenA (lpString="*.zip") returned 5 [0055.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.rar") returned 0 [0055.355] lstrlenA (lpString="*.rar") returned 5 [0055.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.7z") returned 0 [0055.355] lstrlenA (lpString="*.7z") returned 4 [0055.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.tar") returned 0 [0055.355] lstrlenA (lpString="*.tar") returned 5 [0055.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.gzip") returned 0 [0055.355] lstrlenA (lpString="*.gzip") returned 6 [0055.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.jpg") returned 0 [0055.355] lstrlenA (lpString="*.jpg") returned 5 [0055.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.jpeg") returned 0 [0055.355] lstrlenA (lpString="*.jpeg") returned 6 [0055.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.psd") returned 0 [0055.355] lstrlenA (lpString="*.psd") returned 5 [0055.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.gif") returned 0 [0055.356] lstrlenA (lpString="*.gif") returned 5 [0055.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.doc") returned 0 [0055.356] lstrlenA (lpString="*.doc") returned 5 [0055.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.docx") returned 0 [0055.356] lstrlenA (lpString="*.docx") returned 6 [0055.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.xls") returned 0 [0055.356] lstrlenA (lpString="*.xls") returned 5 [0055.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.xlsx") returned 0 [0055.356] lstrlenA (lpString="*.xlsx") returned 6 [0055.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.ppt") returned 0 [0055.356] lstrlenA (lpString="*.ppt") returned 5 [0055.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.pptx") returned 0 [0055.356] lstrlenA (lpString="*.pptx") returned 6 [0055.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.pdf") returned 0 [0055.356] lstrlenA (lpString="*.pdf") returned 5 [0055.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.mov") returned 0 [0055.356] lstrlenA (lpString="*.mov") returned 5 [0055.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.m2v") returned 0 [0055.356] lstrlenA (lpString="*.m2v") returned 5 [0055.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.3gp") returned 0 [0055.356] lstrlenA (lpString="*.3gp") returned 5 [0055.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.mpeg") returned 0 [0055.356] lstrlenA (lpString="*.mpeg") returned 6 [0055.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.mpg") returned 0 [0055.356] lstrlenA (lpString="*.mpg") returned 5 [0055.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.flv") returned 0 [0055.356] lstrlenA (lpString="*.flv") returned 5 [0055.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.avi") returned 0 [0055.357] lstrlenA (lpString="*.avi") returned 5 [0055.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.mp4") returned 0 [0055.357] lstrlenA (lpString="*.mp4") returned 5 [0055.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.wmv") returned 0 [0055.357] lstrlenA (lpString="*.wmv") returned 5 [0055.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.divx") returned 0 [0055.357] lstrlenA (lpString="*.divx") returned 6 [0055.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.mkv") returned 0 [0055.357] lstrlenA (lpString="*.mkv") returned 5 [0055.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.mp3") returned 0 [0055.357] lstrlenA (lpString="*.mp3") returned 5 [0055.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.wav") returned 0 [0055.357] lstrlenA (lpString="*.wav") returned 5 [0055.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.flac") returned 0 [0055.357] lstrlenA (lpString="*.flac") returned 6 [0055.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.ape") returned 0 [0055.357] lstrlenA (lpString="*.ape") returned 5 [0055.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.wma") returned 0 [0055.357] lstrlenA (lpString="*.wma") returned 5 [0055.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.ac3") returned 0 [0055.357] lstrlenA (lpString="*.ac3") returned 5 [0055.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", pszSpec="*.mxf") returned 0 [0055.357] lstrlenA (lpString="*.mxf") returned 5 [0055.357] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x952b9800, ftCreationTime.dwHighDateTime=0x1bff81f, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x952b9800, ftLastWriteTime.dwHighDateTime=0x1bff81f, nFileSizeHigh=0x0, nFileSizeLow=0x1266, dwReserved0=0x74, dwReserved1=0x0, cFileName="FOLDER.ICO", cAlternateFileName="")) returned 0 [0055.357] FindClose (in: hFindFile=0x2d7ff8 | out: hFindFile=0x2d7ff8) returned 1 [0055.357] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xcf98, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="DBENGR.VSL", cAlternateFileName="")) returned 1 [0055.358] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.358] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DBENGR.VSL") returned 1 [0055.358] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DBENGR.VSL") returned 1 [0055.358] lstrcmpiA (lpString1="", lpString2="DBENGR.VSL") returned -1 [0055.358] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\*.*") returned="*.*" [0055.358] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.358] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0055.358] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0055.358] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0055.358] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="DBENGR.VSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" [0055.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.zip") returned 0 [0055.358] lstrlenA (lpString="*.zip") returned 5 [0055.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.rar") returned 0 [0055.358] lstrlenA (lpString="*.rar") returned 5 [0055.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.7z") returned 0 [0055.358] lstrlenA (lpString="*.7z") returned 4 [0055.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.tar") returned 0 [0055.358] lstrlenA (lpString="*.tar") returned 5 [0055.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.gzip") returned 0 [0055.358] lstrlenA (lpString="*.gzip") returned 6 [0055.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.jpg") returned 0 [0055.358] lstrlenA (lpString="*.jpg") returned 5 [0055.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.jpeg") returned 0 [0055.358] lstrlenA (lpString="*.jpeg") returned 6 [0055.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.psd") returned 0 [0055.358] lstrlenA (lpString="*.psd") returned 5 [0055.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.gif") returned 0 [0055.359] lstrlenA (lpString="*.gif") returned 5 [0055.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.doc") returned 0 [0055.359] lstrlenA (lpString="*.doc") returned 5 [0055.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.docx") returned 0 [0055.359] lstrlenA (lpString="*.docx") returned 6 [0055.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.xls") returned 0 [0055.359] lstrlenA (lpString="*.xls") returned 5 [0055.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.xlsx") returned 0 [0055.359] lstrlenA (lpString="*.xlsx") returned 6 [0055.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.ppt") returned 0 [0055.359] lstrlenA (lpString="*.ppt") returned 5 [0055.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.pptx") returned 0 [0055.359] lstrlenA (lpString="*.pptx") returned 6 [0055.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.pdf") returned 0 [0055.359] lstrlenA (lpString="*.pdf") returned 5 [0055.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.mov") returned 0 [0055.359] lstrlenA (lpString="*.mov") returned 5 [0055.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.m2v") returned 0 [0055.360] lstrlenA (lpString="*.m2v") returned 5 [0055.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.3gp") returned 0 [0055.360] lstrlenA (lpString="*.3gp") returned 5 [0055.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.mpeg") returned 0 [0055.360] lstrlenA (lpString="*.mpeg") returned 6 [0055.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.mpg") returned 0 [0055.360] lstrlenA (lpString="*.mpg") returned 5 [0055.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.flv") returned 0 [0055.360] lstrlenA (lpString="*.flv") returned 5 [0055.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.avi") returned 0 [0055.360] lstrlenA (lpString="*.avi") returned 5 [0055.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.mp4") returned 0 [0055.360] lstrlenA (lpString="*.mp4") returned 5 [0055.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.wmv") returned 0 [0055.360] lstrlenA (lpString="*.wmv") returned 5 [0055.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.divx") returned 0 [0055.360] lstrlenA (lpString="*.divx") returned 6 [0055.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.mkv") returned 0 [0055.360] lstrlenA (lpString="*.mkv") returned 5 [0055.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.mp3") returned 0 [0055.360] lstrlenA (lpString="*.mp3") returned 5 [0055.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.wav") returned 0 [0055.360] lstrlenA (lpString="*.wav") returned 5 [0055.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.flac") returned 0 [0055.360] lstrlenA (lpString="*.flac") returned 6 [0055.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.ape") returned 0 [0055.360] lstrlenA (lpString="*.ape") returned 5 [0055.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.wma") returned 0 [0055.361] lstrlenA (lpString="*.wma") returned 5 [0055.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.ac3") returned 0 [0055.361] lstrlenA (lpString="*.ac3") returned 5 [0055.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", pszSpec="*.mxf") returned 0 [0055.361] lstrlenA (lpString="*.mxf") returned 5 [0055.361] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ea0a00, ftCreationTime.dwHighDateTime=0x1c32175, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x78ea0a00, ftLastWriteTime.dwHighDateTime=0x1c32175, nFileSizeHigh=0x0, nFileSizeLow=0x76000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBSAMPLE.MDB", cAlternateFileName="")) returned 1 [0055.361] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.361] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DBSAMPLE.MDB") returned 1 [0055.361] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DBSAMPLE.MDB") returned 1 [0055.361] lstrcmpiA (lpString1="", lpString2="DBSAMPLE.MDB") returned -1 [0055.361] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned="DBENGR.VSL" [0055.361] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.361] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0055.361] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0055.361] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0055.361] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="DBSAMPLE.MDB" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" [0055.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.zip") returned 0 [0055.361] lstrlenA (lpString="*.zip") returned 5 [0055.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.rar") returned 0 [0055.361] lstrlenA (lpString="*.rar") returned 5 [0055.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.7z") returned 0 [0055.361] lstrlenA (lpString="*.7z") returned 4 [0055.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.tar") returned 0 [0055.362] lstrlenA (lpString="*.tar") returned 5 [0055.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.gzip") returned 0 [0055.362] lstrlenA (lpString="*.gzip") returned 6 [0055.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.jpg") returned 0 [0055.362] lstrlenA (lpString="*.jpg") returned 5 [0055.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.jpeg") returned 0 [0055.362] lstrlenA (lpString="*.jpeg") returned 6 [0055.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.psd") returned 0 [0055.362] lstrlenA (lpString="*.psd") returned 5 [0055.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.gif") returned 0 [0055.362] lstrlenA (lpString="*.gif") returned 5 [0055.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.doc") returned 0 [0055.362] lstrlenA (lpString="*.doc") returned 5 [0055.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.docx") returned 0 [0055.362] lstrlenA (lpString="*.docx") returned 6 [0055.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.xls") returned 0 [0055.362] lstrlenA (lpString="*.xls") returned 5 [0055.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.xlsx") returned 0 [0055.362] lstrlenA (lpString="*.xlsx") returned 6 [0055.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.ppt") returned 0 [0055.362] lstrlenA (lpString="*.ppt") returned 5 [0055.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.pptx") returned 0 [0055.362] lstrlenA (lpString="*.pptx") returned 6 [0055.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.pdf") returned 0 [0055.362] lstrlenA (lpString="*.pdf") returned 5 [0055.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.mov") returned 0 [0055.362] lstrlenA (lpString="*.mov") returned 5 [0055.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.m2v") returned 0 [0055.363] lstrlenA (lpString="*.m2v") returned 5 [0055.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.3gp") returned 0 [0055.363] lstrlenA (lpString="*.3gp") returned 5 [0055.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.mpeg") returned 0 [0055.363] lstrlenA (lpString="*.mpeg") returned 6 [0055.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.mpg") returned 0 [0055.363] lstrlenA (lpString="*.mpg") returned 5 [0055.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.flv") returned 0 [0055.363] lstrlenA (lpString="*.flv") returned 5 [0055.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.avi") returned 0 [0055.363] lstrlenA (lpString="*.avi") returned 5 [0055.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.mp4") returned 0 [0055.363] lstrlenA (lpString="*.mp4") returned 5 [0055.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.wmv") returned 0 [0055.363] lstrlenA (lpString="*.wmv") returned 5 [0055.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.divx") returned 0 [0055.363] lstrlenA (lpString="*.divx") returned 6 [0055.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.mkv") returned 0 [0055.363] lstrlenA (lpString="*.mkv") returned 5 [0055.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.mp3") returned 0 [0055.363] lstrlenA (lpString="*.mp3") returned 5 [0055.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.wav") returned 0 [0055.363] lstrlenA (lpString="*.wav") returned 5 [0055.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.flac") returned 0 [0055.363] lstrlenA (lpString="*.flac") returned 6 [0055.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.ape") returned 0 [0055.364] lstrlenA (lpString="*.ape") returned 5 [0055.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.wma") returned 0 [0055.364] lstrlenA (lpString="*.wma") returned 5 [0055.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.ac3") returned 0 [0055.364] lstrlenA (lpString="*.ac3") returned 5 [0055.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", pszSpec="*.mxf") returned 0 [0055.364] lstrlenA (lpString="*.mxf") returned 5 [0055.364] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x28178, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBWIZ.VSL", cAlternateFileName="")) returned 1 [0055.364] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.364] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DBWIZ.VSL") returned 1 [0055.364] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DBWIZ.VSL") returned 1 [0055.364] lstrcmpiA (lpString1="", lpString2="DBWIZ.VSL") returned -1 [0055.364] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB") returned="DBSAMPLE.MDB" [0055.364] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0055.364] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0055.364] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0055.364] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="DBWIZ.VSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" [0055.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.zip") returned 0 [0055.364] lstrlenA (lpString="*.zip") returned 5 [0055.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.rar") returned 0 [0055.365] lstrlenA (lpString="*.rar") returned 5 [0055.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.7z") returned 0 [0055.365] lstrlenA (lpString="*.7z") returned 4 [0055.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.tar") returned 0 [0055.365] lstrlenA (lpString="*.tar") returned 5 [0055.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.gzip") returned 0 [0055.365] lstrlenA (lpString="*.gzip") returned 6 [0055.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.jpg") returned 0 [0055.365] lstrlenA (lpString="*.jpg") returned 5 [0055.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.jpeg") returned 0 [0055.365] lstrlenA (lpString="*.jpeg") returned 6 [0055.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.psd") returned 0 [0055.365] lstrlenA (lpString="*.psd") returned 5 [0055.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.gif") returned 0 [0055.365] lstrlenA (lpString="*.gif") returned 5 [0055.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.doc") returned 0 [0055.365] lstrlenA (lpString="*.doc") returned 5 [0055.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.docx") returned 0 [0055.365] lstrlenA (lpString="*.docx") returned 6 [0055.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.xls") returned 0 [0055.365] lstrlenA (lpString="*.xls") returned 5 [0055.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.xlsx") returned 0 [0055.365] lstrlenA (lpString="*.xlsx") returned 6 [0055.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.ppt") returned 0 [0055.365] lstrlenA (lpString="*.ppt") returned 5 [0055.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.pptx") returned 0 [0055.366] lstrlenA (lpString="*.pptx") returned 6 [0055.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.pdf") returned 0 [0055.366] lstrlenA (lpString="*.pdf") returned 5 [0055.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.mov") returned 0 [0055.366] lstrlenA (lpString="*.mov") returned 5 [0055.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.m2v") returned 0 [0055.366] lstrlenA (lpString="*.m2v") returned 5 [0055.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.3gp") returned 0 [0055.366] lstrlenA (lpString="*.3gp") returned 5 [0055.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.mpeg") returned 0 [0055.366] lstrlenA (lpString="*.mpeg") returned 6 [0055.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.mpg") returned 0 [0055.366] lstrlenA (lpString="*.mpg") returned 5 [0055.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.flv") returned 0 [0055.366] lstrlenA (lpString="*.flv") returned 5 [0055.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.avi") returned 0 [0055.366] lstrlenA (lpString="*.avi") returned 5 [0055.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.mp4") returned 0 [0055.366] lstrlenA (lpString="*.mp4") returned 5 [0055.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.wmv") returned 0 [0055.366] lstrlenA (lpString="*.wmv") returned 5 [0055.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.divx") returned 0 [0055.366] lstrlenA (lpString="*.divx") returned 6 [0055.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.mkv") returned 0 [0055.366] lstrlenA (lpString="*.mkv") returned 5 [0055.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.mp3") returned 0 [0055.367] lstrlenA (lpString="*.mp3") returned 5 [0055.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.wav") returned 0 [0055.367] lstrlenA (lpString="*.wav") returned 5 [0055.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.flac") returned 0 [0055.367] lstrlenA (lpString="*.flac") returned 6 [0055.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.ape") returned 0 [0055.367] lstrlenA (lpString="*.ape") returned 5 [0055.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.wma") returned 0 [0055.367] lstrlenA (lpString="*.wma") returned 5 [0055.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.ac3") returned 0 [0055.367] lstrlenA (lpString="*.ac3") returned 5 [0055.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", pszSpec="*.mxf") returned 0 [0055.367] lstrlenA (lpString="*.mxf") returned 5 [0055.367] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEFAULT.CSS", cAlternateFileName="")) returned 1 [0055.367] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.367] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DEFAULT.CSS") returned 1 [0055.367] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DEFAULT.CSS") returned 1 [0055.367] lstrcmpiA (lpString1="", lpString2="DEFAULT.CSS") returned -1 [0055.367] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned="DBWIZ.VSL" [0055.367] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0055.367] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0055.367] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0055.368] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="DEFAULT.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS" [0055.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS", pszSpec="*.zip") returned 0 [0055.368] lstrlenA (lpString="*.zip") returned 5 [0055.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS", pszSpec="*.rar") returned 0 [0055.368] lstrlenA (lpString="*.rar") returned 5 [0055.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS", pszSpec="*.7z") returned 0 [0055.368] lstrlenA (lpString="*.7z") returned 4 [0055.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS", pszSpec="*.tar") returned 0 [0055.368] lstrlenA (lpString="*.tar") returned 5 [0055.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS", pszSpec="*.gzip") returned 0 [0055.368] lstrlenA (lpString="*.gzip") returned 6 [0055.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS", pszSpec="*.jpg") returned 0 [0055.368] lstrlenA (lpString="*.jpg") returned 5 [0055.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS", pszSpec="*.jpeg") returned 0 [0055.368] lstrlenA (lpString="*.jpeg") returned 6 [0055.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS", pszSpec="*.psd") returned 0 [0055.368] lstrlenA (lpString="*.psd") returned 5 [0055.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS", pszSpec="*.gif") returned 0 [0055.368] lstrlenA (lpString="*.gif") returned 5 [0055.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS", pszSpec="*.doc") returned 0 [0055.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS", pszSpec="*.docx") returned 0 [0055.369] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f81800, ftCreationTime.dwHighDateTime=0x1c913a0, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x66f81800, ftLastWriteTime.dwHighDateTime=0x1c913a0, nFileSizeHigh=0x0, nFileSizeLow=0x19984, dwReserved0=0x0, dwReserved1=0x0, cFileName="Discussion.gta", cAlternateFileName="DISCUS~1.GTA")) returned 1 [0055.369] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.369] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Discussion.gta") returned 1 [0055.369] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Discussion.gta") returned 1 [0055.369] lstrcmpiA (lpString1="", lpString2="Discussion.gta") returned -1 [0055.369] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS") returned="DEFAULT.CSS" [0055.371] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b12e00, ftCreationTime.dwHighDateTime=0x1ca99cf, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x45b12e00, ftLastWriteTime.dwHighDateTime=0x1ca99cf, nFileSizeHigh=0x0, nFileSizeLow=0x587c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Discussion14.gta", cAlternateFileName="DISCUS~2.GTA")) returned 1 [0055.371] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.371] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Discussion14.gta") returned 1 [0055.371] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Discussion14.gta") returned 1 [0055.371] lstrcmpiA (lpString1="", lpString2="Discussion14.gta") returned -1 [0055.371] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned="Discussion.gta" [0055.372] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc800ef00, ftCreationTime.dwHighDateTime=0x1cab7d2, ftLastAccessTime.dwLowDateTime=0x507ae0c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc800ef00, ftLastWriteTime.dwHighDateTime=0x1cab7d2, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="DL_RES.DLL", cAlternateFileName="")) returned 1 [0055.372] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.372] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DL_RES.DLL") returned 1 [0055.372] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DL_RES.DLL") returned 1 [0055.372] lstrcmpiA (lpString1="", lpString2="DL_RES.DLL") returned -1 [0055.372] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned="Discussion14.gta" [0055.372] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0ff9500, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x507ae0c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf0ff9500, ftLastWriteTime.dwHighDateTime=0x1c55530, nFileSizeHigh=0x0, nFileSizeLow=0x6bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOORSCHD.VRD", cAlternateFileName="")) returned 1 [0055.374] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.374] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DOORSCHD.VRD") returned 1 [0055.374] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DOORSCHD.VRD") returned 1 [0055.375] lstrcmpiA (lpString1="", lpString2="DOORSCHD.VRD") returned -1 [0055.375] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned="DL_RES.DLL" [0055.375] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x507ae0c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xfd68, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRILLDWN.VSL", cAlternateFileName="")) returned 1 [0055.375] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.375] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DRILLDWN.VSL") returned 1 [0055.375] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DRILLDWN.VSL") returned 1 [0055.375] lstrcmpiA (lpString1="", lpString2="DRILLDWN.VSL") returned -1 [0055.375] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned="DOORSCHD.VRD" [0055.375] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bb9dc00, ftCreationTime.dwHighDateTime=0x1cab7d1, ftLastAccessTime.dwLowDateTime=0x507d4220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4bb9dc00, ftLastWriteTime.dwHighDateTime=0x1cab7d1, nFileSizeHigh=0x0, nFileSizeLow=0x9760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWGCNV.VSL", cAlternateFileName="")) returned 1 [0055.375] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.375] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DWGCNV.VSL") returned 1 [0055.375] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DWGCNV.VSL") returned 1 [0055.375] lstrcmpiA (lpString1="", lpString2="DWGCNV.VSL") returned -1 [0055.375] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned="DRILLDWN.VSL" [0055.375] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc800ef00, ftCreationTime.dwHighDateTime=0x1cab7d2, ftLastAccessTime.dwLowDateTime=0x507fa380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc800ef00, ftLastWriteTime.dwHighDateTime=0x1cab7d2, nFileSizeHigh=0x0, nFileSizeLow=0x3f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWGDPRES.DLL", cAlternateFileName="")) returned 1 [0055.375] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.376] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DWGDPRES.DLL") returned 1 [0055.376] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DWGDPRES.DLL") returned 1 [0055.376] lstrcmpiA (lpString1="", lpString2="DWGDPRES.DLL") returned -1 [0055.376] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned="DWGCNV.VSL" [0055.376] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc4600, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62bc4600, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x388e, dwReserved0=0x0, dwReserved1=0x0, cFileName="EADOCUMENTAPPROVAL_INIT.XSN", cAlternateFileName="EADOCU~1.XSN")) returned 1 [0055.376] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.376] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EADOCUMENTAPPROVAL_INIT.XSN") returned 1 [0055.376] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EADOCUMENTAPPROVAL_INIT.XSN") returned 1 [0055.376] lstrcmpiA (lpString1="", lpString2="EADOCUMENTAPPROVAL_INIT.XSN") returned -1 [0055.376] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned="DWGDPRES.DLL" [0055.376] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618b1900, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x618b1900, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x4d7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="EADOCUMENTAPPROVAL_REVIEW.XSN", cAlternateFileName="EADOCU~2.XSN")) returned 1 [0055.376] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.376] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EADOCUMENTAPPROVAL_REVIEW.XSN") returned 1 [0055.376] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EADOCUMENTAPPROVAL_REVIEW.XSN") returned 1 [0055.376] lstrcmpiA (lpString1="", lpString2="EADOCUMENTAPPROVAL_REVIEW.XSN") returned -1 [0055.376] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN") returned="EADOCUMENTAPPROVAL_INIT.XSN" [0055.376] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xc990, dwReserved0=0x0, dwReserved1=0x0, cFileName="EAWFINTL.DLL", cAlternateFileName="")) returned 1 [0055.376] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.376] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EAWFINTL.DLL") returned -1 [0055.376] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EAWFINTL.DLL") returned 1 [0055.376] lstrcmpiA (lpString1="", lpString2="EAWFINTL.DLL") returned -1 [0055.377] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN") returned="EADOCUMENTAPPROVAL_REVIEW.XSN" [0055.377] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad844100, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x507fa380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xad844100, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x4d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDITRES.DLL", cAlternateFileName="")) returned 1 [0055.377] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.377] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EDITRES.DLL") returned -1 [0055.377] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EDITRES.DLL") returned 1 [0055.377] lstrcmpiA (lpString1="", lpString2="EDITRES.DLL") returned -1 [0055.377] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned="EAWFINTL.DLL" [0055.377] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e6b2600, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1e6b2600, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x5f88, dwReserved0=0x0, dwReserved1=0x0, cFileName="EntityPickerIntl.dll", cAlternateFileName="ENTITY~1.DLL")) returned 1 [0055.377] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.377] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EntityPickerIntl.dll") returned -1 [0055.377] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EntityPickerIntl.dll") returned 1 [0055.377] lstrcmpiA (lpString1="", lpString2="EntityPickerIntl.dll") returned -1 [0055.377] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned="EDITRES.DLL" [0055.377] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x4388, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPR.DLL", cAlternateFileName="")) returned 1 [0055.377] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.377] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ENVELOPR.DLL") returned -1 [0055.377] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ENVELOPR.DLL") returned 1 [0055.377] lstrcmpiA (lpString1="", lpString2="ENVELOPR.DLL") returned -1 [0055.377] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned="EntityPickerIntl.dll" [0055.378] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2411fa00, ftCreationTime.dwHighDateTime=0x1cac9b2, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2411fa00, ftLastWriteTime.dwHighDateTime=0x1cac9b2, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPR.DLL.IDX_DLL", cAlternateFileName="ENVELO~1.IDX")) returned 1 [0055.378] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.378] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ENVELOPR.DLL.IDX_DLL") returned -1 [0055.378] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ENVELOPR.DLL.IDX_DLL") returned 1 [0055.378] lstrcmpiA (lpString1="", lpString2="ENVELOPR.DLL.IDX_DLL") returned -1 [0055.378] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned="ENVELOPR.DLL" [0055.378] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9e19600, ftCreationTime.dwHighDateTime=0x1c56bc4, ftLastAccessTime.dwLowDateTime=0x508b8a60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf9e19600, ftLastWriteTime.dwHighDateTime=0x1c56bc4, nFileSizeHigh=0x0, nFileSizeLow=0x6a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQPLIST.VRD", cAlternateFileName="")) returned 1 [0055.378] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.378] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EQPLIST.VRD") returned -1 [0055.378] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EQPLIST.VRD") returned 1 [0055.378] lstrcmpiA (lpString1="", lpString2="EQPLIST.VRD") returned -1 [0055.378] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned="ENVELOPR.DLL.IDX_DLL" [0055.378] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a197900, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a197900, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x6b2dfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV.HXS", cAlternateFileName="EXCELD~1.HXS")) returned 1 [0055.378] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.378] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EXCEL.DEV.HXS") returned -1 [0055.378] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXCEL.DEV.HXS") returned 1 [0055.378] lstrcmpiA (lpString1="", lpString2="EXCEL.DEV.HXS") returned -1 [0055.378] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned="EQPLIST.VRD" [0055.378] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV_COL.HXC", cAlternateFileName="EXCELD~1.HXC")) returned 1 [0055.378] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.378] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EXCEL.DEV_COL.HXC") returned -1 [0055.379] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXCEL.DEV_COL.HXC") returned 1 [0055.379] lstrcmpiA (lpString1="", lpString2="EXCEL.DEV_COL.HXC") returned -1 [0055.379] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned="EXCEL.DEV.HXS" [0055.379] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c79b500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c79b500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV_COL.HXT", cAlternateFileName="EXCELD~1.HXT")) returned 1 [0055.379] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.379] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EXCEL.DEV_COL.HXT") returned -1 [0055.379] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXCEL.DEV_COL.HXT") returned 1 [0055.379] lstrcmpiA (lpString1="", lpString2="EXCEL.DEV_COL.HXT") returned -1 [0055.379] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned="EXCEL.DEV_COL.HXC" [0055.379] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c79b500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c79b500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV_F_COL.HXK", cAlternateFileName="EXCELD~1.HXK")) returned 1 [0055.379] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.379] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EXCEL.DEV_F_COL.HXK") returned -1 [0055.379] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXCEL.DEV_F_COL.HXK") returned 1 [0055.379] lstrcmpiA (lpString1="", lpString2="EXCEL.DEV_F_COL.HXK") returned -1 [0055.379] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned="EXCEL.DEV_COL.HXT" [0055.379] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c79b500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c79b500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV_K_COL.HXK", cAlternateFileName="EXCELD~2.HXK")) returned 1 [0055.379] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.379] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EXCEL.DEV_K_COL.HXK") returned -1 [0055.379] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXCEL.DEV_K_COL.HXK") returned 1 [0055.379] lstrcmpiA (lpString1="", lpString2="EXCEL.DEV_K_COL.HXK") returned -1 [0055.380] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned="EXCEL.DEV_F_COL.HXK" [0055.380] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdef99800, ftCreationTime.dwHighDateTime=0x1ca9370, ftLastAccessTime.dwLowDateTime=0xfa293170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdef99800, ftLastWriteTime.dwHighDateTime=0x1ca9370, nFileSizeHigh=0x0, nFileSizeLow=0x7770e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.HXS", cAlternateFileName="")) returned 1 [0055.380] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.380] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EXCEL.HXS") returned -1 [0055.380] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXCEL.HXS") returned 1 [0055.380] lstrcmpiA (lpString1="", lpString2="EXCEL.HXS") returned -1 [0055.380] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned="EXCEL.DEV_K_COL.HXK" [0055.380] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xfa293170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL_COL.HXC", cAlternateFileName="EXCEL_~1.HXC")) returned 1 [0055.380] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.380] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EXCEL_COL.HXC") returned -1 [0055.380] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXCEL_COL.HXC") returned 1 [0055.380] lstrcmpiA (lpString1="", lpString2="EXCEL_COL.HXC") returned -1 [0055.380] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned="EXCEL.HXS" [0055.380] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b50100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa2b92d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x17b50100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL_COL.HXT", cAlternateFileName="EXCEL_~1.HXT")) returned 1 [0055.380] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.380] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EXCEL_COL.HXT") returned -1 [0055.380] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXCEL_COL.HXT") returned 1 [0055.380] lstrcmpiA (lpString1="", lpString2="EXCEL_COL.HXT") returned -1 [0055.380] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned="EXCEL_COL.HXC" [0055.380] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b50100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa2b92d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x17b50100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL_F_COL.HXK", cAlternateFileName="EXCEL_~1.HXK")) returned 1 [0055.381] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.381] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EXCEL_F_COL.HXK") returned -1 [0055.381] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXCEL_F_COL.HXK") returned 1 [0055.381] lstrcmpiA (lpString1="", lpString2="EXCEL_F_COL.HXK") returned -1 [0055.381] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned="EXCEL_COL.HXT" [0055.381] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b50100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa5d8fb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x17b50100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL_K_COL.HXK", cAlternateFileName="EXCEL_~2.HXK")) returned 1 [0055.381] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.381] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EXCEL_K_COL.HXK") returned -1 [0055.381] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXCEL_K_COL.HXK") returned 1 [0055.381] lstrcmpiA (lpString1="", lpString2="EXCEL_K_COL.HXK") returned -1 [0055.381] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned="EXCEL_F_COL.HXK" [0055.381] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89452700, ftCreationTime.dwHighDateTime=0x1cacb3b, ftLastAccessTime.dwLowDateTime=0x19ac4550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89452700, ftLastWriteTime.dwHighDateTime=0x1cacb3b, nFileSizeHigh=0x0, nFileSizeLow=0x2f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPTOOWS.DLL", cAlternateFileName="")) returned 1 [0055.381] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.381] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EXPTOOWS.DLL") returned -1 [0055.381] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXPTOOWS.DLL") returned 1 [0055.381] lstrcmpiA (lpString1="", lpString2="EXPTOOWS.DLL") returned -1 [0055.381] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned="EXCEL_K_COL.HXK" [0055.381] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cfb800, ftCreationTime.dwHighDateTime=0x1cac79b, ftLastAccessTime.dwLowDateTime=0x19ac4550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70cfb800, ftLastWriteTime.dwHighDateTime=0x1cac79b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPTOOWS.XLA", cAlternateFileName="")) returned 1 [0055.381] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.381] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EXPTOOWS.XLA") returned -1 [0055.381] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXPTOOWS.XLA") returned 1 [0055.382] lstrcmpiA (lpString1="", lpString2="EXPTOOWS.XLA") returned -1 [0055.382] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned="EXPTOOWS.DLL" [0055.382] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x508debc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x13f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="FACILITY.VSL", cAlternateFileName="")) returned 1 [0055.382] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.382] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FACILITY.VSL") returned -1 [0055.382] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FACILITY.VSL") returned 1 [0055.382] lstrcmpiA (lpString1="", lpString2="FACILITY.VSL") returned -1 [0055.382] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.XLA") returned="EXPTOOWS.XLA" [0055.382] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83340500, ftCreationTime.dwHighDateTime=0x1c937e6, ftLastAccessTime.dwLowDateTime=0x50904d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x83340500, ftLastWriteTime.dwHighDateTime=0x1c937e6, nFileSizeHigh=0x0, nFileSizeLow=0x7ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLOCH.VRD", cAlternateFileName="")) returned 1 [0055.382] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.382] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FLOCH.VRD") returned -1 [0055.382] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FLOCH.VRD") returned 1 [0055.382] lstrcmpiA (lpString1="", lpString2="FLOCH.VRD") returned -1 [0055.382] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned="FACILITY.VSL" [0055.382] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50904d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="FOREST.CSS", cAlternateFileName="")) returned 1 [0055.382] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.382] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FOREST.CSS") returned -1 [0055.382] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FOREST.CSS") returned 1 [0055.382] lstrcmpiA (lpString1="", lpString2="FOREST.CSS") returned -1 [0055.382] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned="FLOCH.VRD" [0055.383] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50950fe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="GANTT.CSS", cAlternateFileName="")) returned 1 [0055.383] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.383] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GANTT.CSS") returned -1 [0055.383] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GANTT.CSS") returned 1 [0055.383] lstrcmpiA (lpString1="", lpString2="GANTT.CSS") returned -1 [0055.383] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FOREST.CSS") returned="FOREST.CSS" [0055.383] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbba2a00, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x50950fe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfbba2a00, ftLastWriteTime.dwHighDateTime=0x1c55530, nFileSizeHigh=0x0, nFileSizeLow=0x7fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="GANTT.VRD", cAlternateFileName="")) returned 1 [0055.383] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.383] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GANTT.VRD") returned -1 [0055.383] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GANTT.VRD") returned 1 [0055.383] lstrcmpiA (lpString1="", lpString2="GANTT.VRD") returned -1 [0055.383] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.CSS") returned="GANTT.CSS" [0055.383] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ab4f00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50950fe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb4ab4f00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x4e570, dwReserved0=0x0, dwReserved1=0x0, cFileName="GANTT.VSL", cAlternateFileName="")) returned 1 [0055.383] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.383] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GANTT.VSL") returned -1 [0055.383] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GANTT.VSL") returned 1 [0055.383] lstrcmpiA (lpString1="", lpString2="GANTT.VSL") returned -1 [0055.383] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned="GANTT.VRD" [0055.383] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74d63000, ftCreationTime.dwHighDateTime=0x1bbd3c6, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74d63000, ftLastWriteTime.dwHighDateTime=0x1bbd3c6, nFileSizeHigh=0x0, nFileSizeLow=0x2da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="GR8GALRY.GRA", cAlternateFileName="")) returned 1 [0055.383] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.383] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GR8GALRY.GRA") returned -1 [0055.384] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GR8GALRY.GRA") returned 1 [0055.384] lstrcmpiA (lpString1="", lpString2="GR8GALRY.GRA") returned -1 [0055.384] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned="GANTT.VSL" [0055.384] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61152c00, ftCreationTime.dwHighDateTime=0x1c6e5fa, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x61152c00, ftLastWriteTime.dwHighDateTime=0x1c6e5fa, nFileSizeHigh=0x0, nFileSizeLow=0x94f26, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH.HXS", cAlternateFileName="")) returned 1 [0055.384] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.384] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GRAPH.HXS") returned -1 [0055.384] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GRAPH.HXS") returned 1 [0055.384] lstrcmpiA (lpString1="", lpString2="GRAPH.HXS") returned -1 [0055.384] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned="GR8GALRY.GRA" [0055.384] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH_COL.HXC", cAlternateFileName="GRAPH_~1.HXC")) returned 1 [0055.384] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.384] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GRAPH_COL.HXC") returned -1 [0055.384] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GRAPH_COL.HXC") returned 1 [0055.384] lstrcmpiA (lpString1="", lpString2="GRAPH_COL.HXC") returned -1 [0055.384] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned="GRAPH.HXS" [0055.384] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27344a00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x27344a00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH_COL.HXT", cAlternateFileName="GRAPH_~1.HXT")) returned 1 [0055.386] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.386] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GRAPH_COL.HXT") returned -1 [0055.386] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GRAPH_COL.HXT") returned 1 [0055.386] lstrcmpiA (lpString1="", lpString2="GRAPH_COL.HXT") returned -1 [0055.386] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned="GRAPH_COL.HXC" [0055.386] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27344a00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x27344a00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH_F_COL.HXK", cAlternateFileName="GRAPH_~1.HXK")) returned 1 [0055.386] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.386] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GRAPH_F_COL.HXK") returned -1 [0055.386] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GRAPH_F_COL.HXK") returned 1 [0055.386] lstrcmpiA (lpString1="", lpString2="GRAPH_F_COL.HXK") returned -1 [0055.386] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned="GRAPH_COL.HXT" [0055.387] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27344a00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x27344a00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH_K_COL.HXK", cAlternateFileName="GRAPH_~2.HXK")) returned 1 [0055.387] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.387] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GRAPH_K_COL.HXK") returned -1 [0055.387] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GRAPH_K_COL.HXK") returned 1 [0055.387] lstrcmpiA (lpString1="", lpString2="GRAPH_K_COL.HXK") returned -1 [0055.387] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned="GRAPH_F_COL.HXK" [0055.387] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8748a300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8748a300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x32d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.DLL", cAlternateFileName="")) returned 1 [0055.387] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.387] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GRINTL32.DLL") returned -1 [0055.387] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GRINTL32.DLL") returned 1 [0055.387] lstrcmpiA (lpString1="", lpString2="GRINTL32.DLL") returned -1 [0055.387] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned="GRAPH_K_COL.HXK" [0055.387] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc82600, ftCreationTime.dwHighDateTime=0x1cac1e2, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3cc82600, ftLastWriteTime.dwHighDateTime=0x1cac1e2, nFileSizeHigh=0x0, nFileSizeLow=0x9380, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.DLL.IDX_DLL", cAlternateFileName="GRINTL~1.IDX")) returned 1 [0055.387] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.387] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GRINTL32.DLL.IDX_DLL") returned -1 [0055.387] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GRINTL32.DLL.IDX_DLL") returned 1 [0055.387] lstrcmpiA (lpString1="", lpString2="GRINTL32.DLL.IDX_DLL") returned -1 [0055.387] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned="GRINTL32.DLL" [0055.387] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc82600, ftCreationTime.dwHighDateTime=0x1cac1e2, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3cc82600, ftLastWriteTime.dwHighDateTime=0x1cac1e2, nFileSizeHigh=0x0, nFileSizeLow=0x18780, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.REST.IDX_DLL", cAlternateFileName="GRINTL~2.IDX")) returned 1 [0055.387] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.387] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GRINTL32.REST.IDX_DLL") returned -1 [0055.387] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GRINTL32.REST.IDX_DLL") returned 1 [0055.388] lstrcmpiA (lpString1="", lpString2="GRINTL32.REST.IDX_DLL") returned -1 [0055.388] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned="GRINTL32.DLL.IDX_DLL" [0055.388] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8748a300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8748a300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3180, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRLEX.DLL", cAlternateFileName="")) returned 1 [0055.388] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.388] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GRLEX.DLL") returned -1 [0055.388] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GRLEX.DLL") returned 1 [0055.388] lstrcmpiA (lpString1="", lpString2="GRLEX.DLL") returned -1 [0055.388] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned="GRINTL32.REST.IDX_DLL" [0055.388] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd9dd600, ftCreationTime.dwHighDateTime=0x1cacb3e, ftLastAccessTime.dwLowDateTime=0xfd5e6bd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdd9dd600, ftLastWriteTime.dwHighDateTime=0x1cacb3e, nFileSizeHigh=0x0, nFileSizeLow=0xbb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove Starter Template.xsn", cAlternateFileName="GROOVE~1.XSN")) returned 1 [0055.388] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.388] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Groove Starter Template.xsn") returned -1 [0055.388] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Groove Starter Template.xsn") returned 1 [0055.388] lstrcmpiA (lpString1="", lpString2="Groove Starter Template.xsn") returned -1 [0055.388] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned="GRLEX.DLL" [0055.388] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c7bd300, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8c7bd300, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x22c410, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE.HXS", cAlternateFileName="")) returned 1 [0055.388] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0055.388] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GROOVE.HXS") returned -1 [0055.388] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GROOVE.HXS") returned 1 [0055.388] lstrcmpiA (lpString1="", lpString2="GROOVE.HXS") returned -1 [0055.388] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Groove Starter Template.xsn") returned="Groove Starter Template.xsn" [0055.389] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd443cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms5", cAlternateFileName="GROOVE~1")) returned 1 [0055.389] lstrcmpA (lpString1=".", lpString2="GrooveForms5") returned -1 [0055.389] lstrcmpA (lpString1="..", lpString2="GrooveForms5") returned -1 [0055.389] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned="GROOVE.HXS" [0055.389] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="GrooveForms5" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5" [0055.389] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd443cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d8138, cFileName=".", cAlternateFileName="")) returned 0x2d7ff8 [0055.392] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0055.392] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd443cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0055.392] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0055.392] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0055.392] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5373f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc5373f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x614e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BG_ADOBE.GIF", cAlternateFileName="")) returned 1 [0055.392] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.392] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BG_ADOBE.GIF") returned 1 [0055.392] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BG_ADOBE.GIF") returned 1 [0055.392] lstrcmpiA (lpString1="", lpString2="BG_ADOBE.GIF") returned -1 [0055.392] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\*.*") returned="*.*" [0055.397] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0055.397] CloseHandle (hObject=0x90) returned 1 [0055.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\", lpString2="BG_ADOBE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF" [0055.401] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF") returned="BG_ADOBE.GIF" [0055.402] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.402] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60d0, lpOverlapped=0x0) returned 1 [0055.402] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.403] CloseHandle (hObject=0x90) returned 1 [0055.403] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_adobe.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_adobe.gif.wannacry")) returned 1 [0055.403] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5373f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd41db50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc5373f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x161d, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="bg_Casual.gif", cAlternateFileName="BG_CAS~1.GIF")) returned 1 [0055.403] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.404] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_Casual.gif") returned 1 [0055.404] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Casual.gif") returned 1 [0055.404] lstrcmpiA (lpString1="", lpString2="bg_Casual.gif") returned -1 [0055.404] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF") returned="BG_ADOBE.GIF" [0055.404] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" [0055.404] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\") returned="" [0055.404] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0055.404] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0055.404] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\", lpString2="bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif" [0055.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif", pszSpec="*.zip") returned 0 [0055.404] lstrlenA (lpString="*.zip") returned 5 [0055.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif", pszSpec="*.rar") returned 0 [0055.404] lstrlenA (lpString="*.rar") returned 5 [0055.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif", pszSpec="*.7z") returned 0 [0055.404] lstrlenA (lpString="*.7z") returned 4 [0055.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif", pszSpec="*.tar") returned 0 [0055.404] lstrlenA (lpString="*.tar") returned 5 [0055.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif", pszSpec="*.gzip") returned 0 [0055.404] lstrlenA (lpString="*.gzip") returned 6 [0055.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif", pszSpec="*.jpg") returned 0 [0055.405] lstrlenA (lpString="*.jpg") returned 5 [0055.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif", pszSpec="*.jpeg") returned 0 [0055.405] lstrlenA (lpString="*.jpeg") returned 6 [0055.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif", pszSpec="*.psd") returned 0 [0055.405] lstrlenA (lpString="*.psd") returned 5 [0055.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif", pszSpec="*.gif") returned 1 [0055.405] lstrlenA (lpString="*.gif") returned 5 [0055.405] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif" [0055.405] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif" [0055.405] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif." [0055.405] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif.wannacry" [0055.405] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.406] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x161d [0055.406] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc5373f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd41db50, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc5373f00, dwHighDateTime=0x1c747ea)) returned 1 [0055.406] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.406] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x159f, lpOverlapped=0x0) returned 1 [0055.408] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif") returned="bg_Casual.gif" [0055.408] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.408] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x159f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x159f, lpOverlapped=0x0) returned 1 [0055.409] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.409] CloseHandle (hObject=0x90) returned 1 [0055.409] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif.wannacry")) returned 1 [0055.410] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd41db50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7dd3, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="bg_Country.gif", cAlternateFileName="BG_COU~1.GIF")) returned 1 [0055.410] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.410] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_Country.gif") returned 1 [0055.410] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Country.gif") returned 1 [0055.410] lstrcmpiA (lpString1="", lpString2="bg_Country.gif") returned -1 [0055.410] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif") returned="bg_Casual.gif" [0055.410] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" [0055.410] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\") returned="" [0055.410] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0055.410] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0055.410] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\", lpString2="bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif" [0055.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif", pszSpec="*.zip") returned 0 [0055.410] lstrlenA (lpString="*.zip") returned 5 [0055.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif", pszSpec="*.rar") returned 0 [0055.410] lstrlenA (lpString="*.rar") returned 5 [0055.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif", pszSpec="*.7z") returned 0 [0055.410] lstrlenA (lpString="*.7z") returned 4 [0055.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif", pszSpec="*.tar") returned 0 [0055.410] lstrlenA (lpString="*.tar") returned 5 [0055.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif", pszSpec="*.gzip") returned 0 [0055.411] lstrlenA (lpString="*.gzip") returned 6 [0055.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif", pszSpec="*.jpg") returned 0 [0055.411] lstrlenA (lpString="*.jpg") returned 5 [0055.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif", pszSpec="*.jpeg") returned 0 [0055.411] lstrlenA (lpString="*.jpeg") returned 6 [0055.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif", pszSpec="*.psd") returned 0 [0055.411] lstrlenA (lpString="*.psd") returned 5 [0055.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif", pszSpec="*.gif") returned 1 [0055.411] lstrlenA (lpString="*.gif") returned 5 [0055.411] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif" [0055.411] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif" [0055.411] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif." [0055.411] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif.wannacry" [0055.411] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_country.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.412] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7dd3 [0055.412] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc6686c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd41db50, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc6686c00, dwHighDateTime=0x1c747ea)) returned 1 [0055.412] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.412] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x7d55, lpOverlapped=0x0) returned 1 [0055.414] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif") returned="bg_Country.gif" [0055.414] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.414] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x7d55, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x7d55, lpOverlapped=0x0) returned 1 [0055.414] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.414] CloseHandle (hObject=0x90) returned 1 [0055.415] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_country.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_country.gif.wannacry")) returned 1 [0055.415] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd41db50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x132a, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="bg_Earthy.gif", cAlternateFileName="BG_EAR~1.GIF")) returned 1 [0055.415] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.415] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_Earthy.gif") returned 1 [0055.415] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Earthy.gif") returned 1 [0055.415] lstrcmpiA (lpString1="", lpString2="bg_Earthy.gif") returned -1 [0055.415] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif") returned="bg_Country.gif" [0055.416] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" [0055.416] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\") returned="" [0055.416] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0055.416] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0055.416] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\", lpString2="bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif" [0055.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif", pszSpec="*.zip") returned 0 [0055.416] lstrlenA (lpString="*.zip") returned 5 [0055.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif", pszSpec="*.rar") returned 0 [0055.416] lstrlenA (lpString="*.rar") returned 5 [0055.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif", pszSpec="*.7z") returned 0 [0055.416] lstrlenA (lpString="*.7z") returned 4 [0055.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif", pszSpec="*.tar") returned 0 [0055.416] lstrlenA (lpString="*.tar") returned 5 [0055.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif", pszSpec="*.gzip") returned 0 [0055.416] lstrlenA (lpString="*.gzip") returned 6 [0055.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif", pszSpec="*.jpg") returned 0 [0055.416] lstrlenA (lpString="*.jpg") returned 5 [0055.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif", pszSpec="*.jpeg") returned 0 [0055.416] lstrlenA (lpString="*.jpeg") returned 6 [0055.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif", pszSpec="*.psd") returned 0 [0055.416] lstrlenA (lpString="*.psd") returned 5 [0055.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif", pszSpec="*.gif") returned 1 [0055.416] lstrlenA (lpString="*.gif") returned 5 [0055.416] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif" [0055.417] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif" [0055.417] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif." [0055.417] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif.wannacry" [0055.417] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_earthy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.417] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x132a [0055.417] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc6686c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd41db50, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc6686c00, dwHighDateTime=0x1c747ea)) returned 1 [0055.417] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.417] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x12ac, lpOverlapped=0x0) returned 1 [0055.419] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif") returned="bg_Earthy.gif" [0055.419] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.419] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x12ac, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x12ac, lpOverlapped=0x0) returned 1 [0055.419] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.419] CloseHandle (hObject=0x90) returned 1 [0055.419] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_earthy.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_earthy.gif.wannacry")) returned 1 [0055.420] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd41db50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5690, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="bg_GreenTea.gif", cAlternateFileName="BG_GRE~1.GIF")) returned 1 [0055.420] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.420] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_GreenTea.gif") returned 1 [0055.420] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_GreenTea.gif") returned 1 [0055.420] lstrcmpiA (lpString1="", lpString2="bg_GreenTea.gif") returned -1 [0055.420] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif") returned="bg_Earthy.gif" [0055.420] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" [0055.420] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\") returned="" [0055.421] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0055.421] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0055.421] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\", lpString2="bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif" [0055.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif", pszSpec="*.zip") returned 0 [0055.421] lstrlenA (lpString="*.zip") returned 5 [0055.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif", pszSpec="*.rar") returned 0 [0055.421] lstrlenA (lpString="*.rar") returned 5 [0055.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif", pszSpec="*.7z") returned 0 [0055.421] lstrlenA (lpString="*.7z") returned 4 [0055.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif", pszSpec="*.tar") returned 0 [0055.421] lstrlenA (lpString="*.tar") returned 5 [0055.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif", pszSpec="*.gzip") returned 0 [0055.421] lstrlenA (lpString="*.gzip") returned 6 [0055.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif", pszSpec="*.jpg") returned 0 [0055.422] lstrlenA (lpString="*.jpg") returned 5 [0055.422] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif", pszSpec="*.jpeg") returned 0 [0055.422] lstrlenA (lpString="*.jpeg") returned 6 [0055.422] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif", pszSpec="*.psd") returned 0 [0055.422] lstrlenA (lpString="*.psd") returned 5 [0055.422] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif", pszSpec="*.gif") returned 1 [0055.422] lstrlenA (lpString="*.gif") returned 5 [0055.422] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif" [0055.422] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif" [0055.422] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif." [0055.422] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif.wannacry" [0055.422] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_greentea.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.423] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5690 [0055.423] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc6686c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd41db50, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc6686c00, dwHighDateTime=0x1c747ea)) returned 1 [0055.423] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.423] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x5612, lpOverlapped=0x0) returned 1 [0055.737] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif") returned="bg_GreenTea.gif" [0055.737] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.740] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x5612, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x5612, lpOverlapped=0x0) returned 1 [0055.741] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.741] CloseHandle (hObject=0x90) returned 1 [0055.741] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_greentea.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_greentea.gif.wannacry")) returned 1 [0055.742] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6a, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="bg_Groove.gif", cAlternateFileName="BG_GRO~1.GIF")) returned 1 [0055.742] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.742] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_Groove.gif") returned 1 [0055.742] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Groove.gif") returned 1 [0055.742] lstrcmpiA (lpString1="", lpString2="bg_Groove.gif") returned -1 [0055.742] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif") returned="bg_GreenTea.gif" [0055.742] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" [0055.742] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\") returned="" [0055.742] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0055.742] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0055.742] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\", lpString2="bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif" [0055.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif", pszSpec="*.zip") returned 0 [0055.743] lstrlenA (lpString="*.zip") returned 5 [0055.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif", pszSpec="*.rar") returned 0 [0055.743] lstrlenA (lpString="*.rar") returned 5 [0055.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif", pszSpec="*.7z") returned 0 [0055.743] lstrlenA (lpString="*.7z") returned 4 [0055.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif", pszSpec="*.tar") returned 0 [0055.743] lstrlenA (lpString="*.tar") returned 5 [0055.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif", pszSpec="*.gzip") returned 0 [0055.743] lstrlenA (lpString="*.gzip") returned 6 [0055.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif", pszSpec="*.jpg") returned 0 [0055.743] lstrlenA (lpString="*.jpg") returned 5 [0055.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif", pszSpec="*.jpeg") returned 0 [0055.743] lstrlenA (lpString="*.jpeg") returned 6 [0055.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif", pszSpec="*.psd") returned 0 [0055.743] lstrlenA (lpString="*.psd") returned 5 [0055.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif", pszSpec="*.gif") returned 1 [0055.743] lstrlenA (lpString="*.gif") returned 5 [0055.743] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif" [0055.744] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif" [0055.744] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif." [0055.744] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif.wannacry" [0055.744] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_groove.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.745] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6a [0055.745] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc6686c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd443cb0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc6686c00, dwHighDateTime=0x1c747ea)) returned 1 [0055.745] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.745] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0055.745] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.746] CloseHandle (hObject=0x90) returned 1 [0055.746] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_groove.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_groove.gif.wannacry")) returned 1 [0055.746] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x21a6, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="bg_LightSpirit.gif", cAlternateFileName="BG_LIG~1.GIF")) returned 1 [0055.746] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.746] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_LightSpirit.gif") returned 1 [0055.747] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_LightSpirit.gif") returned 1 [0055.747] lstrcmpiA (lpString1="", lpString2="bg_LightSpirit.gif") returned -1 [0055.747] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif") returned="bg_Groove.gif" [0055.747] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" [0055.747] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\") returned="" [0055.747] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0055.747] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0055.747] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\", lpString2="bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif" [0055.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif", pszSpec="*.zip") returned 0 [0055.747] lstrlenA (lpString="*.zip") returned 5 [0055.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif", pszSpec="*.rar") returned 0 [0055.747] lstrlenA (lpString="*.rar") returned 5 [0055.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif", pszSpec="*.7z") returned 0 [0055.747] lstrlenA (lpString="*.7z") returned 4 [0055.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif", pszSpec="*.tar") returned 0 [0055.747] lstrlenA (lpString="*.tar") returned 5 [0055.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif", pszSpec="*.gzip") returned 0 [0055.747] lstrlenA (lpString="*.gzip") returned 6 [0055.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif", pszSpec="*.jpg") returned 0 [0055.747] lstrlenA (lpString="*.jpg") returned 5 [0055.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif", pszSpec="*.jpeg") returned 0 [0055.747] lstrlenA (lpString="*.jpeg") returned 6 [0055.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif", pszSpec="*.psd") returned 0 [0055.747] lstrlenA (lpString="*.psd") returned 5 [0055.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif", pszSpec="*.gif") returned 1 [0055.748] lstrlenA (lpString="*.gif") returned 5 [0055.748] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif" [0055.748] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif" [0055.748] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif." [0055.748] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif.wannacry" [0055.748] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_lightspirit.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.748] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x21a6 [0055.748] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc6686c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd443cb0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc6686c00, dwHighDateTime=0x1c747ea)) returned 1 [0055.748] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.748] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2128, lpOverlapped=0x0) returned 1 [0055.750] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif") returned="bg_LightSpirit.gif" [0055.750] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.750] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2128, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2128, lpOverlapped=0x0) returned 1 [0055.751] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.751] CloseHandle (hObject=0x90) returned 1 [0055.751] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_lightspirit.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_lightspirit.gif.wannacry")) returned 1 [0055.752] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3d57, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="bg_OliveGreen.gif", cAlternateFileName="BG_OLI~1.GIF")) returned 1 [0055.752] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.752] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_OliveGreen.gif") returned 1 [0055.752] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_OliveGreen.gif") returned 1 [0055.752] lstrcmpiA (lpString1="", lpString2="bg_OliveGreen.gif") returned -1 [0055.752] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif") returned="bg_LightSpirit.gif" [0055.752] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" [0055.752] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\") returned="" [0055.752] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0055.752] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0055.752] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\", lpString2="bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif" [0055.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif", pszSpec="*.zip") returned 0 [0055.752] lstrlenA (lpString="*.zip") returned 5 [0055.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif", pszSpec="*.rar") returned 0 [0055.752] lstrlenA (lpString="*.rar") returned 5 [0055.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif", pszSpec="*.7z") returned 0 [0055.752] lstrlenA (lpString="*.7z") returned 4 [0055.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif", pszSpec="*.tar") returned 0 [0055.753] lstrlenA (lpString="*.tar") returned 5 [0055.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif", pszSpec="*.gzip") returned 0 [0055.753] lstrlenA (lpString="*.gzip") returned 6 [0055.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif", pszSpec="*.jpg") returned 0 [0055.753] lstrlenA (lpString="*.jpg") returned 5 [0055.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif", pszSpec="*.jpeg") returned 0 [0055.753] lstrlenA (lpString="*.jpeg") returned 6 [0055.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif", pszSpec="*.psd") returned 0 [0055.753] lstrlenA (lpString="*.psd") returned 5 [0055.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif", pszSpec="*.gif") returned 1 [0055.753] lstrlenA (lpString="*.gif") returned 5 [0055.753] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif" [0055.753] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif" [0055.753] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif." [0055.753] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif.wannacry" [0055.753] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_olivegreen.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.753] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d57 [0055.754] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc6686c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd443cb0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc6686c00, dwHighDateTime=0x1c747ea)) returned 1 [0055.754] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.754] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3cd9, lpOverlapped=0x0) returned 1 [0055.756] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif") returned="bg_OliveGreen.gif" [0055.756] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.756] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3cd9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3cd9, lpOverlapped=0x0) returned 1 [0055.756] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.756] CloseHandle (hObject=0x90) returned 1 [0055.756] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_olivegreen.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_olivegreen.gif.wannacry")) returned 1 [0055.757] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1845, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="bg_Premium.gif", cAlternateFileName="BG_PRE~1.GIF")) returned 1 [0055.757] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.757] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_Premium.gif") returned 1 [0055.757] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Premium.gif") returned 1 [0055.757] lstrcmpiA (lpString1="", lpString2="bg_Premium.gif") returned -1 [0055.757] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif") returned="bg_OliveGreen.gif" [0055.757] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" [0055.757] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\") returned="" [0055.757] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0055.757] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0055.757] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\", lpString2="bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif" [0055.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif", pszSpec="*.zip") returned 0 [0055.757] lstrlenA (lpString="*.zip") returned 5 [0055.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif", pszSpec="*.rar") returned 0 [0055.757] lstrlenA (lpString="*.rar") returned 5 [0055.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif", pszSpec="*.7z") returned 0 [0055.757] lstrlenA (lpString="*.7z") returned 4 [0055.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif", pszSpec="*.tar") returned 0 [0055.758] lstrlenA (lpString="*.tar") returned 5 [0055.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif", pszSpec="*.gzip") returned 0 [0055.758] lstrlenA (lpString="*.gzip") returned 6 [0055.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif", pszSpec="*.jpg") returned 0 [0055.758] lstrlenA (lpString="*.jpg") returned 5 [0055.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif", pszSpec="*.jpeg") returned 0 [0055.758] lstrlenA (lpString="*.jpeg") returned 6 [0055.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif", pszSpec="*.psd") returned 0 [0055.758] lstrlenA (lpString="*.psd") returned 5 [0055.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif", pszSpec="*.gif") returned 1 [0055.758] lstrlenA (lpString="*.gif") returned 5 [0055.758] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif" [0055.758] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif" [0055.758] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif." [0055.758] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif.wannacry" [0055.758] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_premium.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.759] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1845 [0055.759] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc6686c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd443cb0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc6686c00, dwHighDateTime=0x1c747ea)) returned 1 [0055.759] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.759] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x17c7, lpOverlapped=0x0) returned 1 [0055.761] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif") returned="bg_Premium.gif" [0055.761] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.761] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x17c7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x17c7, lpOverlapped=0x0) returned 1 [0055.761] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.761] CloseHandle (hObject=0x90) returned 1 [0055.762] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_premium.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_premium.gif.wannacry")) returned 1 [0055.762] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5141, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="bg_SlateBlue.gif", cAlternateFileName="BG_SLA~1.GIF")) returned 1 [0055.762] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.762] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_SlateBlue.gif") returned 1 [0055.762] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_SlateBlue.gif") returned 1 [0055.762] lstrcmpiA (lpString1="", lpString2="bg_SlateBlue.gif") returned -1 [0055.763] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif") returned="bg_Premium.gif" [0055.763] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" [0055.763] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\") returned="" [0055.763] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0055.763] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0055.763] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\", lpString2="bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif" [0055.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif", pszSpec="*.zip") returned 0 [0055.763] lstrlenA (lpString="*.zip") returned 5 [0055.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif", pszSpec="*.rar") returned 0 [0055.763] lstrlenA (lpString="*.rar") returned 5 [0055.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif", pszSpec="*.7z") returned 0 [0055.763] lstrlenA (lpString="*.7z") returned 4 [0055.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif", pszSpec="*.tar") returned 0 [0055.763] lstrlenA (lpString="*.tar") returned 5 [0055.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif", pszSpec="*.gzip") returned 0 [0055.763] lstrlenA (lpString="*.gzip") returned 6 [0055.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif", pszSpec="*.jpg") returned 0 [0055.763] lstrlenA (lpString="*.jpg") returned 5 [0055.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif", pszSpec="*.jpeg") returned 0 [0055.763] lstrlenA (lpString="*.jpeg") returned 6 [0055.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif", pszSpec="*.psd") returned 0 [0055.763] lstrlenA (lpString="*.psd") returned 5 [0055.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif", pszSpec="*.gif") returned 1 [0055.763] lstrlenA (lpString="*.gif") returned 5 [0055.764] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif" [0055.764] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif" [0055.764] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif." [0055.764] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif.wannacry" [0055.764] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_slateblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.873] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5141 [0055.873] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc6686c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd443cb0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc6686c00, dwHighDateTime=0x1c747ea)) returned 1 [0055.873] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.873] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x50c3, lpOverlapped=0x0) returned 1 [0055.920] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif") returned="bg_SlateBlue.gif" [0055.920] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.920] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x50c3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x50c3, lpOverlapped=0x0) returned 1 [0055.920] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.921] CloseHandle (hObject=0x90) returned 1 [0055.921] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_slateblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_slateblue.gif.wannacry")) returned 1 [0055.922] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x193c, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="bg_TexturedBlue.gif", cAlternateFileName="BG_TEX~1.GIF")) returned 1 [0055.922] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.923] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_TexturedBlue.gif") returned 1 [0055.923] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_TexturedBlue.gif") returned 1 [0055.923] lstrcmpiA (lpString1="", lpString2="bg_TexturedBlue.gif") returned -1 [0055.923] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif") returned="bg_SlateBlue.gif" [0055.923] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" [0055.923] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\") returned="" [0055.923] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0055.923] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0055.923] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\", lpString2="bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif" [0055.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif", pszSpec="*.zip") returned 0 [0055.923] lstrlenA (lpString="*.zip") returned 5 [0055.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif", pszSpec="*.rar") returned 0 [0055.923] lstrlenA (lpString="*.rar") returned 5 [0055.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif", pszSpec="*.7z") returned 0 [0055.923] lstrlenA (lpString="*.7z") returned 4 [0055.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif", pszSpec="*.tar") returned 0 [0055.923] lstrlenA (lpString="*.tar") returned 5 [0055.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif", pszSpec="*.gzip") returned 0 [0055.923] lstrlenA (lpString="*.gzip") returned 6 [0055.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif", pszSpec="*.jpg") returned 0 [0055.923] lstrlenA (lpString="*.jpg") returned 5 [0055.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif", pszSpec="*.jpeg") returned 0 [0055.923] lstrlenA (lpString="*.jpeg") returned 6 [0055.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif", pszSpec="*.psd") returned 0 [0055.924] lstrlenA (lpString="*.psd") returned 5 [0055.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif", pszSpec="*.gif") returned 1 [0055.924] lstrlenA (lpString="*.gif") returned 5 [0055.924] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif" [0055.924] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif" [0055.924] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif." [0055.924] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif.wannacry" [0055.924] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_texturedblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.924] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x193c [0055.924] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc6686c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd443cb0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc6686c00, dwHighDateTime=0x1c747ea)) returned 1 [0055.925] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.925] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x18be, lpOverlapped=0x0) returned 1 [0055.938] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif") returned="bg_TexturedBlue.gif" [0055.938] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.939] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x18be, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x18be, lpOverlapped=0x0) returned 1 [0055.939] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.939] CloseHandle (hObject=0x90) returned 1 [0055.939] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_texturedblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_texturedblue.gif.wannacry")) returned 1 [0055.940] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3c64, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="bg_VelvetRose.gif", cAlternateFileName="BG_VEL~1.GIF")) returned 1 [0055.940] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0055.940] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_VelvetRose.gif") returned 1 [0055.940] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_VelvetRose.gif") returned 1 [0055.940] lstrcmpiA (lpString1="", lpString2="bg_VelvetRose.gif") returned -1 [0055.940] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif") returned="bg_TexturedBlue.gif" [0055.940] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" [0055.940] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\") returned="" [0055.940] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0055.940] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0055.940] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\", lpString2="bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif" [0055.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif", pszSpec="*.zip") returned 0 [0055.941] lstrlenA (lpString="*.zip") returned 5 [0055.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif", pszSpec="*.rar") returned 0 [0055.941] lstrlenA (lpString="*.rar") returned 5 [0055.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif", pszSpec="*.7z") returned 0 [0055.941] lstrlenA (lpString="*.7z") returned 4 [0055.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif", pszSpec="*.tar") returned 0 [0055.941] lstrlenA (lpString="*.tar") returned 5 [0055.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif", pszSpec="*.gzip") returned 0 [0055.941] lstrlenA (lpString="*.gzip") returned 6 [0055.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif", pszSpec="*.jpg") returned 0 [0055.941] lstrlenA (lpString="*.jpg") returned 5 [0055.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif", pszSpec="*.jpeg") returned 0 [0055.941] lstrlenA (lpString="*.jpeg") returned 6 [0055.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif", pszSpec="*.psd") returned 0 [0055.941] lstrlenA (lpString="*.psd") returned 5 [0055.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif", pszSpec="*.gif") returned 1 [0055.941] lstrlenA (lpString="*.gif") returned 5 [0055.941] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif" [0055.941] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif" [0055.941] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif." [0055.941] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif.wannacry" [0055.941] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_velvetrose.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0055.942] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c64 [0055.942] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc6686c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd443cb0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc6686c00, dwHighDateTime=0x1c747ea)) returned 1 [0055.942] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.942] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3be6, lpOverlapped=0x0) returned 1 [0055.945] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif") returned="bg_VelvetRose.gif" [0055.945] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.945] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3be6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3be6, lpOverlapped=0x0) returned 1 [0055.946] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.946] CloseHandle (hObject=0x90) returned 1 [0055.946] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_velvetrose.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_velvetrose.gif.wannacry")) returned 1 [0055.947] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="FormsStyles", cAlternateFileName="FORMSS~1")) returned 1 [0055.947] lstrcmpA (lpString1=".", lpString2="FormsStyles") returned -1 [0055.947] lstrcmpA (lpString1="..", lpString2="FormsStyles") returned -1 [0055.947] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif") returned="bg_VelvetRose.gif" [0055.947] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\", lpString2="FormsStyles" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles" [0055.947] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles") returned 72 [0055.947] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0069, dwReserved1=0x730065, cFileName=".", cAlternateFileName="")) returned 0x2d8150 [0055.949] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0055.950] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x730000, cFileName="..", cAlternateFileName="")) returned 1 [0055.951] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0055.951] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0055.951] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x75c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Adobe.css", cAlternateFileName="")) returned 1 [0055.951] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0055.951] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe.css") returned 1 [0055.951] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe.css") returned 1 [0055.951] lstrcmpiA (lpString1="", lpString2="Adobe.css") returned -1 [0055.951] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*.*") returned="*.*" [0055.951] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0055.951] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0055.951] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0055.951] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0xffffffff [0055.951] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0055.952] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0055.952] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0055.953] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0055.953] CloseHandle (hObject=0x94) returned 1 [0055.953] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Adobe.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css" [0055.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.zip") returned 0 [0055.954] lstrlenA (lpString="*.zip") returned 5 [0055.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.rar") returned 0 [0055.954] lstrlenA (lpString="*.rar") returned 5 [0055.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.7z") returned 0 [0055.954] lstrlenA (lpString="*.7z") returned 4 [0055.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.tar") returned 0 [0055.954] lstrlenA (lpString="*.tar") returned 5 [0055.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.gzip") returned 0 [0055.954] lstrlenA (lpString="*.gzip") returned 6 [0055.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.jpg") returned 0 [0055.954] lstrlenA (lpString="*.jpg") returned 5 [0055.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.jpeg") returned 0 [0055.954] lstrlenA (lpString="*.jpeg") returned 6 [0055.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.psd") returned 0 [0055.954] lstrlenA (lpString="*.psd") returned 5 [0055.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.gif") returned 0 [0055.954] lstrlenA (lpString="*.gif") returned 5 [0055.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.doc") returned 0 [0055.954] lstrlenA (lpString="*.doc") returned 5 [0055.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.docx") returned 0 [0055.954] lstrlenA (lpString="*.docx") returned 6 [0055.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.xls") returned 0 [0055.954] lstrlenA (lpString="*.xls") returned 5 [0055.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.xlsx") returned 0 [0055.954] lstrlenA (lpString="*.xlsx") returned 6 [0055.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.ppt") returned 0 [0055.954] lstrlenA (lpString="*.ppt") returned 5 [0055.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.pptx") returned 0 [0055.955] lstrlenA (lpString="*.pptx") returned 6 [0055.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.pdf") returned 0 [0055.955] lstrlenA (lpString="*.pdf") returned 5 [0055.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.mov") returned 0 [0055.955] lstrlenA (lpString="*.mov") returned 5 [0055.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.m2v") returned 0 [0055.955] lstrlenA (lpString="*.m2v") returned 5 [0055.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.3gp") returned 0 [0055.955] lstrlenA (lpString="*.3gp") returned 5 [0055.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.mpeg") returned 0 [0055.955] lstrlenA (lpString="*.mpeg") returned 6 [0055.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.mpg") returned 0 [0055.955] lstrlenA (lpString="*.mpg") returned 5 [0055.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.flv") returned 0 [0055.955] lstrlenA (lpString="*.flv") returned 5 [0055.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.avi") returned 0 [0055.955] lstrlenA (lpString="*.avi") returned 5 [0055.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.mp4") returned 0 [0055.955] lstrlenA (lpString="*.mp4") returned 5 [0055.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.wmv") returned 0 [0055.955] lstrlenA (lpString="*.wmv") returned 5 [0055.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.divx") returned 0 [0055.955] lstrlenA (lpString="*.divx") returned 6 [0055.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.mkv") returned 0 [0055.955] lstrlenA (lpString="*.mkv") returned 5 [0055.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.mp3") returned 0 [0055.955] lstrlenA (lpString="*.mp3") returned 5 [0055.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.wav") returned 0 [0055.956] lstrlenA (lpString="*.wav") returned 5 [0055.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.flac") returned 0 [0055.956] lstrlenA (lpString="*.flac") returned 6 [0055.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.ape") returned 0 [0055.956] lstrlenA (lpString="*.ape") returned 5 [0055.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.wma") returned 0 [0055.956] lstrlenA (lpString="*.wma") returned 5 [0055.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.ac3") returned 0 [0055.956] lstrlenA (lpString="*.ac3") returned 5 [0055.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", pszSpec="*.mxf") returned 0 [0055.956] lstrlenA (lpString="*.mxf") returned 5 [0055.956] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4b60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Americana", cAlternateFileName="AMERIC~1")) returned 1 [0055.956] lstrcmpA (lpString1=".", lpString2="Americana") returned -1 [0055.956] lstrcmpA (lpString1="..", lpString2="Americana") returned -1 [0055.956] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css") returned="Adobe.css" [0055.956] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Americana" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana" [0055.956] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana") returned 82 [0055.956] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4b60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8252, cFileName=".", cAlternateFileName="")) returned 0x2d80a8 [0055.957] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0055.957] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4b60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0055.957] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0055.957] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0055.957] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0055.957] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0055.957] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0055.957] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0055.958] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0055.958] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\*.*") returned="*.*" [0055.958] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\" [0055.958] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\") returned="" [0055.958] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt" [0055.958] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\how to decrypt files.txt")) returned 0xffffffff [0055.958] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0055.958] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0055.958] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0055.960] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0055.960] CloseHandle (hObject=0x98) returned 1 [0055.960] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF" [0055.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0055.960] lstrlenA (lpString="*.zip") returned 5 [0055.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0055.960] lstrlenA (lpString="*.rar") returned 5 [0055.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0055.960] lstrlenA (lpString="*.7z") returned 4 [0055.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0055.960] lstrlenA (lpString="*.tar") returned 5 [0055.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0055.960] lstrlenA (lpString="*.gzip") returned 6 [0055.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0055.960] lstrlenA (lpString="*.jpg") returned 5 [0055.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0055.961] lstrlenA (lpString="*.jpeg") returned 6 [0055.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0055.961] lstrlenA (lpString="*.psd") returned 5 [0055.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0055.961] lstrlenA (lpString="*.gif") returned 5 [0055.961] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF" [0055.961] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF" [0055.961] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF." [0055.961] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF.wannacry" [0055.961] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0055.961] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0055.962] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc8cac600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd4b60d0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc8cac600, dwHighDateTime=0x1c747ea)) returned 1 [0055.962] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.962] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd7, lpOverlapped=0x0) returned 1 [0055.963] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0055.963] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0055.963] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd7, lpOverlapped=0x0) returned 1 [0055.963] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0055.963] CloseHandle (hObject=0x98) returned 1 [0055.963] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_off.gif.wannacry")) returned 1 [0056.069] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0056.070] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.070] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0056.070] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0056.070] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0056.070] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0056.070] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\" [0056.070] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\") returned="" [0056.070] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt" [0056.070] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\how to decrypt files.txt")) returned 0x20 [0056.070] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF" [0056.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0056.070] lstrlenA (lpString="*.zip") returned 5 [0056.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0056.070] lstrlenA (lpString="*.rar") returned 5 [0056.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0056.070] lstrlenA (lpString="*.7z") returned 4 [0056.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0056.070] lstrlenA (lpString="*.tar") returned 5 [0056.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0056.070] lstrlenA (lpString="*.gzip") returned 6 [0056.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0056.070] lstrlenA (lpString="*.jpg") returned 5 [0056.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0056.071] lstrlenA (lpString="*.jpeg") returned 6 [0056.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0056.071] lstrlenA (lpString="*.psd") returned 5 [0056.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0056.071] lstrlenA (lpString="*.gif") returned 5 [0056.071] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF" [0056.071] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF" [0056.071] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF." [0056.071] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF.wannacry" [0056.071] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.072] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0056.072] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc8cac600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd4b60d0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc8cac600, dwHighDateTime=0x1c747ea)) returned 1 [0056.072] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.072] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60, lpOverlapped=0x0) returned 1 [0056.074] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF") returned="TAB_ON.GIF" [0056.074] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.074] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60, lpOverlapped=0x0) returned 1 [0056.074] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.074] CloseHandle (hObject=0x98) returned 1 [0056.074] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_on.gif.wannacry")) returned 1 [0056.075] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0056.075] FindClose (in: hFindFile=0x2d80a8 | out: hFindFile=0x2d80a8) returned 1 [0056.075] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="Americana.css", cAlternateFileName="AMERIC~1.CSS")) returned 1 [0056.075] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0056.075] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Americana.css") returned 1 [0056.075] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Americana.css") returned 1 [0056.075] lstrcmpiA (lpString1="", lpString2="Americana.css") returned -1 [0056.075] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*.*") returned="*.*" [0056.075] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0056.075] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0056.075] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0056.075] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0056.076] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Americana.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css" [0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.zip") returned 0 [0056.076] lstrlenA (lpString="*.zip") returned 5 [0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.rar") returned 0 [0056.076] lstrlenA (lpString="*.rar") returned 5 [0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.7z") returned 0 [0056.076] lstrlenA (lpString="*.7z") returned 4 [0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.tar") returned 0 [0056.076] lstrlenA (lpString="*.tar") returned 5 [0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.gzip") returned 0 [0056.076] lstrlenA (lpString="*.gzip") returned 6 [0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.jpg") returned 0 [0056.076] lstrlenA (lpString="*.jpg") returned 5 [0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.jpeg") returned 0 [0056.076] lstrlenA (lpString="*.jpeg") returned 6 [0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.psd") returned 0 [0056.076] lstrlenA (lpString="*.psd") returned 5 [0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.gif") returned 0 [0056.076] lstrlenA (lpString="*.gif") returned 5 [0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.doc") returned 0 [0056.076] lstrlenA (lpString="*.doc") returned 5 [0056.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.docx") returned 0 [0056.076] lstrlenA (lpString="*.docx") returned 6 [0056.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.xls") returned 0 [0056.077] lstrlenA (lpString="*.xls") returned 5 [0056.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.xlsx") returned 0 [0056.077] lstrlenA (lpString="*.xlsx") returned 6 [0056.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.ppt") returned 0 [0056.077] lstrlenA (lpString="*.ppt") returned 5 [0056.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.pptx") returned 0 [0056.077] lstrlenA (lpString="*.pptx") returned 6 [0056.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.pdf") returned 0 [0056.077] lstrlenA (lpString="*.pdf") returned 5 [0056.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.mov") returned 0 [0056.077] lstrlenA (lpString="*.mov") returned 5 [0056.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.m2v") returned 0 [0056.077] lstrlenA (lpString="*.m2v") returned 5 [0056.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.3gp") returned 0 [0056.077] lstrlenA (lpString="*.3gp") returned 5 [0056.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.mpeg") returned 0 [0056.077] lstrlenA (lpString="*.mpeg") returned 6 [0056.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.mpg") returned 0 [0056.077] lstrlenA (lpString="*.mpg") returned 5 [0056.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.flv") returned 0 [0056.077] lstrlenA (lpString="*.flv") returned 5 [0056.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.avi") returned 0 [0056.077] lstrlenA (lpString="*.avi") returned 5 [0056.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.mp4") returned 0 [0056.077] lstrlenA (lpString="*.mp4") returned 5 [0056.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.wmv") returned 0 [0056.077] lstrlenA (lpString="*.wmv") returned 5 [0056.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.divx") returned 0 [0056.078] lstrlenA (lpString="*.divx") returned 6 [0056.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.mkv") returned 0 [0056.078] lstrlenA (lpString="*.mkv") returned 5 [0056.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.mp3") returned 0 [0056.078] lstrlenA (lpString="*.mp3") returned 5 [0056.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.wav") returned 0 [0056.078] lstrlenA (lpString="*.wav") returned 5 [0056.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.flac") returned 0 [0056.078] lstrlenA (lpString="*.flac") returned 6 [0056.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.ape") returned 0 [0056.078] lstrlenA (lpString="*.ape") returned 5 [0056.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.wma") returned 0 [0056.078] lstrlenA (lpString="*.wma") returned 5 [0056.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.ac3") returned 0 [0056.078] lstrlenA (lpString="*.ac3") returned 5 [0056.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", pszSpec="*.mxf") returned 0 [0056.078] lstrlenA (lpString="*.mxf") returned 5 [0056.078] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd48ff70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="BabyBlue", cAlternateFileName="")) returned 1 [0056.078] lstrcmpA (lpString1=".", lpString2="BabyBlue") returned -1 [0056.078] lstrcmpA (lpString1="..", lpString2="BabyBlue") returned -1 [0056.078] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css") returned="Americana.css" [0056.078] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="BabyBlue" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue" [0056.078] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue") returned 81 [0056.078] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd48ff70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2d8252, cFileName=".", cAlternateFileName="")) returned 0x2d80a8 [0056.079] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.080] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd48ff70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0056.080] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.080] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.080] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0056.080] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.080] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BUTTON.GIF") returned 1 [0056.080] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BUTTON.GIF") returned 1 [0056.080] lstrcmpiA (lpString1="", lpString2="BUTTON.GIF") returned -1 [0056.080] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\*.*") returned="*.*" [0056.080] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\" [0056.080] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\") returned="" [0056.080] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" [0056.080] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\how to decrypt files.txt")) returned 0xffffffff [0056.080] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.081] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0056.081] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0056.082] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.082] CloseHandle (hObject=0x98) returned 1 [0056.082] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\", lpString2="BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF" [0056.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.zip") returned 0 [0056.082] lstrlenA (lpString="*.zip") returned 5 [0056.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.rar") returned 0 [0056.082] lstrlenA (lpString="*.rar") returned 5 [0056.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.7z") returned 0 [0056.082] lstrlenA (lpString="*.7z") returned 4 [0056.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.tar") returned 0 [0056.082] lstrlenA (lpString="*.tar") returned 5 [0056.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.gzip") returned 0 [0056.082] lstrlenA (lpString="*.gzip") returned 6 [0056.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.jpg") returned 0 [0056.083] lstrlenA (lpString="*.jpg") returned 5 [0056.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.jpeg") returned 0 [0056.083] lstrlenA (lpString="*.jpeg") returned 6 [0056.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.psd") returned 0 [0056.083] lstrlenA (lpString="*.psd") returned 5 [0056.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.gif") returned 1 [0056.083] lstrlenA (lpString="*.gif") returned 5 [0056.083] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF" [0056.083] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF" [0056.083] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF." [0056.083] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF.wannacry" [0056.083] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.083] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9 [0056.084] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc8cac600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd48ff70, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc8cac600, dwHighDateTime=0x1c747ea)) returned 1 [0056.084] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.084] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3b, lpOverlapped=0x0) returned 1 [0056.085] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="BUTTON.GIF" [0056.085] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.085] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3b, lpOverlapped=0x0) returned 1 [0056.085] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.085] CloseHandle (hObject=0x98) returned 1 [0056.085] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\button.gif.wannacry")) returned 1 [0056.103] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5e6bd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0056.103] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.103] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HEADER.GIF") returned -1 [0056.103] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0056.103] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0056.103] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="BUTTON.GIF" [0056.103] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\" [0056.103] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\") returned="" [0056.104] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" [0056.104] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\how to decrypt files.txt")) returned 0x20 [0056.104] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF" [0056.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.zip") returned 0 [0056.104] lstrlenA (lpString="*.zip") returned 5 [0056.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.rar") returned 0 [0056.104] lstrlenA (lpString="*.rar") returned 5 [0056.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.7z") returned 0 [0056.104] lstrlenA (lpString="*.7z") returned 4 [0056.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.tar") returned 0 [0056.104] lstrlenA (lpString="*.tar") returned 5 [0056.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0056.104] lstrlenA (lpString="*.gzip") returned 6 [0056.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0056.104] lstrlenA (lpString="*.jpg") returned 5 [0056.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0056.104] lstrlenA (lpString="*.jpeg") returned 6 [0056.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.psd") returned 0 [0056.104] lstrlenA (lpString="*.psd") returned 5 [0056.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.gif") returned 1 [0056.104] lstrlenA (lpString="*.gif") returned 5 [0056.104] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF" [0056.104] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF" [0056.105] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF." [0056.105] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF.wannacry" [0056.105] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.105] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xff [0056.105] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc8cac600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd5e6bd0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc8cac600, dwHighDateTime=0x1c747ea)) returned 1 [0056.105] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.105] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x81, lpOverlapped=0x0) returned 1 [0056.107] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="HEADER.GIF" [0056.107] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.107] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x81, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x81, lpOverlapped=0x0) returned 1 [0056.107] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.107] CloseHandle (hObject=0x98) returned 1 [0056.107] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\header.gif.wannacry")) returned 1 [0056.108] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0056.108] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.108] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0056.108] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0056.108] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0056.108] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="HEADER.GIF" [0056.108] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\" [0056.108] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\") returned="" [0056.108] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" [0056.108] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\how to decrypt files.txt")) returned 0x20 [0056.108] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" [0056.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0056.109] lstrlenA (lpString="*.zip") returned 5 [0056.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0056.109] lstrlenA (lpString="*.rar") returned 5 [0056.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0056.109] lstrlenA (lpString="*.7z") returned 4 [0056.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0056.109] lstrlenA (lpString="*.tar") returned 5 [0056.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0056.109] lstrlenA (lpString="*.gzip") returned 6 [0056.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0056.109] lstrlenA (lpString="*.jpg") returned 5 [0056.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0056.109] lstrlenA (lpString="*.jpeg") returned 6 [0056.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0056.109] lstrlenA (lpString="*.psd") returned 5 [0056.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0056.109] lstrlenA (lpString="*.gif") returned 5 [0056.109] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" [0056.109] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" [0056.109] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF." [0056.109] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.wannacry" [0056.109] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.111] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0056.111] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc9fbf300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd6a52b0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc9fbf300, dwHighDateTime=0x1c747ea)) returned 1 [0056.111] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.111] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd7, lpOverlapped=0x0) returned 1 [0056.112] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0056.112] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.112] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd7, lpOverlapped=0x0) returned 1 [0056.112] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.112] CloseHandle (hObject=0x98) returned 1 [0056.112] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_off.gif.wannacry")) returned 1 [0056.113] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0056.113] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.113] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0056.113] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0056.113] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0056.113] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0056.113] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\" [0056.113] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\") returned="" [0056.113] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" [0056.113] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\how to decrypt files.txt")) returned 0x20 [0056.114] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF" [0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0056.114] lstrlenA (lpString="*.zip") returned 5 [0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0056.114] lstrlenA (lpString="*.rar") returned 5 [0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0056.114] lstrlenA (lpString="*.7z") returned 4 [0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0056.114] lstrlenA (lpString="*.tar") returned 5 [0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0056.114] lstrlenA (lpString="*.gzip") returned 6 [0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0056.114] lstrlenA (lpString="*.jpg") returned 5 [0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0056.114] lstrlenA (lpString="*.jpeg") returned 6 [0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0056.114] lstrlenA (lpString="*.psd") returned 5 [0056.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0056.114] lstrlenA (lpString="*.gif") returned 5 [0056.114] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF" [0056.114] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF" [0056.114] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF." [0056.114] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF.wannacry" [0056.114] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.115] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0056.115] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc9fbf300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd6cb410, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc9fbf300, dwHighDateTime=0x1c747ea)) returned 1 [0056.115] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.115] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60, lpOverlapped=0x0) returned 1 [0056.116] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="TAB_ON.GIF" [0056.116] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.116] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60, lpOverlapped=0x0) returned 1 [0056.116] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.116] CloseHandle (hObject=0x98) returned 1 [0056.117] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_on.gif.wannacry")) returned 1 [0056.117] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0056.117] FindClose (in: hFindFile=0x2d80a8 | out: hFindFile=0x2d80a8) returned 1 [0056.117] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xcb0, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="BabyBlue.css", cAlternateFileName="")) returned 1 [0056.117] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0056.117] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BabyBlue.css") returned 1 [0056.117] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BabyBlue.css") returned 1 [0056.118] lstrcmpiA (lpString1="", lpString2="BabyBlue.css") returned -1 [0056.118] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*.*") returned="*.*" [0056.118] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0056.118] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0056.118] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0056.118] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0056.118] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="BabyBlue.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css" [0056.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.zip") returned 0 [0056.118] lstrlenA (lpString="*.zip") returned 5 [0056.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.rar") returned 0 [0056.118] lstrlenA (lpString="*.rar") returned 5 [0056.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.7z") returned 0 [0056.118] lstrlenA (lpString="*.7z") returned 4 [0056.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.tar") returned 0 [0056.118] lstrlenA (lpString="*.tar") returned 5 [0056.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.gzip") returned 0 [0056.118] lstrlenA (lpString="*.gzip") returned 6 [0056.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.jpg") returned 0 [0056.118] lstrlenA (lpString="*.jpg") returned 5 [0056.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.jpeg") returned 0 [0056.118] lstrlenA (lpString="*.jpeg") returned 6 [0056.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.psd") returned 0 [0056.118] lstrlenA (lpString="*.psd") returned 5 [0056.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.gif") returned 0 [0056.119] lstrlenA (lpString="*.gif") returned 5 [0056.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.doc") returned 0 [0056.119] lstrlenA (lpString="*.doc") returned 5 [0056.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.docx") returned 0 [0056.119] lstrlenA (lpString="*.docx") returned 6 [0056.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.xls") returned 0 [0056.119] lstrlenA (lpString="*.xls") returned 5 [0056.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.xlsx") returned 0 [0056.119] lstrlenA (lpString="*.xlsx") returned 6 [0056.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.ppt") returned 0 [0056.119] lstrlenA (lpString="*.ppt") returned 5 [0056.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.pptx") returned 0 [0056.119] lstrlenA (lpString="*.pptx") returned 6 [0056.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.pdf") returned 0 [0056.119] lstrlenA (lpString="*.pdf") returned 5 [0056.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.mov") returned 0 [0056.119] lstrlenA (lpString="*.mov") returned 5 [0056.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.m2v") returned 0 [0056.119] lstrlenA (lpString="*.m2v") returned 5 [0056.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.3gp") returned 0 [0056.119] lstrlenA (lpString="*.3gp") returned 5 [0056.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.mpeg") returned 0 [0056.119] lstrlenA (lpString="*.mpeg") returned 6 [0056.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.mpg") returned 0 [0056.119] lstrlenA (lpString="*.mpg") returned 5 [0056.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.flv") returned 0 [0056.119] lstrlenA (lpString="*.flv") returned 5 [0056.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.avi") returned 0 [0056.119] lstrlenA (lpString="*.avi") returned 5 [0056.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.mp4") returned 0 [0056.120] lstrlenA (lpString="*.mp4") returned 5 [0056.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.wmv") returned 0 [0056.120] lstrlenA (lpString="*.wmv") returned 5 [0056.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.divx") returned 0 [0056.120] lstrlenA (lpString="*.divx") returned 6 [0056.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.mkv") returned 0 [0056.120] lstrlenA (lpString="*.mkv") returned 5 [0056.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.mp3") returned 0 [0056.120] lstrlenA (lpString="*.mp3") returned 5 [0056.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.wav") returned 0 [0056.120] lstrlenA (lpString="*.wav") returned 5 [0056.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.flac") returned 0 [0056.120] lstrlenA (lpString="*.flac") returned 6 [0056.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.ape") returned 0 [0056.120] lstrlenA (lpString="*.ape") returned 5 [0056.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.wma") returned 0 [0056.120] lstrlenA (lpString="*.wma") returned 5 [0056.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.ac3") returned 0 [0056.120] lstrlenA (lpString="*.ac3") returned 5 [0056.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", pszSpec="*.mxf") returned 0 [0056.120] lstrlenA (lpString="*.mxf") returned 5 [0056.120] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x71f, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Beige.css", cAlternateFileName="")) returned 1 [0056.120] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0056.120] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Beige.css") returned 1 [0056.120] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Beige.css") returned 1 [0056.120] lstrcmpiA (lpString1="", lpString2="Beige.css") returned -1 [0056.120] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css") returned="BabyBlue.css" [0056.121] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0056.121] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0056.121] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0056.121] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0056.121] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Beige.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css" [0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.zip") returned 0 [0056.121] lstrlenA (lpString="*.zip") returned 5 [0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.rar") returned 0 [0056.121] lstrlenA (lpString="*.rar") returned 5 [0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.7z") returned 0 [0056.121] lstrlenA (lpString="*.7z") returned 4 [0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.tar") returned 0 [0056.121] lstrlenA (lpString="*.tar") returned 5 [0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.gzip") returned 0 [0056.121] lstrlenA (lpString="*.gzip") returned 6 [0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.jpg") returned 0 [0056.121] lstrlenA (lpString="*.jpg") returned 5 [0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.jpeg") returned 0 [0056.121] lstrlenA (lpString="*.jpeg") returned 6 [0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.psd") returned 0 [0056.121] lstrlenA (lpString="*.psd") returned 5 [0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.gif") returned 0 [0056.121] lstrlenA (lpString="*.gif") returned 5 [0056.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.doc") returned 0 [0056.121] lstrlenA (lpString="*.doc") returned 5 [0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.docx") returned 0 [0056.122] lstrlenA (lpString="*.docx") returned 6 [0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.xls") returned 0 [0056.122] lstrlenA (lpString="*.xls") returned 5 [0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.xlsx") returned 0 [0056.122] lstrlenA (lpString="*.xlsx") returned 6 [0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.ppt") returned 0 [0056.122] lstrlenA (lpString="*.ppt") returned 5 [0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.pptx") returned 0 [0056.122] lstrlenA (lpString="*.pptx") returned 6 [0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.pdf") returned 0 [0056.122] lstrlenA (lpString="*.pdf") returned 5 [0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.mov") returned 0 [0056.122] lstrlenA (lpString="*.mov") returned 5 [0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.m2v") returned 0 [0056.122] lstrlenA (lpString="*.m2v") returned 5 [0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.3gp") returned 0 [0056.122] lstrlenA (lpString="*.3gp") returned 5 [0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.mpeg") returned 0 [0056.122] lstrlenA (lpString="*.mpeg") returned 6 [0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.mpg") returned 0 [0056.122] lstrlenA (lpString="*.mpg") returned 5 [0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.flv") returned 0 [0056.122] lstrlenA (lpString="*.flv") returned 5 [0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.avi") returned 0 [0056.122] lstrlenA (lpString="*.avi") returned 5 [0056.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.mp4") returned 0 [0056.122] lstrlenA (lpString="*.mp4") returned 5 [0056.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.wmv") returned 0 [0056.123] lstrlenA (lpString="*.wmv") returned 5 [0056.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.divx") returned 0 [0056.123] lstrlenA (lpString="*.divx") returned 6 [0056.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.mkv") returned 0 [0056.123] lstrlenA (lpString="*.mkv") returned 5 [0056.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.mp3") returned 0 [0056.123] lstrlenA (lpString="*.mp3") returned 5 [0056.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.wav") returned 0 [0056.123] lstrlenA (lpString="*.wav") returned 5 [0056.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.flac") returned 0 [0056.123] lstrlenA (lpString="*.flac") returned 6 [0056.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.ape") returned 0 [0056.123] lstrlenA (lpString="*.ape") returned 5 [0056.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.wma") returned 0 [0056.123] lstrlenA (lpString="*.wma") returned 5 [0056.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.ac3") returned 0 [0056.123] lstrlenA (lpString="*.ac3") returned 5 [0056.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", pszSpec="*.mxf") returned 0 [0056.124] lstrlenA (lpString="*.mxf") returned 5 [0056.124] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4dc230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Biscay", cAlternateFileName="")) returned 1 [0056.124] lstrcmpA (lpString1=".", lpString2="Biscay") returned -1 [0056.124] lstrcmpA (lpString1="..", lpString2="Biscay") returned -1 [0056.124] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css") returned="Beige.css" [0056.124] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Biscay" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay" [0056.124] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay") returned 79 [0056.124] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4dc230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2d8252, cFileName=".", cAlternateFileName="")) returned 0x2d80a8 [0056.124] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.124] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4dc230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0056.124] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.124] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.124] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0056.124] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.124] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0056.124] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0056.124] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0056.124] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\*.*") returned="*.*" [0056.125] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\" [0056.125] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\") returned="" [0056.125] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt" [0056.125] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\how to decrypt files.txt")) returned 0xffffffff [0056.125] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.125] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0056.125] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0056.127] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.127] CloseHandle (hObject=0x98) returned 1 [0056.127] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF" [0056.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0056.127] lstrlenA (lpString="*.zip") returned 5 [0056.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0056.127] lstrlenA (lpString="*.rar") returned 5 [0056.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0056.127] lstrlenA (lpString="*.7z") returned 4 [0056.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0056.127] lstrlenA (lpString="*.tar") returned 5 [0056.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0056.127] lstrlenA (lpString="*.gzip") returned 6 [0056.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0056.127] lstrlenA (lpString="*.jpg") returned 5 [0056.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0056.127] lstrlenA (lpString="*.jpeg") returned 6 [0056.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0056.128] lstrlenA (lpString="*.psd") returned 5 [0056.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0056.128] lstrlenA (lpString="*.gif") returned 5 [0056.128] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF" [0056.128] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF" [0056.128] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF." [0056.128] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF.wannacry" [0056.128] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.128] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0056.128] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc9fbf300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd4dc230, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc9fbf300, dwHighDateTime=0x1c747ea)) returned 1 [0056.128] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.128] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd7, lpOverlapped=0x0) returned 1 [0056.130] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0056.130] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.130] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd7, lpOverlapped=0x0) returned 1 [0056.130] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.130] CloseHandle (hObject=0x98) returned 1 [0056.130] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_off.gif.wannacry")) returned 1 [0056.131] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0056.131] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.131] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0056.131] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0056.131] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0056.131] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0056.131] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\" [0056.131] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\") returned="" [0056.131] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt" [0056.131] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\how to decrypt files.txt")) returned 0x20 [0056.131] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF" [0056.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0056.131] lstrlenA (lpString="*.zip") returned 5 [0056.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0056.131] lstrlenA (lpString="*.rar") returned 5 [0056.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0056.131] lstrlenA (lpString="*.7z") returned 4 [0056.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0056.131] lstrlenA (lpString="*.tar") returned 5 [0056.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0056.132] lstrlenA (lpString="*.gzip") returned 6 [0056.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0056.132] lstrlenA (lpString="*.jpg") returned 5 [0056.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0056.132] lstrlenA (lpString="*.jpeg") returned 6 [0056.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0056.132] lstrlenA (lpString="*.psd") returned 5 [0056.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0056.132] lstrlenA (lpString="*.gif") returned 5 [0056.132] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF" [0056.132] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF" [0056.132] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF." [0056.132] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF.wannacry" [0056.132] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.132] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0056.132] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc9fbf300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd4dc230, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc9fbf300, dwHighDateTime=0x1c747ea)) returned 1 [0056.133] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.133] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60, lpOverlapped=0x0) returned 1 [0056.134] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="TAB_ON.GIF" [0056.134] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.134] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60, lpOverlapped=0x0) returned 1 [0056.134] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.134] CloseHandle (hObject=0x98) returned 1 [0056.137] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_on.gif.wannacry")) returned 1 [0056.204] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0056.204] FindClose (in: hFindFile=0x2d80a8 | out: hFindFile=0x2d80a8) returned 1 [0056.205] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd80, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="Biscay.css", cAlternateFileName="")) returned 1 [0056.205] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0056.205] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Biscay.css") returned 1 [0056.205] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Biscay.css") returned 1 [0056.205] lstrcmpiA (lpString1="", lpString2="Biscay.css") returned -1 [0056.205] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*.*") returned="*.*" [0056.205] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0056.205] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0056.205] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0056.205] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0056.205] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Biscay.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css" [0056.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.zip") returned 0 [0056.205] lstrlenA (lpString="*.zip") returned 5 [0056.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.rar") returned 0 [0056.205] lstrlenA (lpString="*.rar") returned 5 [0056.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.7z") returned 0 [0056.205] lstrlenA (lpString="*.7z") returned 4 [0056.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.tar") returned 0 [0056.205] lstrlenA (lpString="*.tar") returned 5 [0056.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.gzip") returned 0 [0056.205] lstrlenA (lpString="*.gzip") returned 6 [0056.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.jpg") returned 0 [0056.206] lstrlenA (lpString="*.jpg") returned 5 [0056.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.jpeg") returned 0 [0056.206] lstrlenA (lpString="*.jpeg") returned 6 [0056.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.psd") returned 0 [0056.206] lstrlenA (lpString="*.psd") returned 5 [0056.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.gif") returned 0 [0056.206] lstrlenA (lpString="*.gif") returned 5 [0056.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.doc") returned 0 [0056.206] lstrlenA (lpString="*.doc") returned 5 [0056.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.docx") returned 0 [0056.206] lstrlenA (lpString="*.docx") returned 6 [0056.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.xls") returned 0 [0056.206] lstrlenA (lpString="*.xls") returned 5 [0056.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.xlsx") returned 0 [0056.206] lstrlenA (lpString="*.xlsx") returned 6 [0056.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.ppt") returned 0 [0056.206] lstrlenA (lpString="*.ppt") returned 5 [0056.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.pptx") returned 0 [0056.206] lstrlenA (lpString="*.pptx") returned 6 [0056.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.pdf") returned 0 [0056.206] lstrlenA (lpString="*.pdf") returned 5 [0056.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.mov") returned 0 [0056.206] lstrlenA (lpString="*.mov") returned 5 [0056.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.m2v") returned 0 [0056.206] lstrlenA (lpString="*.m2v") returned 5 [0056.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.3gp") returned 0 [0056.207] lstrlenA (lpString="*.3gp") returned 5 [0056.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.mpeg") returned 0 [0056.207] lstrlenA (lpString="*.mpeg") returned 6 [0056.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.mpg") returned 0 [0056.207] lstrlenA (lpString="*.mpg") returned 5 [0056.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.flv") returned 0 [0056.207] lstrlenA (lpString="*.flv") returned 5 [0056.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.avi") returned 0 [0056.207] lstrlenA (lpString="*.avi") returned 5 [0056.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.mp4") returned 0 [0056.207] lstrlenA (lpString="*.mp4") returned 5 [0056.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.wmv") returned 0 [0056.207] lstrlenA (lpString="*.wmv") returned 5 [0056.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.divx") returned 0 [0056.207] lstrlenA (lpString="*.divx") returned 6 [0056.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.mkv") returned 0 [0056.207] lstrlenA (lpString="*.mkv") returned 5 [0056.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.mp3") returned 0 [0056.207] lstrlenA (lpString="*.mp3") returned 5 [0056.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.wav") returned 0 [0056.207] lstrlenA (lpString="*.wav") returned 5 [0056.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.flac") returned 0 [0056.207] lstrlenA (lpString="*.flac") returned 6 [0056.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.ape") returned 0 [0056.207] lstrlenA (lpString="*.ape") returned 5 [0056.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.wma") returned 0 [0056.207] lstrlenA (lpString="*.wma") returned 5 [0056.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.ac3") returned 0 [0056.208] lstrlenA (lpString="*.ac3") returned 5 [0056.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", pszSpec="*.mxf") returned 0 [0056.208] lstrlenA (lpString="*.mxf") returned 5 [0056.208] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4dc230, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd502390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="BrightOrange", cAlternateFileName="BRIGHT~1")) returned 1 [0056.208] lstrcmpA (lpString1=".", lpString2="BrightOrange") returned -1 [0056.208] lstrcmpA (lpString1="..", lpString2="BrightOrange") returned -1 [0056.208] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css") returned="Biscay.css" [0056.208] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="BrightOrange" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange" [0056.208] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange") returned 85 [0056.208] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4dc230, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd502390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2d8252, cFileName=".", cAlternateFileName="")) returned 0x2d80a8 [0056.209] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.209] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4dc230, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd502390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0056.209] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.209] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.209] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x143, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0056.209] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.209] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="background.gif") returned 1 [0056.209] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1 [0056.210] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1 [0056.210] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\*.*") returned="*.*" [0056.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\" [0056.210] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\") returned="" [0056.210] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" [0056.210] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\how to decrypt files.txt")) returned 0xffffffff [0056.210] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.212] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0056.212] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0056.213] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.213] CloseHandle (hObject=0x98) returned 1 [0056.213] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif" [0056.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.zip") returned 0 [0056.214] lstrlenA (lpString="*.zip") returned 5 [0056.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.rar") returned 0 [0056.214] lstrlenA (lpString="*.rar") returned 5 [0056.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.7z") returned 0 [0056.214] lstrlenA (lpString="*.7z") returned 4 [0056.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.tar") returned 0 [0056.214] lstrlenA (lpString="*.tar") returned 5 [0056.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.gzip") returned 0 [0056.214] lstrlenA (lpString="*.gzip") returned 6 [0056.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.jpg") returned 0 [0056.214] lstrlenA (lpString="*.jpg") returned 5 [0056.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.jpeg") returned 0 [0056.214] lstrlenA (lpString="*.jpeg") returned 6 [0056.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.psd") returned 0 [0056.214] lstrlenA (lpString="*.psd") returned 5 [0056.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.gif") returned 1 [0056.214] lstrlenA (lpString="*.gif") returned 5 [0056.214] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif" [0056.214] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif" [0056.214] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif." [0056.214] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif.wannacry" [0056.214] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.215] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x143 [0056.215] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc9fbf300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd4dc230, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc9fbf300, dwHighDateTime=0x1c747ea)) returned 1 [0056.215] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.215] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xc5, lpOverlapped=0x0) returned 1 [0056.216] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif") returned="background.gif" [0056.216] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.216] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xc5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xc5, lpOverlapped=0x0) returned 1 [0056.217] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.217] CloseHandle (hObject=0x98) returned 1 [0056.217] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\background.gif.wannacry")) returned 1 [0056.218] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0056.218] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.218] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BUTTON.GIF") returned 1 [0056.218] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BUTTON.GIF") returned 1 [0056.218] lstrcmpiA (lpString1="", lpString2="BUTTON.GIF") returned -1 [0056.218] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif") returned="background.gif" [0056.218] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\" [0056.218] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\") returned="" [0056.218] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" [0056.218] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\how to decrypt files.txt")) returned 0x20 [0056.218] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\", lpString2="BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF" [0056.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.zip") returned 0 [0056.218] lstrlenA (lpString="*.zip") returned 5 [0056.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.rar") returned 0 [0056.218] lstrlenA (lpString="*.rar") returned 5 [0056.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.7z") returned 0 [0056.218] lstrlenA (lpString="*.7z") returned 4 [0056.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.tar") returned 0 [0056.218] lstrlenA (lpString="*.tar") returned 5 [0056.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.gzip") returned 0 [0056.219] lstrlenA (lpString="*.gzip") returned 6 [0056.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.jpg") returned 0 [0056.219] lstrlenA (lpString="*.jpg") returned 5 [0056.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.jpeg") returned 0 [0056.219] lstrlenA (lpString="*.jpeg") returned 6 [0056.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.psd") returned 0 [0056.219] lstrlenA (lpString="*.psd") returned 5 [0056.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.gif") returned 1 [0056.219] lstrlenA (lpString="*.gif") returned 5 [0056.219] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF" [0056.219] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF" [0056.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF." [0056.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF.wannacry" [0056.219] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.220] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9 [0056.220] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc9fbf300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd502390, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc9fbf300, dwHighDateTime=0x1c747ea)) returned 1 [0056.220] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.220] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3b, lpOverlapped=0x0) returned 1 [0056.221] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF") returned="BUTTON.GIF" [0056.221] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.221] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3b, lpOverlapped=0x0) returned 1 [0056.221] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.221] CloseHandle (hObject=0x98) returned 1 [0056.221] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\button.gif.wannacry")) returned 1 [0056.222] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0056.222] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.222] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0056.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0056.222] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0056.222] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF") returned="BUTTON.GIF" [0056.222] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\" [0056.223] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\") returned="" [0056.223] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" [0056.223] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\how to decrypt files.txt")) returned 0x20 [0056.223] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" [0056.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0056.223] lstrlenA (lpString="*.zip") returned 5 [0056.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0056.223] lstrlenA (lpString="*.rar") returned 5 [0056.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0056.223] lstrlenA (lpString="*.7z") returned 4 [0056.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0056.223] lstrlenA (lpString="*.tar") returned 5 [0056.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0056.223] lstrlenA (lpString="*.gzip") returned 6 [0056.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0056.223] lstrlenA (lpString="*.jpg") returned 5 [0056.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0056.223] lstrlenA (lpString="*.jpeg") returned 6 [0056.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0056.223] lstrlenA (lpString="*.psd") returned 5 [0056.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0056.223] lstrlenA (lpString="*.gif") returned 5 [0056.223] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" [0056.224] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" [0056.224] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF." [0056.224] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.wannacry" [0056.224] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.224] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0056.224] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc9fbf300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd502390, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc9fbf300, dwHighDateTime=0x1c747ea)) returned 1 [0056.224] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.224] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd7, lpOverlapped=0x0) returned 1 [0056.225] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0056.225] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.225] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd7, lpOverlapped=0x0) returned 1 [0056.226] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.226] CloseHandle (hObject=0x98) returned 1 [0056.226] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_off.gif.wannacry")) returned 1 [0056.226] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0056.226] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.226] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0056.226] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0056.227] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0056.227] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0056.227] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\" [0056.227] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\") returned="" [0056.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" [0056.227] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\how to decrypt files.txt")) returned 0x20 [0056.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF" [0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0056.227] lstrlenA (lpString="*.zip") returned 5 [0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0056.227] lstrlenA (lpString="*.rar") returned 5 [0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0056.227] lstrlenA (lpString="*.7z") returned 4 [0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0056.227] lstrlenA (lpString="*.tar") returned 5 [0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0056.227] lstrlenA (lpString="*.gzip") returned 6 [0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0056.227] lstrlenA (lpString="*.jpg") returned 5 [0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0056.227] lstrlenA (lpString="*.jpeg") returned 6 [0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0056.227] lstrlenA (lpString="*.psd") returned 5 [0056.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0056.228] lstrlenA (lpString="*.gif") returned 5 [0056.228] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF" [0056.228] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF" [0056.228] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF." [0056.228] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF.wannacry" [0056.228] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.232] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0056.232] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc9fbf300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd502390, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc9fbf300, dwHighDateTime=0x1c747ea)) returned 1 [0056.232] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.232] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60, lpOverlapped=0x0) returned 1 [0056.233] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF") returned="TAB_ON.GIF" [0056.234] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.234] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60, lpOverlapped=0x0) returned 1 [0056.234] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.234] CloseHandle (hObject=0x98) returned 1 [0056.234] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_on.gif.wannacry")) returned 1 [0056.235] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0056.235] FindClose (in: hFindFile=0x2d80a8 | out: hFindFile=0x2d80a8) returned 1 [0056.235] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc3c, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="BrightOrange.css", cAlternateFileName="BRIGHT~1.CSS")) returned 1 [0056.235] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0056.235] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BrightOrange.css") returned 1 [0056.235] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BrightOrange.css") returned 1 [0056.235] lstrcmpiA (lpString1="", lpString2="BrightOrange.css") returned -1 [0056.235] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*.*") returned="*.*" [0056.235] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0056.235] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0056.235] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0056.236] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0056.236] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="BrightOrange.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css" [0056.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.zip") returned 0 [0056.236] lstrlenA (lpString="*.zip") returned 5 [0056.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.rar") returned 0 [0056.236] lstrlenA (lpString="*.rar") returned 5 [0056.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.7z") returned 0 [0056.236] lstrlenA (lpString="*.7z") returned 4 [0056.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.tar") returned 0 [0056.236] lstrlenA (lpString="*.tar") returned 5 [0056.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.gzip") returned 0 [0056.236] lstrlenA (lpString="*.gzip") returned 6 [0056.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.jpg") returned 0 [0056.236] lstrlenA (lpString="*.jpg") returned 5 [0056.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.jpeg") returned 0 [0056.236] lstrlenA (lpString="*.jpeg") returned 6 [0056.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.psd") returned 0 [0056.236] lstrlenA (lpString="*.psd") returned 5 [0056.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.gif") returned 0 [0056.236] lstrlenA (lpString="*.gif") returned 5 [0056.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.doc") returned 0 [0056.236] lstrlenA (lpString="*.doc") returned 5 [0056.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.docx") returned 0 [0056.237] lstrlenA (lpString="*.docx") returned 6 [0056.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.xls") returned 0 [0056.237] lstrlenA (lpString="*.xls") returned 5 [0056.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.xlsx") returned 0 [0056.237] lstrlenA (lpString="*.xlsx") returned 6 [0056.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.ppt") returned 0 [0056.237] lstrlenA (lpString="*.ppt") returned 5 [0056.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.pptx") returned 0 [0056.237] lstrlenA (lpString="*.pptx") returned 6 [0056.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.pdf") returned 0 [0056.237] lstrlenA (lpString="*.pdf") returned 5 [0056.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.mov") returned 0 [0056.237] lstrlenA (lpString="*.mov") returned 5 [0056.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.m2v") returned 0 [0056.237] lstrlenA (lpString="*.m2v") returned 5 [0056.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.3gp") returned 0 [0056.237] lstrlenA (lpString="*.3gp") returned 5 [0056.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.mpeg") returned 0 [0056.237] lstrlenA (lpString="*.mpeg") returned 6 [0056.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.mpg") returned 0 [0056.237] lstrlenA (lpString="*.mpg") returned 5 [0056.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.flv") returned 0 [0056.237] lstrlenA (lpString="*.flv") returned 5 [0056.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.avi") returned 0 [0056.237] lstrlenA (lpString="*.avi") returned 5 [0056.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.mp4") returned 0 [0056.237] lstrlenA (lpString="*.mp4") returned 5 [0056.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.wmv") returned 0 [0056.238] lstrlenA (lpString="*.wmv") returned 5 [0056.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.divx") returned 0 [0056.238] lstrlenA (lpString="*.divx") returned 6 [0056.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.mkv") returned 0 [0056.238] lstrlenA (lpString="*.mkv") returned 5 [0056.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.mp3") returned 0 [0056.238] lstrlenA (lpString="*.mp3") returned 5 [0056.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.wav") returned 0 [0056.238] lstrlenA (lpString="*.wav") returned 5 [0056.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.flac") returned 0 [0056.238] lstrlenA (lpString="*.flac") returned 6 [0056.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.ape") returned 0 [0056.238] lstrlenA (lpString="*.ape") returned 5 [0056.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.wma") returned 0 [0056.238] lstrlenA (lpString="*.wma") returned 5 [0056.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.ac3") returned 0 [0056.238] lstrlenA (lpString="*.ac3") returned 5 [0056.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", pszSpec="*.mxf") returned 0 [0056.238] lstrlenA (lpString="*.mxf") returned 5 [0056.238] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd502390, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="BrightYellow", cAlternateFileName="BRIGHT~2")) returned 1 [0056.238] lstrcmpA (lpString1=".", lpString2="BrightYellow") returned -1 [0056.238] lstrcmpA (lpString1="..", lpString2="BrightYellow") returned -1 [0056.238] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css") returned="BrightOrange.css" [0056.238] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="BrightYellow" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow" [0056.238] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow") returned 85 [0056.239] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd502390, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2d8252, cFileName=".", cAlternateFileName="")) returned 0x2d80a8 [0056.239] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.239] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd502390, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0056.239] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.239] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.239] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16f, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0056.239] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.239] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HEADER.GIF") returned -1 [0056.239] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0056.239] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0056.239] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\*.*") returned="*.*" [0056.239] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\" [0056.239] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\") returned="" [0056.239] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt" [0056.239] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\how to decrypt files.txt")) returned 0xffffffff [0056.239] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.298] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0056.298] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0056.299] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.299] CloseHandle (hObject=0x98) returned 1 [0056.299] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF" [0056.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.zip") returned 0 [0056.300] lstrlenA (lpString="*.zip") returned 5 [0056.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.rar") returned 0 [0056.300] lstrlenA (lpString="*.rar") returned 5 [0056.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.7z") returned 0 [0056.300] lstrlenA (lpString="*.7z") returned 4 [0056.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.tar") returned 0 [0056.300] lstrlenA (lpString="*.tar") returned 5 [0056.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0056.300] lstrlenA (lpString="*.gzip") returned 6 [0056.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0056.300] lstrlenA (lpString="*.jpg") returned 5 [0056.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0056.300] lstrlenA (lpString="*.jpeg") returned 6 [0056.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.psd") returned 0 [0056.300] lstrlenA (lpString="*.psd") returned 5 [0056.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.gif") returned 1 [0056.300] lstrlenA (lpString="*.gif") returned 5 [0056.300] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF" [0056.300] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF" [0056.300] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF." [0056.300] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF.wannacry" [0056.300] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.301] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16f [0056.301] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc9fbf300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd502390, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc9fbf300, dwHighDateTime=0x1c747ea)) returned 1 [0056.301] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.301] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xf1, lpOverlapped=0x0) returned 1 [0056.303] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="HEADER.GIF" [0056.303] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.303] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xf1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xf1, lpOverlapped=0x0) returned 1 [0056.303] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.303] CloseHandle (hObject=0x98) returned 1 [0056.304] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\header.gif.wannacry")) returned 1 [0056.304] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0056.304] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.304] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0056.305] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0056.305] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0056.305] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="HEADER.GIF" [0056.305] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\" [0056.305] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\") returned="" [0056.305] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt" [0056.305] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\how to decrypt files.txt")) returned 0x20 [0056.305] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" [0056.305] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0056.305] lstrlenA (lpString="*.zip") returned 5 [0056.305] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0056.305] lstrlenA (lpString="*.rar") returned 5 [0056.305] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0056.305] lstrlenA (lpString="*.7z") returned 4 [0056.305] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0056.305] lstrlenA (lpString="*.tar") returned 5 [0056.305] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0056.305] lstrlenA (lpString="*.gzip") returned 6 [0056.305] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0056.305] lstrlenA (lpString="*.jpg") returned 5 [0056.305] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0056.305] lstrlenA (lpString="*.jpeg") returned 6 [0056.305] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0056.305] lstrlenA (lpString="*.psd") returned 5 [0056.305] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0056.305] lstrlenA (lpString="*.gif") returned 5 [0056.305] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" [0056.305] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" [0056.306] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF." [0056.306] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.wannacry" [0056.306] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.306] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0056.306] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcb2d2000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd5284f0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcb2d2000, dwHighDateTime=0x1c747ea)) returned 1 [0056.306] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.306] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd7, lpOverlapped=0x0) returned 1 [0056.307] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0056.307] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.307] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd7, lpOverlapped=0x0) returned 1 [0056.307] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.308] CloseHandle (hObject=0x98) returned 1 [0056.308] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_off.gif.wannacry")) returned 1 [0056.308] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0056.308] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.308] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0056.309] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0056.309] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0056.309] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0056.309] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\" [0056.309] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\") returned="" [0056.309] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt" [0056.309] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\how to decrypt files.txt")) returned 0x20 [0056.309] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF" [0056.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0056.309] lstrlenA (lpString="*.zip") returned 5 [0056.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0056.309] lstrlenA (lpString="*.rar") returned 5 [0056.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0056.309] lstrlenA (lpString="*.7z") returned 4 [0056.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0056.309] lstrlenA (lpString="*.tar") returned 5 [0056.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0056.309] lstrlenA (lpString="*.gzip") returned 6 [0056.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0056.309] lstrlenA (lpString="*.jpg") returned 5 [0056.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0056.309] lstrlenA (lpString="*.jpeg") returned 6 [0056.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0056.310] lstrlenA (lpString="*.psd") returned 5 [0056.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0056.310] lstrlenA (lpString="*.gif") returned 5 [0056.310] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF" [0056.310] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF" [0056.310] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF." [0056.310] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF.wannacry" [0056.310] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.407] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0056.550] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcb2d2000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd5284f0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcb2d2000, dwHighDateTime=0x1c747ea)) returned 1 [0056.550] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.550] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60, lpOverlapped=0x0) returned 1 [0056.558] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned="TAB_ON.GIF" [0056.558] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.558] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60, lpOverlapped=0x0) returned 1 [0056.558] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.558] CloseHandle (hObject=0x98) returned 1 [0056.558] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_on.gif.wannacry")) returned 1 [0056.559] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0056.559] FindClose (in: hFindFile=0x2d80a8 | out: hFindFile=0x2d80a8) returned 1 [0056.559] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd03, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="BrightYellow.css", cAlternateFileName="BRIGHT~2.CSS")) returned 1 [0056.559] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0056.559] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BrightYellow.css") returned 1 [0056.559] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BrightYellow.css") returned 1 [0056.559] lstrcmpiA (lpString1="", lpString2="BrightYellow.css") returned -1 [0056.559] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*.*") returned="*.*" [0056.559] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0056.559] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0056.559] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0056.559] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0056.560] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="BrightYellow.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css" [0056.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.zip") returned 0 [0056.560] lstrlenA (lpString="*.zip") returned 5 [0056.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.rar") returned 0 [0056.560] lstrlenA (lpString="*.rar") returned 5 [0056.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.7z") returned 0 [0056.560] lstrlenA (lpString="*.7z") returned 4 [0056.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.tar") returned 0 [0056.560] lstrlenA (lpString="*.tar") returned 5 [0056.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.gzip") returned 0 [0056.560] lstrlenA (lpString="*.gzip") returned 6 [0056.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.jpg") returned 0 [0056.560] lstrlenA (lpString="*.jpg") returned 5 [0056.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.jpeg") returned 0 [0056.560] lstrlenA (lpString="*.jpeg") returned 6 [0056.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.psd") returned 0 [0056.560] lstrlenA (lpString="*.psd") returned 5 [0056.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.gif") returned 0 [0056.560] lstrlenA (lpString="*.gif") returned 5 [0056.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.doc") returned 0 [0056.560] lstrlenA (lpString="*.doc") returned 5 [0056.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.docx") returned 0 [0056.560] lstrlenA (lpString="*.docx") returned 6 [0056.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.xls") returned 0 [0056.560] lstrlenA (lpString="*.xls") returned 5 [0056.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.xlsx") returned 0 [0056.560] lstrlenA (lpString="*.xlsx") returned 6 [0056.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.ppt") returned 0 [0056.561] lstrlenA (lpString="*.ppt") returned 5 [0056.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.pptx") returned 0 [0056.561] lstrlenA (lpString="*.pptx") returned 6 [0056.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.pdf") returned 0 [0056.561] lstrlenA (lpString="*.pdf") returned 5 [0056.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.mov") returned 0 [0056.561] lstrlenA (lpString="*.mov") returned 5 [0056.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.m2v") returned 0 [0056.561] lstrlenA (lpString="*.m2v") returned 5 [0056.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.3gp") returned 0 [0056.561] lstrlenA (lpString="*.3gp") returned 5 [0056.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.mpeg") returned 0 [0056.561] lstrlenA (lpString="*.mpeg") returned 6 [0056.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.mpg") returned 0 [0056.561] lstrlenA (lpString="*.mpg") returned 5 [0056.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.flv") returned 0 [0056.561] lstrlenA (lpString="*.flv") returned 5 [0056.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.avi") returned 0 [0056.561] lstrlenA (lpString="*.avi") returned 5 [0056.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.mp4") returned 0 [0056.561] lstrlenA (lpString="*.mp4") returned 5 [0056.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.wmv") returned 0 [0056.561] lstrlenA (lpString="*.wmv") returned 5 [0056.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.divx") returned 0 [0056.561] lstrlenA (lpString="*.divx") returned 6 [0056.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.mkv") returned 0 [0056.561] lstrlenA (lpString="*.mkv") returned 5 [0056.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.mp3") returned 0 [0056.561] lstrlenA (lpString="*.mp3") returned 5 [0056.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.wav") returned 0 [0056.561] lstrlenA (lpString="*.wav") returned 5 [0056.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.flac") returned 0 [0056.561] lstrlenA (lpString="*.flac") returned 6 [0056.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.ape") returned 0 [0056.561] lstrlenA (lpString="*.ape") returned 5 [0056.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.wma") returned 0 [0056.562] lstrlenA (lpString="*.wma") returned 5 [0056.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.ac3") returned 0 [0056.562] lstrlenA (lpString="*.ac3") returned 5 [0056.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", pszSpec="*.mxf") returned 0 [0056.562] lstrlenA (lpString="*.mxf") returned 5 [0056.562] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x766, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Casual.css", cAlternateFileName="")) returned 1 [0056.562] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0056.562] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Casual.css") returned 1 [0056.562] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Casual.css") returned 1 [0056.562] lstrcmpiA (lpString1="", lpString2="Casual.css") returned -1 [0056.562] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css") returned="BrightYellow.css" [0056.562] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0056.562] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0056.562] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0056.562] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0056.562] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Casual.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css" [0056.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.zip") returned 0 [0056.562] lstrlenA (lpString="*.zip") returned 5 [0056.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.rar") returned 0 [0056.562] lstrlenA (lpString="*.rar") returned 5 [0056.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.7z") returned 0 [0056.562] lstrlenA (lpString="*.7z") returned 4 [0056.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.tar") returned 0 [0056.562] lstrlenA (lpString="*.tar") returned 5 [0056.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.gzip") returned 0 [0056.562] lstrlenA (lpString="*.gzip") returned 6 [0056.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.jpg") returned 0 [0056.562] lstrlenA (lpString="*.jpg") returned 5 [0056.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.jpeg") returned 0 [0056.562] lstrlenA (lpString="*.jpeg") returned 6 [0056.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.psd") returned 0 [0056.562] lstrlenA (lpString="*.psd") returned 5 [0056.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.gif") returned 0 [0056.563] lstrlenA (lpString="*.gif") returned 5 [0056.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.doc") returned 0 [0056.563] lstrlenA (lpString="*.doc") returned 5 [0056.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.docx") returned 0 [0056.563] lstrlenA (lpString="*.docx") returned 6 [0056.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.xls") returned 0 [0056.563] lstrlenA (lpString="*.xls") returned 5 [0056.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.xlsx") returned 0 [0056.563] lstrlenA (lpString="*.xlsx") returned 6 [0056.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.ppt") returned 0 [0056.563] lstrlenA (lpString="*.ppt") returned 5 [0056.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.pptx") returned 0 [0056.563] lstrlenA (lpString="*.pptx") returned 6 [0056.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.pdf") returned 0 [0056.563] lstrlenA (lpString="*.pdf") returned 5 [0056.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.mov") returned 0 [0056.563] lstrlenA (lpString="*.mov") returned 5 [0056.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.m2v") returned 0 [0056.563] lstrlenA (lpString="*.m2v") returned 5 [0056.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.3gp") returned 0 [0056.563] lstrlenA (lpString="*.3gp") returned 5 [0056.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.mpeg") returned 0 [0056.563] lstrlenA (lpString="*.mpeg") returned 6 [0056.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.mpg") returned 0 [0056.563] lstrlenA (lpString="*.mpg") returned 5 [0056.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.flv") returned 0 [0056.563] lstrlenA (lpString="*.flv") returned 5 [0056.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.avi") returned 0 [0056.563] lstrlenA (lpString="*.avi") returned 5 [0056.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.mp4") returned 0 [0056.563] lstrlenA (lpString="*.mp4") returned 5 [0056.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.wmv") returned 0 [0056.563] lstrlenA (lpString="*.wmv") returned 5 [0056.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.divx") returned 0 [0056.563] lstrlenA (lpString="*.divx") returned 6 [0056.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.mkv") returned 0 [0056.564] lstrlenA (lpString="*.mkv") returned 5 [0056.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.mp3") returned 0 [0056.564] lstrlenA (lpString="*.mp3") returned 5 [0056.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.wav") returned 0 [0056.564] lstrlenA (lpString="*.wav") returned 5 [0056.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.flac") returned 0 [0056.564] lstrlenA (lpString="*.flac") returned 6 [0056.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.ape") returned 0 [0056.564] lstrlenA (lpString="*.ape") returned 5 [0056.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.wma") returned 0 [0056.564] lstrlenA (lpString="*.wma") returned 5 [0056.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.ac3") returned 0 [0056.564] lstrlenA (lpString="*.ac3") returned 5 [0056.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", pszSpec="*.mxf") returned 0 [0056.564] lstrlenA (lpString="*.mxf") returned 5 [0056.564] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Desert", cAlternateFileName="")) returned 1 [0056.564] lstrcmpA (lpString1=".", lpString2="Desert") returned -1 [0056.564] lstrcmpA (lpString1="..", lpString2="Desert") returned -1 [0056.564] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css") returned="Casual.css" [0056.564] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Desert" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert" [0056.564] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert") returned 79 [0056.564] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2d8252, cFileName=".", cAlternateFileName="")) returned 0x2d80a8 [0056.564] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.564] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0056.565] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.565] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.565] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0056.565] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.565] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HEADER.GIF") returned -1 [0056.565] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0056.565] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0056.565] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\*.*") returned="*.*" [0056.565] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\" [0056.565] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\") returned="" [0056.565] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt" [0056.565] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\how to decrypt files.txt")) returned 0xffffffff [0056.565] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.565] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0056.565] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0056.566] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.566] CloseHandle (hObject=0x98) returned 1 [0056.567] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF" [0056.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.zip") returned 0 [0056.567] lstrlenA (lpString="*.zip") returned 5 [0056.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.rar") returned 0 [0056.567] lstrlenA (lpString="*.rar") returned 5 [0056.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.7z") returned 0 [0056.567] lstrlenA (lpString="*.7z") returned 4 [0056.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.tar") returned 0 [0056.567] lstrlenA (lpString="*.tar") returned 5 [0056.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0056.567] lstrlenA (lpString="*.gzip") returned 6 [0056.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0056.567] lstrlenA (lpString="*.jpg") returned 5 [0056.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0056.567] lstrlenA (lpString="*.jpeg") returned 6 [0056.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.psd") returned 0 [0056.567] lstrlenA (lpString="*.psd") returned 5 [0056.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.gif") returned 1 [0056.567] lstrlenA (lpString="*.gif") returned 5 [0056.567] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF" [0056.567] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF" [0056.567] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF." [0056.567] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF.wannacry" [0056.567] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.568] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x94 [0056.568] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcb2d2000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd5284f0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcb2d2000, dwHighDateTime=0x1c747ea)) returned 1 [0056.568] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.568] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x16, lpOverlapped=0x0) returned 1 [0056.569] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF") returned="HEADER.GIF" [0056.569] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.569] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x16, lpOverlapped=0x0) returned 1 [0056.569] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.569] CloseHandle (hObject=0x98) returned 1 [0056.569] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\header.gif.wannacry")) returned 1 [0056.588] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1f0, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0056.588] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.588] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0056.588] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0056.588] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0056.588] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF") returned="HEADER.GIF" [0056.588] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\" [0056.588] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\") returned="" [0056.588] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt" [0056.588] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\how to decrypt files.txt")) returned 0x20 [0056.588] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF" [0056.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0056.588] lstrlenA (lpString="*.zip") returned 5 [0056.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0056.588] lstrlenA (lpString="*.rar") returned 5 [0056.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0056.588] lstrlenA (lpString="*.7z") returned 4 [0056.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0056.588] lstrlenA (lpString="*.tar") returned 5 [0056.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0056.588] lstrlenA (lpString="*.gzip") returned 6 [0056.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0056.588] lstrlenA (lpString="*.jpg") returned 5 [0056.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0056.589] lstrlenA (lpString="*.jpeg") returned 6 [0056.589] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0056.589] lstrlenA (lpString="*.psd") returned 5 [0056.589] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0056.589] lstrlenA (lpString="*.gif") returned 5 [0056.589] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF" [0056.589] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF" [0056.589] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF." [0056.589] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF.wannacry" [0056.589] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.589] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f0 [0056.589] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcb2d2000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd5284f0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcb2d2000, dwHighDateTime=0x1c747ea)) returned 1 [0056.590] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.590] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x172, lpOverlapped=0x0) returned 1 [0056.590] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0056.590] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.591] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x172, lpOverlapped=0x0) returned 1 [0056.591] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.591] CloseHandle (hObject=0x98) returned 1 [0056.591] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_off.gif.wannacry")) returned 1 [0056.591] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0056.592] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.592] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0056.592] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0056.592] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0056.592] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0056.592] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\" [0056.592] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\") returned="" [0056.592] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt" [0056.592] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\how to decrypt files.txt")) returned 0x20 [0056.592] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF" [0056.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0056.592] lstrlenA (lpString="*.zip") returned 5 [0056.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0056.592] lstrlenA (lpString="*.rar") returned 5 [0056.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0056.592] lstrlenA (lpString="*.7z") returned 4 [0056.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0056.592] lstrlenA (lpString="*.tar") returned 5 [0056.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0056.592] lstrlenA (lpString="*.gzip") returned 6 [0056.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0056.592] lstrlenA (lpString="*.jpg") returned 5 [0056.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0056.592] lstrlenA (lpString="*.jpeg") returned 6 [0056.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0056.592] lstrlenA (lpString="*.psd") returned 5 [0056.592] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0056.592] lstrlenA (lpString="*.gif") returned 5 [0056.592] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF" [0056.592] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF" [0056.593] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF." [0056.593] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF.wannacry" [0056.593] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.594] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x401 [0056.594] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcb2d2000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd5284f0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcb2d2000, dwHighDateTime=0x1c747ea)) returned 1 [0056.594] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.594] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x383, lpOverlapped=0x0) returned 1 [0056.625] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF") returned="TAB_ON.GIF" [0056.625] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.625] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x383, lpOverlapped=0x0) returned 1 [0056.625] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.625] CloseHandle (hObject=0x98) returned 1 [0056.625] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_on.gif.wannacry")) returned 1 [0056.626] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0056.626] FindClose (in: hFindFile=0x2d80a8 | out: hFindFile=0x2d80a8) returned 1 [0056.626] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb0e, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="Desert.css", cAlternateFileName="")) returned 1 [0056.626] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0056.626] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Desert.css") returned 1 [0056.626] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Desert.css") returned 1 [0056.626] lstrcmpiA (lpString1="", lpString2="Desert.css") returned -1 [0056.626] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*.*") returned="*.*" [0056.626] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0056.626] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0056.626] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0056.626] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0056.626] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Desert.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css" [0056.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.zip") returned 0 [0056.626] lstrlenA (lpString="*.zip") returned 5 [0056.626] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.rar") returned 0 [0056.626] lstrlenA (lpString="*.rar") returned 5 [0056.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.7z") returned 0 [0056.627] lstrlenA (lpString="*.7z") returned 4 [0056.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.tar") returned 0 [0056.627] lstrlenA (lpString="*.tar") returned 5 [0056.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.gzip") returned 0 [0056.627] lstrlenA (lpString="*.gzip") returned 6 [0056.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.jpg") returned 0 [0056.627] lstrlenA (lpString="*.jpg") returned 5 [0056.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.jpeg") returned 0 [0056.627] lstrlenA (lpString="*.jpeg") returned 6 [0056.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.psd") returned 0 [0056.627] lstrlenA (lpString="*.psd") returned 5 [0056.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.gif") returned 0 [0056.627] lstrlenA (lpString="*.gif") returned 5 [0056.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.doc") returned 0 [0056.627] lstrlenA (lpString="*.doc") returned 5 [0056.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.docx") returned 0 [0056.627] lstrlenA (lpString="*.docx") returned 6 [0056.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.xls") returned 0 [0056.627] lstrlenA (lpString="*.xls") returned 5 [0056.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.xlsx") returned 0 [0056.627] lstrlenA (lpString="*.xlsx") returned 6 [0056.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.ppt") returned 0 [0056.627] lstrlenA (lpString="*.ppt") returned 5 [0056.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.pptx") returned 0 [0056.627] lstrlenA (lpString="*.pptx") returned 6 [0056.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.pdf") returned 0 [0056.627] lstrlenA (lpString="*.pdf") returned 5 [0056.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.mov") returned 0 [0056.627] lstrlenA (lpString="*.mov") returned 5 [0056.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.m2v") returned 0 [0056.627] lstrlenA (lpString="*.m2v") returned 5 [0056.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.3gp") returned 0 [0056.627] lstrlenA (lpString="*.3gp") returned 5 [0056.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.mpeg") returned 0 [0056.628] lstrlenA (lpString="*.mpeg") returned 6 [0056.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.mpg") returned 0 [0056.628] lstrlenA (lpString="*.mpg") returned 5 [0056.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.flv") returned 0 [0056.628] lstrlenA (lpString="*.flv") returned 5 [0056.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.avi") returned 0 [0056.628] lstrlenA (lpString="*.avi") returned 5 [0056.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.mp4") returned 0 [0056.628] lstrlenA (lpString="*.mp4") returned 5 [0056.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.wmv") returned 0 [0056.628] lstrlenA (lpString="*.wmv") returned 5 [0056.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.divx") returned 0 [0056.628] lstrlenA (lpString="*.divx") returned 6 [0056.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.mkv") returned 0 [0056.628] lstrlenA (lpString="*.mkv") returned 5 [0056.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.mp3") returned 0 [0056.628] lstrlenA (lpString="*.mp3") returned 5 [0056.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.wav") returned 0 [0056.628] lstrlenA (lpString="*.wav") returned 5 [0056.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.flac") returned 0 [0056.628] lstrlenA (lpString="*.flac") returned 6 [0056.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.ape") returned 0 [0056.628] lstrlenA (lpString="*.ape") returned 5 [0056.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.wma") returned 0 [0056.628] lstrlenA (lpString="*.wma") returned 5 [0056.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.ac3") returned 0 [0056.628] lstrlenA (lpString="*.ac3") returned 5 [0056.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", pszSpec="*.mxf") returned 0 [0056.628] lstrlenA (lpString="*.mxf") returned 5 [0056.628] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x173, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Discussion.css", cAlternateFileName="DISCUS~1.CSS")) returned 1 [0056.628] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0056.628] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Discussion.css") returned 1 [0056.628] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Discussion.css") returned 1 [0056.629] lstrcmpiA (lpString1="", lpString2="Discussion.css") returned -1 [0056.629] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css") returned="Desert.css" [0056.629] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0056.629] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0056.629] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0056.629] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0056.629] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Discussion.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css" [0056.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.zip") returned 0 [0056.629] lstrlenA (lpString="*.zip") returned 5 [0056.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.rar") returned 0 [0056.629] lstrlenA (lpString="*.rar") returned 5 [0056.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.7z") returned 0 [0056.629] lstrlenA (lpString="*.7z") returned 4 [0056.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.tar") returned 0 [0056.629] lstrlenA (lpString="*.tar") returned 5 [0056.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.gzip") returned 0 [0056.629] lstrlenA (lpString="*.gzip") returned 6 [0056.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.jpg") returned 0 [0056.629] lstrlenA (lpString="*.jpg") returned 5 [0056.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.jpeg") returned 0 [0056.629] lstrlenA (lpString="*.jpeg") returned 6 [0056.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.psd") returned 0 [0056.629] lstrlenA (lpString="*.psd") returned 5 [0056.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.gif") returned 0 [0056.629] lstrlenA (lpString="*.gif") returned 5 [0056.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.doc") returned 0 [0056.629] lstrlenA (lpString="*.doc") returned 5 [0056.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.docx") returned 0 [0056.629] lstrlenA (lpString="*.docx") returned 6 [0056.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.xls") returned 0 [0056.630] lstrlenA (lpString="*.xls") returned 5 [0056.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.xlsx") returned 0 [0056.630] lstrlenA (lpString="*.xlsx") returned 6 [0056.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.ppt") returned 0 [0056.630] lstrlenA (lpString="*.ppt") returned 5 [0056.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.pptx") returned 0 [0056.630] lstrlenA (lpString="*.pptx") returned 6 [0056.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.pdf") returned 0 [0056.630] lstrlenA (lpString="*.pdf") returned 5 [0056.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.mov") returned 0 [0056.630] lstrlenA (lpString="*.mov") returned 5 [0056.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.m2v") returned 0 [0056.630] lstrlenA (lpString="*.m2v") returned 5 [0056.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.3gp") returned 0 [0056.630] lstrlenA (lpString="*.3gp") returned 5 [0056.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.mpeg") returned 0 [0056.630] lstrlenA (lpString="*.mpeg") returned 6 [0056.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.mpg") returned 0 [0056.630] lstrlenA (lpString="*.mpg") returned 5 [0056.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.flv") returned 0 [0056.630] lstrlenA (lpString="*.flv") returned 5 [0056.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.avi") returned 0 [0056.630] lstrlenA (lpString="*.avi") returned 5 [0056.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.mp4") returned 0 [0056.630] lstrlenA (lpString="*.mp4") returned 5 [0056.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.wmv") returned 0 [0056.630] lstrlenA (lpString="*.wmv") returned 5 [0056.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.divx") returned 0 [0056.630] lstrlenA (lpString="*.divx") returned 6 [0056.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.mkv") returned 0 [0056.630] lstrlenA (lpString="*.mkv") returned 5 [0056.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.mp3") returned 0 [0056.630] lstrlenA (lpString="*.mp3") returned 5 [0056.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.wav") returned 0 [0056.631] lstrlenA (lpString="*.wav") returned 5 [0056.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.flac") returned 0 [0056.631] lstrlenA (lpString="*.flac") returned 6 [0056.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.ape") returned 0 [0056.631] lstrlenA (lpString="*.ape") returned 5 [0056.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.wma") returned 0 [0056.631] lstrlenA (lpString="*.wma") returned 5 [0056.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.ac3") returned 0 [0056.631] lstrlenA (lpString="*.ac3") returned 5 [0056.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", pszSpec="*.mxf") returned 0 [0056.631] lstrlenA (lpString="*.mxf") returned 5 [0056.631] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Earthy.css", cAlternateFileName="")) returned 1 [0056.631] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0056.631] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Earthy.css") returned -1 [0056.631] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Earthy.css") returned 1 [0056.631] lstrcmpiA (lpString1="", lpString2="Earthy.css") returned -1 [0056.631] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css") returned="Discussion.css" [0056.631] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0056.631] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0056.631] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0056.631] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0056.631] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Earthy.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css" [0056.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.zip") returned 0 [0056.631] lstrlenA (lpString="*.zip") returned 5 [0056.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.rar") returned 0 [0056.631] lstrlenA (lpString="*.rar") returned 5 [0056.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.7z") returned 0 [0056.631] lstrlenA (lpString="*.7z") returned 4 [0056.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.tar") returned 0 [0056.631] lstrlenA (lpString="*.tar") returned 5 [0056.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.gzip") returned 0 [0056.632] lstrlenA (lpString="*.gzip") returned 6 [0056.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.jpg") returned 0 [0056.632] lstrlenA (lpString="*.jpg") returned 5 [0056.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.jpeg") returned 0 [0056.632] lstrlenA (lpString="*.jpeg") returned 6 [0056.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.psd") returned 0 [0056.632] lstrlenA (lpString="*.psd") returned 5 [0056.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.gif") returned 0 [0056.632] lstrlenA (lpString="*.gif") returned 5 [0056.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.doc") returned 0 [0056.632] lstrlenA (lpString="*.doc") returned 5 [0056.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.docx") returned 0 [0056.632] lstrlenA (lpString="*.docx") returned 6 [0056.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.xls") returned 0 [0056.632] lstrlenA (lpString="*.xls") returned 5 [0056.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.xlsx") returned 0 [0056.632] lstrlenA (lpString="*.xlsx") returned 6 [0056.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.ppt") returned 0 [0056.632] lstrlenA (lpString="*.ppt") returned 5 [0056.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.pptx") returned 0 [0056.632] lstrlenA (lpString="*.pptx") returned 6 [0056.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.pdf") returned 0 [0056.632] lstrlenA (lpString="*.pdf") returned 5 [0056.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.mov") returned 0 [0056.632] lstrlenA (lpString="*.mov") returned 5 [0056.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.m2v") returned 0 [0056.632] lstrlenA (lpString="*.m2v") returned 5 [0056.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.3gp") returned 0 [0056.632] lstrlenA (lpString="*.3gp") returned 5 [0056.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.mpeg") returned 0 [0056.632] lstrlenA (lpString="*.mpeg") returned 6 [0056.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.mpg") returned 0 [0056.632] lstrlenA (lpString="*.mpg") returned 5 [0056.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.flv") returned 0 [0056.633] lstrlenA (lpString="*.flv") returned 5 [0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.avi") returned 0 [0056.633] lstrlenA (lpString="*.avi") returned 5 [0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.mp4") returned 0 [0056.633] lstrlenA (lpString="*.mp4") returned 5 [0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.wmv") returned 0 [0056.633] lstrlenA (lpString="*.wmv") returned 5 [0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.divx") returned 0 [0056.633] lstrlenA (lpString="*.divx") returned 6 [0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.mkv") returned 0 [0056.633] lstrlenA (lpString="*.mkv") returned 5 [0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.mp3") returned 0 [0056.633] lstrlenA (lpString="*.mp3") returned 5 [0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.wav") returned 0 [0056.633] lstrlenA (lpString="*.wav") returned 5 [0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.flac") returned 0 [0056.633] lstrlenA (lpString="*.flac") returned 6 [0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.ape") returned 0 [0056.633] lstrlenA (lpString="*.ape") returned 5 [0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.wma") returned 0 [0056.633] lstrlenA (lpString="*.wma") returned 5 [0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.ac3") returned 0 [0056.633] lstrlenA (lpString="*.ac3") returned 5 [0056.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", pszSpec="*.mxf") returned 0 [0056.633] lstrlenA (lpString="*.mxf") returned 5 [0056.633] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="GrayCheck", cAlternateFileName="GRAYCH~1")) returned 1 [0056.633] lstrcmpA (lpString1=".", lpString2="GrayCheck") returned -1 [0056.633] lstrcmpA (lpString1="..", lpString2="GrayCheck") returned -1 [0056.633] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css") returned="Earthy.css" [0056.633] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="GrayCheck" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck" [0056.633] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck") returned 82 [0056.633] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2d8252, cFileName=".", cAlternateFileName="")) returned 0x2d80a8 [0056.634] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.634] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0056.634] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.634] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.634] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1b8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0056.634] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.634] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HEADER.GIF") returned -1 [0056.634] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0056.634] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0056.634] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\*.*") returned="*.*" [0056.634] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\" [0056.634] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\") returned="" [0056.634] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt" [0056.634] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\how to decrypt files.txt")) returned 0xffffffff [0056.634] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.635] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0056.635] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0056.636] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.636] CloseHandle (hObject=0x98) returned 1 [0056.636] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF" [0056.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.zip") returned 0 [0056.636] lstrlenA (lpString="*.zip") returned 5 [0056.636] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.rar") returned 0 [0056.637] lstrlenA (lpString="*.rar") returned 5 [0056.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.7z") returned 0 [0056.637] lstrlenA (lpString="*.7z") returned 4 [0056.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.tar") returned 0 [0056.637] lstrlenA (lpString="*.tar") returned 5 [0056.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0056.637] lstrlenA (lpString="*.gzip") returned 6 [0056.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0056.637] lstrlenA (lpString="*.jpg") returned 5 [0056.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0056.637] lstrlenA (lpString="*.jpeg") returned 6 [0056.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.psd") returned 0 [0056.637] lstrlenA (lpString="*.psd") returned 5 [0056.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.gif") returned 1 [0056.637] lstrlenA (lpString="*.gif") returned 5 [0056.637] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF" [0056.637] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF" [0056.637] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF." [0056.637] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF.wannacry" [0056.637] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.637] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b8 [0056.638] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcb2d2000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd5284f0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcb2d2000, dwHighDateTime=0x1c747ea)) returned 1 [0056.638] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.638] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x13a, lpOverlapped=0x0) returned 1 [0056.639] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="HEADER.GIF" [0056.639] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.639] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x13a, lpOverlapped=0x0) returned 1 [0056.639] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.639] CloseHandle (hObject=0x98) returned 1 [0056.639] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\header.gif.wannacry")) returned 1 [0056.675] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0056.675] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.675] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0056.675] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0056.675] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0056.675] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="HEADER.GIF" [0056.675] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\" [0056.675] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\") returned="" [0056.675] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt" [0056.675] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\how to decrypt files.txt")) returned 0x20 [0056.675] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" [0056.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0056.675] lstrlenA (lpString="*.zip") returned 5 [0056.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0056.675] lstrlenA (lpString="*.rar") returned 5 [0056.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0056.675] lstrlenA (lpString="*.7z") returned 4 [0056.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0056.676] lstrlenA (lpString="*.tar") returned 5 [0056.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0056.676] lstrlenA (lpString="*.gzip") returned 6 [0056.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0056.676] lstrlenA (lpString="*.jpg") returned 5 [0056.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0056.676] lstrlenA (lpString="*.jpeg") returned 6 [0056.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0056.676] lstrlenA (lpString="*.psd") returned 5 [0056.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0056.676] lstrlenA (lpString="*.gif") returned 5 [0056.676] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" [0056.676] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" [0056.676] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF." [0056.676] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.wannacry" [0056.676] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.677] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0056.677] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcc5e4d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd5284f0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcc5e4d00, dwHighDateTime=0x1c747ea)) returned 1 [0056.677] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.677] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd7, lpOverlapped=0x0) returned 1 [0056.678] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0056.678] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.678] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd7, lpOverlapped=0x0) returned 1 [0056.678] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.678] CloseHandle (hObject=0x98) returned 1 [0056.678] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_off.gif.wannacry")) returned 1 [0056.679] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0056.679] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.679] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0056.679] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0056.679] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0056.679] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0056.679] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\" [0056.679] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\") returned="" [0056.680] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt" [0056.680] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\how to decrypt files.txt")) returned 0x20 [0056.680] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF" [0056.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0056.680] lstrlenA (lpString="*.zip") returned 5 [0056.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0056.680] lstrlenA (lpString="*.rar") returned 5 [0056.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0056.680] lstrlenA (lpString="*.7z") returned 4 [0056.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0056.680] lstrlenA (lpString="*.tar") returned 5 [0056.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0056.680] lstrlenA (lpString="*.gzip") returned 6 [0056.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0056.680] lstrlenA (lpString="*.jpg") returned 5 [0056.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0056.680] lstrlenA (lpString="*.jpeg") returned 6 [0056.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0056.680] lstrlenA (lpString="*.psd") returned 5 [0056.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0056.680] lstrlenA (lpString="*.gif") returned 5 [0056.680] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF" [0056.680] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF" [0056.680] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF." [0056.680] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF.wannacry" [0056.680] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.682] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0056.682] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcc5e4d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd5284f0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcc5e4d00, dwHighDateTime=0x1c747ea)) returned 1 [0056.682] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.682] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60, lpOverlapped=0x0) returned 1 [0056.683] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned="TAB_ON.GIF" [0056.683] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.683] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60, lpOverlapped=0x0) returned 1 [0056.683] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.683] CloseHandle (hObject=0x98) returned 1 [0056.684] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_on.gif.wannacry")) returned 1 [0056.684] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0056.684] FindClose (in: hFindFile=0x2d80a8 | out: hFindFile=0x2d80a8) returned 1 [0056.684] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbea, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="GrayCheck.css", cAlternateFileName="GRAYCH~1.CSS")) returned 1 [0056.684] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0056.685] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GrayCheck.css") returned -1 [0056.685] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GrayCheck.css") returned 1 [0056.685] lstrcmpiA (lpString1="", lpString2="GrayCheck.css") returned -1 [0056.685] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*.*") returned="*.*" [0056.685] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0056.685] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0056.685] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0056.685] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0056.685] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="GrayCheck.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css" [0056.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.zip") returned 0 [0056.685] lstrlenA (lpString="*.zip") returned 5 [0056.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.rar") returned 0 [0056.685] lstrlenA (lpString="*.rar") returned 5 [0056.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.7z") returned 0 [0056.685] lstrlenA (lpString="*.7z") returned 4 [0056.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.tar") returned 0 [0056.685] lstrlenA (lpString="*.tar") returned 5 [0056.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.gzip") returned 0 [0056.685] lstrlenA (lpString="*.gzip") returned 6 [0056.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.jpg") returned 0 [0056.685] lstrlenA (lpString="*.jpg") returned 5 [0056.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.jpeg") returned 0 [0056.685] lstrlenA (lpString="*.jpeg") returned 6 [0056.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.psd") returned 0 [0056.685] lstrlenA (lpString="*.psd") returned 5 [0056.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.gif") returned 0 [0056.686] lstrlenA (lpString="*.gif") returned 5 [0056.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.doc") returned 0 [0056.686] lstrlenA (lpString="*.doc") returned 5 [0056.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.docx") returned 0 [0056.686] lstrlenA (lpString="*.docx") returned 6 [0056.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.xls") returned 0 [0056.686] lstrlenA (lpString="*.xls") returned 5 [0056.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.xlsx") returned 0 [0056.686] lstrlenA (lpString="*.xlsx") returned 6 [0056.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.ppt") returned 0 [0056.686] lstrlenA (lpString="*.ppt") returned 5 [0056.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.pptx") returned 0 [0056.686] lstrlenA (lpString="*.pptx") returned 6 [0056.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.pdf") returned 0 [0056.686] lstrlenA (lpString="*.pdf") returned 5 [0056.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.mov") returned 0 [0056.686] lstrlenA (lpString="*.mov") returned 5 [0056.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.m2v") returned 0 [0056.686] lstrlenA (lpString="*.m2v") returned 5 [0056.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.3gp") returned 0 [0056.686] lstrlenA (lpString="*.3gp") returned 5 [0056.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.mpeg") returned 0 [0056.686] lstrlenA (lpString="*.mpeg") returned 6 [0056.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.mpg") returned 0 [0056.686] lstrlenA (lpString="*.mpg") returned 5 [0056.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.flv") returned 0 [0056.686] lstrlenA (lpString="*.flv") returned 5 [0056.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.avi") returned 0 [0056.687] lstrlenA (lpString="*.avi") returned 5 [0056.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.mp4") returned 0 [0056.687] lstrlenA (lpString="*.mp4") returned 5 [0056.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.wmv") returned 0 [0056.687] lstrlenA (lpString="*.wmv") returned 5 [0056.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.divx") returned 0 [0056.687] lstrlenA (lpString="*.divx") returned 6 [0056.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.mkv") returned 0 [0056.687] lstrlenA (lpString="*.mkv") returned 5 [0056.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.mp3") returned 0 [0056.687] lstrlenA (lpString="*.mp3") returned 5 [0056.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.wav") returned 0 [0056.687] lstrlenA (lpString="*.wav") returned 5 [0056.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.flac") returned 0 [0056.687] lstrlenA (lpString="*.flac") returned 6 [0056.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.ape") returned 0 [0056.687] lstrlenA (lpString="*.ape") returned 5 [0056.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.wma") returned 0 [0056.687] lstrlenA (lpString="*.wma") returned 5 [0056.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.ac3") returned 0 [0056.687] lstrlenA (lpString="*.ac3") returned 5 [0056.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", pszSpec="*.mxf") returned 0 [0056.709] lstrlenA (lpString="*.mxf") returned 5 [0056.709] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x752, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="GreenTea.css", cAlternateFileName="")) returned 1 [0056.709] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0056.709] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GreenTea.css") returned -1 [0056.709] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GreenTea.css") returned 1 [0056.709] lstrcmpiA (lpString1="", lpString2="GreenTea.css") returned -1 [0056.709] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css") returned="GrayCheck.css" [0056.709] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0056.709] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0056.709] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0056.709] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0056.709] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="GreenTea.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css" [0056.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.zip") returned 0 [0056.710] lstrlenA (lpString="*.zip") returned 5 [0056.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.rar") returned 0 [0056.710] lstrlenA (lpString="*.rar") returned 5 [0056.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.7z") returned 0 [0056.710] lstrlenA (lpString="*.7z") returned 4 [0056.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.tar") returned 0 [0056.710] lstrlenA (lpString="*.tar") returned 5 [0056.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.gzip") returned 0 [0056.710] lstrlenA (lpString="*.gzip") returned 6 [0056.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.jpg") returned 0 [0056.710] lstrlenA (lpString="*.jpg") returned 5 [0056.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.jpeg") returned 0 [0056.710] lstrlenA (lpString="*.jpeg") returned 6 [0056.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.psd") returned 0 [0056.710] lstrlenA (lpString="*.psd") returned 5 [0056.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.gif") returned 0 [0056.710] lstrlenA (lpString="*.gif") returned 5 [0056.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.doc") returned 0 [0056.710] lstrlenA (lpString="*.doc") returned 5 [0056.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.docx") returned 0 [0056.710] lstrlenA (lpString="*.docx") returned 6 [0056.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.xls") returned 0 [0056.710] lstrlenA (lpString="*.xls") returned 5 [0056.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.xlsx") returned 0 [0056.710] lstrlenA (lpString="*.xlsx") returned 6 [0056.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.ppt") returned 0 [0056.710] lstrlenA (lpString="*.ppt") returned 5 [0056.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.pptx") returned 0 [0056.710] lstrlenA (lpString="*.pptx") returned 6 [0056.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.pdf") returned 0 [0056.710] lstrlenA (lpString="*.pdf") returned 5 [0056.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.mov") returned 0 [0056.710] lstrlenA (lpString="*.mov") returned 5 [0056.710] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.m2v") returned 0 [0056.711] lstrlenA (lpString="*.m2v") returned 5 [0056.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.3gp") returned 0 [0056.711] lstrlenA (lpString="*.3gp") returned 5 [0056.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.mpeg") returned 0 [0056.711] lstrlenA (lpString="*.mpeg") returned 6 [0056.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.mpg") returned 0 [0056.711] lstrlenA (lpString="*.mpg") returned 5 [0056.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.flv") returned 0 [0056.711] lstrlenA (lpString="*.flv") returned 5 [0056.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.avi") returned 0 [0056.711] lstrlenA (lpString="*.avi") returned 5 [0056.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.mp4") returned 0 [0056.711] lstrlenA (lpString="*.mp4") returned 5 [0056.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.wmv") returned 0 [0056.711] lstrlenA (lpString="*.wmv") returned 5 [0056.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.divx") returned 0 [0056.711] lstrlenA (lpString="*.divx") returned 6 [0056.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.mkv") returned 0 [0056.711] lstrlenA (lpString="*.mkv") returned 5 [0056.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.mp3") returned 0 [0056.711] lstrlenA (lpString="*.mp3") returned 5 [0056.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.wav") returned 0 [0056.711] lstrlenA (lpString="*.wav") returned 5 [0056.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.flac") returned 0 [0056.711] lstrlenA (lpString="*.flac") returned 6 [0056.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.ape") returned 0 [0056.711] lstrlenA (lpString="*.ape") returned 5 [0056.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.wma") returned 0 [0056.711] lstrlenA (lpString="*.wma") returned 5 [0056.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.ac3") returned 0 [0056.712] lstrlenA (lpString="*.ac3") returned 5 [0056.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", pszSpec="*.mxf") returned 0 [0056.712] lstrlenA (lpString="*.mxf") returned 5 [0056.712] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd632e90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="LightSpirit.css", cAlternateFileName="LIGHTS~1.CSS")) returned 1 [0056.712] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0056.712] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LightSpirit.css") returned -1 [0056.712] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LightSpirit.css") returned -1 [0056.712] lstrcmpiA (lpString1="", lpString2="LightSpirit.css") returned -1 [0056.712] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css") returned="GreenTea.css" [0056.712] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0056.712] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0056.712] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0056.712] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0056.712] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="LightSpirit.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css" [0056.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.zip") returned 0 [0056.712] lstrlenA (lpString="*.zip") returned 5 [0056.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.rar") returned 0 [0056.712] lstrlenA (lpString="*.rar") returned 5 [0056.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.7z") returned 0 [0056.712] lstrlenA (lpString="*.7z") returned 4 [0056.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.tar") returned 0 [0056.712] lstrlenA (lpString="*.tar") returned 5 [0056.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.gzip") returned 0 [0056.712] lstrlenA (lpString="*.gzip") returned 6 [0056.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.jpg") returned 0 [0056.712] lstrlenA (lpString="*.jpg") returned 5 [0056.712] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.jpeg") returned 0 [0056.712] lstrlenA (lpString="*.jpeg") returned 6 [0056.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.psd") returned 0 [0056.713] lstrlenA (lpString="*.psd") returned 5 [0056.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.gif") returned 0 [0056.713] lstrlenA (lpString="*.gif") returned 5 [0056.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.doc") returned 0 [0056.713] lstrlenA (lpString="*.doc") returned 5 [0056.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.docx") returned 0 [0056.713] lstrlenA (lpString="*.docx") returned 6 [0056.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.xls") returned 0 [0056.713] lstrlenA (lpString="*.xls") returned 5 [0056.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.xlsx") returned 0 [0056.713] lstrlenA (lpString="*.xlsx") returned 6 [0056.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.ppt") returned 0 [0056.713] lstrlenA (lpString="*.ppt") returned 5 [0056.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.pptx") returned 0 [0056.713] lstrlenA (lpString="*.pptx") returned 6 [0056.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.pdf") returned 0 [0056.713] lstrlenA (lpString="*.pdf") returned 5 [0056.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.mov") returned 0 [0056.713] lstrlenA (lpString="*.mov") returned 5 [0056.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.m2v") returned 0 [0056.713] lstrlenA (lpString="*.m2v") returned 5 [0056.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.3gp") returned 0 [0056.713] lstrlenA (lpString="*.3gp") returned 5 [0056.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.mpeg") returned 0 [0056.713] lstrlenA (lpString="*.mpeg") returned 6 [0056.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.mpg") returned 0 [0056.713] lstrlenA (lpString="*.mpg") returned 5 [0056.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.flv") returned 0 [0056.713] lstrlenA (lpString="*.flv") returned 5 [0056.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.avi") returned 0 [0056.713] lstrlenA (lpString="*.avi") returned 5 [0056.713] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.mp4") returned 0 [0056.713] lstrlenA (lpString="*.mp4") returned 5 [0056.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.wmv") returned 0 [0056.714] lstrlenA (lpString="*.wmv") returned 5 [0056.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.divx") returned 0 [0056.714] lstrlenA (lpString="*.divx") returned 6 [0056.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.mkv") returned 0 [0056.714] lstrlenA (lpString="*.mkv") returned 5 [0056.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.mp3") returned 0 [0056.714] lstrlenA (lpString="*.mp3") returned 5 [0056.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.wav") returned 0 [0056.714] lstrlenA (lpString="*.wav") returned 5 [0056.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.flac") returned 0 [0056.714] lstrlenA (lpString="*.flac") returned 6 [0056.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.ape") returned 0 [0056.714] lstrlenA (lpString="*.ape") returned 5 [0056.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.wma") returned 0 [0056.714] lstrlenA (lpString="*.wma") returned 5 [0056.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.ac3") returned 0 [0056.714] lstrlenA (lpString="*.ac3") returned 5 [0056.714] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", pszSpec="*.mxf") returned 0 [0056.714] lstrlenA (lpString="*.mxf") returned 5 [0056.714] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Lime", cAlternateFileName="")) returned 1 [0056.714] lstrcmpA (lpString1=".", lpString2="Lime") returned -1 [0056.714] lstrcmpA (lpString1="..", lpString2="Lime") returned -1 [0056.714] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css") returned="LightSpirit.css" [0056.714] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Lime" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime" [0056.714] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime") returned 77 [0056.714] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2d8252, cFileName=".", cAlternateFileName="")) returned 0x2d80a8 [0056.715] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.715] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0056.715] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.715] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.715] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0056.715] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.715] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0056.715] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0056.715] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0056.715] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\*.*") returned="*.*" [0056.715] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\" [0056.715] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\") returned="" [0056.715] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt" [0056.715] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\how to decrypt files.txt")) returned 0xffffffff [0056.715] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.716] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0056.716] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0056.717] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.717] CloseHandle (hObject=0x98) returned 1 [0056.717] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF" [0056.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0056.717] lstrlenA (lpString="*.zip") returned 5 [0056.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0056.717] lstrlenA (lpString="*.rar") returned 5 [0056.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0056.717] lstrlenA (lpString="*.7z") returned 4 [0056.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0056.717] lstrlenA (lpString="*.tar") returned 5 [0056.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0056.717] lstrlenA (lpString="*.gzip") returned 6 [0056.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0056.717] lstrlenA (lpString="*.jpg") returned 5 [0056.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0056.717] lstrlenA (lpString="*.jpeg") returned 6 [0056.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0056.717] lstrlenA (lpString="*.psd") returned 5 [0056.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0056.717] lstrlenA (lpString="*.gif") returned 5 [0056.717] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF" [0056.717] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF" [0056.717] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF." [0056.717] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF.wannacry" [0056.717] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.718] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ce [0056.718] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcc5e4d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd5284f0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcc5e4d00, dwHighDateTime=0x1c747ea)) returned 1 [0056.718] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.718] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x150, lpOverlapped=0x0) returned 1 [0056.719] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0056.719] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.719] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x150, lpOverlapped=0x0) returned 1 [0056.719] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.719] CloseHandle (hObject=0x98) returned 1 [0056.720] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_off.gif.wannacry")) returned 1 [0056.720] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0056.720] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.720] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0056.720] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0056.720] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0056.720] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0056.720] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\" [0056.720] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\") returned="" [0056.720] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt" [0056.720] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\how to decrypt files.txt")) returned 0x20 [0056.720] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF" [0056.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0056.721] lstrlenA (lpString="*.zip") returned 5 [0056.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0056.721] lstrlenA (lpString="*.rar") returned 5 [0056.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0056.721] lstrlenA (lpString="*.7z") returned 4 [0056.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0056.721] lstrlenA (lpString="*.tar") returned 5 [0056.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0056.721] lstrlenA (lpString="*.gzip") returned 6 [0056.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0056.721] lstrlenA (lpString="*.jpg") returned 5 [0056.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0056.721] lstrlenA (lpString="*.jpeg") returned 6 [0056.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0056.721] lstrlenA (lpString="*.psd") returned 5 [0056.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0056.721] lstrlenA (lpString="*.gif") returned 5 [0056.721] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF" [0056.721] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF" [0056.721] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF." [0056.721] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF.wannacry" [0056.721] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.721] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10b [0056.721] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcc5e4d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd5284f0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcc5e4d00, dwHighDateTime=0x1c747ea)) returned 1 [0056.722] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.722] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x8d, lpOverlapped=0x0) returned 1 [0056.722] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF") returned="TAB_ON.GIF" [0056.722] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.723] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x8d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x8d, lpOverlapped=0x0) returned 1 [0056.723] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.723] CloseHandle (hObject=0x98) returned 1 [0056.723] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_on.gif.wannacry")) returned 1 [0056.736] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0056.736] FindClose (in: hFindFile=0x2d80a8 | out: hFindFile=0x2d80a8) returned 1 [0056.736] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd632e90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd77, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="Lime.css", cAlternateFileName="")) returned 1 [0056.736] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0056.736] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Lime.css") returned -1 [0056.736] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Lime.css") returned -1 [0056.736] lstrcmpiA (lpString1="", lpString2="Lime.css") returned -1 [0056.736] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*.*") returned="*.*" [0056.736] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0056.736] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0056.737] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0056.737] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0056.737] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Lime.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css" [0056.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.zip") returned 0 [0056.737] lstrlenA (lpString="*.zip") returned 5 [0056.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.rar") returned 0 [0056.737] lstrlenA (lpString="*.rar") returned 5 [0056.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.7z") returned 0 [0056.737] lstrlenA (lpString="*.7z") returned 4 [0056.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.tar") returned 0 [0056.737] lstrlenA (lpString="*.tar") returned 5 [0056.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.gzip") returned 0 [0056.737] lstrlenA (lpString="*.gzip") returned 6 [0056.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.jpg") returned 0 [0056.737] lstrlenA (lpString="*.jpg") returned 5 [0056.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.jpeg") returned 0 [0056.737] lstrlenA (lpString="*.jpeg") returned 6 [0056.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.psd") returned 0 [0056.737] lstrlenA (lpString="*.psd") returned 5 [0056.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.gif") returned 0 [0056.737] lstrlenA (lpString="*.gif") returned 5 [0056.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.doc") returned 0 [0056.737] lstrlenA (lpString="*.doc") returned 5 [0056.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.docx") returned 0 [0056.737] lstrlenA (lpString="*.docx") returned 6 [0056.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.xls") returned 0 [0056.737] lstrlenA (lpString="*.xls") returned 5 [0056.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.xlsx") returned 0 [0056.737] lstrlenA (lpString="*.xlsx") returned 6 [0056.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.ppt") returned 0 [0056.737] lstrlenA (lpString="*.ppt") returned 5 [0056.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.pptx") returned 0 [0056.737] lstrlenA (lpString="*.pptx") returned 6 [0056.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.pdf") returned 0 [0056.738] lstrlenA (lpString="*.pdf") returned 5 [0056.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.mov") returned 0 [0056.738] lstrlenA (lpString="*.mov") returned 5 [0056.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.m2v") returned 0 [0056.738] lstrlenA (lpString="*.m2v") returned 5 [0056.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.3gp") returned 0 [0056.738] lstrlenA (lpString="*.3gp") returned 5 [0056.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.mpeg") returned 0 [0056.738] lstrlenA (lpString="*.mpeg") returned 6 [0056.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.mpg") returned 0 [0056.738] lstrlenA (lpString="*.mpg") returned 5 [0056.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.flv") returned 0 [0056.738] lstrlenA (lpString="*.flv") returned 5 [0056.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.avi") returned 0 [0056.738] lstrlenA (lpString="*.avi") returned 5 [0056.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.mp4") returned 0 [0056.738] lstrlenA (lpString="*.mp4") returned 5 [0056.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.wmv") returned 0 [0056.738] lstrlenA (lpString="*.wmv") returned 5 [0056.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.divx") returned 0 [0056.738] lstrlenA (lpString="*.divx") returned 6 [0056.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.mkv") returned 0 [0056.738] lstrlenA (lpString="*.mkv") returned 5 [0056.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.mp3") returned 0 [0056.738] lstrlenA (lpString="*.mp3") returned 5 [0056.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.wav") returned 0 [0056.738] lstrlenA (lpString="*.wav") returned 5 [0056.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.flac") returned 0 [0056.738] lstrlenA (lpString="*.flac") returned 6 [0056.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.ape") returned 0 [0056.738] lstrlenA (lpString="*.ape") returned 5 [0056.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.wma") returned 0 [0056.738] lstrlenA (lpString="*.wma") returned 5 [0056.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.ac3") returned 0 [0056.739] lstrlenA (lpString="*.ac3") returned 5 [0056.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", pszSpec="*.mxf") returned 0 [0056.739] lstrlenA (lpString="*.mxf") returned 5 [0056.739] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd632e90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x715, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Maroon.css", cAlternateFileName="")) returned 1 [0056.739] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0056.739] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Maroon.css") returned -1 [0056.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Maroon.css") returned -1 [0056.739] lstrcmpiA (lpString1="", lpString2="Maroon.css") returned -1 [0056.739] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css") returned="Lime.css" [0056.739] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0056.739] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0056.739] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0056.739] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0056.739] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Maroon.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css" [0056.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.zip") returned 0 [0056.739] lstrlenA (lpString="*.zip") returned 5 [0056.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.rar") returned 0 [0056.739] lstrlenA (lpString="*.rar") returned 5 [0056.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.7z") returned 0 [0056.739] lstrlenA (lpString="*.7z") returned 4 [0056.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.tar") returned 0 [0056.739] lstrlenA (lpString="*.tar") returned 5 [0056.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.gzip") returned 0 [0056.739] lstrlenA (lpString="*.gzip") returned 6 [0056.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.jpg") returned 0 [0056.739] lstrlenA (lpString="*.jpg") returned 5 [0056.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.jpeg") returned 0 [0056.739] lstrlenA (lpString="*.jpeg") returned 6 [0056.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.psd") returned 0 [0056.739] lstrlenA (lpString="*.psd") returned 5 [0056.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.gif") returned 0 [0056.739] lstrlenA (lpString="*.gif") returned 5 [0056.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.doc") returned 0 [0056.740] lstrlenA (lpString="*.doc") returned 5 [0056.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.docx") returned 0 [0056.740] lstrlenA (lpString="*.docx") returned 6 [0056.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.xls") returned 0 [0056.740] lstrlenA (lpString="*.xls") returned 5 [0056.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.xlsx") returned 0 [0056.740] lstrlenA (lpString="*.xlsx") returned 6 [0056.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.ppt") returned 0 [0056.740] lstrlenA (lpString="*.ppt") returned 5 [0056.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.pptx") returned 0 [0056.740] lstrlenA (lpString="*.pptx") returned 6 [0056.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.pdf") returned 0 [0056.740] lstrlenA (lpString="*.pdf") returned 5 [0056.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.mov") returned 0 [0056.740] lstrlenA (lpString="*.mov") returned 5 [0056.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.m2v") returned 0 [0056.740] lstrlenA (lpString="*.m2v") returned 5 [0056.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.3gp") returned 0 [0056.740] lstrlenA (lpString="*.3gp") returned 5 [0056.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.mpeg") returned 0 [0056.740] lstrlenA (lpString="*.mpeg") returned 6 [0056.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.mpg") returned 0 [0056.740] lstrlenA (lpString="*.mpg") returned 5 [0056.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.flv") returned 0 [0056.740] lstrlenA (lpString="*.flv") returned 5 [0056.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.avi") returned 0 [0056.740] lstrlenA (lpString="*.avi") returned 5 [0056.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.mp4") returned 0 [0056.740] lstrlenA (lpString="*.mp4") returned 5 [0056.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.wmv") returned 0 [0056.740] lstrlenA (lpString="*.wmv") returned 5 [0056.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.divx") returned 0 [0056.740] lstrlenA (lpString="*.divx") returned 6 [0056.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.mkv") returned 0 [0056.740] lstrlenA (lpString="*.mkv") returned 5 [0056.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.mp3") returned 0 [0056.741] lstrlenA (lpString="*.mp3") returned 5 [0056.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.wav") returned 0 [0056.741] lstrlenA (lpString="*.wav") returned 5 [0056.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.flac") returned 0 [0056.741] lstrlenA (lpString="*.flac") returned 6 [0056.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.ape") returned 0 [0056.741] lstrlenA (lpString="*.ape") returned 5 [0056.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.wma") returned 0 [0056.741] lstrlenA (lpString="*.wma") returned 5 [0056.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.ac3") returned 0 [0056.741] lstrlenA (lpString="*.ac3") returned 5 [0056.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", pszSpec="*.mxf") returned 0 [0056.741] lstrlenA (lpString="*.mxf") returned 5 [0056.741] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Oasis", cAlternateFileName="")) returned 1 [0056.741] lstrcmpA (lpString1=".", lpString2="Oasis") returned -1 [0056.741] lstrcmpA (lpString1="..", lpString2="Oasis") returned -1 [0056.741] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css") returned="Maroon.css" [0056.741] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Oasis" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis" [0056.741] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis") returned 78 [0056.741] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2d8252, cFileName=".", cAlternateFileName="")) returned 0x2d80a8 [0056.742] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.742] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0056.742] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.742] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.742] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x86c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0056.742] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.742] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HEADER.GIF") returned -1 [0056.742] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0056.742] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0056.742] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\*.*") returned="*.*" [0056.742] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\" [0056.742] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\") returned="" [0056.742] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt" [0056.742] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\how to decrypt files.txt")) returned 0xffffffff [0056.743] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.743] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0056.743] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0056.744] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.744] CloseHandle (hObject=0x98) returned 1 [0056.744] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF" [0056.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.zip") returned 0 [0056.744] lstrlenA (lpString="*.zip") returned 5 [0056.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.rar") returned 0 [0056.744] lstrlenA (lpString="*.rar") returned 5 [0056.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.7z") returned 0 [0056.744] lstrlenA (lpString="*.7z") returned 4 [0056.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.tar") returned 0 [0056.744] lstrlenA (lpString="*.tar") returned 5 [0056.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0056.744] lstrlenA (lpString="*.gzip") returned 6 [0056.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0056.744] lstrlenA (lpString="*.jpg") returned 5 [0056.744] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0056.745] lstrlenA (lpString="*.jpeg") returned 6 [0056.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.psd") returned 0 [0056.745] lstrlenA (lpString="*.psd") returned 5 [0056.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.gif") returned 1 [0056.745] lstrlenA (lpString="*.gif") returned 5 [0056.745] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF" [0056.745] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF" [0056.745] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF." [0056.745] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF.wannacry" [0056.745] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.745] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x86c [0056.745] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcc5e4d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd54e650, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcc5e4d00, dwHighDateTime=0x1c747ea)) returned 1 [0056.745] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.745] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x7ee, lpOverlapped=0x0) returned 1 [0056.761] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF") returned="HEADER.GIF" [0056.762] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.762] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x7ee, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x7ee, lpOverlapped=0x0) returned 1 [0056.762] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.762] CloseHandle (hObject=0x98) returned 1 [0056.762] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\header.gif.wannacry")) returned 1 [0056.764] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1f0, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0056.764] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.764] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0056.764] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0056.764] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0056.764] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF") returned="HEADER.GIF" [0056.764] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\" [0056.764] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\") returned="" [0056.764] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt" [0056.765] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\how to decrypt files.txt")) returned 0x20 [0056.765] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF" [0056.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0056.765] lstrlenA (lpString="*.zip") returned 5 [0056.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0056.765] lstrlenA (lpString="*.rar") returned 5 [0056.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0056.765] lstrlenA (lpString="*.7z") returned 4 [0056.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0056.765] lstrlenA (lpString="*.tar") returned 5 [0056.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0056.765] lstrlenA (lpString="*.gzip") returned 6 [0056.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0056.765] lstrlenA (lpString="*.jpg") returned 5 [0056.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0056.765] lstrlenA (lpString="*.jpeg") returned 6 [0056.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0056.765] lstrlenA (lpString="*.psd") returned 5 [0056.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0056.765] lstrlenA (lpString="*.gif") returned 5 [0056.765] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF" [0056.765] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF" [0056.765] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF." [0056.765] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF.wannacry" [0056.765] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.766] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f0 [0056.766] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcc5e4d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd54e650, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcc5e4d00, dwHighDateTime=0x1c747ea)) returned 1 [0056.766] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.766] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x172, lpOverlapped=0x0) returned 1 [0056.767] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0056.767] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.767] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x172, lpOverlapped=0x0) returned 1 [0056.767] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.767] CloseHandle (hObject=0x98) returned 1 [0056.767] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_off.gif.wannacry")) returned 1 [0056.768] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0056.768] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.768] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0056.768] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0056.768] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0056.768] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0056.768] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\" [0056.768] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\") returned="" [0056.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt" [0056.768] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\how to decrypt files.txt")) returned 0x20 [0056.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF" [0056.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0056.768] lstrlenA (lpString="*.zip") returned 5 [0056.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0056.768] lstrlenA (lpString="*.rar") returned 5 [0056.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0056.769] lstrlenA (lpString="*.7z") returned 4 [0056.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0056.769] lstrlenA (lpString="*.tar") returned 5 [0056.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0056.769] lstrlenA (lpString="*.gzip") returned 6 [0056.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0056.769] lstrlenA (lpString="*.jpg") returned 5 [0056.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0056.769] lstrlenA (lpString="*.jpeg") returned 6 [0056.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0056.769] lstrlenA (lpString="*.psd") returned 5 [0056.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0056.769] lstrlenA (lpString="*.gif") returned 5 [0056.769] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF" [0056.769] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF" [0056.769] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF." [0056.769] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF.wannacry" [0056.769] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.769] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x401 [0056.770] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcc5e4d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd54e650, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcc5e4d00, dwHighDateTime=0x1c747ea)) returned 1 [0056.770] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.770] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x383, lpOverlapped=0x0) returned 1 [0056.778] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF") returned="TAB_ON.GIF" [0056.778] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.778] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x383, lpOverlapped=0x0) returned 1 [0056.778] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.778] CloseHandle (hObject=0x98) returned 1 [0056.779] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_on.gif.wannacry")) returned 1 [0056.779] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0056.779] FindClose (in: hFindFile=0x2d80a8 | out: hFindFile=0x2d80a8) returned 1 [0056.779] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd632e90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd80, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="Oasis.css", cAlternateFileName="")) returned 1 [0056.779] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0056.779] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Oasis.css") returned -1 [0056.779] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Oasis.css") returned -1 [0056.779] lstrcmpiA (lpString1="", lpString2="Oasis.css") returned -1 [0056.780] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*.*") returned="*.*" [0056.780] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0056.780] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0056.780] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0056.780] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0056.780] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Oasis.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css" [0056.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.zip") returned 0 [0056.780] lstrlenA (lpString="*.zip") returned 5 [0056.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.rar") returned 0 [0056.780] lstrlenA (lpString="*.rar") returned 5 [0056.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.7z") returned 0 [0056.780] lstrlenA (lpString="*.7z") returned 4 [0056.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.tar") returned 0 [0056.780] lstrlenA (lpString="*.tar") returned 5 [0056.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.gzip") returned 0 [0056.780] lstrlenA (lpString="*.gzip") returned 6 [0056.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.jpg") returned 0 [0056.780] lstrlenA (lpString="*.jpg") returned 5 [0056.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.jpeg") returned 0 [0056.780] lstrlenA (lpString="*.jpeg") returned 6 [0056.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.psd") returned 0 [0056.780] lstrlenA (lpString="*.psd") returned 5 [0056.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.gif") returned 0 [0056.780] lstrlenA (lpString="*.gif") returned 5 [0056.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.doc") returned 0 [0056.780] lstrlenA (lpString="*.doc") returned 5 [0056.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.docx") returned 0 [0056.781] lstrlenA (lpString="*.docx") returned 6 [0056.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.xls") returned 0 [0056.781] lstrlenA (lpString="*.xls") returned 5 [0056.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.xlsx") returned 0 [0056.781] lstrlenA (lpString="*.xlsx") returned 6 [0056.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.ppt") returned 0 [0056.781] lstrlenA (lpString="*.ppt") returned 5 [0056.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.pptx") returned 0 [0056.781] lstrlenA (lpString="*.pptx") returned 6 [0056.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.pdf") returned 0 [0056.781] lstrlenA (lpString="*.pdf") returned 5 [0056.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.mov") returned 0 [0056.781] lstrlenA (lpString="*.mov") returned 5 [0056.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.m2v") returned 0 [0056.781] lstrlenA (lpString="*.m2v") returned 5 [0056.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.3gp") returned 0 [0056.781] lstrlenA (lpString="*.3gp") returned 5 [0056.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.mpeg") returned 0 [0056.781] lstrlenA (lpString="*.mpeg") returned 6 [0056.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.mpg") returned 0 [0056.781] lstrlenA (lpString="*.mpg") returned 5 [0056.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.flv") returned 0 [0056.781] lstrlenA (lpString="*.flv") returned 5 [0056.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.avi") returned 0 [0056.781] lstrlenA (lpString="*.avi") returned 5 [0056.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.mp4") returned 0 [0056.781] lstrlenA (lpString="*.mp4") returned 5 [0056.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.wmv") returned 0 [0056.781] lstrlenA (lpString="*.wmv") returned 5 [0056.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.divx") returned 0 [0056.782] lstrlenA (lpString="*.divx") returned 6 [0056.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.mkv") returned 0 [0056.782] lstrlenA (lpString="*.mkv") returned 5 [0056.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.mp3") returned 0 [0056.782] lstrlenA (lpString="*.mp3") returned 5 [0056.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.wav") returned 0 [0056.782] lstrlenA (lpString="*.wav") returned 5 [0056.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.flac") returned 0 [0056.782] lstrlenA (lpString="*.flac") returned 6 [0056.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.ape") returned 0 [0056.782] lstrlenA (lpString="*.ape") returned 5 [0056.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.wma") returned 0 [0056.782] lstrlenA (lpString="*.wma") returned 5 [0056.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.ac3") returned 0 [0056.782] lstrlenA (lpString="*.ac3") returned 5 [0056.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", pszSpec="*.mxf") returned 0 [0056.782] lstrlenA (lpString="*.mxf") returned 5 [0056.782] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x74f, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="OliveGreen.css", cAlternateFileName="OLIVEG~1.CSS")) returned 1 [0056.782] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0056.782] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OliveGreen.css") returned -1 [0056.782] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OliveGreen.css") returned -1 [0056.782] lstrcmpiA (lpString1="", lpString2="OliveGreen.css") returned -1 [0056.782] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css") returned="Oasis.css" [0056.782] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0056.782] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0056.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0056.782] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0056.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="OliveGreen.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css" [0056.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.zip") returned 0 [0056.783] lstrlenA (lpString="*.zip") returned 5 [0056.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.rar") returned 0 [0056.783] lstrlenA (lpString="*.rar") returned 5 [0056.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.7z") returned 0 [0056.783] lstrlenA (lpString="*.7z") returned 4 [0056.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.tar") returned 0 [0056.783] lstrlenA (lpString="*.tar") returned 5 [0056.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.gzip") returned 0 [0056.783] lstrlenA (lpString="*.gzip") returned 6 [0056.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.jpg") returned 0 [0056.783] lstrlenA (lpString="*.jpg") returned 5 [0056.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.jpeg") returned 0 [0056.783] lstrlenA (lpString="*.jpeg") returned 6 [0056.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.psd") returned 0 [0056.783] lstrlenA (lpString="*.psd") returned 5 [0056.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.gif") returned 0 [0056.783] lstrlenA (lpString="*.gif") returned 5 [0056.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.doc") returned 0 [0056.783] lstrlenA (lpString="*.doc") returned 5 [0056.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.docx") returned 0 [0056.783] lstrlenA (lpString="*.docx") returned 6 [0056.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.xls") returned 0 [0056.783] lstrlenA (lpString="*.xls") returned 5 [0056.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.xlsx") returned 0 [0056.783] lstrlenA (lpString="*.xlsx") returned 6 [0056.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.ppt") returned 0 [0056.783] lstrlenA (lpString="*.ppt") returned 5 [0056.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.pptx") returned 0 [0056.783] lstrlenA (lpString="*.pptx") returned 6 [0056.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.pdf") returned 0 [0056.784] lstrlenA (lpString="*.pdf") returned 5 [0056.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.mov") returned 0 [0056.784] lstrlenA (lpString="*.mov") returned 5 [0056.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.m2v") returned 0 [0056.784] lstrlenA (lpString="*.m2v") returned 5 [0056.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.3gp") returned 0 [0056.784] lstrlenA (lpString="*.3gp") returned 5 [0056.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.mpeg") returned 0 [0056.784] lstrlenA (lpString="*.mpeg") returned 6 [0056.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.mpg") returned 0 [0056.784] lstrlenA (lpString="*.mpg") returned 5 [0056.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.flv") returned 0 [0056.784] lstrlenA (lpString="*.flv") returned 5 [0056.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.avi") returned 0 [0056.784] lstrlenA (lpString="*.avi") returned 5 [0056.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.mp4") returned 0 [0056.784] lstrlenA (lpString="*.mp4") returned 5 [0056.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.wmv") returned 0 [0056.784] lstrlenA (lpString="*.wmv") returned 5 [0056.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.divx") returned 0 [0056.784] lstrlenA (lpString="*.divx") returned 6 [0056.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.mkv") returned 0 [0056.784] lstrlenA (lpString="*.mkv") returned 5 [0056.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.mp3") returned 0 [0056.784] lstrlenA (lpString="*.mp3") returned 5 [0056.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.wav") returned 0 [0056.784] lstrlenA (lpString="*.wav") returned 5 [0056.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.flac") returned 0 [0056.784] lstrlenA (lpString="*.flac") returned 6 [0056.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.ape") returned 0 [0056.784] lstrlenA (lpString="*.ape") returned 5 [0056.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.wma") returned 0 [0056.785] lstrlenA (lpString="*.wma") returned 5 [0056.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.ac3") returned 0 [0056.785] lstrlenA (lpString="*.ac3") returned 5 [0056.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", pszSpec="*.mxf") returned 0 [0056.785] lstrlenA (lpString="*.mxf") returned 5 [0056.785] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x705, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Premium.css", cAlternateFileName="")) returned 1 [0056.785] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0056.785] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Premium.css") returned -1 [0056.785] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Premium.css") returned -1 [0056.785] lstrcmpiA (lpString1="", lpString2="Premium.css") returned -1 [0056.785] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css") returned="OliveGreen.css" [0056.785] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0056.785] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0056.785] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0056.785] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0056.785] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Premium.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css" [0056.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.zip") returned 0 [0056.785] lstrlenA (lpString="*.zip") returned 5 [0056.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.rar") returned 0 [0056.785] lstrlenA (lpString="*.rar") returned 5 [0056.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.7z") returned 0 [0056.785] lstrlenA (lpString="*.7z") returned 4 [0056.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.tar") returned 0 [0056.785] lstrlenA (lpString="*.tar") returned 5 [0056.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.gzip") returned 0 [0056.786] lstrlenA (lpString="*.gzip") returned 6 [0056.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.jpg") returned 0 [0056.786] lstrlenA (lpString="*.jpg") returned 5 [0056.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.jpeg") returned 0 [0056.786] lstrlenA (lpString="*.jpeg") returned 6 [0056.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.psd") returned 0 [0056.786] lstrlenA (lpString="*.psd") returned 5 [0056.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.gif") returned 0 [0056.786] lstrlenA (lpString="*.gif") returned 5 [0056.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.doc") returned 0 [0056.786] lstrlenA (lpString="*.doc") returned 5 [0056.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.docx") returned 0 [0056.786] lstrlenA (lpString="*.docx") returned 6 [0056.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.xls") returned 0 [0056.786] lstrlenA (lpString="*.xls") returned 5 [0056.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.xlsx") returned 0 [0056.786] lstrlenA (lpString="*.xlsx") returned 6 [0056.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.ppt") returned 0 [0056.786] lstrlenA (lpString="*.ppt") returned 5 [0056.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.pptx") returned 0 [0056.786] lstrlenA (lpString="*.pptx") returned 6 [0056.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.pdf") returned 0 [0056.786] lstrlenA (lpString="*.pdf") returned 5 [0056.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.mov") returned 0 [0056.786] lstrlenA (lpString="*.mov") returned 5 [0056.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.m2v") returned 0 [0056.786] lstrlenA (lpString="*.m2v") returned 5 [0056.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.3gp") returned 0 [0056.786] lstrlenA (lpString="*.3gp") returned 5 [0056.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.mpeg") returned 0 [0056.786] lstrlenA (lpString="*.mpeg") returned 6 [0056.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.mpg") returned 0 [0056.787] lstrlenA (lpString="*.mpg") returned 5 [0056.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.flv") returned 0 [0056.787] lstrlenA (lpString="*.flv") returned 5 [0056.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.avi") returned 0 [0056.787] lstrlenA (lpString="*.avi") returned 5 [0056.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.mp4") returned 0 [0056.787] lstrlenA (lpString="*.mp4") returned 5 [0056.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.wmv") returned 0 [0056.787] lstrlenA (lpString="*.wmv") returned 5 [0056.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.divx") returned 0 [0056.787] lstrlenA (lpString="*.divx") returned 6 [0056.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.mkv") returned 0 [0056.787] lstrlenA (lpString="*.mkv") returned 5 [0056.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.mp3") returned 0 [0056.787] lstrlenA (lpString="*.mp3") returned 5 [0056.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.wav") returned 0 [0056.787] lstrlenA (lpString="*.wav") returned 5 [0056.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.flac") returned 0 [0056.787] lstrlenA (lpString="*.flac") returned 6 [0056.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.ape") returned 0 [0056.787] lstrlenA (lpString="*.ape") returned 5 [0056.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.wma") returned 0 [0056.787] lstrlenA (lpString="*.wma") returned 5 [0056.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.ac3") returned 0 [0056.787] lstrlenA (lpString="*.ac3") returned 5 [0056.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", pszSpec="*.mxf") returned 0 [0056.787] lstrlenA (lpString="*.mxf") returned 5 [0056.787] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x366, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="RTF_BOLD.GIF", cAlternateFileName="")) returned 1 [0056.787] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0056.787] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RTF_BOLD.GIF") returned -1 [0056.788] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RTF_BOLD.GIF") returned -1 [0056.788] lstrcmpiA (lpString1="", lpString2="RTF_BOLD.GIF") returned -1 [0056.788] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css") returned="Premium.css" [0056.788] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0056.788] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0056.788] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0056.788] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0056.788] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="RTF_BOLD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF" [0056.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF", pszSpec="*.zip") returned 0 [0056.788] lstrlenA (lpString="*.zip") returned 5 [0056.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF", pszSpec="*.rar") returned 0 [0056.788] lstrlenA (lpString="*.rar") returned 5 [0056.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF", pszSpec="*.7z") returned 0 [0056.788] lstrlenA (lpString="*.7z") returned 4 [0056.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF", pszSpec="*.tar") returned 0 [0056.788] lstrlenA (lpString="*.tar") returned 5 [0056.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF", pszSpec="*.gzip") returned 0 [0056.788] lstrlenA (lpString="*.gzip") returned 6 [0056.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF", pszSpec="*.jpg") returned 0 [0056.788] lstrlenA (lpString="*.jpg") returned 5 [0056.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF", pszSpec="*.jpeg") returned 0 [0056.788] lstrlenA (lpString="*.jpeg") returned 6 [0056.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF", pszSpec="*.psd") returned 0 [0056.788] lstrlenA (lpString="*.psd") returned 5 [0056.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF", pszSpec="*.gif") returned 1 [0056.788] lstrlenA (lpString="*.gif") returned 5 [0056.788] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF" [0056.788] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF" [0056.788] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF." [0056.789] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF.wannacry" [0056.789] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_bold.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0056.790] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x366 [0056.790] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcd8f7a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd658ff0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcd8f7a00, dwHighDateTime=0x1c747ea)) returned 1 [0056.790] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.790] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2e8, lpOverlapped=0x0) returned 1 [0056.826] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF") returned="RTF_BOLD.GIF" [0056.826] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.826] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2e8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2e8, lpOverlapped=0x0) returned 1 [0056.826] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.827] CloseHandle (hObject=0x94) returned 1 [0056.827] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_bold.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_bold.gif.wannacry")) returned 1 [0056.827] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79023600, ftCreationTime.dwHighDateTime=0x1ca2b70, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x79023600, ftLastWriteTime.dwHighDateTime=0x1ca2b70, nFileSizeHigh=0x0, nFileSizeLow=0x37a, dwReserved0=0x3000003, dwReserved1=0x2d80a8, cFileName="rtf_choosefont.gif", cAlternateFileName="RTF_CH~1.GIF")) returned 1 [0056.827] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0056.827] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_choosefont.gif") returned -1 [0056.828] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_choosefont.gif") returned -1 [0056.828] lstrcmpiA (lpString1="", lpString2="rtf_choosefont.gif") returned -1 [0056.828] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF") returned="RTF_BOLD.GIF" [0056.828] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0056.828] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0056.828] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0056.828] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0056.828] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="rtf_choosefont.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif" [0056.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif", pszSpec="*.zip") returned 0 [0056.828] lstrlenA (lpString="*.zip") returned 5 [0056.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif", pszSpec="*.rar") returned 0 [0056.828] lstrlenA (lpString="*.rar") returned 5 [0056.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif", pszSpec="*.7z") returned 0 [0056.828] lstrlenA (lpString="*.7z") returned 4 [0056.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif", pszSpec="*.tar") returned 0 [0056.828] lstrlenA (lpString="*.tar") returned 5 [0056.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif", pszSpec="*.gzip") returned 0 [0056.828] lstrlenA (lpString="*.gzip") returned 6 [0056.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif", pszSpec="*.jpg") returned 0 [0056.828] lstrlenA (lpString="*.jpg") returned 5 [0056.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif", pszSpec="*.jpeg") returned 0 [0056.828] lstrlenA (lpString="*.jpeg") returned 6 [0056.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif", pszSpec="*.psd") returned 0 [0056.828] lstrlenA (lpString="*.psd") returned 5 [0056.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif", pszSpec="*.gif") returned 1 [0056.828] lstrlenA (lpString="*.gif") returned 5 [0056.828] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif" [0056.828] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif" [0056.828] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif." [0056.828] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif.wannacry" [0056.828] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_choosefont.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0056.829] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x37a [0056.829] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x79023600, dwHighDateTime=0x1ca2b70), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd658ff0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0x79023600, dwHighDateTime=0x1ca2b70)) returned 1 [0056.829] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.829] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2fc, lpOverlapped=0x0) returned 1 [0056.831] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif") returned="rtf_choosefont.gif" [0056.831] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.831] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2fc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2fc, lpOverlapped=0x0) returned 1 [0056.831] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.831] CloseHandle (hObject=0x94) returned 1 [0056.831] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_choosefont.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_choosefont.gif.wannacry")) returned 1 [0056.832] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x3000003, dwReserved1=0x2d80a8, cFileName="rtf_italic.gif", cAlternateFileName="RTF_IT~1.GIF")) returned 1 [0056.832] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0056.832] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_italic.gif") returned -1 [0056.832] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_italic.gif") returned -1 [0056.832] lstrcmpiA (lpString1="", lpString2="rtf_italic.gif") returned -1 [0056.832] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif") returned="rtf_choosefont.gif" [0056.832] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0056.832] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0056.832] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0056.832] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0056.832] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="rtf_italic.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif" [0056.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif", pszSpec="*.zip") returned 0 [0056.832] lstrlenA (lpString="*.zip") returned 5 [0056.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif", pszSpec="*.rar") returned 0 [0056.832] lstrlenA (lpString="*.rar") returned 5 [0056.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif", pszSpec="*.7z") returned 0 [0056.832] lstrlenA (lpString="*.7z") returned 4 [0056.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif", pszSpec="*.tar") returned 0 [0056.832] lstrlenA (lpString="*.tar") returned 5 [0056.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif", pszSpec="*.gzip") returned 0 [0056.833] lstrlenA (lpString="*.gzip") returned 6 [0056.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif", pszSpec="*.jpg") returned 0 [0056.833] lstrlenA (lpString="*.jpg") returned 5 [0056.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif", pszSpec="*.jpeg") returned 0 [0056.833] lstrlenA (lpString="*.jpeg") returned 6 [0056.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif", pszSpec="*.psd") returned 0 [0056.833] lstrlenA (lpString="*.psd") returned 5 [0056.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif", pszSpec="*.gif") returned 1 [0056.833] lstrlenA (lpString="*.gif") returned 5 [0056.833] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif" [0056.833] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif" [0056.833] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif." [0056.833] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif.wannacry" [0056.833] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_italic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0056.833] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x354 [0056.833] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcd8f7a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd658ff0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcd8f7a00, dwHighDateTime=0x1c747ea)) returned 1 [0056.833] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.833] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2d6, lpOverlapped=0x0) returned 1 [0056.838] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif") returned="rtf_italic.gif" [0056.838] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.838] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2d6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2d6, lpOverlapped=0x0) returned 1 [0056.838] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.838] CloseHandle (hObject=0x94) returned 1 [0056.838] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_italic.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_italic.gif.wannacry")) returned 1 [0056.839] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60dfe600, ftCreationTime.dwHighDateTime=0x1ca2b73, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x60dfe600, ftLastWriteTime.dwHighDateTime=0x1ca2b73, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x3000003, dwReserved1=0x2d80a8, cFileName="rtf_spellcheck.gif", cAlternateFileName="RTF_SP~1.GIF")) returned 1 [0056.839] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0056.839] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_spellcheck.gif") returned -1 [0056.839] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_spellcheck.gif") returned -1 [0056.839] lstrcmpiA (lpString1="", lpString2="rtf_spellcheck.gif") returned -1 [0056.839] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif") returned="rtf_italic.gif" [0056.839] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0056.839] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0056.839] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0056.839] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0056.839] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="rtf_spellcheck.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif" [0056.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif", pszSpec="*.zip") returned 0 [0056.839] lstrlenA (lpString="*.zip") returned 5 [0056.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif", pszSpec="*.rar") returned 0 [0056.839] lstrlenA (lpString="*.rar") returned 5 [0056.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif", pszSpec="*.7z") returned 0 [0056.839] lstrlenA (lpString="*.7z") returned 4 [0056.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif", pszSpec="*.tar") returned 0 [0056.839] lstrlenA (lpString="*.tar") returned 5 [0056.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif", pszSpec="*.gzip") returned 0 [0056.840] lstrlenA (lpString="*.gzip") returned 6 [0056.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif", pszSpec="*.jpg") returned 0 [0056.840] lstrlenA (lpString="*.jpg") returned 5 [0056.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif", pszSpec="*.jpeg") returned 0 [0056.840] lstrlenA (lpString="*.jpeg") returned 6 [0056.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif", pszSpec="*.psd") returned 0 [0056.840] lstrlenA (lpString="*.psd") returned 5 [0056.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif", pszSpec="*.gif") returned 1 [0056.840] lstrlenA (lpString="*.gif") returned 5 [0056.840] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif" [0056.840] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif" [0056.840] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif." [0056.840] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif.wannacry" [0056.840] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_spellcheck.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0056.840] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa0 [0056.840] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x60dfe600, dwHighDateTime=0x1ca2b73), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd658ff0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0x60dfe600, dwHighDateTime=0x1ca2b73)) returned 1 [0056.840] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.840] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x22, lpOverlapped=0x0) returned 1 [0056.841] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif") returned="rtf_spellcheck.gif" [0056.841] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.841] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x22, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x22, lpOverlapped=0x0) returned 1 [0056.841] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.841] CloseHandle (hObject=0x94) returned 1 [0056.842] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_spellcheck.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_spellcheck.gif.wannacry")) returned 1 [0056.842] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35c, dwReserved0=0x3000003, dwReserved1=0x2d80a8, cFileName="rtf_underline.gif", cAlternateFileName="RTF_UN~1.GIF")) returned 1 [0056.842] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0056.842] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_underline.gif") returned -1 [0056.842] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_underline.gif") returned -1 [0056.842] lstrcmpiA (lpString1="", lpString2="rtf_underline.gif") returned -1 [0056.842] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif") returned="rtf_spellcheck.gif" [0056.842] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0056.842] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0056.842] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0056.842] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0056.842] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="rtf_underline.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif" [0056.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif", pszSpec="*.zip") returned 0 [0056.842] lstrlenA (lpString="*.zip") returned 5 [0056.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif", pszSpec="*.rar") returned 0 [0056.843] lstrlenA (lpString="*.rar") returned 5 [0056.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif", pszSpec="*.7z") returned 0 [0056.843] lstrlenA (lpString="*.7z") returned 4 [0056.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif", pszSpec="*.tar") returned 0 [0056.843] lstrlenA (lpString="*.tar") returned 5 [0056.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif", pszSpec="*.gzip") returned 0 [0056.843] lstrlenA (lpString="*.gzip") returned 6 [0056.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif", pszSpec="*.jpg") returned 0 [0056.843] lstrlenA (lpString="*.jpg") returned 5 [0056.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif", pszSpec="*.jpeg") returned 0 [0056.843] lstrlenA (lpString="*.jpeg") returned 6 [0056.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif", pszSpec="*.psd") returned 0 [0056.843] lstrlenA (lpString="*.psd") returned 5 [0056.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif", pszSpec="*.gif") returned 1 [0056.843] lstrlenA (lpString="*.gif") returned 5 [0056.843] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif" [0056.843] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif" [0056.843] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif." [0056.843] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif.wannacry" [0056.843] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_underline.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0056.844] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35c [0056.844] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcd8f7a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd67f150, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcd8f7a00, dwHighDateTime=0x1c747ea)) returned 1 [0056.844] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.844] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2de, lpOverlapped=0x0) returned 1 [0056.873] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif") returned="rtf_underline.gif" [0056.873] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.873] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2de, lpOverlapped=0x0) returned 1 [0056.873] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.873] CloseHandle (hObject=0x94) returned 1 [0056.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_underline.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_underline.gif.wannacry")) returned 1 [0056.874] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d80a8, cFileName="Slate", cAlternateFileName="")) returned 1 [0056.875] lstrcmpA (lpString1=".", lpString2="Slate") returned -1 [0056.875] lstrcmpA (lpString1="..", lpString2="Slate") returned -1 [0056.875] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif") returned="rtf_underline.gif" [0056.875] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Slate" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate" [0056.875] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate") returned 78 [0056.875] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0069, dwReserved1=0x730065, cFileName=".", cAlternateFileName="")) returned 0x2d80a8 [0056.876] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.876] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x730000, cFileName="..", cAlternateFileName="")) returned 1 [0056.876] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.876] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.876] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0056.876] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.876] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0056.876] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0056.876] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0056.876] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\*.*") returned="*.*" [0056.876] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\" [0056.876] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\") returned="" [0056.876] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt" [0056.876] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\how to decrypt files.txt")) returned 0xffffffff [0056.876] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.877] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0056.877] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0056.878] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.878] CloseHandle (hObject=0x98) returned 1 [0056.878] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF" [0056.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0056.878] lstrlenA (lpString="*.zip") returned 5 [0056.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0056.878] lstrlenA (lpString="*.rar") returned 5 [0056.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0056.878] lstrlenA (lpString="*.7z") returned 4 [0056.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0056.878] lstrlenA (lpString="*.tar") returned 5 [0056.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0056.878] lstrlenA (lpString="*.gzip") returned 6 [0056.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0056.879] lstrlenA (lpString="*.jpg") returned 5 [0056.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0056.879] lstrlenA (lpString="*.jpeg") returned 6 [0056.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0056.879] lstrlenA (lpString="*.psd") returned 5 [0056.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0056.879] lstrlenA (lpString="*.gif") returned 5 [0056.879] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF" [0056.879] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF" [0056.879] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF." [0056.879] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF.wannacry" [0056.879] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.879] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16c [0056.879] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcd8f7a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd54e650, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcd8f7a00, dwHighDateTime=0x1c747ea)) returned 1 [0056.880] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.880] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xee, lpOverlapped=0x0) returned 1 [0056.880] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0056.880] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.880] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xee, lpOverlapped=0x0) returned 1 [0056.881] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.881] CloseHandle (hObject=0x98) returned 1 [0056.881] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_off.gif.wannacry")) returned 1 [0056.881] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0056.881] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.881] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0056.881] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0056.881] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0056.881] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0056.882] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\" [0056.882] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\") returned="" [0056.882] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt" [0056.882] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\how to decrypt files.txt")) returned 0x20 [0056.882] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF" [0056.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0056.882] lstrlenA (lpString="*.zip") returned 5 [0056.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0056.882] lstrlenA (lpString="*.rar") returned 5 [0056.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0056.882] lstrlenA (lpString="*.7z") returned 4 [0056.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0056.882] lstrlenA (lpString="*.tar") returned 5 [0056.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0056.882] lstrlenA (lpString="*.gzip") returned 6 [0056.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0056.882] lstrlenA (lpString="*.jpg") returned 5 [0056.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0056.882] lstrlenA (lpString="*.jpeg") returned 6 [0056.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0056.882] lstrlenA (lpString="*.psd") returned 5 [0056.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0056.882] lstrlenA (lpString="*.gif") returned 5 [0056.882] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF" [0056.882] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF" [0056.882] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF." [0056.882] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF.wannacry" [0056.883] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.883] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16c [0056.883] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcd8f7a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd54e650, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcd8f7a00, dwHighDateTime=0x1c747ea)) returned 1 [0056.883] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.883] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xee, lpOverlapped=0x0) returned 1 [0056.884] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF") returned="TAB_ON.GIF" [0056.884] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.884] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xee, lpOverlapped=0x0) returned 1 [0056.884] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.884] CloseHandle (hObject=0x98) returned 1 [0056.884] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_on.gif.wannacry")) returned 1 [0056.886] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0056.887] FindClose (in: hFindFile=0x2d80a8 | out: hFindFile=0x2d80a8) returned 1 [0056.887] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xdbf, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="Slate.css", cAlternateFileName="")) returned 1 [0056.887] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0056.887] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Slate.css") returned -1 [0056.887] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Slate.css") returned -1 [0056.887] lstrcmpiA (lpString1="", lpString2="Slate.css") returned -1 [0056.887] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*.*") returned="*.*" [0056.887] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0056.887] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0056.887] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0056.887] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0056.887] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Slate.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css" [0056.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.zip") returned 0 [0056.887] lstrlenA (lpString="*.zip") returned 5 [0056.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.rar") returned 0 [0056.887] lstrlenA (lpString="*.rar") returned 5 [0056.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.7z") returned 0 [0056.887] lstrlenA (lpString="*.7z") returned 4 [0056.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.tar") returned 0 [0056.887] lstrlenA (lpString="*.tar") returned 5 [0056.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.gzip") returned 0 [0056.887] lstrlenA (lpString="*.gzip") returned 6 [0056.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.jpg") returned 0 [0056.888] lstrlenA (lpString="*.jpg") returned 5 [0056.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.jpeg") returned 0 [0056.888] lstrlenA (lpString="*.jpeg") returned 6 [0056.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.psd") returned 0 [0056.888] lstrlenA (lpString="*.psd") returned 5 [0056.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.gif") returned 0 [0056.888] lstrlenA (lpString="*.gif") returned 5 [0056.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.doc") returned 0 [0056.888] lstrlenA (lpString="*.doc") returned 5 [0056.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.docx") returned 0 [0056.888] lstrlenA (lpString="*.docx") returned 6 [0056.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.xls") returned 0 [0056.888] lstrlenA (lpString="*.xls") returned 5 [0056.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.xlsx") returned 0 [0056.888] lstrlenA (lpString="*.xlsx") returned 6 [0056.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.ppt") returned 0 [0056.888] lstrlenA (lpString="*.ppt") returned 5 [0056.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.pptx") returned 0 [0056.889] lstrlenA (lpString="*.pptx") returned 6 [0056.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.pdf") returned 0 [0056.889] lstrlenA (lpString="*.pdf") returned 5 [0056.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.mov") returned 0 [0056.889] lstrlenA (lpString="*.mov") returned 5 [0056.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.m2v") returned 0 [0056.889] lstrlenA (lpString="*.m2v") returned 5 [0056.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.3gp") returned 0 [0056.889] lstrlenA (lpString="*.3gp") returned 5 [0056.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.mpeg") returned 0 [0056.889] lstrlenA (lpString="*.mpeg") returned 6 [0056.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.mpg") returned 0 [0056.889] lstrlenA (lpString="*.mpg") returned 5 [0056.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.flv") returned 0 [0056.889] lstrlenA (lpString="*.flv") returned 5 [0056.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.avi") returned 0 [0056.889] lstrlenA (lpString="*.avi") returned 5 [0056.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.mp4") returned 0 [0056.889] lstrlenA (lpString="*.mp4") returned 5 [0056.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.wmv") returned 0 [0056.889] lstrlenA (lpString="*.wmv") returned 5 [0056.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.divx") returned 0 [0056.889] lstrlenA (lpString="*.divx") returned 6 [0056.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.mkv") returned 0 [0056.889] lstrlenA (lpString="*.mkv") returned 5 [0056.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.mp3") returned 0 [0056.889] lstrlenA (lpString="*.mp3") returned 5 [0056.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.wav") returned 0 [0056.889] lstrlenA (lpString="*.wav") returned 5 [0056.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.flac") returned 0 [0056.890] lstrlenA (lpString="*.flac") returned 6 [0056.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.ape") returned 0 [0056.890] lstrlenA (lpString="*.ape") returned 5 [0056.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.wma") returned 0 [0056.890] lstrlenA (lpString="*.wma") returned 5 [0056.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.ac3") returned 0 [0056.890] lstrlenA (lpString="*.ac3") returned 5 [0056.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", pszSpec="*.mxf") returned 0 [0056.890] lstrlenA (lpString="*.mxf") returned 5 [0056.890] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x74e, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="SlateBlue.css", cAlternateFileName="SLATEB~1.CSS")) returned 1 [0056.890] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0056.890] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SlateBlue.css") returned -1 [0056.890] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SlateBlue.css") returned -1 [0056.890] lstrcmpiA (lpString1="", lpString2="SlateBlue.css") returned -1 [0056.890] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css") returned="Slate.css" [0056.890] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0056.890] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0056.890] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0056.890] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0056.890] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="SlateBlue.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css" [0056.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.zip") returned 0 [0056.890] lstrlenA (lpString="*.zip") returned 5 [0056.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.rar") returned 0 [0056.890] lstrlenA (lpString="*.rar") returned 5 [0056.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.7z") returned 0 [0056.891] lstrlenA (lpString="*.7z") returned 4 [0056.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.tar") returned 0 [0056.891] lstrlenA (lpString="*.tar") returned 5 [0056.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.gzip") returned 0 [0056.891] lstrlenA (lpString="*.gzip") returned 6 [0056.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.jpg") returned 0 [0056.891] lstrlenA (lpString="*.jpg") returned 5 [0056.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.jpeg") returned 0 [0056.891] lstrlenA (lpString="*.jpeg") returned 6 [0056.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.psd") returned 0 [0056.891] lstrlenA (lpString="*.psd") returned 5 [0056.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.gif") returned 0 [0056.891] lstrlenA (lpString="*.gif") returned 5 [0056.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.doc") returned 0 [0056.891] lstrlenA (lpString="*.doc") returned 5 [0056.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.docx") returned 0 [0056.891] lstrlenA (lpString="*.docx") returned 6 [0056.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.xls") returned 0 [0056.891] lstrlenA (lpString="*.xls") returned 5 [0056.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.xlsx") returned 0 [0056.891] lstrlenA (lpString="*.xlsx") returned 6 [0056.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.ppt") returned 0 [0056.891] lstrlenA (lpString="*.ppt") returned 5 [0056.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.pptx") returned 0 [0056.891] lstrlenA (lpString="*.pptx") returned 6 [0056.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.pdf") returned 0 [0056.891] lstrlenA (lpString="*.pdf") returned 5 [0056.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.mov") returned 0 [0056.891] lstrlenA (lpString="*.mov") returned 5 [0056.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.m2v") returned 0 [0056.891] lstrlenA (lpString="*.m2v") returned 5 [0056.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.3gp") returned 0 [0056.891] lstrlenA (lpString="*.3gp") returned 5 [0056.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.mpeg") returned 0 [0056.892] lstrlenA (lpString="*.mpeg") returned 6 [0056.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.mpg") returned 0 [0056.892] lstrlenA (lpString="*.mpg") returned 5 [0056.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.flv") returned 0 [0056.892] lstrlenA (lpString="*.flv") returned 5 [0056.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.avi") returned 0 [0056.892] lstrlenA (lpString="*.avi") returned 5 [0056.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.mp4") returned 0 [0056.892] lstrlenA (lpString="*.mp4") returned 5 [0056.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.wmv") returned 0 [0056.892] lstrlenA (lpString="*.wmv") returned 5 [0056.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.divx") returned 0 [0056.892] lstrlenA (lpString="*.divx") returned 6 [0056.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.mkv") returned 0 [0056.892] lstrlenA (lpString="*.mkv") returned 5 [0056.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.mp3") returned 0 [0056.892] lstrlenA (lpString="*.mp3") returned 5 [0056.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.wav") returned 0 [0056.892] lstrlenA (lpString="*.wav") returned 5 [0056.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.flac") returned 0 [0056.892] lstrlenA (lpString="*.flac") returned 6 [0056.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.ape") returned 0 [0056.892] lstrlenA (lpString="*.ape") returned 5 [0056.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.wma") returned 0 [0056.892] lstrlenA (lpString="*.wma") returned 5 [0056.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.ac3") returned 0 [0056.892] lstrlenA (lpString="*.ac3") returned 5 [0056.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", pszSpec="*.mxf") returned 0 [0056.892] lstrlenA (lpString="*.mxf") returned 5 [0056.892] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="SoftBlue", cAlternateFileName="")) returned 1 [0056.892] lstrcmpA (lpString1=".", lpString2="SoftBlue") returned -1 [0056.892] lstrcmpA (lpString1="..", lpString2="SoftBlue") returned -1 [0056.892] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css") returned="SlateBlue.css" [0056.892] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="SoftBlue" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue" [0056.893] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue") returned 81 [0056.893] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2d8252, cFileName=".", cAlternateFileName="")) returned 0x2d80a8 [0056.893] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0056.893] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0056.893] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0056.893] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0056.893] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1afa, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0056.893] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.893] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="background.gif") returned 1 [0056.893] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1 [0056.893] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1 [0056.893] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\*.*") returned="*.*" [0056.893] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\" [0056.893] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\") returned="" [0056.893] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt" [0056.893] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\how to decrypt files.txt")) returned 0xffffffff [0056.893] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.895] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0056.895] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0056.896] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0056.896] CloseHandle (hObject=0x98) returned 1 [0056.896] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif" [0056.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.zip") returned 0 [0056.896] lstrlenA (lpString="*.zip") returned 5 [0056.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.rar") returned 0 [0056.896] lstrlenA (lpString="*.rar") returned 5 [0056.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.7z") returned 0 [0056.896] lstrlenA (lpString="*.7z") returned 4 [0056.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.tar") returned 0 [0056.896] lstrlenA (lpString="*.tar") returned 5 [0056.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.gzip") returned 0 [0056.896] lstrlenA (lpString="*.gzip") returned 6 [0056.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.jpg") returned 0 [0056.896] lstrlenA (lpString="*.jpg") returned 5 [0056.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.jpeg") returned 0 [0056.897] lstrlenA (lpString="*.jpeg") returned 6 [0056.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.psd") returned 0 [0056.897] lstrlenA (lpString="*.psd") returned 5 [0056.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.gif") returned 1 [0056.897] lstrlenA (lpString="*.gif") returned 5 [0056.897] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif" [0056.897] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif" [0056.897] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif." [0056.897] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif.wannacry" [0056.897] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.898] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1afa [0056.898] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcd8f7a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd54e650, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcd8f7a00, dwHighDateTime=0x1c747ea)) returned 1 [0056.898] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.898] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1a7c, lpOverlapped=0x0) returned 1 [0056.950] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif") returned="background.gif" [0056.950] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.950] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1a7c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1a7c, lpOverlapped=0x0) returned 1 [0056.950] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.950] CloseHandle (hObject=0x98) returned 1 [0056.950] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\background.gif.wannacry")) returned 1 [0056.951] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0056.951] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.951] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0056.952] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0056.952] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0056.952] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif") returned="background.gif" [0056.952] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\" [0056.952] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\") returned="" [0056.952] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt" [0056.952] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\how to decrypt files.txt")) returned 0x20 [0056.952] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" [0056.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0056.952] lstrlenA (lpString="*.zip") returned 5 [0056.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0056.952] lstrlenA (lpString="*.rar") returned 5 [0056.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0056.952] lstrlenA (lpString="*.7z") returned 4 [0056.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0056.952] lstrlenA (lpString="*.tar") returned 5 [0056.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0056.952] lstrlenA (lpString="*.gzip") returned 6 [0056.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0056.952] lstrlenA (lpString="*.jpg") returned 5 [0056.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0056.953] lstrlenA (lpString="*.jpeg") returned 6 [0056.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0056.953] lstrlenA (lpString="*.psd") returned 5 [0056.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0056.953] lstrlenA (lpString="*.gif") returned 5 [0056.953] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" [0056.953] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" [0056.953] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF." [0056.953] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.wannacry" [0056.953] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.953] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0056.953] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcd8f7a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd54e650, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcd8f7a00, dwHighDateTime=0x1c747ea)) returned 1 [0056.953] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.954] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd7, lpOverlapped=0x0) returned 1 [0056.955] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0056.955] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.955] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd7, lpOverlapped=0x0) returned 1 [0056.955] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.955] CloseHandle (hObject=0x98) returned 1 [0056.955] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_off.gif.wannacry")) returned 1 [0056.956] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0056.956] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0056.956] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0056.956] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0056.956] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0056.956] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0056.956] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\" [0056.956] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\") returned="" [0056.956] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt" [0056.956] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\how to decrypt files.txt")) returned 0x20 [0056.956] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF" [0056.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0056.956] lstrlenA (lpString="*.zip") returned 5 [0056.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0056.956] lstrlenA (lpString="*.rar") returned 5 [0056.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0056.956] lstrlenA (lpString="*.7z") returned 4 [0056.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0056.956] lstrlenA (lpString="*.tar") returned 5 [0056.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0056.956] lstrlenA (lpString="*.gzip") returned 6 [0056.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0056.956] lstrlenA (lpString="*.jpg") returned 5 [0056.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0056.956] lstrlenA (lpString="*.jpeg") returned 6 [0056.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0056.957] lstrlenA (lpString="*.psd") returned 5 [0056.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0056.957] lstrlenA (lpString="*.gif") returned 5 [0056.957] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF" [0056.957] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF" [0056.957] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF." [0056.957] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF.wannacry" [0056.957] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0056.957] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0056.957] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcec0a700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd54e650, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcec0a700, dwHighDateTime=0x1c747ea)) returned 1 [0056.957] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.957] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60, lpOverlapped=0x0) returned 1 [0056.958] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF") returned="TAB_ON.GIF" [0056.958] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0056.958] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60, lpOverlapped=0x0) returned 1 [0056.958] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0056.958] CloseHandle (hObject=0x98) returned 1 [0056.958] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_on.gif.wannacry")) returned 1 [0056.959] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0056.959] FindClose (in: hFindFile=0x2d80a8 | out: hFindFile=0x2d80a8) returned 1 [0056.959] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="SoftBlue.css", cAlternateFileName="")) returned 1 [0056.959] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0056.959] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SoftBlue.css") returned -1 [0056.959] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SoftBlue.css") returned -1 [0056.959] lstrcmpiA (lpString1="", lpString2="SoftBlue.css") returned -1 [0056.959] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*.*") returned="*.*" [0056.959] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0056.959] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0056.960] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0056.960] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0056.960] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="SoftBlue.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css" [0056.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.zip") returned 0 [0056.960] lstrlenA (lpString="*.zip") returned 5 [0056.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.rar") returned 0 [0056.960] lstrlenA (lpString="*.rar") returned 5 [0056.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.7z") returned 0 [0056.960] lstrlenA (lpString="*.7z") returned 4 [0056.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.tar") returned 0 [0056.960] lstrlenA (lpString="*.tar") returned 5 [0056.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.gzip") returned 0 [0056.960] lstrlenA (lpString="*.gzip") returned 6 [0056.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.jpg") returned 0 [0056.960] lstrlenA (lpString="*.jpg") returned 5 [0056.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.jpeg") returned 0 [0056.960] lstrlenA (lpString="*.jpeg") returned 6 [0056.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.psd") returned 0 [0056.960] lstrlenA (lpString="*.psd") returned 5 [0056.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.gif") returned 0 [0056.960] lstrlenA (lpString="*.gif") returned 5 [0056.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.doc") returned 0 [0056.960] lstrlenA (lpString="*.doc") returned 5 [0056.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.docx") returned 0 [0056.960] lstrlenA (lpString="*.docx") returned 6 [0056.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.xls") returned 0 [0056.960] lstrlenA (lpString="*.xls") returned 5 [0056.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.xlsx") returned 0 [0056.960] lstrlenA (lpString="*.xlsx") returned 6 [0056.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.ppt") returned 0 [0056.961] lstrlenA (lpString="*.ppt") returned 5 [0056.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.pptx") returned 0 [0056.961] lstrlenA (lpString="*.pptx") returned 6 [0056.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.pdf") returned 0 [0056.961] lstrlenA (lpString="*.pdf") returned 5 [0056.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.mov") returned 0 [0056.961] lstrlenA (lpString="*.mov") returned 5 [0056.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.m2v") returned 0 [0056.961] lstrlenA (lpString="*.m2v") returned 5 [0056.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.3gp") returned 0 [0056.961] lstrlenA (lpString="*.3gp") returned 5 [0056.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.mpeg") returned 0 [0056.961] lstrlenA (lpString="*.mpeg") returned 6 [0056.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.mpg") returned 0 [0056.961] lstrlenA (lpString="*.mpg") returned 5 [0056.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.flv") returned 0 [0056.961] lstrlenA (lpString="*.flv") returned 5 [0056.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.avi") returned 0 [0056.961] lstrlenA (lpString="*.avi") returned 5 [0056.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.mp4") returned 0 [0056.961] lstrlenA (lpString="*.mp4") returned 5 [0056.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.wmv") returned 0 [0056.961] lstrlenA (lpString="*.wmv") returned 5 [0056.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.divx") returned 0 [0056.961] lstrlenA (lpString="*.divx") returned 6 [0056.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.mkv") returned 0 [0056.961] lstrlenA (lpString="*.mkv") returned 5 [0056.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.mp3") returned 0 [0056.961] lstrlenA (lpString="*.mp3") returned 5 [0056.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.wav") returned 0 [0056.962] lstrlenA (lpString="*.wav") returned 5 [0056.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.flac") returned 0 [0056.962] lstrlenA (lpString="*.flac") returned 6 [0056.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.ape") returned 0 [0056.962] lstrlenA (lpString="*.ape") returned 5 [0056.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.wma") returned 0 [0056.962] lstrlenA (lpString="*.wma") returned 5 [0056.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.ac3") returned 0 [0056.962] lstrlenA (lpString="*.ac3") returned 5 [0056.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", pszSpec="*.mxf") returned 0 [0056.962] lstrlenA (lpString="*.mxf") returned 5 [0056.962] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd67f150, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6a52b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Solutions", cAlternateFileName="SOLUTI~1")) returned 1 [0056.962] lstrcmpA (lpString1=".", lpString2="Solutions") returned -1 [0056.962] lstrcmpA (lpString1="..", lpString2="Solutions") returned -1 [0056.962] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css") returned="SoftBlue.css" [0056.962] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Solutions" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions" [0056.962] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions") returned 82 [0056.962] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd67f150, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6a52b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2d8252, cFileName=".", cAlternateFileName="")) returned 0x2d80a8 [0057.029] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.029] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd67f150, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6a52b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.030] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.030] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.030] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="arrow.png", cAlternateFileName="")) returned 1 [0057.030] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0057.030] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="arrow.png") returned 1 [0057.030] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="arrow.png") returned 1 [0057.030] lstrcmpiA (lpString1="", lpString2="arrow.png") returned -1 [0057.030] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\*.*") returned="*.*" [0057.030] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\" [0057.030] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\") returned="" [0057.030] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\HOW TO DECRYPT FILES.txt" [0057.030] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\how to decrypt files.txt")) returned 0xffffffff [0057.030] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0057.034] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0057.034] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0057.035] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.036] CloseHandle (hObject=0x98) returned 1 [0057.036] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\", lpString2="arrow.png" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png" [0057.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.zip") returned 0 [0057.036] lstrlenA (lpString="*.zip") returned 5 [0057.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.rar") returned 0 [0057.036] lstrlenA (lpString="*.rar") returned 5 [0057.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.7z") returned 0 [0057.036] lstrlenA (lpString="*.7z") returned 4 [0057.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.tar") returned 0 [0057.036] lstrlenA (lpString="*.tar") returned 5 [0057.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.gzip") returned 0 [0057.036] lstrlenA (lpString="*.gzip") returned 6 [0057.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.jpg") returned 0 [0057.036] lstrlenA (lpString="*.jpg") returned 5 [0057.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.jpeg") returned 0 [0057.036] lstrlenA (lpString="*.jpeg") returned 6 [0057.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.psd") returned 0 [0057.036] lstrlenA (lpString="*.psd") returned 5 [0057.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.gif") returned 0 [0057.036] lstrlenA (lpString="*.gif") returned 5 [0057.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.doc") returned 0 [0057.036] lstrlenA (lpString="*.doc") returned 5 [0057.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.docx") returned 0 [0057.036] lstrlenA (lpString="*.docx") returned 6 [0057.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.xls") returned 0 [0057.037] lstrlenA (lpString="*.xls") returned 5 [0057.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.xlsx") returned 0 [0057.037] lstrlenA (lpString="*.xlsx") returned 6 [0057.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.ppt") returned 0 [0057.037] lstrlenA (lpString="*.ppt") returned 5 [0057.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.pptx") returned 0 [0057.037] lstrlenA (lpString="*.pptx") returned 6 [0057.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.pdf") returned 0 [0057.037] lstrlenA (lpString="*.pdf") returned 5 [0057.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.mov") returned 0 [0057.037] lstrlenA (lpString="*.mov") returned 5 [0057.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.m2v") returned 0 [0057.037] lstrlenA (lpString="*.m2v") returned 5 [0057.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.3gp") returned 0 [0057.037] lstrlenA (lpString="*.3gp") returned 5 [0057.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.mpeg") returned 0 [0057.037] lstrlenA (lpString="*.mpeg") returned 6 [0057.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.mpg") returned 0 [0057.037] lstrlenA (lpString="*.mpg") returned 5 [0057.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.flv") returned 0 [0057.037] lstrlenA (lpString="*.flv") returned 5 [0057.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.avi") returned 0 [0057.037] lstrlenA (lpString="*.avi") returned 5 [0057.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.mp4") returned 0 [0057.037] lstrlenA (lpString="*.mp4") returned 5 [0057.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.wmv") returned 0 [0057.037] lstrlenA (lpString="*.wmv") returned 5 [0057.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.divx") returned 0 [0057.038] lstrlenA (lpString="*.divx") returned 6 [0057.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.mkv") returned 0 [0057.038] lstrlenA (lpString="*.mkv") returned 5 [0057.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.mp3") returned 0 [0057.038] lstrlenA (lpString="*.mp3") returned 5 [0057.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.wav") returned 0 [0057.038] lstrlenA (lpString="*.wav") returned 5 [0057.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.flac") returned 0 [0057.038] lstrlenA (lpString="*.flac") returned 6 [0057.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.ape") returned 0 [0057.038] lstrlenA (lpString="*.ape") returned 5 [0057.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.wma") returned 0 [0057.038] lstrlenA (lpString="*.wma") returned 5 [0057.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.ac3") returned 0 [0057.038] lstrlenA (lpString="*.ac3") returned 5 [0057.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", pszSpec="*.mxf") returned 0 [0057.038] lstrlenA (lpString="*.mxf") returned 5 [0057.038] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x931, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document.gif", cAlternateFileName="")) returned 1 [0057.038] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0057.038] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Document.gif") returned 1 [0057.038] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Document.gif") returned 1 [0057.038] lstrcmpiA (lpString1="", lpString2="Document.gif") returned -1 [0057.038] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png") returned="arrow.png" [0057.038] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\" [0057.038] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\") returned="" [0057.038] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\HOW TO DECRYPT FILES.txt" [0057.039] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\how to decrypt files.txt")) returned 0x20 [0057.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\", lpString2="Document.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif" [0057.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif", pszSpec="*.zip") returned 0 [0057.039] lstrlenA (lpString="*.zip") returned 5 [0057.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif", pszSpec="*.rar") returned 0 [0057.039] lstrlenA (lpString="*.rar") returned 5 [0057.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif", pszSpec="*.7z") returned 0 [0057.039] lstrlenA (lpString="*.7z") returned 4 [0057.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif", pszSpec="*.tar") returned 0 [0057.039] lstrlenA (lpString="*.tar") returned 5 [0057.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif", pszSpec="*.gzip") returned 0 [0057.039] lstrlenA (lpString="*.gzip") returned 6 [0057.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif", pszSpec="*.jpg") returned 0 [0057.039] lstrlenA (lpString="*.jpg") returned 5 [0057.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif", pszSpec="*.jpeg") returned 0 [0057.039] lstrlenA (lpString="*.jpeg") returned 6 [0057.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif", pszSpec="*.psd") returned 0 [0057.039] lstrlenA (lpString="*.psd") returned 5 [0057.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif", pszSpec="*.gif") returned 1 [0057.039] lstrlenA (lpString="*.gif") returned 5 [0057.039] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif" [0057.039] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif" [0057.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif." [0057.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif.wannacry" [0057.040] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\document.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0057.041] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x931 [0057.041] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcec0a700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd67f150, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcec0a700, dwHighDateTime=0x1c747ea)) returned 1 [0057.041] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.041] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x8b3, lpOverlapped=0x0) returned 1 [0057.208] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif") returned="Document.gif" [0057.208] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.208] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x8b3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x8b3, lpOverlapped=0x0) returned 1 [0057.208] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0057.209] CloseHandle (hObject=0x98) returned 1 [0057.209] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\document.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\document.gif.wannacry")) returned 1 [0057.210] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x832, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="Generic.gif", cAlternateFileName="")) returned 1 [0057.210] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0057.210] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Generic.gif") returned -1 [0057.210] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Generic.gif") returned 1 [0057.210] lstrcmpiA (lpString1="", lpString2="Generic.gif") returned -1 [0057.210] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif") returned="Document.gif" [0057.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\" [0057.210] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\") returned="" [0057.210] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\HOW TO DECRYPT FILES.txt" [0057.210] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\how to decrypt files.txt")) returned 0x20 [0057.210] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\", lpString2="Generic.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif" [0057.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif", pszSpec="*.zip") returned 0 [0057.210] lstrlenA (lpString="*.zip") returned 5 [0057.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif", pszSpec="*.rar") returned 0 [0057.210] lstrlenA (lpString="*.rar") returned 5 [0057.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif", pszSpec="*.7z") returned 0 [0057.210] lstrlenA (lpString="*.7z") returned 4 [0057.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif", pszSpec="*.tar") returned 0 [0057.210] lstrlenA (lpString="*.tar") returned 5 [0057.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif", pszSpec="*.gzip") returned 0 [0057.210] lstrlenA (lpString="*.gzip") returned 6 [0057.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif", pszSpec="*.jpg") returned 0 [0057.210] lstrlenA (lpString="*.jpg") returned 5 [0057.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif", pszSpec="*.jpeg") returned 0 [0057.210] lstrlenA (lpString="*.jpeg") returned 6 [0057.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif", pszSpec="*.psd") returned 0 [0057.211] lstrlenA (lpString="*.psd") returned 5 [0057.211] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif", pszSpec="*.gif") returned 1 [0057.211] lstrlenA (lpString="*.gif") returned 5 [0057.211] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif" [0057.211] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif" [0057.211] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif." [0057.211] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif.wannacry" [0057.211] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\generic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0057.211] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x832 [0057.211] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcec0a700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd6a52b0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcec0a700, dwHighDateTime=0x1c747ea)) returned 1 [0057.211] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.211] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x7b4, lpOverlapped=0x0) returned 1 [0057.222] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif") returned="Generic.gif" [0057.222] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.222] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x7b4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x7b4, lpOverlapped=0x0) returned 1 [0057.223] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0057.223] CloseHandle (hObject=0x98) returned 1 [0057.223] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\generic.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\generic.gif.wannacry")) returned 1 [0057.224] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="gradient.png", cAlternateFileName="")) returned 1 [0057.224] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0057.224] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="gradient.png") returned -1 [0057.224] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="gradient.png") returned 1 [0057.224] lstrcmpiA (lpString1="", lpString2="gradient.png") returned -1 [0057.224] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif") returned="Generic.gif" [0057.224] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\" [0057.224] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\") returned="" [0057.224] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\HOW TO DECRYPT FILES.txt" [0057.224] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\how to decrypt files.txt")) returned 0x20 [0057.224] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\", lpString2="gradient.png" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png" [0057.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.zip") returned 0 [0057.224] lstrlenA (lpString="*.zip") returned 5 [0057.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.rar") returned 0 [0057.224] lstrlenA (lpString="*.rar") returned 5 [0057.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.7z") returned 0 [0057.224] lstrlenA (lpString="*.7z") returned 4 [0057.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.tar") returned 0 [0057.224] lstrlenA (lpString="*.tar") returned 5 [0057.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.gzip") returned 0 [0057.224] lstrlenA (lpString="*.gzip") returned 6 [0057.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.jpg") returned 0 [0057.224] lstrlenA (lpString="*.jpg") returned 5 [0057.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.jpeg") returned 0 [0057.224] lstrlenA (lpString="*.jpeg") returned 6 [0057.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.psd") returned 0 [0057.225] lstrlenA (lpString="*.psd") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.gif") returned 0 [0057.225] lstrlenA (lpString="*.gif") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.doc") returned 0 [0057.225] lstrlenA (lpString="*.doc") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.docx") returned 0 [0057.225] lstrlenA (lpString="*.docx") returned 6 [0057.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.xls") returned 0 [0057.225] lstrlenA (lpString="*.xls") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.xlsx") returned 0 [0057.225] lstrlenA (lpString="*.xlsx") returned 6 [0057.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.ppt") returned 0 [0057.225] lstrlenA (lpString="*.ppt") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.pptx") returned 0 [0057.225] lstrlenA (lpString="*.pptx") returned 6 [0057.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.pdf") returned 0 [0057.225] lstrlenA (lpString="*.pdf") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.mov") returned 0 [0057.225] lstrlenA (lpString="*.mov") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.m2v") returned 0 [0057.225] lstrlenA (lpString="*.m2v") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.3gp") returned 0 [0057.225] lstrlenA (lpString="*.3gp") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.mpeg") returned 0 [0057.225] lstrlenA (lpString="*.mpeg") returned 6 [0057.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.mpg") returned 0 [0057.225] lstrlenA (lpString="*.mpg") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.flv") returned 0 [0057.225] lstrlenA (lpString="*.flv") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.avi") returned 0 [0057.225] lstrlenA (lpString="*.avi") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.mp4") returned 0 [0057.225] lstrlenA (lpString="*.mp4") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.wmv") returned 0 [0057.225] lstrlenA (lpString="*.wmv") returned 5 [0057.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.divx") returned 0 [0057.226] lstrlenA (lpString="*.divx") returned 6 [0057.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.mkv") returned 0 [0057.226] lstrlenA (lpString="*.mkv") returned 5 [0057.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.mp3") returned 0 [0057.226] lstrlenA (lpString="*.mp3") returned 5 [0057.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.wav") returned 0 [0057.226] lstrlenA (lpString="*.wav") returned 5 [0057.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.flac") returned 0 [0057.226] lstrlenA (lpString="*.flac") returned 6 [0057.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.ape") returned 0 [0057.226] lstrlenA (lpString="*.ape") returned 5 [0057.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.wma") returned 0 [0057.226] lstrlenA (lpString="*.wma") returned 5 [0057.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.ac3") returned 0 [0057.226] lstrlenA (lpString="*.ac3") returned 5 [0057.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", pszSpec="*.mxf") returned 0 [0057.226] lstrlenA (lpString="*.mxf") returned 5 [0057.226] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="Main.gif", cAlternateFileName="")) returned 1 [0057.226] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0057.226] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Main.gif") returned -1 [0057.226] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Main.gif") returned -1 [0057.226] lstrcmpiA (lpString1="", lpString2="Main.gif") returned -1 [0057.226] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png") returned="gradient.png" [0057.226] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\" [0057.226] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\") returned="" [0057.226] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\HOW TO DECRYPT FILES.txt" [0057.226] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\how to decrypt files.txt")) returned 0x20 [0057.226] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\", lpString2="Main.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif" [0057.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif", pszSpec="*.zip") returned 0 [0057.226] lstrlenA (lpString="*.zip") returned 5 [0057.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif", pszSpec="*.rar") returned 0 [0057.226] lstrlenA (lpString="*.rar") returned 5 [0057.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif", pszSpec="*.7z") returned 0 [0057.227] lstrlenA (lpString="*.7z") returned 4 [0057.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif", pszSpec="*.tar") returned 0 [0057.227] lstrlenA (lpString="*.tar") returned 5 [0057.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif", pszSpec="*.gzip") returned 0 [0057.227] lstrlenA (lpString="*.gzip") returned 6 [0057.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif", pszSpec="*.jpg") returned 0 [0057.227] lstrlenA (lpString="*.jpg") returned 5 [0057.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif", pszSpec="*.jpeg") returned 0 [0057.227] lstrlenA (lpString="*.jpeg") returned 6 [0057.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif", pszSpec="*.psd") returned 0 [0057.227] lstrlenA (lpString="*.psd") returned 5 [0057.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif", pszSpec="*.gif") returned 1 [0057.227] lstrlenA (lpString="*.gif") returned 5 [0057.227] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif" [0057.227] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif" [0057.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif." [0057.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif.wannacry" [0057.227] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\main.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0057.228] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x634 [0057.228] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcec0a700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd6a52b0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcec0a700, dwHighDateTime=0x1c747ea)) returned 1 [0057.228] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.228] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x5b6, lpOverlapped=0x0) returned 1 [0057.237] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif") returned="Main.gif" [0057.237] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.237] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x5b6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x5b6, lpOverlapped=0x0) returned 1 [0057.237] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0057.238] CloseHandle (hObject=0x98) returned 1 [0057.238] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\main.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\main.gif.wannacry")) returned 1 [0057.238] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x96a, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="Person.gif", cAlternateFileName="")) returned 1 [0057.239] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0057.239] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Person.gif") returned -1 [0057.239] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Person.gif") returned -1 [0057.239] lstrcmpiA (lpString1="", lpString2="Person.gif") returned -1 [0057.239] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif") returned="Main.gif" [0057.239] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\" [0057.239] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\") returned="" [0057.239] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\HOW TO DECRYPT FILES.txt" [0057.239] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\how to decrypt files.txt")) returned 0x20 [0057.239] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\", lpString2="Person.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif" [0057.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif", pszSpec="*.zip") returned 0 [0057.239] lstrlenA (lpString="*.zip") returned 5 [0057.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif", pszSpec="*.rar") returned 0 [0057.239] lstrlenA (lpString="*.rar") returned 5 [0057.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif", pszSpec="*.7z") returned 0 [0057.239] lstrlenA (lpString="*.7z") returned 4 [0057.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif", pszSpec="*.tar") returned 0 [0057.239] lstrlenA (lpString="*.tar") returned 5 [0057.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif", pszSpec="*.gzip") returned 0 [0057.239] lstrlenA (lpString="*.gzip") returned 6 [0057.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif", pszSpec="*.jpg") returned 0 [0057.239] lstrlenA (lpString="*.jpg") returned 5 [0057.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif", pszSpec="*.jpeg") returned 0 [0057.239] lstrlenA (lpString="*.jpeg") returned 6 [0057.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif", pszSpec="*.psd") returned 0 [0057.239] lstrlenA (lpString="*.psd") returned 5 [0057.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif", pszSpec="*.gif") returned 1 [0057.240] lstrlenA (lpString="*.gif") returned 5 [0057.240] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif" [0057.240] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif" [0057.240] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif." [0057.240] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif.wannacry" [0057.240] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\person.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0057.240] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x96a [0057.240] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcec0a700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd6a52b0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcec0a700, dwHighDateTime=0x1c747ea)) returned 1 [0057.240] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.240] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x8ec, lpOverlapped=0x0) returned 1 [0057.511] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif") returned="Person.gif" [0057.511] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.511] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x8ec, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x8ec, lpOverlapped=0x0) returned 1 [0057.511] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0057.511] CloseHandle (hObject=0x98) returned 1 [0057.511] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\person.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\person.gif.wannacry")) returned 1 [0057.512] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x68e, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="Response.gif", cAlternateFileName="")) returned 1 [0057.512] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0057.512] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Response.gif") returned -1 [0057.512] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Response.gif") returned -1 [0057.512] lstrcmpiA (lpString1="", lpString2="Response.gif") returned -1 [0057.512] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif") returned="Person.gif" [0057.512] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\" [0057.512] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\") returned="" [0057.513] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\HOW TO DECRYPT FILES.txt" [0057.513] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\how to decrypt files.txt")) returned 0x20 [0057.513] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\", lpString2="Response.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif" [0057.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif", pszSpec="*.zip") returned 0 [0057.520] lstrlenA (lpString="*.zip") returned 5 [0057.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif", pszSpec="*.rar") returned 0 [0057.520] lstrlenA (lpString="*.rar") returned 5 [0057.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif", pszSpec="*.7z") returned 0 [0057.521] lstrlenA (lpString="*.7z") returned 4 [0057.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif", pszSpec="*.tar") returned 0 [0057.521] lstrlenA (lpString="*.tar") returned 5 [0057.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif", pszSpec="*.gzip") returned 0 [0057.521] lstrlenA (lpString="*.gzip") returned 6 [0057.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif", pszSpec="*.jpg") returned 0 [0057.521] lstrlenA (lpString="*.jpg") returned 5 [0057.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif", pszSpec="*.jpeg") returned 0 [0057.521] lstrlenA (lpString="*.jpeg") returned 6 [0057.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif", pszSpec="*.psd") returned 0 [0057.521] lstrlenA (lpString="*.psd") returned 5 [0057.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif", pszSpec="*.gif") returned 1 [0057.521] lstrlenA (lpString="*.gif") returned 5 [0057.521] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif" [0057.521] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif" [0057.521] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif." [0057.521] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif.wannacry" [0057.521] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\response.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0057.522] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x68e [0057.522] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcec0a700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd6a52b0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcec0a700, dwHighDateTime=0x1c747ea)) returned 1 [0057.523] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.523] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x610, lpOverlapped=0x0) returned 1 [0057.540] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif") returned="Response.gif" [0057.540] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.540] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x610, lpOverlapped=0x0) returned 1 [0057.540] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0057.540] CloseHandle (hObject=0x98) returned 1 [0057.540] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\response.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\response.gif.wannacry")) returned 1 [0057.541] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x68e, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="Response.gif", cAlternateFileName="")) returned 0 [0057.541] FindClose (in: hFindFile=0x2d80a8 | out: hFindFile=0x2d80a8) returned 1 [0057.541] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x19cc, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="Solutions.css", cAlternateFileName="SOLUTI~1.CSS")) returned 1 [0057.541] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0057.541] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Solutions.css") returned -1 [0057.541] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Solutions.css") returned -1 [0057.541] lstrcmpiA (lpString1="", lpString2="Solutions.css") returned -1 [0057.542] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*.*") returned="*.*" [0057.542] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0057.542] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0057.542] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0057.542] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0057.542] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Solutions.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css" [0057.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.zip") returned 0 [0057.542] lstrlenA (lpString="*.zip") returned 5 [0057.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.rar") returned 0 [0057.542] lstrlenA (lpString="*.rar") returned 5 [0057.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.7z") returned 0 [0057.542] lstrlenA (lpString="*.7z") returned 4 [0057.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.tar") returned 0 [0057.542] lstrlenA (lpString="*.tar") returned 5 [0057.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.gzip") returned 0 [0057.542] lstrlenA (lpString="*.gzip") returned 6 [0057.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.jpg") returned 0 [0057.542] lstrlenA (lpString="*.jpg") returned 5 [0057.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.jpeg") returned 0 [0057.542] lstrlenA (lpString="*.jpeg") returned 6 [0057.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.psd") returned 0 [0057.542] lstrlenA (lpString="*.psd") returned 5 [0057.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.gif") returned 0 [0057.542] lstrlenA (lpString="*.gif") returned 5 [0057.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.doc") returned 0 [0057.542] lstrlenA (lpString="*.doc") returned 5 [0057.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.docx") returned 0 [0057.542] lstrlenA (lpString="*.docx") returned 6 [0057.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.xls") returned 0 [0057.542] lstrlenA (lpString="*.xls") returned 5 [0057.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.xlsx") returned 0 [0057.543] lstrlenA (lpString="*.xlsx") returned 6 [0057.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.ppt") returned 0 [0057.543] lstrlenA (lpString="*.ppt") returned 5 [0057.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.pptx") returned 0 [0057.543] lstrlenA (lpString="*.pptx") returned 6 [0057.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.pdf") returned 0 [0057.543] lstrlenA (lpString="*.pdf") returned 5 [0057.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.mov") returned 0 [0057.543] lstrlenA (lpString="*.mov") returned 5 [0057.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.m2v") returned 0 [0057.543] lstrlenA (lpString="*.m2v") returned 5 [0057.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.3gp") returned 0 [0057.543] lstrlenA (lpString="*.3gp") returned 5 [0057.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.mpeg") returned 0 [0057.543] lstrlenA (lpString="*.mpeg") returned 6 [0057.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.mpg") returned 0 [0057.543] lstrlenA (lpString="*.mpg") returned 5 [0057.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.flv") returned 0 [0057.543] lstrlenA (lpString="*.flv") returned 5 [0057.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.avi") returned 0 [0057.543] lstrlenA (lpString="*.avi") returned 5 [0057.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.mp4") returned 0 [0057.543] lstrlenA (lpString="*.mp4") returned 5 [0057.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.wmv") returned 0 [0057.543] lstrlenA (lpString="*.wmv") returned 5 [0057.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.divx") returned 0 [0057.543] lstrlenA (lpString="*.divx") returned 6 [0057.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.mkv") returned 0 [0057.543] lstrlenA (lpString="*.mkv") returned 5 [0057.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.mp3") returned 0 [0057.543] lstrlenA (lpString="*.mp3") returned 5 [0057.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.wav") returned 0 [0057.543] lstrlenA (lpString="*.wav") returned 5 [0057.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.flac") returned 0 [0057.543] lstrlenA (lpString="*.flac") returned 6 [0057.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.ape") returned 0 [0057.544] lstrlenA (lpString="*.ape") returned 5 [0057.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.wma") returned 0 [0057.544] lstrlenA (lpString="*.wma") returned 5 [0057.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.ac3") returned 0 [0057.544] lstrlenA (lpString="*.ac3") returned 5 [0057.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", pszSpec="*.mxf") returned 0 [0057.544] lstrlenA (lpString="*.mxf") returned 5 [0057.544] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Solutions_Doc.css", cAlternateFileName="SOLUTI~2.CSS")) returned 1 [0057.544] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0057.544] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Solutions_Doc.css") returned -1 [0057.544] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Solutions_Doc.css") returned -1 [0057.544] lstrcmpiA (lpString1="", lpString2="Solutions_Doc.css") returned -1 [0057.544] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css") returned="Solutions.css" [0057.544] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0057.544] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0057.544] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0057.544] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0057.544] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Solutions_Doc.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css" [0057.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.zip") returned 0 [0057.544] lstrlenA (lpString="*.zip") returned 5 [0057.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.rar") returned 0 [0057.544] lstrlenA (lpString="*.rar") returned 5 [0057.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.7z") returned 0 [0057.544] lstrlenA (lpString="*.7z") returned 4 [0057.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.tar") returned 0 [0057.544] lstrlenA (lpString="*.tar") returned 5 [0057.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.gzip") returned 0 [0057.544] lstrlenA (lpString="*.gzip") returned 6 [0057.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.jpg") returned 0 [0057.544] lstrlenA (lpString="*.jpg") returned 5 [0057.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.jpeg") returned 0 [0057.544] lstrlenA (lpString="*.jpeg") returned 6 [0057.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.psd") returned 0 [0057.545] lstrlenA (lpString="*.psd") returned 5 [0057.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.gif") returned 0 [0057.545] lstrlenA (lpString="*.gif") returned 5 [0057.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.doc") returned 0 [0057.545] lstrlenA (lpString="*.doc") returned 5 [0057.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.docx") returned 0 [0057.545] lstrlenA (lpString="*.docx") returned 6 [0057.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.xls") returned 0 [0057.545] lstrlenA (lpString="*.xls") returned 5 [0057.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.xlsx") returned 0 [0057.545] lstrlenA (lpString="*.xlsx") returned 6 [0057.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.ppt") returned 0 [0057.545] lstrlenA (lpString="*.ppt") returned 5 [0057.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.pptx") returned 0 [0057.545] lstrlenA (lpString="*.pptx") returned 6 [0057.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.pdf") returned 0 [0057.545] lstrlenA (lpString="*.pdf") returned 5 [0057.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.mov") returned 0 [0057.545] lstrlenA (lpString="*.mov") returned 5 [0057.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.m2v") returned 0 [0057.545] lstrlenA (lpString="*.m2v") returned 5 [0057.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.3gp") returned 0 [0057.545] lstrlenA (lpString="*.3gp") returned 5 [0057.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.mpeg") returned 0 [0057.545] lstrlenA (lpString="*.mpeg") returned 6 [0057.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.mpg") returned 0 [0057.545] lstrlenA (lpString="*.mpg") returned 5 [0057.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.flv") returned 0 [0057.545] lstrlenA (lpString="*.flv") returned 5 [0057.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.avi") returned 0 [0057.545] lstrlenA (lpString="*.avi") returned 5 [0057.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.mp4") returned 0 [0057.545] lstrlenA (lpString="*.mp4") returned 5 [0057.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.wmv") returned 0 [0057.545] lstrlenA (lpString="*.wmv") returned 5 [0057.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.divx") returned 0 [0057.546] lstrlenA (lpString="*.divx") returned 6 [0057.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.mkv") returned 0 [0057.546] lstrlenA (lpString="*.mkv") returned 5 [0057.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.mp3") returned 0 [0057.546] lstrlenA (lpString="*.mp3") returned 5 [0057.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.wav") returned 0 [0057.546] lstrlenA (lpString="*.wav") returned 5 [0057.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.flac") returned 0 [0057.546] lstrlenA (lpString="*.flac") returned 6 [0057.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.ape") returned 0 [0057.546] lstrlenA (lpString="*.ape") returned 5 [0057.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.wma") returned 0 [0057.546] lstrlenA (lpString="*.wma") returned 5 [0057.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.ac3") returned 0 [0057.546] lstrlenA (lpString="*.ac3") returned 5 [0057.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", pszSpec="*.mxf") returned 0 [0057.546] lstrlenA (lpString="*.mxf") returned 5 [0057.546] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Solutions_Generic.css", cAlternateFileName="SOLUTI~3.CSS")) returned 1 [0057.546] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0057.546] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Solutions_Generic.css") returned -1 [0057.546] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Solutions_Generic.css") returned -1 [0057.546] lstrcmpiA (lpString1="", lpString2="Solutions_Generic.css") returned -1 [0057.546] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css") returned="Solutions_Doc.css" [0057.546] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0057.546] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0057.546] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0057.546] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0057.547] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Solutions_Generic.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css" [0057.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.zip") returned 0 [0057.547] lstrlenA (lpString="*.zip") returned 5 [0057.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.rar") returned 0 [0057.547] lstrlenA (lpString="*.rar") returned 5 [0057.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.7z") returned 0 [0057.547] lstrlenA (lpString="*.7z") returned 4 [0057.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.tar") returned 0 [0057.547] lstrlenA (lpString="*.tar") returned 5 [0057.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.gzip") returned 0 [0057.547] lstrlenA (lpString="*.gzip") returned 6 [0057.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.jpg") returned 0 [0057.547] lstrlenA (lpString="*.jpg") returned 5 [0057.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.jpeg") returned 0 [0057.547] lstrlenA (lpString="*.jpeg") returned 6 [0057.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.psd") returned 0 [0057.547] lstrlenA (lpString="*.psd") returned 5 [0057.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.gif") returned 0 [0057.547] lstrlenA (lpString="*.gif") returned 5 [0057.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.doc") returned 0 [0057.547] lstrlenA (lpString="*.doc") returned 5 [0057.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.docx") returned 0 [0057.547] lstrlenA (lpString="*.docx") returned 6 [0057.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.xls") returned 0 [0057.547] lstrlenA (lpString="*.xls") returned 5 [0057.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.xlsx") returned 0 [0057.547] lstrlenA (lpString="*.xlsx") returned 6 [0057.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.ppt") returned 0 [0057.547] lstrlenA (lpString="*.ppt") returned 5 [0057.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.pptx") returned 0 [0057.547] lstrlenA (lpString="*.pptx") returned 6 [0057.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.pdf") returned 0 [0057.547] lstrlenA (lpString="*.pdf") returned 5 [0057.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.mov") returned 0 [0057.548] lstrlenA (lpString="*.mov") returned 5 [0057.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.m2v") returned 0 [0057.548] lstrlenA (lpString="*.m2v") returned 5 [0057.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.3gp") returned 0 [0057.548] lstrlenA (lpString="*.3gp") returned 5 [0057.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.mpeg") returned 0 [0057.548] lstrlenA (lpString="*.mpeg") returned 6 [0057.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.mpg") returned 0 [0057.548] lstrlenA (lpString="*.mpg") returned 5 [0057.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.flv") returned 0 [0057.548] lstrlenA (lpString="*.flv") returned 5 [0057.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.avi") returned 0 [0057.548] lstrlenA (lpString="*.avi") returned 5 [0057.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.mp4") returned 0 [0057.548] lstrlenA (lpString="*.mp4") returned 5 [0057.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.wmv") returned 0 [0057.548] lstrlenA (lpString="*.wmv") returned 5 [0057.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.divx") returned 0 [0057.548] lstrlenA (lpString="*.divx") returned 6 [0057.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.mkv") returned 0 [0057.548] lstrlenA (lpString="*.mkv") returned 5 [0057.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.mp3") returned 0 [0057.548] lstrlenA (lpString="*.mp3") returned 5 [0057.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.wav") returned 0 [0057.548] lstrlenA (lpString="*.wav") returned 5 [0057.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.flac") returned 0 [0057.548] lstrlenA (lpString="*.flac") returned 6 [0057.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.ape") returned 0 [0057.548] lstrlenA (lpString="*.ape") returned 5 [0057.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.wma") returned 0 [0057.548] lstrlenA (lpString="*.wma") returned 5 [0057.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.ac3") returned 0 [0057.549] lstrlenA (lpString="*.ac3") returned 5 [0057.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", pszSpec="*.mxf") returned 0 [0057.549] lstrlenA (lpString="*.mxf") returned 5 [0057.549] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Solutions_Person.css", cAlternateFileName="SOLUTI~4.CSS")) returned 1 [0057.549] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0057.549] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Solutions_Person.css") returned -1 [0057.549] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Solutions_Person.css") returned -1 [0057.549] lstrcmpiA (lpString1="", lpString2="Solutions_Person.css") returned -1 [0057.549] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css") returned="Solutions_Generic.css" [0057.549] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0057.549] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0057.549] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0057.549] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0057.549] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Solutions_Person.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css" [0057.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.zip") returned 0 [0057.549] lstrlenA (lpString="*.zip") returned 5 [0057.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.rar") returned 0 [0057.549] lstrlenA (lpString="*.rar") returned 5 [0057.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.7z") returned 0 [0057.549] lstrlenA (lpString="*.7z") returned 4 [0057.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.tar") returned 0 [0057.549] lstrlenA (lpString="*.tar") returned 5 [0057.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.gzip") returned 0 [0057.549] lstrlenA (lpString="*.gzip") returned 6 [0057.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.jpg") returned 0 [0057.549] lstrlenA (lpString="*.jpg") returned 5 [0057.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.jpeg") returned 0 [0057.550] lstrlenA (lpString="*.jpeg") returned 6 [0057.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.psd") returned 0 [0057.550] lstrlenA (lpString="*.psd") returned 5 [0057.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.gif") returned 0 [0057.550] lstrlenA (lpString="*.gif") returned 5 [0057.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.doc") returned 0 [0057.550] lstrlenA (lpString="*.doc") returned 5 [0057.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.docx") returned 0 [0057.550] lstrlenA (lpString="*.docx") returned 6 [0057.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.xls") returned 0 [0057.550] lstrlenA (lpString="*.xls") returned 5 [0057.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.xlsx") returned 0 [0057.550] lstrlenA (lpString="*.xlsx") returned 6 [0057.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.ppt") returned 0 [0057.550] lstrlenA (lpString="*.ppt") returned 5 [0057.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.pptx") returned 0 [0057.550] lstrlenA (lpString="*.pptx") returned 6 [0057.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.pdf") returned 0 [0057.550] lstrlenA (lpString="*.pdf") returned 5 [0057.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.mov") returned 0 [0057.550] lstrlenA (lpString="*.mov") returned 5 [0057.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.m2v") returned 0 [0057.550] lstrlenA (lpString="*.m2v") returned 5 [0057.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.3gp") returned 0 [0057.550] lstrlenA (lpString="*.3gp") returned 5 [0057.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.mpeg") returned 0 [0057.550] lstrlenA (lpString="*.mpeg") returned 6 [0057.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.mpg") returned 0 [0057.550] lstrlenA (lpString="*.mpg") returned 5 [0057.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.flv") returned 0 [0057.550] lstrlenA (lpString="*.flv") returned 5 [0057.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.avi") returned 0 [0057.551] lstrlenA (lpString="*.avi") returned 5 [0057.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.mp4") returned 0 [0057.551] lstrlenA (lpString="*.mp4") returned 5 [0057.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.wmv") returned 0 [0057.551] lstrlenA (lpString="*.wmv") returned 5 [0057.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.divx") returned 0 [0057.551] lstrlenA (lpString="*.divx") returned 6 [0057.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.mkv") returned 0 [0057.551] lstrlenA (lpString="*.mkv") returned 5 [0057.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.mp3") returned 0 [0057.551] lstrlenA (lpString="*.mp3") returned 5 [0057.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.wav") returned 0 [0057.551] lstrlenA (lpString="*.wav") returned 5 [0057.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.flac") returned 0 [0057.551] lstrlenA (lpString="*.flac") returned 6 [0057.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.ape") returned 0 [0057.552] lstrlenA (lpString="*.ape") returned 5 [0057.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.wma") returned 0 [0057.553] lstrlenA (lpString="*.wma") returned 5 [0057.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.ac3") returned 0 [0057.553] lstrlenA (lpString="*.ac3") returned 5 [0057.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", pszSpec="*.mxf") returned 0 [0057.553] lstrlenA (lpString="*.mxf") returned 5 [0057.553] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xab, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Solutions_Response.css", cAlternateFileName="SOB0ED~1.CSS")) returned 1 [0057.553] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0057.553] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Solutions_Response.css") returned -1 [0057.553] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Solutions_Response.css") returned -1 [0057.553] lstrcmpiA (lpString1="", lpString2="Solutions_Response.css") returned -1 [0057.553] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css") returned="Solutions_Person.css" [0057.553] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0057.553] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0057.553] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0057.553] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0057.553] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Solutions_Response.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css" [0057.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.zip") returned 0 [0057.553] lstrlenA (lpString="*.zip") returned 5 [0057.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.rar") returned 0 [0057.553] lstrlenA (lpString="*.rar") returned 5 [0057.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.7z") returned 0 [0057.553] lstrlenA (lpString="*.7z") returned 4 [0057.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.tar") returned 0 [0057.553] lstrlenA (lpString="*.tar") returned 5 [0057.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.gzip") returned 0 [0057.553] lstrlenA (lpString="*.gzip") returned 6 [0057.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.jpg") returned 0 [0057.553] lstrlenA (lpString="*.jpg") returned 5 [0057.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.jpeg") returned 0 [0057.554] lstrlenA (lpString="*.jpeg") returned 6 [0057.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.psd") returned 0 [0057.554] lstrlenA (lpString="*.psd") returned 5 [0057.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.gif") returned 0 [0057.554] lstrlenA (lpString="*.gif") returned 5 [0057.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.doc") returned 0 [0057.554] lstrlenA (lpString="*.doc") returned 5 [0057.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.docx") returned 0 [0057.554] lstrlenA (lpString="*.docx") returned 6 [0057.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.xls") returned 0 [0057.554] lstrlenA (lpString="*.xls") returned 5 [0057.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.xlsx") returned 0 [0057.554] lstrlenA (lpString="*.xlsx") returned 6 [0057.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.ppt") returned 0 [0057.554] lstrlenA (lpString="*.ppt") returned 5 [0057.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.pptx") returned 0 [0057.554] lstrlenA (lpString="*.pptx") returned 6 [0057.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.pdf") returned 0 [0057.554] lstrlenA (lpString="*.pdf") returned 5 [0057.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.mov") returned 0 [0057.554] lstrlenA (lpString="*.mov") returned 5 [0057.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.m2v") returned 0 [0057.554] lstrlenA (lpString="*.m2v") returned 5 [0057.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.3gp") returned 0 [0057.554] lstrlenA (lpString="*.3gp") returned 5 [0057.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.mpeg") returned 0 [0057.554] lstrlenA (lpString="*.mpeg") returned 6 [0057.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.mpg") returned 0 [0057.554] lstrlenA (lpString="*.mpg") returned 5 [0057.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.flv") returned 0 [0057.554] lstrlenA (lpString="*.flv") returned 5 [0057.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.avi") returned 0 [0057.554] lstrlenA (lpString="*.avi") returned 5 [0057.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.mp4") returned 0 [0057.555] lstrlenA (lpString="*.mp4") returned 5 [0057.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.wmv") returned 0 [0057.555] lstrlenA (lpString="*.wmv") returned 5 [0057.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.divx") returned 0 [0057.555] lstrlenA (lpString="*.divx") returned 6 [0057.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.mkv") returned 0 [0057.555] lstrlenA (lpString="*.mkv") returned 5 [0057.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.mp3") returned 0 [0057.555] lstrlenA (lpString="*.mp3") returned 5 [0057.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.wav") returned 0 [0057.555] lstrlenA (lpString="*.wav") returned 5 [0057.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.flac") returned 0 [0057.555] lstrlenA (lpString="*.flac") returned 6 [0057.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.ape") returned 0 [0057.555] lstrlenA (lpString="*.ape") returned 5 [0057.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.wma") returned 0 [0057.555] lstrlenA (lpString="*.wma") returned 5 [0057.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.ac3") returned 0 [0057.555] lstrlenA (lpString="*.ac3") returned 5 [0057.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", pszSpec="*.mxf") returned 0 [0057.555] lstrlenA (lpString="*.mxf") returned 5 [0057.555] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="SpringGreen", cAlternateFileName="SPRING~1")) returned 1 [0057.555] lstrcmpA (lpString1=".", lpString2="SpringGreen") returned -1 [0057.555] lstrcmpA (lpString1="..", lpString2="SpringGreen") returned -1 [0057.555] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css") returned="Solutions_Response.css" [0057.555] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="SpringGreen" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen" [0057.555] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen") returned 84 [0057.555] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2d8252, cFileName=".", cAlternateFileName="")) returned 0x2d80a8 [0057.556] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.556] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.556] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.556] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.556] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0057.556] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0057.556] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BUTTON.GIF") returned 1 [0057.556] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BUTTON.GIF") returned 1 [0057.556] lstrcmpiA (lpString1="", lpString2="BUTTON.GIF") returned -1 [0057.556] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\*.*") returned="*.*" [0057.556] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\" [0057.556] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\") returned="" [0057.556] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" [0057.556] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\how to decrypt files.txt")) returned 0xffffffff [0057.556] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0057.557] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0057.557] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0057.559] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.559] CloseHandle (hObject=0x98) returned 1 [0057.560] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\", lpString2="BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF" [0057.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.zip") returned 0 [0057.560] lstrlenA (lpString="*.zip") returned 5 [0057.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.rar") returned 0 [0057.560] lstrlenA (lpString="*.rar") returned 5 [0057.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.7z") returned 0 [0057.560] lstrlenA (lpString="*.7z") returned 4 [0057.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.tar") returned 0 [0057.560] lstrlenA (lpString="*.tar") returned 5 [0057.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.gzip") returned 0 [0057.560] lstrlenA (lpString="*.gzip") returned 6 [0057.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.jpg") returned 0 [0057.560] lstrlenA (lpString="*.jpg") returned 5 [0057.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.jpeg") returned 0 [0057.560] lstrlenA (lpString="*.jpeg") returned 6 [0057.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.psd") returned 0 [0057.560] lstrlenA (lpString="*.psd") returned 5 [0057.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.gif") returned 1 [0057.560] lstrlenA (lpString="*.gif") returned 5 [0057.560] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF" [0057.560] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF" [0057.560] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF." [0057.560] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF.wannacry" [0057.560] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0057.561] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ac [0057.561] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcff1d400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd54e650, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcff1d400, dwHighDateTime=0x1c747ea)) returned 1 [0057.562] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.562] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x12e, lpOverlapped=0x0) returned 1 [0057.562] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="BUTTON.GIF" [0057.563] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.563] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x12e, lpOverlapped=0x0) returned 1 [0057.563] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0057.563] CloseHandle (hObject=0x98) returned 1 [0057.563] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\button.gif.wannacry")) returned 1 [0057.565] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0057.565] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0057.565] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0057.565] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0057.565] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0057.565] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="BUTTON.GIF" [0057.565] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\" [0057.565] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\") returned="" [0057.565] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" [0057.565] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\how to decrypt files.txt")) returned 0x20 [0057.565] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" [0057.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0057.565] lstrlenA (lpString="*.zip") returned 5 [0057.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0057.565] lstrlenA (lpString="*.rar") returned 5 [0057.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0057.565] lstrlenA (lpString="*.7z") returned 4 [0057.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0057.566] lstrlenA (lpString="*.tar") returned 5 [0057.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0057.566] lstrlenA (lpString="*.gzip") returned 6 [0057.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0057.566] lstrlenA (lpString="*.jpg") returned 5 [0057.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0057.566] lstrlenA (lpString="*.jpeg") returned 6 [0057.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0057.566] lstrlenA (lpString="*.psd") returned 5 [0057.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0057.566] lstrlenA (lpString="*.gif") returned 5 [0057.566] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" [0057.566] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" [0057.566] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF." [0057.566] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.wannacry" [0057.566] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0057.566] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0057.566] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcff1d400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd54e650, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcff1d400, dwHighDateTime=0x1c747ea)) returned 1 [0057.567] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.567] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd7, lpOverlapped=0x0) returned 1 [0057.567] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0057.567] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.567] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd7, lpOverlapped=0x0) returned 1 [0057.568] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0057.568] CloseHandle (hObject=0x98) returned 1 [0057.568] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_off.gif.wannacry")) returned 1 [0057.568] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0057.568] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0057.568] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0057.568] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0057.568] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0057.568] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0057.569] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\" [0057.569] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\") returned="" [0057.569] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" [0057.569] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\how to decrypt files.txt")) returned 0x20 [0057.569] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF" [0057.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0057.569] lstrlenA (lpString="*.zip") returned 5 [0057.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0057.569] lstrlenA (lpString="*.rar") returned 5 [0057.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0057.569] lstrlenA (lpString="*.7z") returned 4 [0057.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0057.569] lstrlenA (lpString="*.tar") returned 5 [0057.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0057.569] lstrlenA (lpString="*.gzip") returned 6 [0057.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0057.569] lstrlenA (lpString="*.jpg") returned 5 [0057.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0057.569] lstrlenA (lpString="*.jpeg") returned 6 [0057.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0057.569] lstrlenA (lpString="*.psd") returned 5 [0057.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0057.569] lstrlenA (lpString="*.gif") returned 5 [0057.569] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF" [0057.569] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF" [0057.569] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF." [0057.569] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF.wannacry" [0057.569] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0057.570] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0057.570] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcff1d400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd54e650, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcff1d400, dwHighDateTime=0x1c747ea)) returned 1 [0057.570] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.570] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60, lpOverlapped=0x0) returned 1 [0057.571] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned="TAB_ON.GIF" [0057.571] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.571] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60, lpOverlapped=0x0) returned 1 [0057.571] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0057.571] CloseHandle (hObject=0x98) returned 1 [0057.571] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_on.gif.wannacry")) returned 1 [0057.572] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0057.572] FindClose (in: hFindFile=0x2d80a8 | out: hFindFile=0x2d80a8) returned 1 [0057.572] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd01, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="SpringGreen.css", cAlternateFileName="SPRING~1.CSS")) returned 1 [0057.572] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0057.572] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SpringGreen.css") returned -1 [0057.572] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SpringGreen.css") returned -1 [0057.572] lstrcmpiA (lpString1="", lpString2="SpringGreen.css") returned -1 [0057.572] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*.*") returned="*.*" [0057.572] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0057.572] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0057.572] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0057.572] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0057.572] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="SpringGreen.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css" [0057.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.zip") returned 0 [0057.572] lstrlenA (lpString="*.zip") returned 5 [0057.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.rar") returned 0 [0057.572] lstrlenA (lpString="*.rar") returned 5 [0057.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.7z") returned 0 [0057.572] lstrlenA (lpString="*.7z") returned 4 [0057.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.tar") returned 0 [0057.572] lstrlenA (lpString="*.tar") returned 5 [0057.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.gzip") returned 0 [0057.572] lstrlenA (lpString="*.gzip") returned 6 [0057.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.jpg") returned 0 [0057.572] lstrlenA (lpString="*.jpg") returned 5 [0057.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.jpeg") returned 0 [0057.572] lstrlenA (lpString="*.jpeg") returned 6 [0057.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.psd") returned 0 [0057.572] lstrlenA (lpString="*.psd") returned 5 [0057.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.gif") returned 0 [0057.573] lstrlenA (lpString="*.gif") returned 5 [0057.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.doc") returned 0 [0057.573] lstrlenA (lpString="*.doc") returned 5 [0057.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.docx") returned 0 [0057.573] lstrlenA (lpString="*.docx") returned 6 [0057.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.xls") returned 0 [0057.573] lstrlenA (lpString="*.xls") returned 5 [0057.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.xlsx") returned 0 [0057.573] lstrlenA (lpString="*.xlsx") returned 6 [0057.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.ppt") returned 0 [0057.573] lstrlenA (lpString="*.ppt") returned 5 [0057.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.pptx") returned 0 [0057.573] lstrlenA (lpString="*.pptx") returned 6 [0057.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.pdf") returned 0 [0057.573] lstrlenA (lpString="*.pdf") returned 5 [0057.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.mov") returned 0 [0057.573] lstrlenA (lpString="*.mov") returned 5 [0057.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.m2v") returned 0 [0057.573] lstrlenA (lpString="*.m2v") returned 5 [0057.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.3gp") returned 0 [0057.573] lstrlenA (lpString="*.3gp") returned 5 [0057.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.mpeg") returned 0 [0057.573] lstrlenA (lpString="*.mpeg") returned 6 [0057.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.mpg") returned 0 [0057.573] lstrlenA (lpString="*.mpg") returned 5 [0057.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.flv") returned 0 [0057.573] lstrlenA (lpString="*.flv") returned 5 [0057.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.avi") returned 0 [0057.573] lstrlenA (lpString="*.avi") returned 5 [0057.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.mp4") returned 0 [0057.573] lstrlenA (lpString="*.mp4") returned 5 [0057.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.wmv") returned 0 [0057.573] lstrlenA (lpString="*.wmv") returned 5 [0057.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.divx") returned 0 [0057.573] lstrlenA (lpString="*.divx") returned 6 [0057.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.mkv") returned 0 [0057.574] lstrlenA (lpString="*.mkv") returned 5 [0057.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.mp3") returned 0 [0057.574] lstrlenA (lpString="*.mp3") returned 5 [0057.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.wav") returned 0 [0057.574] lstrlenA (lpString="*.wav") returned 5 [0057.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.flac") returned 0 [0057.574] lstrlenA (lpString="*.flac") returned 6 [0057.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.ape") returned 0 [0057.574] lstrlenA (lpString="*.ape") returned 5 [0057.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.wma") returned 0 [0057.574] lstrlenA (lpString="*.wma") returned 5 [0057.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.ac3") returned 0 [0057.574] lstrlenA (lpString="*.ac3") returned 5 [0057.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", pszSpec="*.mxf") returned 0 [0057.574] lstrlenA (lpString="*.mxf") returned 5 [0057.574] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9fe, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Sts.css", cAlternateFileName="")) returned 1 [0057.577] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0057.577] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Sts.css") returned -1 [0057.577] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Sts.css") returned -1 [0057.577] lstrcmpiA (lpString1="", lpString2="Sts.css") returned -1 [0057.577] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css") returned="SpringGreen.css" [0057.577] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0057.577] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0057.577] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0057.578] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0057.578] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Sts.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css" [0057.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.zip") returned 0 [0057.578] lstrlenA (lpString="*.zip") returned 5 [0057.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.rar") returned 0 [0057.578] lstrlenA (lpString="*.rar") returned 5 [0057.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.7z") returned 0 [0057.578] lstrlenA (lpString="*.7z") returned 4 [0057.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.tar") returned 0 [0057.578] lstrlenA (lpString="*.tar") returned 5 [0057.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.gzip") returned 0 [0057.578] lstrlenA (lpString="*.gzip") returned 6 [0057.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.jpg") returned 0 [0057.578] lstrlenA (lpString="*.jpg") returned 5 [0057.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.jpeg") returned 0 [0057.578] lstrlenA (lpString="*.jpeg") returned 6 [0057.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.psd") returned 0 [0057.578] lstrlenA (lpString="*.psd") returned 5 [0057.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.gif") returned 0 [0057.578] lstrlenA (lpString="*.gif") returned 5 [0057.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.doc") returned 0 [0057.578] lstrlenA (lpString="*.doc") returned 5 [0057.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.docx") returned 0 [0057.578] lstrlenA (lpString="*.docx") returned 6 [0057.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.xls") returned 0 [0057.578] lstrlenA (lpString="*.xls") returned 5 [0057.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.xlsx") returned 0 [0057.578] lstrlenA (lpString="*.xlsx") returned 6 [0057.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.ppt") returned 0 [0057.579] lstrlenA (lpString="*.ppt") returned 5 [0057.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.pptx") returned 0 [0057.579] lstrlenA (lpString="*.pptx") returned 6 [0057.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.pdf") returned 0 [0057.579] lstrlenA (lpString="*.pdf") returned 5 [0057.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.mov") returned 0 [0057.579] lstrlenA (lpString="*.mov") returned 5 [0057.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.m2v") returned 0 [0057.579] lstrlenA (lpString="*.m2v") returned 5 [0057.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.3gp") returned 0 [0057.579] lstrlenA (lpString="*.3gp") returned 5 [0057.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.mpeg") returned 0 [0057.579] lstrlenA (lpString="*.mpeg") returned 6 [0057.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.mpg") returned 0 [0057.579] lstrlenA (lpString="*.mpg") returned 5 [0057.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.flv") returned 0 [0057.579] lstrlenA (lpString="*.flv") returned 5 [0057.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.avi") returned 0 [0057.579] lstrlenA (lpString="*.avi") returned 5 [0057.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.mp4") returned 0 [0057.579] lstrlenA (lpString="*.mp4") returned 5 [0057.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.wmv") returned 0 [0057.579] lstrlenA (lpString="*.wmv") returned 5 [0057.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.divx") returned 0 [0057.579] lstrlenA (lpString="*.divx") returned 6 [0057.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.mkv") returned 0 [0057.579] lstrlenA (lpString="*.mkv") returned 5 [0057.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.mp3") returned 0 [0057.579] lstrlenA (lpString="*.mp3") returned 5 [0057.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.wav") returned 0 [0057.579] lstrlenA (lpString="*.wav") returned 5 [0057.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.flac") returned 0 [0057.579] lstrlenA (lpString="*.flac") returned 6 [0057.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.ape") returned 0 [0057.579] lstrlenA (lpString="*.ape") returned 5 [0057.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.wma") returned 0 [0057.580] lstrlenA (lpString="*.wma") returned 5 [0057.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.ac3") returned 0 [0057.580] lstrlenA (lpString="*.ac3") returned 5 [0057.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", pszSpec="*.mxf") returned 0 [0057.580] lstrlenA (lpString="*.mxf") returned 5 [0057.580] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="STS2", cAlternateFileName="")) returned 1 [0057.580] lstrcmpA (lpString1=".", lpString2="STS2") returned -1 [0057.580] lstrcmpA (lpString1="..", lpString2="STS2") returned -1 [0057.580] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css") returned="Sts.css" [0057.580] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="STS2" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2" [0057.580] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2") returned 77 [0057.580] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2d8252, cFileName=".", cAlternateFileName="")) returned 0x2d80a8 [0057.580] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.580] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.580] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.580] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.580] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0057.580] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0057.580] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="background.gif") returned 1 [0057.580] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1 [0057.581] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1 [0057.581] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\*.*") returned="*.*" [0057.581] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\" [0057.581] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\") returned="" [0057.581] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" [0057.581] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\how to decrypt files.txt")) returned 0xffffffff [0057.581] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0057.589] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0057.589] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0057.590] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.590] CloseHandle (hObject=0x98) returned 1 [0057.590] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif" [0057.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif", pszSpec="*.zip") returned 0 [0057.590] lstrlenA (lpString="*.zip") returned 5 [0057.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif", pszSpec="*.rar") returned 0 [0057.590] lstrlenA (lpString="*.rar") returned 5 [0057.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif", pszSpec="*.7z") returned 0 [0057.590] lstrlenA (lpString="*.7z") returned 4 [0057.590] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif", pszSpec="*.tar") returned 0 [0057.600] lstrlenA (lpString="*.tar") returned 5 [0057.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif", pszSpec="*.gzip") returned 0 [0057.600] lstrlenA (lpString="*.gzip") returned 6 [0057.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif", pszSpec="*.jpg") returned 0 [0057.601] lstrlenA (lpString="*.jpg") returned 5 [0057.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif", pszSpec="*.jpeg") returned 0 [0057.601] lstrlenA (lpString="*.jpeg") returned 6 [0057.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif", pszSpec="*.psd") returned 0 [0057.601] lstrlenA (lpString="*.psd") returned 5 [0057.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif", pszSpec="*.gif") returned 1 [0057.601] lstrlenA (lpString="*.gif") returned 5 [0057.601] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif" [0057.601] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif" [0057.601] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif." [0057.601] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif.wannacry" [0057.601] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0057.603] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe9 [0057.604] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcff1d400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd54e650, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcff1d400, dwHighDateTime=0x1c747ea)) returned 1 [0057.604] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.604] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x6b, lpOverlapped=0x0) returned 1 [0057.605] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif") returned="background.gif" [0057.605] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.605] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x6b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x6b, lpOverlapped=0x0) returned 1 [0057.605] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0057.605] CloseHandle (hObject=0x98) returned 1 [0057.605] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\background.gif.wannacry")) returned 1 [0057.606] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xcbd, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0057.606] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0057.606] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HEADER.GIF") returned -1 [0057.606] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0057.606] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0057.606] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif") returned="background.gif" [0057.606] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\" [0057.606] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\") returned="" [0057.606] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" [0057.606] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\how to decrypt files.txt")) returned 0x20 [0057.606] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF" [0057.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.zip") returned 0 [0057.606] lstrlenA (lpString="*.zip") returned 5 [0057.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.rar") returned 0 [0057.606] lstrlenA (lpString="*.rar") returned 5 [0057.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.7z") returned 0 [0057.606] lstrlenA (lpString="*.7z") returned 4 [0057.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.tar") returned 0 [0057.606] lstrlenA (lpString="*.tar") returned 5 [0057.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0057.606] lstrlenA (lpString="*.gzip") returned 6 [0057.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0057.607] lstrlenA (lpString="*.jpg") returned 5 [0057.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0057.607] lstrlenA (lpString="*.jpeg") returned 6 [0057.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.psd") returned 0 [0057.607] lstrlenA (lpString="*.psd") returned 5 [0057.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.gif") returned 1 [0057.607] lstrlenA (lpString="*.gif") returned 5 [0057.607] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF" [0057.607] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF" [0057.607] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF." [0057.607] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF.wannacry" [0057.607] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0057.607] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcbd [0057.607] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcff1d400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd54e650, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcff1d400, dwHighDateTime=0x1c747ea)) returned 1 [0057.607] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.607] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xc3f, lpOverlapped=0x0) returned 1 [0057.614] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF") returned="HEADER.GIF" [0057.614] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.614] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xc3f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xc3f, lpOverlapped=0x0) returned 1 [0057.614] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0057.614] CloseHandle (hObject=0x98) returned 1 [0057.614] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\header.gif.wannacry")) returned 1 [0057.615] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0057.615] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0057.615] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0057.615] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0057.615] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0057.615] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF") returned="HEADER.GIF" [0057.615] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\" [0057.615] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\") returned="" [0057.615] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" [0057.615] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\how to decrypt files.txt")) returned 0x20 [0057.615] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF" [0057.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0057.615] lstrlenA (lpString="*.zip") returned 5 [0057.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0057.615] lstrlenA (lpString="*.rar") returned 5 [0057.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0057.615] lstrlenA (lpString="*.7z") returned 4 [0057.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0057.615] lstrlenA (lpString="*.tar") returned 5 [0057.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0057.615] lstrlenA (lpString="*.gzip") returned 6 [0057.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0057.616] lstrlenA (lpString="*.jpg") returned 5 [0057.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0057.616] lstrlenA (lpString="*.jpeg") returned 6 [0057.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0057.616] lstrlenA (lpString="*.psd") returned 5 [0057.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0057.616] lstrlenA (lpString="*.gif") returned 5 [0057.616] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF" [0057.616] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF" [0057.616] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF." [0057.616] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF.wannacry" [0057.616] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0057.616] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ce [0057.616] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcff1d400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd54e650, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcff1d400, dwHighDateTime=0x1c747ea)) returned 1 [0057.616] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.616] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x150, lpOverlapped=0x0) returned 1 [0057.617] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0057.617] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.617] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x150, lpOverlapped=0x0) returned 1 [0057.618] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0057.618] CloseHandle (hObject=0x98) returned 1 [0057.618] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_off.gif.wannacry")) returned 1 [0057.618] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0057.618] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0057.618] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0057.618] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0057.618] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0057.619] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0057.619] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\" [0057.619] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\") returned="" [0057.619] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" [0057.619] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\how to decrypt files.txt")) returned 0x20 [0057.619] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF" [0057.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0057.619] lstrlenA (lpString="*.zip") returned 5 [0057.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0057.619] lstrlenA (lpString="*.rar") returned 5 [0057.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0057.619] lstrlenA (lpString="*.7z") returned 4 [0057.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0057.619] lstrlenA (lpString="*.tar") returned 5 [0057.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0057.619] lstrlenA (lpString="*.gzip") returned 6 [0057.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0057.619] lstrlenA (lpString="*.jpg") returned 5 [0057.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0057.619] lstrlenA (lpString="*.jpeg") returned 6 [0057.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0057.619] lstrlenA (lpString="*.psd") returned 5 [0057.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0057.619] lstrlenA (lpString="*.gif") returned 5 [0057.619] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF" [0057.619] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF" [0057.619] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF." [0057.619] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF.wannacry" [0057.619] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0057.620] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x108 [0057.620] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xcff1d400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd54e650, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcff1d400, dwHighDateTime=0x1c747ea)) returned 1 [0057.620] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.620] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x8a, lpOverlapped=0x0) returned 1 [0057.621] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF") returned="TAB_ON.GIF" [0057.621] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.621] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x8a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x8a, lpOverlapped=0x0) returned 1 [0057.621] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0057.621] CloseHandle (hObject=0x98) returned 1 [0057.621] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_on.gif.wannacry")) returned 1 [0057.622] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0057.622] FindClose (in: hFindFile=0x2d80a8 | out: hFindFile=0x2d80a8) returned 1 [0057.622] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6a, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="Sts2.css", cAlternateFileName="")) returned 1 [0057.622] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0057.622] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Sts2.css") returned -1 [0057.622] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Sts2.css") returned -1 [0057.622] lstrcmpiA (lpString1="", lpString2="Sts2.css") returned -1 [0057.622] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*.*") returned="*.*" [0057.622] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0057.622] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0057.622] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0057.622] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0057.622] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Sts2.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css" [0057.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.zip") returned 0 [0057.622] lstrlenA (lpString="*.zip") returned 5 [0057.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.rar") returned 0 [0057.623] lstrlenA (lpString="*.rar") returned 5 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.7z") returned 0 [0057.623] lstrlenA (lpString="*.7z") returned 4 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.tar") returned 0 [0057.623] lstrlenA (lpString="*.tar") returned 5 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.gzip") returned 0 [0057.623] lstrlenA (lpString="*.gzip") returned 6 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.jpg") returned 0 [0057.623] lstrlenA (lpString="*.jpg") returned 5 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.jpeg") returned 0 [0057.623] lstrlenA (lpString="*.jpeg") returned 6 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.psd") returned 0 [0057.623] lstrlenA (lpString="*.psd") returned 5 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.gif") returned 0 [0057.623] lstrlenA (lpString="*.gif") returned 5 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.doc") returned 0 [0057.623] lstrlenA (lpString="*.doc") returned 5 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.docx") returned 0 [0057.623] lstrlenA (lpString="*.docx") returned 6 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.xls") returned 0 [0057.623] lstrlenA (lpString="*.xls") returned 5 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.xlsx") returned 0 [0057.623] lstrlenA (lpString="*.xlsx") returned 6 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.ppt") returned 0 [0057.623] lstrlenA (lpString="*.ppt") returned 5 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.pptx") returned 0 [0057.623] lstrlenA (lpString="*.pptx") returned 6 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.pdf") returned 0 [0057.623] lstrlenA (lpString="*.pdf") returned 5 [0057.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.mov") returned 0 [0057.623] lstrlenA (lpString="*.mov") returned 5 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.m2v") returned 0 [0057.624] lstrlenA (lpString="*.m2v") returned 5 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.3gp") returned 0 [0057.624] lstrlenA (lpString="*.3gp") returned 5 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.mpeg") returned 0 [0057.624] lstrlenA (lpString="*.mpeg") returned 6 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.mpg") returned 0 [0057.624] lstrlenA (lpString="*.mpg") returned 5 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.flv") returned 0 [0057.624] lstrlenA (lpString="*.flv") returned 5 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.avi") returned 0 [0057.624] lstrlenA (lpString="*.avi") returned 5 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.mp4") returned 0 [0057.624] lstrlenA (lpString="*.mp4") returned 5 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.wmv") returned 0 [0057.624] lstrlenA (lpString="*.wmv") returned 5 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.divx") returned 0 [0057.624] lstrlenA (lpString="*.divx") returned 6 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.mkv") returned 0 [0057.624] lstrlenA (lpString="*.mkv") returned 5 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.mp3") returned 0 [0057.624] lstrlenA (lpString="*.mp3") returned 5 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.wav") returned 0 [0057.624] lstrlenA (lpString="*.wav") returned 5 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.flac") returned 0 [0057.624] lstrlenA (lpString="*.flac") returned 6 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.ape") returned 0 [0057.624] lstrlenA (lpString="*.ape") returned 5 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.wma") returned 0 [0057.624] lstrlenA (lpString="*.wma") returned 5 [0057.624] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.ac3") returned 0 [0057.624] lstrlenA (lpString="*.ac3") returned 5 [0057.625] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", pszSpec="*.mxf") returned 0 [0057.625] lstrlenA (lpString="*.mxf") returned 5 [0057.625] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5747b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Swirl", cAlternateFileName="")) returned 1 [0057.625] lstrcmpA (lpString1=".", lpString2="Swirl") returned -1 [0057.625] lstrcmpA (lpString1="..", lpString2="Swirl") returned -1 [0057.625] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css") returned="Sts2.css" [0057.625] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Swirl" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl" [0057.625] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl") returned 78 [0057.625] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5747b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2d8252, cFileName=".", cAlternateFileName="")) returned 0x2d80a8 [0057.626] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0057.626] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5747b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0057.626] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0057.626] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0057.626] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x32f, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0057.626] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0057.626] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="background.gif") returned 1 [0057.626] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1 [0057.626] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1 [0057.626] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\*.*") returned="*.*" [0057.626] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\" [0057.626] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\") returned="" [0057.626] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" [0057.626] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\how to decrypt files.txt")) returned 0xffffffff [0057.626] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0057.716] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0057.716] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0057.717] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0057.717] CloseHandle (hObject=0x98) returned 1 [0057.717] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif" [0057.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif", pszSpec="*.zip") returned 0 [0057.717] lstrlenA (lpString="*.zip") returned 5 [0057.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif", pszSpec="*.rar") returned 0 [0057.717] lstrlenA (lpString="*.rar") returned 5 [0057.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif", pszSpec="*.7z") returned 0 [0057.717] lstrlenA (lpString="*.7z") returned 4 [0057.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif", pszSpec="*.tar") returned 0 [0057.717] lstrlenA (lpString="*.tar") returned 5 [0057.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif", pszSpec="*.gzip") returned 0 [0057.717] lstrlenA (lpString="*.gzip") returned 6 [0057.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif", pszSpec="*.jpg") returned 0 [0057.717] lstrlenA (lpString="*.jpg") returned 5 [0057.717] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif", pszSpec="*.jpeg") returned 0 [0057.717] lstrlenA (lpString="*.jpeg") returned 6 [0057.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif", pszSpec="*.psd") returned 0 [0057.718] lstrlenA (lpString="*.psd") returned 5 [0057.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif", pszSpec="*.gif") returned 1 [0057.718] lstrlenA (lpString="*.gif") returned 5 [0057.718] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif" [0057.718] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif" [0057.718] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif." [0057.718] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif.wannacry" [0057.718] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0057.718] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x32f [0057.718] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd1230100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd54e650, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd1230100, dwHighDateTime=0x1c747ea)) returned 1 [0057.719] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.719] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2b1, lpOverlapped=0x0) returned 1 [0057.720] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif") returned="background.gif" [0057.720] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.720] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2b1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2b1, lpOverlapped=0x0) returned 1 [0057.720] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0057.720] CloseHandle (hObject=0x98) returned 1 [0057.721] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\background.gif.wannacry")) returned 1 [0057.721] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6993, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0057.721] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0057.721] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HEADER.GIF") returned -1 [0057.721] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0057.721] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0057.721] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif") returned="background.gif" [0057.721] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\" [0057.721] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\") returned="" [0057.721] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" [0057.722] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\how to decrypt files.txt")) returned 0x20 [0057.722] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF" [0057.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.zip") returned 0 [0057.722] lstrlenA (lpString="*.zip") returned 5 [0057.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.rar") returned 0 [0057.722] lstrlenA (lpString="*.rar") returned 5 [0057.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.7z") returned 0 [0057.722] lstrlenA (lpString="*.7z") returned 4 [0057.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.tar") returned 0 [0057.722] lstrlenA (lpString="*.tar") returned 5 [0057.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0057.722] lstrlenA (lpString="*.gzip") returned 6 [0057.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0057.722] lstrlenA (lpString="*.jpg") returned 5 [0057.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0057.722] lstrlenA (lpString="*.jpeg") returned 6 [0057.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.psd") returned 0 [0057.722] lstrlenA (lpString="*.psd") returned 5 [0057.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.gif") returned 1 [0057.722] lstrlenA (lpString="*.gif") returned 5 [0057.722] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF" [0057.722] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF" [0057.722] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF." [0057.722] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF.wannacry" [0057.722] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0057.726] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6993 [0057.726] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd1230100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd5747b0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd1230100, dwHighDateTime=0x1c747ea)) returned 1 [0057.726] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.726] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x6915, lpOverlapped=0x0) returned 1 [0057.736] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF") returned="HEADER.GIF" [0057.736] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.736] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x6915, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x6915, lpOverlapped=0x0) returned 1 [0057.736] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0057.736] CloseHandle (hObject=0x98) returned 1 [0057.736] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\header.gif.wannacry")) returned 1 [0057.737] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0057.737] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0057.737] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0057.737] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0057.737] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0057.737] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF") returned="HEADER.GIF" [0057.737] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\" [0057.737] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\") returned="" [0057.737] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" [0057.737] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\how to decrypt files.txt")) returned 0x20 [0057.737] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF" [0057.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0057.737] lstrlenA (lpString="*.zip") returned 5 [0057.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0057.737] lstrlenA (lpString="*.rar") returned 5 [0057.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0057.738] lstrlenA (lpString="*.7z") returned 4 [0057.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0057.738] lstrlenA (lpString="*.tar") returned 5 [0057.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0057.738] lstrlenA (lpString="*.gzip") returned 6 [0057.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0057.738] lstrlenA (lpString="*.jpg") returned 5 [0057.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0057.738] lstrlenA (lpString="*.jpeg") returned 6 [0057.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0057.738] lstrlenA (lpString="*.psd") returned 5 [0057.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0057.738] lstrlenA (lpString="*.gif") returned 5 [0057.738] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF" [0057.738] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF" [0057.738] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF." [0057.738] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF.wannacry" [0057.738] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0057.739] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0057.739] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd1230100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd5747b0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd1230100, dwHighDateTime=0x1c747ea)) returned 1 [0057.739] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.739] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd7, lpOverlapped=0x0) returned 1 [0057.740] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0057.740] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.740] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd7, lpOverlapped=0x0) returned 1 [0057.740] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0057.740] CloseHandle (hObject=0x98) returned 1 [0057.740] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_off.gif.wannacry")) returned 1 [0057.740] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0057.741] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0057.741] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0057.741] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0057.741] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0057.741] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0057.741] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\" [0057.741] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\") returned="" [0057.741] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" [0057.741] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\how to decrypt files.txt")) returned 0x20 [0057.741] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF" [0057.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0057.741] lstrlenA (lpString="*.zip") returned 5 [0057.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0057.741] lstrlenA (lpString="*.rar") returned 5 [0057.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0057.741] lstrlenA (lpString="*.7z") returned 4 [0057.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0057.741] lstrlenA (lpString="*.tar") returned 5 [0057.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0057.741] lstrlenA (lpString="*.gzip") returned 6 [0057.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0057.741] lstrlenA (lpString="*.jpg") returned 5 [0057.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0057.741] lstrlenA (lpString="*.jpeg") returned 6 [0057.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0057.741] lstrlenA (lpString="*.psd") returned 5 [0057.741] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0057.741] lstrlenA (lpString="*.gif") returned 5 [0057.741] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF" [0057.741] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF" [0057.741] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF." [0057.742] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF.wannacry" [0057.742] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0057.743] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0057.743] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd1230100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0xfd5747b0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd1230100, dwHighDateTime=0x1c747ea)) returned 1 [0057.743] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.743] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60, lpOverlapped=0x0) returned 1 [0057.744] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF") returned="TAB_ON.GIF" [0057.744] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0057.744] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60, lpOverlapped=0x0) returned 1 [0057.744] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0057.744] CloseHandle (hObject=0x98) returned 1 [0057.744] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_on.gif.wannacry")) returned 1 [0057.745] FindNextFileA (in: hFindFile=0x2d80a8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80e8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0057.745] FindClose (in: hFindFile=0x2d80a8 | out: hFindFile=0x2d80a8) returned 1 [0057.745] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="Swirl.css", cAlternateFileName="")) returned 1 [0057.745] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0057.745] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Swirl.css") returned -1 [0057.745] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Swirl.css") returned -1 [0057.745] lstrcmpiA (lpString1="", lpString2="Swirl.css") returned -1 [0057.745] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*.*") returned="*.*" [0057.745] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0057.745] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0057.745] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0057.745] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0057.745] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Swirl.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css" [0057.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.zip") returned 0 [0057.745] lstrlenA (lpString="*.zip") returned 5 [0057.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.rar") returned 0 [0057.745] lstrlenA (lpString="*.rar") returned 5 [0057.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.7z") returned 0 [0057.745] lstrlenA (lpString="*.7z") returned 4 [0057.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.tar") returned 0 [0057.745] lstrlenA (lpString="*.tar") returned 5 [0057.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.gzip") returned 0 [0057.745] lstrlenA (lpString="*.gzip") returned 6 [0057.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.jpg") returned 0 [0057.745] lstrlenA (lpString="*.jpg") returned 5 [0057.745] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.jpeg") returned 0 [0057.746] lstrlenA (lpString="*.jpeg") returned 6 [0057.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.psd") returned 0 [0057.746] lstrlenA (lpString="*.psd") returned 5 [0057.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.gif") returned 0 [0057.746] lstrlenA (lpString="*.gif") returned 5 [0057.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.doc") returned 0 [0057.746] lstrlenA (lpString="*.doc") returned 5 [0057.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.docx") returned 0 [0057.746] lstrlenA (lpString="*.docx") returned 6 [0057.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.xls") returned 0 [0057.746] lstrlenA (lpString="*.xls") returned 5 [0057.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.xlsx") returned 0 [0057.746] lstrlenA (lpString="*.xlsx") returned 6 [0057.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.ppt") returned 0 [0057.746] lstrlenA (lpString="*.ppt") returned 5 [0057.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.pptx") returned 0 [0057.746] lstrlenA (lpString="*.pptx") returned 6 [0057.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.pdf") returned 0 [0057.746] lstrlenA (lpString="*.pdf") returned 5 [0057.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.mov") returned 0 [0057.746] lstrlenA (lpString="*.mov") returned 5 [0057.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.m2v") returned 0 [0057.746] lstrlenA (lpString="*.m2v") returned 5 [0057.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.3gp") returned 0 [0057.746] lstrlenA (lpString="*.3gp") returned 5 [0057.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.mpeg") returned 0 [0057.746] lstrlenA (lpString="*.mpeg") returned 6 [0057.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.mpg") returned 0 [0057.746] lstrlenA (lpString="*.mpg") returned 5 [0057.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.flv") returned 0 [0057.746] lstrlenA (lpString="*.flv") returned 5 [0057.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.avi") returned 0 [0057.746] lstrlenA (lpString="*.avi") returned 5 [0057.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.mp4") returned 0 [0057.746] lstrlenA (lpString="*.mp4") returned 5 [0057.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.wmv") returned 0 [0057.747] lstrlenA (lpString="*.wmv") returned 5 [0057.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.divx") returned 0 [0057.747] lstrlenA (lpString="*.divx") returned 6 [0057.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.mkv") returned 0 [0057.747] lstrlenA (lpString="*.mkv") returned 5 [0057.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.mp3") returned 0 [0057.747] lstrlenA (lpString="*.mp3") returned 5 [0057.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.wav") returned 0 [0057.747] lstrlenA (lpString="*.wav") returned 5 [0057.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.flac") returned 0 [0057.747] lstrlenA (lpString="*.flac") returned 6 [0057.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.ape") returned 0 [0057.747] lstrlenA (lpString="*.ape") returned 5 [0057.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.wma") returned 0 [0057.747] lstrlenA (lpString="*.wma") returned 5 [0057.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.ac3") returned 0 [0057.747] lstrlenA (lpString="*.ac3") returned 5 [0057.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", pszSpec="*.mxf") returned 0 [0057.747] lstrlenA (lpString="*.mxf") returned 5 [0057.747] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="Teal.css", cAlternateFileName="")) returned 1 [0057.747] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0057.747] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Teal.css") returned -1 [0057.747] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Teal.css") returned -1 [0057.747] lstrcmpiA (lpString1="", lpString2="Teal.css") returned -1 [0057.747] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css") returned="Swirl.css" [0057.747] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0057.747] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0057.747] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0057.747] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0057.747] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="Teal.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css" [0057.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.zip") returned 0 [0057.747] lstrlenA (lpString="*.zip") returned 5 [0057.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.rar") returned 0 [0057.748] lstrlenA (lpString="*.rar") returned 5 [0057.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.7z") returned 0 [0057.748] lstrlenA (lpString="*.7z") returned 4 [0057.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.tar") returned 0 [0057.748] lstrlenA (lpString="*.tar") returned 5 [0057.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.gzip") returned 0 [0057.748] lstrlenA (lpString="*.gzip") returned 6 [0057.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.jpg") returned 0 [0057.748] lstrlenA (lpString="*.jpg") returned 5 [0057.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.jpeg") returned 0 [0057.748] lstrlenA (lpString="*.jpeg") returned 6 [0057.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.psd") returned 0 [0057.748] lstrlenA (lpString="*.psd") returned 5 [0057.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.gif") returned 0 [0057.748] lstrlenA (lpString="*.gif") returned 5 [0057.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.doc") returned 0 [0057.748] lstrlenA (lpString="*.doc") returned 5 [0057.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.docx") returned 0 [0057.748] lstrlenA (lpString="*.docx") returned 6 [0057.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.xls") returned 0 [0057.748] lstrlenA (lpString="*.xls") returned 5 [0057.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.xlsx") returned 0 [0057.748] lstrlenA (lpString="*.xlsx") returned 6 [0057.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.ppt") returned 0 [0057.748] lstrlenA (lpString="*.ppt") returned 5 [0057.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.pptx") returned 0 [0057.748] lstrlenA (lpString="*.pptx") returned 6 [0057.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.pdf") returned 0 [0057.748] lstrlenA (lpString="*.pdf") returned 5 [0057.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.mov") returned 0 [0057.748] lstrlenA (lpString="*.mov") returned 5 [0057.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.m2v") returned 0 [0057.748] lstrlenA (lpString="*.m2v") returned 5 [0057.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.3gp") returned 0 [0057.748] lstrlenA (lpString="*.3gp") returned 5 [0057.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.mpeg") returned 0 [0057.749] lstrlenA (lpString="*.mpeg") returned 6 [0057.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.mpg") returned 0 [0057.749] lstrlenA (lpString="*.mpg") returned 5 [0057.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.flv") returned 0 [0057.749] lstrlenA (lpString="*.flv") returned 5 [0057.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.avi") returned 0 [0057.749] lstrlenA (lpString="*.avi") returned 5 [0057.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.mp4") returned 0 [0057.749] lstrlenA (lpString="*.mp4") returned 5 [0057.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.wmv") returned 0 [0057.749] lstrlenA (lpString="*.wmv") returned 5 [0057.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.divx") returned 0 [0057.749] lstrlenA (lpString="*.divx") returned 6 [0057.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.mkv") returned 0 [0057.749] lstrlenA (lpString="*.mkv") returned 5 [0057.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.mp3") returned 0 [0057.749] lstrlenA (lpString="*.mp3") returned 5 [0057.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.wav") returned 0 [0057.749] lstrlenA (lpString="*.wav") returned 5 [0057.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.flac") returned 0 [0057.749] lstrlenA (lpString="*.flac") returned 6 [0057.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.ape") returned 0 [0057.749] lstrlenA (lpString="*.ape") returned 5 [0057.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.wma") returned 0 [0057.749] lstrlenA (lpString="*.wma") returned 5 [0057.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.ac3") returned 0 [0057.749] lstrlenA (lpString="*.ac3") returned 5 [0057.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", pszSpec="*.mxf") returned 0 [0057.749] lstrlenA (lpString="*.mxf") returned 5 [0057.749] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x727, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="TexturedBlue.css", cAlternateFileName="TEXTUR~1.CSS")) returned 1 [0057.749] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0057.749] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TexturedBlue.css") returned -1 [0057.749] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TexturedBlue.css") returned -1 [0057.750] lstrcmpiA (lpString1="", lpString2="TexturedBlue.css") returned -1 [0057.750] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css") returned="Teal.css" [0057.750] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0057.750] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0057.750] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0057.750] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0057.750] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="TexturedBlue.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css" [0057.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.zip") returned 0 [0057.750] lstrlenA (lpString="*.zip") returned 5 [0057.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.rar") returned 0 [0057.750] lstrlenA (lpString="*.rar") returned 5 [0057.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.7z") returned 0 [0057.750] lstrlenA (lpString="*.7z") returned 4 [0057.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.tar") returned 0 [0057.750] lstrlenA (lpString="*.tar") returned 5 [0057.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.gzip") returned 0 [0057.750] lstrlenA (lpString="*.gzip") returned 6 [0057.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.jpg") returned 0 [0057.750] lstrlenA (lpString="*.jpg") returned 5 [0057.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.jpeg") returned 0 [0057.750] lstrlenA (lpString="*.jpeg") returned 6 [0057.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.psd") returned 0 [0057.750] lstrlenA (lpString="*.psd") returned 5 [0057.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.gif") returned 0 [0057.750] lstrlenA (lpString="*.gif") returned 5 [0057.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.doc") returned 0 [0057.750] lstrlenA (lpString="*.doc") returned 5 [0057.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.docx") returned 0 [0057.750] lstrlenA (lpString="*.docx") returned 6 [0057.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.xls") returned 0 [0057.750] lstrlenA (lpString="*.xls") returned 5 [0057.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.xlsx") returned 0 [0057.750] lstrlenA (lpString="*.xlsx") returned 6 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.ppt") returned 0 [0057.751] lstrlenA (lpString="*.ppt") returned 5 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.pptx") returned 0 [0057.751] lstrlenA (lpString="*.pptx") returned 6 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.pdf") returned 0 [0057.751] lstrlenA (lpString="*.pdf") returned 5 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.mov") returned 0 [0057.751] lstrlenA (lpString="*.mov") returned 5 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.m2v") returned 0 [0057.751] lstrlenA (lpString="*.m2v") returned 5 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.3gp") returned 0 [0057.751] lstrlenA (lpString="*.3gp") returned 5 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.mpeg") returned 0 [0057.751] lstrlenA (lpString="*.mpeg") returned 6 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.mpg") returned 0 [0057.751] lstrlenA (lpString="*.mpg") returned 5 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.flv") returned 0 [0057.751] lstrlenA (lpString="*.flv") returned 5 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.avi") returned 0 [0057.751] lstrlenA (lpString="*.avi") returned 5 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.mp4") returned 0 [0057.751] lstrlenA (lpString="*.mp4") returned 5 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.wmv") returned 0 [0057.751] lstrlenA (lpString="*.wmv") returned 5 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.divx") returned 0 [0057.751] lstrlenA (lpString="*.divx") returned 6 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.mkv") returned 0 [0057.751] lstrlenA (lpString="*.mkv") returned 5 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.mp3") returned 0 [0057.751] lstrlenA (lpString="*.mp3") returned 5 [0057.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.wav") returned 0 [0057.752] lstrlenA (lpString="*.wav") returned 5 [0057.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.flac") returned 0 [0057.752] lstrlenA (lpString="*.flac") returned 6 [0057.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.ape") returned 0 [0057.752] lstrlenA (lpString="*.ape") returned 5 [0057.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.wma") returned 0 [0057.752] lstrlenA (lpString="*.wma") returned 5 [0057.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.ac3") returned 0 [0057.752] lstrlenA (lpString="*.ac3") returned 5 [0057.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", pszSpec="*.mxf") returned 0 [0057.752] lstrlenA (lpString="*.mxf") returned 5 [0057.752] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x732, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="VelvetRose.css", cAlternateFileName="VELVET~1.CSS")) returned 1 [0057.752] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0057.752] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VelvetRose.css") returned -1 [0057.752] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VelvetRose.css") returned -1 [0057.752] lstrcmpiA (lpString1="", lpString2="VelvetRose.css") returned -1 [0057.752] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css") returned="TexturedBlue.css" [0057.752] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" [0057.752] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned="" [0057.752] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0057.752] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0057.752] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", lpString2="VelvetRose.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css" [0057.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.zip") returned 0 [0057.752] lstrlenA (lpString="*.zip") returned 5 [0057.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.rar") returned 0 [0057.752] lstrlenA (lpString="*.rar") returned 5 [0057.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.7z") returned 0 [0057.752] lstrlenA (lpString="*.7z") returned 4 [0057.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.tar") returned 0 [0057.752] lstrlenA (lpString="*.tar") returned 5 [0057.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.gzip") returned 0 [0057.753] lstrlenA (lpString="*.gzip") returned 6 [0057.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.jpg") returned 0 [0057.753] lstrlenA (lpString="*.jpg") returned 5 [0057.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.jpeg") returned 0 [0057.753] lstrlenA (lpString="*.jpeg") returned 6 [0057.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.psd") returned 0 [0057.753] lstrlenA (lpString="*.psd") returned 5 [0057.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.gif") returned 0 [0057.753] lstrlenA (lpString="*.gif") returned 5 [0057.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.doc") returned 0 [0057.753] lstrlenA (lpString="*.doc") returned 5 [0057.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.docx") returned 0 [0057.753] lstrlenA (lpString="*.docx") returned 6 [0057.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.xls") returned 0 [0057.753] lstrlenA (lpString="*.xls") returned 5 [0057.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.xlsx") returned 0 [0057.753] lstrlenA (lpString="*.xlsx") returned 6 [0057.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.ppt") returned 0 [0057.753] lstrlenA (lpString="*.ppt") returned 5 [0057.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.pptx") returned 0 [0057.753] lstrlenA (lpString="*.pptx") returned 6 [0057.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.pdf") returned 0 [0057.753] lstrlenA (lpString="*.pdf") returned 5 [0057.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.mov") returned 0 [0057.753] lstrlenA (lpString="*.mov") returned 5 [0057.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.m2v") returned 0 [0057.753] lstrlenA (lpString="*.m2v") returned 5 [0057.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.3gp") returned 0 [0057.753] lstrlenA (lpString="*.3gp") returned 5 [0057.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.mpeg") returned 0 [0057.753] lstrlenA (lpString="*.mpeg") returned 6 [0057.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.mpg") returned 0 [0057.753] lstrlenA (lpString="*.mpg") returned 5 [0057.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.flv") returned 0 [0057.754] lstrlenA (lpString="*.flv") returned 5 [0057.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.avi") returned 0 [0057.754] lstrlenA (lpString="*.avi") returned 5 [0057.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.mp4") returned 0 [0057.754] lstrlenA (lpString="*.mp4") returned 5 [0057.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.wmv") returned 0 [0057.754] lstrlenA (lpString="*.wmv") returned 5 [0057.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.divx") returned 0 [0057.754] lstrlenA (lpString="*.divx") returned 6 [0057.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.mkv") returned 0 [0057.754] lstrlenA (lpString="*.mkv") returned 5 [0057.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.mp3") returned 0 [0057.754] lstrlenA (lpString="*.mp3") returned 5 [0057.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.wav") returned 0 [0057.754] lstrlenA (lpString="*.wav") returned 5 [0057.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.flac") returned 0 [0057.754] lstrlenA (lpString="*.flac") returned 6 [0057.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.ape") returned 0 [0057.754] lstrlenA (lpString="*.ape") returned 5 [0057.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.wma") returned 0 [0057.754] lstrlenA (lpString="*.wma") returned 5 [0057.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.ac3") returned 0 [0057.754] lstrlenA (lpString="*.ac3") returned 5 [0057.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", pszSpec="*.mxf") returned 0 [0057.754] lstrlenA (lpString="*.mxf") returned 5 [0057.754] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x732, dwReserved0=0x500059, dwReserved1=0x200054, cFileName="VelvetRose.css", cAlternateFileName="VELVET~1.CSS")) returned 0 [0057.754] FindClose (in: hFindFile=0x2d8150 | out: hFindFile=0x2d8150) returned 1 [0057.754] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="FormsStyles", cAlternateFileName="FORMSS~1")) returned 0 [0057.755] FindClose (in: hFindFile=0x2d7ff8 | out: hFindFile=0x2d7ff8) returned 1 [0057.755] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c91e000, ftCreationTime.dwHighDateTime=0x1cacb46, ftLastAccessTime.dwLowDateTime=0xfd5e6bd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8c91e000, ftLastWriteTime.dwHighDateTime=0x1cacb46, nFileSizeHigh=0x0, nFileSizeLow=0x863360, dwReserved0=0x2d80a8, dwReserved1=0x3, cFileName="GrooveIntlResource.dll", cAlternateFileName="GROOVE~1.DLL")) returned 1 [0057.755] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.755] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GrooveIntlResource.dll") returned -1 [0057.755] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GrooveIntlResource.dll") returned 1 [0057.755] lstrcmpiA (lpString1="", lpString2="GrooveIntlResource.dll") returned -1 [0057.755] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\*.*") returned="*.*" [0057.755] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.755] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.755] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.755] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.755] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="GrooveIntlResource.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll" [0057.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.zip") returned 0 [0057.755] lstrlenA (lpString="*.zip") returned 5 [0057.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.rar") returned 0 [0057.755] lstrlenA (lpString="*.rar") returned 5 [0057.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.7z") returned 0 [0057.755] lstrlenA (lpString="*.7z") returned 4 [0057.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.tar") returned 0 [0057.755] lstrlenA (lpString="*.tar") returned 5 [0057.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.gzip") returned 0 [0057.755] lstrlenA (lpString="*.gzip") returned 6 [0057.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.jpg") returned 0 [0057.755] lstrlenA (lpString="*.jpg") returned 5 [0057.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.jpeg") returned 0 [0057.755] lstrlenA (lpString="*.jpeg") returned 6 [0057.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.psd") returned 0 [0057.755] lstrlenA (lpString="*.psd") returned 5 [0057.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.gif") returned 0 [0057.755] lstrlenA (lpString="*.gif") returned 5 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.doc") returned 0 [0057.756] lstrlenA (lpString="*.doc") returned 5 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.docx") returned 0 [0057.756] lstrlenA (lpString="*.docx") returned 6 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.xls") returned 0 [0057.756] lstrlenA (lpString="*.xls") returned 5 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.xlsx") returned 0 [0057.756] lstrlenA (lpString="*.xlsx") returned 6 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.ppt") returned 0 [0057.756] lstrlenA (lpString="*.ppt") returned 5 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.pptx") returned 0 [0057.756] lstrlenA (lpString="*.pptx") returned 6 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.pdf") returned 0 [0057.756] lstrlenA (lpString="*.pdf") returned 5 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.mov") returned 0 [0057.756] lstrlenA (lpString="*.mov") returned 5 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.m2v") returned 0 [0057.756] lstrlenA (lpString="*.m2v") returned 5 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.3gp") returned 0 [0057.756] lstrlenA (lpString="*.3gp") returned 5 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.mpeg") returned 0 [0057.756] lstrlenA (lpString="*.mpeg") returned 6 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.mpg") returned 0 [0057.756] lstrlenA (lpString="*.mpg") returned 5 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.flv") returned 0 [0057.756] lstrlenA (lpString="*.flv") returned 5 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.avi") returned 0 [0057.756] lstrlenA (lpString="*.avi") returned 5 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.mp4") returned 0 [0057.756] lstrlenA (lpString="*.mp4") returned 5 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.wmv") returned 0 [0057.756] lstrlenA (lpString="*.wmv") returned 5 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.divx") returned 0 [0057.756] lstrlenA (lpString="*.divx") returned 6 [0057.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.mkv") returned 0 [0057.756] lstrlenA (lpString="*.mkv") returned 5 [0057.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.mp3") returned 0 [0057.757] lstrlenA (lpString="*.mp3") returned 5 [0057.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.wav") returned 0 [0057.757] lstrlenA (lpString="*.wav") returned 5 [0057.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.flac") returned 0 [0057.757] lstrlenA (lpString="*.flac") returned 6 [0057.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.ape") returned 0 [0057.757] lstrlenA (lpString="*.ape") returned 5 [0057.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.wma") returned 0 [0057.757] lstrlenA (lpString="*.wma") returned 5 [0057.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.ac3") returned 0 [0057.757] lstrlenA (lpString="*.ac3") returned 5 [0057.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", pszSpec="*.mxf") returned 0 [0057.757] lstrlenA (lpString="*.mxf") returned 5 [0057.757] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xfd59a910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE_COL.HXC", cAlternateFileName="GROOVE~1.HXC")) returned 1 [0057.757] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.757] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GROOVE_COL.HXC") returned -1 [0057.757] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GROOVE_COL.HXC") returned 1 [0057.757] lstrcmpiA (lpString1="", lpString2="GROOVE_COL.HXC") returned -1 [0057.757] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned="GrooveIntlResource.dll" [0057.757] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.757] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.757] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.757] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.757] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="GROOVE_COL.HXC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" [0057.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.zip") returned 0 [0057.757] lstrlenA (lpString="*.zip") returned 5 [0057.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.rar") returned 0 [0057.757] lstrlenA (lpString="*.rar") returned 5 [0057.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.7z") returned 0 [0057.757] lstrlenA (lpString="*.7z") returned 4 [0057.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.tar") returned 0 [0057.758] lstrlenA (lpString="*.tar") returned 5 [0057.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.gzip") returned 0 [0057.758] lstrlenA (lpString="*.gzip") returned 6 [0057.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.jpg") returned 0 [0057.758] lstrlenA (lpString="*.jpg") returned 5 [0057.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.jpeg") returned 0 [0057.758] lstrlenA (lpString="*.jpeg") returned 6 [0057.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.psd") returned 0 [0057.758] lstrlenA (lpString="*.psd") returned 5 [0057.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.gif") returned 0 [0057.758] lstrlenA (lpString="*.gif") returned 5 [0057.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.doc") returned 0 [0057.758] lstrlenA (lpString="*.doc") returned 5 [0057.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.docx") returned 0 [0057.758] lstrlenA (lpString="*.docx") returned 6 [0057.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.xls") returned 0 [0057.758] lstrlenA (lpString="*.xls") returned 5 [0057.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.xlsx") returned 0 [0057.758] lstrlenA (lpString="*.xlsx") returned 6 [0057.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.ppt") returned 0 [0057.758] lstrlenA (lpString="*.ppt") returned 5 [0057.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.pptx") returned 0 [0057.758] lstrlenA (lpString="*.pptx") returned 6 [0057.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.pdf") returned 0 [0057.758] lstrlenA (lpString="*.pdf") returned 5 [0057.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.mov") returned 0 [0057.758] lstrlenA (lpString="*.mov") returned 5 [0057.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.m2v") returned 0 [0057.758] lstrlenA (lpString="*.m2v") returned 5 [0057.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.3gp") returned 0 [0057.758] lstrlenA (lpString="*.3gp") returned 5 [0057.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.mpeg") returned 0 [0057.758] lstrlenA (lpString="*.mpeg") returned 6 [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.mpg") returned 0 [0057.759] lstrlenA (lpString="*.mpg") returned 5 [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.flv") returned 0 [0057.759] lstrlenA (lpString="*.flv") returned 5 [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.avi") returned 0 [0057.759] lstrlenA (lpString="*.avi") returned 5 [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.mp4") returned 0 [0057.759] lstrlenA (lpString="*.mp4") returned 5 [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.wmv") returned 0 [0057.759] lstrlenA (lpString="*.wmv") returned 5 [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.divx") returned 0 [0057.759] lstrlenA (lpString="*.divx") returned 6 [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.mkv") returned 0 [0057.759] lstrlenA (lpString="*.mkv") returned 5 [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.mp3") returned 0 [0057.759] lstrlenA (lpString="*.mp3") returned 5 [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.wav") returned 0 [0057.759] lstrlenA (lpString="*.wav") returned 5 [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.flac") returned 0 [0057.759] lstrlenA (lpString="*.flac") returned 6 [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.ape") returned 0 [0057.759] lstrlenA (lpString="*.ape") returned 5 [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.wma") returned 0 [0057.759] lstrlenA (lpString="*.wma") returned 5 [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.ac3") returned 0 [0057.759] lstrlenA (lpString="*.ac3") returned 5 [0057.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", pszSpec="*.mxf") returned 0 [0057.759] lstrlenA (lpString="*.mxf") returned 5 [0057.759] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e7b500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd59a910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd5e7b500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE_COL.HXT", cAlternateFileName="GROOVE~1.HXT")) returned 1 [0057.759] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.759] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GROOVE_COL.HXT") returned -1 [0057.759] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GROOVE_COL.HXT") returned 1 [0057.759] lstrcmpiA (lpString1="", lpString2="GROOVE_COL.HXT") returned -1 [0057.759] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned="GROOVE_COL.HXC" [0057.760] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.760] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.760] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.760] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.760] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="GROOVE_COL.HXT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.zip") returned 0 [0057.760] lstrlenA (lpString="*.zip") returned 5 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.rar") returned 0 [0057.760] lstrlenA (lpString="*.rar") returned 5 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.7z") returned 0 [0057.760] lstrlenA (lpString="*.7z") returned 4 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.tar") returned 0 [0057.760] lstrlenA (lpString="*.tar") returned 5 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.gzip") returned 0 [0057.760] lstrlenA (lpString="*.gzip") returned 6 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.jpg") returned 0 [0057.760] lstrlenA (lpString="*.jpg") returned 5 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.jpeg") returned 0 [0057.760] lstrlenA (lpString="*.jpeg") returned 6 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.psd") returned 0 [0057.760] lstrlenA (lpString="*.psd") returned 5 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.gif") returned 0 [0057.760] lstrlenA (lpString="*.gif") returned 5 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.doc") returned 0 [0057.760] lstrlenA (lpString="*.doc") returned 5 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.docx") returned 0 [0057.760] lstrlenA (lpString="*.docx") returned 6 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.xls") returned 0 [0057.760] lstrlenA (lpString="*.xls") returned 5 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.xlsx") returned 0 [0057.760] lstrlenA (lpString="*.xlsx") returned 6 [0057.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.ppt") returned 0 [0057.760] lstrlenA (lpString="*.ppt") returned 5 [0057.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.pptx") returned 0 [0057.761] lstrlenA (lpString="*.pptx") returned 6 [0057.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.pdf") returned 0 [0057.761] lstrlenA (lpString="*.pdf") returned 5 [0057.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.mov") returned 0 [0057.761] lstrlenA (lpString="*.mov") returned 5 [0057.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.m2v") returned 0 [0057.761] lstrlenA (lpString="*.m2v") returned 5 [0057.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.3gp") returned 0 [0057.761] lstrlenA (lpString="*.3gp") returned 5 [0057.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.mpeg") returned 0 [0057.761] lstrlenA (lpString="*.mpeg") returned 6 [0057.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.mpg") returned 0 [0057.761] lstrlenA (lpString="*.mpg") returned 5 [0057.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.flv") returned 0 [0057.761] lstrlenA (lpString="*.flv") returned 5 [0057.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.avi") returned 0 [0057.761] lstrlenA (lpString="*.avi") returned 5 [0057.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.mp4") returned 0 [0057.761] lstrlenA (lpString="*.mp4") returned 5 [0057.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.wmv") returned 0 [0057.761] lstrlenA (lpString="*.wmv") returned 5 [0057.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.divx") returned 0 [0057.761] lstrlenA (lpString="*.divx") returned 6 [0057.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.mkv") returned 0 [0057.762] lstrlenA (lpString="*.mkv") returned 5 [0057.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.mp3") returned 0 [0057.762] lstrlenA (lpString="*.mp3") returned 5 [0057.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.wav") returned 0 [0057.762] lstrlenA (lpString="*.wav") returned 5 [0057.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.flac") returned 0 [0057.762] lstrlenA (lpString="*.flac") returned 6 [0057.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.ape") returned 0 [0057.762] lstrlenA (lpString="*.ape") returned 5 [0057.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.wma") returned 0 [0057.762] lstrlenA (lpString="*.wma") returned 5 [0057.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.ac3") returned 0 [0057.762] lstrlenA (lpString="*.ac3") returned 5 [0057.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", pszSpec="*.mxf") returned 0 [0057.762] lstrlenA (lpString="*.mxf") returned 5 [0057.762] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e7b500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd59a910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd5e7b500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE_F_COL.HXK", cAlternateFileName="GROOVE~1.HXK")) returned 1 [0057.762] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.762] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GROOVE_F_COL.HXK") returned -1 [0057.762] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GROOVE_F_COL.HXK") returned 1 [0057.762] lstrcmpiA (lpString1="", lpString2="GROOVE_F_COL.HXK") returned -1 [0057.762] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned="GROOVE_COL.HXT" [0057.762] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.762] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.762] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.762] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.762] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="GROOVE_F_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" [0057.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK", pszSpec="*.zip") returned 0 [0057.762] lstrlenA (lpString="*.zip") returned 5 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK", pszSpec="*.rar") returned 0 [0057.763] lstrlenA (lpString="*.rar") returned 5 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK", pszSpec="*.7z") returned 0 [0057.763] lstrlenA (lpString="*.7z") returned 4 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK", pszSpec="*.tar") returned 0 [0057.763] lstrlenA (lpString="*.tar") returned 5 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK", pszSpec="*.gzip") returned 0 [0057.763] lstrlenA (lpString="*.gzip") returned 6 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK", pszSpec="*.jpg") returned 0 [0057.763] lstrlenA (lpString="*.jpg") returned 5 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK", pszSpec="*.jpeg") returned 0 [0057.763] lstrlenA (lpString="*.jpeg") returned 6 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK", pszSpec="*.psd") returned 0 [0057.763] lstrlenA (lpString="*.psd") returned 5 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK", pszSpec="*.gif") returned 0 [0057.763] lstrlenA (lpString="*.gif") returned 5 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK", pszSpec="*.doc") returned 0 [0057.763] lstrlenA (lpString="*.doc") returned 5 [0057.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK", pszSpec="*.docx") returned 0 [0057.763] lstrlenA (lpString="*.docx") returned 6 [0057.763] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e7b500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd59a910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd5e7b500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE_K_COL.HXK", cAlternateFileName="GROOVE~2.HXK")) returned 1 [0057.763] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.763] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GROOVE_K_COL.HXK") returned -1 [0057.764] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GROOVE_K_COL.HXK") returned 1 [0057.764] lstrcmpiA (lpString1="", lpString2="GROOVE_K_COL.HXK") returned -1 [0057.764] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned="GROOVE_F_COL.HXK" [0057.764] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.764] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.764] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.764] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.764] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="GROOVE_K_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" [0057.764] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x360, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0057.764] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.764] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0057.764] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0057.764] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50977140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x8d68, dwReserved0=0x18f7bc, dwReserved1=0x4f0048, cFileName="HVAC.VSL", cAlternateFileName="")) returned 1 [0057.764] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.764] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HVAC.VSL") returned -1 [0057.764] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HVAC.VSL") returned -1 [0057.764] lstrcmpiA (lpString1="", lpString2="HVAC.VSL") returned -1 [0057.764] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned="GROOVE_K_COL.HXK" [0057.764] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.764] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.764] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.764] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.764] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HVAC.VSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" [0057.764] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ede00, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x5099d2a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7ede00, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x77f, dwReserved0=0x0, dwReserved1=0x0, cFileName="HVACDIFF.VRD", cAlternateFileName="")) returned 1 [0057.764] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.765] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HVACDIFF.VRD") returned -1 [0057.765] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HVACDIFF.VRD") returned -1 [0057.765] lstrcmpiA (lpString1="", lpString2="HVACDIFF.VRD") returned -1 [0057.765] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned="HVAC.VSL" [0057.765] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.765] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.765] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.765] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.765] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HVACDIFF.VRD" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" [0057.765] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ede00, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x5099d2a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7ede00, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x51d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HVACDUCT.VRD", cAlternateFileName="")) returned 1 [0057.765] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.765] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HVACDUCT.VRD") returned -1 [0057.765] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HVACDUCT.VRD") returned -1 [0057.765] lstrcmpiA (lpString1="", lpString2="HVACDUCT.VRD") returned -1 [0057.765] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned="HVACDIFF.VRD" [0057.765] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.765] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.765] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.765] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.765] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HVACDUCT.VRD" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" [0057.765] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53500, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1f53500, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x75790, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFINTL.DLL", cAlternateFileName="")) returned 1 [0057.765] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.765] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="INFINTL.DLL") returned -1 [0057.765] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INFINTL.DLL") returned -1 [0057.765] lstrcmpiA (lpString1="", lpString2="INFINTL.DLL") returned -1 [0057.765] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned="HVACDUCT.VRD" [0057.765] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.766] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.766] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.766] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.766] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="INFINTL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL" [0057.766] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98679500, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98679500, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x174d06, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATH.HXS", cAlternateFileName="")) returned 1 [0057.766] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.766] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="INFOPATH.HXS") returned -1 [0057.766] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INFOPATH.HXS") returned -1 [0057.766] lstrcmpiA (lpString1="", lpString2="INFOPATH.HXS") returned -1 [0057.766] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned="INFINTL.DLL" [0057.766] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.766] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.766] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.766] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.766] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="INFOPATH.HXS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" [0057.766] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98679500, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98679500, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x697e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATHEDITOR.HXS", cAlternateFileName="INFOPA~1.HXS")) returned 1 [0057.766] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.766] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="INFOPATHEDITOR.HXS") returned -1 [0057.766] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INFOPATHEDITOR.HXS") returned -1 [0057.766] lstrcmpiA (lpString1="", lpString2="INFOPATHEDITOR.HXS") returned -1 [0057.766] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned="INFOPATH.HXS" [0057.766] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.766] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.766] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.766] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.766] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="INFOPATHEDITOR.HXS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" [0057.766] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATHEDITOR_COL.HXC", cAlternateFileName="INFOPA~2.HXC")) returned 1 [0057.767] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.767] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="INFOPATHEDITOR_COL.HXC") returned -1 [0057.767] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INFOPATHEDITOR_COL.HXC") returned -1 [0057.767] lstrcmpiA (lpString1="", lpString2="INFOPATHEDITOR_COL.HXC") returned -1 [0057.767] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned="INFOPATHEDITOR.HXS" [0057.767] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.767] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.767] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.767] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.767] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="INFOPATHEDITOR_COL.HXC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" [0057.767] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcc29600, ftCreationTime.dwHighDateTime=0x1c59321, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcc29600, ftLastWriteTime.dwHighDateTime=0x1c59321, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATHEDITOR_COL.HXT", cAlternateFileName="INFOPA~2.HXT")) returned 1 [0057.767] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.767] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="INFOPATHEDITOR_COL.HXT") returned -1 [0057.767] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INFOPATHEDITOR_COL.HXT") returned -1 [0057.767] lstrcmpiA (lpString1="", lpString2="INFOPATHEDITOR_COL.HXT") returned -1 [0057.767] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned="INFOPATHEDITOR_COL.HXC" [0057.767] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.767] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.767] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.767] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.767] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="INFOPATHEDITOR_COL.HXT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" [0057.767] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcc29600, ftCreationTime.dwHighDateTime=0x1c59321, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcc29600, ftLastWriteTime.dwHighDateTime=0x1c59321, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATHEDITOR_F_COL.HXK", cAlternateFileName="INFOPA~3.HXK")) returned 1 [0057.767] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.767] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="INFOPATHEDITOR_F_COL.HXK") returned -1 [0057.767] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INFOPATHEDITOR_F_COL.HXK") returned -1 [0057.767] lstrcmpiA (lpString1="", lpString2="INFOPATHEDITOR_F_COL.HXK") returned -1 [0057.767] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned="INFOPATHEDITOR_COL.HXT" [0057.767] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.767] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.768] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="INFOPATHEDITOR_F_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" [0057.768] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcc29600, ftCreationTime.dwHighDateTime=0x1c59321, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcc29600, ftLastWriteTime.dwHighDateTime=0x1c59321, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATHEDITOR_K_COL.HXK", cAlternateFileName="INFOPA~4.HXK")) returned 1 [0057.768] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.768] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="INFOPATHEDITOR_K_COL.HXK") returned -1 [0057.768] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INFOPATHEDITOR_K_COL.HXK") returned -1 [0057.768] lstrcmpiA (lpString1="", lpString2="INFOPATHEDITOR_K_COL.HXK") returned -1 [0057.768] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned="INFOPATHEDITOR_F_COL.HXK" [0057.768] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.768] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.768] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="INFOPATHEDITOR_K_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" [0057.768] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATH_COL.HXC", cAlternateFileName="INFOPA~1.HXC")) returned 1 [0057.768] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.768] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="INFOPATH_COL.HXC") returned -1 [0057.768] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INFOPATH_COL.HXC") returned -1 [0057.768] lstrcmpiA (lpString1="", lpString2="INFOPATH_COL.HXC") returned -1 [0057.768] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned="INFOPATHEDITOR_K_COL.HXK" [0057.768] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.768] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.768] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="INFOPATH_COL.HXC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" [0057.768] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8c8500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f8c8500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATH_COL.HXT", cAlternateFileName="INFOPA~1.HXT")) returned 1 [0057.769] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.769] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="INFOPATH_COL.HXT") returned -1 [0057.769] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INFOPATH_COL.HXT") returned -1 [0057.769] lstrcmpiA (lpString1="", lpString2="INFOPATH_COL.HXT") returned -1 [0057.769] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned="INFOPATH_COL.HXC" [0057.769] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.769] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.769] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.769] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.769] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="INFOPATH_COL.HXT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" [0057.769] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8c8500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f8c8500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATH_F_COL.HXK", cAlternateFileName="INFOPA~1.HXK")) returned 1 [0057.769] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.769] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="INFOPATH_F_COL.HXK") returned -1 [0057.769] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INFOPATH_F_COL.HXK") returned -1 [0057.769] lstrcmpiA (lpString1="", lpString2="INFOPATH_F_COL.HXK") returned -1 [0057.769] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned="INFOPATH_COL.HXT" [0057.769] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.769] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.769] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.769] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.769] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="INFOPATH_F_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" [0057.769] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8c8500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f8c8500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATH_K_COL.HXK", cAlternateFileName="INFOPA~2.HXK")) returned 1 [0057.769] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.769] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="INFOPATH_K_COL.HXK") returned -1 [0057.769] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INFOPATH_K_COL.HXK") returned -1 [0057.769] lstrcmpiA (lpString1="", lpString2="INFOPATH_K_COL.HXK") returned -1 [0057.769] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned="INFOPATH_F_COL.HXK" [0057.769] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.769] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.769] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.770] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.770] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="INFOPATH_K_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" [0057.770] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x108a400, ftCreationTime.dwHighDateTime=0x1c56bc5, ftLastAccessTime.dwLowDateTime=0x509c3400, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x108a400, ftLastWriteTime.dwHighDateTime=0x1c56bc5, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0x0, dwReserved1=0x0, cFileName="INSTLIST.VRD", cAlternateFileName="")) returned 1 [0057.770] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.770] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="INSTLIST.VRD") returned -1 [0057.770] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INSTLIST.VRD") returned -1 [0057.770] lstrcmpiA (lpString1="", lpString2="INSTLIST.VRD") returned -1 [0057.770] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned="INFOPATH_K_COL.HXK" [0057.770] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.770] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.770] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.770] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.770] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="INSTLIST.VRD" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" [0057.770] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37deba00, ftCreationTime.dwHighDateTime=0x1c56bc5, ftLastAccessTime.dwLowDateTime=0x509c3400, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x37deba00, ftLastWriteTime.dwHighDateTime=0x1c56bc5, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x0, cFileName="INVENTRY.VRD", cAlternateFileName="")) returned 1 [0057.771] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.771] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="INVENTRY.VRD") returned -1 [0057.771] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INVENTRY.VRD") returned -1 [0057.771] lstrcmpiA (lpString1="", lpString2="INVENTRY.VRD") returned -1 [0057.771] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned="INSTLIST.VRD" [0057.771] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.771] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.771] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.771] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.771] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="INVENTRY.VRD" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" [0057.771] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3491f00, ftCreationTime.dwHighDateTime=0x1ca0f52, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3491f00, ftLastWriteTime.dwHighDateTime=0x1ca0f52, nFileSizeHigh=0x0, nFileSizeLow=0x2bc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Invite or Link.one", cAlternateFileName="INVITE~1.ONE")) returned 1 [0057.771] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.771] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Invite or Link.one") returned -1 [0057.771] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Invite or Link.one") returned -1 [0057.771] lstrcmpiA (lpString1="", lpString2="Invite or Link.one") returned -1 [0057.771] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned="INVENTRY.VRD" [0057.771] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.771] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.772] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.772] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.772] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="Invite or Link.one" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Invite or Link.one") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Invite or Link.one" [0057.772] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53500, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1f53500, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x22a590, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPDSINTL.DLL", cAlternateFileName="")) returned 1 [0057.772] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.772] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IPDSINTL.DLL") returned -1 [0057.772] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPDSINTL.DLL") returned -1 [0057.772] lstrcmpiA (lpString1="", lpString2="IPDSINTL.DLL") returned -1 [0057.772] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Invite or Link.one") returned="Invite or Link.one" [0057.772] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.772] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.772] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.772] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.772] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="IPDSINTL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL" [0057.772] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53500, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe1f53500, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0xd7b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPEDINTL.DLL", cAlternateFileName="")) returned 1 [0057.772] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.772] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IPEDINTL.DLL") returned -1 [0057.772] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPEDINTL.DLL") returned -1 [0057.772] lstrcmpiA (lpString1="", lpString2="IPEDINTL.DLL") returned -1 [0057.772] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned="IPDSINTL.DLL" [0057.772] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.772] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.772] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.772] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.772] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="IPEDINTL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL" [0057.772] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53500, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1f53500, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x3e7b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPOLKINTL.DLL", cAlternateFileName="IPOLKI~1.DLL")) returned 1 [0057.772] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.773] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IPOLKINTL.DLL") returned -1 [0057.773] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPOLKINTL.DLL") returned -1 [0057.773] lstrcmpiA (lpString1="", lpString2="IPOLKINTL.DLL") returned -1 [0057.773] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned="IPEDINTL.DLL" [0057.773] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.773] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.773] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.773] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.773] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="IPOLKINTL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL" [0057.773] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f81800, ftCreationTime.dwHighDateTime=0x1c913a0, ftLastAccessTime.dwLowDateTime=0xfd5e6bd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x66f81800, ftLastWriteTime.dwHighDateTime=0x1c913a0, nFileSizeHigh=0x0, nFileSizeLow=0x3cebf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Issue Tracking.gta", cAlternateFileName="ISSUET~1.GTA")) returned 1 [0057.773] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.773] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Issue Tracking.gta") returned -1 [0057.773] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Issue Tracking.gta") returned -1 [0057.773] lstrcmpiA (lpString1="", lpString2="Issue Tracking.gta") returned -1 [0057.773] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned="IPOLKINTL.DLL" [0057.773] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.773] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.773] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.773] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.773] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="Issue Tracking.gta" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" [0057.773] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x509e9560, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="JADE.CSS", cAlternateFileName="")) returned 1 [0057.773] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.773] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="JADE.CSS") returned -1 [0057.773] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="JADE.CSS") returned -1 [0057.773] lstrcmpiA (lpString1="", lpString2="JADE.CSS") returned -1 [0057.773] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned="Issue Tracking.gta" [0057.773] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.773] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.774] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.774] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.774] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="JADE.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\JADE.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\JADE.CSS" [0057.774] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe69b00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50a35820, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xafe69b00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x9980, dwReserved0=0x0, dwReserved1=0x0, cFileName="LGND.VSL", cAlternateFileName="")) returned 1 [0057.774] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.774] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LGND.VSL") returned -1 [0057.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LGND.VSL") returned -1 [0057.774] lstrcmpiA (lpString1="", lpString2="LGND.VSL") returned -1 [0057.774] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\JADE.CSS") returned="JADE.CSS" [0057.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.774] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.774] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.774] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.774] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="LGND.VSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" [0057.774] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0xf2dd30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x112970, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIR.DLL", cAlternateFileName="")) returned 1 [0057.774] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.774] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MAPIR.DLL") returned -1 [0057.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MAPIR.DLL") returned -1 [0057.774] lstrcmpiA (lpString1="", lpString2="MAPIR.DLL") returned -1 [0057.774] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned="LGND.VSL" [0057.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.774] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.774] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.774] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.774] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MAPIR.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL" [0057.775] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2411fa00, ftCreationTime.dwHighDateTime=0x1cac9b2, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2411fa00, ftLastWriteTime.dwHighDateTime=0x1cac9b2, nFileSizeHigh=0x0, nFileSizeLow=0x1a780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIR.DLL.IDX_DLL", cAlternateFileName="MAPIRD~1.IDX")) returned 1 [0057.775] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.777] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MAPIR.DLL.IDX_DLL") returned -1 [0057.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MAPIR.DLL.IDX_DLL") returned -1 [0057.777] lstrcmpiA (lpString1="", lpString2="MAPIR.DLL.IDX_DLL") returned -1 [0057.777] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned="MAPIR.DLL" [0057.777] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.777] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.777] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.777] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.777] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MAPIR.DLL.IDX_DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL" [0057.777] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0xf2dd30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x907d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPISHELLR.DLL", cAlternateFileName="MAPISH~1.DLL")) returned 1 [0057.777] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.777] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MAPISHELLR.DLL") returned -1 [0057.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MAPISHELLR.DLL") returned -1 [0057.777] lstrcmpiA (lpString1="", lpString2="MAPISHELLR.DLL") returned -1 [0057.777] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned="MAPIR.DLL.IDX_DLL" [0057.777] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.778] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.778] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.778] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.778] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MAPISHELLR.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL" [0057.778] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50aa7c40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x100fb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MERES.DLL", cAlternateFileName="")) returned 1 [0057.778] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.778] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MERES.DLL") returned -1 [0057.778] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MERES.DLL") returned -1 [0057.778] lstrcmpiA (lpString1="", lpString2="MERES.DLL") returned -1 [0057.778] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned="MAPISHELLR.DLL" [0057.778] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.778] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.778] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.778] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.778] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MERES.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL" [0057.778] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe105a200, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x1ba28770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe105a200, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x6cf68, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOR6INT.DLL", cAlternateFileName="")) returned 1 [0057.778] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.778] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MOR6INT.DLL") returned -1 [0057.778] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MOR6INT.DLL") returned -1 [0057.778] lstrcmpiA (lpString1="", lpString2="MOR6INT.DLL") returned -1 [0057.778] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned="MERES.DLL" [0057.778] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.778] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.778] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.778] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.778] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MOR6INT.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL" [0057.779] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7146200, ftCreationTime.dwHighDateTime=0x1cab7cc, ftLastAccessTime.dwLowDateTime=0x1ba28770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7146200, ftLastWriteTime.dwHighDateTime=0x1cab7cc, nFileSizeHigh=0x0, nFileSizeLow=0x9b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOR6INT.REST.IDX_DLL", cAlternateFileName="MOR6IN~1.IDX")) returned 1 [0057.779] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.779] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MOR6INT.REST.IDX_DLL") returned -1 [0057.779] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MOR6INT.REST.IDX_DLL") returned -1 [0057.779] lstrcmpiA (lpString1="", lpString2="MOR6INT.REST.IDX_DLL") returned -1 [0057.779] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned="MOR6INT.DLL" [0057.779] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.779] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.779] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.779] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.779] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MOR6INT.REST.IDX_DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL" [0057.779] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b00b00, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50aa7c40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1b00b00, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x58c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOVE.VRD", cAlternateFileName="")) returned 1 [0057.779] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.779] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MOVE.VRD") returned -1 [0057.779] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MOVE.VRD") returned -1 [0057.779] lstrcmpiA (lpString1="", lpString2="MOVE.VRD") returned -1 [0057.779] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned="MOR6INT.REST.IDX_DLL" [0057.779] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.779] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.779] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.779] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.779] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MOVE.VRD" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" [0057.779] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50aa7c40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x3178, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPXRES.DLL", cAlternateFileName="")) returned 1 [0057.779] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.779] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MPXRES.DLL") returned -1 [0057.779] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MPXRES.DLL") returned -1 [0057.779] lstrcmpiA (lpString1="", lpString2="MPXRES.DLL") returned -1 [0057.779] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned="MOVE.VRD" [0057.780] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.780] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.780] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.780] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.780] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MPXRES.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL" [0057.780] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e84c00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88e84c00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0xa3f874, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.DEV.HXS", cAlternateFileName="MSACCE~1.HXS")) returned 1 [0057.780] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.780] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSACCESS.DEV.HXS") returned -1 [0057.780] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSACCESS.DEV.HXS") returned -1 [0057.780] lstrcmpiA (lpString1="", lpString2="MSACCESS.DEV.HXS") returned -1 [0057.780] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned="MPXRES.DLL" [0057.780] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.780] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.780] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.780] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.780] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSACCESS.DEV.HXS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS" [0057.780] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.DEV_COL.HXC", cAlternateFileName="MSACCE~1.HXC")) returned 1 [0057.780] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.780] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSACCESS.DEV_COL.HXC") returned -1 [0057.780] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSACCESS.DEV_COL.HXC") returned -1 [0057.780] lstrcmpiA (lpString1="", lpString2="MSACCESS.DEV_COL.HXC") returned -1 [0057.781] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned="MSACCESS.DEV.HXS" [0057.781] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.781] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.781] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.781] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.781] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSACCESS.DEV_COL.HXC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" [0057.781] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e4c000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37e4c000, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.DEV_COL.HXT", cAlternateFileName="MSACCE~1.HXT")) returned 1 [0057.781] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.781] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSACCESS.DEV_COL.HXT") returned -1 [0057.781] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSACCESS.DEV_COL.HXT") returned -1 [0057.781] lstrcmpiA (lpString1="", lpString2="MSACCESS.DEV_COL.HXT") returned -1 [0057.781] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned="MSACCESS.DEV_COL.HXC" [0057.781] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.781] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.781] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.781] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.781] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSACCESS.DEV_COL.HXT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" [0057.781] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e4c000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37e4c000, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.DEV_F_COL.HXK", cAlternateFileName="MSACCE~1.HXK")) returned 1 [0057.781] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.781] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSACCESS.DEV_F_COL.HXK") returned -1 [0057.781] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSACCESS.DEV_F_COL.HXK") returned -1 [0057.781] lstrcmpiA (lpString1="", lpString2="MSACCESS.DEV_F_COL.HXK") returned -1 [0057.781] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned="MSACCESS.DEV_COL.HXT" [0057.781] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.781] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.781] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.781] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSACCESS.DEV_F_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" [0057.782] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e4c000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37e4c000, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.DEV_K_COL.HXK", cAlternateFileName="MSACCE~2.HXK")) returned 1 [0057.782] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.782] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSACCESS.DEV_K_COL.HXK") returned -1 [0057.782] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSACCESS.DEV_K_COL.HXK") returned -1 [0057.782] lstrcmpiA (lpString1="", lpString2="MSACCESS.DEV_K_COL.HXK") returned -1 [0057.782] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned="MSACCESS.DEV_F_COL.HXK" [0057.782] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.782] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.782] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSACCESS.DEV_K_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" [0057.782] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e84c00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88e84c00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x3b2c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.HXS", cAlternateFileName="")) returned 1 [0057.782] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.782] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSACCESS.HXS") returned -1 [0057.782] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSACCESS.HXS") returned -1 [0057.782] lstrcmpiA (lpString1="", lpString2="MSACCESS.HXS") returned -1 [0057.782] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned="MSACCESS.DEV_K_COL.HXK" [0057.782] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.782] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.782] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSACCESS.HXS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS" [0057.782] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS_COL.HXC", cAlternateFileName="MSACCE~2.HXC")) returned 1 [0057.782] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.782] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSACCESS_COL.HXC") returned -1 [0057.782] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSACCESS_COL.HXC") returned -1 [0057.783] lstrcmpiA (lpString1="", lpString2="MSACCESS_COL.HXC") returned -1 [0057.783] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned="MSACCESS.HXS" [0057.783] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.783] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.783] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.783] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.783] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSACCESS_COL.HXC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" [0057.783] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33200c00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33200c00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS_COL.HXT", cAlternateFileName="MSACCE~2.HXT")) returned 1 [0057.783] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.783] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSACCESS_COL.HXT") returned -1 [0057.783] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSACCESS_COL.HXT") returned -1 [0057.783] lstrcmpiA (lpString1="", lpString2="MSACCESS_COL.HXT") returned -1 [0057.783] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned="MSACCESS_COL.HXC" [0057.783] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.783] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.783] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.783] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.783] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSACCESS_COL.HXT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" [0057.783] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33200c00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33200c00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS_F_COL.HXK", cAlternateFileName="MSACCE~3.HXK")) returned 1 [0057.783] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.783] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSACCESS_F_COL.HXK") returned -1 [0057.783] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSACCESS_F_COL.HXK") returned -1 [0057.783] lstrcmpiA (lpString1="", lpString2="MSACCESS_F_COL.HXK") returned -1 [0057.783] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned="MSACCESS_COL.HXT" [0057.783] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.783] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.784] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSACCESS_F_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" [0057.784] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33200c00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33200c00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS_K_COL.HXK", cAlternateFileName="MSACCE~4.HXK")) returned 1 [0057.784] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.784] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSACCESS_K_COL.HXK") returned -1 [0057.784] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSACCESS_K_COL.HXK") returned -1 [0057.784] lstrcmpiA (lpString1="", lpString2="MSACCESS_K_COL.HXK") returned -1 [0057.784] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned="MSACCESS_F_COL.HXK" [0057.784] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.784] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.784] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSACCESS_K_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" [0057.784] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x127f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSAIN.DLL", cAlternateFileName="")) returned 1 [0057.784] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.784] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSAIN.DLL") returned -1 [0057.784] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSAIN.DLL") returned -1 [0057.784] lstrcmpiA (lpString1="", lpString2="MSAIN.DLL") returned -1 [0057.784] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned="MSACCESS_K_COL.HXK" [0057.784] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.785] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.785] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.785] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.785] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSAIN.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL" [0057.785] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x589e0a00, ftCreationTime.dwHighDateTime=0x1c99224, ftLastAccessTime.dwLowDateTime=0x980ce30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x589e0a00, ftLastWriteTime.dwHighDateTime=0x1c99224, nFileSizeHigh=0x0, nFileSizeLow=0x9382, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.ACL", cAlternateFileName="")) returned 1 [0057.785] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.785] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSO.ACL") returned -1 [0057.785] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSO.ACL") returned -1 [0057.785] lstrcmpiA (lpString1="", lpString2="MSO.ACL") returned -1 [0057.785] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned="MSAIN.DLL" [0057.785] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.785] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.785] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.785] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.785] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSO.ACL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" [0057.785] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe15bf200, ftCreationTime.dwHighDateTime=0x1ca9370, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe15bf200, ftLastWriteTime.dwHighDateTime=0x1ca9370, nFileSizeHigh=0x0, nFileSizeLow=0x69560, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC.HXS", cAlternateFileName="")) returned 1 [0057.785] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.785] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOUC.HXS") returned -1 [0057.785] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOUC.HXS") returned -1 [0057.785] lstrcmpiA (lpString1="", lpString2="MSOUC.HXS") returned -1 [0057.785] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned="MSO.ACL" [0057.786] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.786] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.786] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSOUC.HXS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" [0057.786] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c107b00, ftCreationTime.dwHighDateTime=0x1ca77cf, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c107b00, ftLastWriteTime.dwHighDateTime=0x1ca77cf, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC_COL.HXC", cAlternateFileName="MSOUC_~1.HXC")) returned 1 [0057.786] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.786] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOUC_COL.HXC") returned -1 [0057.786] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOUC_COL.HXC") returned -1 [0057.786] lstrcmpiA (lpString1="", lpString2="MSOUC_COL.HXC") returned -1 [0057.786] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned="MSOUC.HXS" [0057.786] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.786] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.786] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSOUC_COL.HXC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" [0057.786] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c107b00, ftCreationTime.dwHighDateTime=0x1ca77cf, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c107b00, ftLastWriteTime.dwHighDateTime=0x1ca77cf, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC_COL.HXT", cAlternateFileName="MSOUC_~1.HXT")) returned 1 [0057.786] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.786] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOUC_COL.HXT") returned -1 [0057.786] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOUC_COL.HXT") returned -1 [0057.786] lstrcmpiA (lpString1="", lpString2="MSOUC_COL.HXT") returned -1 [0057.786] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned="MSOUC_COL.HXC" [0057.786] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.786] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.787] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.787] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSOUC_COL.HXT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" [0057.787] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c107b00, ftCreationTime.dwHighDateTime=0x1ca77cf, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c107b00, ftLastWriteTime.dwHighDateTime=0x1ca77cf, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC_F_COL.HXK", cAlternateFileName="MSOUC_~1.HXK")) returned 1 [0057.787] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0057.787] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOUC_F_COL.HXK") returned -1 [0057.787] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOUC_F_COL.HXK") returned -1 [0057.787] lstrcmpiA (lpString1="", lpString2="MSOUC_F_COL.HXK") returned -1 [0057.787] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned="MSOUC_COL.HXT" [0057.787] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0057.787] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0057.787] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0057.787] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0057.787] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSOUC_F_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" [0057.787] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c107b00, ftCreationTime.dwHighDateTime=0x1ca77cf, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c107b00, ftLastWriteTime.dwHighDateTime=0x1ca77cf, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC_K_COL.HXK", cAlternateFileName="MSOUC_~2.HXK")) returned 1 [0058.729] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.729] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOUC_K_COL.HXK") returned -1 [0058.729] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOUC_K_COL.HXK") returned -1 [0058.732] lstrcmpiA (lpString1="", lpString2="MSOUC_K_COL.HXK") returned -1 [0058.732] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned="MSOUC_F_COL.HXK" [0058.732] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.732] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.732] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.732] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.732] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSOUC_K_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" [0058.733] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91408700, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x1ba74a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91408700, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x487dc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.DEV.HXS", cAlternateFileName="MSPUBD~1.HXS")) returned 1 [0058.733] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.733] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSPUB.DEV.HXS") returned -1 [0058.733] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB.DEV.HXS") returned -1 [0058.733] lstrcmpiA (lpString1="", lpString2="MSPUB.DEV.HXS") returned -1 [0058.733] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned="MSOUC_K_COL.HXK" [0058.733] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.733] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.733] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.733] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.733] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSPUB.DEV.HXS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS" [0058.733] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1ba74a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.DEV_COL.HXC", cAlternateFileName="MSPUBD~1.HXC")) returned 1 [0058.733] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.733] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSPUB.DEV_COL.HXC") returned -1 [0058.733] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB.DEV_COL.HXC") returned -1 [0058.733] lstrcmpiA (lpString1="", lpString2="MSPUB.DEV_COL.HXC") returned -1 [0058.733] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned="MSPUB.DEV.HXS" [0058.733] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.733] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.733] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.734] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.734] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSPUB.DEV_COL.HXC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" [0058.734] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ddaa100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba74a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ddaa100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.DEV_COL.HXT", cAlternateFileName="MSPUBD~1.HXT")) returned 1 [0058.734] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.734] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSPUB.DEV_COL.HXT") returned -1 [0058.734] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB.DEV_COL.HXT") returned -1 [0058.734] lstrcmpiA (lpString1="", lpString2="MSPUB.DEV_COL.HXT") returned -1 [0058.734] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned="MSPUB.DEV_COL.HXC" [0058.734] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.734] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.734] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.734] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.734] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSPUB.DEV_COL.HXT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" [0058.734] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ddaa100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba74a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ddaa100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.DEV_F_COL.HXK", cAlternateFileName="MSPUBD~1.HXK")) returned 1 [0058.734] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.734] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSPUB.DEV_F_COL.HXK") returned -1 [0058.734] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB.DEV_F_COL.HXK") returned -1 [0058.734] lstrcmpiA (lpString1="", lpString2="MSPUB.DEV_F_COL.HXK") returned -1 [0058.734] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned="MSPUB.DEV_COL.HXT" [0058.734] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.735] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.735] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.735] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.735] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSPUB.DEV_F_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" [0058.735] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ddaa100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba74a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ddaa100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.DEV_K_COL.HXK", cAlternateFileName="MSPUBD~2.HXK")) returned 1 [0058.735] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.735] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSPUB.DEV_K_COL.HXK") returned -1 [0058.735] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB.DEV_K_COL.HXK") returned -1 [0058.735] lstrcmpiA (lpString1="", lpString2="MSPUB.DEV_K_COL.HXK") returned -1 [0058.735] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned="MSPUB.DEV_F_COL.HXK" [0058.735] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.735] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.735] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.735] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.735] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSPUB.DEV_K_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" [0058.735] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9271b400, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9271b400, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x1cc936, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.HXS", cAlternateFileName="")) returned 1 [0058.735] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.735] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSPUB.HXS") returned -1 [0058.735] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB.HXS") returned -1 [0058.735] lstrcmpiA (lpString1="", lpString2="MSPUB.HXS") returned -1 [0058.736] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned="MSPUB.DEV_K_COL.HXK" [0058.736] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.736] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.736] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.736] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.736] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSPUB.HXS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS" [0058.736] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe30400, ftCreationTime.dwHighDateTime=0x1c2a1b4, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8fe30400, ftLastWriteTime.dwHighDateTime=0x1c2a1b4, nFileSizeHigh=0x0, nFileSizeLow=0x2ef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.OPG", cAlternateFileName="")) returned 1 [0058.736] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.736] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSPUB.OPG") returned -1 [0058.736] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB.OPG") returned -1 [0058.736] lstrcmpiA (lpString1="", lpString2="MSPUB.OPG") returned -1 [0058.736] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned="MSPUB.HXS" [0058.736] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.736] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.736] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.736] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.736] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSPUB.OPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" [0058.736] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB_COL.HXC", cAlternateFileName="MSPUB_~1.HXC")) returned 1 [0058.736] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.736] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSPUB_COL.HXC") returned -1 [0058.736] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB_COL.HXC") returned -1 [0058.737] lstrcmpiA (lpString1="", lpString2="MSPUB_COL.HXC") returned -1 [0058.737] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned="MSPUB.OPG" [0058.737] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.737] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.737] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.737] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.737] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSPUB_COL.HXC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" [0058.737] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b784700, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b784700, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB_COL.HXT", cAlternateFileName="MSPUB_~1.HXT")) returned 1 [0058.737] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.737] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSPUB_COL.HXT") returned -1 [0058.737] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB_COL.HXT") returned -1 [0058.737] lstrcmpiA (lpString1="", lpString2="MSPUB_COL.HXT") returned -1 [0058.737] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned="MSPUB_COL.HXC" [0058.737] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.737] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.737] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.737] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.737] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSPUB_COL.HXT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" [0058.737] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b784700, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b784700, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB_F_COL.HXK", cAlternateFileName="MSPUB_~1.HXK")) returned 1 [0058.737] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.737] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSPUB_F_COL.HXK") returned -1 [0058.738] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB_F_COL.HXK") returned -1 [0058.738] lstrcmpiA (lpString1="", lpString2="MSPUB_F_COL.HXK") returned -1 [0058.738] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned="MSPUB_COL.HXT" [0058.738] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.738] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.738] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.738] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.738] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSPUB_F_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" [0058.738] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b784700, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b784700, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB_K_COL.HXK", cAlternateFileName="MSPUB_~2.HXK")) returned 1 [0058.738] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.738] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSPUB_K_COL.HXK") returned -1 [0058.738] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB_K_COL.HXK") returned -1 [0058.738] lstrcmpiA (lpString1="", lpString2="MSPUB_K_COL.HXK") returned -1 [0058.738] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned="MSPUB_F_COL.HXK" [0058.738] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.738] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.738] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.738] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.738] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSPUB_K_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" [0058.738] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8527700, ftCreationTime.dwHighDateTime=0x1c33a9f, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd8527700, ftLastWriteTime.dwHighDateTime=0x1c33a9f, nFileSizeHigh=0x0, nFileSizeLow=0x7d682, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSQRY32.CHM", cAlternateFileName="")) returned 1 [0058.738] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.739] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSQRY32.CHM") returned -1 [0058.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSQRY32.CHM") returned -1 [0058.739] lstrcmpiA (lpString1="", lpString2="MSQRY32.CHM") returned -1 [0058.739] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned="MSPUB_K_COL.HXK" [0058.739] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.739] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.739] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.739] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.739] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSQRY32.CHM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSQRY32.CHM") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSQRY32.CHM" [0058.739] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8c44700, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8c44700, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x15d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTINTL.DLL", cAlternateFileName="")) returned 1 [0058.739] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.739] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSTINTL.DLL") returned -1 [0058.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTINTL.DLL") returned -1 [0058.739] lstrcmpiA (lpString1="", lpString2="MSTINTL.DLL") returned -1 [0058.739] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSQRY32.CHM") returned="MSQRY32.CHM" [0058.739] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.739] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.739] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.739] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.739] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSTINTL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL" [0058.739] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e84c00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x88e84c00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x5f254, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORE.HXS", cAlternateFileName="")) returned 1 [0058.740] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.740] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSTORE.HXS") returned -1 [0058.740] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTORE.HXS") returned -1 [0058.740] lstrcmpiA (lpString1="", lpString2="MSTORE.HXS") returned -1 [0058.740] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned="MSTINTL.DLL" [0058.740] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.740] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.740] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.740] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.740] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSTORE.HXS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS" [0058.740] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORE_COL.HXC", cAlternateFileName="MSTORE~1.HXC")) returned 1 [0058.740] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.740] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSTORE_COL.HXC") returned -1 [0058.740] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTORE_COL.HXC") returned -1 [0058.740] lstrcmpiA (lpString1="", lpString2="MSTORE_COL.HXC") returned -1 [0058.740] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned="MSTORE.HXS" [0058.740] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.740] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.740] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.740] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.740] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSTORE_COL.HXC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" [0058.741] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416e2800, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x416e2800, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORE_COL.HXT", cAlternateFileName="MSTORE~1.HXT")) returned 1 [0058.741] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.741] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSTORE_COL.HXT") returned -1 [0058.741] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTORE_COL.HXT") returned -1 [0058.741] lstrcmpiA (lpString1="", lpString2="MSTORE_COL.HXT") returned -1 [0058.741] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned="MSTORE_COL.HXC" [0058.741] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.741] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.741] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.741] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.741] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSTORE_COL.HXT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" [0058.741] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416e2800, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x416e2800, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORE_F_COL.HXK", cAlternateFileName="MSTORE~1.HXK")) returned 1 [0058.741] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.741] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSTORE_F_COL.HXK") returned -1 [0058.741] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTORE_F_COL.HXK") returned -1 [0058.741] lstrcmpiA (lpString1="", lpString2="MSTORE_F_COL.HXK") returned -1 [0058.741] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned="MSTORE_COL.HXT" [0058.741] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.741] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.741] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.741] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.741] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSTORE_F_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" [0058.742] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416e2800, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x416e2800, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORE_K_COL.HXK", cAlternateFileName="MSTORE~2.HXK")) returned 1 [0058.742] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.742] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSTORE_K_COL.HXK") returned -1 [0058.742] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTORE_K_COL.HXK") returned -1 [0058.742] lstrcmpiA (lpString1="", lpString2="MSTORE_K_COL.HXK") returned -1 [0058.742] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned="MSTORE_F_COL.HXK" [0058.742] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.742] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.742] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.742] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.742] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="MSTORE_K_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" [0058.742] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.CSS", cAlternateFileName="")) returned 1 [0058.742] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.742] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NETWORK.CSS") returned -1 [0058.742] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NETWORK.CSS") returned -1 [0058.742] lstrcmpiA (lpString1="", lpString2="NETWORK.CSS") returned -1 [0058.742] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned="MSTORE_K_COL.HXK" [0058.742] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.742] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.742] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.742] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.742] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="NETWORK.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK.CSS" [0058.743] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4126500, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4126500, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK1.VRD", cAlternateFileName="")) returned 1 [0058.743] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.743] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NETWORK1.VRD") returned -1 [0058.743] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NETWORK1.VRD") returned -1 [0058.743] lstrcmpiA (lpString1="", lpString2="NETWORK1.VRD") returned -1 [0058.743] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK.CSS") returned="NETWORK.CSS" [0058.743] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.743] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.743] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="NETWORK1.VRD" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" [0058.743] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4126500, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4126500, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x866, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK2.VRD", cAlternateFileName="")) returned 1 [0058.743] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.743] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NETWORK2.VRD") returned -1 [0058.743] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NETWORK2.VRD") returned -1 [0058.743] lstrcmpiA (lpString1="", lpString2="NETWORK2.VRD") returned -1 [0058.743] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned="NETWORK1.VRD" [0058.743] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.743] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.743] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.744] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="NETWORK2.VRD" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" [0058.744] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4126500, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4126500, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0xcae, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK3.VRD", cAlternateFileName="")) returned 1 [0058.744] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.744] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NETWORK3.VRD") returned -1 [0058.744] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NETWORK3.VRD") returned -1 [0058.744] lstrcmpiA (lpString1="", lpString2="NETWORK3.VRD") returned -1 [0058.744] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned="NETWORK2.VRD" [0058.744] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.744] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.744] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.744] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.744] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="NETWORK3.VRD" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" [0058.744] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaeefd00, ftCreationTime.dwHighDateTime=0x1c2c076, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xeaeefd00, ftLastWriteTime.dwHighDateTime=0x1c2c076, nFileSizeHigh=0x0, nFileSizeLow=0x468, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCCMPVRD.XML", cAlternateFileName="")) returned 1 [0058.744] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.744] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OCCMPVRD.XML") returned -1 [0058.744] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OCCMPVRD.XML") returned -1 [0058.744] lstrcmpiA (lpString1="", lpString2="OCCMPVRD.XML") returned -1 [0058.744] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned="NETWORK3.VRD" [0058.744] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.744] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.745] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.745] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.745] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OCCMPVRD.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCCMPVRD.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCCMPVRD.XML" [0058.745] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b675400, ftCreationTime.dwHighDateTime=0x1c2c0e2, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4b675400, ftLastWriteTime.dwHighDateTime=0x1c2c0e2, nFileSizeHigh=0x0, nFileSizeLow=0x42c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCMODVRD.XML", cAlternateFileName="")) returned 1 [0058.745] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.745] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OCMODVRD.XML") returned -1 [0058.745] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OCMODVRD.XML") returned -1 [0058.745] lstrcmpiA (lpString1="", lpString2="OCMODVRD.XML") returned -1 [0058.745] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCCMPVRD.XML") returned="OCCMPVRD.XML" [0058.745] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.745] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.745] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.745] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.745] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OCMODVRD.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCMODVRD.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCMODVRD.XML" [0058.745] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde567d00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xde567d00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x81380, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFOWCI.DLL", cAlternateFileName="")) returned 1 [0058.745] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.745] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OFFOWCI.DLL") returned -1 [0058.745] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OFFOWCI.DLL") returned -1 [0058.745] lstrcmpiA (lpString1="", lpString2="OFFOWCI.DLL") returned -1 [0058.745] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCMODVRD.XML") returned="OCMODVRD.XML" [0058.745] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.745] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.746] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.746] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.746] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OFFOWCI.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL" [0058.746] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c7bd300, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8c7bd300, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x6fd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIS.HXS", cAlternateFileName="")) returned 1 [0058.746] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.746] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OIS.HXS") returned -1 [0058.746] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OIS.HXS") returned -1 [0058.746] lstrcmpiA (lpString1="", lpString2="OIS.HXS") returned -1 [0058.746] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned="OFFOWCI.DLL" [0058.746] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.746] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.746] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.746] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.746] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OIS.HXS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" [0058.746] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc74da00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc74da00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1f998, dwReserved0=0x0, dwReserved1=0x0, cFileName="OISINTL.DLL", cAlternateFileName="")) returned 1 [0058.746] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.746] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OISINTL.DLL") returned -1 [0058.746] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OISINTL.DLL") returned -1 [0058.746] lstrcmpiA (lpString1="", lpString2="OISINTL.DLL") returned -1 [0058.746] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned="OIS.HXS" [0058.747] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.747] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.747] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.747] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.747] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OISINTL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL" [0058.747] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIS_COL.HXC", cAlternateFileName="")) returned 1 [0058.747] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.747] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OIS_COL.HXC") returned -1 [0058.747] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OIS_COL.HXC") returned -1 [0058.747] lstrcmpiA (lpString1="", lpString2="OIS_COL.HXC") returned -1 [0058.747] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned="OISINTL.DLL" [0058.747] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.747] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.747] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.747] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.747] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OIS_COL.HXC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" [0058.747] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4501af00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4501af00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIS_COL.HXT", cAlternateFileName="")) returned 1 [0058.747] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.747] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OIS_COL.HXT") returned -1 [0058.747] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OIS_COL.HXT") returned -1 [0058.747] lstrcmpiA (lpString1="", lpString2="OIS_COL.HXT") returned -1 [0058.747] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned="OIS_COL.HXC" [0058.747] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.748] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.748] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.748] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.748] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OIS_COL.HXT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" [0058.748] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4501af00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4501af00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIS_F_COL.HXK", cAlternateFileName="OIS_F_~1.HXK")) returned 1 [0058.748] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.748] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OIS_F_COL.HXK") returned -1 [0058.748] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OIS_F_COL.HXK") returned -1 [0058.748] lstrcmpiA (lpString1="", lpString2="OIS_F_COL.HXK") returned -1 [0058.748] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned="OIS_COL.HXT" [0058.748] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.748] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.748] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.748] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.748] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OIS_F_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" [0058.748] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4501af00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4501af00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIS_K_COL.HXK", cAlternateFileName="OIS_K_~1.HXK")) returned 1 [0058.748] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.748] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OIS_K_COL.HXK") returned -1 [0058.748] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OIS_K_COL.HXK") returned -1 [0058.748] lstrcmpiA (lpString1="", lpString2="OIS_K_COL.HXK") returned -1 [0058.748] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned="OIS_F_COL.HXK" [0058.748] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.748] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.748] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.748] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.749] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OIS_K_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" [0058.749] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8de21e00, ftCreationTime.dwHighDateTime=0x1cab7cf, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8de21e00, ftLastWriteTime.dwHighDateTime=0x1cab7cf, nFileSizeHigh=0x0, nFileSizeLow=0x62180, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSINTL.DLL", cAlternateFileName="")) returned 1 [0058.749] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.749] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OMSINTL.DLL") returned -1 [0058.749] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OMSINTL.DLL") returned -1 [0058.749] lstrcmpiA (lpString1="", lpString2="OMSINTL.DLL") returned -1 [0058.749] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned="OIS_K_COL.HXK" [0058.749] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.749] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.749] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.749] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.749] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OMSINTL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL" [0058.749] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70618400, ftCreationTime.dwHighDateTime=0x1cab7d0, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70618400, ftLastWriteTime.dwHighDateTime=0x1cab7d0, nFileSizeHigh=0x0, nFileSizeLow=0x6180, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSINTL.DLL.IDX_DLL", cAlternateFileName="OMSINT~1.IDX")) returned 1 [0058.763] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.763] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OMSINTL.DLL.IDX_DLL") returned -1 [0058.763] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OMSINTL.DLL.IDX_DLL") returned -1 [0058.763] lstrcmpiA (lpString1="", lpString2="OMSINTL.DLL.IDX_DLL") returned -1 [0058.763] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned="OMSINTL.DLL" [0058.763] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.763] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.763] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.764] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.764] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OMSINTL.DLL.IDX_DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL" [0058.764] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc7ce790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0xdf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONELEV.EXE", cAlternateFileName="")) returned 1 [0058.764] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.764] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ONELEV.EXE") returned -1 [0058.764] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONELEV.EXE") returned -1 [0058.764] lstrcmpiA (lpString1="", lpString2="ONELEV.EXE") returned -1 [0058.764] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned="OMSINTL.DLL.IDX_DLL" [0058.764] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.764] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.764] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.764] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.764] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="ONELEV.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE" [0058.764] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c7bd300, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xc7ce790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c7bd300, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE.HXS", cAlternateFileName="")) returned 1 [0058.764] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.764] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ONENOTE.HXS") returned -1 [0058.764] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONENOTE.HXS") returned -1 [0058.764] lstrcmpiA (lpString1="", lpString2="ONENOTE.HXS") returned -1 [0058.764] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned="ONELEV.EXE" [0058.764] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.764] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.764] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.764] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.765] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="ONENOTE.HXS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS" [0058.765] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabfa4f00, ftCreationTime.dwHighDateTime=0x1cab7cc, ftLastAccessTime.dwLowDateTime=0xc81aa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabfa4f00, ftLastWriteTime.dwHighDateTime=0x1cab7cc, nFileSizeHigh=0x0, nFileSizeLow=0x25e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteSyncPCIntl.dll", cAlternateFileName="ONENOT~1.DLL")) returned 1 [0058.765] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.765] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OneNoteSyncPCIntl.dll") returned -1 [0058.765] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OneNoteSyncPCIntl.dll") returned -1 [0058.765] lstrcmpiA (lpString1="", lpString2="OneNoteSyncPCIntl.dll") returned -1 [0058.765] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned="ONENOTE.HXS" [0058.765] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.765] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.765] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.765] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.765] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OneNoteSyncPCIntl.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll" [0058.765] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xc7ce790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE_COL.HXC", cAlternateFileName="ONENOT~1.HXC")) returned 1 [0058.765] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.765] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ONENOTE_COL.HXC") returned -1 [0058.765] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONENOTE_COL.HXC") returned -1 [0058.765] lstrcmpiA (lpString1="", lpString2="ONENOTE_COL.HXC") returned -1 [0058.765] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned="OneNoteSyncPCIntl.dll" [0058.765] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.765] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.765] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.765] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.765] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="ONENOTE_COL.HXC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC" [0058.765] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48953600, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xc7f48f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48953600, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE_COL.HXT", cAlternateFileName="ONENOT~1.HXT")) returned 1 [0058.765] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.765] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ONENOTE_COL.HXT") returned -1 [0058.766] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONENOTE_COL.HXT") returned -1 [0058.766] lstrcmpiA (lpString1="", lpString2="ONENOTE_COL.HXT") returned -1 [0058.766] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned="ONENOTE_COL.HXC" [0058.766] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.766] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.766] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.766] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.766] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="ONENOTE_COL.HXT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" [0058.766] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48953600, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xc7f48f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48953600, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE_F_COL.HXK", cAlternateFileName="ONENOT~1.HXK")) returned 1 [0058.766] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.766] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ONENOTE_F_COL.HXK") returned -1 [0058.766] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONENOTE_F_COL.HXK") returned -1 [0058.766] lstrcmpiA (lpString1="", lpString2="ONENOTE_F_COL.HXK") returned -1 [0058.766] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned="ONENOTE_COL.HXT" [0058.766] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.766] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.766] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.766] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.766] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="ONENOTE_F_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" [0058.766] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48953600, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xc7f48f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48953600, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE_K_COL.HXK", cAlternateFileName="ONENOT~2.HXK")) returned 1 [0058.766] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.766] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ONENOTE_K_COL.HXK") returned -1 [0058.766] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONENOTE_K_COL.HXK") returned -1 [0058.766] lstrcmpiA (lpString1="", lpString2="ONENOTE_K_COL.HXK") returned -1 [0058.766] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned="ONENOTE_F_COL.HXK" [0058.766] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.766] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.767] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.767] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.767] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="ONENOTE_K_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" [0058.767] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb96d3b00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc7f48f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb96d3b00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x148d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONGuide.onepkg", cAlternateFileName="ONGUID~1.ONE")) returned 1 [0058.767] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.767] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ONGuide.onepkg") returned -1 [0058.767] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONGuide.onepkg") returned -1 [0058.767] lstrcmpiA (lpString1="", lpString2="ONGuide.onepkg") returned -1 [0058.767] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned="ONENOTE_K_COL.HXK" [0058.767] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.767] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.767] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.767] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.767] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="ONGuide.onepkg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONGuide.onepkg") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONGuide.onepkg" [0058.767] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc81aa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x341f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.DLL", cAlternateFileName="")) returned 1 [0058.767] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.767] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ONINTL.DLL") returned -1 [0058.767] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONINTL.DLL") returned -1 [0058.767] lstrcmpiA (lpString1="", lpString2="ONINTL.DLL") returned -1 [0058.767] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONGuide.onepkg") returned="ONGuide.onepkg" [0058.767] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.767] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.767] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.767] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.767] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="ONINTL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL" [0058.768] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3266200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc7f48f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3266200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x3b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.DLL.IDX_DLL", cAlternateFileName="ONINTL~1.IDX")) returned 1 [0058.768] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.768] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ONINTL.DLL.IDX_DLL") returned -1 [0058.768] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONINTL.DLL.IDX_DLL") returned -1 [0058.768] lstrcmpiA (lpString1="", lpString2="ONINTL.DLL.IDX_DLL") returned -1 [0058.768] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned="ONINTL.DLL" [0058.768] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.768] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.768] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="ONINTL.DLL.IDX_DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL" [0058.768] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3266200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc81aa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3266200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x1bf80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.REST.IDX_DLL", cAlternateFileName="ONINTL~2.IDX")) returned 1 [0058.768] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.768] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ONINTL.REST.IDX_DLL") returned -1 [0058.768] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONINTL.REST.IDX_DLL") returned -1 [0058.768] lstrcmpiA (lpString1="", lpString2="ONINTL.REST.IDX_DLL") returned -1 [0058.768] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned="ONINTL.DLL.IDX_DLL" [0058.768] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.768] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.768] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="ONINTL.REST.IDX_DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" [0058.768] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5439200, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50af3f00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5439200, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGCH.VRD", cAlternateFileName="")) returned 1 [0058.768] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.768] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ORGCH.VRD") returned -1 [0058.769] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ORGCH.VRD") returned -1 [0058.769] lstrcmpiA (lpString1="", lpString2="ORGCH.VRD") returned -1 [0058.769] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned="ONINTL.REST.IDX_DLL" [0058.769] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.769] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.769] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.769] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.769] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="ORGCH.VRD" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" [0058.769] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50b1a060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xdfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGCHART.VSL", cAlternateFileName="")) returned 1 [0058.769] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.769] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ORGCHART.VSL") returned -1 [0058.769] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ORGCHART.VSL") returned -1 [0058.769] lstrcmpiA (lpString1="", lpString2="ORGCHART.VSL") returned -1 [0058.769] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned="ORGCH.VRD" [0058.769] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.769] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.769] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.769] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.769] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="ORGCHART.VSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" [0058.769] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5439200, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50b1a060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5439200, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGPOS.VRD", cAlternateFileName="")) returned 1 [0058.769] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.769] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ORGPOS.VRD") returned -1 [0058.769] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ORGPOS.VRD") returned -1 [0058.769] lstrcmpiA (lpString1="", lpString2="ORGPOS.VRD") returned -1 [0058.769] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned="ORGCHART.VSL" [0058.769] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.769] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.769] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.770] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.770] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="ORGPOS.VRD" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" [0058.770] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5dc7c00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50b1a060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb5dc7c00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x105b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGWIZ.VSL", cAlternateFileName="")) returned 1 [0058.770] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.770] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ORGWIZ.VSL") returned -1 [0058.770] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ORGWIZ.VSL") returned -1 [0058.770] lstrcmpiA (lpString1="", lpString2="ORGWIZ.VSL") returned -1 [0058.770] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned="ORGPOS.VRD" [0058.770] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.770] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.770] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.770] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.770] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="ORGWIZ.VSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" [0058.770] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c57a100, ftCreationTime.dwHighDateTime=0x1cac466, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4c57a100, ftLastWriteTime.dwHighDateTime=0x1cac466, nFileSizeHigh=0x0, nFileSizeLow=0x4790, dwReserved0=0x0, dwReserved1=0x0, cFileName="ospintl.dll", cAlternateFileName="")) returned 1 [0058.770] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.770] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ospintl.dll") returned -1 [0058.770] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ospintl.dll") returned -1 [0058.770] lstrcmpiA (lpString1="", lpString2="ospintl.dll") returned -1 [0058.770] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned="ORGWIZ.VSL" [0058.770] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.771] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.771] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.771] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.771] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="ospintl.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll" [0058.771] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8c4100, ftCreationTime.dwHighDateTime=0x1c67eda, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed8c4100, ftLastWriteTime.dwHighDateTime=0x1c67eda, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTFORM.DAT", cAlternateFileName="")) returned 1 [0058.771] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.771] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OUTFORM.DAT") returned -1 [0058.771] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTFORM.DAT") returned -1 [0058.771] lstrcmpiA (lpString1="", lpString2="OUTFORM.DAT") returned -1 [0058.771] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned="ospintl.dll" [0058.771] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.771] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.771] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.771] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.771] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OUTFORM.DAT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTFORM.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTFORM.DAT" [0058.771] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2fc5400, ftCreationTime.dwHighDateTime=0x1ca0f51, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2fc5400, ftLastWriteTime.dwHighDateTime=0x1ca0f51, nFileSizeHigh=0x0, nFileSizeLow=0x970, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLBAR.INF", cAlternateFileName="")) returned 1 [0058.771] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.771] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OUTLBAR.INF") returned -1 [0058.771] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLBAR.INF") returned -1 [0058.771] lstrcmpiA (lpString1="", lpString2="OUTLBAR.INF") returned -1 [0058.772] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTFORM.DAT") returned="OUTFORM.DAT" [0058.772] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.772] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.772] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.772] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.772] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OUTLBAR.INF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF" [0058.772] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7df9900, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x13f0930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7df9900, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x644d70, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.DLL", cAlternateFileName="")) returned 1 [0058.772] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.772] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OUTLLIBR.DLL") returned -1 [0058.772] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLLIBR.DLL") returned -1 [0058.772] lstrcmpiA (lpString1="", lpString2="OUTLLIBR.DLL") returned -1 [0058.772] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned="OUTLBAR.INF" [0058.772] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.772] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.772] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.772] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.772] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OUTLLIBR.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL" [0058.772] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2411fa00, ftCreationTime.dwHighDateTime=0x1cac9b2, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2411fa00, ftLastWriteTime.dwHighDateTime=0x1cac9b2, nFileSizeHigh=0x0, nFileSizeLow=0x1d380, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.DLL.IDX_DLL", cAlternateFileName="OUTLLI~1.IDX")) returned 1 [0058.772] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.772] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OUTLLIBR.DLL.IDX_DLL") returned -1 [0058.772] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLLIBR.DLL.IDX_DLL") returned -1 [0058.772] lstrcmpiA (lpString1="", lpString2="OUTLLIBR.DLL.IDX_DLL") returned -1 [0058.772] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned="OUTLLIBR.DLL" [0058.772] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.773] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.773] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.773] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.773] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OUTLLIBR.DLL.IDX_DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL" [0058.773] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2411fa00, ftCreationTime.dwHighDateTime=0x1cac9b2, ftLastAccessTime.dwLowDateTime=0x1416a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2411fa00, ftLastWriteTime.dwHighDateTime=0x1cac9b2, nFileSizeHigh=0x0, nFileSizeLow=0x46f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.REST.IDX_DLL", cAlternateFileName="OUTLLI~2.IDX")) returned 1 [0058.773] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.773] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OUTLLIBR.REST.IDX_DLL") returned -1 [0058.773] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLLIBR.REST.IDX_DLL") returned -1 [0058.773] lstrcmpiA (lpString1="", lpString2="OUTLLIBR.REST.IDX_DLL") returned -1 [0058.773] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned="OUTLLIBR.DLL.IDX_DLL" [0058.773] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.773] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.773] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.773] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.773] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OUTLLIBR.REST.IDX_DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL" [0058.773] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa80e2700, ftCreationTime.dwHighDateTime=0x1ca8f17, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa80e2700, ftLastWriteTime.dwHighDateTime=0x1ca8f17, nFileSizeHigh=0x0, nFileSizeLow=0x6aa3d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.DEV.HXS", cAlternateFileName="OUTLOO~1.HXS")) returned 1 [0058.773] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.773] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OUTLOOK.DEV.HXS") returned -1 [0058.773] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLOOK.DEV.HXS") returned -1 [0058.773] lstrcmpiA (lpString1="", lpString2="OUTLOOK.DEV.HXS") returned -1 [0058.773] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned="OUTLLIBR.REST.IDX_DLL" [0058.773] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.773] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.773] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.773] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.773] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OUTLOOK.DEV.HXS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS" [0058.773] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.DEV_COL.HXC", cAlternateFileName="OUTLOO~1.HXC")) returned 1 [0058.774] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.774] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OUTLOOK.DEV_COL.HXC") returned -1 [0058.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLOOK.DEV_COL.HXC") returned -1 [0058.774] lstrcmpiA (lpString1="", lpString2="OUTLOOK.DEV_COL.HXC") returned -1 [0058.774] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned="OUTLOOK.DEV.HXS" [0058.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.774] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.774] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.774] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.774] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OUTLOOK.DEV_COL.HXC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC" [0058.774] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fbc4400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4fbc4400, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.DEV_COL.HXT", cAlternateFileName="OUTLOO~1.HXT")) returned 1 [0058.774] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.774] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OUTLOOK.DEV_COL.HXT") returned -1 [0058.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLOOK.DEV_COL.HXT") returned -1 [0058.774] lstrcmpiA (lpString1="", lpString2="OUTLOOK.DEV_COL.HXT") returned -1 [0058.774] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned="OUTLOOK.DEV_COL.HXC" [0058.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.774] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.774] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.774] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.774] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OUTLOOK.DEV_COL.HXT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" [0058.774] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fbc4400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4fbc4400, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.DEV_F_COL.HXK", cAlternateFileName="OUTLOO~1.HXK")) returned 1 [0058.774] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.774] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OUTLOOK.DEV_F_COL.HXK") returned -1 [0058.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLOOK.DEV_F_COL.HXK") returned -1 [0058.774] lstrcmpiA (lpString1="", lpString2="OUTLOOK.DEV_F_COL.HXK") returned -1 [0058.774] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned="OUTLOOK.DEV_COL.HXT" [0058.775] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.775] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.775] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.775] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.775] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OUTLOOK.DEV_F_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" [0058.775] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fbc4400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4fbc4400, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.DEV_K_COL.HXK", cAlternateFileName="OUTLOO~2.HXK")) returned 1 [0058.775] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.775] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OUTLOOK.DEV_K_COL.HXK") returned -1 [0058.775] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLOOK.DEV_K_COL.HXK") returned -1 [0058.775] lstrcmpiA (lpString1="", lpString2="OUTLOOK.DEV_K_COL.HXK") returned -1 [0058.775] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned="OUTLOOK.DEV_F_COL.HXK" [0058.775] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.775] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.775] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.775] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.775] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OUTLOOK.DEV_K_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" [0058.775] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3475b500, ftCreationTime.dwHighDateTime=0x1ca95bc, ftLastAccessTime.dwLowDateTime=0x1488eb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3475b500, ftLastWriteTime.dwHighDateTime=0x1ca95bc, nFileSizeHigh=0x0, nFileSizeLow=0x13a57c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.HOL", cAlternateFileName="")) returned 1 [0058.775] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.775] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OUTLOOK.HOL") returned -1 [0058.775] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLOOK.HOL") returned -1 [0058.775] lstrcmpiA (lpString1="", lpString2="OUTLOOK.HOL") returned -1 [0058.775] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned="OUTLOOK.DEV_K_COL.HXK" [0058.775] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.776] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.776] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.776] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.776] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OUTLOOK.HOL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" [0058.776] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ede2d00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8ede2d00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x4c4c67, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.HXS", cAlternateFileName="")) returned 1 [0058.776] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.776] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OUTLOOK.HXS") returned -1 [0058.776] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLOOK.HXS") returned -1 [0058.776] lstrcmpiA (lpString1="", lpString2="OUTLOOK.HXS") returned -1 [0058.776] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned="OUTLOOK.HOL" [0058.776] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.776] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.776] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.776] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.776] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OUTLOOK.HXS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS" [0058.776] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK_COL.HXC", cAlternateFileName="OUTLOO~2.HXC")) returned 1 [0058.776] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.776] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OUTLOOK_COL.HXC") returned -1 [0058.776] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLOOK_COL.HXC") returned -1 [0058.776] lstrcmpiA (lpString1="", lpString2="OUTLOOK_COL.HXC") returned -1 [0058.776] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned="OUTLOOK.HXS" [0058.776] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.776] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.776] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.776] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.776] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OUTLOOK_COL.HXC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" [0058.777] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c28bd00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c28bd00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK_COL.HXT", cAlternateFileName="OUTLOO~2.HXT")) returned 1 [0058.777] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.777] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OUTLOOK_COL.HXT") returned -1 [0058.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLOOK_COL.HXT") returned -1 [0058.777] lstrcmpiA (lpString1="", lpString2="OUTLOOK_COL.HXT") returned -1 [0058.777] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned="OUTLOOK_COL.HXC" [0058.777] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.777] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.777] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.777] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.777] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OUTLOOK_COL.HXT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" [0058.777] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c28bd00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c28bd00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK_F_COL.HXK", cAlternateFileName="OUTLOO~3.HXK")) returned 1 [0058.777] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.777] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OUTLOOK_F_COL.HXK") returned -1 [0058.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLOOK_F_COL.HXK") returned -1 [0058.777] lstrcmpiA (lpString1="", lpString2="OUTLOOK_F_COL.HXK") returned -1 [0058.777] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned="OUTLOOK_COL.HXT" [0058.777] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.777] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.777] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.777] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.777] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OUTLOOK_F_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" [0058.777] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c28bd00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c28bd00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK_K_COL.HXK", cAlternateFileName="OUTLOO~4.HXK")) returned 1 [0058.782] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.782] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OUTLOOK_K_COL.HXK") returned -1 [0058.782] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLOOK_K_COL.HXK") returned -1 [0058.782] lstrcmpiA (lpString1="", lpString2="OUTLOOK_K_COL.HXK") returned -1 [0058.782] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned="OUTLOOK_F_COL.HXK" [0058.782] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.782] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.782] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OUTLOOK_K_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" [0058.782] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40d55d00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x40d55d00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLPERF.H", cAlternateFileName="")) returned 1 [0058.782] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.783] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OUTLPERF.H") returned -1 [0058.783] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLPERF.H") returned -1 [0058.783] lstrcmpiA (lpString1="", lpString2="OUTLPERF.H") returned -1 [0058.783] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned="OUTLOOK_K_COL.HXK" [0058.783] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.783] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.783] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.783] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.783] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OUTLPERF.H" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.H") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.H" [0058.783] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40d55d00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x40d55d00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0xa87, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLPERF.INI", cAlternateFileName="")) returned 1 [0058.783] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.783] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OUTLPERF.INI") returned -1 [0058.783] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLPERF.INI") returned -1 [0058.783] lstrcmpiA (lpString1="", lpString2="OUTLPERF.INI") returned -1 [0058.783] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.H") returned="OUTLPERF.H" [0058.783] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.783] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.783] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.783] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.783] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OUTLPERF.INI" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.INI") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.INI" [0058.783] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x1f760, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLWVW.DLL", cAlternateFileName="")) returned 1 [0058.783] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.783] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OUTLWVW.DLL") returned -1 [0058.783] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLWVW.DLL") returned -1 [0058.783] lstrcmpiA (lpString1="", lpString2="OUTLWVW.DLL") returned -1 [0058.783] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.INI") returned="OUTLPERF.INI" [0058.783] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.783] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.784] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OUTLWVW.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL" [0058.784] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2411fa00, ftCreationTime.dwHighDateTime=0x1cac9b2, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2411fa00, ftLastWriteTime.dwHighDateTime=0x1cac9b2, nFileSizeHigh=0x0, nFileSizeLow=0x2b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLWVW.DLL.IDX_DLL", cAlternateFileName="OUTLWV~1.IDX")) returned 1 [0058.784] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.784] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OUTLWVW.DLL.IDX_DLL") returned -1 [0058.784] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLWVW.DLL.IDX_DLL") returned -1 [0058.784] lstrcmpiA (lpString1="", lpString2="OUTLWVW.DLL.IDX_DLL") returned -1 [0058.784] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned="OUTLWVW.DLL" [0058.784] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.784] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.784] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="OUTLWVW.DLL.IDX_DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL" [0058.784] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PASSPORT.CSS", cAlternateFileName="")) returned 1 [0058.784] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.784] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PASSPORT.CSS") returned -1 [0058.784] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PASSPORT.CSS") returned -1 [0058.784] lstrcmpiA (lpString1="", lpString2="PASSPORT.CSS") returned -1 [0058.784] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned="OUTLWVW.DLL.IDX_DLL" [0058.784] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.784] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.784] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PASSPORT.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASSPORT.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASSPORT.CSS" [0058.785] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PASTEL.CSS", cAlternateFileName="")) returned 1 [0058.785] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.785] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PASTEL.CSS") returned -1 [0058.785] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PASTEL.CSS") returned -1 [0058.785] lstrcmpiA (lpString1="", lpString2="PASTEL.CSS") returned -1 [0058.785] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASSPORT.CSS") returned="PASSPORT.CSS" [0058.785] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.785] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.785] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.785] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.785] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PASTEL.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASTEL.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASTEL.CSS" [0058.785] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50b8c480, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x14980, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE.VSL", cAlternateFileName="")) returned 1 [0058.785] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.785] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PE.VSL") returned -1 [0058.785] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PE.VSL") returned -1 [0058.785] lstrcmpiA (lpString1="", lpString2="PE.VSL") returned -1 [0058.785] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASTEL.CSS") returned="PASTEL.CSS" [0058.785] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.785] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.785] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.785] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.785] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PE.VSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL" [0058.785] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cd5800, ftCreationTime.dwHighDateTime=0x1c56bc5, ftLastAccessTime.dwLowDateTime=0x50bfe8a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5cd5800, ftLastWriteTime.dwHighDateTime=0x1c56bc5, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIPELINE.VRD", cAlternateFileName="")) returned 1 [0058.785] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.785] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PIPELINE.VRD") returned -1 [0058.785] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PIPELINE.VRD") returned -1 [0058.785] lstrcmpiA (lpString1="", lpString2="PIPELINE.VRD") returned -1 [0058.786] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned="PE.VSL" [0058.786] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.786] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.786] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PIPELINE.VRD" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" [0058.786] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bd800, ftCreationTime.dwHighDateTime=0x1cb71c8, ftLastAccessTime.dwLowDateTime=0xdf0d2c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74bd800, ftLastWriteTime.dwHighDateTime=0x1cb71c8, nFileSizeHigh=0x0, nFileSizeLow=0x33a380, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJINTL.DLL", cAlternateFileName="")) returned 1 [0058.786] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.786] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PJINTL.DLL") returned -1 [0058.786] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PJINTL.DLL") returned -1 [0058.786] lstrcmpiA (lpString1="", lpString2="PJINTL.DLL") returned -1 [0058.786] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned="PIPELINE.VRD" [0058.786] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.786] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.786] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PJINTL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL" [0058.786] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a461000, ftCreationTime.dwHighDateTime=0x1cb7018, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9a461000, ftLastWriteTime.dwHighDateTime=0x1cb7018, nFileSizeHigh=0x0, nFileSizeLow=0x25b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJINTLC.DLL", cAlternateFileName="")) returned 1 [0058.786] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.786] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PJINTLC.DLL") returned -1 [0058.786] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PJINTLC.DLL") returned -1 [0058.786] lstrcmpiA (lpString1="", lpString2="PJINTLC.DLL") returned -1 [0058.786] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned="PJINTL.DLL" [0058.786] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.786] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.787] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.787] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.787] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PJINTLC.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL" [0058.787] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50c24a00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x2980, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMENURES.DLL", cAlternateFileName="")) returned 1 [0058.787] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.807] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PMENURES.DLL") returned -1 [0058.807] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PMENURES.DLL") returned -1 [0058.807] lstrcmpiA (lpString1="", lpString2="PMENURES.DLL") returned -1 [0058.807] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned="PJINTLC.DLL" [0058.807] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.807] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.807] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.807] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.807] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PMENURES.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL" [0058.807] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900f5a00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x900f5a00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x4cf264, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.DEV.HXS", cAlternateFileName="POWERP~1.HXS")) returned 1 [0058.807] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.807] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="POWERPNT.DEV.HXS") returned -1 [0058.807] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="POWERPNT.DEV.HXS") returned -1 [0058.807] lstrcmpiA (lpString1="", lpString2="POWERPNT.DEV.HXS") returned -1 [0058.807] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned="PMENURES.DLL" [0058.807] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.807] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.807] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.807] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.807] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="POWERPNT.DEV.HXS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS" [0058.807] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.DEV_COL.HXC", cAlternateFileName="POWERP~1.HXC")) returned 1 [0058.807] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.807] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="POWERPNT.DEV_COL.HXC") returned -1 [0058.808] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="POWERPNT.DEV_COL.HXC") returned -1 [0058.808] lstrcmpiA (lpString1="", lpString2="POWERPNT.DEV_COL.HXC") returned -1 [0058.808] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned="POWERPNT.DEV.HXS" [0058.808] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.808] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.808] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.808] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.808] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="POWERPNT.DEV_COL.HXC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC" [0058.808] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56e35200, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x56e35200, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.DEV_COL.HXT", cAlternateFileName="POWERP~1.HXT")) returned 1 [0058.808] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.808] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="POWERPNT.DEV_COL.HXT") returned -1 [0058.808] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="POWERPNT.DEV_COL.HXT") returned -1 [0058.808] lstrcmpiA (lpString1="", lpString2="POWERPNT.DEV_COL.HXT") returned -1 [0058.808] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned="POWERPNT.DEV_COL.HXC" [0058.808] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.808] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.808] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.808] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.808] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="POWERPNT.DEV_COL.HXT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" [0058.808] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56e35200, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x56e35200, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.DEV_F_COL.HXK", cAlternateFileName="POWERP~1.HXK")) returned 1 [0058.808] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.808] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="POWERPNT.DEV_F_COL.HXK") returned -1 [0058.808] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="POWERPNT.DEV_F_COL.HXK") returned -1 [0058.808] lstrcmpiA (lpString1="", lpString2="POWERPNT.DEV_F_COL.HXK") returned -1 [0058.808] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned="POWERPNT.DEV_COL.HXT" [0058.808] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.808] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.808] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.809] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.809] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="POWERPNT.DEV_F_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" [0058.809] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56e35200, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x56e35200, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.DEV_K_COL.HXK", cAlternateFileName="POWERP~2.HXK")) returned 1 [0058.809] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.809] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="POWERPNT.DEV_K_COL.HXK") returned -1 [0058.809] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="POWERPNT.DEV_K_COL.HXK") returned -1 [0058.809] lstrcmpiA (lpString1="", lpString2="POWERPNT.DEV_K_COL.HXK") returned -1 [0058.809] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned="POWERPNT.DEV_F_COL.HXK" [0058.809] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.809] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.809] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.809] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.809] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="POWERPNT.DEV_K_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK" [0058.809] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe02ac500, ftCreationTime.dwHighDateTime=0x1ca9370, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe02ac500, ftLastWriteTime.dwHighDateTime=0x1ca9370, nFileSizeHigh=0x0, nFileSizeLow=0x68013d, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.HXS", cAlternateFileName="")) returned 1 [0058.809] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.809] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="POWERPNT.HXS") returned -1 [0058.809] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="POWERPNT.HXS") returned -1 [0058.809] lstrcmpiA (lpString1="", lpString2="POWERPNT.HXS") returned -1 [0058.809] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned="POWERPNT.DEV_K_COL.HXK" [0058.809] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.809] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.809] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.809] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.810] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="POWERPNT.HXS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS" [0058.810] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT_COL.HXC", cAlternateFileName="POWERP~2.HXC")) returned 1 [0058.810] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.810] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="POWERPNT_COL.HXC") returned -1 [0058.810] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="POWERPNT_COL.HXC") returned -1 [0058.810] lstrcmpiA (lpString1="", lpString2="POWERPNT_COL.HXC") returned -1 [0058.810] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned="POWERPNT.HXS" [0058.810] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.810] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.810] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.810] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.810] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="POWERPNT_COL.HXC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" [0058.810] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534fcb00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x534fcb00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT_COL.HXT", cAlternateFileName="POWERP~2.HXT")) returned 1 [0058.810] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.810] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="POWERPNT_COL.HXT") returned -1 [0058.810] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="POWERPNT_COL.HXT") returned -1 [0058.810] lstrcmpiA (lpString1="", lpString2="POWERPNT_COL.HXT") returned -1 [0058.810] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned="POWERPNT_COL.HXC" [0058.810] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.810] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.810] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.810] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.811] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="POWERPNT_COL.HXT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" [0058.811] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534fcb00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x534fcb00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT_F_COL.HXK", cAlternateFileName="POWERP~3.HXK")) returned 1 [0058.811] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.811] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="POWERPNT_F_COL.HXK") returned -1 [0058.811] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="POWERPNT_F_COL.HXK") returned -1 [0058.811] lstrcmpiA (lpString1="", lpString2="POWERPNT_F_COL.HXK") returned -1 [0058.811] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned="POWERPNT_COL.HXT" [0058.811] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.811] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.811] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.811] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.811] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="POWERPNT_F_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" [0058.811] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534fcb00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x534fcb00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT_K_COL.HXK", cAlternateFileName="POWERP~4.HXK")) returned 1 [0058.811] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.811] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="POWERPNT_K_COL.HXK") returned -1 [0058.811] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="POWERPNT_K_COL.HXK") returned -1 [0058.811] lstrcmpiA (lpString1="", lpString2="POWERPNT_K_COL.HXK") returned -1 [0058.811] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned="POWERPNT_F_COL.HXK" [0058.811] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.811] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.811] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.812] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.812] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="POWERPNT_K_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" [0058.812] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcab1b00, ftCreationTime.dwHighDateTime=0x1cabea2, ftLastAccessTime.dwLowDateTime=0xf5e6fbb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcab1b00, ftLastWriteTime.dwHighDateTime=0x1cabea2, nFileSizeHigh=0x0, nFileSizeLow=0x139968, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.DLL", cAlternateFileName="")) returned 1 [0058.812] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.812] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PPINTL.DLL") returned -1 [0058.812] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PPINTL.DLL") returned -1 [0058.812] lstrcmpiA (lpString1="", lpString2="PPINTL.DLL") returned -1 [0058.812] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned="POWERPNT_K_COL.HXK" [0058.812] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.812] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.812] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.812] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.812] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PPINTL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL" [0058.812] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45e38b00, ftCreationTime.dwHighDateTime=0x1cabea2, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x45e38b00, ftLastWriteTime.dwHighDateTime=0x1cabea2, nFileSizeHigh=0x0, nFileSizeLow=0x9580, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.DLL.IDX_DLL", cAlternateFileName="PPINTL~1.IDX")) returned 1 [0058.812] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.812] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PPINTL.DLL.IDX_DLL") returned -1 [0058.812] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PPINTL.DLL.IDX_DLL") returned -1 [0058.812] lstrcmpiA (lpString1="", lpString2="PPINTL.DLL.IDX_DLL") returned -1 [0058.812] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned="PPINTL.DLL" [0058.812] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.812] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.812] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.813] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.813] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PPINTL.DLL.IDX_DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL" [0058.813] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45e38b00, ftCreationTime.dwHighDateTime=0x1cabea2, ftLastAccessTime.dwLowDateTime=0xf5e6fbb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x45e38b00, ftLastWriteTime.dwHighDateTime=0x1cabea2, nFileSizeHigh=0x0, nFileSizeLow=0x22180, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.REST.IDX_DLL", cAlternateFileName="PPINTL~2.IDX")) returned 1 [0058.813] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.813] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PPINTL.REST.IDX_DLL") returned -1 [0058.813] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PPINTL.REST.IDX_DLL") returned -1 [0058.813] lstrcmpiA (lpString1="", lpString2="PPINTL.REST.IDX_DLL") returned -1 [0058.813] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned="PPINTL.DLL.IDX_DLL" [0058.813] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.813] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.813] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.813] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.813] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PPINTL.REST.IDX_DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" [0058.813] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50c4ab60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRIMARY.CSS", cAlternateFileName="")) returned 1 [0058.813] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.813] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PRIMARY.CSS") returned -1 [0058.813] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PRIMARY.CSS") returned -1 [0058.813] lstrcmpiA (lpString1="", lpString2="PRIMARY.CSS") returned -1 [0058.813] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned="PPINTL.REST.IDX_DLL" [0058.813] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.813] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.813] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.813] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.813] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PRIMARY.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PRIMARY.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PRIMARY.CSS" [0058.814] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50c70cc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x21788, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPRPT.VSL", cAlternateFileName="")) returned 1 [0058.814] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.814] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PROPRPT.VSL") returned -1 [0058.814] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PROPRPT.VSL") returned -1 [0058.814] lstrcmpiA (lpString1="", lpString2="PROPRPT.VSL") returned -1 [0058.814] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PRIMARY.CSS") returned="PRIMARY.CSS" [0058.814] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.814] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.814] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.814] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.814] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PROPRPT.VSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" [0058.814] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e830b00, ftCreationTime.dwHighDateTime=0x1ca4730, ftLastAccessTime.dwLowDateTime=0x50c70cc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7e830b00, ftLastWriteTime.dwHighDateTime=0x1ca4730, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPRPT.VSS", cAlternateFileName="")) returned 1 [0058.814] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.814] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PROPRPT.VSS") returned -1 [0058.814] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PROPRPT.VSS") returned -1 [0058.814] lstrcmpiA (lpString1="", lpString2="PROPRPT.VSS") returned -1 [0058.814] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned="PROPRPT.VSL" [0058.814] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.814] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.814] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.814] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.814] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PROPRPT.VSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSS" [0058.814] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4722d700, ftCreationTime.dwHighDateTime=0x1c4bfe8, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4722d700, ftLastWriteTime.dwHighDateTime=0x1c4bfe8, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLN.DOC", cAlternateFileName="")) returned 1 [0058.814] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.814] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PROTTPLN.DOC") returned -1 [0058.814] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PROTTPLN.DOC") returned -1 [0058.814] lstrcmpiA (lpString1="", lpString2="PROTTPLN.DOC") returned -1 [0058.814] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSS") returned="PROPRPT.VSS" [0058.815] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.815] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.815] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.815] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.815] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PROTTPLN.DOC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC" [0058.815] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC" [0058.815] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC" [0058.815] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC." [0058.815] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC.wannacry" [0058.815] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0058.817] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4e00 [0058.817] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4722d700, dwHighDateTime=0x1c4bfe8), lpLastAccessTime=0x407536*(dwLowDateTime=0xfa64b3d0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4722d700, dwHighDateTime=0x1c4bfe8)) returned 1 [0058.817] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.817] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4d82, lpOverlapped=0x0) returned 1 [0058.819] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC") returned="PROTTPLN.DOC" [0058.819] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.819] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4d82, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4d82, lpOverlapped=0x0) returned 1 [0058.819] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.819] CloseHandle (hObject=0x8c) returned 1 [0058.819] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.doc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.doc.wannacry")) returned 1 [0058.820] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9744d100, ftCreationTime.dwHighDateTime=0x1c7e3af, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9744d100, ftLastWriteTime.dwHighDateTime=0x1c7e3af, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="PROTTPLN.PPT", cAlternateFileName="")) returned 1 [0058.820] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.820] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PROTTPLN.PPT") returned -1 [0058.820] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PROTTPLN.PPT") returned -1 [0058.821] lstrcmpiA (lpString1="", lpString2="PROTTPLN.PPT") returned -1 [0058.821] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC") returned="PROTTPLN.DOC" [0058.821] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.821] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.821] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.821] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.821] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PROTTPLN.PPT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT" [0058.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT", pszSpec="*.zip") returned 0 [0058.821] lstrlenA (lpString="*.zip") returned 5 [0058.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT", pszSpec="*.rar") returned 0 [0058.821] lstrlenA (lpString="*.rar") returned 5 [0058.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT", pszSpec="*.7z") returned 0 [0058.821] lstrlenA (lpString="*.7z") returned 4 [0058.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT", pszSpec="*.tar") returned 0 [0058.821] lstrlenA (lpString="*.tar") returned 5 [0058.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT", pszSpec="*.gzip") returned 0 [0058.821] lstrlenA (lpString="*.gzip") returned 6 [0058.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT", pszSpec="*.jpg") returned 0 [0058.821] lstrlenA (lpString="*.jpg") returned 5 [0058.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT", pszSpec="*.jpeg") returned 0 [0058.821] lstrlenA (lpString="*.jpeg") returned 6 [0058.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT", pszSpec="*.psd") returned 0 [0058.821] lstrlenA (lpString="*.psd") returned 5 [0058.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT", pszSpec="*.gif") returned 0 [0058.821] lstrlenA (lpString="*.gif") returned 5 [0058.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT", pszSpec="*.doc") returned 0 [0058.822] lstrlenA (lpString="*.doc") returned 5 [0058.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT", pszSpec="*.docx") returned 0 [0058.822] lstrlenA (lpString="*.docx") returned 6 [0058.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT", pszSpec="*.xls") returned 0 [0058.822] lstrlenA (lpString="*.xls") returned 5 [0058.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT", pszSpec="*.xlsx") returned 0 [0058.822] lstrlenA (lpString="*.xlsx") returned 6 [0058.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT", pszSpec="*.ppt") returned 1 [0058.822] lstrlenA (lpString="*.ppt") returned 5 [0058.822] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT" [0058.822] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT" [0058.822] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT." [0058.822] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT.wannacry" [0058.822] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0058.824] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3000 [0058.824] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9744d100, dwHighDateTime=0x1c7e3af), lpLastAccessTime=0x407536*(dwLowDateTime=0xef00bf70, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9744d100, dwHighDateTime=0x1c7e3af)) returned 1 [0058.824] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.824] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2f82, lpOverlapped=0x0) returned 1 [0058.825] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT") returned="PROTTPLN.PPT" [0058.826] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.826] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2f82, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2f82, lpOverlapped=0x0) returned 1 [0058.826] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.826] CloseHandle (hObject=0x8c) returned 1 [0058.826] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.ppt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.ppt.wannacry")) returned 1 [0058.827] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51dd6c00, ftCreationTime.dwHighDateTime=0x1c4bfe8, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x51dd6c00, ftLastWriteTime.dwHighDateTime=0x1c4bfe8, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="PROTTPLN.XLS", cAlternateFileName="")) returned 1 [0058.827] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.827] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PROTTPLN.XLS") returned -1 [0058.827] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PROTTPLN.XLS") returned -1 [0058.827] lstrcmpiA (lpString1="", lpString2="PROTTPLN.XLS") returned -1 [0058.827] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT") returned="PROTTPLN.PPT" [0058.827] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.827] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.827] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.827] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.827] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PROTTPLN.XLS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS" [0058.827] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS", pszSpec="*.zip") returned 0 [0058.827] lstrlenA (lpString="*.zip") returned 5 [0058.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS", pszSpec="*.rar") returned 0 [0058.828] lstrlenA (lpString="*.rar") returned 5 [0058.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS", pszSpec="*.7z") returned 0 [0058.828] lstrlenA (lpString="*.7z") returned 4 [0058.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS", pszSpec="*.tar") returned 0 [0058.828] lstrlenA (lpString="*.tar") returned 5 [0058.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS", pszSpec="*.gzip") returned 0 [0058.828] lstrlenA (lpString="*.gzip") returned 6 [0058.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS", pszSpec="*.jpg") returned 0 [0058.828] lstrlenA (lpString="*.jpg") returned 5 [0058.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS", pszSpec="*.jpeg") returned 0 [0058.828] lstrlenA (lpString="*.jpeg") returned 6 [0058.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS", pszSpec="*.psd") returned 0 [0058.828] lstrlenA (lpString="*.psd") returned 5 [0058.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS", pszSpec="*.gif") returned 0 [0058.828] lstrlenA (lpString="*.gif") returned 5 [0058.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS", pszSpec="*.doc") returned 0 [0058.828] lstrlenA (lpString="*.doc") returned 5 [0058.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS", pszSpec="*.docx") returned 0 [0058.828] lstrlenA (lpString="*.docx") returned 6 [0058.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS", pszSpec="*.xls") returned 1 [0058.828] lstrlenA (lpString="*.xls") returned 5 [0058.828] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS" [0058.828] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS" [0058.828] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS." [0058.828] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS.wannacry" [0058.828] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0058.829] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2200 [0058.829] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x51dd6c00, dwHighDateTime=0x1c4bfe8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf5e95d10, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0x51dd6c00, dwHighDateTime=0x1c4bfe8)) returned 1 [0058.829] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.829] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2182, lpOverlapped=0x0) returned 1 [0058.831] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS") returned="PROTTPLN.XLS" [0058.831] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.831] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2182, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2182, lpOverlapped=0x0) returned 1 [0058.831] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.831] CloseHandle (hObject=0x8c) returned 1 [0058.831] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.xls.wannacry")) returned 1 [0058.832] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45f1aa00, ftCreationTime.dwHighDateTime=0x1c4bfe8, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x45f1aa00, ftLastWriteTime.dwHighDateTime=0x1c4bfe8, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="PROTTPLV.DOC", cAlternateFileName="")) returned 1 [0058.832] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.832] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PROTTPLV.DOC") returned -1 [0058.832] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PROTTPLV.DOC") returned -1 [0058.832] lstrcmpiA (lpString1="", lpString2="PROTTPLV.DOC") returned -1 [0058.832] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS") returned="PROTTPLN.XLS" [0058.832] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.832] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.833] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.833] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.833] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PROTTPLV.DOC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC" [0058.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC", pszSpec="*.zip") returned 0 [0058.833] lstrlenA (lpString="*.zip") returned 5 [0058.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC", pszSpec="*.rar") returned 0 [0058.833] lstrlenA (lpString="*.rar") returned 5 [0058.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC", pszSpec="*.7z") returned 0 [0058.833] lstrlenA (lpString="*.7z") returned 4 [0058.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC", pszSpec="*.tar") returned 0 [0058.833] lstrlenA (lpString="*.tar") returned 5 [0058.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC", pszSpec="*.gzip") returned 0 [0058.833] lstrlenA (lpString="*.gzip") returned 6 [0058.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC", pszSpec="*.jpg") returned 0 [0058.833] lstrlenA (lpString="*.jpg") returned 5 [0058.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC", pszSpec="*.jpeg") returned 0 [0058.833] lstrlenA (lpString="*.jpeg") returned 6 [0058.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC", pszSpec="*.psd") returned 0 [0058.833] lstrlenA (lpString="*.psd") returned 5 [0058.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC", pszSpec="*.gif") returned 0 [0058.833] lstrlenA (lpString="*.gif") returned 5 [0058.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC", pszSpec="*.doc") returned 1 [0058.833] lstrlenA (lpString="*.doc") returned 5 [0058.833] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC" [0058.833] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC" [0058.833] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC." [0058.833] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC.wannacry" [0058.833] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0058.834] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4e00 [0058.834] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45f1aa00, dwHighDateTime=0x1c4bfe8), lpLastAccessTime=0x407536*(dwLowDateTime=0xfa64b3d0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45f1aa00, dwHighDateTime=0x1c4bfe8)) returned 1 [0058.834] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.834] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4d82, lpOverlapped=0x0) returned 1 [0058.838] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC") returned="PROTTPLV.DOC" [0058.838] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.838] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4d82, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4d82, lpOverlapped=0x0) returned 1 [0058.838] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.838] CloseHandle (hObject=0x8c) returned 1 [0058.838] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.doc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.doc.wannacry")) returned 1 [0058.839] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9744d100, ftCreationTime.dwHighDateTime=0x1c7e3af, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9744d100, ftLastWriteTime.dwHighDateTime=0x1c7e3af, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="PROTTPLV.PPT", cAlternateFileName="")) returned 1 [0058.841] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.841] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PROTTPLV.PPT") returned -1 [0058.841] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PROTTPLV.PPT") returned -1 [0058.841] lstrcmpiA (lpString1="", lpString2="PROTTPLV.PPT") returned -1 [0058.841] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC") returned="PROTTPLV.DOC" [0058.841] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.841] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.841] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.841] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.841] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PROTTPLV.PPT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT" [0058.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT", pszSpec="*.zip") returned 0 [0058.841] lstrlenA (lpString="*.zip") returned 5 [0058.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT", pszSpec="*.rar") returned 0 [0058.841] lstrlenA (lpString="*.rar") returned 5 [0058.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT", pszSpec="*.7z") returned 0 [0058.841] lstrlenA (lpString="*.7z") returned 4 [0058.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT", pszSpec="*.tar") returned 0 [0058.841] lstrlenA (lpString="*.tar") returned 5 [0058.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT", pszSpec="*.gzip") returned 0 [0058.841] lstrlenA (lpString="*.gzip") returned 6 [0058.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT", pszSpec="*.jpg") returned 0 [0058.841] lstrlenA (lpString="*.jpg") returned 5 [0058.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT", pszSpec="*.jpeg") returned 0 [0058.841] lstrlenA (lpString="*.jpeg") returned 6 [0058.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT", pszSpec="*.psd") returned 0 [0058.841] lstrlenA (lpString="*.psd") returned 5 [0058.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT", pszSpec="*.gif") returned 0 [0058.841] lstrlenA (lpString="*.gif") returned 5 [0058.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT", pszSpec="*.doc") returned 0 [0058.841] lstrlenA (lpString="*.doc") returned 5 [0058.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT", pszSpec="*.docx") returned 0 [0058.841] lstrlenA (lpString="*.docx") returned 6 [0058.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT", pszSpec="*.xls") returned 0 [0058.842] lstrlenA (lpString="*.xls") returned 5 [0058.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT", pszSpec="*.xlsx") returned 0 [0058.842] lstrlenA (lpString="*.xlsx") returned 6 [0058.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT", pszSpec="*.ppt") returned 1 [0058.842] lstrlenA (lpString="*.ppt") returned 5 [0058.842] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT" [0058.842] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT" [0058.842] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT." [0058.842] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT.wannacry" [0058.842] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0058.842] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3000 [0058.842] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9744d100, dwHighDateTime=0x1c7e3af), lpLastAccessTime=0x407536*(dwLowDateTime=0xef00bf70, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9744d100, dwHighDateTime=0x1c7e3af)) returned 1 [0058.843] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.843] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2f82, lpOverlapped=0x0) returned 1 [0058.844] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT") returned="PROTTPLV.PPT" [0058.844] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.844] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2f82, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2f82, lpOverlapped=0x0) returned 1 [0058.845] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.845] CloseHandle (hObject=0x8c) returned 1 [0058.845] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.ppt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.ppt.wannacry")) returned 1 [0058.846] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d18b800, ftCreationTime.dwHighDateTime=0x1c4bfe8, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4d18b800, ftLastWriteTime.dwHighDateTime=0x1c4bfe8, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="PROTTPLV.XLS", cAlternateFileName="")) returned 1 [0058.846] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.846] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PROTTPLV.XLS") returned -1 [0058.846] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PROTTPLV.XLS") returned -1 [0058.846] lstrcmpiA (lpString1="", lpString2="PROTTPLV.XLS") returned -1 [0058.846] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT") returned="PROTTPLV.PPT" [0058.846] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.846] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.846] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.846] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.846] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PROTTPLV.XLS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS" [0058.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS", pszSpec="*.zip") returned 0 [0058.846] lstrlenA (lpString="*.zip") returned 5 [0058.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS", pszSpec="*.rar") returned 0 [0058.846] lstrlenA (lpString="*.rar") returned 5 [0058.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS", pszSpec="*.7z") returned 0 [0058.847] lstrlenA (lpString="*.7z") returned 4 [0058.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS", pszSpec="*.tar") returned 0 [0058.847] lstrlenA (lpString="*.tar") returned 5 [0058.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS", pszSpec="*.gzip") returned 0 [0058.847] lstrlenA (lpString="*.gzip") returned 6 [0058.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS", pszSpec="*.jpg") returned 0 [0058.847] lstrlenA (lpString="*.jpg") returned 5 [0058.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS", pszSpec="*.jpeg") returned 0 [0058.847] lstrlenA (lpString="*.jpeg") returned 6 [0058.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS", pszSpec="*.psd") returned 0 [0058.847] lstrlenA (lpString="*.psd") returned 5 [0058.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS", pszSpec="*.gif") returned 0 [0058.847] lstrlenA (lpString="*.gif") returned 5 [0058.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS", pszSpec="*.doc") returned 0 [0058.847] lstrlenA (lpString="*.doc") returned 5 [0058.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS", pszSpec="*.docx") returned 0 [0058.847] lstrlenA (lpString="*.docx") returned 6 [0058.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS", pszSpec="*.xls") returned 1 [0058.847] lstrlenA (lpString="*.xls") returned 5 [0058.847] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS" [0058.847] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS" [0058.847] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS." [0058.847] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS.wannacry" [0058.847] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0058.849] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2200 [0058.849] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4d18b800, dwHighDateTime=0x1c4bfe8), lpLastAccessTime=0x407536*(dwLowDateTime=0xf5e95d10, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4d18b800, dwHighDateTime=0x1c4bfe8)) returned 1 [0058.849] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.849] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2182, lpOverlapped=0x0) returned 1 [0058.851] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS") returned="PROTTPLV.XLS" [0058.851] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.851] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2182, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2182, lpOverlapped=0x0) returned 1 [0058.851] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.851] CloseHandle (hObject=0x8c) returned 1 [0058.851] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.xls.wannacry")) returned 1 [0058.852] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99e7da00, ftCreationTime.dwHighDateTime=0x1c5c981, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99e7da00, ftLastWriteTime.dwHighDateTime=0x1c5c981, nFileSizeHigh=0x0, nFileSizeLow=0x4f777, dwReserved0=0x3000003, dwReserved1=0x2d7ff8, cFileName="PSRCHKEY.DAT", cAlternateFileName="")) returned 1 [0058.852] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.852] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PSRCHKEY.DAT") returned -1 [0058.852] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PSRCHKEY.DAT") returned -1 [0058.852] lstrcmpiA (lpString1="", lpString2="PSRCHKEY.DAT") returned -1 [0058.852] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS") returned="PROTTPLV.XLS" [0058.852] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.852] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.852] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.853] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.853] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PSRCHKEY.DAT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT" [0058.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.zip") returned 0 [0058.853] lstrlenA (lpString="*.zip") returned 5 [0058.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.rar") returned 0 [0058.853] lstrlenA (lpString="*.rar") returned 5 [0058.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.7z") returned 0 [0058.853] lstrlenA (lpString="*.7z") returned 4 [0058.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.tar") returned 0 [0058.853] lstrlenA (lpString="*.tar") returned 5 [0058.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.gzip") returned 0 [0058.853] lstrlenA (lpString="*.gzip") returned 6 [0058.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.jpg") returned 0 [0058.853] lstrlenA (lpString="*.jpg") returned 5 [0058.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.jpeg") returned 0 [0058.853] lstrlenA (lpString="*.jpeg") returned 6 [0058.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.psd") returned 0 [0058.853] lstrlenA (lpString="*.psd") returned 5 [0058.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.gif") returned 0 [0058.853] lstrlenA (lpString="*.gif") returned 5 [0058.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.doc") returned 0 [0058.853] lstrlenA (lpString="*.doc") returned 5 [0058.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.docx") returned 0 [0058.853] lstrlenA (lpString="*.docx") returned 6 [0058.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.xls") returned 0 [0058.853] lstrlenA (lpString="*.xls") returned 5 [0058.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.xlsx") returned 0 [0058.853] lstrlenA (lpString="*.xlsx") returned 6 [0058.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.ppt") returned 0 [0058.853] lstrlenA (lpString="*.ppt") returned 5 [0058.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.pptx") returned 0 [0058.853] lstrlenA (lpString="*.pptx") returned 6 [0058.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.pdf") returned 0 [0058.854] lstrlenA (lpString="*.pdf") returned 5 [0058.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.mov") returned 0 [0058.854] lstrlenA (lpString="*.mov") returned 5 [0058.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.m2v") returned 0 [0058.854] lstrlenA (lpString="*.m2v") returned 5 [0058.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.3gp") returned 0 [0058.854] lstrlenA (lpString="*.3gp") returned 5 [0058.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.mpeg") returned 0 [0058.854] lstrlenA (lpString="*.mpeg") returned 6 [0058.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.mpg") returned 0 [0058.854] lstrlenA (lpString="*.mpg") returned 5 [0058.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.flv") returned 0 [0058.854] lstrlenA (lpString="*.flv") returned 5 [0058.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.avi") returned 0 [0058.854] lstrlenA (lpString="*.avi") returned 5 [0058.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.mp4") returned 0 [0058.854] lstrlenA (lpString="*.mp4") returned 5 [0058.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.wmv") returned 0 [0058.854] lstrlenA (lpString="*.wmv") returned 5 [0058.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.divx") returned 0 [0058.854] lstrlenA (lpString="*.divx") returned 6 [0058.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.mkv") returned 0 [0058.854] lstrlenA (lpString="*.mkv") returned 5 [0058.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.mp3") returned 0 [0058.854] lstrlenA (lpString="*.mp3") returned 5 [0058.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.wav") returned 0 [0058.854] lstrlenA (lpString="*.wav") returned 5 [0058.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.flac") returned 0 [0058.854] lstrlenA (lpString="*.flac") returned 6 [0058.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.ape") returned 0 [0058.854] lstrlenA (lpString="*.ape") returned 5 [0058.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.wma") returned 0 [0058.855] lstrlenA (lpString="*.wma") returned 5 [0058.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.ac3") returned 0 [0058.855] lstrlenA (lpString="*.ac3") returned 5 [0058.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", pszSpec="*.mxf") returned 0 [0058.855] lstrlenA (lpString="*.mxf") returned 5 [0058.855] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33033d00, ftCreationTime.dwHighDateTime=0x1c56d62, ftLastAccessTime.dwLowDateTime=0xc866d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33033d00, ftLastWriteTime.dwHighDateTime=0x1c56d62, nFileSizeHigh=0x0, nFileSizeLow=0x1f3978, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRCHLEX.DAT", cAlternateFileName="")) returned 1 [0058.855] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.855] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PSRCHLEX.DAT") returned -1 [0058.855] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PSRCHLEX.DAT") returned -1 [0058.855] lstrcmpiA (lpString1="", lpString2="PSRCHLEX.DAT") returned -1 [0058.855] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT") returned="PSRCHKEY.DAT" [0058.855] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.855] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.855] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.855] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.855] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PSRCHLEX.DAT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT" [0058.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.zip") returned 0 [0058.855] lstrlenA (lpString="*.zip") returned 5 [0058.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.rar") returned 0 [0058.855] lstrlenA (lpString="*.rar") returned 5 [0058.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.7z") returned 0 [0058.855] lstrlenA (lpString="*.7z") returned 4 [0058.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.tar") returned 0 [0058.855] lstrlenA (lpString="*.tar") returned 5 [0058.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.gzip") returned 0 [0058.855] lstrlenA (lpString="*.gzip") returned 6 [0058.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.jpg") returned 0 [0058.856] lstrlenA (lpString="*.jpg") returned 5 [0058.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.jpeg") returned 0 [0058.856] lstrlenA (lpString="*.jpeg") returned 6 [0058.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.psd") returned 0 [0058.856] lstrlenA (lpString="*.psd") returned 5 [0058.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.gif") returned 0 [0058.856] lstrlenA (lpString="*.gif") returned 5 [0058.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.doc") returned 0 [0058.856] lstrlenA (lpString="*.doc") returned 5 [0058.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.docx") returned 0 [0058.856] lstrlenA (lpString="*.docx") returned 6 [0058.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.xls") returned 0 [0058.856] lstrlenA (lpString="*.xls") returned 5 [0058.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.xlsx") returned 0 [0058.856] lstrlenA (lpString="*.xlsx") returned 6 [0058.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.ppt") returned 0 [0058.856] lstrlenA (lpString="*.ppt") returned 5 [0058.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.pptx") returned 0 [0058.856] lstrlenA (lpString="*.pptx") returned 6 [0058.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.pdf") returned 0 [0058.856] lstrlenA (lpString="*.pdf") returned 5 [0058.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.mov") returned 0 [0058.856] lstrlenA (lpString="*.mov") returned 5 [0058.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.m2v") returned 0 [0058.856] lstrlenA (lpString="*.m2v") returned 5 [0058.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.3gp") returned 0 [0058.856] lstrlenA (lpString="*.3gp") returned 5 [0058.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.mpeg") returned 0 [0058.856] lstrlenA (lpString="*.mpeg") returned 6 [0058.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.mpg") returned 0 [0058.856] lstrlenA (lpString="*.mpg") returned 5 [0058.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.flv") returned 0 [0058.856] lstrlenA (lpString="*.flv") returned 5 [0058.856] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.avi") returned 0 [0058.857] lstrlenA (lpString="*.avi") returned 5 [0058.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.mp4") returned 0 [0058.857] lstrlenA (lpString="*.mp4") returned 5 [0058.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.wmv") returned 0 [0058.857] lstrlenA (lpString="*.wmv") returned 5 [0058.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.divx") returned 0 [0058.857] lstrlenA (lpString="*.divx") returned 6 [0058.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.mkv") returned 0 [0058.857] lstrlenA (lpString="*.mkv") returned 5 [0058.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.mp3") returned 0 [0058.857] lstrlenA (lpString="*.mp3") returned 5 [0058.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.wav") returned 0 [0058.857] lstrlenA (lpString="*.wav") returned 5 [0058.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.flac") returned 0 [0058.857] lstrlenA (lpString="*.flac") returned 6 [0058.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.ape") returned 0 [0058.857] lstrlenA (lpString="*.ape") returned 5 [0058.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.wma") returned 0 [0058.857] lstrlenA (lpString="*.wma") returned 5 [0058.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.ac3") returned 0 [0058.857] lstrlenA (lpString="*.ac3") returned 5 [0058.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", pszSpec="*.mxf") returned 0 [0058.857] lstrlenA (lpString="*.mxf") returned 5 [0058.857] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33033d00, ftCreationTime.dwHighDateTime=0x1c56d62, ftLastAccessTime.dwLowDateTime=0xc866d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33033d00, ftLastWriteTime.dwHighDateTime=0x1c56d62, nFileSizeHigh=0x0, nFileSizeLow=0xcd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRCHLTS.DAT", cAlternateFileName="")) returned 1 [0058.857] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.857] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PSRCHLTS.DAT") returned -1 [0058.857] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PSRCHLTS.DAT") returned -1 [0058.857] lstrcmpiA (lpString1="", lpString2="PSRCHLTS.DAT") returned -1 [0058.857] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT") returned="PSRCHLEX.DAT" [0058.857] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.857] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.857] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.857] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.858] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PSRCHLTS.DAT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT" [0058.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.zip") returned 0 [0058.858] lstrlenA (lpString="*.zip") returned 5 [0058.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.rar") returned 0 [0058.858] lstrlenA (lpString="*.rar") returned 5 [0058.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.7z") returned 0 [0058.858] lstrlenA (lpString="*.7z") returned 4 [0058.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.tar") returned 0 [0058.858] lstrlenA (lpString="*.tar") returned 5 [0058.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.gzip") returned 0 [0058.858] lstrlenA (lpString="*.gzip") returned 6 [0058.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.jpg") returned 0 [0058.858] lstrlenA (lpString="*.jpg") returned 5 [0058.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.jpeg") returned 0 [0058.858] lstrlenA (lpString="*.jpeg") returned 6 [0058.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.psd") returned 0 [0058.858] lstrlenA (lpString="*.psd") returned 5 [0058.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.gif") returned 0 [0058.858] lstrlenA (lpString="*.gif") returned 5 [0058.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.doc") returned 0 [0058.858] lstrlenA (lpString="*.doc") returned 5 [0058.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.docx") returned 0 [0058.858] lstrlenA (lpString="*.docx") returned 6 [0058.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.xls") returned 0 [0058.858] lstrlenA (lpString="*.xls") returned 5 [0058.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.xlsx") returned 0 [0058.858] lstrlenA (lpString="*.xlsx") returned 6 [0058.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.ppt") returned 0 [0058.858] lstrlenA (lpString="*.ppt") returned 5 [0058.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.pptx") returned 0 [0058.858] lstrlenA (lpString="*.pptx") returned 6 [0058.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.pdf") returned 0 [0058.858] lstrlenA (lpString="*.pdf") returned 5 [0058.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.mov") returned 0 [0058.858] lstrlenA (lpString="*.mov") returned 5 [0058.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.m2v") returned 0 [0058.859] lstrlenA (lpString="*.m2v") returned 5 [0058.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.3gp") returned 0 [0058.859] lstrlenA (lpString="*.3gp") returned 5 [0058.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.mpeg") returned 0 [0058.859] lstrlenA (lpString="*.mpeg") returned 6 [0058.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.mpg") returned 0 [0058.859] lstrlenA (lpString="*.mpg") returned 5 [0058.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.flv") returned 0 [0058.859] lstrlenA (lpString="*.flv") returned 5 [0058.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.avi") returned 0 [0058.859] lstrlenA (lpString="*.avi") returned 5 [0058.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.mp4") returned 0 [0058.859] lstrlenA (lpString="*.mp4") returned 5 [0058.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.wmv") returned 0 [0058.859] lstrlenA (lpString="*.wmv") returned 5 [0058.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.divx") returned 0 [0058.859] lstrlenA (lpString="*.divx") returned 6 [0058.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.mkv") returned 0 [0058.859] lstrlenA (lpString="*.mkv") returned 5 [0058.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.mp3") returned 0 [0058.859] lstrlenA (lpString="*.mp3") returned 5 [0058.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.wav") returned 0 [0058.859] lstrlenA (lpString="*.wav") returned 5 [0058.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.flac") returned 0 [0058.859] lstrlenA (lpString="*.flac") returned 6 [0058.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.ape") returned 0 [0058.859] lstrlenA (lpString="*.ape") returned 5 [0058.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.wma") returned 0 [0058.859] lstrlenA (lpString="*.wma") returned 5 [0058.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.ac3") returned 0 [0058.859] lstrlenA (lpString="*.ac3") returned 5 [0058.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", pszSpec="*.mxf") returned 0 [0058.859] lstrlenA (lpString="*.mxf") returned 5 [0058.860] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33033d00, ftCreationTime.dwHighDateTime=0x1c56d62, ftLastAccessTime.dwLowDateTime=0xc866d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33033d00, ftLastWriteTime.dwHighDateTime=0x1c56d62, nFileSizeHigh=0x0, nFileSizeLow=0xd18, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRCHPHN.DAT", cAlternateFileName="")) returned 1 [0058.860] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.860] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PSRCHPHN.DAT") returned -1 [0058.860] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PSRCHPHN.DAT") returned -1 [0058.860] lstrcmpiA (lpString1="", lpString2="PSRCHPHN.DAT") returned -1 [0058.860] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT") returned="PSRCHLTS.DAT" [0058.860] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.860] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.860] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.860] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.860] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PSRCHPHN.DAT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT" [0058.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.zip") returned 0 [0058.860] lstrlenA (lpString="*.zip") returned 5 [0058.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.rar") returned 0 [0058.860] lstrlenA (lpString="*.rar") returned 5 [0058.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.7z") returned 0 [0058.860] lstrlenA (lpString="*.7z") returned 4 [0058.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.tar") returned 0 [0058.860] lstrlenA (lpString="*.tar") returned 5 [0058.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.gzip") returned 0 [0058.860] lstrlenA (lpString="*.gzip") returned 6 [0058.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.jpg") returned 0 [0058.860] lstrlenA (lpString="*.jpg") returned 5 [0058.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.jpeg") returned 0 [0058.860] lstrlenA (lpString="*.jpeg") returned 6 [0058.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.psd") returned 0 [0058.860] lstrlenA (lpString="*.psd") returned 5 [0058.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.gif") returned 0 [0058.860] lstrlenA (lpString="*.gif") returned 5 [0058.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.doc") returned 0 [0058.861] lstrlenA (lpString="*.doc") returned 5 [0058.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.docx") returned 0 [0058.861] lstrlenA (lpString="*.docx") returned 6 [0058.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.xls") returned 0 [0058.861] lstrlenA (lpString="*.xls") returned 5 [0058.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.xlsx") returned 0 [0058.861] lstrlenA (lpString="*.xlsx") returned 6 [0058.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.ppt") returned 0 [0058.861] lstrlenA (lpString="*.ppt") returned 5 [0058.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.pptx") returned 0 [0058.861] lstrlenA (lpString="*.pptx") returned 6 [0058.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.pdf") returned 0 [0058.861] lstrlenA (lpString="*.pdf") returned 5 [0058.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.mov") returned 0 [0058.861] lstrlenA (lpString="*.mov") returned 5 [0058.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.m2v") returned 0 [0058.861] lstrlenA (lpString="*.m2v") returned 5 [0058.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.3gp") returned 0 [0058.861] lstrlenA (lpString="*.3gp") returned 5 [0058.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.mpeg") returned 0 [0058.861] lstrlenA (lpString="*.mpeg") returned 6 [0058.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.mpg") returned 0 [0058.861] lstrlenA (lpString="*.mpg") returned 5 [0058.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.flv") returned 0 [0058.861] lstrlenA (lpString="*.flv") returned 5 [0058.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.avi") returned 0 [0058.861] lstrlenA (lpString="*.avi") returned 5 [0058.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.mp4") returned 0 [0058.861] lstrlenA (lpString="*.mp4") returned 5 [0058.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.wmv") returned 0 [0058.861] lstrlenA (lpString="*.wmv") returned 5 [0058.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.divx") returned 0 [0058.861] lstrlenA (lpString="*.divx") returned 6 [0058.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.mkv") returned 0 [0058.862] lstrlenA (lpString="*.mkv") returned 5 [0058.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.mp3") returned 0 [0058.862] lstrlenA (lpString="*.mp3") returned 5 [0058.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.wav") returned 0 [0058.862] lstrlenA (lpString="*.wav") returned 5 [0058.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.flac") returned 0 [0058.862] lstrlenA (lpString="*.flac") returned 6 [0058.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.ape") returned 0 [0058.862] lstrlenA (lpString="*.ape") returned 5 [0058.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.wma") returned 0 [0058.862] lstrlenA (lpString="*.wma") returned 5 [0058.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.ac3") returned 0 [0058.862] lstrlenA (lpString="*.ac3") returned 5 [0058.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", pszSpec="*.mxf") returned 0 [0058.862] lstrlenA (lpString="*.mxf") returned 5 [0058.862] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b190700, ftCreationTime.dwHighDateTime=0x1c5c981, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b190700, ftLastWriteTime.dwHighDateTime=0x1c5c981, nFileSizeHigh=0x0, nFileSizeLow=0xa03a47, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRCHSRN.DAT", cAlternateFileName="")) returned 1 [0058.862] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.862] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PSRCHSRN.DAT") returned -1 [0058.862] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PSRCHSRN.DAT") returned -1 [0058.862] lstrcmpiA (lpString1="", lpString2="PSRCHSRN.DAT") returned -1 [0058.862] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT") returned="PSRCHPHN.DAT" [0058.862] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.862] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.862] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.862] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.862] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PSRCHSRN.DAT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT" [0058.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.zip") returned 0 [0058.862] lstrlenA (lpString="*.zip") returned 5 [0058.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.rar") returned 0 [0058.862] lstrlenA (lpString="*.rar") returned 5 [0058.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.7z") returned 0 [0058.863] lstrlenA (lpString="*.7z") returned 4 [0058.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.tar") returned 0 [0058.863] lstrlenA (lpString="*.tar") returned 5 [0058.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.gzip") returned 0 [0058.863] lstrlenA (lpString="*.gzip") returned 6 [0058.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.jpg") returned 0 [0058.863] lstrlenA (lpString="*.jpg") returned 5 [0058.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.jpeg") returned 0 [0058.863] lstrlenA (lpString="*.jpeg") returned 6 [0058.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.psd") returned 0 [0058.863] lstrlenA (lpString="*.psd") returned 5 [0058.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.gif") returned 0 [0058.863] lstrlenA (lpString="*.gif") returned 5 [0058.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.doc") returned 0 [0058.863] lstrlenA (lpString="*.doc") returned 5 [0058.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.docx") returned 0 [0058.863] lstrlenA (lpString="*.docx") returned 6 [0058.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.xls") returned 0 [0058.863] lstrlenA (lpString="*.xls") returned 5 [0058.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.xlsx") returned 0 [0058.863] lstrlenA (lpString="*.xlsx") returned 6 [0058.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.ppt") returned 0 [0058.863] lstrlenA (lpString="*.ppt") returned 5 [0058.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.pptx") returned 0 [0058.863] lstrlenA (lpString="*.pptx") returned 6 [0058.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.pdf") returned 0 [0058.863] lstrlenA (lpString="*.pdf") returned 5 [0058.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.mov") returned 0 [0058.863] lstrlenA (lpString="*.mov") returned 5 [0058.863] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.m2v") returned 0 [0058.863] lstrlenA (lpString="*.m2v") returned 5 [0058.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.3gp") returned 0 [0058.864] lstrlenA (lpString="*.3gp") returned 5 [0058.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.mpeg") returned 0 [0058.864] lstrlenA (lpString="*.mpeg") returned 6 [0058.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.mpg") returned 0 [0058.864] lstrlenA (lpString="*.mpg") returned 5 [0058.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.flv") returned 0 [0058.864] lstrlenA (lpString="*.flv") returned 5 [0058.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.avi") returned 0 [0058.864] lstrlenA (lpString="*.avi") returned 5 [0058.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.mp4") returned 0 [0058.864] lstrlenA (lpString="*.mp4") returned 5 [0058.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.wmv") returned 0 [0058.864] lstrlenA (lpString="*.wmv") returned 5 [0058.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.divx") returned 0 [0058.864] lstrlenA (lpString="*.divx") returned 6 [0058.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.mkv") returned 0 [0058.864] lstrlenA (lpString="*.mkv") returned 5 [0058.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.mp3") returned 0 [0058.864] lstrlenA (lpString="*.mp3") returned 5 [0058.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.wav") returned 0 [0058.864] lstrlenA (lpString="*.wav") returned 5 [0058.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.flac") returned 0 [0058.864] lstrlenA (lpString="*.flac") returned 6 [0058.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.ape") returned 0 [0058.864] lstrlenA (lpString="*.ape") returned 5 [0058.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.wma") returned 0 [0058.864] lstrlenA (lpString="*.wma") returned 5 [0058.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.ac3") returned 0 [0058.864] lstrlenA (lpString="*.ac3") returned 5 [0058.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", pszSpec="*.mxf") returned 0 [0058.864] lstrlenA (lpString="*.mxf") returned 5 [0058.864] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe236cf00, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x1bbcb690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe236cf00, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x6a8b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.DLL", cAlternateFileName="")) returned 1 [0058.865] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.865] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PUB6INTL.DLL") returned -1 [0058.865] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PUB6INTL.DLL") returned -1 [0058.865] lstrcmpiA (lpString1="", lpString2="PUB6INTL.DLL") returned -1 [0058.865] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT") returned="PSRCHSRN.DAT" [0058.865] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.865] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.865] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.865] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.865] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PUB6INTL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL" [0058.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.zip") returned 0 [0058.865] lstrlenA (lpString="*.zip") returned 5 [0058.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.rar") returned 0 [0058.865] lstrlenA (lpString="*.rar") returned 5 [0058.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.7z") returned 0 [0058.865] lstrlenA (lpString="*.7z") returned 4 [0058.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.tar") returned 0 [0058.865] lstrlenA (lpString="*.tar") returned 5 [0058.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.gzip") returned 0 [0058.865] lstrlenA (lpString="*.gzip") returned 6 [0058.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.jpg") returned 0 [0058.865] lstrlenA (lpString="*.jpg") returned 5 [0058.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.jpeg") returned 0 [0058.865] lstrlenA (lpString="*.jpeg") returned 6 [0058.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.psd") returned 0 [0058.865] lstrlenA (lpString="*.psd") returned 5 [0058.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.gif") returned 0 [0058.866] lstrlenA (lpString="*.gif") returned 5 [0058.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.doc") returned 0 [0058.866] lstrlenA (lpString="*.doc") returned 5 [0058.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.docx") returned 0 [0058.866] lstrlenA (lpString="*.docx") returned 6 [0058.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.xls") returned 0 [0058.866] lstrlenA (lpString="*.xls") returned 5 [0058.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.xlsx") returned 0 [0058.866] lstrlenA (lpString="*.xlsx") returned 6 [0058.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.ppt") returned 0 [0058.866] lstrlenA (lpString="*.ppt") returned 5 [0058.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.pptx") returned 0 [0058.866] lstrlenA (lpString="*.pptx") returned 6 [0058.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.pdf") returned 0 [0058.866] lstrlenA (lpString="*.pdf") returned 5 [0058.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.mov") returned 0 [0058.866] lstrlenA (lpString="*.mov") returned 5 [0058.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.m2v") returned 0 [0058.866] lstrlenA (lpString="*.m2v") returned 5 [0058.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.3gp") returned 0 [0058.866] lstrlenA (lpString="*.3gp") returned 5 [0058.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.mpeg") returned 0 [0058.866] lstrlenA (lpString="*.mpeg") returned 6 [0058.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.mpg") returned 0 [0058.866] lstrlenA (lpString="*.mpg") returned 5 [0058.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.flv") returned 0 [0058.866] lstrlenA (lpString="*.flv") returned 5 [0058.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.avi") returned 0 [0058.866] lstrlenA (lpString="*.avi") returned 5 [0058.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.mp4") returned 0 [0058.866] lstrlenA (lpString="*.mp4") returned 5 [0058.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.wmv") returned 0 [0058.866] lstrlenA (lpString="*.wmv") returned 5 [0058.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.divx") returned 0 [0058.867] lstrlenA (lpString="*.divx") returned 6 [0058.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.mkv") returned 0 [0058.867] lstrlenA (lpString="*.mkv") returned 5 [0058.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.mp3") returned 0 [0058.867] lstrlenA (lpString="*.mp3") returned 5 [0058.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.wav") returned 0 [0058.867] lstrlenA (lpString="*.wav") returned 5 [0058.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.flac") returned 0 [0058.867] lstrlenA (lpString="*.flac") returned 6 [0058.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.ape") returned 0 [0058.867] lstrlenA (lpString="*.ape") returned 5 [0058.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.wma") returned 0 [0058.867] lstrlenA (lpString="*.wma") returned 5 [0058.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.ac3") returned 0 [0058.867] lstrlenA (lpString="*.ac3") returned 5 [0058.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", pszSpec="*.mxf") returned 0 [0058.867] lstrlenA (lpString="*.mxf") returned 5 [0058.867] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7146200, ftCreationTime.dwHighDateTime=0x1cab7cc, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7146200, ftLastWriteTime.dwHighDateTime=0x1cab7cc, nFileSizeHigh=0x0, nFileSizeLow=0x10980, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.DLL.IDX_DLL", cAlternateFileName="PUB6IN~1.IDX")) returned 1 [0058.867] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.867] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PUB6INTL.DLL.IDX_DLL") returned -1 [0058.867] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PUB6INTL.DLL.IDX_DLL") returned -1 [0058.867] lstrcmpiA (lpString1="", lpString2="PUB6INTL.DLL.IDX_DLL") returned -1 [0058.867] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned="PUB6INTL.DLL" [0058.867] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.867] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.867] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.867] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.867] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PUB6INTL.DLL.IDX_DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL" [0058.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.zip") returned 0 [0058.868] lstrlenA (lpString="*.zip") returned 5 [0058.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.rar") returned 0 [0058.868] lstrlenA (lpString="*.rar") returned 5 [0058.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.7z") returned 0 [0058.868] lstrlenA (lpString="*.7z") returned 4 [0058.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.tar") returned 0 [0058.868] lstrlenA (lpString="*.tar") returned 5 [0058.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.gzip") returned 0 [0058.868] lstrlenA (lpString="*.gzip") returned 6 [0058.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.jpg") returned 0 [0058.868] lstrlenA (lpString="*.jpg") returned 5 [0058.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.jpeg") returned 0 [0058.868] lstrlenA (lpString="*.jpeg") returned 6 [0058.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.psd") returned 0 [0058.868] lstrlenA (lpString="*.psd") returned 5 [0058.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.gif") returned 0 [0058.868] lstrlenA (lpString="*.gif") returned 5 [0058.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.doc") returned 0 [0058.868] lstrlenA (lpString="*.doc") returned 5 [0058.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.docx") returned 0 [0058.868] lstrlenA (lpString="*.docx") returned 6 [0058.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.xls") returned 0 [0058.868] lstrlenA (lpString="*.xls") returned 5 [0058.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.xlsx") returned 0 [0058.868] lstrlenA (lpString="*.xlsx") returned 6 [0058.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.ppt") returned 0 [0058.868] lstrlenA (lpString="*.ppt") returned 5 [0058.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.pptx") returned 0 [0058.868] lstrlenA (lpString="*.pptx") returned 6 [0058.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.pdf") returned 0 [0058.868] lstrlenA (lpString="*.pdf") returned 5 [0058.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.mov") returned 0 [0058.868] lstrlenA (lpString="*.mov") returned 5 [0058.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.m2v") returned 0 [0058.869] lstrlenA (lpString="*.m2v") returned 5 [0058.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.3gp") returned 0 [0058.869] lstrlenA (lpString="*.3gp") returned 5 [0058.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.mpeg") returned 0 [0058.869] lstrlenA (lpString="*.mpeg") returned 6 [0058.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.mpg") returned 0 [0058.869] lstrlenA (lpString="*.mpg") returned 5 [0058.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.flv") returned 0 [0058.869] lstrlenA (lpString="*.flv") returned 5 [0058.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.avi") returned 0 [0058.869] lstrlenA (lpString="*.avi") returned 5 [0058.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.mp4") returned 0 [0058.869] lstrlenA (lpString="*.mp4") returned 5 [0058.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.wmv") returned 0 [0058.869] lstrlenA (lpString="*.wmv") returned 5 [0058.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.divx") returned 0 [0058.869] lstrlenA (lpString="*.divx") returned 6 [0058.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.mkv") returned 0 [0058.869] lstrlenA (lpString="*.mkv") returned 5 [0058.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.mp3") returned 0 [0058.869] lstrlenA (lpString="*.mp3") returned 5 [0058.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.wav") returned 0 [0058.869] lstrlenA (lpString="*.wav") returned 5 [0058.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.flac") returned 0 [0058.869] lstrlenA (lpString="*.flac") returned 6 [0058.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.ape") returned 0 [0058.869] lstrlenA (lpString="*.ape") returned 5 [0058.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.wma") returned 0 [0058.869] lstrlenA (lpString="*.wma") returned 5 [0058.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.ac3") returned 0 [0058.869] lstrlenA (lpString="*.ac3") returned 5 [0058.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", pszSpec="*.mxf") returned 0 [0058.870] lstrlenA (lpString="*.mxf") returned 5 [0058.870] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7146200, ftCreationTime.dwHighDateTime=0x1cab7cc, ftLastAccessTime.dwLowDateTime=0x1bbcb690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7146200, ftLastWriteTime.dwHighDateTime=0x1cab7cc, nFileSizeHigh=0x0, nFileSizeLow=0x41b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.REST.IDX_DLL", cAlternateFileName="PUB6IN~2.IDX")) returned 1 [0058.870] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.870] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PUB6INTL.REST.IDX_DLL") returned -1 [0058.870] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PUB6INTL.REST.IDX_DLL") returned -1 [0058.870] lstrcmpiA (lpString1="", lpString2="PUB6INTL.REST.IDX_DLL") returned -1 [0058.870] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned="PUB6INTL.DLL.IDX_DLL" [0058.870] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.870] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.870] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.870] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.870] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PUB6INTL.REST.IDX_DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" [0058.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL", pszSpec="*.zip") returned 0 [0058.870] lstrlenA (lpString="*.zip") returned 5 [0058.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL", pszSpec="*.rar") returned 0 [0058.870] lstrlenA (lpString="*.rar") returned 5 [0058.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL", pszSpec="*.7z") returned 0 [0058.870] lstrlenA (lpString="*.7z") returned 4 [0058.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL", pszSpec="*.tar") returned 0 [0058.870] lstrlenA (lpString="*.tar") returned 5 [0058.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL", pszSpec="*.gzip") returned 0 [0058.870] lstrlenA (lpString="*.gzip") returned 6 [0058.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL", pszSpec="*.jpg") returned 0 [0058.870] lstrlenA (lpString="*.jpg") returned 5 [0058.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL", pszSpec="*.jpeg") returned 0 [0058.870] lstrlenA (lpString="*.jpeg") returned 6 [0058.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL", pszSpec="*.psd") returned 0 [0058.871] lstrlenA (lpString="*.psd") returned 5 [0058.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL", pszSpec="*.gif") returned 0 [0058.871] lstrlenA (lpString="*.gif") returned 5 [0058.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL", pszSpec="*.doc") returned 0 [0058.871] lstrlenA (lpString="*.doc") returned 5 [0058.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL", pszSpec="*.docx") returned 0 [0058.871] lstrlenA (lpString="*.docx") returned 6 [0058.871] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf925f00, ftCreationTime.dwHighDateTime=0x1c92dac, ftLastAccessTime.dwLowDateTime=0x1bbcb690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf925f00, ftLastWriteTime.dwHighDateTime=0x1c92dac, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBCOLOR.SCM", cAlternateFileName="")) returned 1 [0058.871] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0058.871] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PUBCOLOR.SCM") returned -1 [0058.871] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PUBCOLOR.SCM") returned -1 [0058.871] lstrcmpiA (lpString1="", lpString2="PUBCOLOR.SCM") returned -1 [0058.871] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned="PUB6INTL.REST.IDX_DLL" [0058.871] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0058.871] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0058.871] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0058.871] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0058.871] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PUBCOLOR.SCM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" [0058.871] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba28770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBFTSCM", cAlternateFileName="")) returned 1 [0058.872] lstrcmpA (lpString1=".", lpString2="PUBFTSCM") returned -1 [0058.872] lstrcmpA (lpString1="..", lpString2="PUBFTSCM") returned -1 [0058.872] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned="PUBCOLOR.SCM" [0058.872] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PUBFTSCM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM" [0058.872] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba28770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d8138, cFileName=".", cAlternateFileName="")) returned 0x2d7ff8 [0058.874] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.874] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba28770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0058.875] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.875] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.875] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c22e700, ftCreationTime.dwHighDateTime=0x1ca6669, ftLastAccessTime.dwLowDateTime=0x1ba28770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c22e700, ftLastWriteTime.dwHighDateTime=0x1ca6669, nFileSizeHigh=0x0, nFileSizeLow=0xcb7, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="FONTSCHM.INI", cAlternateFileName="")) returned 1 [0058.875] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.875] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FONTSCHM.INI") returned -1 [0058.875] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FONTSCHM.INI") returned 1 [0058.875] lstrcmpiA (lpString1="", lpString2="FONTSCHM.INI") returned -1 [0058.875] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\*.*") returned="*.*" [0058.875] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.875] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.875] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.875] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0xffffffff [0058.875] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.878] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.878] CloseHandle (hObject=0x90) returned 1 [0058.878] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="FONTSCHM.INI" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\FONTSCHM.INI") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\FONTSCHM.INI" [0058.879] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47994900, ftCreationTime.dwHighDateTime=0x1ca1577, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47994900, ftLastWriteTime.dwHighDateTime=0x1ca1577, nFileSizeHigh=0x0, nFileSizeLow=0x1eea6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME01.CSS", cAlternateFileName="")) returned 1 [0058.879] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.879] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME01.CSS") returned -1 [0058.879] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME01.CSS") returned -1 [0058.879] lstrcmpiA (lpString1="", lpString2="SCHEME01.CSS") returned -1 [0058.879] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\FONTSCHM.INI") returned="FONTSCHM.INI" [0058.879] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.879] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.879] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.879] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.879] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME01.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME01.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME01.CSS" [0058.879] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b96a700, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b96a700, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1fbbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME02.CSS", cAlternateFileName="")) returned 1 [0058.879] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.879] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME02.CSS") returned -1 [0058.879] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME02.CSS") returned -1 [0058.879] lstrcmpiA (lpString1="", lpString2="SCHEME02.CSS") returned -1 [0058.879] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME01.CSS") returned="SCHEME01.CSS" [0058.879] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.879] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.879] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.879] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.879] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME02.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME02.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME02.CSS" [0058.879] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a657a00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a657a00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1f024, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME03.CSS", cAlternateFileName="")) returned 1 [0058.879] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.879] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME03.CSS") returned -1 [0058.880] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME03.CSS") returned -1 [0058.880] lstrcmpiA (lpString1="", lpString2="SCHEME03.CSS") returned -1 [0058.880] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME02.CSS") returned="SCHEME02.CSS" [0058.880] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.880] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.880] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.880] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.880] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME03.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME03.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME03.CSS" [0058.880] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29344d00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29344d00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1f4e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME04.CSS", cAlternateFileName="")) returned 1 [0058.880] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.880] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME04.CSS") returned -1 [0058.880] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME04.CSS") returned -1 [0058.880] lstrcmpiA (lpString1="", lpString2="SCHEME04.CSS") returned -1 [0058.880] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME03.CSS") returned="SCHEME03.CSS" [0058.880] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.880] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.880] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.880] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.880] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME04.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME04.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME04.CSS" [0058.880] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28032000, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28032000, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1edba, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME05.CSS", cAlternateFileName="")) returned 1 [0058.880] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.880] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME05.CSS") returned -1 [0058.880] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME05.CSS") returned -1 [0058.880] lstrcmpiA (lpString1="", lpString2="SCHEME05.CSS") returned -1 [0058.880] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME04.CSS") returned="SCHEME04.CSS" [0058.880] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.881] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.881] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.881] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.881] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME05.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME05.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME05.CSS" [0058.881] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28032000, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28032000, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1f2da, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME06.CSS", cAlternateFileName="")) returned 1 [0058.881] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.881] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME06.CSS") returned -1 [0058.881] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME06.CSS") returned -1 [0058.881] lstrcmpiA (lpString1="", lpString2="SCHEME06.CSS") returned -1 [0058.881] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME05.CSS") returned="SCHEME05.CSS" [0058.881] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.881] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.881] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.881] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.881] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME06.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME06.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME06.CSS" [0058.881] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26d1f300, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26d1f300, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1ff56, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME07.CSS", cAlternateFileName="")) returned 1 [0058.881] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.881] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME07.CSS") returned -1 [0058.881] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME07.CSS") returned -1 [0058.881] lstrcmpiA (lpString1="", lpString2="SCHEME07.CSS") returned -1 [0058.881] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME06.CSS") returned="SCHEME06.CSS" [0058.881] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.881] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.881] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.881] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.882] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME07.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME07.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME07.CSS" [0058.882] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25a0c600, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25a0c600, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1f998, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME08.CSS", cAlternateFileName="")) returned 1 [0058.882] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.882] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME08.CSS") returned -1 [0058.882] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME08.CSS") returned -1 [0058.882] lstrcmpiA (lpString1="", lpString2="SCHEME08.CSS") returned -1 [0058.882] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME07.CSS") returned="SCHEME07.CSS" [0058.882] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.882] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.882] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.882] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.882] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME08.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME08.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME08.CSS" [0058.882] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25a0c600, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25a0c600, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x20444, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME09.CSS", cAlternateFileName="")) returned 1 [0058.882] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.882] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME09.CSS") returned -1 [0058.882] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME09.CSS") returned -1 [0058.882] lstrcmpiA (lpString1="", lpString2="SCHEME09.CSS") returned -1 [0058.882] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME08.CSS") returned="SCHEME08.CSS" [0058.882] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.882] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.882] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.882] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.882] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME09.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME09.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME09.CSS" [0058.882] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x233e6c00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x233e6c00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x2072a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME10.CSS", cAlternateFileName="")) returned 1 [0058.882] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.883] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME10.CSS") returned -1 [0058.883] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME10.CSS") returned -1 [0058.883] lstrcmpiA (lpString1="", lpString2="SCHEME10.CSS") returned -1 [0058.883] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME09.CSS") returned="SCHEME09.CSS" [0058.883] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.883] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.883] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.883] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.883] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME10.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME10.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME10.CSS" [0058.883] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x220d3f00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x220d3f00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x20030, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME11.CSS", cAlternateFileName="")) returned 1 [0058.883] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.883] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME11.CSS") returned -1 [0058.883] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME11.CSS") returned -1 [0058.883] lstrcmpiA (lpString1="", lpString2="SCHEME11.CSS") returned -1 [0058.883] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME10.CSS") returned="SCHEME10.CSS" [0058.883] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.883] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.883] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.883] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.883] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME11.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME11.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME11.CSS" [0058.883] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20dc1200, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20dc1200, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1e09a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME12.CSS", cAlternateFileName="")) returned 1 [0058.883] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.883] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME12.CSS") returned -1 [0058.883] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME12.CSS") returned -1 [0058.883] lstrcmpiA (lpString1="", lpString2="SCHEME12.CSS") returned -1 [0058.883] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME11.CSS") returned="SCHEME11.CSS" [0058.884] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.884] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.884] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.884] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.884] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME12.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME12.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME12.CSS" [0058.884] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1faae500, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1faae500, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1ec9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME13.CSS", cAlternateFileName="")) returned 1 [0058.884] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.884] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME13.CSS") returned -1 [0058.884] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME13.CSS") returned -1 [0058.884] lstrcmpiA (lpString1="", lpString2="SCHEME13.CSS") returned -1 [0058.884] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME12.CSS") returned="SCHEME12.CSS" [0058.884] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.884] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.884] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.884] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.884] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME13.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME13.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME13.CSS" [0058.884] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1faae500, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1faae500, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1f5cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME14.CSS", cAlternateFileName="")) returned 1 [0058.884] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.884] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME14.CSS") returned -1 [0058.884] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME14.CSS") returned -1 [0058.884] lstrcmpiA (lpString1="", lpString2="SCHEME14.CSS") returned -1 [0058.885] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME13.CSS") returned="SCHEME13.CSS" [0058.885] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.885] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.885] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.885] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.885] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME14.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME14.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME14.CSS" [0058.885] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e79b800, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e79b800, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1e094, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME15.CSS", cAlternateFileName="")) returned 1 [0058.885] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.885] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME15.CSS") returned -1 [0058.885] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME15.CSS") returned -1 [0058.885] lstrcmpiA (lpString1="", lpString2="SCHEME15.CSS") returned -1 [0058.885] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME14.CSS") returned="SCHEME14.CSS" [0058.885] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.885] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.885] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.885] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.885] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME15.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME15.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME15.CSS" [0058.885] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d488b00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d488b00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1f822, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME16.CSS", cAlternateFileName="")) returned 1 [0058.885] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.885] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME16.CSS") returned -1 [0058.885] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME16.CSS") returned -1 [0058.885] lstrcmpiA (lpString1="", lpString2="SCHEME16.CSS") returned -1 [0058.886] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME15.CSS") returned="SCHEME15.CSS" [0058.886] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.886] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.886] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.886] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.886] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME16.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME16.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME16.CSS" [0058.886] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c175e00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c175e00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1eada, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME17.CSS", cAlternateFileName="")) returned 1 [0058.886] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.886] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME17.CSS") returned -1 [0058.886] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME17.CSS") returned -1 [0058.886] lstrcmpiA (lpString1="", lpString2="SCHEME17.CSS") returned -1 [0058.886] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME16.CSS") returned="SCHEME16.CSS" [0058.886] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.886] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.886] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.886] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.886] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME17.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME17.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME17.CSS" [0058.886] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ae63100, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ae63100, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x20438, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME18.CSS", cAlternateFileName="")) returned 1 [0058.886] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.886] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME18.CSS") returned -1 [0058.886] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME18.CSS") returned -1 [0058.886] lstrcmpiA (lpString1="", lpString2="SCHEME18.CSS") returned -1 [0058.886] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME17.CSS") returned="SCHEME17.CSS" [0058.886] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.886] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.886] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.887] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.887] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME18.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME18.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME18.CSS" [0058.887] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19b50400, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b50400, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1fff2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME19.CSS", cAlternateFileName="")) returned 1 [0058.887] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.887] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME19.CSS") returned -1 [0058.887] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME19.CSS") returned -1 [0058.887] lstrcmpiA (lpString1="", lpString2="SCHEME19.CSS") returned -1 [0058.887] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME18.CSS") returned="SCHEME18.CSS" [0058.887] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.887] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.887] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.887] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.887] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME19.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME19.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME19.CSS" [0058.887] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1883d700, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1883d700, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1f6f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME20.CSS", cAlternateFileName="")) returned 1 [0058.887] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.887] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME20.CSS") returned -1 [0058.887] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME20.CSS") returned -1 [0058.887] lstrcmpiA (lpString1="", lpString2="SCHEME20.CSS") returned -1 [0058.887] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME19.CSS") returned="SCHEME19.CSS" [0058.887] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.887] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.887] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.887] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.887] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME20.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME20.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME20.CSS" [0058.888] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1752aa00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1752aa00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1eae6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME21.CSS", cAlternateFileName="")) returned 1 [0058.888] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.888] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME21.CSS") returned -1 [0058.888] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME21.CSS") returned -1 [0058.888] lstrcmpiA (lpString1="", lpString2="SCHEME21.CSS") returned -1 [0058.888] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME20.CSS") returned="SCHEME20.CSS" [0058.888] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.888] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.888] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.888] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.888] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME21.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME21.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME21.CSS" [0058.888] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f05000, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14f05000, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1fcca, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME22.CSS", cAlternateFileName="")) returned 1 [0058.888] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.888] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME22.CSS") returned -1 [0058.888] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME22.CSS") returned -1 [0058.888] lstrcmpiA (lpString1="", lpString2="SCHEME22.CSS") returned -1 [0058.888] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME21.CSS") returned="SCHEME21.CSS" [0058.888] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.888] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.888] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.888] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.888] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME22.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME22.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME22.CSS" [0058.888] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13bf2300, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x13bf2300, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1f5fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME23.CSS", cAlternateFileName="")) returned 1 [0058.888] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.888] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME23.CSS") returned -1 [0058.888] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME23.CSS") returned -1 [0058.888] lstrcmpiA (lpString1="", lpString2="SCHEME23.CSS") returned -1 [0058.888] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME22.CSS") returned="SCHEME22.CSS" [0058.889] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.889] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.889] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.889] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.889] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME23.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME23.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME23.CSS" [0058.889] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128df600, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x128df600, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1ee38, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME24.CSS", cAlternateFileName="")) returned 1 [0058.889] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.889] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME24.CSS") returned -1 [0058.889] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME24.CSS") returned -1 [0058.889] lstrcmpiA (lpString1="", lpString2="SCHEME24.CSS") returned -1 [0058.889] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME23.CSS") returned="SCHEME23.CSS" [0058.889] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.889] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.889] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.889] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.889] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME24.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME24.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME24.CSS" [0058.889] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x115cc900, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x115cc900, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1fcee, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME25.CSS", cAlternateFileName="")) returned 1 [0058.889] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.889] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME25.CSS") returned -1 [0058.889] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME25.CSS") returned -1 [0058.889] lstrcmpiA (lpString1="", lpString2="SCHEME25.CSS") returned -1 [0058.889] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME24.CSS") returned="SCHEME24.CSS" [0058.889] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.889] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.889] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.889] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.890] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME25.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME25.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME25.CSS" [0058.890] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x115cc900, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x115cc900, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1d1b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME26.CSS", cAlternateFileName="")) returned 1 [0058.890] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.890] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME26.CSS") returned -1 [0058.890] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME26.CSS") returned -1 [0058.890] lstrcmpiA (lpString1="", lpString2="SCHEME26.CSS") returned -1 [0058.890] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME25.CSS") returned="SCHEME25.CSS" [0058.890] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.890] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.890] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.890] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.890] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME26.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME26.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME26.CSS" [0058.890] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefa6f00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefa6f00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1e088, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME27.CSS", cAlternateFileName="")) returned 1 [0058.890] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.890] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME27.CSS") returned -1 [0058.890] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME27.CSS") returned -1 [0058.890] lstrcmpiA (lpString1="", lpString2="SCHEME27.CSS") returned -1 [0058.890] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME26.CSS") returned="SCHEME26.CSS" [0058.890] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.890] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.890] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.890] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.890] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME27.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME27.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME27.CSS" [0058.891] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefa6f00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefa6f00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1d754, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME28.CSS", cAlternateFileName="")) returned 1 [0058.891] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.891] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME28.CSS") returned -1 [0058.891] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME28.CSS") returned -1 [0058.891] lstrcmpiA (lpString1="", lpString2="SCHEME28.CSS") returned -1 [0058.891] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME27.CSS") returned="SCHEME27.CSS" [0058.891] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.891] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.891] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.891] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.891] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME28.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME28.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME28.CSS" [0058.891] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb66e800, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb66e800, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1eb4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME29.CSS", cAlternateFileName="")) returned 1 [0058.891] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.891] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME29.CSS") returned -1 [0058.891] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME29.CSS") returned -1 [0058.891] lstrcmpiA (lpString1="", lpString2="SCHEME29.CSS") returned -1 [0058.891] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME28.CSS") returned="SCHEME28.CSS" [0058.891] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.891] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.891] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.891] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.891] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME29.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME29.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME29.CSS" [0058.892] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa35bb00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa35bb00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1d522, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME30.CSS", cAlternateFileName="")) returned 1 [0058.892] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.892] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME30.CSS") returned -1 [0058.892] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME30.CSS") returned -1 [0058.892] lstrcmpiA (lpString1="", lpString2="SCHEME30.CSS") returned -1 [0058.892] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME29.CSS") returned="SCHEME29.CSS" [0058.892] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.892] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.892] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.892] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.892] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME30.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME30.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME30.CSS" [0058.892] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff7b2600, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff7b2600, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1d652, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME31.CSS", cAlternateFileName="")) returned 1 [0058.892] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.892] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME31.CSS") returned -1 [0058.892] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME31.CSS") returned -1 [0058.892] lstrcmpiA (lpString1="", lpString2="SCHEME31.CSS") returned -1 [0058.892] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME30.CSS") returned="SCHEME30.CSS" [0058.892] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.892] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.892] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.892] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.892] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME31.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME31.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME31.CSS" [0058.892] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43fda00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43fda00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1eb20, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME32.CSS", cAlternateFileName="")) returned 1 [0058.892] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.892] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME32.CSS") returned -1 [0058.892] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME32.CSS") returned -1 [0058.893] lstrcmpiA (lpString1="", lpString2="SCHEME32.CSS") returned -1 [0058.893] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME31.CSS") returned="SCHEME31.CSS" [0058.893] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.893] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.893] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.893] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.893] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME32.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME32.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME32.CSS" [0058.893] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8755100, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8755100, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1dcb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME33.CSS", cAlternateFileName="")) returned 1 [0058.894] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.894] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME33.CSS") returned -1 [0058.894] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME33.CSS") returned -1 [0058.894] lstrcmpiA (lpString1="", lpString2="SCHEME33.CSS") returned -1 [0058.894] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME32.CSS") returned="SCHEME32.CSS" [0058.894] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.894] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.894] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" [0058.894] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\how to decrypt files.txt")) returned 0x20 [0058.895] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", lpString2="SCHEME33.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME33.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME33.CSS" [0058.895] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9eebe900, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9eebe900, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1d124, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME34.CSS", cAlternateFileName="")) returned 1 [0058.895] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.895] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME34.CSS") returned -1 [0058.895] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME34.CSS") returned -1 [0058.895] lstrcmpiA (lpString1="", lpString2="SCHEME34.CSS") returned -1 [0058.895] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME33.CSS") returned="SCHEME33.CSS" [0058.895] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.895] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.896] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ce4c100, ftCreationTime.dwHighDateTime=0x1c69a52, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ce4c100, ftLastWriteTime.dwHighDateTime=0x1c69a52, nFileSizeHigh=0x0, nFileSizeLow=0x202f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME35.CSS", cAlternateFileName="")) returned 1 [0058.896] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.896] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME35.CSS") returned -1 [0058.896] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME35.CSS") returned -1 [0058.896] lstrcmpiA (lpString1="", lpString2="SCHEME35.CSS") returned -1 [0058.896] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME34.CSS") returned="SCHEME34.CSS" [0058.896] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.896] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.896] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94315400, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94315400, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1e12c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME36.CSS", cAlternateFileName="")) returned 1 [0058.896] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.896] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME36.CSS") returned -1 [0058.896] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME36.CSS") returned -1 [0058.896] lstrcmpiA (lpString1="", lpString2="SCHEME36.CSS") returned -1 [0058.896] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME35.CSS") returned="SCHEME35.CSS" [0058.896] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.896] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.896] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ad35f00, ftCreationTime.dwHighDateTime=0x1c69a52, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ad35f00, ftLastWriteTime.dwHighDateTime=0x1c69a52, nFileSizeHigh=0x0, nFileSizeLow=0x205bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME37.CSS", cAlternateFileName="")) returned 1 [0058.896] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.896] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME37.CSS") returned -1 [0058.896] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME37.CSS") returned -1 [0058.896] lstrcmpiA (lpString1="", lpString2="SCHEME37.CSS") returned -1 [0058.897] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME36.CSS") returned="SCHEME36.CSS" [0058.897] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.897] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.897] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8380de00, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8380de00, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1f07c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME38.CSS", cAlternateFileName="")) returned 1 [0058.897] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.897] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME38.CSS") returned -1 [0058.897] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME38.CSS") returned -1 [0058.897] lstrcmpiA (lpString1="", lpString2="SCHEME38.CSS") returned -1 [0058.897] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME37.CSS") returned="SCHEME37.CSS" [0058.897] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.897] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.897] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7532c200, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7532c200, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1e44c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME39.CSS", cAlternateFileName="")) returned 1 [0058.897] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.897] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME39.CSS") returned -1 [0058.897] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME39.CSS") returned -1 [0058.897] lstrcmpiA (lpString1="", lpString2="SCHEME39.CSS") returned -1 [0058.897] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME38.CSS") returned="SCHEME38.CSS" [0058.897] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.897] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.897] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cda8700, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cda8700, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1eb4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME40.CSS", cAlternateFileName="")) returned 1 [0058.897] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.897] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME40.CSS") returned -1 [0058.897] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME40.CSS") returned -1 [0058.897] lstrcmpiA (lpString1="", lpString2="SCHEME40.CSS") returned -1 [0058.897] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME39.CSS") returned="SCHEME39.CSS" [0058.897] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.897] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.897] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x621ff200, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x621ff200, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1e958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME41.CSS", cAlternateFileName="")) returned 1 [0058.898] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.898] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME41.CSS") returned -1 [0058.898] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME41.CSS") returned -1 [0058.898] lstrcmpiA (lpString1="", lpString2="SCHEME41.CSS") returned -1 [0058.898] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME40.CSS") returned="SCHEME40.CSS" [0058.898] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.898] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.898] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56343000, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56343000, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1d920, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME42.CSS", cAlternateFileName="")) returned 1 [0058.898] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.898] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME42.CSS") returned -1 [0058.898] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME42.CSS") returned -1 [0058.898] lstrcmpiA (lpString1="", lpString2="SCHEME42.CSS") returned -1 [0058.898] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME41.CSS") returned="SCHEME41.CSS" [0058.898] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.898] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.898] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47e61400, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47e61400, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1e714, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME43.CSS", cAlternateFileName="")) returned 1 [0058.898] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.898] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME43.CSS") returned -1 [0058.898] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME43.CSS") returned -1 [0058.898] lstrcmpiA (lpString1="", lpString2="SCHEME43.CSS") returned -1 [0058.898] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME42.CSS") returned="SCHEME42.CSS" [0058.898] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.898] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.898] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37359e00, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37359e00, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1ecfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME44.CSS", cAlternateFileName="")) returned 1 [0058.899] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.899] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME44.CSS") returned -1 [0058.899] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME44.CSS") returned -1 [0058.899] lstrcmpiA (lpString1="", lpString2="SCHEME44.CSS") returned -1 [0058.899] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME43.CSS") returned="SCHEME43.CSS" [0058.899] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.899] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.899] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c7b0900, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c7b0900, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1e6a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME45.CSS", cAlternateFileName="")) returned 1 [0058.899] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.899] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME45.CSS") returned -1 [0058.899] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME45.CSS") returned -1 [0058.899] lstrcmpiA (lpString1="", lpString2="SCHEME45.CSS") returned -1 [0058.899] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME44.CSS") returned="SCHEME44.CSS" [0058.899] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.899] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.899] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cfbc000, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cfbc000, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1fdb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME46.CSS", cAlternateFileName="")) returned 1 [0058.899] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.899] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME46.CSS") returned -1 [0058.899] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME46.CSS") returned -1 [0058.899] lstrcmpiA (lpString1="", lpString2="SCHEME46.CSS") returned -1 [0058.899] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME45.CSS") returned="SCHEME45.CSS" [0058.899] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.899] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.899] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a38500, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a38500, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1f190, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME47.CSS", cAlternateFileName="")) returned 1 [0058.899] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.900] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME47.CSS") returned -1 [0058.900] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME47.CSS") returned -1 [0058.900] lstrcmpiA (lpString1="", lpString2="SCHEME47.CSS") returned -1 [0058.900] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME46.CSS") returned="SCHEME46.CSS" [0058.900] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.900] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.900] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7869600, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7869600, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1f984, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME48.CSS", cAlternateFileName="")) returned 1 [0058.900] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.900] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME48.CSS") returned -1 [0058.900] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME48.CSS") returned -1 [0058.900] lstrcmpiA (lpString1="", lpString2="SCHEME48.CSS") returned -1 [0058.900] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME47.CSS") returned="SCHEME47.CSS" [0058.900] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.900] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.900] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa69a700, ftCreationTime.dwHighDateTime=0x1ca1577, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa69a700, ftLastWriteTime.dwHighDateTime=0x1ca1577, nFileSizeHigh=0x0, nFileSizeLow=0x1da6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME49.CSS", cAlternateFileName="")) returned 1 [0058.900] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.900] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME49.CSS") returned -1 [0058.900] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME49.CSS") returned -1 [0058.900] lstrcmpiA (lpString1="", lpString2="SCHEME49.CSS") returned -1 [0058.900] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME48.CSS") returned="SCHEME48.CSS" [0058.900] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.900] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.900] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e03f00, ftCreationTime.dwHighDateTime=0x1ca1577, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0e03f00, ftLastWriteTime.dwHighDateTime=0x1ca1577, nFileSizeHigh=0x0, nFileSizeLow=0x1f018, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME50.CSS", cAlternateFileName="")) returned 1 [0058.900] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.900] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME50.CSS") returned -1 [0058.901] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME50.CSS") returned -1 [0058.901] lstrcmpiA (lpString1="", lpString2="SCHEME50.CSS") returned -1 [0058.901] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME49.CSS") returned="SCHEME49.CSS" [0058.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.901] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.901] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1922be00, ftCreationTime.dwHighDateTime=0x1c69a7b, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1922be00, ftLastWriteTime.dwHighDateTime=0x1c69a7b, nFileSizeHigh=0x0, nFileSizeLow=0x1df68, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME51.CSS", cAlternateFileName="")) returned 1 [0058.901] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.901] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME51.CSS") returned -1 [0058.901] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME51.CSS") returned -1 [0058.901] lstrcmpiA (lpString1="", lpString2="SCHEME51.CSS") returned -1 [0058.901] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME50.CSS") returned="SCHEME50.CSS" [0058.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.901] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.901] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1ce8a00, ftCreationTime.dwHighDateTime=0x1c69651, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1ce8a00, ftLastWriteTime.dwHighDateTime=0x1c69651, nFileSizeHigh=0x0, nFileSizeLow=0x1e254, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME52.CSS", cAlternateFileName="")) returned 1 [0058.901] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.901] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME52.CSS") returned -1 [0058.901] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME52.CSS") returned -1 [0058.901] lstrcmpiA (lpString1="", lpString2="SCHEME52.CSS") returned -1 [0058.901] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME51.CSS") returned="SCHEME51.CSS" [0058.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.901] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.901] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74d95100, ftCreationTime.dwHighDateTime=0x1c69a53, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74d95100, ftLastWriteTime.dwHighDateTime=0x1c69a53, nFileSizeHigh=0x0, nFileSizeLow=0x1e6a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME53.CSS", cAlternateFileName="")) returned 1 [0058.901] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.901] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME53.CSS") returned -1 [0058.902] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME53.CSS") returned -1 [0058.902] lstrcmpiA (lpString1="", lpString2="SCHEME53.CSS") returned -1 [0058.902] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME52.CSS") returned="SCHEME52.CSS" [0058.902] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.902] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.902] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c1eb00, ftCreationTime.dwHighDateTime=0x1c69597, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67c1eb00, ftLastWriteTime.dwHighDateTime=0x1c69597, nFileSizeHigh=0x0, nFileSizeLow=0x1f064, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME54.CSS", cAlternateFileName="")) returned 1 [0058.902] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.902] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME54.CSS") returned -1 [0058.902] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME54.CSS") returned -1 [0058.902] lstrcmpiA (lpString1="", lpString2="SCHEME54.CSS") returned -1 [0058.902] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME53.CSS") returned="SCHEME53.CSS" [0058.902] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.915] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.915] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f2a2e00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f2a2e00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1e114, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME55.CSS", cAlternateFileName="")) returned 1 [0058.915] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.915] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SCHEME55.CSS") returned -1 [0058.916] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SCHEME55.CSS") returned -1 [0058.916] lstrcmpiA (lpString1="", lpString2="SCHEME55.CSS") returned -1 [0058.916] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME54.CSS") returned="SCHEME54.CSS" [0058.916] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" [0058.916] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned="" [0058.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.zip") returned 0 [0058.918] lstrlenA (lpString="*.zip") returned 5 [0058.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.rar") returned 0 [0058.918] lstrlenA (lpString="*.rar") returned 5 [0058.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.7z") returned 0 [0058.918] lstrlenA (lpString="*.7z") returned 4 [0058.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.tar") returned 0 [0058.918] lstrlenA (lpString="*.tar") returned 5 [0058.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.gzip") returned 0 [0058.918] lstrlenA (lpString="*.gzip") returned 6 [0058.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.jpg") returned 0 [0058.918] lstrlenA (lpString="*.jpg") returned 5 [0058.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.jpeg") returned 0 [0058.918] lstrlenA (lpString="*.jpeg") returned 6 [0058.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.psd") returned 0 [0058.918] lstrlenA (lpString="*.psd") returned 5 [0058.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.gif") returned 0 [0058.918] lstrlenA (lpString="*.gif") returned 5 [0058.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.doc") returned 0 [0058.918] lstrlenA (lpString="*.doc") returned 5 [0058.918] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.docx") returned 0 [0058.918] lstrlenA (lpString="*.docx") returned 6 [0058.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.xls") returned 0 [0058.919] lstrlenA (lpString="*.xls") returned 5 [0058.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.xlsx") returned 0 [0058.919] lstrlenA (lpString="*.xlsx") returned 6 [0058.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.ppt") returned 0 [0058.919] lstrlenA (lpString="*.ppt") returned 5 [0058.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.pptx") returned 0 [0058.919] lstrlenA (lpString="*.pptx") returned 6 [0058.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.pdf") returned 0 [0058.919] lstrlenA (lpString="*.pdf") returned 5 [0058.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.mov") returned 0 [0058.919] lstrlenA (lpString="*.mov") returned 5 [0058.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.m2v") returned 0 [0058.919] lstrlenA (lpString="*.m2v") returned 5 [0058.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.3gp") returned 0 [0058.919] lstrlenA (lpString="*.3gp") returned 5 [0058.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.mpeg") returned 0 [0058.919] lstrlenA (lpString="*.mpeg") returned 6 [0058.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.mpg") returned 0 [0058.919] lstrlenA (lpString="*.mpg") returned 5 [0058.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.flv") returned 0 [0058.919] lstrlenA (lpString="*.flv") returned 5 [0058.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.avi") returned 0 [0058.919] lstrlenA (lpString="*.avi") returned 5 [0058.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.mp4") returned 0 [0058.919] lstrlenA (lpString="*.mp4") returned 5 [0058.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.wmv") returned 0 [0058.919] lstrlenA (lpString="*.wmv") returned 5 [0058.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.divx") returned 0 [0058.920] lstrlenA (lpString="*.divx") returned 6 [0058.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.mkv") returned 0 [0058.920] lstrlenA (lpString="*.mkv") returned 5 [0058.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.mp3") returned 0 [0058.920] lstrlenA (lpString="*.mp3") returned 5 [0058.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.wav") returned 0 [0058.920] lstrlenA (lpString="*.wav") returned 5 [0058.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.flac") returned 0 [0058.920] lstrlenA (lpString="*.flac") returned 6 [0058.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.ape") returned 0 [0058.920] lstrlenA (lpString="*.ape") returned 5 [0058.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.wma") returned 0 [0058.920] lstrlenA (lpString="*.wma") returned 5 [0058.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.ac3") returned 0 [0058.920] lstrlenA (lpString="*.ac3") returned 5 [0058.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", pszSpec="*.mxf") returned 0 [0058.920] lstrlenA (lpString="*.mxf") returned 5 [0058.920] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f2a2e00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f2a2e00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1e114, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME55.CSS", cAlternateFileName="")) returned 0 [0058.920] FindClose (in: hFindFile=0x2d7ff8 | out: hFindFile=0x2d7ff8) returned 1 [0058.920] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bde09d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="PUBSPAPR", cAlternateFileName="")) returned 1 [0058.920] lstrcmpA (lpString1=".", lpString2="PUBSPAPR") returned -1 [0058.920] lstrcmpA (lpString1="..", lpString2="PUBSPAPR") returned -1 [0058.920] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\*.*") returned="*.*" [0058.920] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR") returned 56 [0058.920] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bde09d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d7ff8 [0058.923] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0058.923] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bde09d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.924] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0058.924] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0058.924] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x182b, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PAPERS.INI", cAlternateFileName="")) returned 1 [0058.924] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.924] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PAPERS.INI") returned -1 [0058.924] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PAPERS.INI") returned -1 [0058.924] lstrcmpiA (lpString1="", lpString2="PAPERS.INI") returned -1 [0058.924] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\*.*") returned="*.*" [0058.924] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0058.924] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0058.924] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0xffffffff [0058.924] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.925] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0058.925] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0058.926] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0058.926] CloseHandle (hObject=0x90) returned 1 [0058.926] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PAPERS.INI" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI" [0058.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.zip") returned 0 [0058.926] lstrlenA (lpString="*.zip") returned 5 [0058.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.rar") returned 0 [0058.926] lstrlenA (lpString="*.rar") returned 5 [0058.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.7z") returned 0 [0058.926] lstrlenA (lpString="*.7z") returned 4 [0058.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.tar") returned 0 [0058.926] lstrlenA (lpString="*.tar") returned 5 [0058.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.gzip") returned 0 [0058.926] lstrlenA (lpString="*.gzip") returned 6 [0058.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.jpg") returned 0 [0058.926] lstrlenA (lpString="*.jpg") returned 5 [0058.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.jpeg") returned 0 [0058.926] lstrlenA (lpString="*.jpeg") returned 6 [0058.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.psd") returned 0 [0058.927] lstrlenA (lpString="*.psd") returned 5 [0058.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.gif") returned 0 [0058.927] lstrlenA (lpString="*.gif") returned 5 [0058.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.doc") returned 0 [0058.927] lstrlenA (lpString="*.doc") returned 5 [0058.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.docx") returned 0 [0058.927] lstrlenA (lpString="*.docx") returned 6 [0058.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.xls") returned 0 [0058.927] lstrlenA (lpString="*.xls") returned 5 [0058.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.xlsx") returned 0 [0058.927] lstrlenA (lpString="*.xlsx") returned 6 [0058.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.ppt") returned 0 [0058.927] lstrlenA (lpString="*.ppt") returned 5 [0058.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.pptx") returned 0 [0058.927] lstrlenA (lpString="*.pptx") returned 6 [0058.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.pdf") returned 0 [0058.927] lstrlenA (lpString="*.pdf") returned 5 [0058.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.mov") returned 0 [0058.927] lstrlenA (lpString="*.mov") returned 5 [0058.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.m2v") returned 0 [0058.927] lstrlenA (lpString="*.m2v") returned 5 [0058.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.3gp") returned 0 [0058.927] lstrlenA (lpString="*.3gp") returned 5 [0058.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.mpeg") returned 0 [0058.927] lstrlenA (lpString="*.mpeg") returned 6 [0058.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.mpg") returned 0 [0058.927] lstrlenA (lpString="*.mpg") returned 5 [0058.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.flv") returned 0 [0058.927] lstrlenA (lpString="*.flv") returned 5 [0058.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.avi") returned 0 [0058.928] lstrlenA (lpString="*.avi") returned 5 [0058.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.mp4") returned 0 [0058.928] lstrlenA (lpString="*.mp4") returned 5 [0058.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.wmv") returned 0 [0058.928] lstrlenA (lpString="*.wmv") returned 5 [0058.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.divx") returned 0 [0058.928] lstrlenA (lpString="*.divx") returned 6 [0058.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.mkv") returned 0 [0058.928] lstrlenA (lpString="*.mkv") returned 5 [0058.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.mp3") returned 0 [0058.928] lstrlenA (lpString="*.mp3") returned 5 [0058.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.wav") returned 0 [0058.928] lstrlenA (lpString="*.wav") returned 5 [0058.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.flac") returned 0 [0058.928] lstrlenA (lpString="*.flac") returned 6 [0058.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.ape") returned 0 [0058.928] lstrlenA (lpString="*.ape") returned 5 [0058.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.wma") returned 0 [0058.928] lstrlenA (lpString="*.wma") returned 5 [0058.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.ac3") returned 0 [0058.928] lstrlenA (lpString="*.ac3") returned 5 [0058.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", pszSpec="*.mxf") returned 0 [0058.928] lstrlenA (lpString="*.mxf") returned 5 [0058.928] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3bb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR10F.GIF", cAlternateFileName="")) returned 1 [0058.928] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.928] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR10F.GIF") returned -1 [0058.928] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR10F.GIF") returned -1 [0058.928] lstrcmpiA (lpString1="", lpString2="PDIR10F.GIF") returned -1 [0058.928] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI") returned="PAPERS.INI" [0058.928] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0058.928] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0058.928] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0058.928] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0058.929] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR10F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF" [0058.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF", pszSpec="*.zip") returned 0 [0058.929] lstrlenA (lpString="*.zip") returned 5 [0058.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF", pszSpec="*.rar") returned 0 [0058.929] lstrlenA (lpString="*.rar") returned 5 [0058.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF", pszSpec="*.7z") returned 0 [0058.929] lstrlenA (lpString="*.7z") returned 4 [0058.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF", pszSpec="*.tar") returned 0 [0058.929] lstrlenA (lpString="*.tar") returned 5 [0058.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF", pszSpec="*.gzip") returned 0 [0058.929] lstrlenA (lpString="*.gzip") returned 6 [0058.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF", pszSpec="*.jpg") returned 0 [0058.929] lstrlenA (lpString="*.jpg") returned 5 [0058.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF", pszSpec="*.jpeg") returned 0 [0058.929] lstrlenA (lpString="*.jpeg") returned 6 [0058.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF", pszSpec="*.psd") returned 0 [0058.929] lstrlenA (lpString="*.psd") returned 5 [0058.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF", pszSpec="*.gif") returned 1 [0058.929] lstrlenA (lpString="*.gif") returned 5 [0058.929] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF" [0058.929] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF" [0058.929] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF." [0058.929] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF.wannacry" [0058.929] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir10f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.930] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3bb5 [0058.930] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1ba9ab90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0058.931] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.931] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3b37, lpOverlapped=0x0) returned 1 [0058.933] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF") returned="PDIR10F.GIF" [0058.933] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.933] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3b37, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3b37, lpOverlapped=0x0) returned 1 [0058.933] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.933] CloseHandle (hObject=0x90) returned 1 [0058.933] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir10f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir10f.gif.wannacry")) returned 1 [0058.934] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x142f, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR11F.GIF", cAlternateFileName="")) returned 1 [0058.934] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.934] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR11F.GIF") returned -1 [0058.934] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR11F.GIF") returned -1 [0058.934] lstrcmpiA (lpString1="", lpString2="PDIR11F.GIF") returned -1 [0058.934] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF") returned="PDIR10F.GIF" [0058.934] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0058.934] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0058.935] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0058.935] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0058.935] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR11F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF" [0058.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF", pszSpec="*.zip") returned 0 [0058.935] lstrlenA (lpString="*.zip") returned 5 [0058.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF", pszSpec="*.rar") returned 0 [0058.935] lstrlenA (lpString="*.rar") returned 5 [0058.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF", pszSpec="*.7z") returned 0 [0058.935] lstrlenA (lpString="*.7z") returned 4 [0058.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF", pszSpec="*.tar") returned 0 [0058.935] lstrlenA (lpString="*.tar") returned 5 [0058.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF", pszSpec="*.gzip") returned 0 [0058.935] lstrlenA (lpString="*.gzip") returned 6 [0058.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF", pszSpec="*.jpg") returned 0 [0058.935] lstrlenA (lpString="*.jpg") returned 5 [0058.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF", pszSpec="*.jpeg") returned 0 [0058.935] lstrlenA (lpString="*.jpeg") returned 6 [0058.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF", pszSpec="*.psd") returned 0 [0058.935] lstrlenA (lpString="*.psd") returned 5 [0058.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF", pszSpec="*.gif") returned 1 [0058.935] lstrlenA (lpString="*.gif") returned 5 [0058.935] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF" [0058.935] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF" [0058.935] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF." [0058.936] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF.wannacry" [0058.936] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir11f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.936] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x142f [0058.936] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1ba9ab90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0058.936] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.936] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x13b1, lpOverlapped=0x0) returned 1 [0058.938] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF") returned="PDIR11F.GIF" [0058.938] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.938] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x13b1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x13b1, lpOverlapped=0x0) returned 1 [0058.939] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.939] CloseHandle (hObject=0x90) returned 1 [0058.939] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir11f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir11f.gif.wannacry")) returned 1 [0058.939] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x46df, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR12F.GIF", cAlternateFileName="")) returned 1 [0058.940] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.940] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR12F.GIF") returned -1 [0058.940] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR12F.GIF") returned -1 [0058.940] lstrcmpiA (lpString1="", lpString2="PDIR12F.GIF") returned -1 [0058.940] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF") returned="PDIR11F.GIF" [0058.940] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0058.940] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0058.940] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0058.940] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0058.940] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR12F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF" [0058.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF", pszSpec="*.zip") returned 0 [0058.940] lstrlenA (lpString="*.zip") returned 5 [0058.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF", pszSpec="*.rar") returned 0 [0058.940] lstrlenA (lpString="*.rar") returned 5 [0058.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF", pszSpec="*.7z") returned 0 [0058.940] lstrlenA (lpString="*.7z") returned 4 [0058.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF", pszSpec="*.tar") returned 0 [0058.940] lstrlenA (lpString="*.tar") returned 5 [0058.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF", pszSpec="*.gzip") returned 0 [0058.940] lstrlenA (lpString="*.gzip") returned 6 [0058.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF", pszSpec="*.jpg") returned 0 [0058.940] lstrlenA (lpString="*.jpg") returned 5 [0058.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF", pszSpec="*.jpeg") returned 0 [0058.940] lstrlenA (lpString="*.jpeg") returned 6 [0058.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF", pszSpec="*.psd") returned 0 [0058.941] lstrlenA (lpString="*.psd") returned 5 [0058.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF", pszSpec="*.gif") returned 1 [0058.941] lstrlenA (lpString="*.gif") returned 5 [0058.941] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF" [0058.941] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF" [0058.941] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF." [0058.941] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF.wannacry" [0058.941] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir12f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.941] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46df [0058.941] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1ba9ab90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0058.941] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.941] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4661, lpOverlapped=0x0) returned 1 [0058.944] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF") returned="PDIR12F.GIF" [0058.944] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.944] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4661, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4661, lpOverlapped=0x0) returned 1 [0058.944] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.944] CloseHandle (hObject=0x90) returned 1 [0058.944] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir12f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir12f.gif.wannacry")) returned 1 [0058.945] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x430d, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR13F.GIF", cAlternateFileName="")) returned 1 [0058.945] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.945] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR13F.GIF") returned -1 [0058.945] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR13F.GIF") returned -1 [0058.945] lstrcmpiA (lpString1="", lpString2="PDIR13F.GIF") returned -1 [0058.945] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF") returned="PDIR12F.GIF" [0058.945] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0058.945] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0058.945] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0058.945] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0058.946] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR13F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF" [0058.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF", pszSpec="*.zip") returned 0 [0058.946] lstrlenA (lpString="*.zip") returned 5 [0058.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF", pszSpec="*.rar") returned 0 [0058.946] lstrlenA (lpString="*.rar") returned 5 [0058.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF", pszSpec="*.7z") returned 0 [0058.946] lstrlenA (lpString="*.7z") returned 4 [0058.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF", pszSpec="*.tar") returned 0 [0058.946] lstrlenA (lpString="*.tar") returned 5 [0058.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF", pszSpec="*.gzip") returned 0 [0058.946] lstrlenA (lpString="*.gzip") returned 6 [0058.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF", pszSpec="*.jpg") returned 0 [0058.946] lstrlenA (lpString="*.jpg") returned 5 [0058.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF", pszSpec="*.jpeg") returned 0 [0058.946] lstrlenA (lpString="*.jpeg") returned 6 [0058.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF", pszSpec="*.psd") returned 0 [0058.946] lstrlenA (lpString="*.psd") returned 5 [0058.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF", pszSpec="*.gif") returned 1 [0058.946] lstrlenA (lpString="*.gif") returned 5 [0058.946] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF" [0058.946] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF" [0058.946] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF." [0058.946] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF.wannacry" [0058.946] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir13f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.948] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x430d [0058.948] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1ba9ab90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0058.948] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.948] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x428f, lpOverlapped=0x0) returned 1 [0058.951] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF") returned="PDIR13F.GIF" [0058.951] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.951] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x428f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x428f, lpOverlapped=0x0) returned 1 [0058.951] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.951] CloseHandle (hObject=0x90) returned 1 [0058.951] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir13f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir13f.gif.wannacry")) returned 1 [0058.952] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x5cb7, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR14F.GIF", cAlternateFileName="")) returned 1 [0058.952] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.952] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR14F.GIF") returned -1 [0058.952] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR14F.GIF") returned -1 [0058.952] lstrcmpiA (lpString1="", lpString2="PDIR14F.GIF") returned -1 [0058.952] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF") returned="PDIR13F.GIF" [0058.953] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0058.953] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0058.953] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0058.953] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0058.953] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR14F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF" [0058.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF", pszSpec="*.zip") returned 0 [0058.953] lstrlenA (lpString="*.zip") returned 5 [0058.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF", pszSpec="*.rar") returned 0 [0058.953] lstrlenA (lpString="*.rar") returned 5 [0058.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF", pszSpec="*.7z") returned 0 [0058.953] lstrlenA (lpString="*.7z") returned 4 [0058.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF", pszSpec="*.tar") returned 0 [0058.953] lstrlenA (lpString="*.tar") returned 5 [0058.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF", pszSpec="*.gzip") returned 0 [0058.953] lstrlenA (lpString="*.gzip") returned 6 [0058.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF", pszSpec="*.jpg") returned 0 [0058.953] lstrlenA (lpString="*.jpg") returned 5 [0058.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF", pszSpec="*.jpeg") returned 0 [0058.953] lstrlenA (lpString="*.jpeg") returned 6 [0058.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF", pszSpec="*.psd") returned 0 [0058.953] lstrlenA (lpString="*.psd") returned 5 [0058.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF", pszSpec="*.gif") returned 1 [0058.953] lstrlenA (lpString="*.gif") returned 5 [0058.953] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF" [0058.954] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF" [0058.954] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF." [0058.954] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF.wannacry" [0058.954] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir14f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.954] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5cb7 [0058.954] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1ba9ab90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0058.954] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.954] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x5c39, lpOverlapped=0x0) returned 1 [0058.956] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF") returned="PDIR14F.GIF" [0058.957] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.957] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x5c39, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x5c39, lpOverlapped=0x0) returned 1 [0058.957] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.957] CloseHandle (hObject=0x90) returned 1 [0058.957] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir14f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir14f.gif.wannacry")) returned 1 [0058.958] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1cb8, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR15F.GIF", cAlternateFileName="")) returned 1 [0058.958] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.958] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR15F.GIF") returned -1 [0058.958] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR15F.GIF") returned -1 [0058.958] lstrcmpiA (lpString1="", lpString2="PDIR15F.GIF") returned -1 [0058.958] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF") returned="PDIR14F.GIF" [0058.958] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0058.958] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0058.958] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0058.958] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0058.958] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR15F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF" [0058.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF", pszSpec="*.zip") returned 0 [0058.959] lstrlenA (lpString="*.zip") returned 5 [0058.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF", pszSpec="*.rar") returned 0 [0058.959] lstrlenA (lpString="*.rar") returned 5 [0058.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF", pszSpec="*.7z") returned 0 [0058.959] lstrlenA (lpString="*.7z") returned 4 [0058.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF", pszSpec="*.tar") returned 0 [0058.959] lstrlenA (lpString="*.tar") returned 5 [0058.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF", pszSpec="*.gzip") returned 0 [0058.959] lstrlenA (lpString="*.gzip") returned 6 [0058.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF", pszSpec="*.jpg") returned 0 [0058.959] lstrlenA (lpString="*.jpg") returned 5 [0058.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF", pszSpec="*.jpeg") returned 0 [0058.959] lstrlenA (lpString="*.jpeg") returned 6 [0058.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF", pszSpec="*.psd") returned 0 [0058.959] lstrlenA (lpString="*.psd") returned 5 [0058.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF", pszSpec="*.gif") returned 1 [0058.959] lstrlenA (lpString="*.gif") returned 5 [0058.959] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF" [0058.959] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF" [0058.959] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF." [0058.959] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF.wannacry" [0058.959] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir15f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.960] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1cb8 [0058.960] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bac0cf0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0058.960] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.960] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1c3a, lpOverlapped=0x0) returned 1 [0058.962] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF") returned="PDIR15F.GIF" [0058.962] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.962] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1c3a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1c3a, lpOverlapped=0x0) returned 1 [0058.962] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.962] CloseHandle (hObject=0x90) returned 1 [0058.963] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir15f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir15f.gif.wannacry")) returned 1 [0058.963] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x399f, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR16F.GIF", cAlternateFileName="")) returned 1 [0058.963] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.963] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR16F.GIF") returned -1 [0058.963] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR16F.GIF") returned -1 [0058.964] lstrcmpiA (lpString1="", lpString2="PDIR16F.GIF") returned -1 [0058.964] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF") returned="PDIR15F.GIF" [0058.964] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0058.964] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0058.964] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0058.964] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0058.964] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR16F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF" [0058.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF", pszSpec="*.zip") returned 0 [0058.964] lstrlenA (lpString="*.zip") returned 5 [0058.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF", pszSpec="*.rar") returned 0 [0058.964] lstrlenA (lpString="*.rar") returned 5 [0058.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF", pszSpec="*.7z") returned 0 [0058.964] lstrlenA (lpString="*.7z") returned 4 [0058.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF", pszSpec="*.tar") returned 0 [0058.964] lstrlenA (lpString="*.tar") returned 5 [0058.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF", pszSpec="*.gzip") returned 0 [0058.964] lstrlenA (lpString="*.gzip") returned 6 [0058.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF", pszSpec="*.jpg") returned 0 [0058.964] lstrlenA (lpString="*.jpg") returned 5 [0058.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF", pszSpec="*.jpeg") returned 0 [0058.964] lstrlenA (lpString="*.jpeg") returned 6 [0058.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF", pszSpec="*.psd") returned 0 [0058.964] lstrlenA (lpString="*.psd") returned 5 [0058.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF", pszSpec="*.gif") returned 1 [0058.965] lstrlenA (lpString="*.gif") returned 5 [0058.965] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF" [0058.965] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF" [0058.965] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF." [0058.965] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF.wannacry" [0058.965] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir16f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.965] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x399f [0058.965] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bac0cf0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0058.965] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.966] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3921, lpOverlapped=0x0) returned 1 [0058.968] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF") returned="PDIR16F.GIF" [0058.968] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.968] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3921, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3921, lpOverlapped=0x0) returned 1 [0058.968] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.968] CloseHandle (hObject=0x90) returned 1 [0058.968] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir16f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir16f.gif.wannacry")) returned 1 [0058.969] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2bb7, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR17F.GIF", cAlternateFileName="")) returned 1 [0058.969] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.969] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR17F.GIF") returned -1 [0058.969] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR17F.GIF") returned -1 [0058.969] lstrcmpiA (lpString1="", lpString2="PDIR17F.GIF") returned -1 [0058.969] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF") returned="PDIR16F.GIF" [0058.969] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0058.969] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0058.969] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0058.969] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0058.969] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR17F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF" [0058.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF", pszSpec="*.zip") returned 0 [0058.970] lstrlenA (lpString="*.zip") returned 5 [0058.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF", pszSpec="*.rar") returned 0 [0058.970] lstrlenA (lpString="*.rar") returned 5 [0058.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF", pszSpec="*.7z") returned 0 [0058.970] lstrlenA (lpString="*.7z") returned 4 [0058.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF", pszSpec="*.tar") returned 0 [0058.970] lstrlenA (lpString="*.tar") returned 5 [0058.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF", pszSpec="*.gzip") returned 0 [0058.970] lstrlenA (lpString="*.gzip") returned 6 [0058.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF", pszSpec="*.jpg") returned 0 [0058.970] lstrlenA (lpString="*.jpg") returned 5 [0058.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF", pszSpec="*.jpeg") returned 0 [0058.970] lstrlenA (lpString="*.jpeg") returned 6 [0058.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF", pszSpec="*.psd") returned 0 [0058.970] lstrlenA (lpString="*.psd") returned 5 [0058.970] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF", pszSpec="*.gif") returned 1 [0058.970] lstrlenA (lpString="*.gif") returned 5 [0058.970] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF" [0058.970] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF" [0058.970] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF." [0058.970] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF.wannacry" [0058.970] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir17f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.971] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2bb7 [0058.971] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bac0cf0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0058.971] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.971] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2b39, lpOverlapped=0x0) returned 1 [0058.973] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF") returned="PDIR17F.GIF" [0058.973] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.973] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2b39, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2b39, lpOverlapped=0x0) returned 1 [0058.974] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.974] CloseHandle (hObject=0x90) returned 1 [0058.974] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir17f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir17f.gif.wannacry")) returned 1 [0058.975] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x41f4, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR18F.GIF", cAlternateFileName="")) returned 1 [0058.975] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.975] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR18F.GIF") returned -1 [0058.975] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR18F.GIF") returned -1 [0058.975] lstrcmpiA (lpString1="", lpString2="PDIR18F.GIF") returned -1 [0058.975] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF") returned="PDIR17F.GIF" [0058.975] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0058.975] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0058.975] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0058.975] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0058.975] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR18F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF" [0058.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF", pszSpec="*.zip") returned 0 [0058.975] lstrlenA (lpString="*.zip") returned 5 [0058.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF", pszSpec="*.rar") returned 0 [0058.975] lstrlenA (lpString="*.rar") returned 5 [0058.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF", pszSpec="*.7z") returned 0 [0058.975] lstrlenA (lpString="*.7z") returned 4 [0058.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF", pszSpec="*.tar") returned 0 [0058.975] lstrlenA (lpString="*.tar") returned 5 [0058.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF", pszSpec="*.gzip") returned 0 [0058.975] lstrlenA (lpString="*.gzip") returned 6 [0058.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF", pszSpec="*.jpg") returned 0 [0058.976] lstrlenA (lpString="*.jpg") returned 5 [0058.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF", pszSpec="*.jpeg") returned 0 [0058.976] lstrlenA (lpString="*.jpeg") returned 6 [0058.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF", pszSpec="*.psd") returned 0 [0058.976] lstrlenA (lpString="*.psd") returned 5 [0058.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF", pszSpec="*.gif") returned 1 [0058.976] lstrlenA (lpString="*.gif") returned 5 [0058.976] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF" [0058.976] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF" [0058.976] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF." [0058.976] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF.wannacry" [0058.976] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir18f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.976] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x41f4 [0058.977] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bac0cf0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0058.977] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.977] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4176, lpOverlapped=0x0) returned 1 [0058.979] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF") returned="PDIR18F.GIF" [0058.979] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.979] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4176, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4176, lpOverlapped=0x0) returned 1 [0058.979] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.979] CloseHandle (hObject=0x90) returned 1 [0058.979] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir18f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir18f.gif.wannacry")) returned 1 [0058.980] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xc4f, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR19F.GIF", cAlternateFileName="")) returned 1 [0058.980] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.980] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR19F.GIF") returned -1 [0058.980] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR19F.GIF") returned -1 [0058.980] lstrcmpiA (lpString1="", lpString2="PDIR19F.GIF") returned -1 [0058.980] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF") returned="PDIR18F.GIF" [0058.980] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0058.980] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0058.980] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0058.980] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0058.981] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR19F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF" [0058.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF", pszSpec="*.zip") returned 0 [0058.981] lstrlenA (lpString="*.zip") returned 5 [0058.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF", pszSpec="*.rar") returned 0 [0058.981] lstrlenA (lpString="*.rar") returned 5 [0058.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF", pszSpec="*.7z") returned 0 [0058.981] lstrlenA (lpString="*.7z") returned 4 [0058.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF", pszSpec="*.tar") returned 0 [0058.981] lstrlenA (lpString="*.tar") returned 5 [0058.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF", pszSpec="*.gzip") returned 0 [0058.981] lstrlenA (lpString="*.gzip") returned 6 [0058.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF", pszSpec="*.jpg") returned 0 [0058.981] lstrlenA (lpString="*.jpg") returned 5 [0058.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF", pszSpec="*.jpeg") returned 0 [0058.981] lstrlenA (lpString="*.jpeg") returned 6 [0058.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF", pszSpec="*.psd") returned 0 [0058.981] lstrlenA (lpString="*.psd") returned 5 [0058.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF", pszSpec="*.gif") returned 1 [0058.981] lstrlenA (lpString="*.gif") returned 5 [0058.981] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF" [0058.981] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF" [0058.981] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF." [0058.981] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF.wannacry" [0058.981] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir19f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.982] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc4f [0058.982] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bac0cf0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0058.982] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.982] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xbd1, lpOverlapped=0x0) returned 1 [0058.984] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF") returned="PDIR19F.GIF" [0058.984] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.984] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xbd1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xbd1, lpOverlapped=0x0) returned 1 [0058.984] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.984] CloseHandle (hObject=0x90) returned 1 [0058.984] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir19f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir19f.gif.wannacry")) returned 1 [0058.985] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xd98, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR1B.GIF", cAlternateFileName="")) returned 1 [0058.985] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.985] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR1B.GIF") returned -1 [0058.985] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR1B.GIF") returned -1 [0058.985] lstrcmpiA (lpString1="", lpString2="PDIR1B.GIF") returned -1 [0058.985] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF") returned="PDIR19F.GIF" [0058.985] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0058.985] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0058.985] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0058.985] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0058.985] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR1B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF" [0058.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF", pszSpec="*.zip") returned 0 [0058.985] lstrlenA (lpString="*.zip") returned 5 [0058.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF", pszSpec="*.rar") returned 0 [0058.985] lstrlenA (lpString="*.rar") returned 5 [0058.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF", pszSpec="*.7z") returned 0 [0058.985] lstrlenA (lpString="*.7z") returned 4 [0058.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF", pszSpec="*.tar") returned 0 [0058.985] lstrlenA (lpString="*.tar") returned 5 [0058.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF", pszSpec="*.gzip") returned 0 [0058.986] lstrlenA (lpString="*.gzip") returned 6 [0058.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF", pszSpec="*.jpg") returned 0 [0058.986] lstrlenA (lpString="*.jpg") returned 5 [0058.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF", pszSpec="*.jpeg") returned 0 [0058.986] lstrlenA (lpString="*.jpeg") returned 6 [0058.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF", pszSpec="*.psd") returned 0 [0058.986] lstrlenA (lpString="*.psd") returned 5 [0058.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF", pszSpec="*.gif") returned 1 [0058.986] lstrlenA (lpString="*.gif") returned 5 [0058.986] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF" [0058.986] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF" [0058.986] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF." [0058.986] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF.wannacry" [0058.986] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.986] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd98 [0058.986] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bac0cf0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0058.986] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.986] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd1a, lpOverlapped=0x0) returned 1 [0058.988] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF") returned="PDIR1B.GIF" [0058.988] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.988] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd1a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd1a, lpOverlapped=0x0) returned 1 [0058.988] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.988] CloseHandle (hObject=0x90) returned 1 [0058.988] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1b.gif.wannacry")) returned 1 [0058.991] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xf6d, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR1F.GIF", cAlternateFileName="")) returned 1 [0058.991] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.992] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR1F.GIF") returned -1 [0058.992] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR1F.GIF") returned -1 [0058.992] lstrcmpiA (lpString1="", lpString2="PDIR1F.GIF") returned -1 [0058.992] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF") returned="PDIR1B.GIF" [0058.992] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0058.992] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0058.992] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0058.992] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0058.992] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR1F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF" [0058.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF", pszSpec="*.zip") returned 0 [0058.992] lstrlenA (lpString="*.zip") returned 5 [0058.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF", pszSpec="*.rar") returned 0 [0058.992] lstrlenA (lpString="*.rar") returned 5 [0058.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF", pszSpec="*.7z") returned 0 [0058.992] lstrlenA (lpString="*.7z") returned 4 [0058.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF", pszSpec="*.tar") returned 0 [0058.992] lstrlenA (lpString="*.tar") returned 5 [0058.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF", pszSpec="*.gzip") returned 0 [0058.992] lstrlenA (lpString="*.gzip") returned 6 [0058.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF", pszSpec="*.jpg") returned 0 [0058.992] lstrlenA (lpString="*.jpg") returned 5 [0058.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF", pszSpec="*.jpeg") returned 0 [0058.992] lstrlenA (lpString="*.jpeg") returned 6 [0058.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF", pszSpec="*.psd") returned 0 [0058.992] lstrlenA (lpString="*.psd") returned 5 [0058.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF", pszSpec="*.gif") returned 1 [0058.992] lstrlenA (lpString="*.gif") returned 5 [0058.992] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF" [0058.992] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF" [0058.993] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF." [0058.993] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF.wannacry" [0058.993] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.994] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf6d [0058.994] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bac0cf0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0058.994] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.994] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xeef, lpOverlapped=0x0) returned 1 [0058.996] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF") returned="PDIR1F.GIF" [0058.996] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.996] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xeef, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xeef, lpOverlapped=0x0) returned 1 [0058.996] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0058.996] CloseHandle (hObject=0x90) returned 1 [0058.996] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1f.gif.wannacry")) returned 1 [0058.997] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3408, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR20F.GIF", cAlternateFileName="")) returned 1 [0058.997] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0058.997] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR20F.GIF") returned -1 [0058.997] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR20F.GIF") returned -1 [0058.997] lstrcmpiA (lpString1="", lpString2="PDIR20F.GIF") returned -1 [0058.997] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF") returned="PDIR1F.GIF" [0058.997] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0058.997] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0058.997] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0058.997] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0058.997] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR20F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF" [0058.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF", pszSpec="*.zip") returned 0 [0058.997] lstrlenA (lpString="*.zip") returned 5 [0058.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF", pszSpec="*.rar") returned 0 [0058.997] lstrlenA (lpString="*.rar") returned 5 [0058.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF", pszSpec="*.7z") returned 0 [0058.997] lstrlenA (lpString="*.7z") returned 4 [0058.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF", pszSpec="*.tar") returned 0 [0058.997] lstrlenA (lpString="*.tar") returned 5 [0058.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF", pszSpec="*.gzip") returned 0 [0058.997] lstrlenA (lpString="*.gzip") returned 6 [0058.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF", pszSpec="*.jpg") returned 0 [0058.997] lstrlenA (lpString="*.jpg") returned 5 [0058.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF", pszSpec="*.jpeg") returned 0 [0058.997] lstrlenA (lpString="*.jpeg") returned 6 [0058.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF", pszSpec="*.psd") returned 0 [0058.997] lstrlenA (lpString="*.psd") returned 5 [0058.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF", pszSpec="*.gif") returned 1 [0058.998] lstrlenA (lpString="*.gif") returned 5 [0058.998] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF" [0058.998] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF" [0058.998] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF." [0058.998] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF.wannacry" [0058.998] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir20f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0058.998] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3408 [0058.998] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bac0cf0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0058.998] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0058.998] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x338a, lpOverlapped=0x0) returned 1 [0059.000] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF") returned="PDIR20F.GIF" [0059.000] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.000] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x338a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x338a, lpOverlapped=0x0) returned 1 [0059.000] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.000] CloseHandle (hObject=0x90) returned 1 [0059.000] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir20f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir20f.gif.wannacry")) returned 1 [0059.001] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2d7e, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR21F.GIF", cAlternateFileName="")) returned 1 [0059.001] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.001] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR21F.GIF") returned -1 [0059.001] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR21F.GIF") returned -1 [0059.001] lstrcmpiA (lpString1="", lpString2="PDIR21F.GIF") returned -1 [0059.001] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF") returned="PDIR20F.GIF" [0059.001] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.001] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.001] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.001] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.001] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR21F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF" [0059.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF", pszSpec="*.zip") returned 0 [0059.001] lstrlenA (lpString="*.zip") returned 5 [0059.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF", pszSpec="*.rar") returned 0 [0059.001] lstrlenA (lpString="*.rar") returned 5 [0059.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF", pszSpec="*.7z") returned 0 [0059.001] lstrlenA (lpString="*.7z") returned 4 [0059.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF", pszSpec="*.tar") returned 0 [0059.001] lstrlenA (lpString="*.tar") returned 5 [0059.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF", pszSpec="*.gzip") returned 0 [0059.001] lstrlenA (lpString="*.gzip") returned 6 [0059.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF", pszSpec="*.jpg") returned 0 [0059.001] lstrlenA (lpString="*.jpg") returned 5 [0059.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF", pszSpec="*.jpeg") returned 0 [0059.001] lstrlenA (lpString="*.jpeg") returned 6 [0059.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF", pszSpec="*.psd") returned 0 [0059.001] lstrlenA (lpString="*.psd") returned 5 [0059.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF", pszSpec="*.gif") returned 1 [0059.002] lstrlenA (lpString="*.gif") returned 5 [0059.002] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF" [0059.002] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF" [0059.002] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF." [0059.002] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF.wannacry" [0059.002] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir21f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.002] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d7e [0059.002] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bae6e50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.002] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.002] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2d00, lpOverlapped=0x0) returned 1 [0059.004] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF") returned="PDIR21F.GIF" [0059.004] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.004] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2d00, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2d00, lpOverlapped=0x0) returned 1 [0059.004] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.004] CloseHandle (hObject=0x90) returned 1 [0059.004] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir21f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir21f.gif.wannacry")) returned 1 [0059.006] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1fd7, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR22F.GIF", cAlternateFileName="")) returned 1 [0059.006] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.006] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR22F.GIF") returned -1 [0059.006] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR22F.GIF") returned -1 [0059.006] lstrcmpiA (lpString1="", lpString2="PDIR22F.GIF") returned -1 [0059.006] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF") returned="PDIR21F.GIF" [0059.006] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.006] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.006] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.006] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.006] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR22F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF" [0059.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF", pszSpec="*.zip") returned 0 [0059.006] lstrlenA (lpString="*.zip") returned 5 [0059.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF", pszSpec="*.rar") returned 0 [0059.007] lstrlenA (lpString="*.rar") returned 5 [0059.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF", pszSpec="*.7z") returned 0 [0059.007] lstrlenA (lpString="*.7z") returned 4 [0059.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF", pszSpec="*.tar") returned 0 [0059.007] lstrlenA (lpString="*.tar") returned 5 [0059.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF", pszSpec="*.gzip") returned 0 [0059.007] lstrlenA (lpString="*.gzip") returned 6 [0059.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF", pszSpec="*.jpg") returned 0 [0059.007] lstrlenA (lpString="*.jpg") returned 5 [0059.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF", pszSpec="*.jpeg") returned 0 [0059.007] lstrlenA (lpString="*.jpeg") returned 6 [0059.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF", pszSpec="*.psd") returned 0 [0059.007] lstrlenA (lpString="*.psd") returned 5 [0059.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF", pszSpec="*.gif") returned 1 [0059.007] lstrlenA (lpString="*.gif") returned 5 [0059.007] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF" [0059.007] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF" [0059.007] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF." [0059.007] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF.wannacry" [0059.007] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir22f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.008] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fd7 [0059.008] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bae6e50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.008] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.008] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1f59, lpOverlapped=0x0) returned 1 [0059.009] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF") returned="PDIR22F.GIF" [0059.009] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.009] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1f59, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1f59, lpOverlapped=0x0) returned 1 [0059.010] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.010] CloseHandle (hObject=0x90) returned 1 [0059.010] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir22f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir22f.gif.wannacry")) returned 1 [0059.010] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x313b, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR23F.GIF", cAlternateFileName="")) returned 1 [0059.010] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.010] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR23F.GIF") returned -1 [0059.010] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR23F.GIF") returned -1 [0059.010] lstrcmpiA (lpString1="", lpString2="PDIR23F.GIF") returned -1 [0059.010] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF") returned="PDIR22F.GIF" [0059.010] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.011] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.011] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.011] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.011] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR23F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF" [0059.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF", pszSpec="*.zip") returned 0 [0059.011] lstrlenA (lpString="*.zip") returned 5 [0059.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF", pszSpec="*.rar") returned 0 [0059.011] lstrlenA (lpString="*.rar") returned 5 [0059.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF", pszSpec="*.7z") returned 0 [0059.011] lstrlenA (lpString="*.7z") returned 4 [0059.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF", pszSpec="*.tar") returned 0 [0059.011] lstrlenA (lpString="*.tar") returned 5 [0059.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF", pszSpec="*.gzip") returned 0 [0059.011] lstrlenA (lpString="*.gzip") returned 6 [0059.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF", pszSpec="*.jpg") returned 0 [0059.011] lstrlenA (lpString="*.jpg") returned 5 [0059.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF", pszSpec="*.jpeg") returned 0 [0059.011] lstrlenA (lpString="*.jpeg") returned 6 [0059.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF", pszSpec="*.psd") returned 0 [0059.011] lstrlenA (lpString="*.psd") returned 5 [0059.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF", pszSpec="*.gif") returned 1 [0059.011] lstrlenA (lpString="*.gif") returned 5 [0059.011] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF" [0059.011] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF" [0059.011] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF." [0059.011] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF.wannacry" [0059.011] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir23f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.012] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x313b [0059.012] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bae6e50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.012] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.012] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x30bd, lpOverlapped=0x0) returned 1 [0059.014] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF") returned="PDIR23F.GIF" [0059.014] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.014] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x30bd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x30bd, lpOverlapped=0x0) returned 1 [0059.014] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.015] CloseHandle (hObject=0x90) returned 1 [0059.015] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir23f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir23f.gif.wannacry")) returned 1 [0059.015] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x16ad, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR24F.GIF", cAlternateFileName="")) returned 1 [0059.015] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.015] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR24F.GIF") returned -1 [0059.015] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR24F.GIF") returned -1 [0059.015] lstrcmpiA (lpString1="", lpString2="PDIR24F.GIF") returned -1 [0059.015] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF") returned="PDIR23F.GIF" [0059.015] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.015] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.015] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.015] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.016] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR24F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF" [0059.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF", pszSpec="*.zip") returned 0 [0059.016] lstrlenA (lpString="*.zip") returned 5 [0059.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF", pszSpec="*.rar") returned 0 [0059.016] lstrlenA (lpString="*.rar") returned 5 [0059.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF", pszSpec="*.7z") returned 0 [0059.016] lstrlenA (lpString="*.7z") returned 4 [0059.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF", pszSpec="*.tar") returned 0 [0059.016] lstrlenA (lpString="*.tar") returned 5 [0059.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF", pszSpec="*.gzip") returned 0 [0059.016] lstrlenA (lpString="*.gzip") returned 6 [0059.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF", pszSpec="*.jpg") returned 0 [0059.016] lstrlenA (lpString="*.jpg") returned 5 [0059.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF", pszSpec="*.jpeg") returned 0 [0059.016] lstrlenA (lpString="*.jpeg") returned 6 [0059.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF", pszSpec="*.psd") returned 0 [0059.016] lstrlenA (lpString="*.psd") returned 5 [0059.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF", pszSpec="*.gif") returned 1 [0059.016] lstrlenA (lpString="*.gif") returned 5 [0059.016] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF" [0059.016] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF" [0059.016] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF." [0059.016] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF.wannacry" [0059.016] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir24f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.017] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16ad [0059.017] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bae6e50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.017] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.017] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x162f, lpOverlapped=0x0) returned 1 [0059.018] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF") returned="PDIR24F.GIF" [0059.018] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.018] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x162f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x162f, lpOverlapped=0x0) returned 1 [0059.018] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.018] CloseHandle (hObject=0x90) returned 1 [0059.019] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir24f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir24f.gif.wannacry")) returned 1 [0059.019] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd51e200, ftCreationTime.dwHighDateTime=0x1bdb5da, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbd51e200, ftLastWriteTime.dwHighDateTime=0x1bdb5da, nFileSizeHigh=0x0, nFileSizeLow=0x3187, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR25F.GIF", cAlternateFileName="")) returned 1 [0059.019] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.019] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR25F.GIF") returned -1 [0059.019] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR25F.GIF") returned -1 [0059.019] lstrcmpiA (lpString1="", lpString2="PDIR25F.GIF") returned -1 [0059.019] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF") returned="PDIR24F.GIF" [0059.019] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.019] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.019] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.019] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.019] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR25F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF" [0059.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF", pszSpec="*.zip") returned 0 [0059.019] lstrlenA (lpString="*.zip") returned 5 [0059.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF", pszSpec="*.rar") returned 0 [0059.020] lstrlenA (lpString="*.rar") returned 5 [0059.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF", pszSpec="*.7z") returned 0 [0059.020] lstrlenA (lpString="*.7z") returned 4 [0059.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF", pszSpec="*.tar") returned 0 [0059.020] lstrlenA (lpString="*.tar") returned 5 [0059.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF", pszSpec="*.gzip") returned 0 [0059.020] lstrlenA (lpString="*.gzip") returned 6 [0059.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF", pszSpec="*.jpg") returned 0 [0059.020] lstrlenA (lpString="*.jpg") returned 5 [0059.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF", pszSpec="*.jpeg") returned 0 [0059.020] lstrlenA (lpString="*.jpeg") returned 6 [0059.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF", pszSpec="*.psd") returned 0 [0059.020] lstrlenA (lpString="*.psd") returned 5 [0059.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF", pszSpec="*.gif") returned 1 [0059.020] lstrlenA (lpString="*.gif") returned 5 [0059.020] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF" [0059.020] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF" [0059.020] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF." [0059.020] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF.wannacry" [0059.020] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir25f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.020] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3187 [0059.020] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbd51e200, dwHighDateTime=0x1bdb5da), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bae6e50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbd51e200, dwHighDateTime=0x1bdb5da)) returned 1 [0059.020] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.021] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3109, lpOverlapped=0x0) returned 1 [0059.022] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF") returned="PDIR25F.GIF" [0059.022] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.022] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3109, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3109, lpOverlapped=0x0) returned 1 [0059.023] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.023] CloseHandle (hObject=0x90) returned 1 [0059.023] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir25f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir25f.gif.wannacry")) returned 1 [0059.023] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1985, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR26F.GIF", cAlternateFileName="")) returned 1 [0059.023] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.023] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR26F.GIF") returned -1 [0059.023] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR26F.GIF") returned -1 [0059.023] lstrcmpiA (lpString1="", lpString2="PDIR26F.GIF") returned -1 [0059.023] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF") returned="PDIR25F.GIF" [0059.023] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.023] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.023] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.023] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR26F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF" [0059.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF", pszSpec="*.zip") returned 0 [0059.024] lstrlenA (lpString="*.zip") returned 5 [0059.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF", pszSpec="*.rar") returned 0 [0059.024] lstrlenA (lpString="*.rar") returned 5 [0059.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF", pszSpec="*.7z") returned 0 [0059.024] lstrlenA (lpString="*.7z") returned 4 [0059.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF", pszSpec="*.tar") returned 0 [0059.024] lstrlenA (lpString="*.tar") returned 5 [0059.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF", pszSpec="*.gzip") returned 0 [0059.024] lstrlenA (lpString="*.gzip") returned 6 [0059.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF", pszSpec="*.jpg") returned 0 [0059.024] lstrlenA (lpString="*.jpg") returned 5 [0059.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF", pszSpec="*.jpeg") returned 0 [0059.024] lstrlenA (lpString="*.jpeg") returned 6 [0059.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF", pszSpec="*.psd") returned 0 [0059.024] lstrlenA (lpString="*.psd") returned 5 [0059.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF", pszSpec="*.gif") returned 1 [0059.024] lstrlenA (lpString="*.gif") returned 5 [0059.024] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF" [0059.024] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF" [0059.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF." [0059.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF.wannacry" [0059.024] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir26f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.024] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1985 [0059.025] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bae6e50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.025] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.025] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1907, lpOverlapped=0x0) returned 1 [0059.026] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF") returned="PDIR26F.GIF" [0059.026] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.026] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1907, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1907, lpOverlapped=0x0) returned 1 [0059.027] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.027] CloseHandle (hObject=0x90) returned 1 [0059.027] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir26f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir26f.gif.wannacry")) returned 1 [0059.027] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1cd3, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR27F.GIF", cAlternateFileName="")) returned 1 [0059.027] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.027] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR27F.GIF") returned -1 [0059.027] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR27F.GIF") returned -1 [0059.027] lstrcmpiA (lpString1="", lpString2="PDIR27F.GIF") returned -1 [0059.027] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF") returned="PDIR26F.GIF" [0059.027] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.027] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.027] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR27F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF" [0059.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF", pszSpec="*.zip") returned 0 [0059.028] lstrlenA (lpString="*.zip") returned 5 [0059.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF", pszSpec="*.rar") returned 0 [0059.028] lstrlenA (lpString="*.rar") returned 5 [0059.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF", pszSpec="*.7z") returned 0 [0059.028] lstrlenA (lpString="*.7z") returned 4 [0059.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF", pszSpec="*.tar") returned 0 [0059.028] lstrlenA (lpString="*.tar") returned 5 [0059.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF", pszSpec="*.gzip") returned 0 [0059.028] lstrlenA (lpString="*.gzip") returned 6 [0059.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF", pszSpec="*.jpg") returned 0 [0059.028] lstrlenA (lpString="*.jpg") returned 5 [0059.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF", pszSpec="*.jpeg") returned 0 [0059.028] lstrlenA (lpString="*.jpeg") returned 6 [0059.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF", pszSpec="*.psd") returned 0 [0059.028] lstrlenA (lpString="*.psd") returned 5 [0059.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF", pszSpec="*.gif") returned 1 [0059.028] lstrlenA (lpString="*.gif") returned 5 [0059.028] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF" [0059.028] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF" [0059.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF." [0059.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF.wannacry" [0059.028] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir27f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.033] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1cd3 [0059.033] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bae6e50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.033] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.033] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1c55, lpOverlapped=0x0) returned 1 [0059.035] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF") returned="PDIR27F.GIF" [0059.035] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.035] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1c55, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1c55, lpOverlapped=0x0) returned 1 [0059.035] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.035] CloseHandle (hObject=0x90) returned 1 [0059.035] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir27f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir27f.gif.wannacry")) returned 1 [0059.036] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x684, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR28B.GIF", cAlternateFileName="")) returned 1 [0059.036] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.036] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR28B.GIF") returned -1 [0059.036] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR28B.GIF") returned -1 [0059.036] lstrcmpiA (lpString1="", lpString2="PDIR28B.GIF") returned -1 [0059.036] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF") returned="PDIR27F.GIF" [0059.036] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.036] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.036] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.036] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.036] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR28B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF" [0059.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF", pszSpec="*.zip") returned 0 [0059.036] lstrlenA (lpString="*.zip") returned 5 [0059.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF", pszSpec="*.rar") returned 0 [0059.036] lstrlenA (lpString="*.rar") returned 5 [0059.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF", pszSpec="*.7z") returned 0 [0059.036] lstrlenA (lpString="*.7z") returned 4 [0059.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF", pszSpec="*.tar") returned 0 [0059.036] lstrlenA (lpString="*.tar") returned 5 [0059.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF", pszSpec="*.gzip") returned 0 [0059.037] lstrlenA (lpString="*.gzip") returned 6 [0059.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF", pszSpec="*.jpg") returned 0 [0059.037] lstrlenA (lpString="*.jpg") returned 5 [0059.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF", pszSpec="*.jpeg") returned 0 [0059.037] lstrlenA (lpString="*.jpeg") returned 6 [0059.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF", pszSpec="*.psd") returned 0 [0059.037] lstrlenA (lpString="*.psd") returned 5 [0059.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF", pszSpec="*.gif") returned 1 [0059.037] lstrlenA (lpString="*.gif") returned 5 [0059.037] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF" [0059.037] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF" [0059.037] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF." [0059.037] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF.wannacry" [0059.037] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.037] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x684 [0059.037] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bae6e50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.037] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.037] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x606, lpOverlapped=0x0) returned 1 [0059.039] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF") returned="PDIR28B.GIF" [0059.039] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.039] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x606, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x606, lpOverlapped=0x0) returned 1 [0059.040] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.040] CloseHandle (hObject=0x90) returned 1 [0059.040] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28b.gif.wannacry")) returned 1 [0059.040] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1786, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR28F.GIF", cAlternateFileName="")) returned 1 [0059.040] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.040] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR28F.GIF") returned -1 [0059.040] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR28F.GIF") returned -1 [0059.040] lstrcmpiA (lpString1="", lpString2="PDIR28F.GIF") returned -1 [0059.040] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF") returned="PDIR28B.GIF" [0059.040] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.040] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.041] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.041] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.041] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR28F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF" [0059.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF", pszSpec="*.zip") returned 0 [0059.041] lstrlenA (lpString="*.zip") returned 5 [0059.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF", pszSpec="*.rar") returned 0 [0059.041] lstrlenA (lpString="*.rar") returned 5 [0059.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF", pszSpec="*.7z") returned 0 [0059.041] lstrlenA (lpString="*.7z") returned 4 [0059.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF", pszSpec="*.tar") returned 0 [0059.041] lstrlenA (lpString="*.tar") returned 5 [0059.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF", pszSpec="*.gzip") returned 0 [0059.041] lstrlenA (lpString="*.gzip") returned 6 [0059.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF", pszSpec="*.jpg") returned 0 [0059.041] lstrlenA (lpString="*.jpg") returned 5 [0059.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF", pszSpec="*.jpeg") returned 0 [0059.041] lstrlenA (lpString="*.jpeg") returned 6 [0059.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF", pszSpec="*.psd") returned 0 [0059.041] lstrlenA (lpString="*.psd") returned 5 [0059.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF", pszSpec="*.gif") returned 1 [0059.041] lstrlenA (lpString="*.gif") returned 5 [0059.041] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF" [0059.041] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF" [0059.041] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF." [0059.041] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF.wannacry" [0059.041] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.042] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1786 [0059.042] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bae6e50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.042] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.042] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1708, lpOverlapped=0x0) returned 1 [0059.043] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF") returned="PDIR28F.GIF" [0059.043] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.043] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1708, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1708, lpOverlapped=0x0) returned 1 [0059.044] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.044] CloseHandle (hObject=0x90) returned 1 [0059.044] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28f.gif.wannacry")) returned 1 [0059.044] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x11b3, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR29B.GIF", cAlternateFileName="")) returned 1 [0059.044] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.044] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR29B.GIF") returned -1 [0059.044] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR29B.GIF") returned -1 [0059.044] lstrcmpiA (lpString1="", lpString2="PDIR29B.GIF") returned -1 [0059.044] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF") returned="PDIR28F.GIF" [0059.044] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.044] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.044] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.044] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.045] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR29B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF" [0059.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF", pszSpec="*.zip") returned 0 [0059.045] lstrlenA (lpString="*.zip") returned 5 [0059.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF", pszSpec="*.rar") returned 0 [0059.045] lstrlenA (lpString="*.rar") returned 5 [0059.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF", pszSpec="*.7z") returned 0 [0059.045] lstrlenA (lpString="*.7z") returned 4 [0059.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF", pszSpec="*.tar") returned 0 [0059.045] lstrlenA (lpString="*.tar") returned 5 [0059.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF", pszSpec="*.gzip") returned 0 [0059.045] lstrlenA (lpString="*.gzip") returned 6 [0059.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF", pszSpec="*.jpg") returned 0 [0059.045] lstrlenA (lpString="*.jpg") returned 5 [0059.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF", pszSpec="*.jpeg") returned 0 [0059.045] lstrlenA (lpString="*.jpeg") returned 6 [0059.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF", pszSpec="*.psd") returned 0 [0059.045] lstrlenA (lpString="*.psd") returned 5 [0059.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF", pszSpec="*.gif") returned 1 [0059.045] lstrlenA (lpString="*.gif") returned 5 [0059.045] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF" [0059.045] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF" [0059.045] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF." [0059.045] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF.wannacry" [0059.045] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.046] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11b3 [0059.046] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bae6e50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.046] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.046] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1135, lpOverlapped=0x0) returned 1 [0059.047] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF") returned="PDIR29B.GIF" [0059.047] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.047] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1135, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1135, lpOverlapped=0x0) returned 1 [0059.047] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.048] CloseHandle (hObject=0x90) returned 1 [0059.048] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29b.gif.wannacry")) returned 1 [0059.048] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x59bc, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR29F.GIF", cAlternateFileName="")) returned 1 [0059.048] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.048] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR29F.GIF") returned -1 [0059.048] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR29F.GIF") returned -1 [0059.048] lstrcmpiA (lpString1="", lpString2="PDIR29F.GIF") returned -1 [0059.048] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF") returned="PDIR29B.GIF" [0059.048] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.048] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.048] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.048] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.049] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR29F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF" [0059.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF", pszSpec="*.zip") returned 0 [0059.049] lstrlenA (lpString="*.zip") returned 5 [0059.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF", pszSpec="*.rar") returned 0 [0059.049] lstrlenA (lpString="*.rar") returned 5 [0059.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF", pszSpec="*.7z") returned 0 [0059.049] lstrlenA (lpString="*.7z") returned 4 [0059.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF", pszSpec="*.tar") returned 0 [0059.049] lstrlenA (lpString="*.tar") returned 5 [0059.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF", pszSpec="*.gzip") returned 0 [0059.049] lstrlenA (lpString="*.gzip") returned 6 [0059.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF", pszSpec="*.jpg") returned 0 [0059.049] lstrlenA (lpString="*.jpg") returned 5 [0059.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF", pszSpec="*.jpeg") returned 0 [0059.049] lstrlenA (lpString="*.jpeg") returned 6 [0059.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF", pszSpec="*.psd") returned 0 [0059.049] lstrlenA (lpString="*.psd") returned 5 [0059.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF", pszSpec="*.gif") returned 1 [0059.049] lstrlenA (lpString="*.gif") returned 5 [0059.049] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF" [0059.049] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF" [0059.049] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF." [0059.049] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF.wannacry" [0059.049] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.050] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x59bc [0059.050] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bae6e50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.050] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.050] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x593e, lpOverlapped=0x0) returned 1 [0059.052] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF") returned="PDIR29F.GIF" [0059.052] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.052] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x593e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x593e, lpOverlapped=0x0) returned 1 [0059.052] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.052] CloseHandle (hObject=0x90) returned 1 [0059.052] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29f.gif.wannacry")) returned 1 [0059.053] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3567a000, ftCreationTime.dwHighDateTime=0x1bdb36e, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3567a000, ftLastWriteTime.dwHighDateTime=0x1bdb36e, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR2B.GIF", cAlternateFileName="")) returned 1 [0059.053] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.053] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR2B.GIF") returned -1 [0059.053] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR2B.GIF") returned -1 [0059.053] lstrcmpiA (lpString1="", lpString2="PDIR2B.GIF") returned -1 [0059.053] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF") returned="PDIR29F.GIF" [0059.053] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.053] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.053] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.053] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR2B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF" [0059.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF", pszSpec="*.zip") returned 0 [0059.053] lstrlenA (lpString="*.zip") returned 5 [0059.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF", pszSpec="*.rar") returned 0 [0059.053] lstrlenA (lpString="*.rar") returned 5 [0059.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF", pszSpec="*.7z") returned 0 [0059.053] lstrlenA (lpString="*.7z") returned 4 [0059.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF", pszSpec="*.tar") returned 0 [0059.053] lstrlenA (lpString="*.tar") returned 5 [0059.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF", pszSpec="*.gzip") returned 0 [0059.053] lstrlenA (lpString="*.gzip") returned 6 [0059.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF", pszSpec="*.jpg") returned 0 [0059.053] lstrlenA (lpString="*.jpg") returned 5 [0059.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF", pszSpec="*.jpeg") returned 0 [0059.053] lstrlenA (lpString="*.jpeg") returned 6 [0059.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF", pszSpec="*.psd") returned 0 [0059.053] lstrlenA (lpString="*.psd") returned 5 [0059.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF", pszSpec="*.gif") returned 1 [0059.053] lstrlenA (lpString="*.gif") returned 5 [0059.053] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.054] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb96 [0059.054] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3567a000, dwHighDateTime=0x1bdb36e), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bae6e50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3567a000, dwHighDateTime=0x1bdb36e)) returned 1 [0059.054] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.054] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xb18, lpOverlapped=0x0) returned 1 [0059.055] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF") returned="PDIR2B.GIF" [0059.055] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.055] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xb18, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xb18, lpOverlapped=0x0) returned 1 [0059.056] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.056] CloseHandle (hObject=0x90) returned 1 [0059.056] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2b.gif.wannacry")) returned 1 [0059.056] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xf73, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR2F.GIF", cAlternateFileName="")) returned 1 [0059.056] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.056] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR2F.GIF") returned -1 [0059.057] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR2F.GIF") returned -1 [0059.057] lstrcmpiA (lpString1="", lpString2="PDIR2F.GIF") returned -1 [0059.057] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF") returned="PDIR2B.GIF" [0059.057] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.057] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.057] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR2F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF" [0059.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF", pszSpec="*.zip") returned 0 [0059.057] lstrlenA (lpString="*.zip") returned 5 [0059.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF", pszSpec="*.rar") returned 0 [0059.057] lstrlenA (lpString="*.rar") returned 5 [0059.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF", pszSpec="*.7z") returned 0 [0059.057] lstrlenA (lpString="*.7z") returned 4 [0059.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF", pszSpec="*.tar") returned 0 [0059.057] lstrlenA (lpString="*.tar") returned 5 [0059.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF", pszSpec="*.gzip") returned 0 [0059.057] lstrlenA (lpString="*.gzip") returned 6 [0059.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF", pszSpec="*.jpg") returned 0 [0059.057] lstrlenA (lpString="*.jpg") returned 5 [0059.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF", pszSpec="*.jpeg") returned 0 [0059.057] lstrlenA (lpString="*.jpeg") returned 6 [0059.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF", pszSpec="*.psd") returned 0 [0059.057] lstrlenA (lpString="*.psd") returned 5 [0059.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF", pszSpec="*.gif") returned 1 [0059.057] lstrlenA (lpString="*.gif") returned 5 [0059.057] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF" [0059.057] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF" [0059.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF." [0059.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF.wannacry" [0059.057] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.058] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf73 [0059.058] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bae6e50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.058] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.058] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xef5, lpOverlapped=0x0) returned 1 [0059.060] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF") returned="PDIR2F.GIF" [0059.060] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.060] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xef5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xef5, lpOverlapped=0x0) returned 1 [0059.060] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.060] CloseHandle (hObject=0x90) returned 1 [0059.060] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2f.gif.wannacry")) returned 1 [0059.061] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x332e, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR30B.GIF", cAlternateFileName="")) returned 1 [0059.061] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.061] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR30B.GIF") returned -1 [0059.061] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR30B.GIF") returned -1 [0059.061] lstrcmpiA (lpString1="", lpString2="PDIR30B.GIF") returned -1 [0059.061] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF") returned="PDIR2F.GIF" [0059.061] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.061] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.061] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.061] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.061] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR30B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF" [0059.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF", pszSpec="*.zip") returned 0 [0059.061] lstrlenA (lpString="*.zip") returned 5 [0059.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF", pszSpec="*.rar") returned 0 [0059.061] lstrlenA (lpString="*.rar") returned 5 [0059.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF", pszSpec="*.7z") returned 0 [0059.061] lstrlenA (lpString="*.7z") returned 4 [0059.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF", pszSpec="*.tar") returned 0 [0059.061] lstrlenA (lpString="*.tar") returned 5 [0059.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF", pszSpec="*.gzip") returned 0 [0059.061] lstrlenA (lpString="*.gzip") returned 6 [0059.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF", pszSpec="*.jpg") returned 0 [0059.061] lstrlenA (lpString="*.jpg") returned 5 [0059.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF", pszSpec="*.jpeg") returned 0 [0059.061] lstrlenA (lpString="*.jpeg") returned 6 [0059.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF", pszSpec="*.psd") returned 0 [0059.061] lstrlenA (lpString="*.psd") returned 5 [0059.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF", pszSpec="*.gif") returned 1 [0059.061] lstrlenA (lpString="*.gif") returned 5 [0059.061] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF" [0059.062] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF" [0059.062] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF." [0059.062] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF.wannacry" [0059.062] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.062] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x332e [0059.062] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bae6e50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.062] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.062] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x32b0, lpOverlapped=0x0) returned 1 [0059.064] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF") returned="PDIR30B.GIF" [0059.064] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.064] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x32b0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x32b0, lpOverlapped=0x0) returned 1 [0059.064] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.064] CloseHandle (hObject=0x90) returned 1 [0059.064] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30b.gif.wannacry")) returned 1 [0059.065] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4bda, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR30F.GIF", cAlternateFileName="")) returned 1 [0059.065] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.065] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR30F.GIF") returned -1 [0059.065] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR30F.GIF") returned -1 [0059.065] lstrcmpiA (lpString1="", lpString2="PDIR30F.GIF") returned -1 [0059.065] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF") returned="PDIR30B.GIF" [0059.065] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.065] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.065] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.065] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.065] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR30F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF" [0059.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF", pszSpec="*.zip") returned 0 [0059.065] lstrlenA (lpString="*.zip") returned 5 [0059.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF", pszSpec="*.rar") returned 0 [0059.065] lstrlenA (lpString="*.rar") returned 5 [0059.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF", pszSpec="*.7z") returned 0 [0059.065] lstrlenA (lpString="*.7z") returned 4 [0059.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF", pszSpec="*.tar") returned 0 [0059.065] lstrlenA (lpString="*.tar") returned 5 [0059.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF", pszSpec="*.gzip") returned 0 [0059.065] lstrlenA (lpString="*.gzip") returned 6 [0059.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF", pszSpec="*.jpg") returned 0 [0059.065] lstrlenA (lpString="*.jpg") returned 5 [0059.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF", pszSpec="*.jpeg") returned 0 [0059.065] lstrlenA (lpString="*.jpeg") returned 6 [0059.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF", pszSpec="*.psd") returned 0 [0059.066] lstrlenA (lpString="*.psd") returned 5 [0059.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF", pszSpec="*.gif") returned 1 [0059.066] lstrlenA (lpString="*.gif") returned 5 [0059.066] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF" [0059.066] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF" [0059.066] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF." [0059.066] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF.wannacry" [0059.066] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.067] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4bda [0059.067] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bae6e50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.067] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.067] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4b5c, lpOverlapped=0x0) returned 1 [0059.069] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF") returned="PDIR30F.GIF" [0059.069] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.069] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4b5c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4b5c, lpOverlapped=0x0) returned 1 [0059.069] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.069] CloseHandle (hObject=0x90) returned 1 [0059.069] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30f.gif.wannacry")) returned 1 [0059.069] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR31B.GIF", cAlternateFileName="")) returned 1 [0059.070] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.070] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR31B.GIF") returned -1 [0059.070] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR31B.GIF") returned -1 [0059.070] lstrcmpiA (lpString1="", lpString2="PDIR31B.GIF") returned -1 [0059.070] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF") returned="PDIR30F.GIF" [0059.070] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.070] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.070] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.070] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.070] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR31B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF" [0059.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF", pszSpec="*.zip") returned 0 [0059.070] lstrlenA (lpString="*.zip") returned 5 [0059.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF", pszSpec="*.rar") returned 0 [0059.070] lstrlenA (lpString="*.rar") returned 5 [0059.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF", pszSpec="*.7z") returned 0 [0059.070] lstrlenA (lpString="*.7z") returned 4 [0059.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF", pszSpec="*.tar") returned 0 [0059.070] lstrlenA (lpString="*.tar") returned 5 [0059.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF", pszSpec="*.gzip") returned 0 [0059.070] lstrlenA (lpString="*.gzip") returned 6 [0059.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF", pszSpec="*.jpg") returned 0 [0059.070] lstrlenA (lpString="*.jpg") returned 5 [0059.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF", pszSpec="*.jpeg") returned 0 [0059.070] lstrlenA (lpString="*.jpeg") returned 6 [0059.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF", pszSpec="*.psd") returned 0 [0059.070] lstrlenA (lpString="*.psd") returned 5 [0059.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF", pszSpec="*.gif") returned 1 [0059.070] lstrlenA (lpString="*.gif") returned 5 [0059.070] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF" [0059.070] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF" [0059.070] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF." [0059.070] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF.wannacry" [0059.071] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.071] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x838 [0059.071] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bae6e50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.071] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.071] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x7ba, lpOverlapped=0x0) returned 1 [0059.073] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF") returned="PDIR31B.GIF" [0059.073] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.073] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x7ba, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x7ba, lpOverlapped=0x0) returned 1 [0059.073] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.073] CloseHandle (hObject=0x90) returned 1 [0059.073] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31b.gif.wannacry")) returned 1 [0059.074] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x52da, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR31F.GIF", cAlternateFileName="")) returned 1 [0059.074] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.074] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR31F.GIF") returned -1 [0059.074] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR31F.GIF") returned -1 [0059.074] lstrcmpiA (lpString1="", lpString2="PDIR31F.GIF") returned -1 [0059.074] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF") returned="PDIR31B.GIF" [0059.074] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.074] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.074] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.074] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.074] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR31F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF" [0059.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF", pszSpec="*.zip") returned 0 [0059.074] lstrlenA (lpString="*.zip") returned 5 [0059.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF", pszSpec="*.rar") returned 0 [0059.074] lstrlenA (lpString="*.rar") returned 5 [0059.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF", pszSpec="*.7z") returned 0 [0059.074] lstrlenA (lpString="*.7z") returned 4 [0059.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF", pszSpec="*.tar") returned 0 [0059.074] lstrlenA (lpString="*.tar") returned 5 [0059.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF", pszSpec="*.gzip") returned 0 [0059.075] lstrlenA (lpString="*.gzip") returned 6 [0059.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF", pszSpec="*.jpg") returned 0 [0059.075] lstrlenA (lpString="*.jpg") returned 5 [0059.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF", pszSpec="*.jpeg") returned 0 [0059.075] lstrlenA (lpString="*.jpeg") returned 6 [0059.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF", pszSpec="*.psd") returned 0 [0059.075] lstrlenA (lpString="*.psd") returned 5 [0059.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF", pszSpec="*.gif") returned 1 [0059.075] lstrlenA (lpString="*.gif") returned 5 [0059.075] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF" [0059.075] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF" [0059.075] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF." [0059.075] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF.wannacry" [0059.075] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.075] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x52da [0059.075] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb0cfb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.075] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.075] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x525c, lpOverlapped=0x0) returned 1 [0059.077] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF") returned="PDIR31F.GIF" [0059.077] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.077] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x525c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x525c, lpOverlapped=0x0) returned 1 [0059.077] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.078] CloseHandle (hObject=0x90) returned 1 [0059.078] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31f.gif.wannacry")) returned 1 [0059.078] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xf47, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR32B.GIF", cAlternateFileName="")) returned 1 [0059.078] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.078] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR32B.GIF") returned -1 [0059.078] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR32B.GIF") returned -1 [0059.078] lstrcmpiA (lpString1="", lpString2="PDIR32B.GIF") returned -1 [0059.078] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF") returned="PDIR31F.GIF" [0059.078] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.078] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.078] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.078] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.079] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR32B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF" [0059.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF", pszSpec="*.zip") returned 0 [0059.079] lstrlenA (lpString="*.zip") returned 5 [0059.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF", pszSpec="*.rar") returned 0 [0059.079] lstrlenA (lpString="*.rar") returned 5 [0059.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF", pszSpec="*.7z") returned 0 [0059.079] lstrlenA (lpString="*.7z") returned 4 [0059.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF", pszSpec="*.tar") returned 0 [0059.079] lstrlenA (lpString="*.tar") returned 5 [0059.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF", pszSpec="*.gzip") returned 0 [0059.079] lstrlenA (lpString="*.gzip") returned 6 [0059.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF", pszSpec="*.jpg") returned 0 [0059.079] lstrlenA (lpString="*.jpg") returned 5 [0059.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF", pszSpec="*.jpeg") returned 0 [0059.079] lstrlenA (lpString="*.jpeg") returned 6 [0059.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF", pszSpec="*.psd") returned 0 [0059.079] lstrlenA (lpString="*.psd") returned 5 [0059.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF", pszSpec="*.gif") returned 1 [0059.079] lstrlenA (lpString="*.gif") returned 5 [0059.079] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF" [0059.079] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF" [0059.079] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF." [0059.079] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF.wannacry" [0059.079] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.080] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf47 [0059.080] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb0cfb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.080] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.080] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xec9, lpOverlapped=0x0) returned 1 [0059.081] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF") returned="PDIR32B.GIF" [0059.081] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.081] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xec9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xec9, lpOverlapped=0x0) returned 1 [0059.081] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.081] CloseHandle (hObject=0x90) returned 1 [0059.082] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32b.gif.wannacry")) returned 1 [0059.082] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x910b, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR32F.GIF", cAlternateFileName="")) returned 1 [0059.082] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.082] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR32F.GIF") returned -1 [0059.082] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR32F.GIF") returned -1 [0059.082] lstrcmpiA (lpString1="", lpString2="PDIR32F.GIF") returned -1 [0059.082] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF") returned="PDIR32B.GIF" [0059.082] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.082] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.082] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.082] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.082] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR32F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF" [0059.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF", pszSpec="*.zip") returned 0 [0059.083] lstrlenA (lpString="*.zip") returned 5 [0059.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF", pszSpec="*.rar") returned 0 [0059.083] lstrlenA (lpString="*.rar") returned 5 [0059.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF", pszSpec="*.7z") returned 0 [0059.083] lstrlenA (lpString="*.7z") returned 4 [0059.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF", pszSpec="*.tar") returned 0 [0059.083] lstrlenA (lpString="*.tar") returned 5 [0059.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF", pszSpec="*.gzip") returned 0 [0059.083] lstrlenA (lpString="*.gzip") returned 6 [0059.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF", pszSpec="*.jpg") returned 0 [0059.083] lstrlenA (lpString="*.jpg") returned 5 [0059.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF", pszSpec="*.jpeg") returned 0 [0059.083] lstrlenA (lpString="*.jpeg") returned 6 [0059.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF", pszSpec="*.psd") returned 0 [0059.083] lstrlenA (lpString="*.psd") returned 5 [0059.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF", pszSpec="*.gif") returned 1 [0059.083] lstrlenA (lpString="*.gif") returned 5 [0059.083] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF" [0059.083] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF" [0059.083] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF." [0059.083] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF.wannacry" [0059.083] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.084] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x910b [0059.084] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb0cfb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.084] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.084] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x908d, lpOverlapped=0x0) returned 1 [0059.086] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF") returned="PDIR32F.GIF" [0059.086] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.086] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x908d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x908d, lpOverlapped=0x0) returned 1 [0059.086] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.087] CloseHandle (hObject=0x90) returned 1 [0059.087] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32f.gif.wannacry")) returned 1 [0059.087] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1631, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR33B.GIF", cAlternateFileName="")) returned 1 [0059.089] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.089] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR33B.GIF") returned -1 [0059.089] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR33B.GIF") returned -1 [0059.089] lstrcmpiA (lpString1="", lpString2="PDIR33B.GIF") returned -1 [0059.089] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF") returned="PDIR32F.GIF" [0059.089] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.089] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.089] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.089] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.089] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR33B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF" [0059.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF", pszSpec="*.zip") returned 0 [0059.089] lstrlenA (lpString="*.zip") returned 5 [0059.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF", pszSpec="*.rar") returned 0 [0059.089] lstrlenA (lpString="*.rar") returned 5 [0059.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF", pszSpec="*.7z") returned 0 [0059.089] lstrlenA (lpString="*.7z") returned 4 [0059.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF", pszSpec="*.tar") returned 0 [0059.089] lstrlenA (lpString="*.tar") returned 5 [0059.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF", pszSpec="*.gzip") returned 0 [0059.089] lstrlenA (lpString="*.gzip") returned 6 [0059.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF", pszSpec="*.jpg") returned 0 [0059.089] lstrlenA (lpString="*.jpg") returned 5 [0059.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF", pszSpec="*.jpeg") returned 0 [0059.089] lstrlenA (lpString="*.jpeg") returned 6 [0059.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF", pszSpec="*.psd") returned 0 [0059.090] lstrlenA (lpString="*.psd") returned 5 [0059.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF", pszSpec="*.gif") returned 1 [0059.090] lstrlenA (lpString="*.gif") returned 5 [0059.090] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF" [0059.090] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF" [0059.090] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF." [0059.090] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF.wannacry" [0059.090] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.090] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1631 [0059.090] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb0cfb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.090] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.090] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x15b3, lpOverlapped=0x0) returned 1 [0059.092] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF") returned="PDIR33B.GIF" [0059.092] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.092] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x15b3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x15b3, lpOverlapped=0x0) returned 1 [0059.092] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.092] CloseHandle (hObject=0x90) returned 1 [0059.092] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33b.gif.wannacry")) returned 1 [0059.093] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2d13, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR33F.GIF", cAlternateFileName="")) returned 1 [0059.093] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.093] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR33F.GIF") returned -1 [0059.093] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR33F.GIF") returned -1 [0059.093] lstrcmpiA (lpString1="", lpString2="PDIR33F.GIF") returned -1 [0059.093] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF") returned="PDIR33B.GIF" [0059.093] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.093] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.093] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.093] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.093] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR33F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF" [0059.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF", pszSpec="*.zip") returned 0 [0059.093] lstrlenA (lpString="*.zip") returned 5 [0059.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF", pszSpec="*.rar") returned 0 [0059.093] lstrlenA (lpString="*.rar") returned 5 [0059.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF", pszSpec="*.7z") returned 0 [0059.093] lstrlenA (lpString="*.7z") returned 4 [0059.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF", pszSpec="*.tar") returned 0 [0059.093] lstrlenA (lpString="*.tar") returned 5 [0059.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF", pszSpec="*.gzip") returned 0 [0059.093] lstrlenA (lpString="*.gzip") returned 6 [0059.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF", pszSpec="*.jpg") returned 0 [0059.093] lstrlenA (lpString="*.jpg") returned 5 [0059.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF", pszSpec="*.jpeg") returned 0 [0059.094] lstrlenA (lpString="*.jpeg") returned 6 [0059.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF", pszSpec="*.psd") returned 0 [0059.094] lstrlenA (lpString="*.psd") returned 5 [0059.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF", pszSpec="*.gif") returned 1 [0059.094] lstrlenA (lpString="*.gif") returned 5 [0059.094] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF" [0059.094] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF" [0059.094] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF." [0059.094] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF.wannacry" [0059.094] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.094] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d13 [0059.094] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb0cfb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.094] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.094] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2c95, lpOverlapped=0x0) returned 1 [0059.098] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF") returned="PDIR33F.GIF" [0059.098] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.098] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2c95, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2c95, lpOverlapped=0x0) returned 1 [0059.098] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.099] CloseHandle (hObject=0x90) returned 1 [0059.099] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33f.gif.wannacry")) returned 1 [0059.099] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1179, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR34B.GIF", cAlternateFileName="")) returned 1 [0059.099] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.099] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR34B.GIF") returned -1 [0059.099] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR34B.GIF") returned -1 [0059.099] lstrcmpiA (lpString1="", lpString2="PDIR34B.GIF") returned -1 [0059.099] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF") returned="PDIR33F.GIF" [0059.099] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.099] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.100] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.100] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.100] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR34B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF" [0059.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF", pszSpec="*.zip") returned 0 [0059.100] lstrlenA (lpString="*.zip") returned 5 [0059.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF", pszSpec="*.rar") returned 0 [0059.100] lstrlenA (lpString="*.rar") returned 5 [0059.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF", pszSpec="*.7z") returned 0 [0059.100] lstrlenA (lpString="*.7z") returned 4 [0059.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF", pszSpec="*.tar") returned 0 [0059.100] lstrlenA (lpString="*.tar") returned 5 [0059.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF", pszSpec="*.gzip") returned 0 [0059.100] lstrlenA (lpString="*.gzip") returned 6 [0059.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF", pszSpec="*.jpg") returned 0 [0059.100] lstrlenA (lpString="*.jpg") returned 5 [0059.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF", pszSpec="*.jpeg") returned 0 [0059.100] lstrlenA (lpString="*.jpeg") returned 6 [0059.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF", pszSpec="*.psd") returned 0 [0059.100] lstrlenA (lpString="*.psd") returned 5 [0059.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF", pszSpec="*.gif") returned 1 [0059.100] lstrlenA (lpString="*.gif") returned 5 [0059.100] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF" [0059.100] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF" [0059.100] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF." [0059.100] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF.wannacry" [0059.100] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.101] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1179 [0059.101] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb0cfb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.101] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.101] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x10fb, lpOverlapped=0x0) returned 1 [0059.103] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF") returned="PDIR34B.GIF" [0059.103] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.103] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x10fb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x10fb, lpOverlapped=0x0) returned 1 [0059.103] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.103] CloseHandle (hObject=0x90) returned 1 [0059.103] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34b.gif.wannacry")) returned 1 [0059.104] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x95dd, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR34F.GIF", cAlternateFileName="")) returned 1 [0059.104] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.104] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR34F.GIF") returned -1 [0059.104] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR34F.GIF") returned -1 [0059.104] lstrcmpiA (lpString1="", lpString2="PDIR34F.GIF") returned -1 [0059.104] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF") returned="PDIR34B.GIF" [0059.104] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.104] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.104] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.104] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.104] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR34F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF" [0059.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF", pszSpec="*.zip") returned 0 [0059.104] lstrlenA (lpString="*.zip") returned 5 [0059.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF", pszSpec="*.rar") returned 0 [0059.104] lstrlenA (lpString="*.rar") returned 5 [0059.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF", pszSpec="*.7z") returned 0 [0059.104] lstrlenA (lpString="*.7z") returned 4 [0059.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF", pszSpec="*.tar") returned 0 [0059.104] lstrlenA (lpString="*.tar") returned 5 [0059.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF", pszSpec="*.gzip") returned 0 [0059.105] lstrlenA (lpString="*.gzip") returned 6 [0059.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF", pszSpec="*.jpg") returned 0 [0059.105] lstrlenA (lpString="*.jpg") returned 5 [0059.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF", pszSpec="*.jpeg") returned 0 [0059.105] lstrlenA (lpString="*.jpeg") returned 6 [0059.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF", pszSpec="*.psd") returned 0 [0059.105] lstrlenA (lpString="*.psd") returned 5 [0059.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF", pszSpec="*.gif") returned 1 [0059.105] lstrlenA (lpString="*.gif") returned 5 [0059.105] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF" [0059.105] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF" [0059.105] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF." [0059.105] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF.wannacry" [0059.105] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.106] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x95dd [0059.106] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb0cfb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.106] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.106] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x955f, lpOverlapped=0x0) returned 1 [0059.107] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF") returned="PDIR34F.GIF" [0059.107] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.108] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x955f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x955f, lpOverlapped=0x0) returned 1 [0059.108] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.108] CloseHandle (hObject=0x90) returned 1 [0059.108] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34f.gif.wannacry")) returned 1 [0059.108] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x11ec, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR35B.GIF", cAlternateFileName="")) returned 1 [0059.108] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.108] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR35B.GIF") returned -1 [0059.109] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR35B.GIF") returned -1 [0059.109] lstrcmpiA (lpString1="", lpString2="PDIR35B.GIF") returned -1 [0059.109] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF") returned="PDIR34F.GIF" [0059.109] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.109] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.109] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.109] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.109] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR35B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF" [0059.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF", pszSpec="*.zip") returned 0 [0059.109] lstrlenA (lpString="*.zip") returned 5 [0059.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF", pszSpec="*.rar") returned 0 [0059.109] lstrlenA (lpString="*.rar") returned 5 [0059.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF", pszSpec="*.7z") returned 0 [0059.109] lstrlenA (lpString="*.7z") returned 4 [0059.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF", pszSpec="*.tar") returned 0 [0059.109] lstrlenA (lpString="*.tar") returned 5 [0059.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF", pszSpec="*.gzip") returned 0 [0059.109] lstrlenA (lpString="*.gzip") returned 6 [0059.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF", pszSpec="*.jpg") returned 0 [0059.109] lstrlenA (lpString="*.jpg") returned 5 [0059.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF", pszSpec="*.jpeg") returned 0 [0059.109] lstrlenA (lpString="*.jpeg") returned 6 [0059.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF", pszSpec="*.psd") returned 0 [0059.109] lstrlenA (lpString="*.psd") returned 5 [0059.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF", pszSpec="*.gif") returned 1 [0059.109] lstrlenA (lpString="*.gif") returned 5 [0059.109] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF" [0059.109] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF" [0059.109] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF." [0059.109] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF.wannacry" [0059.110] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.110] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11ec [0059.110] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb0cfb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.110] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.110] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x116e, lpOverlapped=0x0) returned 1 [0059.111] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF") returned="PDIR35B.GIF" [0059.112] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.112] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x116e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x116e, lpOverlapped=0x0) returned 1 [0059.112] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.112] CloseHandle (hObject=0x90) returned 1 [0059.112] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35b.gif.wannacry")) returned 1 [0059.112] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2bb6, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR35F.GIF", cAlternateFileName="")) returned 1 [0059.112] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.112] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR35F.GIF") returned -1 [0059.112] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR35F.GIF") returned -1 [0059.112] lstrcmpiA (lpString1="", lpString2="PDIR35F.GIF") returned -1 [0059.113] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF") returned="PDIR35B.GIF" [0059.113] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.113] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.113] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.113] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.113] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR35F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF" [0059.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF", pszSpec="*.zip") returned 0 [0059.113] lstrlenA (lpString="*.zip") returned 5 [0059.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF", pszSpec="*.rar") returned 0 [0059.113] lstrlenA (lpString="*.rar") returned 5 [0059.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF", pszSpec="*.7z") returned 0 [0059.113] lstrlenA (lpString="*.7z") returned 4 [0059.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF", pszSpec="*.tar") returned 0 [0059.113] lstrlenA (lpString="*.tar") returned 5 [0059.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF", pszSpec="*.gzip") returned 0 [0059.113] lstrlenA (lpString="*.gzip") returned 6 [0059.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF", pszSpec="*.jpg") returned 0 [0059.113] lstrlenA (lpString="*.jpg") returned 5 [0059.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF", pszSpec="*.jpeg") returned 0 [0059.113] lstrlenA (lpString="*.jpeg") returned 6 [0059.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF", pszSpec="*.psd") returned 0 [0059.113] lstrlenA (lpString="*.psd") returned 5 [0059.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF", pszSpec="*.gif") returned 1 [0059.113] lstrlenA (lpString="*.gif") returned 5 [0059.113] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF" [0059.113] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF" [0059.113] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF." [0059.113] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF.wannacry" [0059.113] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.114] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2bb6 [0059.114] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb0cfb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.114] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.114] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2b38, lpOverlapped=0x0) returned 1 [0059.116] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF") returned="PDIR35F.GIF" [0059.116] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.116] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2b38, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2b38, lpOverlapped=0x0) returned 1 [0059.116] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.116] CloseHandle (hObject=0x90) returned 1 [0059.116] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35f.gif.wannacry")) returned 1 [0059.116] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x23e1, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR36B.GIF", cAlternateFileName="")) returned 1 [0059.116] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.117] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR36B.GIF") returned -1 [0059.117] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR36B.GIF") returned -1 [0059.117] lstrcmpiA (lpString1="", lpString2="PDIR36B.GIF") returned -1 [0059.117] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF") returned="PDIR35F.GIF" [0059.117] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.117] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.117] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.117] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.117] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR36B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF" [0059.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF", pszSpec="*.zip") returned 0 [0059.117] lstrlenA (lpString="*.zip") returned 5 [0059.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF", pszSpec="*.rar") returned 0 [0059.117] lstrlenA (lpString="*.rar") returned 5 [0059.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF", pszSpec="*.7z") returned 0 [0059.117] lstrlenA (lpString="*.7z") returned 4 [0059.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF", pszSpec="*.tar") returned 0 [0059.117] lstrlenA (lpString="*.tar") returned 5 [0059.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF", pszSpec="*.gzip") returned 0 [0059.117] lstrlenA (lpString="*.gzip") returned 6 [0059.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF", pszSpec="*.jpg") returned 0 [0059.117] lstrlenA (lpString="*.jpg") returned 5 [0059.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF", pszSpec="*.jpeg") returned 0 [0059.117] lstrlenA (lpString="*.jpeg") returned 6 [0059.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF", pszSpec="*.psd") returned 0 [0059.117] lstrlenA (lpString="*.psd") returned 5 [0059.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF", pszSpec="*.gif") returned 1 [0059.117] lstrlenA (lpString="*.gif") returned 5 [0059.117] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF" [0059.118] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF" [0059.118] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF." [0059.118] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF.wannacry" [0059.118] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.118] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23e1 [0059.118] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb0cfb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.118] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.118] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2363, lpOverlapped=0x0) returned 1 [0059.120] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF") returned="PDIR36B.GIF" [0059.120] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.120] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2363, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2363, lpOverlapped=0x0) returned 1 [0059.121] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.121] CloseHandle (hObject=0x90) returned 1 [0059.121] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36b.gif.wannacry")) returned 1 [0059.121] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8fd7, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR36F.GIF", cAlternateFileName="")) returned 1 [0059.121] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.121] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR36F.GIF") returned -1 [0059.121] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR36F.GIF") returned -1 [0059.121] lstrcmpiA (lpString1="", lpString2="PDIR36F.GIF") returned -1 [0059.121] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF") returned="PDIR36B.GIF" [0059.122] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.122] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.122] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.122] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.122] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR36F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF" [0059.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF", pszSpec="*.zip") returned 0 [0059.122] lstrlenA (lpString="*.zip") returned 5 [0059.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF", pszSpec="*.rar") returned 0 [0059.122] lstrlenA (lpString="*.rar") returned 5 [0059.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF", pszSpec="*.7z") returned 0 [0059.122] lstrlenA (lpString="*.7z") returned 4 [0059.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF", pszSpec="*.tar") returned 0 [0059.122] lstrlenA (lpString="*.tar") returned 5 [0059.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF", pszSpec="*.gzip") returned 0 [0059.122] lstrlenA (lpString="*.gzip") returned 6 [0059.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF", pszSpec="*.jpg") returned 0 [0059.122] lstrlenA (lpString="*.jpg") returned 5 [0059.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF", pszSpec="*.jpeg") returned 0 [0059.122] lstrlenA (lpString="*.jpeg") returned 6 [0059.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF", pszSpec="*.psd") returned 0 [0059.122] lstrlenA (lpString="*.psd") returned 5 [0059.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF", pszSpec="*.gif") returned 1 [0059.122] lstrlenA (lpString="*.gif") returned 5 [0059.122] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF" [0059.122] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF" [0059.122] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF." [0059.122] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF.wannacry" [0059.122] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.123] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8fd7 [0059.123] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb0cfb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.123] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.123] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x8f59, lpOverlapped=0x0) returned 1 [0059.125] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF") returned="PDIR36F.GIF" [0059.125] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.125] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x8f59, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x8f59, lpOverlapped=0x0) returned 1 [0059.126] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.126] CloseHandle (hObject=0x90) returned 1 [0059.126] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36f.gif.wannacry")) returned 1 [0059.126] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xd4a3, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR37F.GIF", cAlternateFileName="")) returned 1 [0059.126] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.126] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR37F.GIF") returned -1 [0059.126] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR37F.GIF") returned -1 [0059.126] lstrcmpiA (lpString1="", lpString2="PDIR37F.GIF") returned -1 [0059.126] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF") returned="PDIR36F.GIF" [0059.127] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.127] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.127] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.127] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.127] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR37F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF" [0059.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF", pszSpec="*.zip") returned 0 [0059.127] lstrlenA (lpString="*.zip") returned 5 [0059.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF", pszSpec="*.rar") returned 0 [0059.127] lstrlenA (lpString="*.rar") returned 5 [0059.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF", pszSpec="*.7z") returned 0 [0059.127] lstrlenA (lpString="*.7z") returned 4 [0059.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF", pszSpec="*.tar") returned 0 [0059.127] lstrlenA (lpString="*.tar") returned 5 [0059.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF", pszSpec="*.gzip") returned 0 [0059.127] lstrlenA (lpString="*.gzip") returned 6 [0059.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF", pszSpec="*.jpg") returned 0 [0059.127] lstrlenA (lpString="*.jpg") returned 5 [0059.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF", pszSpec="*.jpeg") returned 0 [0059.127] lstrlenA (lpString="*.jpeg") returned 6 [0059.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF", pszSpec="*.psd") returned 0 [0059.127] lstrlenA (lpString="*.psd") returned 5 [0059.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF", pszSpec="*.gif") returned 1 [0059.127] lstrlenA (lpString="*.gif") returned 5 [0059.127] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF" [0059.127] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF" [0059.127] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF." [0059.127] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF.wannacry" [0059.127] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir37f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.128] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd4a3 [0059.128] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb0cfb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.128] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.128] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd425, lpOverlapped=0x0) returned 1 [0059.130] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF") returned="PDIR37F.GIF" [0059.130] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.130] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd425, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd425, lpOverlapped=0x0) returned 1 [0059.130] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.130] CloseHandle (hObject=0x90) returned 1 [0059.131] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir37f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir37f.gif.wannacry")) returned 1 [0059.131] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xb819, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR38F.GIF", cAlternateFileName="")) returned 1 [0059.131] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.131] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR38F.GIF") returned -1 [0059.131] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR38F.GIF") returned -1 [0059.131] lstrcmpiA (lpString1="", lpString2="PDIR38F.GIF") returned -1 [0059.131] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF") returned="PDIR37F.GIF" [0059.131] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.131] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.131] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.131] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.131] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR38F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF" [0059.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF", pszSpec="*.zip") returned 0 [0059.132] lstrlenA (lpString="*.zip") returned 5 [0059.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF", pszSpec="*.rar") returned 0 [0059.132] lstrlenA (lpString="*.rar") returned 5 [0059.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF", pszSpec="*.7z") returned 0 [0059.132] lstrlenA (lpString="*.7z") returned 4 [0059.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF", pszSpec="*.tar") returned 0 [0059.132] lstrlenA (lpString="*.tar") returned 5 [0059.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF", pszSpec="*.gzip") returned 0 [0059.132] lstrlenA (lpString="*.gzip") returned 6 [0059.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF", pszSpec="*.jpg") returned 0 [0059.132] lstrlenA (lpString="*.jpg") returned 5 [0059.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF", pszSpec="*.jpeg") returned 0 [0059.132] lstrlenA (lpString="*.jpeg") returned 6 [0059.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF", pszSpec="*.psd") returned 0 [0059.132] lstrlenA (lpString="*.psd") returned 5 [0059.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF", pszSpec="*.gif") returned 1 [0059.132] lstrlenA (lpString="*.gif") returned 5 [0059.132] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF" [0059.132] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF" [0059.132] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF." [0059.132] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF.wannacry" [0059.132] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir38f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.133] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb819 [0059.133] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb0cfb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.133] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.133] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xb79b, lpOverlapped=0x0) returned 1 [0059.135] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF") returned="PDIR38F.GIF" [0059.135] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.136] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xb79b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xb79b, lpOverlapped=0x0) returned 1 [0059.136] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.136] CloseHandle (hObject=0x90) returned 1 [0059.136] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir38f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir38f.gif.wannacry")) returned 1 [0059.137] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xaf65, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR39F.GIF", cAlternateFileName="")) returned 1 [0059.137] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.137] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR39F.GIF") returned -1 [0059.137] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR39F.GIF") returned -1 [0059.137] lstrcmpiA (lpString1="", lpString2="PDIR39F.GIF") returned -1 [0059.137] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF") returned="PDIR38F.GIF" [0059.137] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.137] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.137] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.137] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.137] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR39F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF" [0059.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF", pszSpec="*.zip") returned 0 [0059.138] lstrlenA (lpString="*.zip") returned 5 [0059.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF", pszSpec="*.rar") returned 0 [0059.138] lstrlenA (lpString="*.rar") returned 5 [0059.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF", pszSpec="*.7z") returned 0 [0059.138] lstrlenA (lpString="*.7z") returned 4 [0059.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF", pszSpec="*.tar") returned 0 [0059.138] lstrlenA (lpString="*.tar") returned 5 [0059.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF", pszSpec="*.gzip") returned 0 [0059.138] lstrlenA (lpString="*.gzip") returned 6 [0059.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF", pszSpec="*.jpg") returned 0 [0059.138] lstrlenA (lpString="*.jpg") returned 5 [0059.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF", pszSpec="*.jpeg") returned 0 [0059.138] lstrlenA (lpString="*.jpeg") returned 6 [0059.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF", pszSpec="*.psd") returned 0 [0059.138] lstrlenA (lpString="*.psd") returned 5 [0059.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF", pszSpec="*.gif") returned 1 [0059.138] lstrlenA (lpString="*.gif") returned 5 [0059.138] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF" [0059.138] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF" [0059.138] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF." [0059.138] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF.wannacry" [0059.139] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir39f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.139] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaf65 [0059.139] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb33110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.139] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.139] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xaee7, lpOverlapped=0x0) returned 1 [0059.142] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF") returned="PDIR39F.GIF" [0059.142] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.142] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xaee7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xaee7, lpOverlapped=0x0) returned 1 [0059.142] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.142] CloseHandle (hObject=0x90) returned 1 [0059.142] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir39f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir39f.gif.wannacry")) returned 1 [0059.143] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2eda, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR3B.GIF", cAlternateFileName="")) returned 1 [0059.143] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.143] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR3B.GIF") returned -1 [0059.143] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR3B.GIF") returned -1 [0059.143] lstrcmpiA (lpString1="", lpString2="PDIR3B.GIF") returned -1 [0059.143] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF") returned="PDIR39F.GIF" [0059.144] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.144] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.144] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.144] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.144] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR3B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF" [0059.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF", pszSpec="*.zip") returned 0 [0059.144] lstrlenA (lpString="*.zip") returned 5 [0059.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF", pszSpec="*.rar") returned 0 [0059.144] lstrlenA (lpString="*.rar") returned 5 [0059.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF", pszSpec="*.7z") returned 0 [0059.144] lstrlenA (lpString="*.7z") returned 4 [0059.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF", pszSpec="*.tar") returned 0 [0059.144] lstrlenA (lpString="*.tar") returned 5 [0059.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF", pszSpec="*.gzip") returned 0 [0059.144] lstrlenA (lpString="*.gzip") returned 6 [0059.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF", pszSpec="*.jpg") returned 0 [0059.144] lstrlenA (lpString="*.jpg") returned 5 [0059.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF", pszSpec="*.jpeg") returned 0 [0059.144] lstrlenA (lpString="*.jpeg") returned 6 [0059.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF", pszSpec="*.psd") returned 0 [0059.144] lstrlenA (lpString="*.psd") returned 5 [0059.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF", pszSpec="*.gif") returned 1 [0059.145] lstrlenA (lpString="*.gif") returned 5 [0059.145] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF" [0059.145] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF" [0059.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF." [0059.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF.wannacry" [0059.145] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.146] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2eda [0059.146] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb33110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.146] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.146] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2e5c, lpOverlapped=0x0) returned 1 [0059.148] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF") returned="PDIR3B.GIF" [0059.148] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.148] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2e5c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2e5c, lpOverlapped=0x0) returned 1 [0059.148] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.149] CloseHandle (hObject=0x90) returned 1 [0059.149] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3b.gif.wannacry")) returned 1 [0059.149] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4647, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR3F.GIF", cAlternateFileName="")) returned 1 [0059.149] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.149] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR3F.GIF") returned -1 [0059.150] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR3F.GIF") returned -1 [0059.150] lstrcmpiA (lpString1="", lpString2="PDIR3F.GIF") returned -1 [0059.150] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF") returned="PDIR3B.GIF" [0059.150] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.150] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.150] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.150] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.150] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR3F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF" [0059.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF", pszSpec="*.zip") returned 0 [0059.150] lstrlenA (lpString="*.zip") returned 5 [0059.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF", pszSpec="*.rar") returned 0 [0059.150] lstrlenA (lpString="*.rar") returned 5 [0059.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF", pszSpec="*.7z") returned 0 [0059.150] lstrlenA (lpString="*.7z") returned 4 [0059.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF", pszSpec="*.tar") returned 0 [0059.151] lstrlenA (lpString="*.tar") returned 5 [0059.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF", pszSpec="*.gzip") returned 0 [0059.151] lstrlenA (lpString="*.gzip") returned 6 [0059.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF", pszSpec="*.jpg") returned 0 [0059.151] lstrlenA (lpString="*.jpg") returned 5 [0059.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF", pszSpec="*.jpeg") returned 0 [0059.151] lstrlenA (lpString="*.jpeg") returned 6 [0059.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF", pszSpec="*.psd") returned 0 [0059.151] lstrlenA (lpString="*.psd") returned 5 [0059.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF", pszSpec="*.gif") returned 1 [0059.151] lstrlenA (lpString="*.gif") returned 5 [0059.151] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF" [0059.151] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF" [0059.151] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF." [0059.151] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF.wannacry" [0059.151] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.152] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4647 [0059.152] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb33110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.152] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.152] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x45c9, lpOverlapped=0x0) returned 1 [0059.154] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF") returned="PDIR3F.GIF" [0059.154] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.154] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x45c9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x45c9, lpOverlapped=0x0) returned 1 [0059.155] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.155] CloseHandle (hObject=0x90) returned 1 [0059.155] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3f.gif.wannacry")) returned 1 [0059.156] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x10f19, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR40F.GIF", cAlternateFileName="")) returned 1 [0059.156] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.156] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR40F.GIF") returned -1 [0059.156] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR40F.GIF") returned -1 [0059.156] lstrcmpiA (lpString1="", lpString2="PDIR40F.GIF") returned -1 [0059.156] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF") returned="PDIR3F.GIF" [0059.156] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.156] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.156] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.156] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.156] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR40F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF" [0059.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF", pszSpec="*.zip") returned 0 [0059.156] lstrlenA (lpString="*.zip") returned 5 [0059.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF", pszSpec="*.rar") returned 0 [0059.156] lstrlenA (lpString="*.rar") returned 5 [0059.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF", pszSpec="*.7z") returned 0 [0059.156] lstrlenA (lpString="*.7z") returned 4 [0059.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF", pszSpec="*.tar") returned 0 [0059.156] lstrlenA (lpString="*.tar") returned 5 [0059.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF", pszSpec="*.gzip") returned 0 [0059.157] lstrlenA (lpString="*.gzip") returned 6 [0059.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF", pszSpec="*.jpg") returned 0 [0059.157] lstrlenA (lpString="*.jpg") returned 5 [0059.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF", pszSpec="*.jpeg") returned 0 [0059.157] lstrlenA (lpString="*.jpeg") returned 6 [0059.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF", pszSpec="*.psd") returned 0 [0059.157] lstrlenA (lpString="*.psd") returned 5 [0059.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF", pszSpec="*.gif") returned 1 [0059.157] lstrlenA (lpString="*.gif") returned 5 [0059.157] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF" [0059.157] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF" [0059.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF." [0059.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF.wannacry" [0059.157] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir40f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.158] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10f19 [0059.158] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb33110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.158] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.158] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x10e9b, lpOverlapped=0x0) returned 1 [0059.164] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF") returned="PDIR40F.GIF" [0059.164] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.164] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x10e9b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x10e9b, lpOverlapped=0x0) returned 1 [0059.164] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.164] CloseHandle (hObject=0x90) returned 1 [0059.165] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir40f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir40f.gif.wannacry")) returned 1 [0059.165] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x7d5b, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR41F.GIF", cAlternateFileName="")) returned 1 [0059.166] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.166] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR41F.GIF") returned -1 [0059.166] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR41F.GIF") returned -1 [0059.166] lstrcmpiA (lpString1="", lpString2="PDIR41F.GIF") returned -1 [0059.166] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF") returned="PDIR40F.GIF" [0059.166] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.166] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.166] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.166] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.166] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR41F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF" [0059.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF", pszSpec="*.zip") returned 0 [0059.166] lstrlenA (lpString="*.zip") returned 5 [0059.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF", pszSpec="*.rar") returned 0 [0059.166] lstrlenA (lpString="*.rar") returned 5 [0059.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF", pszSpec="*.7z") returned 0 [0059.166] lstrlenA (lpString="*.7z") returned 4 [0059.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF", pszSpec="*.tar") returned 0 [0059.166] lstrlenA (lpString="*.tar") returned 5 [0059.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF", pszSpec="*.gzip") returned 0 [0059.166] lstrlenA (lpString="*.gzip") returned 6 [0059.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF", pszSpec="*.jpg") returned 0 [0059.167] lstrlenA (lpString="*.jpg") returned 5 [0059.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF", pszSpec="*.jpeg") returned 0 [0059.167] lstrlenA (lpString="*.jpeg") returned 6 [0059.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF", pszSpec="*.psd") returned 0 [0059.167] lstrlenA (lpString="*.psd") returned 5 [0059.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF", pszSpec="*.gif") returned 1 [0059.167] lstrlenA (lpString="*.gif") returned 5 [0059.167] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF" [0059.167] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF" [0059.167] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF." [0059.167] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF.wannacry" [0059.167] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir41f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.168] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7d5b [0059.168] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb33110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.168] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.168] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x7cdd, lpOverlapped=0x0) returned 1 [0059.170] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF") returned="PDIR41F.GIF" [0059.170] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.170] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x7cdd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x7cdd, lpOverlapped=0x0) returned 1 [0059.171] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.171] CloseHandle (hObject=0x90) returned 1 [0059.171] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir41f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir41f.gif.wannacry")) returned 1 [0059.172] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xdf73, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR42F.GIF", cAlternateFileName="")) returned 1 [0059.172] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.172] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR42F.GIF") returned -1 [0059.172] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR42F.GIF") returned -1 [0059.172] lstrcmpiA (lpString1="", lpString2="PDIR42F.GIF") returned -1 [0059.172] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF") returned="PDIR41F.GIF" [0059.172] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.172] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.172] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.173] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.173] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR42F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF" [0059.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF", pszSpec="*.zip") returned 0 [0059.173] lstrlenA (lpString="*.zip") returned 5 [0059.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF", pszSpec="*.rar") returned 0 [0059.173] lstrlenA (lpString="*.rar") returned 5 [0059.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF", pszSpec="*.7z") returned 0 [0059.173] lstrlenA (lpString="*.7z") returned 4 [0059.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF", pszSpec="*.tar") returned 0 [0059.173] lstrlenA (lpString="*.tar") returned 5 [0059.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF", pszSpec="*.gzip") returned 0 [0059.173] lstrlenA (lpString="*.gzip") returned 6 [0059.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF", pszSpec="*.jpg") returned 0 [0059.173] lstrlenA (lpString="*.jpg") returned 5 [0059.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF", pszSpec="*.jpeg") returned 0 [0059.173] lstrlenA (lpString="*.jpeg") returned 6 [0059.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF", pszSpec="*.psd") returned 0 [0059.173] lstrlenA (lpString="*.psd") returned 5 [0059.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF", pszSpec="*.gif") returned 1 [0059.173] lstrlenA (lpString="*.gif") returned 5 [0059.173] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF" [0059.173] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF" [0059.174] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF." [0059.174] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF.wannacry" [0059.174] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir42f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.175] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdf73 [0059.175] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb33110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.175] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.175] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xdef5, lpOverlapped=0x0) returned 1 [0059.178] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF") returned="PDIR42F.GIF" [0059.178] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.178] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xdef5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xdef5, lpOverlapped=0x0) returned 1 [0059.178] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.178] CloseHandle (hObject=0x90) returned 1 [0059.178] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir42f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir42f.gif.wannacry")) returned 1 [0059.179] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xd2c, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR43B.GIF", cAlternateFileName="")) returned 1 [0059.179] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.179] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR43B.GIF") returned -1 [0059.179] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR43B.GIF") returned -1 [0059.179] lstrcmpiA (lpString1="", lpString2="PDIR43B.GIF") returned -1 [0059.179] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF") returned="PDIR42F.GIF" [0059.179] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.179] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.179] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.179] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.180] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR43B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF" [0059.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF", pszSpec="*.zip") returned 0 [0059.180] lstrlenA (lpString="*.zip") returned 5 [0059.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF", pszSpec="*.rar") returned 0 [0059.180] lstrlenA (lpString="*.rar") returned 5 [0059.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF", pszSpec="*.7z") returned 0 [0059.180] lstrlenA (lpString="*.7z") returned 4 [0059.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF", pszSpec="*.tar") returned 0 [0059.180] lstrlenA (lpString="*.tar") returned 5 [0059.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF", pszSpec="*.gzip") returned 0 [0059.180] lstrlenA (lpString="*.gzip") returned 6 [0059.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF", pszSpec="*.jpg") returned 0 [0059.180] lstrlenA (lpString="*.jpg") returned 5 [0059.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF", pszSpec="*.jpeg") returned 0 [0059.180] lstrlenA (lpString="*.jpeg") returned 6 [0059.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF", pszSpec="*.psd") returned 0 [0059.180] lstrlenA (lpString="*.psd") returned 5 [0059.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF", pszSpec="*.gif") returned 1 [0059.180] lstrlenA (lpString="*.gif") returned 5 [0059.180] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF" [0059.180] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF" [0059.180] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF." [0059.180] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF.wannacry" [0059.180] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.181] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd2c [0059.181] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb33110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.181] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.181] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xcae, lpOverlapped=0x0) returned 1 [0059.183] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF") returned="PDIR43B.GIF" [0059.183] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.183] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xcae, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xcae, lpOverlapped=0x0) returned 1 [0059.183] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.183] CloseHandle (hObject=0x90) returned 1 [0059.184] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43b.gif.wannacry")) returned 1 [0059.184] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa5e, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR43F.GIF", cAlternateFileName="")) returned 1 [0059.184] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.184] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR43F.GIF") returned -1 [0059.184] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR43F.GIF") returned -1 [0059.184] lstrcmpiA (lpString1="", lpString2="PDIR43F.GIF") returned -1 [0059.184] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF") returned="PDIR43B.GIF" [0059.185] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.185] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.185] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.185] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.185] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR43F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF" [0059.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF", pszSpec="*.zip") returned 0 [0059.185] lstrlenA (lpString="*.zip") returned 5 [0059.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF", pszSpec="*.rar") returned 0 [0059.185] lstrlenA (lpString="*.rar") returned 5 [0059.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF", pszSpec="*.7z") returned 0 [0059.185] lstrlenA (lpString="*.7z") returned 4 [0059.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF", pszSpec="*.tar") returned 0 [0059.185] lstrlenA (lpString="*.tar") returned 5 [0059.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF", pszSpec="*.gzip") returned 0 [0059.185] lstrlenA (lpString="*.gzip") returned 6 [0059.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF", pszSpec="*.jpg") returned 0 [0059.185] lstrlenA (lpString="*.jpg") returned 5 [0059.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF", pszSpec="*.jpeg") returned 0 [0059.185] lstrlenA (lpString="*.jpeg") returned 6 [0059.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF", pszSpec="*.psd") returned 0 [0059.185] lstrlenA (lpString="*.psd") returned 5 [0059.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF", pszSpec="*.gif") returned 1 [0059.185] lstrlenA (lpString="*.gif") returned 5 [0059.185] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF" [0059.185] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF" [0059.185] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF." [0059.185] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF.wannacry" [0059.185] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.186] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa5e [0059.186] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb33110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.186] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.186] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x9e0, lpOverlapped=0x0) returned 1 [0059.188] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF") returned="PDIR43F.GIF" [0059.188] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.188] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x9e0, lpOverlapped=0x0) returned 1 [0059.188] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.188] CloseHandle (hObject=0x90) returned 1 [0059.188] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43f.gif.wannacry")) returned 1 [0059.189] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3606, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR44B.GIF", cAlternateFileName="")) returned 1 [0059.189] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.189] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR44B.GIF") returned -1 [0059.189] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR44B.GIF") returned -1 [0059.189] lstrcmpiA (lpString1="", lpString2="PDIR44B.GIF") returned -1 [0059.189] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF") returned="PDIR43F.GIF" [0059.189] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.189] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.189] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.189] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.189] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR44B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF" [0059.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF", pszSpec="*.zip") returned 0 [0059.189] lstrlenA (lpString="*.zip") returned 5 [0059.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF", pszSpec="*.rar") returned 0 [0059.189] lstrlenA (lpString="*.rar") returned 5 [0059.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF", pszSpec="*.7z") returned 0 [0059.189] lstrlenA (lpString="*.7z") returned 4 [0059.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF", pszSpec="*.tar") returned 0 [0059.189] lstrlenA (lpString="*.tar") returned 5 [0059.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF", pszSpec="*.gzip") returned 0 [0059.189] lstrlenA (lpString="*.gzip") returned 6 [0059.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF", pszSpec="*.jpg") returned 0 [0059.189] lstrlenA (lpString="*.jpg") returned 5 [0059.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF", pszSpec="*.jpeg") returned 0 [0059.189] lstrlenA (lpString="*.jpeg") returned 6 [0059.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF", pszSpec="*.psd") returned 0 [0059.189] lstrlenA (lpString="*.psd") returned 5 [0059.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF", pszSpec="*.gif") returned 1 [0059.190] lstrlenA (lpString="*.gif") returned 5 [0059.190] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF" [0059.190] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF" [0059.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF." [0059.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF.wannacry" [0059.190] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.190] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3606 [0059.190] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb33110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.190] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.190] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3588, lpOverlapped=0x0) returned 1 [0059.192] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF") returned="PDIR44B.GIF" [0059.192] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.192] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3588, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3588, lpOverlapped=0x0) returned 1 [0059.195] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.195] CloseHandle (hObject=0x90) returned 1 [0059.195] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44b.gif.wannacry")) returned 1 [0059.195] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3026, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR44F.GIF", cAlternateFileName="")) returned 1 [0059.195] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.195] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR44F.GIF") returned -1 [0059.195] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR44F.GIF") returned -1 [0059.196] lstrcmpiA (lpString1="", lpString2="PDIR44F.GIF") returned -1 [0059.196] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF") returned="PDIR44B.GIF" [0059.196] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.196] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.196] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.196] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.196] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR44F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF" [0059.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF", pszSpec="*.zip") returned 0 [0059.196] lstrlenA (lpString="*.zip") returned 5 [0059.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF", pszSpec="*.rar") returned 0 [0059.196] lstrlenA (lpString="*.rar") returned 5 [0059.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF", pszSpec="*.7z") returned 0 [0059.196] lstrlenA (lpString="*.7z") returned 4 [0059.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF", pszSpec="*.tar") returned 0 [0059.196] lstrlenA (lpString="*.tar") returned 5 [0059.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF", pszSpec="*.gzip") returned 0 [0059.196] lstrlenA (lpString="*.gzip") returned 6 [0059.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF", pszSpec="*.jpg") returned 0 [0059.196] lstrlenA (lpString="*.jpg") returned 5 [0059.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF", pszSpec="*.jpeg") returned 0 [0059.196] lstrlenA (lpString="*.jpeg") returned 6 [0059.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF", pszSpec="*.psd") returned 0 [0059.196] lstrlenA (lpString="*.psd") returned 5 [0059.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF", pszSpec="*.gif") returned 1 [0059.197] lstrlenA (lpString="*.gif") returned 5 [0059.197] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF" [0059.197] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF" [0059.197] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF." [0059.197] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF.wannacry" [0059.197] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.198] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3026 [0059.198] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb33110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.198] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.198] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2fa8, lpOverlapped=0x0) returned 1 [0059.200] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF") returned="PDIR44F.GIF" [0059.200] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.200] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2fa8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2fa8, lpOverlapped=0x0) returned 1 [0059.200] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.200] CloseHandle (hObject=0x90) returned 1 [0059.200] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44f.gif.wannacry")) returned 1 [0059.200] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2019, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR45B.GIF", cAlternateFileName="")) returned 1 [0059.201] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.201] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR45B.GIF") returned -1 [0059.201] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR45B.GIF") returned -1 [0059.201] lstrcmpiA (lpString1="", lpString2="PDIR45B.GIF") returned -1 [0059.201] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF") returned="PDIR44F.GIF" [0059.201] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.201] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.201] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.201] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.201] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR45B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF" [0059.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF", pszSpec="*.zip") returned 0 [0059.201] lstrlenA (lpString="*.zip") returned 5 [0059.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF", pszSpec="*.rar") returned 0 [0059.201] lstrlenA (lpString="*.rar") returned 5 [0059.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF", pszSpec="*.7z") returned 0 [0059.201] lstrlenA (lpString="*.7z") returned 4 [0059.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF", pszSpec="*.tar") returned 0 [0059.201] lstrlenA (lpString="*.tar") returned 5 [0059.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF", pszSpec="*.gzip") returned 0 [0059.201] lstrlenA (lpString="*.gzip") returned 6 [0059.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF", pszSpec="*.jpg") returned 0 [0059.201] lstrlenA (lpString="*.jpg") returned 5 [0059.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF", pszSpec="*.jpeg") returned 0 [0059.201] lstrlenA (lpString="*.jpeg") returned 6 [0059.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF", pszSpec="*.psd") returned 0 [0059.201] lstrlenA (lpString="*.psd") returned 5 [0059.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF", pszSpec="*.gif") returned 1 [0059.201] lstrlenA (lpString="*.gif") returned 5 [0059.201] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF" [0059.201] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF" [0059.202] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF." [0059.202] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF.wannacry" [0059.202] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.202] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2019 [0059.202] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb33110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.202] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.202] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1f9b, lpOverlapped=0x0) returned 1 [0059.204] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF") returned="PDIR45B.GIF" [0059.204] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.204] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1f9b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1f9b, lpOverlapped=0x0) returned 1 [0059.204] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.204] CloseHandle (hObject=0x90) returned 1 [0059.204] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45b.gif.wannacry")) returned 1 [0059.206] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1ee9, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR45F.GIF", cAlternateFileName="")) returned 1 [0059.206] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.206] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR45F.GIF") returned -1 [0059.206] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR45F.GIF") returned -1 [0059.206] lstrcmpiA (lpString1="", lpString2="PDIR45F.GIF") returned -1 [0059.206] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF") returned="PDIR45B.GIF" [0059.206] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.206] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.206] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.206] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.206] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR45F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF" [0059.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF", pszSpec="*.zip") returned 0 [0059.206] lstrlenA (lpString="*.zip") returned 5 [0059.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF", pszSpec="*.rar") returned 0 [0059.206] lstrlenA (lpString="*.rar") returned 5 [0059.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF", pszSpec="*.7z") returned 0 [0059.206] lstrlenA (lpString="*.7z") returned 4 [0059.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF", pszSpec="*.tar") returned 0 [0059.206] lstrlenA (lpString="*.tar") returned 5 [0059.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF", pszSpec="*.gzip") returned 0 [0059.206] lstrlenA (lpString="*.gzip") returned 6 [0059.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF", pszSpec="*.jpg") returned 0 [0059.206] lstrlenA (lpString="*.jpg") returned 5 [0059.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF", pszSpec="*.jpeg") returned 0 [0059.206] lstrlenA (lpString="*.jpeg") returned 6 [0059.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF", pszSpec="*.psd") returned 0 [0059.206] lstrlenA (lpString="*.psd") returned 5 [0059.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF", pszSpec="*.gif") returned 1 [0059.206] lstrlenA (lpString="*.gif") returned 5 [0059.207] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF" [0059.207] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF" [0059.207] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF." [0059.207] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF.wannacry" [0059.207] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.207] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ee9 [0059.207] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb33110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.207] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.207] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1e6b, lpOverlapped=0x0) returned 1 [0059.209] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF") returned="PDIR45F.GIF" [0059.209] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.209] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1e6b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1e6b, lpOverlapped=0x0) returned 1 [0059.209] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.209] CloseHandle (hObject=0x90) returned 1 [0059.209] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45f.gif.wannacry")) returned 1 [0059.210] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1349, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR46B.GIF", cAlternateFileName="")) returned 1 [0059.210] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.210] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR46B.GIF") returned -1 [0059.210] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR46B.GIF") returned -1 [0059.210] lstrcmpiA (lpString1="", lpString2="PDIR46B.GIF") returned -1 [0059.210] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF") returned="PDIR45F.GIF" [0059.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.210] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.210] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.210] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.210] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR46B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF" [0059.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF", pszSpec="*.zip") returned 0 [0059.210] lstrlenA (lpString="*.zip") returned 5 [0059.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF", pszSpec="*.rar") returned 0 [0059.210] lstrlenA (lpString="*.rar") returned 5 [0059.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF", pszSpec="*.7z") returned 0 [0059.210] lstrlenA (lpString="*.7z") returned 4 [0059.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF", pszSpec="*.tar") returned 0 [0059.210] lstrlenA (lpString="*.tar") returned 5 [0059.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF", pszSpec="*.gzip") returned 0 [0059.210] lstrlenA (lpString="*.gzip") returned 6 [0059.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF", pszSpec="*.jpg") returned 0 [0059.210] lstrlenA (lpString="*.jpg") returned 5 [0059.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF", pszSpec="*.jpeg") returned 0 [0059.210] lstrlenA (lpString="*.jpeg") returned 6 [0059.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF", pszSpec="*.psd") returned 0 [0059.210] lstrlenA (lpString="*.psd") returned 5 [0059.210] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF", pszSpec="*.gif") returned 1 [0059.210] lstrlenA (lpString="*.gif") returned 5 [0059.210] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF" [0059.211] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF" [0059.211] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF." [0059.211] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF.wannacry" [0059.211] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.211] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1349 [0059.211] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb33110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.211] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.211] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x12cb, lpOverlapped=0x0) returned 1 [0059.212] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.213] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x12cb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x12cb, lpOverlapped=0x0) returned 1 [0059.213] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.213] CloseHandle (hObject=0x90) returned 1 [0059.213] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46b.gif.wannacry")) returned 1 [0059.213] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1377, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR46F.GIF", cAlternateFileName="")) returned 1 [0059.213] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.213] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR46F.GIF") returned -1 [0059.213] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR46F.GIF") returned -1 [0059.213] lstrcmpiA (lpString1="", lpString2="PDIR46F.GIF") returned -1 [0059.214] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.214] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.214] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.214] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.214] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR46F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF" [0059.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF", pszSpec="*.zip") returned 0 [0059.214] lstrlenA (lpString="*.zip") returned 5 [0059.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF", pszSpec="*.rar") returned 0 [0059.214] lstrlenA (lpString="*.rar") returned 5 [0059.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF", pszSpec="*.7z") returned 0 [0059.214] lstrlenA (lpString="*.7z") returned 4 [0059.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF", pszSpec="*.tar") returned 0 [0059.214] lstrlenA (lpString="*.tar") returned 5 [0059.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF", pszSpec="*.gzip") returned 0 [0059.214] lstrlenA (lpString="*.gzip") returned 6 [0059.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF", pszSpec="*.jpg") returned 0 [0059.214] lstrlenA (lpString="*.jpg") returned 5 [0059.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF", pszSpec="*.jpeg") returned 0 [0059.214] lstrlenA (lpString="*.jpeg") returned 6 [0059.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF", pszSpec="*.psd") returned 0 [0059.214] lstrlenA (lpString="*.psd") returned 5 [0059.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF", pszSpec="*.gif") returned 1 [0059.214] lstrlenA (lpString="*.gif") returned 5 [0059.214] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF" [0059.214] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF" [0059.214] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF." [0059.214] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF.wannacry" [0059.214] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.215] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1377 [0059.215] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb59270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.215] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.216] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x12f9, lpOverlapped=0x0) returned 1 [0059.217] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF") returned="PDIR46F.GIF" [0059.217] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.217] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x12f9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x12f9, lpOverlapped=0x0) returned 1 [0059.217] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.217] CloseHandle (hObject=0x90) returned 1 [0059.217] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46f.gif.wannacry")) returned 1 [0059.218] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x80d9, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR47B.GIF", cAlternateFileName="")) returned 1 [0059.218] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.218] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR47B.GIF") returned -1 [0059.218] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR47B.GIF") returned -1 [0059.218] lstrcmpiA (lpString1="", lpString2="PDIR47B.GIF") returned -1 [0059.218] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF") returned="PDIR46F.GIF" [0059.218] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.218] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.218] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.218] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.218] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR47B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF" [0059.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF", pszSpec="*.zip") returned 0 [0059.218] lstrlenA (lpString="*.zip") returned 5 [0059.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF", pszSpec="*.rar") returned 0 [0059.218] lstrlenA (lpString="*.rar") returned 5 [0059.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF", pszSpec="*.7z") returned 0 [0059.218] lstrlenA (lpString="*.7z") returned 4 [0059.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF", pszSpec="*.tar") returned 0 [0059.218] lstrlenA (lpString="*.tar") returned 5 [0059.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF", pszSpec="*.gzip") returned 0 [0059.218] lstrlenA (lpString="*.gzip") returned 6 [0059.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF", pszSpec="*.jpg") returned 0 [0059.218] lstrlenA (lpString="*.jpg") returned 5 [0059.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF", pszSpec="*.jpeg") returned 0 [0059.218] lstrlenA (lpString="*.jpeg") returned 6 [0059.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF", pszSpec="*.psd") returned 0 [0059.219] lstrlenA (lpString="*.psd") returned 5 [0059.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF", pszSpec="*.gif") returned 1 [0059.219] lstrlenA (lpString="*.gif") returned 5 [0059.219] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF" [0059.219] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF" [0059.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF." [0059.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF.wannacry" [0059.219] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.219] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x80d9 [0059.219] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb59270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.219] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.219] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x805b, lpOverlapped=0x0) returned 1 [0059.221] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF") returned="PDIR47B.GIF" [0059.221] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.221] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x805b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x805b, lpOverlapped=0x0) returned 1 [0059.221] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.221] CloseHandle (hObject=0x90) returned 1 [0059.221] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47b.gif.wannacry")) returned 1 [0059.222] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3ae8, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR47F.GIF", cAlternateFileName="")) returned 1 [0059.222] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.222] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR47F.GIF") returned -1 [0059.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR47F.GIF") returned -1 [0059.222] lstrcmpiA (lpString1="", lpString2="PDIR47F.GIF") returned -1 [0059.222] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF") returned="PDIR47B.GIF" [0059.222] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.222] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.222] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.222] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.222] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR47F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF" [0059.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF", pszSpec="*.zip") returned 0 [0059.222] lstrlenA (lpString="*.zip") returned 5 [0059.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF", pszSpec="*.rar") returned 0 [0059.222] lstrlenA (lpString="*.rar") returned 5 [0059.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF", pszSpec="*.7z") returned 0 [0059.222] lstrlenA (lpString="*.7z") returned 4 [0059.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF", pszSpec="*.tar") returned 0 [0059.222] lstrlenA (lpString="*.tar") returned 5 [0059.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF", pszSpec="*.gzip") returned 0 [0059.223] lstrlenA (lpString="*.gzip") returned 6 [0059.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF", pszSpec="*.jpg") returned 0 [0059.223] lstrlenA (lpString="*.jpg") returned 5 [0059.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF", pszSpec="*.jpeg") returned 0 [0059.223] lstrlenA (lpString="*.jpeg") returned 6 [0059.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF", pszSpec="*.psd") returned 0 [0059.223] lstrlenA (lpString="*.psd") returned 5 [0059.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF", pszSpec="*.gif") returned 1 [0059.223] lstrlenA (lpString="*.gif") returned 5 [0059.223] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF" [0059.223] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF" [0059.223] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF." [0059.223] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF.wannacry" [0059.223] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.223] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ae8 [0059.223] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb59270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.223] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.223] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3a6a, lpOverlapped=0x0) returned 1 [0059.227] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF") returned="PDIR47F.GIF" [0059.227] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.227] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3a6a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3a6a, lpOverlapped=0x0) returned 1 [0059.227] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.227] CloseHandle (hObject=0x90) returned 1 [0059.228] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47f.gif.wannacry")) returned 1 [0059.228] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2b53, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR48B.GIF", cAlternateFileName="")) returned 1 [0059.228] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.228] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR48B.GIF") returned -1 [0059.228] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR48B.GIF") returned -1 [0059.228] lstrcmpiA (lpString1="", lpString2="PDIR48B.GIF") returned -1 [0059.228] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF") returned="PDIR47F.GIF" [0059.228] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.228] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.228] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.228] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.228] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR48B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF" [0059.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF", pszSpec="*.zip") returned 0 [0059.229] lstrlenA (lpString="*.zip") returned 5 [0059.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF", pszSpec="*.rar") returned 0 [0059.229] lstrlenA (lpString="*.rar") returned 5 [0059.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF", pszSpec="*.7z") returned 0 [0059.229] lstrlenA (lpString="*.7z") returned 4 [0059.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF", pszSpec="*.tar") returned 0 [0059.229] lstrlenA (lpString="*.tar") returned 5 [0059.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF", pszSpec="*.gzip") returned 0 [0059.229] lstrlenA (lpString="*.gzip") returned 6 [0059.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF", pszSpec="*.jpg") returned 0 [0059.229] lstrlenA (lpString="*.jpg") returned 5 [0059.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF", pszSpec="*.jpeg") returned 0 [0059.229] lstrlenA (lpString="*.jpeg") returned 6 [0059.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF", pszSpec="*.psd") returned 0 [0059.229] lstrlenA (lpString="*.psd") returned 5 [0059.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF", pszSpec="*.gif") returned 1 [0059.229] lstrlenA (lpString="*.gif") returned 5 [0059.229] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF" [0059.229] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF" [0059.229] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF." [0059.229] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF.wannacry" [0059.229] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.230] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b53 [0059.230] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb59270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.230] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.230] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2ad5, lpOverlapped=0x0) returned 1 [0059.231] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF") returned="PDIR48B.GIF" [0059.231] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.231] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2ad5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2ad5, lpOverlapped=0x0) returned 1 [0059.232] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.232] CloseHandle (hObject=0x90) returned 1 [0059.232] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48b.gif.wannacry")) returned 1 [0059.232] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x178c, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR48F.GIF", cAlternateFileName="")) returned 1 [0059.232] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.232] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR48F.GIF") returned -1 [0059.232] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR48F.GIF") returned -1 [0059.232] lstrcmpiA (lpString1="", lpString2="PDIR48F.GIF") returned -1 [0059.232] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF") returned="PDIR48B.GIF" [0059.232] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.232] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.233] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.233] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.233] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR48F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF" [0059.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF", pszSpec="*.zip") returned 0 [0059.233] lstrlenA (lpString="*.zip") returned 5 [0059.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF", pszSpec="*.rar") returned 0 [0059.233] lstrlenA (lpString="*.rar") returned 5 [0059.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF", pszSpec="*.7z") returned 0 [0059.233] lstrlenA (lpString="*.7z") returned 4 [0059.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF", pszSpec="*.tar") returned 0 [0059.233] lstrlenA (lpString="*.tar") returned 5 [0059.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF", pszSpec="*.gzip") returned 0 [0059.233] lstrlenA (lpString="*.gzip") returned 6 [0059.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF", pszSpec="*.jpg") returned 0 [0059.233] lstrlenA (lpString="*.jpg") returned 5 [0059.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF", pszSpec="*.jpeg") returned 0 [0059.233] lstrlenA (lpString="*.jpeg") returned 6 [0059.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF", pszSpec="*.psd") returned 0 [0059.233] lstrlenA (lpString="*.psd") returned 5 [0059.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF", pszSpec="*.gif") returned 1 [0059.233] lstrlenA (lpString="*.gif") returned 5 [0059.233] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF" [0059.233] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF" [0059.233] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF." [0059.233] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF.wannacry" [0059.233] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.234] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x178c [0059.234] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb59270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.234] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.234] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x170e, lpOverlapped=0x0) returned 1 [0059.236] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF") returned="PDIR48F.GIF" [0059.236] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.236] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x170e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x170e, lpOverlapped=0x0) returned 1 [0059.236] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.236] CloseHandle (hObject=0x90) returned 1 [0059.236] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48f.gif.wannacry")) returned 1 [0059.237] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4a66, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR49B.GIF", cAlternateFileName="")) returned 1 [0059.237] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.237] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR49B.GIF") returned -1 [0059.237] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR49B.GIF") returned -1 [0059.237] lstrcmpiA (lpString1="", lpString2="PDIR49B.GIF") returned -1 [0059.237] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF") returned="PDIR48F.GIF" [0059.237] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.237] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.237] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.237] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.237] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR49B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF" [0059.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF", pszSpec="*.zip") returned 0 [0059.237] lstrlenA (lpString="*.zip") returned 5 [0059.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF", pszSpec="*.rar") returned 0 [0059.237] lstrlenA (lpString="*.rar") returned 5 [0059.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF", pszSpec="*.7z") returned 0 [0059.237] lstrlenA (lpString="*.7z") returned 4 [0059.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF", pszSpec="*.tar") returned 0 [0059.237] lstrlenA (lpString="*.tar") returned 5 [0059.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF", pszSpec="*.gzip") returned 0 [0059.238] lstrlenA (lpString="*.gzip") returned 6 [0059.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF", pszSpec="*.jpg") returned 0 [0059.238] lstrlenA (lpString="*.jpg") returned 5 [0059.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF", pszSpec="*.jpeg") returned 0 [0059.238] lstrlenA (lpString="*.jpeg") returned 6 [0059.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF", pszSpec="*.psd") returned 0 [0059.238] lstrlenA (lpString="*.psd") returned 5 [0059.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF", pszSpec="*.gif") returned 1 [0059.238] lstrlenA (lpString="*.gif") returned 5 [0059.238] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF" [0059.238] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF" [0059.238] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF." [0059.238] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF.wannacry" [0059.238] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.238] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4a66 [0059.238] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb59270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.238] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.238] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x49e8, lpOverlapped=0x0) returned 1 [0059.240] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF") returned="PDIR49B.GIF" [0059.240] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.240] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x49e8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x49e8, lpOverlapped=0x0) returned 1 [0059.240] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.240] CloseHandle (hObject=0x90) returned 1 [0059.240] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49b.gif.wannacry")) returned 1 [0059.241] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x32b6, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR49F.GIF", cAlternateFileName="")) returned 1 [0059.241] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.241] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR49F.GIF") returned -1 [0059.241] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR49F.GIF") returned -1 [0059.241] lstrcmpiA (lpString1="", lpString2="PDIR49F.GIF") returned -1 [0059.241] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF") returned="PDIR49B.GIF" [0059.241] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.241] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.241] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.241] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.242] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR49F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF" [0059.242] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF", pszSpec="*.zip") returned 0 [0059.242] lstrlenA (lpString="*.zip") returned 5 [0059.242] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF", pszSpec="*.rar") returned 0 [0059.242] lstrlenA (lpString="*.rar") returned 5 [0059.242] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF", pszSpec="*.7z") returned 0 [0059.242] lstrlenA (lpString="*.7z") returned 4 [0059.242] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF", pszSpec="*.tar") returned 0 [0059.242] lstrlenA (lpString="*.tar") returned 5 [0059.242] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF", pszSpec="*.gzip") returned 0 [0059.242] lstrlenA (lpString="*.gzip") returned 6 [0059.242] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF", pszSpec="*.jpg") returned 0 [0059.242] lstrlenA (lpString="*.jpg") returned 5 [0059.242] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF", pszSpec="*.jpeg") returned 0 [0059.242] lstrlenA (lpString="*.jpeg") returned 6 [0059.242] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF", pszSpec="*.psd") returned 0 [0059.242] lstrlenA (lpString="*.psd") returned 5 [0059.242] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF", pszSpec="*.gif") returned 1 [0059.242] lstrlenA (lpString="*.gif") returned 5 [0059.242] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF" [0059.242] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF" [0059.242] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF." [0059.242] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF.wannacry" [0059.242] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.243] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x32b6 [0059.243] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb59270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.243] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.243] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3238, lpOverlapped=0x0) returned 1 [0059.245] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF") returned="PDIR49F.GIF" [0059.245] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.245] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3238, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3238, lpOverlapped=0x0) returned 1 [0059.245] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.245] CloseHandle (hObject=0x90) returned 1 [0059.245] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49f.gif.wannacry")) returned 1 [0059.246] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2a01, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR4B.GIF", cAlternateFileName="")) returned 1 [0059.246] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.246] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR4B.GIF") returned -1 [0059.246] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR4B.GIF") returned -1 [0059.246] lstrcmpiA (lpString1="", lpString2="PDIR4B.GIF") returned -1 [0059.246] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF") returned="PDIR49F.GIF" [0059.246] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.246] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.246] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.246] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.246] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR4B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF" [0059.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF", pszSpec="*.zip") returned 0 [0059.246] lstrlenA (lpString="*.zip") returned 5 [0059.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF", pszSpec="*.rar") returned 0 [0059.246] lstrlenA (lpString="*.rar") returned 5 [0059.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF", pszSpec="*.7z") returned 0 [0059.246] lstrlenA (lpString="*.7z") returned 4 [0059.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF", pszSpec="*.tar") returned 0 [0059.246] lstrlenA (lpString="*.tar") returned 5 [0059.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF", pszSpec="*.gzip") returned 0 [0059.246] lstrlenA (lpString="*.gzip") returned 6 [0059.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF", pszSpec="*.jpg") returned 0 [0059.246] lstrlenA (lpString="*.jpg") returned 5 [0059.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF", pszSpec="*.jpeg") returned 0 [0059.247] lstrlenA (lpString="*.jpeg") returned 6 [0059.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF", pszSpec="*.psd") returned 0 [0059.247] lstrlenA (lpString="*.psd") returned 5 [0059.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF", pszSpec="*.gif") returned 1 [0059.247] lstrlenA (lpString="*.gif") returned 5 [0059.247] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF" [0059.247] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF" [0059.247] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF." [0059.247] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF.wannacry" [0059.247] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.247] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a01 [0059.247] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb59270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.247] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.247] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2983, lpOverlapped=0x0) returned 1 [0059.265] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF") returned="PDIR4B.GIF" [0059.265] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.265] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2983, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2983, lpOverlapped=0x0) returned 1 [0059.265] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.265] CloseHandle (hObject=0x90) returned 1 [0059.265] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4b.gif.wannacry")) returned 1 [0059.266] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x76cd, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR4F.GIF", cAlternateFileName="")) returned 1 [0059.266] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.266] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR4F.GIF") returned -1 [0059.266] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR4F.GIF") returned -1 [0059.266] lstrcmpiA (lpString1="", lpString2="PDIR4F.GIF") returned -1 [0059.266] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF") returned="PDIR4B.GIF" [0059.266] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.266] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.266] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.266] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.267] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR4F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF" [0059.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF", pszSpec="*.zip") returned 0 [0059.267] lstrlenA (lpString="*.zip") returned 5 [0059.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF", pszSpec="*.rar") returned 0 [0059.267] lstrlenA (lpString="*.rar") returned 5 [0059.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF", pszSpec="*.7z") returned 0 [0059.267] lstrlenA (lpString="*.7z") returned 4 [0059.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF", pszSpec="*.tar") returned 0 [0059.267] lstrlenA (lpString="*.tar") returned 5 [0059.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF", pszSpec="*.gzip") returned 0 [0059.267] lstrlenA (lpString="*.gzip") returned 6 [0059.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF", pszSpec="*.jpg") returned 0 [0059.267] lstrlenA (lpString="*.jpg") returned 5 [0059.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF", pszSpec="*.jpeg") returned 0 [0059.267] lstrlenA (lpString="*.jpeg") returned 6 [0059.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF", pszSpec="*.psd") returned 0 [0059.267] lstrlenA (lpString="*.psd") returned 5 [0059.267] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF", pszSpec="*.gif") returned 1 [0059.267] lstrlenA (lpString="*.gif") returned 5 [0059.267] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF" [0059.267] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF" [0059.267] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF." [0059.267] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF.wannacry" [0059.267] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.268] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x76cd [0059.268] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb59270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.268] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.268] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x764f, lpOverlapped=0x0) returned 1 [0059.270] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF") returned="PDIR4F.GIF" [0059.270] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.270] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x764f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x764f, lpOverlapped=0x0) returned 1 [0059.270] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.270] CloseHandle (hObject=0x90) returned 1 [0059.270] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4f.gif.wannacry")) returned 1 [0059.271] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1001, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR50B.GIF", cAlternateFileName="")) returned 1 [0059.271] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.271] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR50B.GIF") returned -1 [0059.271] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR50B.GIF") returned -1 [0059.271] lstrcmpiA (lpString1="", lpString2="PDIR50B.GIF") returned -1 [0059.271] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF") returned="PDIR4F.GIF" [0059.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.271] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.271] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR50B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF" [0059.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF", pszSpec="*.zip") returned 0 [0059.272] lstrlenA (lpString="*.zip") returned 5 [0059.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF", pszSpec="*.rar") returned 0 [0059.272] lstrlenA (lpString="*.rar") returned 5 [0059.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF", pszSpec="*.7z") returned 0 [0059.272] lstrlenA (lpString="*.7z") returned 4 [0059.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF", pszSpec="*.tar") returned 0 [0059.272] lstrlenA (lpString="*.tar") returned 5 [0059.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF", pszSpec="*.gzip") returned 0 [0059.272] lstrlenA (lpString="*.gzip") returned 6 [0059.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF", pszSpec="*.jpg") returned 0 [0059.272] lstrlenA (lpString="*.jpg") returned 5 [0059.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF", pszSpec="*.jpeg") returned 0 [0059.272] lstrlenA (lpString="*.jpeg") returned 6 [0059.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF", pszSpec="*.psd") returned 0 [0059.272] lstrlenA (lpString="*.psd") returned 5 [0059.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF", pszSpec="*.gif") returned 1 [0059.272] lstrlenA (lpString="*.gif") returned 5 [0059.272] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF" [0059.272] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF" [0059.272] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF." [0059.272] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF.wannacry" [0059.272] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.273] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1001 [0059.273] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb59270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.273] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.273] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xf83, lpOverlapped=0x0) returned 1 [0059.274] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF") returned="PDIR50B.GIF" [0059.274] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.274] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xf83, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xf83, lpOverlapped=0x0) returned 1 [0059.275] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.275] CloseHandle (hObject=0x90) returned 1 [0059.275] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50b.gif.wannacry")) returned 1 [0059.275] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xe82, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR50F.GIF", cAlternateFileName="")) returned 1 [0059.275] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.276] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR50F.GIF") returned -1 [0059.276] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR50F.GIF") returned -1 [0059.276] lstrcmpiA (lpString1="", lpString2="PDIR50F.GIF") returned -1 [0059.276] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF") returned="PDIR50B.GIF" [0059.276] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.276] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.276] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.276] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.276] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR50F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF" [0059.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF", pszSpec="*.zip") returned 0 [0059.276] lstrlenA (lpString="*.zip") returned 5 [0059.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF", pszSpec="*.rar") returned 0 [0059.276] lstrlenA (lpString="*.rar") returned 5 [0059.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF", pszSpec="*.7z") returned 0 [0059.276] lstrlenA (lpString="*.7z") returned 4 [0059.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF", pszSpec="*.tar") returned 0 [0059.276] lstrlenA (lpString="*.tar") returned 5 [0059.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF", pszSpec="*.gzip") returned 0 [0059.276] lstrlenA (lpString="*.gzip") returned 6 [0059.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF", pszSpec="*.jpg") returned 0 [0059.276] lstrlenA (lpString="*.jpg") returned 5 [0059.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF", pszSpec="*.jpeg") returned 0 [0059.276] lstrlenA (lpString="*.jpeg") returned 6 [0059.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF", pszSpec="*.psd") returned 0 [0059.276] lstrlenA (lpString="*.psd") returned 5 [0059.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF", pszSpec="*.gif") returned 1 [0059.276] lstrlenA (lpString="*.gif") returned 5 [0059.276] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF" [0059.276] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF" [0059.277] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF." [0059.277] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF.wannacry" [0059.277] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.277] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe82 [0059.277] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb59270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.277] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.277] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xe04, lpOverlapped=0x0) returned 1 [0059.279] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF") returned="PDIR50F.GIF" [0059.279] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.279] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xe04, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xe04, lpOverlapped=0x0) returned 1 [0059.279] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.279] CloseHandle (hObject=0x90) returned 1 [0059.279] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50f.gif.wannacry")) returned 1 [0059.280] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4217, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR51B.GIF", cAlternateFileName="")) returned 1 [0059.281] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.281] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR51B.GIF") returned -1 [0059.281] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR51B.GIF") returned -1 [0059.281] lstrcmpiA (lpString1="", lpString2="PDIR51B.GIF") returned -1 [0059.281] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF") returned="PDIR50F.GIF" [0059.281] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.281] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.281] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.281] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.281] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR51B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF" [0059.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF", pszSpec="*.zip") returned 0 [0059.281] lstrlenA (lpString="*.zip") returned 5 [0059.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF", pszSpec="*.rar") returned 0 [0059.281] lstrlenA (lpString="*.rar") returned 5 [0059.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF", pszSpec="*.7z") returned 0 [0059.282] lstrlenA (lpString="*.7z") returned 4 [0059.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF", pszSpec="*.tar") returned 0 [0059.282] lstrlenA (lpString="*.tar") returned 5 [0059.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF", pszSpec="*.gzip") returned 0 [0059.282] lstrlenA (lpString="*.gzip") returned 6 [0059.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF", pszSpec="*.jpg") returned 0 [0059.282] lstrlenA (lpString="*.jpg") returned 5 [0059.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF", pszSpec="*.jpeg") returned 0 [0059.282] lstrlenA (lpString="*.jpeg") returned 6 [0059.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF", pszSpec="*.psd") returned 0 [0059.282] lstrlenA (lpString="*.psd") returned 5 [0059.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF", pszSpec="*.gif") returned 1 [0059.282] lstrlenA (lpString="*.gif") returned 5 [0059.282] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF" [0059.282] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF" [0059.282] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF." [0059.282] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF.wannacry" [0059.282] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.283] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4217 [0059.283] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb59270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.283] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.283] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4199, lpOverlapped=0x0) returned 1 [0059.285] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF") returned="PDIR51B.GIF" [0059.285] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.285] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4199, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4199, lpOverlapped=0x0) returned 1 [0059.286] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.286] CloseHandle (hObject=0x90) returned 1 [0059.286] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51b.gif.wannacry")) returned 1 [0059.286] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x16a1, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR51F.GIF", cAlternateFileName="")) returned 1 [0059.286] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.287] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR51F.GIF") returned -1 [0059.287] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR51F.GIF") returned -1 [0059.287] lstrcmpiA (lpString1="", lpString2="PDIR51F.GIF") returned -1 [0059.287] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF") returned="PDIR51B.GIF" [0059.287] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.287] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.287] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.287] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.287] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR51F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF" [0059.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF", pszSpec="*.zip") returned 0 [0059.287] lstrlenA (lpString="*.zip") returned 5 [0059.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF", pszSpec="*.rar") returned 0 [0059.287] lstrlenA (lpString="*.rar") returned 5 [0059.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF", pszSpec="*.7z") returned 0 [0059.287] lstrlenA (lpString="*.7z") returned 4 [0059.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF", pszSpec="*.tar") returned 0 [0059.287] lstrlenA (lpString="*.tar") returned 5 [0059.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF", pszSpec="*.gzip") returned 0 [0059.287] lstrlenA (lpString="*.gzip") returned 6 [0059.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF", pszSpec="*.jpg") returned 0 [0059.287] lstrlenA (lpString="*.jpg") returned 5 [0059.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF", pszSpec="*.jpeg") returned 0 [0059.287] lstrlenA (lpString="*.jpeg") returned 6 [0059.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF", pszSpec="*.psd") returned 0 [0059.287] lstrlenA (lpString="*.psd") returned 5 [0059.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF", pszSpec="*.gif") returned 1 [0059.287] lstrlenA (lpString="*.gif") returned 5 [0059.287] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF" [0059.287] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF" [0059.288] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF." [0059.288] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF.wannacry" [0059.288] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.288] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16a1 [0059.288] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb59270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.288] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.288] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1623, lpOverlapped=0x0) returned 1 [0059.293] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF") returned="PDIR51F.GIF" [0059.293] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.293] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1623, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1623, lpOverlapped=0x0) returned 1 [0059.293] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.293] CloseHandle (hObject=0x90) returned 1 [0059.293] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51f.gif.wannacry")) returned 1 [0059.294] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4c88, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR5B.GIF", cAlternateFileName="")) returned 1 [0059.294] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.294] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR5B.GIF") returned -1 [0059.294] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR5B.GIF") returned -1 [0059.294] lstrcmpiA (lpString1="", lpString2="PDIR5B.GIF") returned -1 [0059.294] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF") returned="PDIR51F.GIF" [0059.294] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.295] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.295] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.295] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.295] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR5B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF" [0059.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF", pszSpec="*.zip") returned 0 [0059.295] lstrlenA (lpString="*.zip") returned 5 [0059.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF", pszSpec="*.rar") returned 0 [0059.295] lstrlenA (lpString="*.rar") returned 5 [0059.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF", pszSpec="*.7z") returned 0 [0059.295] lstrlenA (lpString="*.7z") returned 4 [0059.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF", pszSpec="*.tar") returned 0 [0059.295] lstrlenA (lpString="*.tar") returned 5 [0059.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF", pszSpec="*.gzip") returned 0 [0059.295] lstrlenA (lpString="*.gzip") returned 6 [0059.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF", pszSpec="*.jpg") returned 0 [0059.295] lstrlenA (lpString="*.jpg") returned 5 [0059.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF", pszSpec="*.jpeg") returned 0 [0059.295] lstrlenA (lpString="*.jpeg") returned 6 [0059.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF", pszSpec="*.psd") returned 0 [0059.295] lstrlenA (lpString="*.psd") returned 5 [0059.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF", pszSpec="*.gif") returned 1 [0059.295] lstrlenA (lpString="*.gif") returned 5 [0059.295] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF" [0059.295] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF" [0059.295] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF." [0059.296] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF.wannacry" [0059.296] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.296] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4c88 [0059.296] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb59270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.296] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.296] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4c0a, lpOverlapped=0x0) returned 1 [0059.298] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF") returned="PDIR5B.GIF" [0059.298] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.298] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4c0a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4c0a, lpOverlapped=0x0) returned 1 [0059.299] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.299] CloseHandle (hObject=0x90) returned 1 [0059.299] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5b.gif.wannacry")) returned 1 [0059.300] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xce72, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR5F.GIF", cAlternateFileName="")) returned 1 [0059.300] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.300] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR5F.GIF") returned -1 [0059.300] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR5F.GIF") returned -1 [0059.300] lstrcmpiA (lpString1="", lpString2="PDIR5F.GIF") returned -1 [0059.300] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF") returned="PDIR5B.GIF" [0059.300] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.300] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.300] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.300] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.300] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR5F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF" [0059.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF", pszSpec="*.zip") returned 0 [0059.300] lstrlenA (lpString="*.zip") returned 5 [0059.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF", pszSpec="*.rar") returned 0 [0059.300] lstrlenA (lpString="*.rar") returned 5 [0059.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF", pszSpec="*.7z") returned 0 [0059.301] lstrlenA (lpString="*.7z") returned 4 [0059.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF", pszSpec="*.tar") returned 0 [0059.301] lstrlenA (lpString="*.tar") returned 5 [0059.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF", pszSpec="*.gzip") returned 0 [0059.301] lstrlenA (lpString="*.gzip") returned 6 [0059.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF", pszSpec="*.jpg") returned 0 [0059.301] lstrlenA (lpString="*.jpg") returned 5 [0059.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF", pszSpec="*.jpeg") returned 0 [0059.301] lstrlenA (lpString="*.jpeg") returned 6 [0059.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF", pszSpec="*.psd") returned 0 [0059.301] lstrlenA (lpString="*.psd") returned 5 [0059.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF", pszSpec="*.gif") returned 1 [0059.301] lstrlenA (lpString="*.gif") returned 5 [0059.301] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF" [0059.301] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF" [0059.301] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF." [0059.301] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF.wannacry" [0059.301] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.302] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xce72 [0059.302] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb59270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.302] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.302] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xcdf4, lpOverlapped=0x0) returned 1 [0059.304] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF") returned="PDIR5F.GIF" [0059.304] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.304] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xcdf4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xcdf4, lpOverlapped=0x0) returned 1 [0059.304] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.304] CloseHandle (hObject=0x90) returned 1 [0059.304] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5f.gif.wannacry")) returned 1 [0059.305] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x24dd, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR6B.GIF", cAlternateFileName="")) returned 1 [0059.305] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.305] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR6B.GIF") returned -1 [0059.305] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR6B.GIF") returned -1 [0059.305] lstrcmpiA (lpString1="", lpString2="PDIR6B.GIF") returned -1 [0059.305] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF") returned="PDIR5F.GIF" [0059.305] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.306] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.306] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.306] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.306] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR6B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF" [0059.306] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", pszSpec="*.zip") returned 0 [0059.306] lstrlenA (lpString="*.zip") returned 5 [0059.306] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", pszSpec="*.rar") returned 0 [0059.306] lstrlenA (lpString="*.rar") returned 5 [0059.306] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", pszSpec="*.7z") returned 0 [0059.306] lstrlenA (lpString="*.7z") returned 4 [0059.306] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", pszSpec="*.tar") returned 0 [0059.306] lstrlenA (lpString="*.tar") returned 5 [0059.306] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", pszSpec="*.gzip") returned 0 [0059.306] lstrlenA (lpString="*.gzip") returned 6 [0059.306] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", pszSpec="*.jpg") returned 0 [0059.306] lstrlenA (lpString="*.jpg") returned 5 [0059.306] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", pszSpec="*.jpeg") returned 0 [0059.306] lstrlenA (lpString="*.jpeg") returned 6 [0059.306] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", pszSpec="*.psd") returned 0 [0059.306] lstrlenA (lpString="*.psd") returned 5 [0059.306] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", pszSpec="*.gif") returned 1 [0059.306] lstrlenA (lpString="*.gif") returned 5 [0059.306] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF" [0059.307] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF" [0059.307] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF." [0059.307] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF.wannacry" [0059.307] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.308] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24dd [0059.308] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb7f3d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.308] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.308] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x245f, lpOverlapped=0x0) returned 1 [0059.310] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF") returned="PDIR6B.GIF" [0059.310] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.310] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x245f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x245f, lpOverlapped=0x0) returned 1 [0059.310] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.310] CloseHandle (hObject=0x90) returned 1 [0059.310] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6b.gif.wannacry")) returned 1 [0059.311] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x6e4a, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR6F.GIF", cAlternateFileName="")) returned 1 [0059.311] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.311] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR6F.GIF") returned -1 [0059.311] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR6F.GIF") returned -1 [0059.311] lstrcmpiA (lpString1="", lpString2="PDIR6F.GIF") returned -1 [0059.311] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF") returned="PDIR6B.GIF" [0059.312] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.312] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.312] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.312] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.312] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR6F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF" [0059.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF", pszSpec="*.zip") returned 0 [0059.312] lstrlenA (lpString="*.zip") returned 5 [0059.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF", pszSpec="*.rar") returned 0 [0059.312] lstrlenA (lpString="*.rar") returned 5 [0059.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF", pszSpec="*.7z") returned 0 [0059.312] lstrlenA (lpString="*.7z") returned 4 [0059.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF", pszSpec="*.tar") returned 0 [0059.312] lstrlenA (lpString="*.tar") returned 5 [0059.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF", pszSpec="*.gzip") returned 0 [0059.312] lstrlenA (lpString="*.gzip") returned 6 [0059.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF", pszSpec="*.jpg") returned 0 [0059.312] lstrlenA (lpString="*.jpg") returned 5 [0059.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF", pszSpec="*.jpeg") returned 0 [0059.312] lstrlenA (lpString="*.jpeg") returned 6 [0059.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF", pszSpec="*.psd") returned 0 [0059.312] lstrlenA (lpString="*.psd") returned 5 [0059.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF", pszSpec="*.gif") returned 1 [0059.312] lstrlenA (lpString="*.gif") returned 5 [0059.312] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF" [0059.312] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF" [0059.312] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF." [0059.313] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF.wannacry" [0059.313] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.313] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6e4a [0059.313] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb7f3d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.313] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.313] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x6dcc, lpOverlapped=0x0) returned 1 [0059.315] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF") returned="PDIR6F.GIF" [0059.315] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.315] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x6dcc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x6dcc, lpOverlapped=0x0) returned 1 [0059.316] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.316] CloseHandle (hObject=0x90) returned 1 [0059.316] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6f.gif.wannacry")) returned 1 [0059.316] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x6054, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR7B.GIF", cAlternateFileName="")) returned 1 [0059.316] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.316] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR7B.GIF") returned -1 [0059.316] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR7B.GIF") returned -1 [0059.316] lstrcmpiA (lpString1="", lpString2="PDIR7B.GIF") returned -1 [0059.316] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF") returned="PDIR6F.GIF" [0059.317] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.317] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.317] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.317] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.317] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR7B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF" [0059.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF", pszSpec="*.zip") returned 0 [0059.317] lstrlenA (lpString="*.zip") returned 5 [0059.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF", pszSpec="*.rar") returned 0 [0059.317] lstrlenA (lpString="*.rar") returned 5 [0059.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF", pszSpec="*.7z") returned 0 [0059.317] lstrlenA (lpString="*.7z") returned 4 [0059.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF", pszSpec="*.tar") returned 0 [0059.317] lstrlenA (lpString="*.tar") returned 5 [0059.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF", pszSpec="*.gzip") returned 0 [0059.317] lstrlenA (lpString="*.gzip") returned 6 [0059.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF", pszSpec="*.jpg") returned 0 [0059.317] lstrlenA (lpString="*.jpg") returned 5 [0059.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF", pszSpec="*.jpeg") returned 0 [0059.317] lstrlenA (lpString="*.jpeg") returned 6 [0059.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF", pszSpec="*.psd") returned 0 [0059.317] lstrlenA (lpString="*.psd") returned 5 [0059.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF", pszSpec="*.gif") returned 1 [0059.317] lstrlenA (lpString="*.gif") returned 5 [0059.317] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF" [0059.317] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF" [0059.317] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF." [0059.317] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF.wannacry" [0059.317] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.318] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6054 [0059.318] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb7f3d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.318] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.318] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x5fd6, lpOverlapped=0x0) returned 1 [0059.320] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF") returned="PDIR7B.GIF" [0059.320] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.320] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x5fd6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x5fd6, lpOverlapped=0x0) returned 1 [0059.321] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.321] CloseHandle (hObject=0x90) returned 1 [0059.321] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7b.gif.wannacry")) returned 1 [0059.322] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x70bc, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR7F.GIF", cAlternateFileName="")) returned 1 [0059.322] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.322] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR7F.GIF") returned -1 [0059.322] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR7F.GIF") returned -1 [0059.322] lstrcmpiA (lpString1="", lpString2="PDIR7F.GIF") returned -1 [0059.322] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF") returned="PDIR7B.GIF" [0059.322] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.322] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.322] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.322] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.323] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR7F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF" [0059.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF", pszSpec="*.zip") returned 0 [0059.323] lstrlenA (lpString="*.zip") returned 5 [0059.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF", pszSpec="*.rar") returned 0 [0059.323] lstrlenA (lpString="*.rar") returned 5 [0059.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF", pszSpec="*.7z") returned 0 [0059.323] lstrlenA (lpString="*.7z") returned 4 [0059.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF", pszSpec="*.tar") returned 0 [0059.323] lstrlenA (lpString="*.tar") returned 5 [0059.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF", pszSpec="*.gzip") returned 0 [0059.323] lstrlenA (lpString="*.gzip") returned 6 [0059.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF", pszSpec="*.jpg") returned 0 [0059.323] lstrlenA (lpString="*.jpg") returned 5 [0059.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF", pszSpec="*.jpeg") returned 0 [0059.323] lstrlenA (lpString="*.jpeg") returned 6 [0059.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF", pszSpec="*.psd") returned 0 [0059.323] lstrlenA (lpString="*.psd") returned 5 [0059.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF", pszSpec="*.gif") returned 1 [0059.323] lstrlenA (lpString="*.gif") returned 5 [0059.323] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF" [0059.323] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF" [0059.323] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF." [0059.323] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF.wannacry" [0059.323] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.324] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x70bc [0059.324] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb7f3d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.324] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.324] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x703e, lpOverlapped=0x0) returned 1 [0059.326] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF") returned="PDIR7F.GIF" [0059.326] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.326] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x703e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x703e, lpOverlapped=0x0) returned 1 [0059.326] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.327] CloseHandle (hObject=0x90) returned 1 [0059.327] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7f.gif.wannacry")) returned 1 [0059.327] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xd2e, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR8B.GIF", cAlternateFileName="")) returned 1 [0059.327] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.327] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR8B.GIF") returned -1 [0059.327] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR8B.GIF") returned -1 [0059.327] lstrcmpiA (lpString1="", lpString2="PDIR8B.GIF") returned -1 [0059.327] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF") returned="PDIR7F.GIF" [0059.328] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.328] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.328] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.328] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.328] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR8B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF" [0059.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", pszSpec="*.zip") returned 0 [0059.328] lstrlenA (lpString="*.zip") returned 5 [0059.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", pszSpec="*.rar") returned 0 [0059.328] lstrlenA (lpString="*.rar") returned 5 [0059.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", pszSpec="*.7z") returned 0 [0059.328] lstrlenA (lpString="*.7z") returned 4 [0059.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", pszSpec="*.tar") returned 0 [0059.328] lstrlenA (lpString="*.tar") returned 5 [0059.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", pszSpec="*.gzip") returned 0 [0059.328] lstrlenA (lpString="*.gzip") returned 6 [0059.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", pszSpec="*.jpg") returned 0 [0059.328] lstrlenA (lpString="*.jpg") returned 5 [0059.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", pszSpec="*.jpeg") returned 0 [0059.328] lstrlenA (lpString="*.jpeg") returned 6 [0059.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", pszSpec="*.psd") returned 0 [0059.328] lstrlenA (lpString="*.psd") returned 5 [0059.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", pszSpec="*.gif") returned 1 [0059.328] lstrlenA (lpString="*.gif") returned 5 [0059.328] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF" [0059.328] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF" [0059.328] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF." [0059.328] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF.wannacry" [0059.328] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.329] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd2e [0059.330] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb7f3d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.330] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.330] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xcb0, lpOverlapped=0x0) returned 1 [0059.331] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF") returned="PDIR8B.GIF" [0059.331] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.331] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xcb0, lpOverlapped=0x0) returned 1 [0059.331] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.331] CloseHandle (hObject=0x90) returned 1 [0059.332] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8b.gif.wannacry")) returned 1 [0059.332] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2204, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR8F.GIF", cAlternateFileName="")) returned 1 [0059.332] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.332] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR8F.GIF") returned -1 [0059.332] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR8F.GIF") returned -1 [0059.332] lstrcmpiA (lpString1="", lpString2="PDIR8F.GIF") returned -1 [0059.332] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF") returned="PDIR8B.GIF" [0059.332] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.332] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.332] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.333] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.333] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR8F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF" [0059.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", pszSpec="*.zip") returned 0 [0059.333] lstrlenA (lpString="*.zip") returned 5 [0059.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", pszSpec="*.rar") returned 0 [0059.333] lstrlenA (lpString="*.rar") returned 5 [0059.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", pszSpec="*.7z") returned 0 [0059.333] lstrlenA (lpString="*.7z") returned 4 [0059.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", pszSpec="*.tar") returned 0 [0059.333] lstrlenA (lpString="*.tar") returned 5 [0059.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", pszSpec="*.gzip") returned 0 [0059.333] lstrlenA (lpString="*.gzip") returned 6 [0059.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", pszSpec="*.jpg") returned 0 [0059.333] lstrlenA (lpString="*.jpg") returned 5 [0059.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", pszSpec="*.jpeg") returned 0 [0059.333] lstrlenA (lpString="*.jpeg") returned 6 [0059.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", pszSpec="*.psd") returned 0 [0059.333] lstrlenA (lpString="*.psd") returned 5 [0059.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", pszSpec="*.gif") returned 1 [0059.333] lstrlenA (lpString="*.gif") returned 5 [0059.333] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF" [0059.333] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF" [0059.333] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF." [0059.333] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF.wannacry" [0059.333] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.334] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2204 [0059.334] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb7f3d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.334] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.334] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2186, lpOverlapped=0x0) returned 1 [0059.336] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF") returned="PDIR8F.GIF" [0059.336] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.336] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2186, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2186, lpOverlapped=0x0) returned 1 [0059.336] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.336] CloseHandle (hObject=0x90) returned 1 [0059.336] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8f.gif.wannacry")) returned 1 [0059.337] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x445d, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR9B.GIF", cAlternateFileName="")) returned 1 [0059.337] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.338] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR9B.GIF") returned -1 [0059.338] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR9B.GIF") returned -1 [0059.338] lstrcmpiA (lpString1="", lpString2="PDIR9B.GIF") returned -1 [0059.338] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF") returned="PDIR8F.GIF" [0059.338] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.338] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.338] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.338] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.338] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR9B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF" [0059.338] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", pszSpec="*.zip") returned 0 [0059.338] lstrlenA (lpString="*.zip") returned 5 [0059.338] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", pszSpec="*.rar") returned 0 [0059.338] lstrlenA (lpString="*.rar") returned 5 [0059.338] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", pszSpec="*.7z") returned 0 [0059.338] lstrlenA (lpString="*.7z") returned 4 [0059.338] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", pszSpec="*.tar") returned 0 [0059.338] lstrlenA (lpString="*.tar") returned 5 [0059.338] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", pszSpec="*.gzip") returned 0 [0059.338] lstrlenA (lpString="*.gzip") returned 6 [0059.338] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", pszSpec="*.jpg") returned 0 [0059.338] lstrlenA (lpString="*.jpg") returned 5 [0059.338] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", pszSpec="*.jpeg") returned 0 [0059.338] lstrlenA (lpString="*.jpeg") returned 6 [0059.338] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", pszSpec="*.psd") returned 0 [0059.338] lstrlenA (lpString="*.psd") returned 5 [0059.338] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", pszSpec="*.gif") returned 1 [0059.338] lstrlenA (lpString="*.gif") returned 5 [0059.338] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF" [0059.338] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF" [0059.338] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF." [0059.338] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF.wannacry" [0059.339] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.339] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x445d [0059.339] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb7f3d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.339] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.339] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x43df, lpOverlapped=0x0) returned 1 [0059.341] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF") returned="PDIR9B.GIF" [0059.341] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.341] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x43df, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x43df, lpOverlapped=0x0) returned 1 [0059.341] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.341] CloseHandle (hObject=0x90) returned 1 [0059.341] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9b.gif.wannacry")) returned 1 [0059.342] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x5aec, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PDIR9F.GIF", cAlternateFileName="")) returned 1 [0059.342] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.342] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDIR9F.GIF") returned -1 [0059.342] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDIR9F.GIF") returned -1 [0059.342] lstrcmpiA (lpString1="", lpString2="PDIR9F.GIF") returned -1 [0059.342] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF") returned="PDIR9B.GIF" [0059.342] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.342] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.342] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.342] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.342] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="PDIR9F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF" [0059.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", pszSpec="*.zip") returned 0 [0059.342] lstrlenA (lpString="*.zip") returned 5 [0059.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", pszSpec="*.rar") returned 0 [0059.342] lstrlenA (lpString="*.rar") returned 5 [0059.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", pszSpec="*.7z") returned 0 [0059.342] lstrlenA (lpString="*.7z") returned 4 [0059.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", pszSpec="*.tar") returned 0 [0059.342] lstrlenA (lpString="*.tar") returned 5 [0059.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", pszSpec="*.gzip") returned 0 [0059.343] lstrlenA (lpString="*.gzip") returned 6 [0059.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", pszSpec="*.jpg") returned 0 [0059.343] lstrlenA (lpString="*.jpg") returned 5 [0059.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", pszSpec="*.jpeg") returned 0 [0059.343] lstrlenA (lpString="*.jpeg") returned 6 [0059.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", pszSpec="*.psd") returned 0 [0059.343] lstrlenA (lpString="*.psd") returned 5 [0059.343] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", pszSpec="*.gif") returned 1 [0059.343] lstrlenA (lpString="*.gif") returned 5 [0059.343] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF" [0059.343] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF" [0059.343] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF." [0059.343] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF.wannacry" [0059.343] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.343] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5aec [0059.343] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bb7f3d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.343] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.343] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x5a6e, lpOverlapped=0x0) returned 1 [0059.345] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF") returned="PDIR9F.GIF" [0059.345] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.345] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x5a6e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x5a6e, lpOverlapped=0x0) returned 1 [0059.345] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.345] CloseHandle (hObject=0x90) returned 1 [0059.345] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9f.gif.wannacry")) returned 1 [0059.346] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x189e, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPAPERS.INI", cAlternateFileName="")) returned 1 [0059.346] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.346] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPAPERS.INI") returned -1 [0059.346] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPAPERS.INI") returned -1 [0059.346] lstrcmpiA (lpString1="", lpString2="ZPAPERS.INI") returned -1 [0059.346] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF") returned="PDIR9F.GIF" [0059.346] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.346] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.346] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.346] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.346] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPAPERS.INI" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI" [0059.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.zip") returned 0 [0059.346] lstrlenA (lpString="*.zip") returned 5 [0059.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.rar") returned 0 [0059.346] lstrlenA (lpString="*.rar") returned 5 [0059.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.7z") returned 0 [0059.346] lstrlenA (lpString="*.7z") returned 4 [0059.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.tar") returned 0 [0059.346] lstrlenA (lpString="*.tar") returned 5 [0059.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.gzip") returned 0 [0059.347] lstrlenA (lpString="*.gzip") returned 6 [0059.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.jpg") returned 0 [0059.347] lstrlenA (lpString="*.jpg") returned 5 [0059.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.jpeg") returned 0 [0059.347] lstrlenA (lpString="*.jpeg") returned 6 [0059.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.psd") returned 0 [0059.347] lstrlenA (lpString="*.psd") returned 5 [0059.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.gif") returned 0 [0059.347] lstrlenA (lpString="*.gif") returned 5 [0059.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.doc") returned 0 [0059.347] lstrlenA (lpString="*.doc") returned 5 [0059.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.docx") returned 0 [0059.347] lstrlenA (lpString="*.docx") returned 6 [0059.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.xls") returned 0 [0059.347] lstrlenA (lpString="*.xls") returned 5 [0059.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.xlsx") returned 0 [0059.347] lstrlenA (lpString="*.xlsx") returned 6 [0059.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.ppt") returned 0 [0059.347] lstrlenA (lpString="*.ppt") returned 5 [0059.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.pptx") returned 0 [0059.347] lstrlenA (lpString="*.pptx") returned 6 [0059.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.pdf") returned 0 [0059.347] lstrlenA (lpString="*.pdf") returned 5 [0059.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.mov") returned 0 [0059.347] lstrlenA (lpString="*.mov") returned 5 [0059.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.m2v") returned 0 [0059.347] lstrlenA (lpString="*.m2v") returned 5 [0059.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.3gp") returned 0 [0059.347] lstrlenA (lpString="*.3gp") returned 5 [0059.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.mpeg") returned 0 [0059.347] lstrlenA (lpString="*.mpeg") returned 6 [0059.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.mpg") returned 0 [0059.347] lstrlenA (lpString="*.mpg") returned 5 [0059.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.flv") returned 0 [0059.347] lstrlenA (lpString="*.flv") returned 5 [0059.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.avi") returned 0 [0059.347] lstrlenA (lpString="*.avi") returned 5 [0059.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.mp4") returned 0 [0059.348] lstrlenA (lpString="*.mp4") returned 5 [0059.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.wmv") returned 0 [0059.348] lstrlenA (lpString="*.wmv") returned 5 [0059.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.divx") returned 0 [0059.348] lstrlenA (lpString="*.divx") returned 6 [0059.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.mkv") returned 0 [0059.348] lstrlenA (lpString="*.mkv") returned 5 [0059.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.mp3") returned 0 [0059.348] lstrlenA (lpString="*.mp3") returned 5 [0059.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.wav") returned 0 [0059.348] lstrlenA (lpString="*.wav") returned 5 [0059.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.flac") returned 0 [0059.348] lstrlenA (lpString="*.flac") returned 6 [0059.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.ape") returned 0 [0059.348] lstrlenA (lpString="*.ape") returned 5 [0059.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.wma") returned 0 [0059.348] lstrlenA (lpString="*.wma") returned 5 [0059.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.ac3") returned 0 [0059.348] lstrlenA (lpString="*.ac3") returned 5 [0059.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", pszSpec="*.mxf") returned 0 [0059.348] lstrlenA (lpString="*.mxf") returned 5 [0059.348] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR00.GIF", cAlternateFileName="")) returned 1 [0059.348] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.348] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR00.GIF") returned -1 [0059.348] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR00.GIF") returned -1 [0059.348] lstrcmpiA (lpString1="", lpString2="ZPDIR00.GIF") returned -1 [0059.348] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI") returned="ZPAPERS.INI" [0059.348] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.348] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.348] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.348] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.348] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR00.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF" [0059.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", pszSpec="*.zip") returned 0 [0059.349] lstrlenA (lpString="*.zip") returned 5 [0059.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", pszSpec="*.rar") returned 0 [0059.349] lstrlenA (lpString="*.rar") returned 5 [0059.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", pszSpec="*.7z") returned 0 [0059.349] lstrlenA (lpString="*.7z") returned 4 [0059.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", pszSpec="*.tar") returned 0 [0059.349] lstrlenA (lpString="*.tar") returned 5 [0059.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", pszSpec="*.gzip") returned 0 [0059.349] lstrlenA (lpString="*.gzip") returned 6 [0059.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", pszSpec="*.jpg") returned 0 [0059.349] lstrlenA (lpString="*.jpg") returned 5 [0059.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", pszSpec="*.jpeg") returned 0 [0059.349] lstrlenA (lpString="*.jpeg") returned 6 [0059.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", pszSpec="*.psd") returned 0 [0059.349] lstrlenA (lpString="*.psd") returned 5 [0059.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", pszSpec="*.gif") returned 1 [0059.349] lstrlenA (lpString="*.gif") returned 5 [0059.349] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF" [0059.349] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF" [0059.349] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF." [0059.349] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF.wannacry" [0059.349] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir00.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.350] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29 [0059.350] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bc89d70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.350] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.350] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0059.351] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.351] CloseHandle (hObject=0x90) returned 1 [0059.351] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir00.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir00.gif.wannacry")) returned 1 [0059.351] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x13ad, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR10F.GIF", cAlternateFileName="")) returned 1 [0059.351] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.351] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR10F.GIF") returned -1 [0059.352] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR10F.GIF") returned -1 [0059.352] lstrcmpiA (lpString1="", lpString2="ZPDIR10F.GIF") returned -1 [0059.352] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF") returned="ZPDIR00.GIF" [0059.352] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.352] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.352] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.352] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.352] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR10F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF" [0059.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", pszSpec="*.zip") returned 0 [0059.352] lstrlenA (lpString="*.zip") returned 5 [0059.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", pszSpec="*.rar") returned 0 [0059.352] lstrlenA (lpString="*.rar") returned 5 [0059.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", pszSpec="*.7z") returned 0 [0059.352] lstrlenA (lpString="*.7z") returned 4 [0059.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", pszSpec="*.tar") returned 0 [0059.352] lstrlenA (lpString="*.tar") returned 5 [0059.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", pszSpec="*.gzip") returned 0 [0059.352] lstrlenA (lpString="*.gzip") returned 6 [0059.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", pszSpec="*.jpg") returned 0 [0059.352] lstrlenA (lpString="*.jpg") returned 5 [0059.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", pszSpec="*.jpeg") returned 0 [0059.352] lstrlenA (lpString="*.jpeg") returned 6 [0059.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", pszSpec="*.psd") returned 0 [0059.352] lstrlenA (lpString="*.psd") returned 5 [0059.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", pszSpec="*.gif") returned 1 [0059.352] lstrlenA (lpString="*.gif") returned 5 [0059.352] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF" [0059.353] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF" [0059.353] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF." [0059.353] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF.wannacry" [0059.353] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir10f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.354] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13ad [0059.354] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bc89d70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.354] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.354] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x132f, lpOverlapped=0x0) returned 1 [0059.358] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF") returned="ZPDIR10F.GIF" [0059.358] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.359] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x132f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x132f, lpOverlapped=0x0) returned 1 [0059.359] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.359] CloseHandle (hObject=0x90) returned 1 [0059.359] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir10f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir10f.gif.wannacry")) returned 1 [0059.360] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1706, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR11F.GIF", cAlternateFileName="")) returned 1 [0059.360] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.360] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR11F.GIF") returned -1 [0059.360] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR11F.GIF") returned -1 [0059.360] lstrcmpiA (lpString1="", lpString2="ZPDIR11F.GIF") returned -1 [0059.360] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF") returned="ZPDIR10F.GIF" [0059.360] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.360] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.361] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.361] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.361] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR11F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF" [0059.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", pszSpec="*.zip") returned 0 [0059.361] lstrlenA (lpString="*.zip") returned 5 [0059.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", pszSpec="*.rar") returned 0 [0059.361] lstrlenA (lpString="*.rar") returned 5 [0059.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", pszSpec="*.7z") returned 0 [0059.361] lstrlenA (lpString="*.7z") returned 4 [0059.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", pszSpec="*.tar") returned 0 [0059.361] lstrlenA (lpString="*.tar") returned 5 [0059.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", pszSpec="*.gzip") returned 0 [0059.361] lstrlenA (lpString="*.gzip") returned 6 [0059.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", pszSpec="*.jpg") returned 0 [0059.361] lstrlenA (lpString="*.jpg") returned 5 [0059.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", pszSpec="*.jpeg") returned 0 [0059.361] lstrlenA (lpString="*.jpeg") returned 6 [0059.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", pszSpec="*.psd") returned 0 [0059.361] lstrlenA (lpString="*.psd") returned 5 [0059.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", pszSpec="*.gif") returned 1 [0059.361] lstrlenA (lpString="*.gif") returned 5 [0059.362] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF" [0059.362] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF" [0059.362] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF." [0059.362] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF.wannacry" [0059.362] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir11f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.362] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1706 [0059.363] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bc89d70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.363] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.363] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1688, lpOverlapped=0x0) returned 1 [0059.365] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF") returned="ZPDIR11F.GIF" [0059.365] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.365] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1688, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1688, lpOverlapped=0x0) returned 1 [0059.365] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.365] CloseHandle (hObject=0x90) returned 1 [0059.365] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir11f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir11f.gif.wannacry")) returned 1 [0059.366] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x6499, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR12F.GIF", cAlternateFileName="")) returned 1 [0059.367] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.367] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR12F.GIF") returned -1 [0059.367] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR12F.GIF") returned -1 [0059.367] lstrcmpiA (lpString1="", lpString2="ZPDIR12F.GIF") returned -1 [0059.367] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF") returned="ZPDIR11F.GIF" [0059.367] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.367] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.367] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.367] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.367] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR12F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF" [0059.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", pszSpec="*.zip") returned 0 [0059.367] lstrlenA (lpString="*.zip") returned 5 [0059.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", pszSpec="*.rar") returned 0 [0059.367] lstrlenA (lpString="*.rar") returned 5 [0059.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", pszSpec="*.7z") returned 0 [0059.367] lstrlenA (lpString="*.7z") returned 4 [0059.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", pszSpec="*.tar") returned 0 [0059.367] lstrlenA (lpString="*.tar") returned 5 [0059.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", pszSpec="*.gzip") returned 0 [0059.367] lstrlenA (lpString="*.gzip") returned 6 [0059.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", pszSpec="*.jpg") returned 0 [0059.368] lstrlenA (lpString="*.jpg") returned 5 [0059.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", pszSpec="*.jpeg") returned 0 [0059.368] lstrlenA (lpString="*.jpeg") returned 6 [0059.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", pszSpec="*.psd") returned 0 [0059.368] lstrlenA (lpString="*.psd") returned 5 [0059.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", pszSpec="*.gif") returned 1 [0059.368] lstrlenA (lpString="*.gif") returned 5 [0059.368] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF" [0059.368] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF" [0059.368] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF." [0059.368] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF.wannacry" [0059.368] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir12f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.369] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6499 [0059.369] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bc89d70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.369] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.369] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x641b, lpOverlapped=0x0) returned 1 [0059.371] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF") returned="ZPDIR12F.GIF" [0059.372] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.372] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x641b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x641b, lpOverlapped=0x0) returned 1 [0059.372] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.372] CloseHandle (hObject=0x90) returned 1 [0059.372] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir12f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir12f.gif.wannacry")) returned 1 [0059.373] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3ce8, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR13F.GIF", cAlternateFileName="")) returned 1 [0059.373] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.373] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR13F.GIF") returned -1 [0059.373] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR13F.GIF") returned -1 [0059.373] lstrcmpiA (lpString1="", lpString2="ZPDIR13F.GIF") returned -1 [0059.373] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF") returned="ZPDIR12F.GIF" [0059.373] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.374] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.374] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.374] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.374] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR13F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF" [0059.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", pszSpec="*.zip") returned 0 [0059.374] lstrlenA (lpString="*.zip") returned 5 [0059.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", pszSpec="*.rar") returned 0 [0059.374] lstrlenA (lpString="*.rar") returned 5 [0059.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", pszSpec="*.7z") returned 0 [0059.374] lstrlenA (lpString="*.7z") returned 4 [0059.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", pszSpec="*.tar") returned 0 [0059.374] lstrlenA (lpString="*.tar") returned 5 [0059.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", pszSpec="*.gzip") returned 0 [0059.374] lstrlenA (lpString="*.gzip") returned 6 [0059.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", pszSpec="*.jpg") returned 0 [0059.374] lstrlenA (lpString="*.jpg") returned 5 [0059.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", pszSpec="*.jpeg") returned 0 [0059.374] lstrlenA (lpString="*.jpeg") returned 6 [0059.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", pszSpec="*.psd") returned 0 [0059.375] lstrlenA (lpString="*.psd") returned 5 [0059.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", pszSpec="*.gif") returned 1 [0059.375] lstrlenA (lpString="*.gif") returned 5 [0059.375] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF" [0059.375] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF" [0059.375] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF." [0059.375] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF.wannacry" [0059.375] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir13f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.376] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ce8 [0059.376] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bc89d70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.376] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.376] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3c6a, lpOverlapped=0x0) returned 1 [0059.378] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF") returned="ZPDIR13F.GIF" [0059.378] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.378] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3c6a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3c6a, lpOverlapped=0x0) returned 1 [0059.378] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.379] CloseHandle (hObject=0x90) returned 1 [0059.379] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir13f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir13f.gif.wannacry")) returned 1 [0059.380] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x645b, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR14F.GIF", cAlternateFileName="")) returned 1 [0059.380] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.380] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR14F.GIF") returned -1 [0059.380] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR14F.GIF") returned -1 [0059.380] lstrcmpiA (lpString1="", lpString2="ZPDIR14F.GIF") returned -1 [0059.380] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF") returned="ZPDIR13F.GIF" [0059.380] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.380] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.380] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.380] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.380] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR14F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF" [0059.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", pszSpec="*.zip") returned 0 [0059.380] lstrlenA (lpString="*.zip") returned 5 [0059.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", pszSpec="*.rar") returned 0 [0059.380] lstrlenA (lpString="*.rar") returned 5 [0059.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", pszSpec="*.7z") returned 0 [0059.380] lstrlenA (lpString="*.7z") returned 4 [0059.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", pszSpec="*.tar") returned 0 [0059.381] lstrlenA (lpString="*.tar") returned 5 [0059.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", pszSpec="*.gzip") returned 0 [0059.381] lstrlenA (lpString="*.gzip") returned 6 [0059.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", pszSpec="*.jpg") returned 0 [0059.381] lstrlenA (lpString="*.jpg") returned 5 [0059.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", pszSpec="*.jpeg") returned 0 [0059.381] lstrlenA (lpString="*.jpeg") returned 6 [0059.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", pszSpec="*.psd") returned 0 [0059.381] lstrlenA (lpString="*.psd") returned 5 [0059.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", pszSpec="*.gif") returned 1 [0059.381] lstrlenA (lpString="*.gif") returned 5 [0059.381] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF" [0059.381] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF" [0059.381] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF." [0059.381] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF.wannacry" [0059.381] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir14f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.383] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x645b [0059.383] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bc89d70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.383] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.383] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x63dd, lpOverlapped=0x0) returned 1 [0059.385] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF") returned="ZPDIR14F.GIF" [0059.386] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.386] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x63dd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x63dd, lpOverlapped=0x0) returned 1 [0059.386] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.386] CloseHandle (hObject=0x90) returned 1 [0059.386] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir14f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir14f.gif.wannacry")) returned 1 [0059.387] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x452b, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR15F.GIF", cAlternateFileName="")) returned 1 [0059.387] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.387] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR15F.GIF") returned -1 [0059.388] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR15F.GIF") returned -1 [0059.388] lstrcmpiA (lpString1="", lpString2="ZPDIR15F.GIF") returned -1 [0059.388] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF") returned="ZPDIR14F.GIF" [0059.388] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.388] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.388] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.388] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.388] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR15F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF" [0059.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", pszSpec="*.zip") returned 0 [0059.388] lstrlenA (lpString="*.zip") returned 5 [0059.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", pszSpec="*.rar") returned 0 [0059.388] lstrlenA (lpString="*.rar") returned 5 [0059.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", pszSpec="*.7z") returned 0 [0059.388] lstrlenA (lpString="*.7z") returned 4 [0059.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", pszSpec="*.tar") returned 0 [0059.388] lstrlenA (lpString="*.tar") returned 5 [0059.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", pszSpec="*.gzip") returned 0 [0059.388] lstrlenA (lpString="*.gzip") returned 6 [0059.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", pszSpec="*.jpg") returned 0 [0059.388] lstrlenA (lpString="*.jpg") returned 5 [0059.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", pszSpec="*.jpeg") returned 0 [0059.389] lstrlenA (lpString="*.jpeg") returned 6 [0059.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", pszSpec="*.psd") returned 0 [0059.389] lstrlenA (lpString="*.psd") returned 5 [0059.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", pszSpec="*.gif") returned 1 [0059.389] lstrlenA (lpString="*.gif") returned 5 [0059.389] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF" [0059.389] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF" [0059.389] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF." [0059.389] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF.wannacry" [0059.389] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir15f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.390] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x452b [0059.390] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bc89d70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.390] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.390] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x44ad, lpOverlapped=0x0) returned 1 [0059.392] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF") returned="ZPDIR15F.GIF" [0059.392] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.392] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x44ad, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x44ad, lpOverlapped=0x0) returned 1 [0059.392] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.392] CloseHandle (hObject=0x90) returned 1 [0059.393] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir15f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir15f.gif.wannacry")) returned 1 [0059.394] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2fc1, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR16F.GIF", cAlternateFileName="")) returned 1 [0059.394] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.394] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR16F.GIF") returned -1 [0059.394] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR16F.GIF") returned -1 [0059.394] lstrcmpiA (lpString1="", lpString2="ZPDIR16F.GIF") returned -1 [0059.394] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF") returned="ZPDIR15F.GIF" [0059.394] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.394] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.394] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.394] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.395] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR16F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF" [0059.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", pszSpec="*.zip") returned 0 [0059.395] lstrlenA (lpString="*.zip") returned 5 [0059.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", pszSpec="*.rar") returned 0 [0059.395] lstrlenA (lpString="*.rar") returned 5 [0059.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", pszSpec="*.7z") returned 0 [0059.395] lstrlenA (lpString="*.7z") returned 4 [0059.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", pszSpec="*.tar") returned 0 [0059.395] lstrlenA (lpString="*.tar") returned 5 [0059.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", pszSpec="*.gzip") returned 0 [0059.395] lstrlenA (lpString="*.gzip") returned 6 [0059.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", pszSpec="*.jpg") returned 0 [0059.395] lstrlenA (lpString="*.jpg") returned 5 [0059.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", pszSpec="*.jpeg") returned 0 [0059.395] lstrlenA (lpString="*.jpeg") returned 6 [0059.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", pszSpec="*.psd") returned 0 [0059.395] lstrlenA (lpString="*.psd") returned 5 [0059.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", pszSpec="*.gif") returned 1 [0059.395] lstrlenA (lpString="*.gif") returned 5 [0059.395] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF" [0059.395] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF" [0059.395] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF." [0059.395] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF.wannacry" [0059.395] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir16f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.396] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2fc1 [0059.396] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bc89d70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.396] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.396] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2f43, lpOverlapped=0x0) returned 1 [0059.398] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF") returned="ZPDIR16F.GIF" [0059.398] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.398] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2f43, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2f43, lpOverlapped=0x0) returned 1 [0059.398] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.398] CloseHandle (hObject=0x90) returned 1 [0059.398] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir16f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir16f.gif.wannacry")) returned 1 [0059.399] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x34cf, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR17F.GIF", cAlternateFileName="")) returned 1 [0059.399] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.399] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR17F.GIF") returned -1 [0059.399] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR17F.GIF") returned -1 [0059.399] lstrcmpiA (lpString1="", lpString2="ZPDIR17F.GIF") returned -1 [0059.399] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF") returned="ZPDIR16F.GIF" [0059.399] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.399] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.399] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.399] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.399] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR17F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF" [0059.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", pszSpec="*.zip") returned 0 [0059.400] lstrlenA (lpString="*.zip") returned 5 [0059.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", pszSpec="*.rar") returned 0 [0059.400] lstrlenA (lpString="*.rar") returned 5 [0059.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", pszSpec="*.7z") returned 0 [0059.400] lstrlenA (lpString="*.7z") returned 4 [0059.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", pszSpec="*.tar") returned 0 [0059.400] lstrlenA (lpString="*.tar") returned 5 [0059.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", pszSpec="*.gzip") returned 0 [0059.400] lstrlenA (lpString="*.gzip") returned 6 [0059.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", pszSpec="*.jpg") returned 0 [0059.400] lstrlenA (lpString="*.jpg") returned 5 [0059.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", pszSpec="*.jpeg") returned 0 [0059.400] lstrlenA (lpString="*.jpeg") returned 6 [0059.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", pszSpec="*.psd") returned 0 [0059.400] lstrlenA (lpString="*.psd") returned 5 [0059.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", pszSpec="*.gif") returned 1 [0059.400] lstrlenA (lpString="*.gif") returned 5 [0059.400] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF" [0059.400] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF" [0059.400] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF." [0059.400] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF.wannacry" [0059.400] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir17f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.401] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34cf [0059.401] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bc89d70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.401] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.401] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3451, lpOverlapped=0x0) returned 1 [0059.402] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF") returned="ZPDIR17F.GIF" [0059.402] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.402] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3451, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3451, lpOverlapped=0x0) returned 1 [0059.403] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.403] CloseHandle (hObject=0x90) returned 1 [0059.403] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir17f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir17f.gif.wannacry")) returned 1 [0059.403] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4be9, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR18F.GIF", cAlternateFileName="")) returned 1 [0059.403] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.403] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR18F.GIF") returned -1 [0059.403] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR18F.GIF") returned -1 [0059.403] lstrcmpiA (lpString1="", lpString2="ZPDIR18F.GIF") returned -1 [0059.404] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF") returned="ZPDIR17F.GIF" [0059.404] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.404] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.404] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.404] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.404] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR18F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF" [0059.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", pszSpec="*.zip") returned 0 [0059.404] lstrlenA (lpString="*.zip") returned 5 [0059.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", pszSpec="*.rar") returned 0 [0059.404] lstrlenA (lpString="*.rar") returned 5 [0059.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", pszSpec="*.7z") returned 0 [0059.404] lstrlenA (lpString="*.7z") returned 4 [0059.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", pszSpec="*.tar") returned 0 [0059.404] lstrlenA (lpString="*.tar") returned 5 [0059.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", pszSpec="*.gzip") returned 0 [0059.404] lstrlenA (lpString="*.gzip") returned 6 [0059.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", pszSpec="*.jpg") returned 0 [0059.404] lstrlenA (lpString="*.jpg") returned 5 [0059.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", pszSpec="*.jpeg") returned 0 [0059.404] lstrlenA (lpString="*.jpeg") returned 6 [0059.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", pszSpec="*.psd") returned 0 [0059.404] lstrlenA (lpString="*.psd") returned 5 [0059.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", pszSpec="*.gif") returned 1 [0059.404] lstrlenA (lpString="*.gif") returned 5 [0059.404] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF" [0059.404] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF" [0059.404] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF." [0059.404] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF.wannacry" [0059.404] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir18f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.405] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4be9 [0059.405] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bc89d70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.405] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.405] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4b6b, lpOverlapped=0x0) returned 1 [0059.407] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF") returned="ZPDIR18F.GIF" [0059.407] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.407] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4b6b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4b6b, lpOverlapped=0x0) returned 1 [0059.407] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.407] CloseHandle (hObject=0x90) returned 1 [0059.407] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir18f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir18f.gif.wannacry")) returned 1 [0059.408] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xc11, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR19F.GIF", cAlternateFileName="")) returned 1 [0059.408] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.408] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR19F.GIF") returned -1 [0059.408] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR19F.GIF") returned -1 [0059.408] lstrcmpiA (lpString1="", lpString2="ZPDIR19F.GIF") returned -1 [0059.408] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF") returned="ZPDIR18F.GIF" [0059.408] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.408] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.408] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.408] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.408] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR19F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF" [0059.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", pszSpec="*.zip") returned 0 [0059.408] lstrlenA (lpString="*.zip") returned 5 [0059.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", pszSpec="*.rar") returned 0 [0059.409] lstrlenA (lpString="*.rar") returned 5 [0059.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", pszSpec="*.7z") returned 0 [0059.409] lstrlenA (lpString="*.7z") returned 4 [0059.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", pszSpec="*.tar") returned 0 [0059.409] lstrlenA (lpString="*.tar") returned 5 [0059.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", pszSpec="*.gzip") returned 0 [0059.409] lstrlenA (lpString="*.gzip") returned 6 [0059.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", pszSpec="*.jpg") returned 0 [0059.409] lstrlenA (lpString="*.jpg") returned 5 [0059.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", pszSpec="*.jpeg") returned 0 [0059.409] lstrlenA (lpString="*.jpeg") returned 6 [0059.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", pszSpec="*.psd") returned 0 [0059.409] lstrlenA (lpString="*.psd") returned 5 [0059.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", pszSpec="*.gif") returned 1 [0059.409] lstrlenA (lpString="*.gif") returned 5 [0059.409] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF" [0059.409] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF" [0059.409] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF." [0059.409] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF.wannacry" [0059.409] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir19f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.410] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc11 [0059.410] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bc89d70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.410] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.410] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xb93, lpOverlapped=0x0) returned 1 [0059.412] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF") returned="ZPDIR19F.GIF" [0059.412] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.412] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xb93, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xb93, lpOverlapped=0x0) returned 1 [0059.412] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.412] CloseHandle (hObject=0x90) returned 1 [0059.412] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir19f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir19f.gif.wannacry")) returned 1 [0059.413] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xef5, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR1B.GIF", cAlternateFileName="")) returned 1 [0059.413] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.413] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR1B.GIF") returned -1 [0059.413] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR1B.GIF") returned -1 [0059.413] lstrcmpiA (lpString1="", lpString2="ZPDIR1B.GIF") returned -1 [0059.413] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF") returned="ZPDIR19F.GIF" [0059.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.413] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.413] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.413] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.413] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR1B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF" [0059.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", pszSpec="*.zip") returned 0 [0059.414] lstrlenA (lpString="*.zip") returned 5 [0059.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", pszSpec="*.rar") returned 0 [0059.414] lstrlenA (lpString="*.rar") returned 5 [0059.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", pszSpec="*.7z") returned 0 [0059.414] lstrlenA (lpString="*.7z") returned 4 [0059.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", pszSpec="*.tar") returned 0 [0059.414] lstrlenA (lpString="*.tar") returned 5 [0059.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", pszSpec="*.gzip") returned 0 [0059.414] lstrlenA (lpString="*.gzip") returned 6 [0059.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", pszSpec="*.jpg") returned 0 [0059.414] lstrlenA (lpString="*.jpg") returned 5 [0059.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", pszSpec="*.jpeg") returned 0 [0059.414] lstrlenA (lpString="*.jpeg") returned 6 [0059.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", pszSpec="*.psd") returned 0 [0059.414] lstrlenA (lpString="*.psd") returned 5 [0059.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", pszSpec="*.gif") returned 1 [0059.414] lstrlenA (lpString="*.gif") returned 5 [0059.414] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF" [0059.414] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF" [0059.414] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF." [0059.414] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF.wannacry" [0059.414] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.415] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xef5 [0059.415] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bc89d70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.415] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.415] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xe77, lpOverlapped=0x0) returned 1 [0059.416] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF") returned="ZPDIR1B.GIF" [0059.416] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.416] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xe77, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xe77, lpOverlapped=0x0) returned 1 [0059.416] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.417] CloseHandle (hObject=0x90) returned 1 [0059.417] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1b.gif.wannacry")) returned 1 [0059.420] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bcafed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b75, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR1F.GIF", cAlternateFileName="")) returned 1 [0059.420] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.420] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR1F.GIF") returned -1 [0059.420] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR1F.GIF") returned -1 [0059.420] lstrcmpiA (lpString1="", lpString2="ZPDIR1F.GIF") returned -1 [0059.421] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF") returned="ZPDIR1B.GIF" [0059.421] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.421] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.421] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.421] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.421] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR1F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF" [0059.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", pszSpec="*.zip") returned 0 [0059.421] lstrlenA (lpString="*.zip") returned 5 [0059.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", pszSpec="*.rar") returned 0 [0059.421] lstrlenA (lpString="*.rar") returned 5 [0059.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", pszSpec="*.7z") returned 0 [0059.421] lstrlenA (lpString="*.7z") returned 4 [0059.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", pszSpec="*.tar") returned 0 [0059.421] lstrlenA (lpString="*.tar") returned 5 [0059.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", pszSpec="*.gzip") returned 0 [0059.421] lstrlenA (lpString="*.gzip") returned 6 [0059.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", pszSpec="*.jpg") returned 0 [0059.421] lstrlenA (lpString="*.jpg") returned 5 [0059.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", pszSpec="*.jpeg") returned 0 [0059.421] lstrlenA (lpString="*.jpeg") returned 6 [0059.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", pszSpec="*.psd") returned 0 [0059.421] lstrlenA (lpString="*.psd") returned 5 [0059.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", pszSpec="*.gif") returned 1 [0059.421] lstrlenA (lpString="*.gif") returned 5 [0059.422] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF" [0059.422] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF" [0059.422] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF." [0059.422] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF.wannacry" [0059.422] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.424] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b75 [0059.424] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bcafed0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.424] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.424] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1af7, lpOverlapped=0x0) returned 1 [0059.426] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF") returned="ZPDIR1F.GIF" [0059.426] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.426] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1af7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1af7, lpOverlapped=0x0) returned 1 [0059.427] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.427] CloseHandle (hObject=0x90) returned 1 [0059.427] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1f.gif.wannacry")) returned 1 [0059.428] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bcafed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xc85, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR20F.GIF", cAlternateFileName="")) returned 1 [0059.428] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.428] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR20F.GIF") returned -1 [0059.428] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR20F.GIF") returned -1 [0059.428] lstrcmpiA (lpString1="", lpString2="ZPDIR20F.GIF") returned -1 [0059.428] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF") returned="ZPDIR1F.GIF" [0059.428] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.428] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.428] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.428] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.429] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR20F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF" [0059.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", pszSpec="*.zip") returned 0 [0059.429] lstrlenA (lpString="*.zip") returned 5 [0059.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", pszSpec="*.rar") returned 0 [0059.429] lstrlenA (lpString="*.rar") returned 5 [0059.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", pszSpec="*.7z") returned 0 [0059.429] lstrlenA (lpString="*.7z") returned 4 [0059.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", pszSpec="*.tar") returned 0 [0059.429] lstrlenA (lpString="*.tar") returned 5 [0059.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", pszSpec="*.gzip") returned 0 [0059.429] lstrlenA (lpString="*.gzip") returned 6 [0059.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", pszSpec="*.jpg") returned 0 [0059.429] lstrlenA (lpString="*.jpg") returned 5 [0059.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", pszSpec="*.jpeg") returned 0 [0059.429] lstrlenA (lpString="*.jpeg") returned 6 [0059.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", pszSpec="*.psd") returned 0 [0059.429] lstrlenA (lpString="*.psd") returned 5 [0059.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", pszSpec="*.gif") returned 1 [0059.429] lstrlenA (lpString="*.gif") returned 5 [0059.429] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF" [0059.429] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF" [0059.429] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF." [0059.429] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF.wannacry" [0059.429] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir20f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.430] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc85 [0059.430] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bcafed0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.430] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.446] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xc07, lpOverlapped=0x0) returned 1 [0059.460] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF") returned="ZPDIR20F.GIF" [0059.460] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.460] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xc07, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xc07, lpOverlapped=0x0) returned 1 [0059.460] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.460] CloseHandle (hObject=0x90) returned 1 [0059.460] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir20f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir20f.gif.wannacry")) returned 1 [0059.462] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bcafed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x42ea, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR21F.GIF", cAlternateFileName="")) returned 1 [0059.462] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.462] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR21F.GIF") returned -1 [0059.462] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR21F.GIF") returned -1 [0059.462] lstrcmpiA (lpString1="", lpString2="ZPDIR21F.GIF") returned -1 [0059.462] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF") returned="ZPDIR20F.GIF" [0059.462] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.462] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.462] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.462] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.462] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR21F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF" [0059.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", pszSpec="*.zip") returned 0 [0059.462] lstrlenA (lpString="*.zip") returned 5 [0059.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", pszSpec="*.rar") returned 0 [0059.462] lstrlenA (lpString="*.rar") returned 5 [0059.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", pszSpec="*.7z") returned 0 [0059.463] lstrlenA (lpString="*.7z") returned 4 [0059.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", pszSpec="*.tar") returned 0 [0059.463] lstrlenA (lpString="*.tar") returned 5 [0059.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", pszSpec="*.gzip") returned 0 [0059.463] lstrlenA (lpString="*.gzip") returned 6 [0059.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", pszSpec="*.jpg") returned 0 [0059.463] lstrlenA (lpString="*.jpg") returned 5 [0059.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", pszSpec="*.jpeg") returned 0 [0059.463] lstrlenA (lpString="*.jpeg") returned 6 [0059.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", pszSpec="*.psd") returned 0 [0059.463] lstrlenA (lpString="*.psd") returned 5 [0059.463] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", pszSpec="*.gif") returned 1 [0059.463] lstrlenA (lpString="*.gif") returned 5 [0059.463] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF" [0059.463] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF" [0059.463] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF." [0059.463] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF.wannacry" [0059.463] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir21f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.464] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x42ea [0059.464] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bcafed0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.464] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.464] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x426c, lpOverlapped=0x0) returned 1 [0059.466] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF") returned="ZPDIR21F.GIF" [0059.466] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.466] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x426c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x426c, lpOverlapped=0x0) returned 1 [0059.466] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.466] CloseHandle (hObject=0x90) returned 1 [0059.467] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir21f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir21f.gif.wannacry")) returned 1 [0059.468] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bcd6030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1983, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR22F.GIF", cAlternateFileName="")) returned 1 [0059.468] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.468] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR22F.GIF") returned -1 [0059.468] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR22F.GIF") returned -1 [0059.468] lstrcmpiA (lpString1="", lpString2="ZPDIR22F.GIF") returned -1 [0059.468] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF") returned="ZPDIR21F.GIF" [0059.468] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.468] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.468] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.468] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.468] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR22F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF" [0059.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", pszSpec="*.zip") returned 0 [0059.468] lstrlenA (lpString="*.zip") returned 5 [0059.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", pszSpec="*.rar") returned 0 [0059.468] lstrlenA (lpString="*.rar") returned 5 [0059.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", pszSpec="*.7z") returned 0 [0059.469] lstrlenA (lpString="*.7z") returned 4 [0059.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", pszSpec="*.tar") returned 0 [0059.469] lstrlenA (lpString="*.tar") returned 5 [0059.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", pszSpec="*.gzip") returned 0 [0059.469] lstrlenA (lpString="*.gzip") returned 6 [0059.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", pszSpec="*.jpg") returned 0 [0059.469] lstrlenA (lpString="*.jpg") returned 5 [0059.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", pszSpec="*.jpeg") returned 0 [0059.469] lstrlenA (lpString="*.jpeg") returned 6 [0059.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", pszSpec="*.psd") returned 0 [0059.469] lstrlenA (lpString="*.psd") returned 5 [0059.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", pszSpec="*.gif") returned 1 [0059.469] lstrlenA (lpString="*.gif") returned 5 [0059.469] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF" [0059.469] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF" [0059.469] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF." [0059.469] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF.wannacry" [0059.469] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir22f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.471] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1983 [0059.471] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bcd6030, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.471] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.471] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1905, lpOverlapped=0x0) returned 1 [0059.473] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF") returned="ZPDIR22F.GIF" [0059.473] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.473] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1905, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1905, lpOverlapped=0x0) returned 1 [0059.473] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.473] CloseHandle (hObject=0x90) returned 1 [0059.473] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir22f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir22f.gif.wannacry")) returned 1 [0059.474] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bcd6030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2a71, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR23F.GIF", cAlternateFileName="")) returned 1 [0059.474] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.474] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR23F.GIF") returned -1 [0059.474] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR23F.GIF") returned -1 [0059.474] lstrcmpiA (lpString1="", lpString2="ZPDIR23F.GIF") returned -1 [0059.474] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF") returned="ZPDIR22F.GIF" [0059.474] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.474] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.475] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.475] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.475] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR23F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF" [0059.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", pszSpec="*.zip") returned 0 [0059.475] lstrlenA (lpString="*.zip") returned 5 [0059.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", pszSpec="*.rar") returned 0 [0059.475] lstrlenA (lpString="*.rar") returned 5 [0059.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", pszSpec="*.7z") returned 0 [0059.475] lstrlenA (lpString="*.7z") returned 4 [0059.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", pszSpec="*.tar") returned 0 [0059.475] lstrlenA (lpString="*.tar") returned 5 [0059.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", pszSpec="*.gzip") returned 0 [0059.475] lstrlenA (lpString="*.gzip") returned 6 [0059.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", pszSpec="*.jpg") returned 0 [0059.475] lstrlenA (lpString="*.jpg") returned 5 [0059.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", pszSpec="*.jpeg") returned 0 [0059.475] lstrlenA (lpString="*.jpeg") returned 6 [0059.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", pszSpec="*.psd") returned 0 [0059.476] lstrlenA (lpString="*.psd") returned 5 [0059.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", pszSpec="*.gif") returned 1 [0059.476] lstrlenA (lpString="*.gif") returned 5 [0059.476] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF" [0059.476] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF" [0059.476] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF." [0059.476] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF.wannacry" [0059.476] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir23f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.476] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a71 [0059.477] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bcd6030, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.477] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.477] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x29f3, lpOverlapped=0x0) returned 1 [0059.479] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF") returned="ZPDIR23F.GIF" [0059.479] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.479] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x29f3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x29f3, lpOverlapped=0x0) returned 1 [0059.479] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.479] CloseHandle (hObject=0x90) returned 1 [0059.479] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir23f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir23f.gif.wannacry")) returned 1 [0059.480] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd222f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3f61, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR24F.GIF", cAlternateFileName="")) returned 1 [0059.480] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.480] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR24F.GIF") returned -1 [0059.480] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR24F.GIF") returned -1 [0059.481] lstrcmpiA (lpString1="", lpString2="ZPDIR24F.GIF") returned -1 [0059.481] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF") returned="ZPDIR23F.GIF" [0059.481] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.481] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.481] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.481] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.481] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR24F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF" [0059.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", pszSpec="*.zip") returned 0 [0059.481] lstrlenA (lpString="*.zip") returned 5 [0059.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", pszSpec="*.rar") returned 0 [0059.481] lstrlenA (lpString="*.rar") returned 5 [0059.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", pszSpec="*.7z") returned 0 [0059.481] lstrlenA (lpString="*.7z") returned 4 [0059.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", pszSpec="*.tar") returned 0 [0059.481] lstrlenA (lpString="*.tar") returned 5 [0059.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", pszSpec="*.gzip") returned 0 [0059.481] lstrlenA (lpString="*.gzip") returned 6 [0059.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", pszSpec="*.jpg") returned 0 [0059.481] lstrlenA (lpString="*.jpg") returned 5 [0059.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", pszSpec="*.jpeg") returned 0 [0059.481] lstrlenA (lpString="*.jpeg") returned 6 [0059.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", pszSpec="*.psd") returned 0 [0059.482] lstrlenA (lpString="*.psd") returned 5 [0059.482] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", pszSpec="*.gif") returned 1 [0059.482] lstrlenA (lpString="*.gif") returned 5 [0059.482] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF" [0059.482] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF" [0059.482] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF." [0059.482] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF.wannacry" [0059.482] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir24f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.482] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f61 [0059.483] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd222f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.483] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.483] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3ee3, lpOverlapped=0x0) returned 1 [0059.488] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF") returned="ZPDIR24F.GIF" [0059.488] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.488] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3ee3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3ee3, lpOverlapped=0x0) returned 1 [0059.489] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.489] CloseHandle (hObject=0x90) returned 1 [0059.489] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir24f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir24f.gif.wannacry")) returned 1 [0059.490] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd222f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x326c, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR25F.GIF", cAlternateFileName="")) returned 1 [0059.490] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.490] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR25F.GIF") returned -1 [0059.491] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR25F.GIF") returned -1 [0059.491] lstrcmpiA (lpString1="", lpString2="ZPDIR25F.GIF") returned -1 [0059.491] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF") returned="ZPDIR24F.GIF" [0059.491] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.491] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.491] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.491] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.491] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR25F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF" [0059.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", pszSpec="*.zip") returned 0 [0059.491] lstrlenA (lpString="*.zip") returned 5 [0059.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", pszSpec="*.rar") returned 0 [0059.491] lstrlenA (lpString="*.rar") returned 5 [0059.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", pszSpec="*.7z") returned 0 [0059.491] lstrlenA (lpString="*.7z") returned 4 [0059.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", pszSpec="*.tar") returned 0 [0059.491] lstrlenA (lpString="*.tar") returned 5 [0059.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", pszSpec="*.gzip") returned 0 [0059.491] lstrlenA (lpString="*.gzip") returned 6 [0059.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", pszSpec="*.jpg") returned 0 [0059.491] lstrlenA (lpString="*.jpg") returned 5 [0059.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", pszSpec="*.jpeg") returned 0 [0059.491] lstrlenA (lpString="*.jpeg") returned 6 [0059.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", pszSpec="*.psd") returned 0 [0059.492] lstrlenA (lpString="*.psd") returned 5 [0059.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", pszSpec="*.gif") returned 1 [0059.492] lstrlenA (lpString="*.gif") returned 5 [0059.492] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF" [0059.492] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF" [0059.492] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF." [0059.492] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF.wannacry" [0059.492] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir25f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.493] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x326c [0059.493] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd222f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.493] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.493] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x31ee, lpOverlapped=0x0) returned 1 [0059.495] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF") returned="ZPDIR25F.GIF" [0059.496] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.496] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x31ee, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x31ee, lpOverlapped=0x0) returned 1 [0059.496] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.496] CloseHandle (hObject=0x90) returned 1 [0059.496] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir25f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir25f.gif.wannacry")) returned 1 [0059.497] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd222f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2072, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR26F.GIF", cAlternateFileName="")) returned 1 [0059.497] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.497] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR26F.GIF") returned -1 [0059.497] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR26F.GIF") returned -1 [0059.497] lstrcmpiA (lpString1="", lpString2="ZPDIR26F.GIF") returned -1 [0059.497] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF") returned="ZPDIR25F.GIF" [0059.497] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.497] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.497] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.497] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.498] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR26F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF" [0059.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", pszSpec="*.zip") returned 0 [0059.498] lstrlenA (lpString="*.zip") returned 5 [0059.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", pszSpec="*.rar") returned 0 [0059.498] lstrlenA (lpString="*.rar") returned 5 [0059.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", pszSpec="*.7z") returned 0 [0059.498] lstrlenA (lpString="*.7z") returned 4 [0059.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", pszSpec="*.tar") returned 0 [0059.498] lstrlenA (lpString="*.tar") returned 5 [0059.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", pszSpec="*.gzip") returned 0 [0059.498] lstrlenA (lpString="*.gzip") returned 6 [0059.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", pszSpec="*.jpg") returned 0 [0059.498] lstrlenA (lpString="*.jpg") returned 5 [0059.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", pszSpec="*.jpeg") returned 0 [0059.498] lstrlenA (lpString="*.jpeg") returned 6 [0059.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", pszSpec="*.psd") returned 0 [0059.498] lstrlenA (lpString="*.psd") returned 5 [0059.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", pszSpec="*.gif") returned 1 [0059.498] lstrlenA (lpString="*.gif") returned 5 [0059.498] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF" [0059.498] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF" [0059.498] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF." [0059.498] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF.wannacry" [0059.499] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir26f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.500] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2072 [0059.500] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd222f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.500] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.500] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1ff4, lpOverlapped=0x0) returned 1 [0059.502] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF") returned="ZPDIR26F.GIF" [0059.502] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.502] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1ff4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1ff4, lpOverlapped=0x0) returned 1 [0059.502] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.502] CloseHandle (hObject=0x90) returned 1 [0059.503] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir26f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir26f.gif.wannacry")) returned 1 [0059.504] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd222f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x20f0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR27F.GIF", cAlternateFileName="")) returned 1 [0059.504] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.504] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR27F.GIF") returned -1 [0059.504] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR27F.GIF") returned -1 [0059.504] lstrcmpiA (lpString1="", lpString2="ZPDIR27F.GIF") returned -1 [0059.504] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF") returned="ZPDIR26F.GIF" [0059.504] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.504] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.504] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.504] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.504] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR27F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF" [0059.504] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", pszSpec="*.zip") returned 0 [0059.504] lstrlenA (lpString="*.zip") returned 5 [0059.504] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", pszSpec="*.rar") returned 0 [0059.504] lstrlenA (lpString="*.rar") returned 5 [0059.504] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", pszSpec="*.7z") returned 0 [0059.504] lstrlenA (lpString="*.7z") returned 4 [0059.504] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", pszSpec="*.tar") returned 0 [0059.505] lstrlenA (lpString="*.tar") returned 5 [0059.505] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", pszSpec="*.gzip") returned 0 [0059.505] lstrlenA (lpString="*.gzip") returned 6 [0059.505] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", pszSpec="*.jpg") returned 0 [0059.505] lstrlenA (lpString="*.jpg") returned 5 [0059.505] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", pszSpec="*.jpeg") returned 0 [0059.505] lstrlenA (lpString="*.jpeg") returned 6 [0059.505] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", pszSpec="*.psd") returned 0 [0059.505] lstrlenA (lpString="*.psd") returned 5 [0059.505] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", pszSpec="*.gif") returned 1 [0059.505] lstrlenA (lpString="*.gif") returned 5 [0059.505] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF" [0059.505] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF" [0059.505] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF." [0059.505] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF.wannacry" [0059.505] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir27f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.506] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x20f0 [0059.506] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd222f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.506] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.506] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2072, lpOverlapped=0x0) returned 1 [0059.508] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF") returned="ZPDIR27F.GIF" [0059.508] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.509] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2072, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2072, lpOverlapped=0x0) returned 1 [0059.509] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.509] CloseHandle (hObject=0x90) returned 1 [0059.509] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir27f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir27f.gif.wannacry")) returned 1 [0059.511] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd222f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x10a3, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR28F.GIF", cAlternateFileName="")) returned 1 [0059.511] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.511] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR28F.GIF") returned -1 [0059.511] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR28F.GIF") returned -1 [0059.511] lstrcmpiA (lpString1="", lpString2="ZPDIR28F.GIF") returned -1 [0059.511] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF") returned="ZPDIR27F.GIF" [0059.511] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.511] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.511] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.511] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.511] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR28F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF" [0059.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", pszSpec="*.zip") returned 0 [0059.511] lstrlenA (lpString="*.zip") returned 5 [0059.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", pszSpec="*.rar") returned 0 [0059.512] lstrlenA (lpString="*.rar") returned 5 [0059.512] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", pszSpec="*.7z") returned 0 [0059.512] lstrlenA (lpString="*.7z") returned 4 [0059.512] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", pszSpec="*.tar") returned 0 [0059.512] lstrlenA (lpString="*.tar") returned 5 [0059.512] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", pszSpec="*.gzip") returned 0 [0059.512] lstrlenA (lpString="*.gzip") returned 6 [0059.512] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", pszSpec="*.jpg") returned 0 [0059.512] lstrlenA (lpString="*.jpg") returned 5 [0059.512] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", pszSpec="*.jpeg") returned 0 [0059.512] lstrlenA (lpString="*.jpeg") returned 6 [0059.512] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", pszSpec="*.psd") returned 0 [0059.512] lstrlenA (lpString="*.psd") returned 5 [0059.512] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", pszSpec="*.gif") returned 1 [0059.512] lstrlenA (lpString="*.gif") returned 5 [0059.512] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF" [0059.512] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF" [0059.512] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF." [0059.512] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF.wannacry" [0059.512] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir28f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.513] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10a3 [0059.513] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd222f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.513] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.513] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1025, lpOverlapped=0x0) returned 1 [0059.551] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF") returned="ZPDIR28F.GIF" [0059.551] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.551] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1025, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1025, lpOverlapped=0x0) returned 1 [0059.551] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.551] CloseHandle (hObject=0x90) returned 1 [0059.552] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir28f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir28f.gif.wannacry")) returned 1 [0059.553] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd222f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1444, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR29F.GIF", cAlternateFileName="")) returned 1 [0059.553] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.553] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR29F.GIF") returned -1 [0059.553] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR29F.GIF") returned -1 [0059.553] lstrcmpiA (lpString1="", lpString2="ZPDIR29F.GIF") returned -1 [0059.553] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF") returned="ZPDIR28F.GIF" [0059.553] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.553] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.553] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.553] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.553] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR29F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF" [0059.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", pszSpec="*.zip") returned 0 [0059.553] lstrlenA (lpString="*.zip") returned 5 [0059.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", pszSpec="*.rar") returned 0 [0059.553] lstrlenA (lpString="*.rar") returned 5 [0059.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", pszSpec="*.7z") returned 0 [0059.553] lstrlenA (lpString="*.7z") returned 4 [0059.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", pszSpec="*.tar") returned 0 [0059.554] lstrlenA (lpString="*.tar") returned 5 [0059.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", pszSpec="*.gzip") returned 0 [0059.554] lstrlenA (lpString="*.gzip") returned 6 [0059.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", pszSpec="*.jpg") returned 0 [0059.554] lstrlenA (lpString="*.jpg") returned 5 [0059.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", pszSpec="*.jpeg") returned 0 [0059.554] lstrlenA (lpString="*.jpeg") returned 6 [0059.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", pszSpec="*.psd") returned 0 [0059.554] lstrlenA (lpString="*.psd") returned 5 [0059.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", pszSpec="*.gif") returned 1 [0059.554] lstrlenA (lpString="*.gif") returned 5 [0059.554] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF" [0059.554] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF" [0059.554] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF." [0059.554] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF.wannacry" [0059.554] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir29f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.555] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1444 [0059.555] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd222f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.555] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.555] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x13c6, lpOverlapped=0x0) returned 1 [0059.598] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF") returned="ZPDIR29F.GIF" [0059.598] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.598] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x13c6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x13c6, lpOverlapped=0x0) returned 1 [0059.599] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.599] CloseHandle (hObject=0x90) returned 1 [0059.599] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir29f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir29f.gif.wannacry")) returned 1 [0059.600] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20a5ff00, ftCreationTime.dwHighDateTime=0x1bdb3a4, ftLastAccessTime.dwLowDateTime=0x1bd222f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20a5ff00, ftLastWriteTime.dwHighDateTime=0x1bdb3a4, nFileSizeHigh=0x0, nFileSizeLow=0xc49, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR2B.GIF", cAlternateFileName="")) returned 1 [0059.600] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.600] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR2B.GIF") returned -1 [0059.600] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR2B.GIF") returned -1 [0059.600] lstrcmpiA (lpString1="", lpString2="ZPDIR2B.GIF") returned -1 [0059.600] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF") returned="ZPDIR29F.GIF" [0059.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.600] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.600] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.600] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.600] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR2B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF" [0059.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", pszSpec="*.zip") returned 0 [0059.601] lstrlenA (lpString="*.zip") returned 5 [0059.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", pszSpec="*.rar") returned 0 [0059.601] lstrlenA (lpString="*.rar") returned 5 [0059.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", pszSpec="*.7z") returned 0 [0059.601] lstrlenA (lpString="*.7z") returned 4 [0059.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", pszSpec="*.tar") returned 0 [0059.601] lstrlenA (lpString="*.tar") returned 5 [0059.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", pszSpec="*.gzip") returned 0 [0059.601] lstrlenA (lpString="*.gzip") returned 6 [0059.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", pszSpec="*.jpg") returned 0 [0059.601] lstrlenA (lpString="*.jpg") returned 5 [0059.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", pszSpec="*.jpeg") returned 0 [0059.601] lstrlenA (lpString="*.jpeg") returned 6 [0059.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", pszSpec="*.psd") returned 0 [0059.601] lstrlenA (lpString="*.psd") returned 5 [0059.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", pszSpec="*.gif") returned 1 [0059.601] lstrlenA (lpString="*.gif") returned 5 [0059.601] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF" [0059.601] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF" [0059.601] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF." [0059.601] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF.wannacry" [0059.601] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.603] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc49 [0059.603] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x20a5ff00, dwHighDateTime=0x1bdb3a4), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd222f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x20a5ff00, dwHighDateTime=0x1bdb3a4)) returned 1 [0059.603] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.603] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xbcb, lpOverlapped=0x0) returned 1 [0059.615] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF") returned="ZPDIR2B.GIF" [0059.615] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.615] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xbcb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xbcb, lpOverlapped=0x0) returned 1 [0059.616] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.616] CloseHandle (hObject=0x90) returned 1 [0059.616] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2b.gif.wannacry")) returned 1 [0059.617] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x154f, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR2F.GIF", cAlternateFileName="")) returned 1 [0059.617] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.617] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR2F.GIF") returned -1 [0059.617] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR2F.GIF") returned -1 [0059.617] lstrcmpiA (lpString1="", lpString2="ZPDIR2F.GIF") returned -1 [0059.617] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF") returned="ZPDIR2B.GIF" [0059.617] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.617] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.617] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.617] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.618] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR2F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF" [0059.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", pszSpec="*.zip") returned 0 [0059.618] lstrlenA (lpString="*.zip") returned 5 [0059.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", pszSpec="*.rar") returned 0 [0059.618] lstrlenA (lpString="*.rar") returned 5 [0059.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", pszSpec="*.7z") returned 0 [0059.618] lstrlenA (lpString="*.7z") returned 4 [0059.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", pszSpec="*.tar") returned 0 [0059.618] lstrlenA (lpString="*.tar") returned 5 [0059.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", pszSpec="*.gzip") returned 0 [0059.618] lstrlenA (lpString="*.gzip") returned 6 [0059.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", pszSpec="*.jpg") returned 0 [0059.618] lstrlenA (lpString="*.jpg") returned 5 [0059.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", pszSpec="*.jpeg") returned 0 [0059.618] lstrlenA (lpString="*.jpeg") returned 6 [0059.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", pszSpec="*.psd") returned 0 [0059.618] lstrlenA (lpString="*.psd") returned 5 [0059.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", pszSpec="*.gif") returned 1 [0059.618] lstrlenA (lpString="*.gif") returned 5 [0059.618] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF" [0059.618] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF" [0059.618] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF." [0059.618] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF.wannacry" [0059.619] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.619] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x154f [0059.619] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd48450, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.619] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.619] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x14d1, lpOverlapped=0x0) returned 1 [0059.635] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF") returned="ZPDIR2F.GIF" [0059.635] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.635] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x14d1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x14d1, lpOverlapped=0x0) returned 1 [0059.636] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.636] CloseHandle (hObject=0x90) returned 1 [0059.636] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2f.gif.wannacry")) returned 1 [0059.639] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x905a, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR30F.GIF", cAlternateFileName="")) returned 1 [0059.639] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.639] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR30F.GIF") returned -1 [0059.639] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR30F.GIF") returned -1 [0059.639] lstrcmpiA (lpString1="", lpString2="ZPDIR30F.GIF") returned -1 [0059.639] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF") returned="ZPDIR2F.GIF" [0059.639] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.639] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.639] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.639] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.639] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR30F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF" [0059.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", pszSpec="*.zip") returned 0 [0059.639] lstrlenA (lpString="*.zip") returned 5 [0059.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", pszSpec="*.rar") returned 0 [0059.639] lstrlenA (lpString="*.rar") returned 5 [0059.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", pszSpec="*.7z") returned 0 [0059.640] lstrlenA (lpString="*.7z") returned 4 [0059.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", pszSpec="*.tar") returned 0 [0059.640] lstrlenA (lpString="*.tar") returned 5 [0059.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", pszSpec="*.gzip") returned 0 [0059.640] lstrlenA (lpString="*.gzip") returned 6 [0059.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", pszSpec="*.jpg") returned 0 [0059.640] lstrlenA (lpString="*.jpg") returned 5 [0059.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", pszSpec="*.jpeg") returned 0 [0059.640] lstrlenA (lpString="*.jpeg") returned 6 [0059.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", pszSpec="*.psd") returned 0 [0059.640] lstrlenA (lpString="*.psd") returned 5 [0059.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", pszSpec="*.gif") returned 1 [0059.640] lstrlenA (lpString="*.gif") returned 5 [0059.640] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF" [0059.640] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF" [0059.640] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF." [0059.640] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF.wannacry" [0059.640] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir30f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.641] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x905a [0059.641] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd48450, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.641] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.641] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x8fdc, lpOverlapped=0x0) returned 1 [0059.695] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF") returned="ZPDIR30F.GIF" [0059.695] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.696] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x8fdc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x8fdc, lpOverlapped=0x0) returned 1 [0059.696] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.696] CloseHandle (hObject=0x90) returned 1 [0059.696] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir30f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir30f.gif.wannacry")) returned 1 [0059.697] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3b6e, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR31F.GIF", cAlternateFileName="")) returned 1 [0059.697] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.698] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR31F.GIF") returned -1 [0059.698] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR31F.GIF") returned -1 [0059.698] lstrcmpiA (lpString1="", lpString2="ZPDIR31F.GIF") returned -1 [0059.698] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF") returned="ZPDIR30F.GIF" [0059.698] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.698] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.698] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.698] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.698] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR31F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF" [0059.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", pszSpec="*.zip") returned 0 [0059.698] lstrlenA (lpString="*.zip") returned 5 [0059.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", pszSpec="*.rar") returned 0 [0059.698] lstrlenA (lpString="*.rar") returned 5 [0059.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", pszSpec="*.7z") returned 0 [0059.698] lstrlenA (lpString="*.7z") returned 4 [0059.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", pszSpec="*.tar") returned 0 [0059.698] lstrlenA (lpString="*.tar") returned 5 [0059.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", pszSpec="*.gzip") returned 0 [0059.698] lstrlenA (lpString="*.gzip") returned 6 [0059.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", pszSpec="*.jpg") returned 0 [0059.698] lstrlenA (lpString="*.jpg") returned 5 [0059.698] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", pszSpec="*.jpeg") returned 0 [0059.698] lstrlenA (lpString="*.jpeg") returned 6 [0059.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", pszSpec="*.psd") returned 0 [0059.699] lstrlenA (lpString="*.psd") returned 5 [0059.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", pszSpec="*.gif") returned 1 [0059.699] lstrlenA (lpString="*.gif") returned 5 [0059.699] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF" [0059.699] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF" [0059.699] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF." [0059.699] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF.wannacry" [0059.699] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir31f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.699] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b6e [0059.700] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd48450, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.700] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.700] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3af0, lpOverlapped=0x0) returned 1 [0059.702] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF") returned="ZPDIR31F.GIF" [0059.702] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.702] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3af0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3af0, lpOverlapped=0x0) returned 1 [0059.702] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.702] CloseHandle (hObject=0x90) returned 1 [0059.702] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir31f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir31f.gif.wannacry")) returned 1 [0059.703] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x9eb1, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR32F.GIF", cAlternateFileName="")) returned 1 [0059.703] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.703] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR32F.GIF") returned -1 [0059.703] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR32F.GIF") returned -1 [0059.703] lstrcmpiA (lpString1="", lpString2="ZPDIR32F.GIF") returned -1 [0059.703] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF") returned="ZPDIR31F.GIF" [0059.703] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.703] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.703] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.703] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.704] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR32F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF" [0059.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", pszSpec="*.zip") returned 0 [0059.704] lstrlenA (lpString="*.zip") returned 5 [0059.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", pszSpec="*.rar") returned 0 [0059.704] lstrlenA (lpString="*.rar") returned 5 [0059.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", pszSpec="*.7z") returned 0 [0059.704] lstrlenA (lpString="*.7z") returned 4 [0059.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", pszSpec="*.tar") returned 0 [0059.704] lstrlenA (lpString="*.tar") returned 5 [0059.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", pszSpec="*.gzip") returned 0 [0059.704] lstrlenA (lpString="*.gzip") returned 6 [0059.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", pszSpec="*.jpg") returned 0 [0059.704] lstrlenA (lpString="*.jpg") returned 5 [0059.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", pszSpec="*.jpeg") returned 0 [0059.704] lstrlenA (lpString="*.jpeg") returned 6 [0059.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", pszSpec="*.psd") returned 0 [0059.704] lstrlenA (lpString="*.psd") returned 5 [0059.704] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", pszSpec="*.gif") returned 1 [0059.704] lstrlenA (lpString="*.gif") returned 5 [0059.704] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF" [0059.704] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF" [0059.704] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF." [0059.704] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF.wannacry" [0059.704] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir32f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.706] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9eb1 [0059.706] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd48450, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.706] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.706] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x9e33, lpOverlapped=0x0) returned 1 [0059.708] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF") returned="ZPDIR32F.GIF" [0059.708] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.709] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x9e33, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x9e33, lpOverlapped=0x0) returned 1 [0059.709] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.709] CloseHandle (hObject=0x90) returned 1 [0059.709] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir32f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir32f.gif.wannacry")) returned 1 [0059.710] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x5a34, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR33F.GIF", cAlternateFileName="")) returned 1 [0059.710] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.710] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR33F.GIF") returned -1 [0059.710] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR33F.GIF") returned -1 [0059.710] lstrcmpiA (lpString1="", lpString2="ZPDIR33F.GIF") returned -1 [0059.710] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF") returned="ZPDIR32F.GIF" [0059.711] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.711] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.711] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.711] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.711] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR33F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF" [0059.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", pszSpec="*.zip") returned 0 [0059.711] lstrlenA (lpString="*.zip") returned 5 [0059.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", pszSpec="*.rar") returned 0 [0059.711] lstrlenA (lpString="*.rar") returned 5 [0059.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", pszSpec="*.7z") returned 0 [0059.711] lstrlenA (lpString="*.7z") returned 4 [0059.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", pszSpec="*.tar") returned 0 [0059.711] lstrlenA (lpString="*.tar") returned 5 [0059.711] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", pszSpec="*.gzip") returned 0 [0059.725] lstrlenA (lpString="*.gzip") returned 6 [0059.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", pszSpec="*.jpg") returned 0 [0059.725] lstrlenA (lpString="*.jpg") returned 5 [0059.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", pszSpec="*.jpeg") returned 0 [0059.725] lstrlenA (lpString="*.jpeg") returned 6 [0059.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", pszSpec="*.psd") returned 0 [0059.725] lstrlenA (lpString="*.psd") returned 5 [0059.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", pszSpec="*.gif") returned 1 [0059.725] lstrlenA (lpString="*.gif") returned 5 [0059.725] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF" [0059.725] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF" [0059.725] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF." [0059.725] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF.wannacry" [0059.725] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir33f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.726] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5a34 [0059.726] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd48450, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.726] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.726] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x59b6, lpOverlapped=0x0) returned 1 [0059.760] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF") returned="ZPDIR33F.GIF" [0059.760] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.760] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x59b6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x59b6, lpOverlapped=0x0) returned 1 [0059.760] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.760] CloseHandle (hObject=0x90) returned 1 [0059.761] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir33f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir33f.gif.wannacry")) returned 1 [0059.762] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa9f0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR34F.GIF", cAlternateFileName="")) returned 1 [0059.762] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.762] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR34F.GIF") returned -1 [0059.762] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR34F.GIF") returned -1 [0059.762] lstrcmpiA (lpString1="", lpString2="ZPDIR34F.GIF") returned -1 [0059.762] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF") returned="ZPDIR33F.GIF" [0059.762] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.765] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.765] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.765] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.765] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR34F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF" [0059.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", pszSpec="*.zip") returned 0 [0059.765] lstrlenA (lpString="*.zip") returned 5 [0059.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", pszSpec="*.rar") returned 0 [0059.765] lstrlenA (lpString="*.rar") returned 5 [0059.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", pszSpec="*.7z") returned 0 [0059.765] lstrlenA (lpString="*.7z") returned 4 [0059.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", pszSpec="*.tar") returned 0 [0059.765] lstrlenA (lpString="*.tar") returned 5 [0059.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", pszSpec="*.gzip") returned 0 [0059.765] lstrlenA (lpString="*.gzip") returned 6 [0059.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", pszSpec="*.jpg") returned 0 [0059.765] lstrlenA (lpString="*.jpg") returned 5 [0059.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", pszSpec="*.jpeg") returned 0 [0059.765] lstrlenA (lpString="*.jpeg") returned 6 [0059.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", pszSpec="*.psd") returned 0 [0059.765] lstrlenA (lpString="*.psd") returned 5 [0059.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", pszSpec="*.gif") returned 1 [0059.765] lstrlenA (lpString="*.gif") returned 5 [0059.765] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF" [0059.766] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir34f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.766] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa9f0 [0059.766] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd48450, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.766] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.767] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xa972, lpOverlapped=0x0) returned 1 [0059.805] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF") returned="ZPDIR34F.GIF" [0059.805] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.805] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xa972, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xa972, lpOverlapped=0x0) returned 1 [0059.806] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.806] CloseHandle (hObject=0x90) returned 1 [0059.806] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir34f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir34f.gif.wannacry")) returned 1 [0059.807] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4660, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR35F.GIF", cAlternateFileName="")) returned 1 [0059.807] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.807] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR35F.GIF") returned -1 [0059.807] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR35F.GIF") returned -1 [0059.807] lstrcmpiA (lpString1="", lpString2="ZPDIR35F.GIF") returned -1 [0059.807] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF") returned="ZPDIR34F.GIF" [0059.807] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.808] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.808] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.808] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR35F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF" [0059.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", pszSpec="*.zip") returned 0 [0059.808] lstrlenA (lpString="*.zip") returned 5 [0059.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", pszSpec="*.rar") returned 0 [0059.808] lstrlenA (lpString="*.rar") returned 5 [0059.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", pszSpec="*.7z") returned 0 [0059.808] lstrlenA (lpString="*.7z") returned 4 [0059.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", pszSpec="*.tar") returned 0 [0059.808] lstrlenA (lpString="*.tar") returned 5 [0059.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", pszSpec="*.gzip") returned 0 [0059.808] lstrlenA (lpString="*.gzip") returned 6 [0059.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", pszSpec="*.jpg") returned 0 [0059.808] lstrlenA (lpString="*.jpg") returned 5 [0059.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", pszSpec="*.jpeg") returned 0 [0059.808] lstrlenA (lpString="*.jpeg") returned 6 [0059.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", pszSpec="*.psd") returned 0 [0059.808] lstrlenA (lpString="*.psd") returned 5 [0059.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", pszSpec="*.gif") returned 1 [0059.808] lstrlenA (lpString="*.gif") returned 5 [0059.808] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF" [0059.808] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF" [0059.808] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF." [0059.809] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF.wannacry" [0059.809] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir35f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.809] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4660 [0059.809] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd48450, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.809] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.809] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x45e2, lpOverlapped=0x0) returned 1 [0059.812] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF") returned="ZPDIR35F.GIF" [0059.812] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.812] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x45e2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x45e2, lpOverlapped=0x0) returned 1 [0059.812] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.812] CloseHandle (hObject=0x90) returned 1 [0059.812] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir35f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir35f.gif.wannacry")) returned 1 [0059.813] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x875e, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR36F.GIF", cAlternateFileName="")) returned 1 [0059.813] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.816] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR36F.GIF") returned -1 [0059.816] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR36F.GIF") returned -1 [0059.816] lstrcmpiA (lpString1="", lpString2="ZPDIR36F.GIF") returned -1 [0059.816] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF") returned="ZPDIR35F.GIF" [0059.816] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.816] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.816] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.816] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.816] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR36F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF" [0059.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", pszSpec="*.zip") returned 0 [0059.816] lstrlenA (lpString="*.zip") returned 5 [0059.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", pszSpec="*.rar") returned 0 [0059.816] lstrlenA (lpString="*.rar") returned 5 [0059.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", pszSpec="*.7z") returned 0 [0059.816] lstrlenA (lpString="*.7z") returned 4 [0059.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", pszSpec="*.tar") returned 0 [0059.816] lstrlenA (lpString="*.tar") returned 5 [0059.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", pszSpec="*.gzip") returned 0 [0059.816] lstrlenA (lpString="*.gzip") returned 6 [0059.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", pszSpec="*.jpg") returned 0 [0059.816] lstrlenA (lpString="*.jpg") returned 5 [0059.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", pszSpec="*.jpeg") returned 0 [0059.816] lstrlenA (lpString="*.jpeg") returned 6 [0059.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", pszSpec="*.psd") returned 0 [0059.817] lstrlenA (lpString="*.psd") returned 5 [0059.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", pszSpec="*.gif") returned 1 [0059.817] lstrlenA (lpString="*.gif") returned 5 [0059.817] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF" [0059.817] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF" [0059.817] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF." [0059.817] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF.wannacry" [0059.817] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir36f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.879] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x875e [0059.879] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd48450, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.880] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.880] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x86e0, lpOverlapped=0x0) returned 1 [0059.882] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF") returned="ZPDIR36F.GIF" [0059.882] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.882] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x86e0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x86e0, lpOverlapped=0x0) returned 1 [0059.883] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.883] CloseHandle (hObject=0x90) returned 1 [0059.883] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir36f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir36f.gif.wannacry")) returned 1 [0059.884] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xd1ac, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR37F.GIF", cAlternateFileName="")) returned 1 [0059.884] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.884] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR37F.GIF") returned -1 [0059.884] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR37F.GIF") returned -1 [0059.884] lstrcmpiA (lpString1="", lpString2="ZPDIR37F.GIF") returned -1 [0059.884] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF") returned="ZPDIR36F.GIF" [0059.884] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.884] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.884] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.884] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.884] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR37F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF" [0059.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", pszSpec="*.zip") returned 0 [0059.885] lstrlenA (lpString="*.zip") returned 5 [0059.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", pszSpec="*.rar") returned 0 [0059.885] lstrlenA (lpString="*.rar") returned 5 [0059.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", pszSpec="*.7z") returned 0 [0059.885] lstrlenA (lpString="*.7z") returned 4 [0059.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", pszSpec="*.tar") returned 0 [0059.885] lstrlenA (lpString="*.tar") returned 5 [0059.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", pszSpec="*.gzip") returned 0 [0059.885] lstrlenA (lpString="*.gzip") returned 6 [0059.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", pszSpec="*.jpg") returned 0 [0059.885] lstrlenA (lpString="*.jpg") returned 5 [0059.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", pszSpec="*.jpeg") returned 0 [0059.885] lstrlenA (lpString="*.jpeg") returned 6 [0059.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", pszSpec="*.psd") returned 0 [0059.885] lstrlenA (lpString="*.psd") returned 5 [0059.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", pszSpec="*.gif") returned 1 [0059.885] lstrlenA (lpString="*.gif") returned 5 [0059.885] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF" [0059.885] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF" [0059.885] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF." [0059.885] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF.wannacry" [0059.885] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir37f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.886] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd1ac [0059.886] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd6e5b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.886] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.886] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd12e, lpOverlapped=0x0) returned 1 [0059.889] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF") returned="ZPDIR37F.GIF" [0059.889] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.889] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd12e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd12e, lpOverlapped=0x0) returned 1 [0059.890] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.890] CloseHandle (hObject=0x90) returned 1 [0059.890] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir37f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir37f.gif.wannacry")) returned 1 [0059.891] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xcbc3, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR38F.GIF", cAlternateFileName="")) returned 1 [0059.891] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.891] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR38F.GIF") returned -1 [0059.891] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR38F.GIF") returned -1 [0059.891] lstrcmpiA (lpString1="", lpString2="ZPDIR38F.GIF") returned -1 [0059.891] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF") returned="ZPDIR37F.GIF" [0059.891] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.891] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.891] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.891] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.891] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR38F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF" [0059.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", pszSpec="*.zip") returned 0 [0059.891] lstrlenA (lpString="*.zip") returned 5 [0059.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", pszSpec="*.rar") returned 0 [0059.891] lstrlenA (lpString="*.rar") returned 5 [0059.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", pszSpec="*.7z") returned 0 [0059.891] lstrlenA (lpString="*.7z") returned 4 [0059.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", pszSpec="*.tar") returned 0 [0059.892] lstrlenA (lpString="*.tar") returned 5 [0059.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", pszSpec="*.gzip") returned 0 [0059.892] lstrlenA (lpString="*.gzip") returned 6 [0059.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", pszSpec="*.jpg") returned 0 [0059.892] lstrlenA (lpString="*.jpg") returned 5 [0059.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", pszSpec="*.jpeg") returned 0 [0059.892] lstrlenA (lpString="*.jpeg") returned 6 [0059.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", pszSpec="*.psd") returned 0 [0059.892] lstrlenA (lpString="*.psd") returned 5 [0059.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", pszSpec="*.gif") returned 1 [0059.892] lstrlenA (lpString="*.gif") returned 5 [0059.892] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF" [0059.892] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF" [0059.892] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF." [0059.892] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF.wannacry" [0059.892] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir38f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.893] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcbc3 [0059.893] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd6e5b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.893] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.893] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xcb45, lpOverlapped=0x0) returned 1 [0059.896] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF") returned="ZPDIR38F.GIF" [0059.896] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.896] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xcb45, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xcb45, lpOverlapped=0x0) returned 1 [0059.896] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.896] CloseHandle (hObject=0x90) returned 1 [0059.896] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir38f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir38f.gif.wannacry")) returned 1 [0059.897] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xdc9a, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR39F.GIF", cAlternateFileName="")) returned 1 [0059.897] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.897] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR39F.GIF") returned -1 [0059.897] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR39F.GIF") returned -1 [0059.897] lstrcmpiA (lpString1="", lpString2="ZPDIR39F.GIF") returned -1 [0059.897] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF") returned="ZPDIR38F.GIF" [0059.898] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.898] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.898] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.898] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.898] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR39F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF" [0059.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", pszSpec="*.zip") returned 0 [0059.898] lstrlenA (lpString="*.zip") returned 5 [0059.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", pszSpec="*.rar") returned 0 [0059.898] lstrlenA (lpString="*.rar") returned 5 [0059.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", pszSpec="*.7z") returned 0 [0059.898] lstrlenA (lpString="*.7z") returned 4 [0059.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", pszSpec="*.tar") returned 0 [0059.898] lstrlenA (lpString="*.tar") returned 5 [0059.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", pszSpec="*.gzip") returned 0 [0059.898] lstrlenA (lpString="*.gzip") returned 6 [0059.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", pszSpec="*.jpg") returned 0 [0059.898] lstrlenA (lpString="*.jpg") returned 5 [0059.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", pszSpec="*.jpeg") returned 0 [0059.898] lstrlenA (lpString="*.jpeg") returned 6 [0059.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", pszSpec="*.psd") returned 0 [0059.899] lstrlenA (lpString="*.psd") returned 5 [0059.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", pszSpec="*.gif") returned 1 [0059.899] lstrlenA (lpString="*.gif") returned 5 [0059.899] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF" [0059.899] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF" [0059.899] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF." [0059.899] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF.wannacry" [0059.899] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir39f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.899] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdc9a [0059.899] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd6e5b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.899] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.900] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xdc1c, lpOverlapped=0x0) returned 1 [0059.902] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF") returned="ZPDIR39F.GIF" [0059.902] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.902] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xdc1c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xdc1c, lpOverlapped=0x0) returned 1 [0059.903] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.920] CloseHandle (hObject=0x90) returned 1 [0059.920] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir39f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir39f.gif.wannacry")) returned 1 [0059.921] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3a1e, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR3B.GIF", cAlternateFileName="")) returned 1 [0059.922] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.922] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR3B.GIF") returned -1 [0059.922] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR3B.GIF") returned -1 [0059.922] lstrcmpiA (lpString1="", lpString2="ZPDIR3B.GIF") returned -1 [0059.922] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF") returned="ZPDIR39F.GIF" [0059.922] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.922] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.922] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.922] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.922] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR3B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF" [0059.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", pszSpec="*.zip") returned 0 [0059.922] lstrlenA (lpString="*.zip") returned 5 [0059.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", pszSpec="*.rar") returned 0 [0059.922] lstrlenA (lpString="*.rar") returned 5 [0059.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", pszSpec="*.7z") returned 0 [0059.922] lstrlenA (lpString="*.7z") returned 4 [0059.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", pszSpec="*.tar") returned 0 [0059.923] lstrlenA (lpString="*.tar") returned 5 [0059.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", pszSpec="*.gzip") returned 0 [0059.923] lstrlenA (lpString="*.gzip") returned 6 [0059.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", pszSpec="*.jpg") returned 0 [0059.923] lstrlenA (lpString="*.jpg") returned 5 [0059.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", pszSpec="*.jpeg") returned 0 [0059.923] lstrlenA (lpString="*.jpeg") returned 6 [0059.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", pszSpec="*.psd") returned 0 [0059.923] lstrlenA (lpString="*.psd") returned 5 [0059.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", pszSpec="*.gif") returned 1 [0059.923] lstrlenA (lpString="*.gif") returned 5 [0059.923] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF" [0059.923] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF" [0059.923] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF." [0059.923] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF.wannacry" [0059.923] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.925] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a1e [0059.925] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd6e5b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.925] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.925] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x39a0, lpOverlapped=0x0) returned 1 [0059.928] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF") returned="ZPDIR3B.GIF" [0059.928] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.928] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x39a0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x39a0, lpOverlapped=0x0) returned 1 [0059.928] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.928] CloseHandle (hObject=0x90) returned 1 [0059.928] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3b.gif.wannacry")) returned 1 [0059.929] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x58e2, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR3F.GIF", cAlternateFileName="")) returned 1 [0059.930] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.930] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR3F.GIF") returned -1 [0059.930] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR3F.GIF") returned -1 [0059.930] lstrcmpiA (lpString1="", lpString2="ZPDIR3F.GIF") returned -1 [0059.930] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF") returned="ZPDIR3B.GIF" [0059.930] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.930] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.930] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.930] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.930] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR3F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF" [0059.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", pszSpec="*.zip") returned 0 [0059.930] lstrlenA (lpString="*.zip") returned 5 [0059.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", pszSpec="*.rar") returned 0 [0059.931] lstrlenA (lpString="*.rar") returned 5 [0059.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", pszSpec="*.7z") returned 0 [0059.931] lstrlenA (lpString="*.7z") returned 4 [0059.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", pszSpec="*.tar") returned 0 [0059.931] lstrlenA (lpString="*.tar") returned 5 [0059.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", pszSpec="*.gzip") returned 0 [0059.931] lstrlenA (lpString="*.gzip") returned 6 [0059.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", pszSpec="*.jpg") returned 0 [0059.931] lstrlenA (lpString="*.jpg") returned 5 [0059.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", pszSpec="*.jpeg") returned 0 [0059.931] lstrlenA (lpString="*.jpeg") returned 6 [0059.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", pszSpec="*.psd") returned 0 [0059.931] lstrlenA (lpString="*.psd") returned 5 [0059.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", pszSpec="*.gif") returned 1 [0059.931] lstrlenA (lpString="*.gif") returned 5 [0059.931] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF" [0059.931] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF" [0059.931] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF." [0059.931] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF.wannacry" [0059.931] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.932] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x58e2 [0059.932] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd6e5b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.932] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.932] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x5864, lpOverlapped=0x0) returned 1 [0059.935] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF") returned="ZPDIR3F.GIF" [0059.935] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.935] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x5864, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x5864, lpOverlapped=0x0) returned 1 [0059.935] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.935] CloseHandle (hObject=0x90) returned 1 [0059.936] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3f.gif.wannacry")) returned 1 [0059.937] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x112a3, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR40F.GIF", cAlternateFileName="")) returned 1 [0059.937] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.937] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR40F.GIF") returned -1 [0059.937] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR40F.GIF") returned -1 [0059.937] lstrcmpiA (lpString1="", lpString2="ZPDIR40F.GIF") returned -1 [0059.937] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF") returned="ZPDIR3F.GIF" [0059.937] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.937] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.937] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.937] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.937] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR40F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF" [0059.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", pszSpec="*.zip") returned 0 [0059.937] lstrlenA (lpString="*.zip") returned 5 [0059.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", pszSpec="*.rar") returned 0 [0059.937] lstrlenA (lpString="*.rar") returned 5 [0059.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", pszSpec="*.7z") returned 0 [0059.937] lstrlenA (lpString="*.7z") returned 4 [0059.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", pszSpec="*.tar") returned 0 [0059.937] lstrlenA (lpString="*.tar") returned 5 [0059.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", pszSpec="*.gzip") returned 0 [0059.938] lstrlenA (lpString="*.gzip") returned 6 [0059.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", pszSpec="*.jpg") returned 0 [0059.938] lstrlenA (lpString="*.jpg") returned 5 [0059.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", pszSpec="*.jpeg") returned 0 [0059.938] lstrlenA (lpString="*.jpeg") returned 6 [0059.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", pszSpec="*.psd") returned 0 [0059.938] lstrlenA (lpString="*.psd") returned 5 [0059.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", pszSpec="*.gif") returned 1 [0059.938] lstrlenA (lpString="*.gif") returned 5 [0059.938] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF" [0059.938] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF" [0059.938] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF." [0059.938] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF.wannacry" [0059.938] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir40f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.939] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x112a3 [0059.939] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd6e5b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.939] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.939] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x11225, lpOverlapped=0x0) returned 1 [0059.942] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF") returned="ZPDIR40F.GIF" [0059.942] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.942] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x11225, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x11225, lpOverlapped=0x0) returned 1 [0059.943] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.943] CloseHandle (hObject=0x90) returned 1 [0059.943] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir40f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir40f.gif.wannacry")) returned 1 [0059.944] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x9a60, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR41F.GIF", cAlternateFileName="")) returned 1 [0059.944] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.944] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR41F.GIF") returned -1 [0059.944] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR41F.GIF") returned -1 [0059.944] lstrcmpiA (lpString1="", lpString2="ZPDIR41F.GIF") returned -1 [0059.944] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF") returned="ZPDIR40F.GIF" [0059.944] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.944] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.944] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.944] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.944] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR41F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF" [0059.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", pszSpec="*.zip") returned 0 [0059.944] lstrlenA (lpString="*.zip") returned 5 [0059.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", pszSpec="*.rar") returned 0 [0059.945] lstrlenA (lpString="*.rar") returned 5 [0059.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", pszSpec="*.7z") returned 0 [0059.945] lstrlenA (lpString="*.7z") returned 4 [0059.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", pszSpec="*.tar") returned 0 [0059.945] lstrlenA (lpString="*.tar") returned 5 [0059.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", pszSpec="*.gzip") returned 0 [0059.945] lstrlenA (lpString="*.gzip") returned 6 [0059.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", pszSpec="*.jpg") returned 0 [0059.945] lstrlenA (lpString="*.jpg") returned 5 [0059.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", pszSpec="*.jpeg") returned 0 [0059.945] lstrlenA (lpString="*.jpeg") returned 6 [0059.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", pszSpec="*.psd") returned 0 [0059.945] lstrlenA (lpString="*.psd") returned 5 [0059.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", pszSpec="*.gif") returned 1 [0059.945] lstrlenA (lpString="*.gif") returned 5 [0059.945] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF" [0059.945] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF" [0059.945] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF." [0059.945] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF.wannacry" [0059.946] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir41f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.946] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9a60 [0059.946] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd6e5b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.946] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.946] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x99e2, lpOverlapped=0x0) returned 1 [0059.951] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF") returned="ZPDIR41F.GIF" [0059.951] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.951] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x99e2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x99e2, lpOverlapped=0x0) returned 1 [0059.951] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.951] CloseHandle (hObject=0x90) returned 1 [0059.952] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir41f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir41f.gif.wannacry")) returned 1 [0059.952] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xe591, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR42F.GIF", cAlternateFileName="")) returned 1 [0059.953] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.953] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR42F.GIF") returned -1 [0059.953] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR42F.GIF") returned -1 [0059.953] lstrcmpiA (lpString1="", lpString2="ZPDIR42F.GIF") returned -1 [0059.953] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF") returned="ZPDIR41F.GIF" [0059.953] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.953] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.953] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.953] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.953] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR42F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF" [0059.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", pszSpec="*.zip") returned 0 [0059.953] lstrlenA (lpString="*.zip") returned 5 [0059.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", pszSpec="*.rar") returned 0 [0059.953] lstrlenA (lpString="*.rar") returned 5 [0059.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", pszSpec="*.7z") returned 0 [0059.953] lstrlenA (lpString="*.7z") returned 4 [0059.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", pszSpec="*.tar") returned 0 [0059.953] lstrlenA (lpString="*.tar") returned 5 [0059.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", pszSpec="*.gzip") returned 0 [0059.954] lstrlenA (lpString="*.gzip") returned 6 [0059.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", pszSpec="*.jpg") returned 0 [0059.954] lstrlenA (lpString="*.jpg") returned 5 [0059.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", pszSpec="*.jpeg") returned 0 [0059.954] lstrlenA (lpString="*.jpeg") returned 6 [0059.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", pszSpec="*.psd") returned 0 [0059.954] lstrlenA (lpString="*.psd") returned 5 [0059.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", pszSpec="*.gif") returned 1 [0059.954] lstrlenA (lpString="*.gif") returned 5 [0059.954] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF" [0059.954] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF" [0059.954] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF." [0059.954] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF.wannacry" [0059.954] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir42f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.956] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe591 [0059.956] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd6e5b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.956] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.956] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xe513, lpOverlapped=0x0) returned 1 [0059.959] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF") returned="ZPDIR42F.GIF" [0059.959] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.959] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xe513, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xe513, lpOverlapped=0x0) returned 1 [0059.959] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.959] CloseHandle (hObject=0x90) returned 1 [0059.960] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir42f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir42f.gif.wannacry")) returned 1 [0059.960] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x98a, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR43B.GIF", cAlternateFileName="")) returned 1 [0059.961] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.961] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR43B.GIF") returned -1 [0059.961] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR43B.GIF") returned -1 [0059.961] lstrcmpiA (lpString1="", lpString2="ZPDIR43B.GIF") returned -1 [0059.961] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF") returned="ZPDIR42F.GIF" [0059.961] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.961] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.961] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.961] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.961] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR43B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF" [0059.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", pszSpec="*.zip") returned 0 [0059.961] lstrlenA (lpString="*.zip") returned 5 [0059.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", pszSpec="*.rar") returned 0 [0059.961] lstrlenA (lpString="*.rar") returned 5 [0059.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", pszSpec="*.7z") returned 0 [0059.961] lstrlenA (lpString="*.7z") returned 4 [0059.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", pszSpec="*.tar") returned 0 [0059.961] lstrlenA (lpString="*.tar") returned 5 [0059.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", pszSpec="*.gzip") returned 0 [0059.962] lstrlenA (lpString="*.gzip") returned 6 [0059.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", pszSpec="*.jpg") returned 0 [0059.962] lstrlenA (lpString="*.jpg") returned 5 [0059.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", pszSpec="*.jpeg") returned 0 [0059.962] lstrlenA (lpString="*.jpeg") returned 6 [0059.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", pszSpec="*.psd") returned 0 [0059.962] lstrlenA (lpString="*.psd") returned 5 [0059.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", pszSpec="*.gif") returned 1 [0059.962] lstrlenA (lpString="*.gif") returned 5 [0059.962] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF" [0059.962] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF" [0059.962] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF." [0059.962] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF.wannacry" [0059.962] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.963] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x98a [0059.963] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd6e5b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.963] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.963] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x90c, lpOverlapped=0x0) returned 1 [0059.965] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF") returned="ZPDIR43B.GIF" [0059.965] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.965] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x90c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x90c, lpOverlapped=0x0) returned 1 [0059.965] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.965] CloseHandle (hObject=0x90) returned 1 [0059.966] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43b.gif.wannacry")) returned 1 [0059.967] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x997, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR43F.GIF", cAlternateFileName="")) returned 1 [0059.967] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.967] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR43F.GIF") returned -1 [0059.967] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR43F.GIF") returned -1 [0059.967] lstrcmpiA (lpString1="", lpString2="ZPDIR43F.GIF") returned -1 [0059.967] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF") returned="ZPDIR43B.GIF" [0059.967] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.967] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.967] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.967] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.967] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR43F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF" [0059.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", pszSpec="*.zip") returned 0 [0059.967] lstrlenA (lpString="*.zip") returned 5 [0059.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", pszSpec="*.rar") returned 0 [0059.967] lstrlenA (lpString="*.rar") returned 5 [0059.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", pszSpec="*.7z") returned 0 [0059.967] lstrlenA (lpString="*.7z") returned 4 [0059.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", pszSpec="*.tar") returned 0 [0059.967] lstrlenA (lpString="*.tar") returned 5 [0059.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", pszSpec="*.gzip") returned 0 [0059.968] lstrlenA (lpString="*.gzip") returned 6 [0059.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", pszSpec="*.jpg") returned 0 [0059.968] lstrlenA (lpString="*.jpg") returned 5 [0059.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", pszSpec="*.jpeg") returned 0 [0059.968] lstrlenA (lpString="*.jpeg") returned 6 [0059.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", pszSpec="*.psd") returned 0 [0059.968] lstrlenA (lpString="*.psd") returned 5 [0059.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", pszSpec="*.gif") returned 1 [0059.968] lstrlenA (lpString="*.gif") returned 5 [0059.968] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF" [0059.968] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF" [0059.968] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF." [0059.968] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF.wannacry" [0059.968] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.969] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x997 [0059.969] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd6e5b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.969] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.969] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x919, lpOverlapped=0x0) returned 1 [0059.971] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF") returned="ZPDIR43F.GIF" [0059.971] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.971] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x919, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x919, lpOverlapped=0x0) returned 1 [0059.971] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.971] CloseHandle (hObject=0x90) returned 1 [0059.972] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43f.gif.wannacry")) returned 1 [0059.973] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b06, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR44B.GIF", cAlternateFileName="")) returned 1 [0059.973] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.973] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR44B.GIF") returned -1 [0059.973] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR44B.GIF") returned -1 [0059.973] lstrcmpiA (lpString1="", lpString2="ZPDIR44B.GIF") returned -1 [0059.973] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF") returned="ZPDIR43F.GIF" [0059.973] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.973] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.973] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.973] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.973] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR44B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF" [0059.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", pszSpec="*.zip") returned 0 [0059.973] lstrlenA (lpString="*.zip") returned 5 [0059.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", pszSpec="*.rar") returned 0 [0059.973] lstrlenA (lpString="*.rar") returned 5 [0059.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", pszSpec="*.7z") returned 0 [0059.973] lstrlenA (lpString="*.7z") returned 4 [0059.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", pszSpec="*.tar") returned 0 [0059.973] lstrlenA (lpString="*.tar") returned 5 [0059.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", pszSpec="*.gzip") returned 0 [0059.974] lstrlenA (lpString="*.gzip") returned 6 [0059.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", pszSpec="*.jpg") returned 0 [0059.974] lstrlenA (lpString="*.jpg") returned 5 [0059.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", pszSpec="*.jpeg") returned 0 [0059.974] lstrlenA (lpString="*.jpeg") returned 6 [0059.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", pszSpec="*.psd") returned 0 [0059.974] lstrlenA (lpString="*.psd") returned 5 [0059.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", pszSpec="*.gif") returned 1 [0059.974] lstrlenA (lpString="*.gif") returned 5 [0059.974] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF" [0059.974] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF" [0059.974] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF." [0059.974] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF.wannacry" [0059.974] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.975] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b06 [0059.975] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd94710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.975] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.975] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1a88, lpOverlapped=0x0) returned 1 [0059.977] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF") returned="ZPDIR44B.GIF" [0059.977] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.977] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1a88, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1a88, lpOverlapped=0x0) returned 1 [0059.977] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.977] CloseHandle (hObject=0x90) returned 1 [0059.978] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44b.gif.wannacry")) returned 1 [0059.978] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a76, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR44F.GIF", cAlternateFileName="")) returned 1 [0059.978] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.978] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR44F.GIF") returned -1 [0059.979] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR44F.GIF") returned -1 [0059.979] lstrcmpiA (lpString1="", lpString2="ZPDIR44F.GIF") returned -1 [0059.979] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF") returned="ZPDIR44B.GIF" [0059.979] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.979] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.979] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.979] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.979] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR44F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF" [0059.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", pszSpec="*.zip") returned 0 [0059.979] lstrlenA (lpString="*.zip") returned 5 [0059.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", pszSpec="*.rar") returned 0 [0059.979] lstrlenA (lpString="*.rar") returned 5 [0059.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", pszSpec="*.7z") returned 0 [0059.979] lstrlenA (lpString="*.7z") returned 4 [0059.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", pszSpec="*.tar") returned 0 [0059.979] lstrlenA (lpString="*.tar") returned 5 [0059.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", pszSpec="*.gzip") returned 0 [0059.979] lstrlenA (lpString="*.gzip") returned 6 [0059.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", pszSpec="*.jpg") returned 0 [0059.979] lstrlenA (lpString="*.jpg") returned 5 [0059.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", pszSpec="*.jpeg") returned 0 [0059.980] lstrlenA (lpString="*.jpeg") returned 6 [0059.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", pszSpec="*.psd") returned 0 [0059.980] lstrlenA (lpString="*.psd") returned 5 [0059.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", pszSpec="*.gif") returned 1 [0059.980] lstrlenA (lpString="*.gif") returned 5 [0059.980] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF" [0059.980] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF" [0059.980] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF." [0059.980] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF.wannacry" [0059.980] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.981] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a76 [0059.981] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd94710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.981] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.981] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x19f8, lpOverlapped=0x0) returned 1 [0059.984] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF") returned="ZPDIR44F.GIF" [0059.984] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.984] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x19f8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x19f8, lpOverlapped=0x0) returned 1 [0059.984] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.984] CloseHandle (hObject=0x90) returned 1 [0059.984] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44f.gif.wannacry")) returned 1 [0059.985] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x17bb, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR45B.GIF", cAlternateFileName="")) returned 1 [0059.985] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.985] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR45B.GIF") returned -1 [0059.985] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR45B.GIF") returned -1 [0059.985] lstrcmpiA (lpString1="", lpString2="ZPDIR45B.GIF") returned -1 [0059.985] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF") returned="ZPDIR44F.GIF" [0059.985] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.985] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.985] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.985] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.985] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR45B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF" [0059.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", pszSpec="*.zip") returned 0 [0059.986] lstrlenA (lpString="*.zip") returned 5 [0059.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", pszSpec="*.rar") returned 0 [0059.986] lstrlenA (lpString="*.rar") returned 5 [0059.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", pszSpec="*.7z") returned 0 [0059.986] lstrlenA (lpString="*.7z") returned 4 [0059.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", pszSpec="*.tar") returned 0 [0059.986] lstrlenA (lpString="*.tar") returned 5 [0059.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", pszSpec="*.gzip") returned 0 [0059.986] lstrlenA (lpString="*.gzip") returned 6 [0059.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", pszSpec="*.jpg") returned 0 [0059.986] lstrlenA (lpString="*.jpg") returned 5 [0059.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", pszSpec="*.jpeg") returned 0 [0059.986] lstrlenA (lpString="*.jpeg") returned 6 [0059.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", pszSpec="*.psd") returned 0 [0059.986] lstrlenA (lpString="*.psd") returned 5 [0059.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", pszSpec="*.gif") returned 1 [0059.986] lstrlenA (lpString="*.gif") returned 5 [0059.986] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF" [0059.986] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF" [0059.986] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF." [0059.986] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF.wannacry" [0059.986] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.987] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17bb [0059.987] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd94710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.987] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.987] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x173d, lpOverlapped=0x0) returned 1 [0059.989] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF") returned="ZPDIR45B.GIF" [0059.989] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.989] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x173d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x173d, lpOverlapped=0x0) returned 1 [0059.990] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.990] CloseHandle (hObject=0x90) returned 1 [0059.990] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45b.gif.wannacry")) returned 1 [0059.991] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x16eb, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR45F.GIF", cAlternateFileName="")) returned 1 [0059.991] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.991] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR45F.GIF") returned -1 [0059.991] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR45F.GIF") returned -1 [0059.991] lstrcmpiA (lpString1="", lpString2="ZPDIR45F.GIF") returned -1 [0059.991] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF") returned="ZPDIR45B.GIF" [0059.991] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.991] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.991] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.991] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.991] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR45F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF" [0059.991] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", pszSpec="*.zip") returned 0 [0059.991] lstrlenA (lpString="*.zip") returned 5 [0059.991] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", pszSpec="*.rar") returned 0 [0059.991] lstrlenA (lpString="*.rar") returned 5 [0059.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", pszSpec="*.7z") returned 0 [0059.992] lstrlenA (lpString="*.7z") returned 4 [0059.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", pszSpec="*.tar") returned 0 [0059.992] lstrlenA (lpString="*.tar") returned 5 [0059.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", pszSpec="*.gzip") returned 0 [0059.992] lstrlenA (lpString="*.gzip") returned 6 [0059.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", pszSpec="*.jpg") returned 0 [0059.992] lstrlenA (lpString="*.jpg") returned 5 [0059.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", pszSpec="*.jpeg") returned 0 [0059.992] lstrlenA (lpString="*.jpeg") returned 6 [0059.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", pszSpec="*.psd") returned 0 [0059.992] lstrlenA (lpString="*.psd") returned 5 [0059.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", pszSpec="*.gif") returned 1 [0059.992] lstrlenA (lpString="*.gif") returned 5 [0059.992] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF" [0059.992] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF" [0059.992] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF." [0059.992] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF.wannacry" [0059.993] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.993] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16eb [0059.993] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd94710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.993] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.993] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x166d, lpOverlapped=0x0) returned 1 [0059.995] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF") returned="ZPDIR45F.GIF" [0059.996] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.996] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x166d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x166d, lpOverlapped=0x0) returned 1 [0059.996] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0059.996] CloseHandle (hObject=0x90) returned 1 [0059.996] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45f.gif.wannacry")) returned 1 [0059.997] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1304, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR46B.GIF", cAlternateFileName="")) returned 1 [0059.997] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0059.997] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR46B.GIF") returned -1 [0059.997] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR46B.GIF") returned -1 [0059.997] lstrcmpiA (lpString1="", lpString2="ZPDIR46B.GIF") returned -1 [0059.997] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF") returned="ZPDIR45F.GIF" [0059.997] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0059.997] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0059.997] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0059.997] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0059.997] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR46B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF" [0059.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", pszSpec="*.zip") returned 0 [0059.998] lstrlenA (lpString="*.zip") returned 5 [0059.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", pszSpec="*.rar") returned 0 [0059.998] lstrlenA (lpString="*.rar") returned 5 [0059.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", pszSpec="*.7z") returned 0 [0059.998] lstrlenA (lpString="*.7z") returned 4 [0059.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", pszSpec="*.tar") returned 0 [0059.998] lstrlenA (lpString="*.tar") returned 5 [0059.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", pszSpec="*.gzip") returned 0 [0059.998] lstrlenA (lpString="*.gzip") returned 6 [0059.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", pszSpec="*.jpg") returned 0 [0059.998] lstrlenA (lpString="*.jpg") returned 5 [0059.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", pszSpec="*.jpeg") returned 0 [0059.998] lstrlenA (lpString="*.jpeg") returned 6 [0059.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", pszSpec="*.psd") returned 0 [0059.998] lstrlenA (lpString="*.psd") returned 5 [0059.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", pszSpec="*.gif") returned 1 [0059.998] lstrlenA (lpString="*.gif") returned 5 [0059.998] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF" [0059.998] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF" [0059.998] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF." [0059.998] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF.wannacry" [0059.998] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0059.999] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1304 [0059.999] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd94710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0059.999] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0059.999] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1286, lpOverlapped=0x0) returned 1 [0060.001] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF") returned="ZPDIR46B.GIF" [0060.001] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.001] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1286, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1286, lpOverlapped=0x0) returned 1 [0060.002] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.002] CloseHandle (hObject=0x90) returned 1 [0060.002] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46b.gif.wannacry")) returned 1 [0060.003] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x141c, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR46F.GIF", cAlternateFileName="")) returned 1 [0060.003] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.003] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR46F.GIF") returned -1 [0060.003] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR46F.GIF") returned -1 [0060.003] lstrcmpiA (lpString1="", lpString2="ZPDIR46F.GIF") returned -1 [0060.003] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF") returned="ZPDIR46B.GIF" [0060.003] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0060.003] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0060.003] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0060.003] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0060.003] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR46F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF" [0060.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", pszSpec="*.zip") returned 0 [0060.003] lstrlenA (lpString="*.zip") returned 5 [0060.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", pszSpec="*.rar") returned 0 [0060.003] lstrlenA (lpString="*.rar") returned 5 [0060.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", pszSpec="*.7z") returned 0 [0060.003] lstrlenA (lpString="*.7z") returned 4 [0060.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", pszSpec="*.tar") returned 0 [0060.004] lstrlenA (lpString="*.tar") returned 5 [0060.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", pszSpec="*.gzip") returned 0 [0060.004] lstrlenA (lpString="*.gzip") returned 6 [0060.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", pszSpec="*.jpg") returned 0 [0060.004] lstrlenA (lpString="*.jpg") returned 5 [0060.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", pszSpec="*.jpeg") returned 0 [0060.004] lstrlenA (lpString="*.jpeg") returned 6 [0060.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", pszSpec="*.psd") returned 0 [0060.004] lstrlenA (lpString="*.psd") returned 5 [0060.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", pszSpec="*.gif") returned 1 [0060.004] lstrlenA (lpString="*.gif") returned 5 [0060.004] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF" [0060.004] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF" [0060.004] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF." [0060.004] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF.wannacry" [0060.004] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.005] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x141c [0060.006] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd94710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0060.006] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.006] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x139e, lpOverlapped=0x0) returned 1 [0060.008] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF") returned="ZPDIR46F.GIF" [0060.008] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.008] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x139e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x139e, lpOverlapped=0x0) returned 1 [0060.008] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.008] CloseHandle (hObject=0x90) returned 1 [0060.008] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46f.gif.wannacry")) returned 1 [0060.009] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x7517, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR47B.GIF", cAlternateFileName="")) returned 1 [0060.009] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.009] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR47B.GIF") returned -1 [0060.009] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR47B.GIF") returned -1 [0060.009] lstrcmpiA (lpString1="", lpString2="ZPDIR47B.GIF") returned -1 [0060.009] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF") returned="ZPDIR46F.GIF" [0060.009] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0060.009] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0060.009] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0060.009] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0060.009] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR47B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF" [0060.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", pszSpec="*.zip") returned 0 [0060.009] lstrlenA (lpString="*.zip") returned 5 [0060.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", pszSpec="*.rar") returned 0 [0060.010] lstrlenA (lpString="*.rar") returned 5 [0060.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", pszSpec="*.7z") returned 0 [0060.010] lstrlenA (lpString="*.7z") returned 4 [0060.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", pszSpec="*.tar") returned 0 [0060.010] lstrlenA (lpString="*.tar") returned 5 [0060.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", pszSpec="*.gzip") returned 0 [0060.010] lstrlenA (lpString="*.gzip") returned 6 [0060.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", pszSpec="*.jpg") returned 0 [0060.010] lstrlenA (lpString="*.jpg") returned 5 [0060.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", pszSpec="*.jpeg") returned 0 [0060.010] lstrlenA (lpString="*.jpeg") returned 6 [0060.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", pszSpec="*.psd") returned 0 [0060.010] lstrlenA (lpString="*.psd") returned 5 [0060.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", pszSpec="*.gif") returned 1 [0060.010] lstrlenA (lpString="*.gif") returned 5 [0060.010] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF" [0060.010] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF" [0060.010] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF." [0060.010] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF.wannacry" [0060.010] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.010] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7517 [0060.011] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd94710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0060.011] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.011] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x7499, lpOverlapped=0x0) returned 1 [0060.016] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF") returned="ZPDIR47B.GIF" [0060.016] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.016] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x7499, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x7499, lpOverlapped=0x0) returned 1 [0060.017] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.017] CloseHandle (hObject=0x90) returned 1 [0060.017] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47b.gif.wannacry")) returned 1 [0060.018] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x539e, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR47F.GIF", cAlternateFileName="")) returned 1 [0060.018] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.018] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR47F.GIF") returned -1 [0060.018] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR47F.GIF") returned -1 [0060.018] lstrcmpiA (lpString1="", lpString2="ZPDIR47F.GIF") returned -1 [0060.018] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF") returned="ZPDIR47B.GIF" [0060.018] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0060.018] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0060.018] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0060.018] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0060.018] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR47F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF" [0060.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", pszSpec="*.zip") returned 0 [0060.019] lstrlenA (lpString="*.zip") returned 5 [0060.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", pszSpec="*.rar") returned 0 [0060.019] lstrlenA (lpString="*.rar") returned 5 [0060.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", pszSpec="*.7z") returned 0 [0060.019] lstrlenA (lpString="*.7z") returned 4 [0060.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", pszSpec="*.tar") returned 0 [0060.019] lstrlenA (lpString="*.tar") returned 5 [0060.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", pszSpec="*.gzip") returned 0 [0060.019] lstrlenA (lpString="*.gzip") returned 6 [0060.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", pszSpec="*.jpg") returned 0 [0060.019] lstrlenA (lpString="*.jpg") returned 5 [0060.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", pszSpec="*.jpeg") returned 0 [0060.019] lstrlenA (lpString="*.jpeg") returned 6 [0060.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", pszSpec="*.psd") returned 0 [0060.019] lstrlenA (lpString="*.psd") returned 5 [0060.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", pszSpec="*.gif") returned 1 [0060.019] lstrlenA (lpString="*.gif") returned 5 [0060.019] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF" [0060.019] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF" [0060.019] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF." [0060.019] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF.wannacry" [0060.019] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.020] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x539e [0060.020] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd94710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0060.020] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.020] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x5320, lpOverlapped=0x0) returned 1 [0060.022] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF") returned="ZPDIR47F.GIF" [0060.022] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.022] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x5320, lpOverlapped=0x0) returned 1 [0060.023] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.023] CloseHandle (hObject=0x90) returned 1 [0060.023] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47f.gif.wannacry")) returned 1 [0060.024] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x67f9, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR48B.GIF", cAlternateFileName="")) returned 1 [0060.024] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.024] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR48B.GIF") returned -1 [0060.024] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR48B.GIF") returned -1 [0060.024] lstrcmpiA (lpString1="", lpString2="ZPDIR48B.GIF") returned -1 [0060.024] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF") returned="ZPDIR47F.GIF" [0060.024] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0060.024] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0060.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0060.024] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0060.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR48B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF" [0060.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", pszSpec="*.zip") returned 0 [0060.024] lstrlenA (lpString="*.zip") returned 5 [0060.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", pszSpec="*.rar") returned 0 [0060.024] lstrlenA (lpString="*.rar") returned 5 [0060.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", pszSpec="*.7z") returned 0 [0060.024] lstrlenA (lpString="*.7z") returned 4 [0060.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", pszSpec="*.tar") returned 0 [0060.024] lstrlenA (lpString="*.tar") returned 5 [0060.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", pszSpec="*.gzip") returned 0 [0060.025] lstrlenA (lpString="*.gzip") returned 6 [0060.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", pszSpec="*.jpg") returned 0 [0060.025] lstrlenA (lpString="*.jpg") returned 5 [0060.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", pszSpec="*.jpeg") returned 0 [0060.025] lstrlenA (lpString="*.jpeg") returned 6 [0060.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", pszSpec="*.psd") returned 0 [0060.025] lstrlenA (lpString="*.psd") returned 5 [0060.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", pszSpec="*.gif") returned 1 [0060.025] lstrlenA (lpString="*.gif") returned 5 [0060.025] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF" [0060.025] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF" [0060.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF." [0060.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF.wannacry" [0060.025] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.026] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x67f9 [0060.026] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd94710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0060.026] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.026] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x677b, lpOverlapped=0x0) returned 1 [0060.028] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF") returned="ZPDIR48B.GIF" [0060.028] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.028] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x677b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x677b, lpOverlapped=0x0) returned 1 [0060.029] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.032] CloseHandle (hObject=0x90) returned 1 [0060.032] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48b.gif.wannacry")) returned 1 [0060.033] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1ba1, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR48F.GIF", cAlternateFileName="")) returned 1 [0060.033] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.033] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR48F.GIF") returned -1 [0060.033] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR48F.GIF") returned -1 [0060.033] lstrcmpiA (lpString1="", lpString2="ZPDIR48F.GIF") returned -1 [0060.033] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF") returned="ZPDIR48B.GIF" [0060.033] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0060.033] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0060.033] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0060.033] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0060.033] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR48F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF" [0060.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", pszSpec="*.zip") returned 0 [0060.033] lstrlenA (lpString="*.zip") returned 5 [0060.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", pszSpec="*.rar") returned 0 [0060.033] lstrlenA (lpString="*.rar") returned 5 [0060.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", pszSpec="*.7z") returned 0 [0060.033] lstrlenA (lpString="*.7z") returned 4 [0060.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", pszSpec="*.tar") returned 0 [0060.034] lstrlenA (lpString="*.tar") returned 5 [0060.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", pszSpec="*.gzip") returned 0 [0060.034] lstrlenA (lpString="*.gzip") returned 6 [0060.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", pszSpec="*.jpg") returned 0 [0060.034] lstrlenA (lpString="*.jpg") returned 5 [0060.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", pszSpec="*.jpeg") returned 0 [0060.034] lstrlenA (lpString="*.jpeg") returned 6 [0060.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", pszSpec="*.psd") returned 0 [0060.034] lstrlenA (lpString="*.psd") returned 5 [0060.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", pszSpec="*.gif") returned 1 [0060.034] lstrlenA (lpString="*.gif") returned 5 [0060.034] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF" [0060.034] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF" [0060.034] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF." [0060.034] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF.wannacry" [0060.034] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.035] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ba1 [0060.035] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd94710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0060.036] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.036] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1b23, lpOverlapped=0x0) returned 1 [0060.038] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF") returned="ZPDIR48F.GIF" [0060.038] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.038] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1b23, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1b23, lpOverlapped=0x0) returned 1 [0060.038] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.038] CloseHandle (hObject=0x90) returned 1 [0060.038] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48f.gif.wannacry")) returned 1 [0060.039] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1cd7, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR49B.GIF", cAlternateFileName="")) returned 1 [0060.039] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.039] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR49B.GIF") returned -1 [0060.039] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR49B.GIF") returned -1 [0060.039] lstrcmpiA (lpString1="", lpString2="ZPDIR49B.GIF") returned -1 [0060.039] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF") returned="ZPDIR48F.GIF" [0060.039] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0060.039] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0060.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0060.040] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0060.040] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR49B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF" [0060.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", pszSpec="*.zip") returned 0 [0060.040] lstrlenA (lpString="*.zip") returned 5 [0060.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", pszSpec="*.rar") returned 0 [0060.040] lstrlenA (lpString="*.rar") returned 5 [0060.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", pszSpec="*.7z") returned 0 [0060.040] lstrlenA (lpString="*.7z") returned 4 [0060.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", pszSpec="*.tar") returned 0 [0060.040] lstrlenA (lpString="*.tar") returned 5 [0060.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", pszSpec="*.gzip") returned 0 [0060.040] lstrlenA (lpString="*.gzip") returned 6 [0060.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", pszSpec="*.jpg") returned 0 [0060.040] lstrlenA (lpString="*.jpg") returned 5 [0060.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", pszSpec="*.jpeg") returned 0 [0060.040] lstrlenA (lpString="*.jpeg") returned 6 [0060.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", pszSpec="*.psd") returned 0 [0060.040] lstrlenA (lpString="*.psd") returned 5 [0060.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", pszSpec="*.gif") returned 1 [0060.040] lstrlenA (lpString="*.gif") returned 5 [0060.040] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF" [0060.040] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF" [0060.040] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF." [0060.040] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF.wannacry" [0060.040] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.041] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1cd7 [0060.041] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd94710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0060.041] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.041] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1c59, lpOverlapped=0x0) returned 1 [0060.043] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF") returned="ZPDIR49B.GIF" [0060.043] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.043] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1c59, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1c59, lpOverlapped=0x0) returned 1 [0060.044] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.044] CloseHandle (hObject=0x90) returned 1 [0060.044] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49b.gif.wannacry")) returned 1 [0060.045] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b99, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR49F.GIF", cAlternateFileName="")) returned 1 [0060.045] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.045] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR49F.GIF") returned -1 [0060.045] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR49F.GIF") returned -1 [0060.045] lstrcmpiA (lpString1="", lpString2="ZPDIR49F.GIF") returned -1 [0060.045] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF") returned="ZPDIR49B.GIF" [0060.045] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0060.045] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0060.045] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0060.045] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0060.045] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR49F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF" [0060.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", pszSpec="*.zip") returned 0 [0060.045] lstrlenA (lpString="*.zip") returned 5 [0060.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", pszSpec="*.rar") returned 0 [0060.045] lstrlenA (lpString="*.rar") returned 5 [0060.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", pszSpec="*.7z") returned 0 [0060.045] lstrlenA (lpString="*.7z") returned 4 [0060.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", pszSpec="*.tar") returned 0 [0060.045] lstrlenA (lpString="*.tar") returned 5 [0060.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", pszSpec="*.gzip") returned 0 [0060.045] lstrlenA (lpString="*.gzip") returned 6 [0060.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", pszSpec="*.jpg") returned 0 [0060.045] lstrlenA (lpString="*.jpg") returned 5 [0060.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", pszSpec="*.jpeg") returned 0 [0060.046] lstrlenA (lpString="*.jpeg") returned 6 [0060.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", pszSpec="*.psd") returned 0 [0060.046] lstrlenA (lpString="*.psd") returned 5 [0060.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", pszSpec="*.gif") returned 1 [0060.046] lstrlenA (lpString="*.gif") returned 5 [0060.046] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF" [0060.046] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF" [0060.046] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF." [0060.046] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF.wannacry" [0060.046] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.046] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b99 [0060.046] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd94710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0060.046] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.047] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1b1b, lpOverlapped=0x0) returned 1 [0060.048] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF") returned="ZPDIR49F.GIF" [0060.048] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.049] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1b1b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1b1b, lpOverlapped=0x0) returned 1 [0060.049] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.049] CloseHandle (hObject=0x90) returned 1 [0060.049] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49f.gif.wannacry")) returned 1 [0060.050] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2fc2, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR4B.GIF", cAlternateFileName="")) returned 1 [0060.050] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.050] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR4B.GIF") returned -1 [0060.050] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR4B.GIF") returned -1 [0060.050] lstrcmpiA (lpString1="", lpString2="ZPDIR4B.GIF") returned -1 [0060.050] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF") returned="ZPDIR49F.GIF" [0060.050] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0060.050] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0060.050] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0060.050] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0060.050] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR4B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF" [0060.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", pszSpec="*.zip") returned 0 [0060.050] lstrlenA (lpString="*.zip") returned 5 [0060.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", pszSpec="*.rar") returned 0 [0060.051] lstrlenA (lpString="*.rar") returned 5 [0060.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", pszSpec="*.7z") returned 0 [0060.051] lstrlenA (lpString="*.7z") returned 4 [0060.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", pszSpec="*.tar") returned 0 [0060.051] lstrlenA (lpString="*.tar") returned 5 [0060.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", pszSpec="*.gzip") returned 0 [0060.051] lstrlenA (lpString="*.gzip") returned 6 [0060.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", pszSpec="*.jpg") returned 0 [0060.051] lstrlenA (lpString="*.jpg") returned 5 [0060.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", pszSpec="*.jpeg") returned 0 [0060.051] lstrlenA (lpString="*.jpeg") returned 6 [0060.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", pszSpec="*.psd") returned 0 [0060.051] lstrlenA (lpString="*.psd") returned 5 [0060.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", pszSpec="*.gif") returned 1 [0060.051] lstrlenA (lpString="*.gif") returned 5 [0060.051] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF" [0060.051] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF" [0060.051] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF." [0060.051] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF.wannacry" [0060.051] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.052] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2fc2 [0060.052] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bd94710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0060.052] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.052] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2f44, lpOverlapped=0x0) returned 1 [0060.054] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF") returned="ZPDIR4B.GIF" [0060.054] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.054] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2f44, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2f44, lpOverlapped=0x0) returned 1 [0060.054] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.054] CloseHandle (hObject=0x90) returned 1 [0060.055] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4b.gif.wannacry")) returned 1 [0060.055] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8edb, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR4F.GIF", cAlternateFileName="")) returned 1 [0060.055] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.055] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR4F.GIF") returned -1 [0060.055] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR4F.GIF") returned -1 [0060.055] lstrcmpiA (lpString1="", lpString2="ZPDIR4F.GIF") returned -1 [0060.055] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF") returned="ZPDIR4B.GIF" [0060.056] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0060.056] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0060.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0060.056] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0060.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR4F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF" [0060.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", pszSpec="*.zip") returned 0 [0060.056] lstrlenA (lpString="*.zip") returned 5 [0060.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", pszSpec="*.rar") returned 0 [0060.056] lstrlenA (lpString="*.rar") returned 5 [0060.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", pszSpec="*.7z") returned 0 [0060.056] lstrlenA (lpString="*.7z") returned 4 [0060.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", pszSpec="*.tar") returned 0 [0060.056] lstrlenA (lpString="*.tar") returned 5 [0060.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", pszSpec="*.gzip") returned 0 [0060.056] lstrlenA (lpString="*.gzip") returned 6 [0060.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", pszSpec="*.jpg") returned 0 [0060.056] lstrlenA (lpString="*.jpg") returned 5 [0060.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", pszSpec="*.jpeg") returned 0 [0060.056] lstrlenA (lpString="*.jpeg") returned 6 [0060.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", pszSpec="*.psd") returned 0 [0060.056] lstrlenA (lpString="*.psd") returned 5 [0060.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", pszSpec="*.gif") returned 1 [0060.056] lstrlenA (lpString="*.gif") returned 5 [0060.056] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF" [0060.056] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF" [0060.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF." [0060.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF.wannacry" [0060.057] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.058] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8edb [0060.058] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bdba870, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0060.058] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.058] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x8e5d, lpOverlapped=0x0) returned 1 [0060.060] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF") returned="ZPDIR4F.GIF" [0060.060] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.060] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x8e5d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x8e5d, lpOverlapped=0x0) returned 1 [0060.060] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.061] CloseHandle (hObject=0x90) returned 1 [0060.061] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4f.gif.wannacry")) returned 1 [0060.062] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x10a7, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR50B.GIF", cAlternateFileName="")) returned 1 [0060.062] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.062] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR50B.GIF") returned -1 [0060.062] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR50B.GIF") returned -1 [0060.062] lstrcmpiA (lpString1="", lpString2="ZPDIR50B.GIF") returned -1 [0060.062] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF") returned="ZPDIR4F.GIF" [0060.062] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0060.062] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0060.062] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0060.062] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0060.062] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR50B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF" [0060.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", pszSpec="*.zip") returned 0 [0060.062] lstrlenA (lpString="*.zip") returned 5 [0060.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", pszSpec="*.rar") returned 0 [0060.062] lstrlenA (lpString="*.rar") returned 5 [0060.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", pszSpec="*.7z") returned 0 [0060.062] lstrlenA (lpString="*.7z") returned 4 [0060.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", pszSpec="*.tar") returned 0 [0060.062] lstrlenA (lpString="*.tar") returned 5 [0060.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", pszSpec="*.gzip") returned 0 [0060.062] lstrlenA (lpString="*.gzip") returned 6 [0060.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", pszSpec="*.jpg") returned 0 [0060.062] lstrlenA (lpString="*.jpg") returned 5 [0060.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", pszSpec="*.jpeg") returned 0 [0060.063] lstrlenA (lpString="*.jpeg") returned 6 [0060.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", pszSpec="*.psd") returned 0 [0060.063] lstrlenA (lpString="*.psd") returned 5 [0060.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", pszSpec="*.gif") returned 1 [0060.063] lstrlenA (lpString="*.gif") returned 5 [0060.063] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF" [0060.063] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF" [0060.063] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF." [0060.063] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF.wannacry" [0060.063] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.063] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10a7 [0060.063] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bdba870, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0060.063] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.064] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1029, lpOverlapped=0x0) returned 1 [0060.065] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF") returned="ZPDIR50B.GIF" [0060.065] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.065] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1029, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1029, lpOverlapped=0x0) returned 1 [0060.066] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.066] CloseHandle (hObject=0x90) returned 1 [0060.066] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50b.gif.wannacry")) returned 1 [0060.066] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x117f, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR50F.GIF", cAlternateFileName="")) returned 1 [0060.067] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.067] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR50F.GIF") returned -1 [0060.067] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR50F.GIF") returned -1 [0060.067] lstrcmpiA (lpString1="", lpString2="ZPDIR50F.GIF") returned -1 [0060.067] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF") returned="ZPDIR50B.GIF" [0060.067] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0060.067] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0060.067] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0060.067] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0060.067] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR50F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF" [0060.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", pszSpec="*.zip") returned 0 [0060.067] lstrlenA (lpString="*.zip") returned 5 [0060.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", pszSpec="*.rar") returned 0 [0060.067] lstrlenA (lpString="*.rar") returned 5 [0060.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", pszSpec="*.7z") returned 0 [0060.067] lstrlenA (lpString="*.7z") returned 4 [0060.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", pszSpec="*.tar") returned 0 [0060.067] lstrlenA (lpString="*.tar") returned 5 [0060.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", pszSpec="*.gzip") returned 0 [0060.067] lstrlenA (lpString="*.gzip") returned 6 [0060.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", pszSpec="*.jpg") returned 0 [0060.067] lstrlenA (lpString="*.jpg") returned 5 [0060.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", pszSpec="*.jpeg") returned 0 [0060.067] lstrlenA (lpString="*.jpeg") returned 6 [0060.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", pszSpec="*.psd") returned 0 [0060.068] lstrlenA (lpString="*.psd") returned 5 [0060.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", pszSpec="*.gif") returned 1 [0060.068] lstrlenA (lpString="*.gif") returned 5 [0060.068] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF" [0060.068] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF" [0060.068] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF." [0060.068] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF.wannacry" [0060.068] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.068] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x117f [0060.068] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bdba870, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0060.068] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.068] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1101, lpOverlapped=0x0) returned 1 [0060.070] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF") returned="ZPDIR50F.GIF" [0060.070] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.070] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1101, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1101, lpOverlapped=0x0) returned 1 [0060.071] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.071] CloseHandle (hObject=0x90) returned 1 [0060.071] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50f.gif.wannacry")) returned 1 [0060.071] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2395, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR51B.GIF", cAlternateFileName="")) returned 1 [0060.072] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.072] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR51B.GIF") returned -1 [0060.072] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR51B.GIF") returned -1 [0060.072] lstrcmpiA (lpString1="", lpString2="ZPDIR51B.GIF") returned -1 [0060.072] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF") returned="ZPDIR50F.GIF" [0060.072] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0060.072] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0060.072] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0060.072] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0060.072] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR51B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF" [0060.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", pszSpec="*.zip") returned 0 [0060.072] lstrlenA (lpString="*.zip") returned 5 [0060.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", pszSpec="*.rar") returned 0 [0060.072] lstrlenA (lpString="*.rar") returned 5 [0060.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", pszSpec="*.7z") returned 0 [0060.072] lstrlenA (lpString="*.7z") returned 4 [0060.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", pszSpec="*.tar") returned 0 [0060.072] lstrlenA (lpString="*.tar") returned 5 [0060.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", pszSpec="*.gzip") returned 0 [0060.072] lstrlenA (lpString="*.gzip") returned 6 [0060.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", pszSpec="*.jpg") returned 0 [0060.072] lstrlenA (lpString="*.jpg") returned 5 [0060.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", pszSpec="*.jpeg") returned 0 [0060.072] lstrlenA (lpString="*.jpeg") returned 6 [0060.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", pszSpec="*.psd") returned 0 [0060.073] lstrlenA (lpString="*.psd") returned 5 [0060.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", pszSpec="*.gif") returned 1 [0060.073] lstrlenA (lpString="*.gif") returned 5 [0060.073] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF" [0060.073] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF" [0060.073] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF." [0060.073] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF.wannacry" [0060.073] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.073] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2395 [0060.073] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bdba870, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0060.073] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.073] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2317, lpOverlapped=0x0) returned 1 [0060.075] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF") returned="ZPDIR51B.GIF" [0060.075] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.075] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2317, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2317, lpOverlapped=0x0) returned 1 [0060.076] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.076] CloseHandle (hObject=0x90) returned 1 [0060.076] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51b.gif.wannacry")) returned 1 [0060.077] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1179, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR51F.GIF", cAlternateFileName="")) returned 1 [0060.077] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.077] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR51F.GIF") returned -1 [0060.077] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR51F.GIF") returned -1 [0060.077] lstrcmpiA (lpString1="", lpString2="ZPDIR51F.GIF") returned -1 [0060.077] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF") returned="ZPDIR51B.GIF" [0060.077] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0060.077] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0060.077] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0060.077] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0060.077] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR51F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF" [0060.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", pszSpec="*.zip") returned 0 [0060.077] lstrlenA (lpString="*.zip") returned 5 [0060.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", pszSpec="*.rar") returned 0 [0060.077] lstrlenA (lpString="*.rar") returned 5 [0060.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", pszSpec="*.7z") returned 0 [0060.077] lstrlenA (lpString="*.7z") returned 4 [0060.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", pszSpec="*.tar") returned 0 [0060.077] lstrlenA (lpString="*.tar") returned 5 [0060.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", pszSpec="*.gzip") returned 0 [0060.077] lstrlenA (lpString="*.gzip") returned 6 [0060.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", pszSpec="*.jpg") returned 0 [0060.077] lstrlenA (lpString="*.jpg") returned 5 [0060.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", pszSpec="*.jpeg") returned 0 [0060.078] lstrlenA (lpString="*.jpeg") returned 6 [0060.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", pszSpec="*.psd") returned 0 [0060.078] lstrlenA (lpString="*.psd") returned 5 [0060.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", pszSpec="*.gif") returned 1 [0060.078] lstrlenA (lpString="*.gif") returned 5 [0060.078] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF" [0060.078] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF" [0060.078] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF." [0060.078] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF.wannacry" [0060.078] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.081] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1179 [0060.081] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bdba870, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0060.081] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.081] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x10fb, lpOverlapped=0x0) returned 1 [0060.083] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF") returned="ZPDIR51F.GIF" [0060.083] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.083] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x10fb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x10fb, lpOverlapped=0x0) returned 1 [0060.083] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.083] CloseHandle (hObject=0x90) returned 1 [0060.083] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51f.gif.wannacry")) returned 1 [0060.084] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x592b, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR5B.GIF", cAlternateFileName="")) returned 1 [0060.084] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.084] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR5B.GIF") returned -1 [0060.084] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR5B.GIF") returned -1 [0060.084] lstrcmpiA (lpString1="", lpString2="ZPDIR5B.GIF") returned -1 [0060.084] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF") returned="ZPDIR51F.GIF" [0060.084] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0060.084] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0060.084] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0060.084] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0060.085] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR5B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF" [0060.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", pszSpec="*.zip") returned 0 [0060.085] lstrlenA (lpString="*.zip") returned 5 [0060.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", pszSpec="*.rar") returned 0 [0060.085] lstrlenA (lpString="*.rar") returned 5 [0060.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", pszSpec="*.7z") returned 0 [0060.085] lstrlenA (lpString="*.7z") returned 4 [0060.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", pszSpec="*.tar") returned 0 [0060.085] lstrlenA (lpString="*.tar") returned 5 [0060.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", pszSpec="*.gzip") returned 0 [0060.085] lstrlenA (lpString="*.gzip") returned 6 [0060.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", pszSpec="*.jpg") returned 0 [0060.085] lstrlenA (lpString="*.jpg") returned 5 [0060.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", pszSpec="*.jpeg") returned 0 [0060.085] lstrlenA (lpString="*.jpeg") returned 6 [0060.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", pszSpec="*.psd") returned 0 [0060.085] lstrlenA (lpString="*.psd") returned 5 [0060.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", pszSpec="*.gif") returned 1 [0060.085] lstrlenA (lpString="*.gif") returned 5 [0060.085] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF" [0060.085] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF" [0060.085] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF." [0060.085] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF.wannacry" [0060.085] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.086] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x592b [0060.086] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bdba870, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0060.086] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.086] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x58ad, lpOverlapped=0x0) returned 1 [0060.088] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF") returned="ZPDIR5B.GIF" [0060.088] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.088] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x58ad, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x58ad, lpOverlapped=0x0) returned 1 [0060.088] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.088] CloseHandle (hObject=0x90) returned 1 [0060.088] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5b.gif.wannacry")) returned 1 [0060.089] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xdb2e, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR5F.GIF", cAlternateFileName="")) returned 1 [0060.089] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.089] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR5F.GIF") returned -1 [0060.089] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR5F.GIF") returned -1 [0060.089] lstrcmpiA (lpString1="", lpString2="ZPDIR5F.GIF") returned -1 [0060.089] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF") returned="ZPDIR5B.GIF" [0060.089] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0060.089] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0060.090] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0060.090] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0060.090] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR5F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF" [0060.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", pszSpec="*.zip") returned 0 [0060.090] lstrlenA (lpString="*.zip") returned 5 [0060.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", pszSpec="*.rar") returned 0 [0060.090] lstrlenA (lpString="*.rar") returned 5 [0060.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", pszSpec="*.7z") returned 0 [0060.090] lstrlenA (lpString="*.7z") returned 4 [0060.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", pszSpec="*.tar") returned 0 [0060.090] lstrlenA (lpString="*.tar") returned 5 [0060.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", pszSpec="*.gzip") returned 0 [0060.090] lstrlenA (lpString="*.gzip") returned 6 [0060.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", pszSpec="*.jpg") returned 0 [0060.090] lstrlenA (lpString="*.jpg") returned 5 [0060.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", pszSpec="*.jpeg") returned 0 [0060.090] lstrlenA (lpString="*.jpeg") returned 6 [0060.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", pszSpec="*.psd") returned 0 [0060.090] lstrlenA (lpString="*.psd") returned 5 [0060.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", pszSpec="*.gif") returned 1 [0060.090] lstrlenA (lpString="*.gif") returned 5 [0060.090] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF" [0060.090] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF" [0060.090] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF." [0060.090] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF.wannacry" [0060.091] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.091] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdb2e [0060.091] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bdba870, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0060.091] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.091] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xdab0, lpOverlapped=0x0) returned 1 [0060.093] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF") returned="ZPDIR5F.GIF" [0060.093] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.094] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xdab0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xdab0, lpOverlapped=0x0) returned 1 [0060.094] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.094] CloseHandle (hObject=0x90) returned 1 [0060.094] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5f.gif.wannacry")) returned 1 [0060.095] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2ade, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR6B.GIF", cAlternateFileName="")) returned 1 [0060.095] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.095] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR6B.GIF") returned -1 [0060.095] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR6B.GIF") returned -1 [0060.095] lstrcmpiA (lpString1="", lpString2="ZPDIR6B.GIF") returned -1 [0060.095] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF") returned="ZPDIR5F.GIF" [0060.095] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0060.095] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0060.095] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0060.095] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0060.095] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR6B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF" [0060.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", pszSpec="*.zip") returned 0 [0060.095] lstrlenA (lpString="*.zip") returned 5 [0060.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", pszSpec="*.rar") returned 0 [0060.095] lstrlenA (lpString="*.rar") returned 5 [0060.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", pszSpec="*.7z") returned 0 [0060.095] lstrlenA (lpString="*.7z") returned 4 [0060.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", pszSpec="*.tar") returned 0 [0060.095] lstrlenA (lpString="*.tar") returned 5 [0060.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", pszSpec="*.gzip") returned 0 [0060.096] lstrlenA (lpString="*.gzip") returned 6 [0060.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", pszSpec="*.jpg") returned 0 [0060.096] lstrlenA (lpString="*.jpg") returned 5 [0060.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", pszSpec="*.jpeg") returned 0 [0060.096] lstrlenA (lpString="*.jpeg") returned 6 [0060.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", pszSpec="*.psd") returned 0 [0060.096] lstrlenA (lpString="*.psd") returned 5 [0060.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", pszSpec="*.gif") returned 1 [0060.096] lstrlenA (lpString="*.gif") returned 5 [0060.096] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF" [0060.096] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF" [0060.096] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF." [0060.096] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF.wannacry" [0060.096] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.097] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ade [0060.097] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bdba870, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0060.097] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.097] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2a60, lpOverlapped=0x0) returned 1 [0060.099] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF") returned="ZPDIR6B.GIF" [0060.099] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.099] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2a60, lpOverlapped=0x0) returned 1 [0060.099] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.100] CloseHandle (hObject=0x90) returned 1 [0060.100] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6b.gif.wannacry")) returned 1 [0060.100] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x41e5, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR6F.GIF", cAlternateFileName="")) returned 1 [0060.100] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.100] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR6F.GIF") returned -1 [0060.100] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR6F.GIF") returned -1 [0060.100] lstrcmpiA (lpString1="", lpString2="ZPDIR6F.GIF") returned -1 [0060.101] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF") returned="ZPDIR6B.GIF" [0060.101] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0060.101] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0060.101] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0060.101] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0060.101] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR6F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF" [0060.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", pszSpec="*.zip") returned 0 [0060.101] lstrlenA (lpString="*.zip") returned 5 [0060.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", pszSpec="*.rar") returned 0 [0060.101] lstrlenA (lpString="*.rar") returned 5 [0060.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", pszSpec="*.7z") returned 0 [0060.101] lstrlenA (lpString="*.7z") returned 4 [0060.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", pszSpec="*.tar") returned 0 [0060.101] lstrlenA (lpString="*.tar") returned 5 [0060.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", pszSpec="*.gzip") returned 0 [0060.101] lstrlenA (lpString="*.gzip") returned 6 [0060.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", pszSpec="*.jpg") returned 0 [0060.101] lstrlenA (lpString="*.jpg") returned 5 [0060.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", pszSpec="*.jpeg") returned 0 [0060.101] lstrlenA (lpString="*.jpeg") returned 6 [0060.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", pszSpec="*.psd") returned 0 [0060.101] lstrlenA (lpString="*.psd") returned 5 [0060.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", pszSpec="*.gif") returned 1 [0060.101] lstrlenA (lpString="*.gif") returned 5 [0060.102] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF" [0060.102] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF" [0060.102] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF." [0060.102] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF.wannacry" [0060.102] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.102] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x41e5 [0060.102] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bdba870, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0060.102] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.102] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4167, lpOverlapped=0x0) returned 1 [0060.104] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF") returned="ZPDIR6F.GIF" [0060.104] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.104] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4167, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4167, lpOverlapped=0x0) returned 1 [0060.105] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.105] CloseHandle (hObject=0x90) returned 1 [0060.105] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6f.gif.wannacry")) returned 1 [0060.106] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x5559, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR7B.GIF", cAlternateFileName="")) returned 1 [0060.106] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.106] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR7B.GIF") returned -1 [0060.106] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR7B.GIF") returned -1 [0060.106] lstrcmpiA (lpString1="", lpString2="ZPDIR7B.GIF") returned -1 [0060.106] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF") returned="ZPDIR6F.GIF" [0060.106] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0060.106] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0060.106] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0060.106] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0060.106] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR7B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF" [0060.106] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", pszSpec="*.zip") returned 0 [0060.106] lstrlenA (lpString="*.zip") returned 5 [0060.106] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", pszSpec="*.rar") returned 0 [0060.106] lstrlenA (lpString="*.rar") returned 5 [0060.106] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", pszSpec="*.7z") returned 0 [0060.107] lstrlenA (lpString="*.7z") returned 4 [0060.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", pszSpec="*.tar") returned 0 [0060.107] lstrlenA (lpString="*.tar") returned 5 [0060.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", pszSpec="*.gzip") returned 0 [0060.107] lstrlenA (lpString="*.gzip") returned 6 [0060.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", pszSpec="*.jpg") returned 0 [0060.107] lstrlenA (lpString="*.jpg") returned 5 [0060.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", pszSpec="*.jpeg") returned 0 [0060.107] lstrlenA (lpString="*.jpeg") returned 6 [0060.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", pszSpec="*.psd") returned 0 [0060.107] lstrlenA (lpString="*.psd") returned 5 [0060.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", pszSpec="*.gif") returned 1 [0060.107] lstrlenA (lpString="*.gif") returned 5 [0060.107] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF" [0060.107] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF" [0060.107] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF." [0060.107] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF.wannacry" [0060.107] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.108] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5559 [0060.108] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bdba870, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0060.108] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.108] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x54db, lpOverlapped=0x0) returned 1 [0060.110] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF") returned="ZPDIR7B.GIF" [0060.110] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.110] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x54db, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x54db, lpOverlapped=0x0) returned 1 [0060.110] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.110] CloseHandle (hObject=0x90) returned 1 [0060.110] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7b.gif.wannacry")) returned 1 [0060.111] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x5fdf, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR7F.GIF", cAlternateFileName="")) returned 1 [0060.111] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.111] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR7F.GIF") returned -1 [0060.111] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR7F.GIF") returned -1 [0060.111] lstrcmpiA (lpString1="", lpString2="ZPDIR7F.GIF") returned -1 [0060.111] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF") returned="ZPDIR7B.GIF" [0060.111] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0060.111] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0060.111] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0060.111] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0060.112] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR7F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF" [0060.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", pszSpec="*.zip") returned 0 [0060.112] lstrlenA (lpString="*.zip") returned 5 [0060.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", pszSpec="*.rar") returned 0 [0060.112] lstrlenA (lpString="*.rar") returned 5 [0060.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", pszSpec="*.7z") returned 0 [0060.112] lstrlenA (lpString="*.7z") returned 4 [0060.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", pszSpec="*.tar") returned 0 [0060.112] lstrlenA (lpString="*.tar") returned 5 [0060.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", pszSpec="*.gzip") returned 0 [0060.112] lstrlenA (lpString="*.gzip") returned 6 [0060.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", pszSpec="*.jpg") returned 0 [0060.112] lstrlenA (lpString="*.jpg") returned 5 [0060.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", pszSpec="*.jpeg") returned 0 [0060.112] lstrlenA (lpString="*.jpeg") returned 6 [0060.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", pszSpec="*.psd") returned 0 [0060.112] lstrlenA (lpString="*.psd") returned 5 [0060.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", pszSpec="*.gif") returned 1 [0060.112] lstrlenA (lpString="*.gif") returned 5 [0060.112] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF" [0060.112] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF" [0060.112] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF." [0060.112] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF.wannacry" [0060.112] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.113] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5fdf [0060.113] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bdba870, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0060.113] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.113] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x5f61, lpOverlapped=0x0) returned 1 [0060.115] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF") returned="ZPDIR7F.GIF" [0060.115] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.115] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x5f61, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x5f61, lpOverlapped=0x0) returned 1 [0060.115] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.115] CloseHandle (hObject=0x90) returned 1 [0060.115] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7f.gif.wannacry")) returned 1 [0060.116] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1038, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR8B.GIF", cAlternateFileName="")) returned 1 [0060.116] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.116] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR8B.GIF") returned -1 [0060.116] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR8B.GIF") returned -1 [0060.116] lstrcmpiA (lpString1="", lpString2="ZPDIR8B.GIF") returned -1 [0060.116] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF") returned="ZPDIR7F.GIF" [0060.116] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0060.116] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0060.116] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0060.116] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0060.116] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR8B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF" [0060.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", pszSpec="*.zip") returned 0 [0060.117] lstrlenA (lpString="*.zip") returned 5 [0060.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", pszSpec="*.rar") returned 0 [0060.117] lstrlenA (lpString="*.rar") returned 5 [0060.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", pszSpec="*.7z") returned 0 [0060.117] lstrlenA (lpString="*.7z") returned 4 [0060.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", pszSpec="*.tar") returned 0 [0060.117] lstrlenA (lpString="*.tar") returned 5 [0060.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", pszSpec="*.gzip") returned 0 [0060.117] lstrlenA (lpString="*.gzip") returned 6 [0060.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", pszSpec="*.jpg") returned 0 [0060.117] lstrlenA (lpString="*.jpg") returned 5 [0060.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", pszSpec="*.jpeg") returned 0 [0060.117] lstrlenA (lpString="*.jpeg") returned 6 [0060.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", pszSpec="*.psd") returned 0 [0060.117] lstrlenA (lpString="*.psd") returned 5 [0060.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", pszSpec="*.gif") returned 1 [0060.117] lstrlenA (lpString="*.gif") returned 5 [0060.117] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF" [0060.117] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF" [0060.117] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF." [0060.117] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF.wannacry" [0060.118] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.119] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1038 [0060.119] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bde09d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0060.119] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.119] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xfba, lpOverlapped=0x0) returned 1 [0060.121] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF") returned="ZPDIR8B.GIF" [0060.121] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.121] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xfba, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xfba, lpOverlapped=0x0) returned 1 [0060.121] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.121] CloseHandle (hObject=0x90) returned 1 [0060.121] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8b.gif.wannacry")) returned 1 [0060.122] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2d54, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR8F.GIF", cAlternateFileName="")) returned 1 [0060.122] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.122] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR8F.GIF") returned -1 [0060.122] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR8F.GIF") returned -1 [0060.122] lstrcmpiA (lpString1="", lpString2="ZPDIR8F.GIF") returned -1 [0060.122] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF") returned="ZPDIR8B.GIF" [0060.122] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0060.122] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0060.122] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0060.122] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0060.122] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR8F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF" [0060.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", pszSpec="*.zip") returned 0 [0060.122] lstrlenA (lpString="*.zip") returned 5 [0060.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", pszSpec="*.rar") returned 0 [0060.123] lstrlenA (lpString="*.rar") returned 5 [0060.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", pszSpec="*.7z") returned 0 [0060.123] lstrlenA (lpString="*.7z") returned 4 [0060.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", pszSpec="*.tar") returned 0 [0060.123] lstrlenA (lpString="*.tar") returned 5 [0060.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", pszSpec="*.gzip") returned 0 [0060.123] lstrlenA (lpString="*.gzip") returned 6 [0060.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", pszSpec="*.jpg") returned 0 [0060.123] lstrlenA (lpString="*.jpg") returned 5 [0060.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", pszSpec="*.jpeg") returned 0 [0060.123] lstrlenA (lpString="*.jpeg") returned 6 [0060.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", pszSpec="*.psd") returned 0 [0060.123] lstrlenA (lpString="*.psd") returned 5 [0060.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", pszSpec="*.gif") returned 1 [0060.123] lstrlenA (lpString="*.gif") returned 5 [0060.123] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF" [0060.123] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF" [0060.123] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF." [0060.123] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF.wannacry" [0060.123] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.124] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d54 [0060.124] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bde09d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0060.124] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.124] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2cd6, lpOverlapped=0x0) returned 1 [0060.126] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF") returned="ZPDIR8F.GIF" [0060.126] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.126] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2cd6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2cd6, lpOverlapped=0x0) returned 1 [0060.126] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.126] CloseHandle (hObject=0x90) returned 1 [0060.126] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8f.gif.wannacry")) returned 1 [0060.127] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3e39, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR9B.GIF", cAlternateFileName="")) returned 1 [0060.127] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.127] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR9B.GIF") returned -1 [0060.127] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR9B.GIF") returned -1 [0060.127] lstrcmpiA (lpString1="", lpString2="ZPDIR9B.GIF") returned -1 [0060.127] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF") returned="ZPDIR8F.GIF" [0060.127] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0060.127] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0060.127] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0060.127] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0060.127] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR9B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF" [0060.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", pszSpec="*.zip") returned 0 [0060.128] lstrlenA (lpString="*.zip") returned 5 [0060.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", pszSpec="*.rar") returned 0 [0060.128] lstrlenA (lpString="*.rar") returned 5 [0060.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", pszSpec="*.7z") returned 0 [0060.128] lstrlenA (lpString="*.7z") returned 4 [0060.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", pszSpec="*.tar") returned 0 [0060.128] lstrlenA (lpString="*.tar") returned 5 [0060.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", pszSpec="*.gzip") returned 0 [0060.128] lstrlenA (lpString="*.gzip") returned 6 [0060.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", pszSpec="*.jpg") returned 0 [0060.128] lstrlenA (lpString="*.jpg") returned 5 [0060.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", pszSpec="*.jpeg") returned 0 [0060.128] lstrlenA (lpString="*.jpeg") returned 6 [0060.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", pszSpec="*.psd") returned 0 [0060.128] lstrlenA (lpString="*.psd") returned 5 [0060.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", pszSpec="*.gif") returned 1 [0060.128] lstrlenA (lpString="*.gif") returned 5 [0060.128] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF" [0060.128] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF" [0060.128] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF." [0060.128] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF.wannacry" [0060.128] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.130] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e39 [0060.130] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bde09d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0060.130] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.130] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3dbb, lpOverlapped=0x0) returned 1 [0060.132] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF") returned="ZPDIR9B.GIF" [0060.132] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.132] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3dbb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3dbb, lpOverlapped=0x0) returned 1 [0060.132] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.132] CloseHandle (hObject=0x90) returned 1 [0060.132] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9b.gif.wannacry")) returned 1 [0060.133] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x46ec, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR9F.GIF", cAlternateFileName="")) returned 1 [0060.133] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.133] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZPDIR9F.GIF") returned -1 [0060.133] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZPDIR9F.GIF") returned -1 [0060.133] lstrcmpiA (lpString1="", lpString2="ZPDIR9F.GIF") returned -1 [0060.133] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF") returned="ZPDIR9B.GIF" [0060.133] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" [0060.133] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned="" [0060.133] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" [0060.133] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\how to decrypt files.txt")) returned 0x20 [0060.133] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", lpString2="ZPDIR9F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF" [0060.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", pszSpec="*.zip") returned 0 [0060.134] lstrlenA (lpString="*.zip") returned 5 [0060.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", pszSpec="*.rar") returned 0 [0060.134] lstrlenA (lpString="*.rar") returned 5 [0060.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", pszSpec="*.7z") returned 0 [0060.134] lstrlenA (lpString="*.7z") returned 4 [0060.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", pszSpec="*.tar") returned 0 [0060.134] lstrlenA (lpString="*.tar") returned 5 [0060.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", pszSpec="*.gzip") returned 0 [0060.134] lstrlenA (lpString="*.gzip") returned 6 [0060.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", pszSpec="*.jpg") returned 0 [0060.134] lstrlenA (lpString="*.jpg") returned 5 [0060.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", pszSpec="*.jpeg") returned 0 [0060.134] lstrlenA (lpString="*.jpeg") returned 6 [0060.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", pszSpec="*.psd") returned 0 [0060.134] lstrlenA (lpString="*.psd") returned 5 [0060.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", pszSpec="*.gif") returned 1 [0060.134] lstrlenA (lpString="*.gif") returned 5 [0060.134] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF" [0060.134] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF" [0060.134] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF." [0060.134] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF.wannacry" [0060.134] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.135] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46ec [0060.136] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320), lpLastAccessTime=0x407536*(dwLowDateTime=0x1bde09d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xca0e1800, dwHighDateTime=0x1bd0320)) returned 1 [0060.136] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.136] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x466e, lpOverlapped=0x0) returned 1 [0060.138] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF") returned="ZPDIR9F.GIF" [0060.138] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.138] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x466e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x466e, lpOverlapped=0x0) returned 1 [0060.138] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.138] CloseHandle (hObject=0x90) returned 1 [0060.138] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9f.gif.wannacry")) returned 1 [0060.139] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x46ec, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ZPDIR9F.GIF", cAlternateFileName="")) returned 0 [0060.139] FindClose (in: hFindFile=0x2d7ff8 | out: hFindFile=0x2d7ff8) returned 1 [0060.139] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87ce900, ftCreationTime.dwHighDateTime=0x1ca9b87, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc87ce900, ftLastWriteTime.dwHighDateTime=0x1ca9b87, nFileSizeHigh=0x0, nFileSizeLow=0x29d68, dwReserved0=0x2d80a8, dwReserved1=0x3, cFileName="PUBWZINT.DLL", cAlternateFileName="")) returned 1 [0060.139] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.139] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PUBWZINT.DLL") returned -1 [0060.139] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PUBWZINT.DLL") returned -1 [0060.139] lstrcmpiA (lpString1="", lpString2="PUBWZINT.DLL") returned -1 [0060.139] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\*.*") returned="*.*" [0060.139] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.139] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.139] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.139] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.140] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PUBWZINT.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL" [0060.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.zip") returned 0 [0060.140] lstrlenA (lpString="*.zip") returned 5 [0060.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.rar") returned 0 [0060.140] lstrlenA (lpString="*.rar") returned 5 [0060.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.7z") returned 0 [0060.140] lstrlenA (lpString="*.7z") returned 4 [0060.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.tar") returned 0 [0060.140] lstrlenA (lpString="*.tar") returned 5 [0060.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.gzip") returned 0 [0060.140] lstrlenA (lpString="*.gzip") returned 6 [0060.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.jpg") returned 0 [0060.140] lstrlenA (lpString="*.jpg") returned 5 [0060.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.jpeg") returned 0 [0060.140] lstrlenA (lpString="*.jpeg") returned 6 [0060.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.psd") returned 0 [0060.140] lstrlenA (lpString="*.psd") returned 5 [0060.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.gif") returned 0 [0060.140] lstrlenA (lpString="*.gif") returned 5 [0060.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.doc") returned 0 [0060.140] lstrlenA (lpString="*.doc") returned 5 [0060.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.docx") returned 0 [0060.140] lstrlenA (lpString="*.docx") returned 6 [0060.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.xls") returned 0 [0060.140] lstrlenA (lpString="*.xls") returned 5 [0060.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.xlsx") returned 0 [0060.140] lstrlenA (lpString="*.xlsx") returned 6 [0060.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.ppt") returned 0 [0060.141] lstrlenA (lpString="*.ppt") returned 5 [0060.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.pptx") returned 0 [0060.141] lstrlenA (lpString="*.pptx") returned 6 [0060.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.pdf") returned 0 [0060.141] lstrlenA (lpString="*.pdf") returned 5 [0060.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.mov") returned 0 [0060.141] lstrlenA (lpString="*.mov") returned 5 [0060.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.m2v") returned 0 [0060.141] lstrlenA (lpString="*.m2v") returned 5 [0060.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.3gp") returned 0 [0060.141] lstrlenA (lpString="*.3gp") returned 5 [0060.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.mpeg") returned 0 [0060.141] lstrlenA (lpString="*.mpeg") returned 6 [0060.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.mpg") returned 0 [0060.141] lstrlenA (lpString="*.mpg") returned 5 [0060.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.flv") returned 0 [0060.141] lstrlenA (lpString="*.flv") returned 5 [0060.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.avi") returned 0 [0060.141] lstrlenA (lpString="*.avi") returned 5 [0060.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.mp4") returned 0 [0060.141] lstrlenA (lpString="*.mp4") returned 5 [0060.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.wmv") returned 0 [0060.141] lstrlenA (lpString="*.wmv") returned 5 [0060.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.divx") returned 0 [0060.141] lstrlenA (lpString="*.divx") returned 6 [0060.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.mkv") returned 0 [0060.141] lstrlenA (lpString="*.mkv") returned 5 [0060.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.mp3") returned 0 [0060.142] lstrlenA (lpString="*.mp3") returned 5 [0060.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.wav") returned 0 [0060.142] lstrlenA (lpString="*.wav") returned 5 [0060.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.flac") returned 0 [0060.142] lstrlenA (lpString="*.flac") returned 6 [0060.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.ape") returned 0 [0060.142] lstrlenA (lpString="*.ape") returned 5 [0060.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.wma") returned 0 [0060.142] lstrlenA (lpString="*.wma") returned 5 [0060.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.ac3") returned 0 [0060.142] lstrlenA (lpString="*.ac3") returned 5 [0060.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", pszSpec="*.mxf") returned 0 [0060.142] lstrlenA (lpString="*.mxf") returned 5 [0060.142] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9324cb00, ftCreationTime.dwHighDateTime=0x1ca9b88, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9324cb00, ftLastWriteTime.dwHighDateTime=0x1ca9b88, nFileSizeHigh=0x0, nFileSizeLow=0x2a780, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWZINT.REST.IDX_DLL", cAlternateFileName="PUBWZI~1.IDX")) returned 1 [0060.142] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.142] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PUBWZINT.REST.IDX_DLL") returned -1 [0060.142] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PUBWZINT.REST.IDX_DLL") returned -1 [0060.142] lstrcmpiA (lpString1="", lpString2="PUBWZINT.REST.IDX_DLL") returned -1 [0060.142] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned="PUBWZINT.DLL" [0060.142] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.142] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.142] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.142] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.142] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="PUBWZINT.REST.IDX_DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL" [0060.142] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.zip") returned 0 [0060.142] lstrlenA (lpString="*.zip") returned 5 [0060.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.rar") returned 0 [0060.143] lstrlenA (lpString="*.rar") returned 5 [0060.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.7z") returned 0 [0060.143] lstrlenA (lpString="*.7z") returned 4 [0060.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.tar") returned 0 [0060.143] lstrlenA (lpString="*.tar") returned 5 [0060.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.gzip") returned 0 [0060.143] lstrlenA (lpString="*.gzip") returned 6 [0060.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.jpg") returned 0 [0060.143] lstrlenA (lpString="*.jpg") returned 5 [0060.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.jpeg") returned 0 [0060.143] lstrlenA (lpString="*.jpeg") returned 6 [0060.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.psd") returned 0 [0060.143] lstrlenA (lpString="*.psd") returned 5 [0060.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.gif") returned 0 [0060.143] lstrlenA (lpString="*.gif") returned 5 [0060.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.doc") returned 0 [0060.143] lstrlenA (lpString="*.doc") returned 5 [0060.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.docx") returned 0 [0060.143] lstrlenA (lpString="*.docx") returned 6 [0060.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.xls") returned 0 [0060.143] lstrlenA (lpString="*.xls") returned 5 [0060.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.xlsx") returned 0 [0060.143] lstrlenA (lpString="*.xlsx") returned 6 [0060.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.ppt") returned 0 [0060.143] lstrlenA (lpString="*.ppt") returned 5 [0060.143] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.pptx") returned 0 [0060.143] lstrlenA (lpString="*.pptx") returned 6 [0060.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.pdf") returned 0 [0060.144] lstrlenA (lpString="*.pdf") returned 5 [0060.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.mov") returned 0 [0060.144] lstrlenA (lpString="*.mov") returned 5 [0060.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.m2v") returned 0 [0060.144] lstrlenA (lpString="*.m2v") returned 5 [0060.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.3gp") returned 0 [0060.144] lstrlenA (lpString="*.3gp") returned 5 [0060.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.mpeg") returned 0 [0060.144] lstrlenA (lpString="*.mpeg") returned 6 [0060.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.mpg") returned 0 [0060.144] lstrlenA (lpString="*.mpg") returned 5 [0060.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.flv") returned 0 [0060.144] lstrlenA (lpString="*.flv") returned 5 [0060.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.avi") returned 0 [0060.144] lstrlenA (lpString="*.avi") returned 5 [0060.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.mp4") returned 0 [0060.144] lstrlenA (lpString="*.mp4") returned 5 [0060.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.wmv") returned 0 [0060.144] lstrlenA (lpString="*.wmv") returned 5 [0060.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.divx") returned 0 [0060.144] lstrlenA (lpString="*.divx") returned 6 [0060.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.mkv") returned 0 [0060.144] lstrlenA (lpString="*.mkv") returned 5 [0060.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.mp3") returned 0 [0060.144] lstrlenA (lpString="*.mp3") returned 5 [0060.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.wav") returned 0 [0060.144] lstrlenA (lpString="*.wav") returned 5 [0060.144] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.flac") returned 0 [0060.145] lstrlenA (lpString="*.flac") returned 6 [0060.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.ape") returned 0 [0060.145] lstrlenA (lpString="*.ape") returned 5 [0060.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.wma") returned 0 [0060.145] lstrlenA (lpString="*.wma") returned 5 [0060.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.ac3") returned 0 [0060.145] lstrlenA (lpString="*.ac3") returned 5 [0060.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", pszSpec="*.mxf") returned 0 [0060.145] lstrlenA (lpString="*.mxf") returned 5 [0060.145] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32ad2d00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x32ad2d00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x14760, dwReserved0=0x0, dwReserved1=0x0, cFileName="QRYINT32.DLL", cAlternateFileName="")) returned 1 [0060.145] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.145] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QRYINT32.DLL") returned -1 [0060.145] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QRYINT32.DLL") returned -1 [0060.145] lstrcmpiA (lpString1="", lpString2="QRYINT32.DLL") returned -1 [0060.145] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned="PUBWZINT.REST.IDX_DLL" [0060.145] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.145] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.145] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="QRYINT32.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL" [0060.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.zip") returned 0 [0060.145] lstrlenA (lpString="*.zip") returned 5 [0060.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.rar") returned 0 [0060.145] lstrlenA (lpString="*.rar") returned 5 [0060.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.7z") returned 0 [0060.145] lstrlenA (lpString="*.7z") returned 4 [0060.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.tar") returned 0 [0060.146] lstrlenA (lpString="*.tar") returned 5 [0060.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.gzip") returned 0 [0060.146] lstrlenA (lpString="*.gzip") returned 6 [0060.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.jpg") returned 0 [0060.146] lstrlenA (lpString="*.jpg") returned 5 [0060.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.jpeg") returned 0 [0060.146] lstrlenA (lpString="*.jpeg") returned 6 [0060.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.psd") returned 0 [0060.146] lstrlenA (lpString="*.psd") returned 5 [0060.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.gif") returned 0 [0060.146] lstrlenA (lpString="*.gif") returned 5 [0060.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.doc") returned 0 [0060.146] lstrlenA (lpString="*.doc") returned 5 [0060.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.docx") returned 0 [0060.146] lstrlenA (lpString="*.docx") returned 6 [0060.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.xls") returned 0 [0060.146] lstrlenA (lpString="*.xls") returned 5 [0060.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.xlsx") returned 0 [0060.146] lstrlenA (lpString="*.xlsx") returned 6 [0060.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.ppt") returned 0 [0060.146] lstrlenA (lpString="*.ppt") returned 5 [0060.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.pptx") returned 0 [0060.146] lstrlenA (lpString="*.pptx") returned 6 [0060.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.pdf") returned 0 [0060.146] lstrlenA (lpString="*.pdf") returned 5 [0060.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.mov") returned 0 [0060.146] lstrlenA (lpString="*.mov") returned 5 [0060.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.m2v") returned 0 [0060.146] lstrlenA (lpString="*.m2v") returned 5 [0060.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.3gp") returned 0 [0060.147] lstrlenA (lpString="*.3gp") returned 5 [0060.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.mpeg") returned 0 [0060.147] lstrlenA (lpString="*.mpeg") returned 6 [0060.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.mpg") returned 0 [0060.147] lstrlenA (lpString="*.mpg") returned 5 [0060.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.flv") returned 0 [0060.147] lstrlenA (lpString="*.flv") returned 5 [0060.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.avi") returned 0 [0060.147] lstrlenA (lpString="*.avi") returned 5 [0060.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.mp4") returned 0 [0060.147] lstrlenA (lpString="*.mp4") returned 5 [0060.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.wmv") returned 0 [0060.147] lstrlenA (lpString="*.wmv") returned 5 [0060.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.divx") returned 0 [0060.147] lstrlenA (lpString="*.divx") returned 6 [0060.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.mkv") returned 0 [0060.147] lstrlenA (lpString="*.mkv") returned 5 [0060.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.mp3") returned 0 [0060.147] lstrlenA (lpString="*.mp3") returned 5 [0060.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.wav") returned 0 [0060.147] lstrlenA (lpString="*.wav") returned 5 [0060.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.flac") returned 0 [0060.147] lstrlenA (lpString="*.flac") returned 6 [0060.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.ape") returned 0 [0060.147] lstrlenA (lpString="*.ape") returned 5 [0060.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.wma") returned 0 [0060.147] lstrlenA (lpString="*.wma") returned 5 [0060.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.ac3") returned 0 [0060.147] lstrlenA (lpString="*.ac3") returned 5 [0060.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", pszSpec="*.mxf") returned 0 [0060.148] lstrlenA (lpString="*.mxf") returned 5 [0060.148] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickStyles", cAlternateFileName="QUICKS~1")) returned 1 [0060.148] lstrcmpA (lpString1=".", lpString2="QuickStyles") returned -1 [0060.148] lstrcmpA (lpString1="..", lpString2="QuickStyles") returned -1 [0060.148] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned="QRYINT32.DLL" [0060.148] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="QuickStyles" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles" [0060.148] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles") returned 59 [0060.148] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d8138, cFileName=".", cAlternateFileName="")) returned 0x2d7ff8 [0060.151] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.151] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0060.151] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.151] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.151] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95af5900, ftCreationTime.dwHighDateTime=0x1c7e846, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95af5900, ftLastWriteTime.dwHighDateTime=0x1c7e846, nFileSizeHigh=0x0, nFileSizeLow=0x2387, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Classic.dotx", cAlternateFileName="CLASSI~1.DOT")) returned 1 [0060.151] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.151] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Classic.dotx") returned 1 [0060.151] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Classic.dotx") returned 1 [0060.151] lstrcmpiA (lpString1="", lpString2="Classic.dotx") returned -1 [0060.151] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\*.*") returned="*.*" [0060.151] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" [0060.152] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned="" [0060.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt" [0060.152] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\how to decrypt files.txt")) returned 0xffffffff [0060.152] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.153] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0060.153] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0060.154] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.154] CloseHandle (hObject=0x90) returned 1 [0060.154] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpString2="Classic.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx" [0060.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.zip") returned 0 [0060.154] lstrlenA (lpString="*.zip") returned 5 [0060.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.rar") returned 0 [0060.154] lstrlenA (lpString="*.rar") returned 5 [0060.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.7z") returned 0 [0060.154] lstrlenA (lpString="*.7z") returned 4 [0060.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.tar") returned 0 [0060.154] lstrlenA (lpString="*.tar") returned 5 [0060.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.gzip") returned 0 [0060.154] lstrlenA (lpString="*.gzip") returned 6 [0060.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.jpg") returned 0 [0060.155] lstrlenA (lpString="*.jpg") returned 5 [0060.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.jpeg") returned 0 [0060.155] lstrlenA (lpString="*.jpeg") returned 6 [0060.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.psd") returned 0 [0060.155] lstrlenA (lpString="*.psd") returned 5 [0060.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.gif") returned 0 [0060.155] lstrlenA (lpString="*.gif") returned 5 [0060.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.doc") returned 0 [0060.155] lstrlenA (lpString="*.doc") returned 5 [0060.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.docx") returned 0 [0060.155] lstrlenA (lpString="*.docx") returned 6 [0060.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.xls") returned 0 [0060.155] lstrlenA (lpString="*.xls") returned 5 [0060.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.xlsx") returned 0 [0060.155] lstrlenA (lpString="*.xlsx") returned 6 [0060.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.ppt") returned 0 [0060.155] lstrlenA (lpString="*.ppt") returned 5 [0060.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.pptx") returned 0 [0060.155] lstrlenA (lpString="*.pptx") returned 6 [0060.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.pdf") returned 0 [0060.155] lstrlenA (lpString="*.pdf") returned 5 [0060.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.mov") returned 0 [0060.155] lstrlenA (lpString="*.mov") returned 5 [0060.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.m2v") returned 0 [0060.155] lstrlenA (lpString="*.m2v") returned 5 [0060.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.3gp") returned 0 [0060.155] lstrlenA (lpString="*.3gp") returned 5 [0060.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.mpeg") returned 0 [0060.156] lstrlenA (lpString="*.mpeg") returned 6 [0060.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.mpg") returned 0 [0060.156] lstrlenA (lpString="*.mpg") returned 5 [0060.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.flv") returned 0 [0060.156] lstrlenA (lpString="*.flv") returned 5 [0060.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.avi") returned 0 [0060.156] lstrlenA (lpString="*.avi") returned 5 [0060.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.mp4") returned 0 [0060.156] lstrlenA (lpString="*.mp4") returned 5 [0060.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.wmv") returned 0 [0060.156] lstrlenA (lpString="*.wmv") returned 5 [0060.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.divx") returned 0 [0060.156] lstrlenA (lpString="*.divx") returned 6 [0060.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.mkv") returned 0 [0060.156] lstrlenA (lpString="*.mkv") returned 5 [0060.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.mp3") returned 0 [0060.156] lstrlenA (lpString="*.mp3") returned 5 [0060.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.wav") returned 0 [0060.156] lstrlenA (lpString="*.wav") returned 5 [0060.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.flac") returned 0 [0060.156] lstrlenA (lpString="*.flac") returned 6 [0060.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.ape") returned 0 [0060.156] lstrlenA (lpString="*.ape") returned 5 [0060.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.wma") returned 0 [0060.156] lstrlenA (lpString="*.wma") returned 5 [0060.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.ac3") returned 0 [0060.156] lstrlenA (lpString="*.ac3") returned 5 [0060.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", pszSpec="*.mxf") returned 0 [0060.157] lstrlenA (lpString="*.mxf") returned 5 [0060.157] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x23e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default.dotx", cAlternateFileName="DEFAUL~1.DOT")) returned 1 [0060.157] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.157] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Default.dotx") returned 1 [0060.157] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Default.dotx") returned 1 [0060.157] lstrcmpiA (lpString1="", lpString2="Default.dotx") returned -1 [0060.157] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx") returned="Classic.dotx" [0060.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" [0060.157] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned="" [0060.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt" [0060.157] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\how to decrypt files.txt")) returned 0x20 [0060.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpString2="Default.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx" [0060.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.zip") returned 0 [0060.157] lstrlenA (lpString="*.zip") returned 5 [0060.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.rar") returned 0 [0060.157] lstrlenA (lpString="*.rar") returned 5 [0060.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.7z") returned 0 [0060.157] lstrlenA (lpString="*.7z") returned 4 [0060.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.tar") returned 0 [0060.157] lstrlenA (lpString="*.tar") returned 5 [0060.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.gzip") returned 0 [0060.157] lstrlenA (lpString="*.gzip") returned 6 [0060.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.jpg") returned 0 [0060.158] lstrlenA (lpString="*.jpg") returned 5 [0060.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.jpeg") returned 0 [0060.158] lstrlenA (lpString="*.jpeg") returned 6 [0060.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.psd") returned 0 [0060.158] lstrlenA (lpString="*.psd") returned 5 [0060.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.gif") returned 0 [0060.158] lstrlenA (lpString="*.gif") returned 5 [0060.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.doc") returned 0 [0060.158] lstrlenA (lpString="*.doc") returned 5 [0060.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.docx") returned 0 [0060.158] lstrlenA (lpString="*.docx") returned 6 [0060.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.xls") returned 0 [0060.158] lstrlenA (lpString="*.xls") returned 5 [0060.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.xlsx") returned 0 [0060.158] lstrlenA (lpString="*.xlsx") returned 6 [0060.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.ppt") returned 0 [0060.158] lstrlenA (lpString="*.ppt") returned 5 [0060.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.pptx") returned 0 [0060.158] lstrlenA (lpString="*.pptx") returned 6 [0060.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.pdf") returned 0 [0060.158] lstrlenA (lpString="*.pdf") returned 5 [0060.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.mov") returned 0 [0060.158] lstrlenA (lpString="*.mov") returned 5 [0060.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.m2v") returned 0 [0060.158] lstrlenA (lpString="*.m2v") returned 5 [0060.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.3gp") returned 0 [0060.158] lstrlenA (lpString="*.3gp") returned 5 [0060.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.mpeg") returned 0 [0060.159] lstrlenA (lpString="*.mpeg") returned 6 [0060.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.mpg") returned 0 [0060.159] lstrlenA (lpString="*.mpg") returned 5 [0060.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.flv") returned 0 [0060.159] lstrlenA (lpString="*.flv") returned 5 [0060.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.avi") returned 0 [0060.159] lstrlenA (lpString="*.avi") returned 5 [0060.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.mp4") returned 0 [0060.159] lstrlenA (lpString="*.mp4") returned 5 [0060.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.wmv") returned 0 [0060.159] lstrlenA (lpString="*.wmv") returned 5 [0060.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.divx") returned 0 [0060.159] lstrlenA (lpString="*.divx") returned 6 [0060.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.mkv") returned 0 [0060.159] lstrlenA (lpString="*.mkv") returned 5 [0060.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.mp3") returned 0 [0060.159] lstrlenA (lpString="*.mp3") returned 5 [0060.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.wav") returned 0 [0060.159] lstrlenA (lpString="*.wav") returned 5 [0060.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.flac") returned 0 [0060.159] lstrlenA (lpString="*.flac") returned 6 [0060.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.ape") returned 0 [0060.159] lstrlenA (lpString="*.ape") returned 5 [0060.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.wma") returned 0 [0060.159] lstrlenA (lpString="*.wma") returned 5 [0060.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.ac3") returned 0 [0060.159] lstrlenA (lpString="*.ac3") returned 5 [0060.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", pszSpec="*.mxf") returned 0 [0060.160] lstrlenA (lpString="*.mxf") returned 5 [0060.160] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x20f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefaultBlackAndWhite.dotx", cAlternateFileName="DEFAUL~2.DOT")) returned 1 [0060.160] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.160] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultBlackAndWhite.dotx") returned 1 [0060.160] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultBlackAndWhite.dotx") returned 1 [0060.160] lstrcmpiA (lpString1="", lpString2="DefaultBlackAndWhite.dotx") returned -1 [0060.160] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx") returned="Default.dotx" [0060.160] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" [0060.160] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned="" [0060.160] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt" [0060.160] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\how to decrypt files.txt")) returned 0x20 [0060.160] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpString2="DefaultBlackAndWhite.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx" [0060.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.zip") returned 0 [0060.160] lstrlenA (lpString="*.zip") returned 5 [0060.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.rar") returned 0 [0060.160] lstrlenA (lpString="*.rar") returned 5 [0060.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.7z") returned 0 [0060.160] lstrlenA (lpString="*.7z") returned 4 [0060.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.tar") returned 0 [0060.160] lstrlenA (lpString="*.tar") returned 5 [0060.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.gzip") returned 0 [0060.160] lstrlenA (lpString="*.gzip") returned 6 [0060.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.jpg") returned 0 [0060.161] lstrlenA (lpString="*.jpg") returned 5 [0060.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.jpeg") returned 0 [0060.161] lstrlenA (lpString="*.jpeg") returned 6 [0060.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.psd") returned 0 [0060.161] lstrlenA (lpString="*.psd") returned 5 [0060.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.gif") returned 0 [0060.161] lstrlenA (lpString="*.gif") returned 5 [0060.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.doc") returned 0 [0060.161] lstrlenA (lpString="*.doc") returned 5 [0060.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.docx") returned 0 [0060.161] lstrlenA (lpString="*.docx") returned 6 [0060.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.xls") returned 0 [0060.161] lstrlenA (lpString="*.xls") returned 5 [0060.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.xlsx") returned 0 [0060.161] lstrlenA (lpString="*.xlsx") returned 6 [0060.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.ppt") returned 0 [0060.161] lstrlenA (lpString="*.ppt") returned 5 [0060.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.pptx") returned 0 [0060.161] lstrlenA (lpString="*.pptx") returned 6 [0060.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.pdf") returned 0 [0060.161] lstrlenA (lpString="*.pdf") returned 5 [0060.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.mov") returned 0 [0060.161] lstrlenA (lpString="*.mov") returned 5 [0060.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.m2v") returned 0 [0060.161] lstrlenA (lpString="*.m2v") returned 5 [0060.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.3gp") returned 0 [0060.161] lstrlenA (lpString="*.3gp") returned 5 [0060.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.mpeg") returned 0 [0060.162] lstrlenA (lpString="*.mpeg") returned 6 [0060.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.mpg") returned 0 [0060.162] lstrlenA (lpString="*.mpg") returned 5 [0060.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.flv") returned 0 [0060.162] lstrlenA (lpString="*.flv") returned 5 [0060.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.avi") returned 0 [0060.162] lstrlenA (lpString="*.avi") returned 5 [0060.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.mp4") returned 0 [0060.162] lstrlenA (lpString="*.mp4") returned 5 [0060.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.wmv") returned 0 [0060.162] lstrlenA (lpString="*.wmv") returned 5 [0060.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.divx") returned 0 [0060.162] lstrlenA (lpString="*.divx") returned 6 [0060.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.mkv") returned 0 [0060.162] lstrlenA (lpString="*.mkv") returned 5 [0060.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.mp3") returned 0 [0060.162] lstrlenA (lpString="*.mp3") returned 5 [0060.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.wav") returned 0 [0060.162] lstrlenA (lpString="*.wav") returned 5 [0060.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.flac") returned 0 [0060.162] lstrlenA (lpString="*.flac") returned 6 [0060.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.ape") returned 0 [0060.162] lstrlenA (lpString="*.ape") returned 5 [0060.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.wma") returned 0 [0060.162] lstrlenA (lpString="*.wma") returned 5 [0060.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.ac3") returned 0 [0060.162] lstrlenA (lpString="*.ac3") returned 5 [0060.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", pszSpec="*.mxf") returned 0 [0060.163] lstrlenA (lpString="*.mxf") returned 5 [0060.163] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x2169, dwReserved0=0x0, dwReserved1=0x0, cFileName="Distinctive.dotx", cAlternateFileName="DISTIN~1.DOT")) returned 1 [0060.163] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.163] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Distinctive.dotx") returned 1 [0060.163] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Distinctive.dotx") returned 1 [0060.163] lstrcmpiA (lpString1="", lpString2="Distinctive.dotx") returned -1 [0060.163] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx") returned="DefaultBlackAndWhite.dotx" [0060.163] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" [0060.163] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned="" [0060.163] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt" [0060.163] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\how to decrypt files.txt")) returned 0x20 [0060.163] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpString2="Distinctive.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx" [0060.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.zip") returned 0 [0060.163] lstrlenA (lpString="*.zip") returned 5 [0060.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.rar") returned 0 [0060.163] lstrlenA (lpString="*.rar") returned 5 [0060.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.7z") returned 0 [0060.163] lstrlenA (lpString="*.7z") returned 4 [0060.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.tar") returned 0 [0060.163] lstrlenA (lpString="*.tar") returned 5 [0060.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.gzip") returned 0 [0060.163] lstrlenA (lpString="*.gzip") returned 6 [0060.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.jpg") returned 0 [0060.163] lstrlenA (lpString="*.jpg") returned 5 [0060.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.jpeg") returned 0 [0060.164] lstrlenA (lpString="*.jpeg") returned 6 [0060.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.psd") returned 0 [0060.164] lstrlenA (lpString="*.psd") returned 5 [0060.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.gif") returned 0 [0060.164] lstrlenA (lpString="*.gif") returned 5 [0060.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.doc") returned 0 [0060.164] lstrlenA (lpString="*.doc") returned 5 [0060.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.docx") returned 0 [0060.164] lstrlenA (lpString="*.docx") returned 6 [0060.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.xls") returned 0 [0060.164] lstrlenA (lpString="*.xls") returned 5 [0060.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.xlsx") returned 0 [0060.164] lstrlenA (lpString="*.xlsx") returned 6 [0060.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.ppt") returned 0 [0060.164] lstrlenA (lpString="*.ppt") returned 5 [0060.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.pptx") returned 0 [0060.164] lstrlenA (lpString="*.pptx") returned 6 [0060.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.pdf") returned 0 [0060.164] lstrlenA (lpString="*.pdf") returned 5 [0060.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.mov") returned 0 [0060.164] lstrlenA (lpString="*.mov") returned 5 [0060.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.m2v") returned 0 [0060.164] lstrlenA (lpString="*.m2v") returned 5 [0060.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.3gp") returned 0 [0060.165] lstrlenA (lpString="*.3gp") returned 5 [0060.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.mpeg") returned 0 [0060.165] lstrlenA (lpString="*.mpeg") returned 6 [0060.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.mpg") returned 0 [0060.165] lstrlenA (lpString="*.mpg") returned 5 [0060.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.flv") returned 0 [0060.165] lstrlenA (lpString="*.flv") returned 5 [0060.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.avi") returned 0 [0060.165] lstrlenA (lpString="*.avi") returned 5 [0060.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.mp4") returned 0 [0060.165] lstrlenA (lpString="*.mp4") returned 5 [0060.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.wmv") returned 0 [0060.165] lstrlenA (lpString="*.wmv") returned 5 [0060.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.divx") returned 0 [0060.165] lstrlenA (lpString="*.divx") returned 6 [0060.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.mkv") returned 0 [0060.165] lstrlenA (lpString="*.mkv") returned 5 [0060.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.mp3") returned 0 [0060.165] lstrlenA (lpString="*.mp3") returned 5 [0060.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.wav") returned 0 [0060.165] lstrlenA (lpString="*.wav") returned 5 [0060.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.flac") returned 0 [0060.165] lstrlenA (lpString="*.flac") returned 6 [0060.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.ape") returned 0 [0060.165] lstrlenA (lpString="*.ape") returned 5 [0060.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.wma") returned 0 [0060.166] lstrlenA (lpString="*.wma") returned 5 [0060.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.ac3") returned 0 [0060.166] lstrlenA (lpString="*.ac3") returned 5 [0060.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", pszSpec="*.mxf") returned 0 [0060.166] lstrlenA (lpString="*.mxf") returned 5 [0060.166] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e3aa710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x222a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Elegant.dotx", cAlternateFileName="ELEGAN~1.DOT")) returned 1 [0060.166] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.166] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Elegant.dotx") returned -1 [0060.166] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Elegant.dotx") returned 1 [0060.166] lstrcmpiA (lpString1="", lpString2="Elegant.dotx") returned -1 [0060.166] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx") returned="Distinctive.dotx" [0060.166] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" [0060.166] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned="" [0060.166] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt" [0060.166] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\how to decrypt files.txt")) returned 0x20 [0060.166] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpString2="Elegant.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx" [0060.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", pszSpec="*.zip") returned 0 [0060.166] lstrlenA (lpString="*.zip") returned 5 [0060.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", pszSpec="*.rar") returned 0 [0060.166] lstrlenA (lpString="*.rar") returned 5 [0060.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", pszSpec="*.7z") returned 0 [0060.166] lstrlenA (lpString="*.7z") returned 4 [0060.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", pszSpec="*.tar") returned 0 [0060.166] lstrlenA (lpString="*.tar") returned 5 [0060.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", pszSpec="*.gzip") returned 0 [0060.167] lstrlenA (lpString="*.gzip") returned 6 [0060.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", pszSpec="*.jpg") returned 0 [0060.167] lstrlenA (lpString="*.jpg") returned 5 [0060.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", pszSpec="*.jpeg") returned 0 [0060.167] lstrlenA (lpString="*.jpeg") returned 6 [0060.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", pszSpec="*.psd") returned 0 [0060.167] lstrlenA (lpString="*.psd") returned 5 [0060.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", pszSpec="*.gif") returned 0 [0060.167] lstrlenA (lpString="*.gif") returned 5 [0060.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", pszSpec="*.doc") returned 0 [0060.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", pszSpec="*.docx") returned 0 [0060.167] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e48ef50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x221b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fancy.dotx", cAlternateFileName="FANCY~1.DOT")) returned 1 [0060.167] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.167] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Fancy.dotx") returned -1 [0060.167] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Fancy.dotx") returned 1 [0060.167] lstrcmpiA (lpString1="", lpString2="Fancy.dotx") returned -1 [0060.167] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx") returned="Elegant.dotx" [0060.168] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" [0060.168] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned="" [0060.168] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt" [0060.168] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\how to decrypt files.txt")) returned 0x20 [0060.168] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpString2="Fancy.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx" [0060.168] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e48ef50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0x0, dwReserved1=0x0, cFileName="Formal.dotx", cAlternateFileName="FORMAL~1.DOT")) returned 1 [0060.168] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.168] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Formal.dotx") returned -1 [0060.168] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Formal.dotx") returned 1 [0060.168] lstrcmpiA (lpString1="", lpString2="Formal.dotx") returned -1 [0060.168] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx") returned="Fancy.dotx" [0060.168] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" [0060.168] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned="" [0060.168] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt" [0060.168] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\how to decrypt files.txt")) returned 0x20 [0060.168] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpString2="Formal.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx" [0060.168] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e48ef50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x210c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Manuscript.dotx", cAlternateFileName="MANUSC~1.DOT")) returned 1 [0060.168] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.168] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Manuscript.dotx") returned -1 [0060.168] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Manuscript.dotx") returned -1 [0060.169] lstrcmpiA (lpString1="", lpString2="Manuscript.dotx") returned -1 [0060.169] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx") returned="Formal.dotx" [0060.169] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" [0060.169] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned="" [0060.169] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt" [0060.169] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\how to decrypt files.txt")) returned 0x20 [0060.169] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpString2="Manuscript.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx" [0060.169] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e4b50b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x21ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modern.dotx", cAlternateFileName="MODERN~1.DOT")) returned 1 [0060.169] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.169] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Modern.dotx") returned -1 [0060.169] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Modern.dotx") returned -1 [0060.169] lstrcmpiA (lpString1="", lpString2="Modern.dotx") returned -1 [0060.169] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx") returned="Manuscript.dotx" [0060.169] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" [0060.169] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned="" [0060.169] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt" [0060.169] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\how to decrypt files.txt")) returned 0x20 [0060.169] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpString2="Modern.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx" [0060.169] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2744700, ftCreationTime.dwHighDateTime=0x1ca568e, ftLastAccessTime.dwLowDateTime=0x1e4db210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2744700, ftLastWriteTime.dwHighDateTime=0x1ca568e, nFileSizeHigh=0x0, nFileSizeLow=0x8ce63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Newsprint.dotx", cAlternateFileName="NEWSPR~1.DOT")) returned 1 [0060.169] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.169] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Newsprint.dotx") returned -1 [0060.170] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Newsprint.dotx") returned -1 [0060.170] lstrcmpiA (lpString1="", lpString2="Newsprint.dotx") returned -1 [0060.170] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx") returned="Modern.dotx" [0060.170] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" [0060.170] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned="" [0060.170] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt" [0060.170] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\how to decrypt files.txt")) returned 0x20 [0060.170] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpString2="Newsprint.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx" [0060.170] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2744700, ftCreationTime.dwHighDateTime=0x1ca568e, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2744700, ftLastWriteTime.dwHighDateTime=0x1ca568e, nFileSizeHigh=0x0, nFileSizeLow=0x5adf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perspective.dotx", cAlternateFileName="PERSPE~1.DOT")) returned 1 [0060.170] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.170] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Perspective.dotx") returned -1 [0060.170] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Perspective.dotx") returned -1 [0060.170] lstrcmpiA (lpString1="", lpString2="Perspective.dotx") returned -1 [0060.170] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx") returned="Newsprint.dotx" [0060.170] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" [0060.170] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned="" [0060.170] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt" [0060.170] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\how to decrypt files.txt")) returned 0x20 [0060.170] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpString2="Perspective.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx" [0060.170] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x20f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple.dotx", cAlternateFileName="SIMPLE~1.DOT")) returned 1 [0060.171] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.171] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Simple.dotx") returned -1 [0060.171] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Simple.dotx") returned -1 [0060.171] lstrcmpiA (lpString1="", lpString2="Simple.dotx") returned -1 [0060.171] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx") returned="Perspective.dotx" [0060.171] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" [0060.171] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned="" [0060.171] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt" [0060.171] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\how to decrypt files.txt")) returned 0x20 [0060.171] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpString2="Simple.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx" [0060.171] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2744700, ftCreationTime.dwHighDateTime=0x1ca568e, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2744700, ftLastWriteTime.dwHighDateTime=0x1ca568e, nFileSizeHigh=0x0, nFileSizeLow=0x5d3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thatch.dotx", cAlternateFileName="THATCH~1.DOT")) returned 1 [0060.171] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.171] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Thatch.dotx") returned -1 [0060.171] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Thatch.dotx") returned -1 [0060.171] lstrcmpiA (lpString1="", lpString2="Thatch.dotx") returned -1 [0060.171] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx") returned="Simple.dotx" [0060.171] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" [0060.171] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned="" [0060.171] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt" [0060.171] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\how to decrypt files.txt")) returned 0x20 [0060.171] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpString2="Thatch.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx" [0060.172] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x21f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Traditional.dotx", cAlternateFileName="TRADIT~1.DOT")) returned 1 [0060.172] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.172] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Traditional.dotx") returned -1 [0060.172] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Traditional.dotx") returned -1 [0060.172] lstrcmpiA (lpString1="", lpString2="Traditional.dotx") returned -1 [0060.172] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx") returned="Thatch.dotx" [0060.172] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" [0060.172] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned="" [0060.172] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt" [0060.172] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\how to decrypt files.txt")) returned 0x20 [0060.172] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", lpString2="Traditional.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx" [0060.172] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x21f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Traditional.dotx", cAlternateFileName="TRADIT~1.DOT")) returned 0 [0060.172] FindClose (in: hFindFile=0x2d7ff8 | out: hFindFile=0x2d7ff8) returned 1 [0060.172] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc4600, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62bc4600, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x39aa, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ReviewRouting_Init.xsn", cAlternateFileName="REVIEW~1.XSN")) returned 1 [0060.172] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.172] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ReviewRouting_Init.xsn") returned -1 [0060.172] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ReviewRouting_Init.xsn") returned -1 [0060.172] lstrcmpiA (lpString1="", lpString2="ReviewRouting_Init.xsn") returned -1 [0060.172] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\*.*") returned="*.*" [0060.172] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.172] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.173] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.173] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.173] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="ReviewRouting_Init.xsn" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn" [0060.173] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63ed7300, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x63ed7300, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x482d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReviewRouting_Review.xsn", cAlternateFileName="REVIEW~2.XSN")) returned 1 [0060.173] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.173] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ReviewRouting_Review.xsn") returned -1 [0060.173] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ReviewRouting_Review.xsn") returned -1 [0060.173] lstrcmpiA (lpString1="", lpString2="ReviewRouting_Review.xsn") returned -1 [0060.173] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn") returned="ReviewRouting_Init.xsn" [0060.173] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.173] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.173] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.173] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.173] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="ReviewRouting_Review.xsn" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn" [0060.173] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50d55500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ROSE.CSS", cAlternateFileName="")) returned 1 [0060.173] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.173] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ROSE.CSS") returned -1 [0060.173] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ROSE.CSS") returned -1 [0060.173] lstrcmpiA (lpString1="", lpString2="ROSE.CSS") returned -1 [0060.173] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn") returned="ReviewRouting_Review.xsn" [0060.173] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.174] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.174] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.174] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.174] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="ROSE.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS" [0060.174] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1d3a600, ftCreationTime.dwHighDateTime=0x1be1dd7, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1d3a600, ftLastWriteTime.dwHighDateTime=0x1be1dd7, nFileSizeHigh=0x0, nFileSizeLow=0xc06d, dwReserved0=0x0, dwReserved1=0x0, cFileName="RPLBRF35.CHM", cAlternateFileName="")) returned 1 [0060.174] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.174] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RPLBRF35.CHM") returned -1 [0060.174] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RPLBRF35.CHM") returned -1 [0060.174] lstrcmpiA (lpString1="", lpString2="RPLBRF35.CHM") returned -1 [0060.174] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS") returned="ROSE.CSS" [0060.174] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.174] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.174] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.174] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.174] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="RPLBRF35.CHM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM" [0060.174] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50d55500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xbd68, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVASWEB.VSL", cAlternateFileName="")) returned 1 [0060.174] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.174] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SAVASWEB.VSL") returned -1 [0060.174] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SAVASWEB.VSL") returned -1 [0060.174] lstrcmpiA (lpString1="", lpString2="SAVASWEB.VSL") returned -1 [0060.174] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM") returned="RPLBRF35.CHM" [0060.174] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.175] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.175] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.175] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.175] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="SAVASWEB.VSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" [0060.175] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9271b400, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9271b400, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x61204, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETLANG.HXS", cAlternateFileName="")) returned 1 [0060.175] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.175] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SETLANG.HXS") returned -1 [0060.175] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETLANG.HXS") returned -1 [0060.175] lstrcmpiA (lpString1="", lpString2="SETLANG.HXS") returned -1 [0060.175] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned="SAVASWEB.VSL" [0060.175] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.175] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.175] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.175] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.175] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="SETLANG.HXS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS" [0060.175] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETLANG_COL.HXC", cAlternateFileName="SETLAN~1.HXC")) returned 1 [0060.175] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.175] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SETLANG_COL.HXC") returned -1 [0060.175] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETLANG_COL.HXC") returned -1 [0060.175] lstrcmpiA (lpString1="", lpString2="SETLANG_COL.HXC") returned -1 [0060.175] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned="SETLANG.HXS" [0060.176] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.176] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.176] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.176] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.176] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="SETLANG_COL.HXC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC" [0060.176] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a76d900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5a76d900, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETLANG_COL.HXT", cAlternateFileName="SETLAN~1.HXT")) returned 1 [0060.176] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.176] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SETLANG_COL.HXT") returned -1 [0060.176] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETLANG_COL.HXT") returned -1 [0060.176] lstrcmpiA (lpString1="", lpString2="SETLANG_COL.HXT") returned -1 [0060.176] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned="SETLANG_COL.HXC" [0060.176] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.176] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.176] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.176] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.176] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="SETLANG_COL.HXT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" [0060.176] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a76d900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5a76d900, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETLANG_F_COL.HXK", cAlternateFileName="SETLAN~1.HXK")) returned 1 [0060.176] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.176] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SETLANG_F_COL.HXK") returned -1 [0060.176] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETLANG_F_COL.HXK") returned -1 [0060.177] lstrcmpiA (lpString1="", lpString2="SETLANG_F_COL.HXK") returned -1 [0060.177] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned="SETLANG_COL.HXT" [0060.177] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.177] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.177] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.177] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.177] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="SETLANG_F_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" [0060.177] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a76d900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5a76d900, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETLANG_K_COL.HXK", cAlternateFileName="SETLAN~2.HXK")) returned 1 [0060.177] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.177] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SETLANG_K_COL.HXK") returned -1 [0060.177] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETLANG_K_COL.HXK") returned -1 [0060.177] lstrcmpiA (lpString1="", lpString2="SETLANG_K_COL.HXK") returned -1 [0060.177] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned="SETLANG_F_COL.HXK" [0060.177] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.177] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.177] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.177] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.177] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="SETLANG_K_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" [0060.177] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x10d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="SGRES.DLL", cAlternateFileName="")) returned 1 [0060.177] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.177] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SGRES.DLL") returned -1 [0060.178] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SGRES.DLL") returned -1 [0060.178] lstrcmpiA (lpString1="", lpString2="SGRES.DLL") returned -1 [0060.178] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned="SETLANG_K_COL.HXK" [0060.178] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.178] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.178] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.178] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.178] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="SGRES.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL" [0060.178] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ba4cc00, ftCreationTime.dwHighDateTime=0x1cab7e0, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6ba4cc00, ftLastWriteTime.dwHighDateTime=0x1cab7e0, nFileSizeHigh=0x0, nFileSizeLow=0x2d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SGRES.DLL.IDX_DLL", cAlternateFileName="SGRESD~1.IDX")) returned 1 [0060.178] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.178] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SGRES.DLL.IDX_DLL") returned -1 [0060.178] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SGRES.DLL.IDX_DLL") returned -1 [0060.178] lstrcmpiA (lpString1="", lpString2="SGRES.DLL.IDX_DLL") returned -1 [0060.178] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned="SGRES.DLL" [0060.178] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.178] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.178] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.178] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.178] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="SGRES.DLL.IDX_DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL" [0060.178] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xa570, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHAPNUM.VSL", cAlternateFileName="")) returned 1 [0060.179] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.179] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SHAPNUM.VSL") returned -1 [0060.179] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SHAPNUM.VSL") returned -1 [0060.179] lstrcmpiA (lpString1="", lpString2="SHAPNUM.VSL") returned -1 [0060.179] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned="SGRES.DLL.IDX_DLL" [0060.179] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.179] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.179] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.179] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.179] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="SHAPNUM.VSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" [0060.179] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50deda80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.CSS", cAlternateFileName="")) returned 1 [0060.179] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.179] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SKY.CSS") returned -1 [0060.179] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SKY.CSS") returned -1 [0060.179] lstrcmpiA (lpString1="", lpString2="SKY.CSS") returned -1 [0060.179] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned="SHAPNUM.VSL" [0060.180] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.180] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.180] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.180] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.180] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="SKY.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS" [0060.180] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c961300, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7c961300, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x2380, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLINTL.DLL", cAlternateFileName="")) returned 1 [0060.180] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.180] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SLINTL.DLL") returned -1 [0060.180] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SLINTL.DLL") returned -1 [0060.180] lstrcmpiA (lpString1="", lpString2="SLINTL.DLL") returned -1 [0060.180] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS") returned="SKY.CSS" [0060.180] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.180] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.180] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.180] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.180] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="SLINTL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL" [0060.180] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50deda80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="SMIGRATE.VSL", cAlternateFileName="")) returned 1 [0060.180] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.180] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SMIGRATE.VSL") returned -1 [0060.181] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SMIGRATE.VSL") returned -1 [0060.181] lstrcmpiA (lpString1="", lpString2="SMIGRATE.VSL") returned -1 [0060.181] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned="SLINTL.DLL" [0060.181] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.181] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.181] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.181] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.181] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="SMIGRATE.VSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL" [0060.181] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67868700, ftCreationTime.dwHighDateTime=0x1cacbb1, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67868700, ftLastWriteTime.dwHighDateTime=0x1cacbb1, nFileSizeHigh=0x0, nFileSizeLow=0x4e5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOCIALCONNECTORRES.DLL", cAlternateFileName="SOCIAL~1.DLL")) returned 1 [0060.205] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.205] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SOCIALCONNECTORRES.DLL") returned -1 [0060.205] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SOCIALCONNECTORRES.DLL") returned -1 [0060.205] lstrcmpiA (lpString1="", lpString2="SOCIALCONNECTORRES.DLL") returned -1 [0060.205] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned="SMIGRATE.VSL" [0060.205] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.206] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.206] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.206] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.206] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="SOCIALCONNECTORRES.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL" [0060.206] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffe2700, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50deda80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xffe2700, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x644, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPACE.VRD", cAlternateFileName="")) returned 1 [0060.206] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.206] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SPACE.VRD") returned -1 [0060.206] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SPACE.VRD") returned -1 [0060.206] lstrcmpiA (lpString1="", lpString2="SPACE.VRD") returned -1 [0060.206] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned="SOCIALCONNECTORRES.DLL" [0060.206] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.206] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.206] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.206] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.206] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="SPACE.VRD" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD" [0060.206] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e13be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING.CSS", cAlternateFileName="")) returned 1 [0060.207] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.207] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SPRING.CSS") returned -1 [0060.207] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SPRING.CSS") returned -1 [0060.207] lstrcmpiA (lpString1="", lpString2="SPRING.CSS") returned -1 [0060.207] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned="SPACE.VRD" [0060.207] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.207] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.207] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.207] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.207] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="SPRING.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS" [0060.207] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e13be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPS.CSS", cAlternateFileName="")) returned 1 [0060.207] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.207] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SPS.CSS") returned -1 [0060.207] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SPS.CSS") returned -1 [0060.207] lstrcmpiA (lpString1="", lpString2="SPS.CSS") returned -1 [0060.207] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS") returned="SPRING.CSS" [0060.207] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.207] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.207] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.207] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.207] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="SPS.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS" [0060.208] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e5fea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="STEEL.CSS", cAlternateFileName="")) returned 1 [0060.208] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.208] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="STEEL.CSS") returned -1 [0060.208] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="STEEL.CSS") returned -1 [0060.208] lstrcmpiA (lpString1="", lpString2="STEEL.CSS") returned -1 [0060.208] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS") returned="SPS.CSS" [0060.208] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.208] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.208] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.208] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.208] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="STEEL.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS" [0060.208] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33021f00, ftCreationTime.dwHighDateTime=0x1ca6570, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x33021f00, ftLastWriteTime.dwHighDateTime=0x1ca6570, nFileSizeHigh=0x0, nFileSizeLow=0x69d1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="STSLIST.CHM", cAlternateFileName="")) returned 1 [0060.208] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.208] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="STSLIST.CHM") returned -1 [0060.208] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="STSLIST.CHM") returned -1 [0060.208] lstrcmpiA (lpString1="", lpString2="STSLIST.CHM") returned -1 [0060.208] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS") returned="STEEL.CSS" [0060.208] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.208] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.208] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.208] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.209] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="STSLIST.CHM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM" [0060.209] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6069a300, ftCreationTime.dwHighDateTime=0x1cab8a9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6069a300, ftLastWriteTime.dwHighDateTime=0x1cab8a9, nFileSizeHigh=0x0, nFileSizeLow=0x15990, dwReserved0=0x0, dwReserved1=0x0, cFileName="STSLISTI.DLL", cAlternateFileName="")) returned 1 [0060.209] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.209] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="STSLISTI.DLL") returned -1 [0060.209] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="STSLISTI.DLL") returned -1 [0060.209] lstrcmpiA (lpString1="", lpString2="STSLISTI.DLL") returned -1 [0060.209] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM") returned="STSLIST.CHM" [0060.209] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.209] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.209] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.209] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.209] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="STSLISTI.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL" [0060.209] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e5fea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUNNY.CSS", cAlternateFileName="")) returned 1 [0060.209] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.209] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SUNNY.CSS") returned -1 [0060.209] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SUNNY.CSS") returned -1 [0060.209] lstrcmpiA (lpString1="", lpString2="SUNNY.CSS") returned -1 [0060.209] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned="STSLISTI.DLL" [0060.209] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.209] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.210] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.210] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.210] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="SUNNY.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS" [0060.210] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e5fea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUNSET.CSS", cAlternateFileName="")) returned 1 [0060.210] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.210] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SUNSET.CSS") returned -1 [0060.210] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SUNSET.CSS") returned -1 [0060.210] lstrcmpiA (lpString1="", lpString2="SUNSET.CSS") returned -1 [0060.210] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS") returned="SUNNY.CSS" [0060.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.210] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.210] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.210] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.210] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="SUNSET.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS" [0060.210] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e5fea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TERRCOTT.CSS", cAlternateFileName="")) returned 1 [0060.210] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.211] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TERRCOTT.CSS") returned -1 [0060.211] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TERRCOTT.CSS") returned -1 [0060.211] lstrcmpiA (lpString1="", lpString2="TERRCOTT.CSS") returned -1 [0060.211] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS") returned="SUNSET.CSS" [0060.211] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.211] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.211] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.211] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.211] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="TERRCOTT.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS" [0060.211] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50e86000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x44b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIMESOLN.VSL", cAlternateFileName="")) returned 1 [0060.211] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.211] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TIMESOLN.VSL") returned -1 [0060.211] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TIMESOLN.VSL") returned -1 [0060.211] lstrcmpiA (lpString1="", lpString2="TIMESOLN.VSL") returned -1 [0060.211] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS") returned="TERRCOTT.CSS" [0060.211] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.211] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.211] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.212] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.212] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="TIMESOLN.VSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" [0060.212] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad844100, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50ed22c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xad844100, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x5fd88, dwReserved0=0x0, dwReserved1=0x0, cFileName="UML.VSL", cAlternateFileName="")) returned 1 [0060.212] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.212] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UML.VSL") returned -1 [0060.212] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UML.VSL") returned -1 [0060.212] lstrcmpiA (lpString1="", lpString2="UML.VSL") returned -1 [0060.212] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned="TIMESOLN.VSL" [0060.212] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.212] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.212] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.212] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.212] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="UML.VSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" [0060.212] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f896e00, ftCreationTime.dwHighDateTime=0x1cab8a9, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f896e00, ftLastWriteTime.dwHighDateTime=0x1cab8a9, nFileSizeHigh=0x0, nFileSizeLow=0xef80, dwReserved0=0x0, dwReserved1=0x0, cFileName="UmOutlookStrings.dll", cAlternateFileName="UMOUTL~1.DLL")) returned 1 [0060.212] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.212] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UmOutlookStrings.dll") returned -1 [0060.212] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UmOutlookStrings.dll") returned -1 [0060.212] lstrcmpiA (lpString1="", lpString2="UmOutlookStrings.dll") returned -1 [0060.212] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned="UML.VSL" [0060.212] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.213] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.213] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.213] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.213] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="UmOutlookStrings.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll" [0060.213] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x960df00, ftCreationTime.dwHighDateTime=0x1c56bc5, ftLastAccessTime.dwLowDateTime=0x50f446e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x960df00, ftLastWriteTime.dwHighDateTime=0x1c56bc5, nFileSizeHigh=0x0, nFileSizeLow=0x74c, dwReserved0=0x0, dwReserved1=0x0, cFileName="VALVE.VRD", cAlternateFileName="")) returned 1 [0060.213] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.213] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VALVE.VRD") returned -1 [0060.213] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VALVE.VRD") returned -1 [0060.213] lstrcmpiA (lpString1="", lpString2="VALVE.VRD") returned -1 [0060.213] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned="UmOutlookStrings.dll" [0060.213] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.213] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.213] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.213] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.213] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VALVE.VRD" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD" [0060.213] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ceb0900, ftCreationTime.dwHighDateTime=0x1cab7d1, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4ceb0900, ftLastWriteTime.dwHighDateTime=0x1cab7d1, nFileSizeHigh=0x0, nFileSizeLow=0x9190, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISBRRES.DLL", cAlternateFileName="")) returned 1 [0060.213] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.213] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISBRRES.DLL") returned -1 [0060.213] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISBRRES.DLL") returned -1 [0060.213] lstrcmpiA (lpString1="", lpString2="VISBRRES.DLL") returned -1 [0060.214] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned="VALVE.VRD" [0060.214] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.214] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.214] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.214] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.214] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISBRRES.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL" [0060.214] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b68e400, ftCreationTime.dwHighDateTime=0x1cab7d1, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7b68e400, ftLastWriteTime.dwHighDateTime=0x1cab7d1, nFileSizeHigh=0x0, nFileSizeLow=0x4b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISBRRES.DLL.IDX_DLL", cAlternateFileName="VISBRR~1.IDX")) returned 1 [0060.214] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.214] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISBRRES.DLL.IDX_DLL") returned -1 [0060.214] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISBRRES.DLL.IDX_DLL") returned -1 [0060.214] lstrcmpiA (lpString1="", lpString2="VISBRRES.DLL.IDX_DLL") returned -1 [0060.214] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned="VISBRRES.DLL" [0060.214] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.214] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.214] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.214] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.214] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISBRRES.DLL.IDX_DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL" [0060.214] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xa980, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISCOLOR.VSL", cAlternateFileName="")) returned 1 [0060.214] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.214] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISCOLOR.VSL") returned -1 [0060.215] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISCOLOR.VSL") returned -1 [0060.215] lstrcmpiA (lpString1="", lpString2="VISCOLOR.VSL") returned -1 [0060.215] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned="VISBRRES.DLL.IDX_DLL" [0060.215] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.215] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.215] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.215] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.215] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISCOLOR.VSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL" [0060.215] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d766e00, ftCreationTime.dwHighDateTime=0x1cac1e7, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7d766e00, ftLastWriteTime.dwHighDateTime=0x1cac1e7, nFileSizeHigh=0x0, nFileSizeLow=0xb9378, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISINTL.DLL", cAlternateFileName="")) returned 1 [0060.215] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.215] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISINTL.DLL") returned -1 [0060.215] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISINTL.DLL") returned -1 [0060.215] lstrcmpiA (lpString1="", lpString2="VISINTL.DLL") returned -1 [0060.215] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned="VISCOLOR.VSL" [0060.215] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.215] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.215] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.215] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.215] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISINTL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL" [0060.216] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bb60400, ftCreationTime.dwHighDateTime=0x1cac1e7, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1bb60400, ftLastWriteTime.dwHighDateTime=0x1cac1e7, nFileSizeHigh=0x0, nFileSizeLow=0x3a980, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISINTL.DLL.IDX_DLL", cAlternateFileName="VISINT~1.IDX")) returned 1 [0060.216] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.216] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISINTL.DLL.IDX_DLL") returned -1 [0060.216] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISINTL.DLL.IDX_DLL") returned -1 [0060.216] lstrcmpiA (lpString1="", lpString2="VISINTL.DLL.IDX_DLL") returned -1 [0060.216] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned="VISINTL.DLL" [0060.216] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.216] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.216] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.216] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.216] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISINTL.DLL.IDX_DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL" [0060.216] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.CSS", cAlternateFileName="")) returned 1 [0060.216] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.216] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISIO.CSS") returned -1 [0060.216] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISIO.CSS") returned -1 [0060.216] lstrcmpiA (lpString1="", lpString2="VISIO.CSS") returned -1 [0060.216] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned="VISINTL.DLL.IDX_DLL" [0060.216] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.216] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.216] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.217] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.217] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISIO.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS" [0060.217] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94d40e00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x50fdcc60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x94d40e00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x588a20, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.DEV.HXS", cAlternateFileName="VISIOD~1.HXS")) returned 1 [0060.217] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.217] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISIO.DEV.HXS") returned -1 [0060.217] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISIO.DEV.HXS") returned -1 [0060.217] lstrcmpiA (lpString1="", lpString2="VISIO.DEV.HXS") returned -1 [0060.217] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS") returned="VISIO.CSS" [0060.217] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.217] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.217] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.217] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.217] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISIO.DEV.HXS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS" [0060.217] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x50fdcc60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.DEV_COL.HXC", cAlternateFileName="VISIOD~1.HXC")) returned 1 [0060.217] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.217] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISIO.DEV_COL.HXC") returned -1 [0060.217] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISIO.DEV_COL.HXC") returned -1 [0060.217] lstrcmpiA (lpString1="", lpString2="VISIO.DEV_COL.HXC") returned -1 [0060.217] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned="VISIO.DEV.HXS" [0060.217] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.218] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.218] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.218] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.218] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISIO.DEV_COL.HXC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC" [0060.218] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62cf1400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x50fdcc60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x62cf1400, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.DEV_COL.HXT", cAlternateFileName="VISIOD~1.HXT")) returned 1 [0060.218] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.218] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISIO.DEV_COL.HXT") returned -1 [0060.218] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISIO.DEV_COL.HXT") returned -1 [0060.218] lstrcmpiA (lpString1="", lpString2="VISIO.DEV_COL.HXT") returned -1 [0060.218] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned="VISIO.DEV_COL.HXC" [0060.218] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.218] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.218] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.218] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.218] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISIO.DEV_COL.HXT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT" [0060.218] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62cf1400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x50fdcc60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x62cf1400, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.DEV_F_COL.HXK", cAlternateFileName="VISIOD~1.HXK")) returned 1 [0060.218] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.218] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISIO.DEV_F_COL.HXK") returned -1 [0060.219] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISIO.DEV_F_COL.HXK") returned -1 [0060.219] lstrcmpiA (lpString1="", lpString2="VISIO.DEV_F_COL.HXK") returned -1 [0060.219] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned="VISIO.DEV_COL.HXT" [0060.219] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.219] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.219] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISIO.DEV_F_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" [0060.219] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62cf1400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x50fdcc60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x62cf1400, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.DEV_K_COL.HXK", cAlternateFileName="VISIOD~2.HXK")) returned 1 [0060.219] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.219] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISIO.DEV_K_COL.HXK") returned -1 [0060.219] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISIO.DEV_K_COL.HXK") returned -1 [0060.219] lstrcmpiA (lpString1="", lpString2="VISIO.DEV_K_COL.HXK") returned -1 [0060.219] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned="VISIO.DEV_F_COL.HXK" [0060.219] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.219] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.219] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.220] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISIO.DEV_K_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" [0060.220] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96053b00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x51002dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x96053b00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x2b532a, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.HXS", cAlternateFileName="")) returned 1 [0060.220] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.220] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISIO.HXS") returned -1 [0060.220] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISIO.HXS") returned -1 [0060.220] lstrcmpiA (lpString1="", lpString2="VISIO.HXS") returned -1 [0060.220] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned="VISIO.DEV_K_COL.HXK" [0060.220] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.220] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.220] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.220] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.220] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISIO.HXS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS" [0060.220] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e34500, ftCreationTime.dwHighDateTime=0x1ca90f4, ftLastAccessTime.dwLowDateTime=0x51002dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4e34500, ftLastWriteTime.dwHighDateTime=0x1ca90f4, nFileSizeHigh=0x0, nFileSizeLow=0xd6cc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.SHAPESHEET.HXS", cAlternateFileName="VISIOS~1.HXS")) returned 1 [0060.220] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.220] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISIO.SHAPESHEET.HXS") returned -1 [0060.220] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISIO.SHAPESHEET.HXS") returned -1 [0060.220] lstrcmpiA (lpString1="", lpString2="VISIO.SHAPESHEET.HXS") returned -1 [0060.220] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned="VISIO.HXS" [0060.220] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.220] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.220] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.220] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.221] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISIO.SHAPESHEET.HXS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS" [0060.221] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x51028f20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x2a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.SHAPESHEET_COL.HXC", cAlternateFileName="VISIOS~1.HXC")) returned 1 [0060.221] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.221] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISIO.SHAPESHEET_COL.HXC") returned -1 [0060.221] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISIO.SHAPESHEET_COL.HXC") returned -1 [0060.221] lstrcmpiA (lpString1="", lpString2="VISIO.SHAPESHEET_COL.HXC") returned -1 [0060.221] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned="VISIO.SHAPESHEET.HXS" [0060.221] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.221] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.221] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.221] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.221] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISIO.SHAPESHEET_COL.HXC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC" [0060.221] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa53f300, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x51028f20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xaa53f300, ftLastWriteTime.dwHighDateTime=0x1c5aeb1, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.SHAPESHEET_COL.HXT", cAlternateFileName="VISIOS~1.HXT")) returned 1 [0060.221] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.221] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISIO.SHAPESHEET_COL.HXT") returned -1 [0060.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISIO.SHAPESHEET_COL.HXT") returned -1 [0060.222] lstrcmpiA (lpString1="", lpString2="VISIO.SHAPESHEET_COL.HXT") returned -1 [0060.222] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned="VISIO.SHAPESHEET_COL.HXC" [0060.222] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.222] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.222] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.222] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.222] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISIO.SHAPESHEET_COL.HXT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" [0060.222] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa53f300, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x51ca82a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xaa53f300, ftLastWriteTime.dwHighDateTime=0x1c5aeb1, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.SHAPESHEET_F_COL.HXK", cAlternateFileName="VISIOS~1.HXK")) returned 1 [0060.222] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.222] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISIO.SHAPESHEET_F_COL.HXK") returned -1 [0060.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISIO.SHAPESHEET_F_COL.HXK") returned -1 [0060.222] lstrcmpiA (lpString1="", lpString2="VISIO.SHAPESHEET_F_COL.HXK") returned -1 [0060.222] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned="VISIO.SHAPESHEET_COL.HXT" [0060.222] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.222] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.222] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.222] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.222] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISIO.SHAPESHEET_F_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" [0060.223] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa53f300, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xaa53f300, ftLastWriteTime.dwHighDateTime=0x1c5aeb1, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.SHAPESHEET_K_COL.HXK", cAlternateFileName="VISIOS~2.HXK")) returned 1 [0060.223] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.223] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISIO.SHAPESHEET_K_COL.HXK") returned -1 [0060.223] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISIO.SHAPESHEET_K_COL.HXK") returned -1 [0060.223] lstrcmpiA (lpString1="", lpString2="VISIO.SHAPESHEET_K_COL.HXK") returned -1 [0060.223] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned="VISIO.SHAPESHEET_F_COL.HXK" [0060.223] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.223] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.223] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.223] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.223] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISIO.SHAPESHEET_K_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" [0060.223] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_COL.HXC", cAlternateFileName="VISIO_~1.HXC")) returned 1 [0060.223] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.223] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISIO_COL.HXC") returned -1 [0060.223] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISIO_COL.HXC") returned -1 [0060.223] lstrcmpiA (lpString1="", lpString2="VISIO_COL.HXC") returned -1 [0060.223] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned="VISIO.SHAPESHEET_K_COL.HXK" [0060.223] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.223] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.223] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.223] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.224] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISIO_COL.HXC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" [0060.224] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f3b8d00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f3b8d00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_COL.HXT", cAlternateFileName="VISIO_~1.HXT")) returned 1 [0060.229] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.229] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISIO_COL.HXT") returned -1 [0060.229] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISIO_COL.HXT") returned -1 [0060.229] lstrcmpiA (lpString1="", lpString2="VISIO_COL.HXT") returned -1 [0060.229] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned="VISIO_COL.HXC" [0060.229] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.229] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.229] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.229] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.229] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISIO_COL.HXT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" [0060.229] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f3b8d00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f3b8d00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_F_COL.HXK", cAlternateFileName="VISIO_~1.HXK")) returned 1 [0060.229] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.229] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISIO_F_COL.HXK") returned -1 [0060.229] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISIO_F_COL.HXK") returned -1 [0060.229] lstrcmpiA (lpString1="", lpString2="VISIO_F_COL.HXK") returned -1 [0060.229] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned="VISIO_COL.HXT" [0060.229] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.229] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.229] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.229] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.230] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISIO_F_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK" [0060.230] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f3b8d00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f3b8d00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_K_COL.HXK", cAlternateFileName="VISIO_~2.HXK")) returned 1 [0060.230] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.230] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISIO_K_COL.HXK") returned -1 [0060.230] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISIO_K_COL.HXK") returned -1 [0060.230] lstrcmpiA (lpString1="", lpString2="VISIO_K_COL.HXK") returned -1 [0060.230] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned="VISIO_F_COL.HXK" [0060.230] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.230] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.230] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.230] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.230] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISIO_K_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" [0060.230] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe62b3700, ftCreationTime.dwHighDateTime=0x1ca5009, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe62b3700, ftLastWriteTime.dwHighDateTime=0x1ca5009, nFileSizeHigh=0x0, nFileSizeLow=0x22e780, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_PRM.HXS", cAlternateFileName="VISIO_~1.HXS")) returned 1 [0060.230] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.230] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISIO_PRM.HXS") returned -1 [0060.230] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISIO_PRM.HXS") returned -1 [0060.230] lstrcmpiA (lpString1="", lpString2="VISIO_PRM.HXS") returned -1 [0060.230] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned="VISIO_K_COL.HXK" [0060.230] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.230] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.230] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.231] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.231] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISIO_PRM.HXS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS" [0060.231] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65709000, ftCreationTime.dwHighDateTime=0x1ca53a7, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x65709000, ftLastWriteTime.dwHighDateTime=0x1ca53a7, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_PRM_COL.HXC", cAlternateFileName="VISIO_~2.HXC")) returned 1 [0060.231] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.231] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISIO_PRM_COL.HXC") returned -1 [0060.231] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISIO_PRM_COL.HXC") returned -1 [0060.231] lstrcmpiA (lpString1="", lpString2="VISIO_PRM_COL.HXC") returned -1 [0060.231] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned="VISIO_PRM.HXS" [0060.231] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.231] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.231] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.231] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.231] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISIO_PRM_COL.HXC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC" [0060.231] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5be72800, ftCreationTime.dwHighDateTime=0x1ca53a7, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5be72800, ftLastWriteTime.dwHighDateTime=0x1ca53a7, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_PRM_COL.HXT", cAlternateFileName="VISIO_~2.HXT")) returned 1 [0060.231] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.231] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISIO_PRM_COL.HXT") returned -1 [0060.231] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISIO_PRM_COL.HXT") returned -1 [0060.231] lstrcmpiA (lpString1="", lpString2="VISIO_PRM_COL.HXT") returned -1 [0060.231] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned="VISIO_PRM_COL.HXC" [0060.231] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.232] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.232] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISIO_PRM_COL.HXT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" [0060.232] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa724d200, ftCreationTime.dwHighDateTime=0x1ca5059, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa724d200, ftLastWriteTime.dwHighDateTime=0x1ca5059, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_PRM_F_COL.HXK", cAlternateFileName="VISIO_~3.HXK")) returned 1 [0060.232] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.232] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISIO_PRM_F_COL.HXK") returned -1 [0060.232] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISIO_PRM_F_COL.HXK") returned -1 [0060.232] lstrcmpiA (lpString1="", lpString2="VISIO_PRM_F_COL.HXK") returned -1 [0060.232] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned="VISIO_PRM_COL.HXT" [0060.232] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.232] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.232] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISIO_PRM_F_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" [0060.232] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa724d200, ftCreationTime.dwHighDateTime=0x1ca5059, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa724d200, ftLastWriteTime.dwHighDateTime=0x1ca5059, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_PRM_K_COL.HXK", cAlternateFileName="VISIO_~4.HXK")) returned 1 [0060.232] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.232] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISIO_PRM_K_COL.HXK") returned -1 [0060.232] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISIO_PRM_K_COL.HXK") returned -1 [0060.232] lstrcmpiA (lpString1="", lpString2="VISIO_PRM_K_COL.HXK") returned -1 [0060.232] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned="VISIO_PRM_F_COL.HXK" [0060.233] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.233] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.233] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.233] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.233] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISIO_PRM_K_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" [0060.233] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94d40e00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x94d40e00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x26745e, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_STD.HXS", cAlternateFileName="VISIO_~2.HXS")) returned 1 [0060.233] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.233] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISIO_STD.HXS") returned -1 [0060.233] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISIO_STD.HXS") returned -1 [0060.233] lstrcmpiA (lpString1="", lpString2="VISIO_STD.HXS") returned -1 [0060.233] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned="VISIO_PRM_K_COL.HXK" [0060.233] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.233] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.233] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.233] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.233] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISIO_STD.HXS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS" [0060.233] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_STD_COL.HXC", cAlternateFileName="VISIO_~3.HXC")) returned 1 [0060.233] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.233] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISIO_STD_COL.HXC") returned -1 [0060.233] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISIO_STD_COL.HXC") returned -1 [0060.233] lstrcmpiA (lpString1="", lpString2="VISIO_STD_COL.HXC") returned -1 [0060.233] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned="VISIO_STD.HXS" [0060.234] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.234] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.234] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.234] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.234] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISIO_STD_COL.HXC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC" [0060.234] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb770e200, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb770e200, ftLastWriteTime.dwHighDateTime=0x1c5aeb1, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_STD_COL.HXT", cAlternateFileName="VISIO_~3.HXT")) returned 1 [0060.234] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.234] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISIO_STD_COL.HXT") returned -1 [0060.234] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISIO_STD_COL.HXT") returned -1 [0060.234] lstrcmpiA (lpString1="", lpString2="VISIO_STD_COL.HXT") returned -1 [0060.234] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned="VISIO_STD_COL.HXC" [0060.234] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.234] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.234] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.234] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.234] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISIO_STD_COL.HXT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" [0060.234] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb770e200, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb770e200, ftLastWriteTime.dwHighDateTime=0x1c5aeb1, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_STD_F_COL.HXK", cAlternateFileName="VIB8A9~1.HXK")) returned 1 [0060.234] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.234] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISIO_STD_F_COL.HXK") returned -1 [0060.235] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISIO_STD_F_COL.HXK") returned -1 [0060.235] lstrcmpiA (lpString1="", lpString2="VISIO_STD_F_COL.HXK") returned -1 [0060.235] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned="VISIO_STD_COL.HXT" [0060.235] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.235] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.235] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.235] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.235] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISIO_STD_F_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" [0060.235] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb770e200, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb770e200, ftLastWriteTime.dwHighDateTime=0x1c5aeb1, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_STD_K_COL.HXK", cAlternateFileName="VI5545~1.HXK")) returned 1 [0060.235] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.235] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISIO_STD_K_COL.HXK") returned -1 [0060.235] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISIO_STD_K_COL.HXK") returned -1 [0060.235] lstrcmpiA (lpString1="", lpString2="VISIO_STD_K_COL.HXK") returned -1 [0060.235] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned="VISIO_STD_F_COL.HXK" [0060.235] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.235] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.235] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.235] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.235] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISIO_STD_K_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" [0060.235] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xc570, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISUTILS.VSL", cAlternateFileName="")) returned 1 [0060.236] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.236] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISUTILS.VSL") returned -1 [0060.236] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISUTILS.VSL") returned -1 [0060.236] lstrcmpiA (lpString1="", lpString2="VISUTILS.VSL") returned -1 [0060.236] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned="VISIO_STD_K_COL.HXK" [0060.236] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.236] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.236] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.236] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.236] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISUTILS.VSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" [0060.236] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad844100, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x52086660, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xad844100, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x10b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISWEB.VSL", cAlternateFileName="")) returned 1 [0060.236] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.236] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VISWEB.VSL") returned -1 [0060.236] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VISWEB.VSL") returned -1 [0060.236] lstrcmpiA (lpString1="", lpString2="VISWEB.VSL") returned -1 [0060.236] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned="VISUTILS.VSL" [0060.236] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.236] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.236] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.236] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.236] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VISWEB.VSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" [0060.237] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50f6a840, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vsdir", cAlternateFileName="")) returned 1 [0060.237] lstrcmpA (lpString1=".", lpString2="Vsdir") returned -1 [0060.237] lstrcmpA (lpString1="..", lpString2="Vsdir") returned -1 [0060.237] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned="VISWEB.VSL" [0060.237] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="Vsdir" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir" [0060.237] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50f6a840, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d8138, cFileName=".", cAlternateFileName="")) returned 0x2d7ff8 [0060.237] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.237] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50f6a840, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0060.238] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.238] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.238] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58b19600, ftCreationTime.dwHighDateTime=0x1c304b9, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x58b19600, ftLastWriteTime.dwHighDateTime=0x1c304b9, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Visfilem.vsdir", cAlternateFileName="VISFIL~1.VSD")) returned 1 [0060.238] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.238] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Visfilem.vsdir") returned -1 [0060.238] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Visfilem.vsdir") returned -1 [0060.238] lstrcmpiA (lpString1="", lpString2="Visfilem.vsdir") returned -1 [0060.238] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\*.*") returned="*.*" [0060.238] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\" [0060.238] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\") returned="" [0060.238] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\HOW TO DECRYPT FILES.txt" [0060.238] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\how to decrypt files.txt")) returned 0xffffffff [0060.238] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.243] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.243] CloseHandle (hObject=0x90) returned 1 [0060.243] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\", lpString2="Visfilem.vsdir" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" [0060.243] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58b19600, ftCreationTime.dwHighDateTime=0x1c304b9, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x58b19600, ftLastWriteTime.dwHighDateTime=0x1c304b9, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Visfilem.vsdir", cAlternateFileName="VISFIL~1.VSD")) returned 0 [0060.243] FindClose (in: hFindFile=0x2d7ff8 | out: hFindFile=0x2d7ff8) returned 1 [0060.243] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc800ef00, ftCreationTime.dwHighDateTime=0x1cab7d2, ftLastAccessTime.dwLowDateTime=0xef0ca650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc800ef00, ftLastWriteTime.dwHighDateTime=0x1cab7d2, nFileSizeHigh=0x0, nFileSizeLow=0xa3380, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="VVIEWRES.DLL", cAlternateFileName="")) returned 1 [0060.243] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.243] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VVIEWRES.DLL") returned -1 [0060.243] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VVIEWRES.DLL") returned -1 [0060.243] lstrcmpiA (lpString1="", lpString2="VVIEWRES.DLL") returned -1 [0060.243] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\*.*") returned="*.*" [0060.243] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.243] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.243] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.243] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.244] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="VVIEWRES.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL" [0060.244] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15f40800, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x520ac7c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x15f40800, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x794, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDALLLNK.VRD", cAlternateFileName="")) returned 1 [0060.244] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.244] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WDALLLNK.VRD") returned -1 [0060.244] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WDALLLNK.VRD") returned -1 [0060.244] lstrcmpiA (lpString1="", lpString2="WDALLLNK.VRD") returned -1 [0060.244] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned="VVIEWRES.DLL" [0060.244] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.244] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.244] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.244] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.244] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="WDALLLNK.VRD" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD" [0060.244] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd43d9b00, ftCreationTime.dwHighDateTime=0x1c2a020, ftLastAccessTime.dwLowDateTime=0x520ac7c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd43d9b00, ftLastWriteTime.dwHighDateTime=0x1c2a020, nFileSizeHigh=0x0, nFileSizeLow=0x579, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDCMPVRD.XML", cAlternateFileName="")) returned 1 [0060.244] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.244] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned="WDALLLNK.VRD" [0060.244] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.244] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.244] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.245] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.245] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="WDCMPVRD.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML" [0060.245] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15f40800, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x520ac7c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x15f40800, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x722, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDERRLNK.VRD", cAlternateFileName="")) returned 1 [0060.245] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.245] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML") returned="WDCMPVRD.XML" [0060.245] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.245] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.245] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.245] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.245] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="WDERRLNK.VRD" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" [0060.245] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900f5a00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xaf5c3fc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x900f5a00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x4b425a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ.DEV.HXS", cAlternateFileName="WINPRO~1.HXS")) returned 1 [0060.245] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.245] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned="WDERRLNK.VRD" [0060.245] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.245] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.245] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.245] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.245] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="WINPROJ.DEV.HXS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS" [0060.246] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xaf5c3fc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ.DEV_COL.HXC", cAlternateFileName="WINPRO~1.HXC")) returned 1 [0060.246] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.246] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned="WINPROJ.DEV.HXS" [0060.246] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.246] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.246] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.246] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.246] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="WINPROJ.DEV_COL.HXC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC" [0060.246] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711d3000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5c3fc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x711d3000, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ.DEV_COL.HXT", cAlternateFileName="WINPRO~1.HXT")) returned 1 [0060.246] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.246] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned="WINPROJ.DEV_COL.HXC" [0060.246] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.246] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.246] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.246] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.246] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="WINPROJ.DEV_COL.HXT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" [0060.246] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711d3000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5c3fc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x711d3000, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ.DEV_F_COL.HXK", cAlternateFileName="WINPRO~1.HXK")) returned 1 [0060.246] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.246] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned="WINPROJ.DEV_COL.HXT" [0060.246] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.247] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.247] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.247] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.247] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="WINPROJ.DEV_F_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" [0060.247] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711d3000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5c3fc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x711d3000, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ.DEV_K_COL.HXK", cAlternateFileName="WINPRO~2.HXK")) returned 1 [0060.247] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.247] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned="WINPROJ.DEV_F_COL.HXK" [0060.247] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.247] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.247] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.247] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.247] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="WINPROJ.DEV_K_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" [0060.247] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91408700, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xaf5ea120, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x91408700, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x168406, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ.HXS", cAlternateFileName="")) returned 1 [0060.247] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.247] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned="WINPROJ.DEV_K_COL.HXK" [0060.247] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.247] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.247] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.247] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.248] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="WINPROJ.HXS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS" [0060.248] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xaf5ea120, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ_COL.HXC", cAlternateFileName="WINPRO~2.HXC")) returned 1 [0060.248] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.248] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned="WINPROJ.HXS" [0060.248] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.248] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.248] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.248] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.248] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="WINPROJ_COL.HXC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" [0060.248] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d89a900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5ea120, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6d89a900, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ_COL.HXT", cAlternateFileName="WINPRO~2.HXT")) returned 1 [0060.248] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.248] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned="WINPROJ_COL.HXC" [0060.248] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.248] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.248] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.248] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.248] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="WINPROJ_COL.HXT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" [0060.248] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d89a900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5ea120, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6d89a900, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ_F_COL.HXK", cAlternateFileName="WINPRO~3.HXK")) returned 1 [0060.248] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.249] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned="WINPROJ_COL.HXT" [0060.249] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.249] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.249] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.249] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.249] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="WINPROJ_F_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" [0060.249] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d89a900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5ea120, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6d89a900, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ_K_COL.HXK", cAlternateFileName="WINPRO~4.HXK")) returned 1 [0060.249] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.249] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned="WINPROJ_F_COL.HXK" [0060.249] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.249] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.249] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.249] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.249] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="WINPROJ_K_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" [0060.249] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17253500, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x521b7160, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x17253500, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINSCHD.VRD", cAlternateFileName="")) returned 1 [0060.249] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.249] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned="WINPROJ_K_COL.HXK" [0060.249] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.249] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.249] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.250] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.250] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="WINSCHD.VRD" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" [0060.250] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97366800, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x1e5998f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97366800, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x718092, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD.DEV.HXS", cAlternateFileName="WINWOR~1.HXS")) returned 1 [0060.250] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.250] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned="WINSCHD.VRD" [0060.250] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.250] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.250] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.250] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.250] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="WINWORD.DEV.HXS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS" [0060.250] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1e5998f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD.DEV_COL.HXC", cAlternateFileName="WINWOR~1.HXC")) returned 1 [0060.261] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.261] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned="WINWORD.DEV.HXS" [0060.261] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.261] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.261] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.261] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.261] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="WINWORD.DEV_COL.HXC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC" [0060.261] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e3a1f00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5998f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e3a1f00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD.DEV_COL.HXT", cAlternateFileName="WINWOR~1.HXT")) returned 1 [0060.261] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.261] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned="WINWORD.DEV_COL.HXC" [0060.261] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.261] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.262] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.262] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.262] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="WINWORD.DEV_COL.HXT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" [0060.262] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e3a1f00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5998f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e3a1f00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD.DEV_F_COL.HXK", cAlternateFileName="WINWOR~1.HXK")) returned 1 [0060.262] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.262] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned="WINWORD.DEV_COL.HXT" [0060.262] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.262] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.262] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.262] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.262] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="WINWORD.DEV_F_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" [0060.262] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e3a1f00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5998f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e3a1f00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD.DEV_K_COL.HXK", cAlternateFileName="WINWOR~2.HXK")) returned 1 [0060.262] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.262] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned="WINWORD.DEV_F_COL.HXK" [0060.262] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.262] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.262] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.262] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.263] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="WINWORD.DEV_K_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" [0060.263] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe02ac500, ftCreationTime.dwHighDateTime=0x1ca9370, ftLastAccessTime.dwLowDateTime=0x1e5bfa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe02ac500, ftLastWriteTime.dwHighDateTime=0x1ca9370, nFileSizeHigh=0x0, nFileSizeLow=0x4ff5e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD.HXS", cAlternateFileName="")) returned 1 [0060.263] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.263] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned="WINWORD.DEV_K_COL.HXK" [0060.263] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.263] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.263] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.263] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.263] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="WINWORD.HXS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS" [0060.263] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1e5e5bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD_COL.HXC", cAlternateFileName="WINWOR~2.HXC")) returned 1 [0060.263] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.263] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned="WINWORD.HXS" [0060.263] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.263] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.263] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.263] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.263] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="WINWORD_COL.HXC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC" [0060.263] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79756b00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5e5bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79756b00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD_COL.HXT", cAlternateFileName="WINWOR~2.HXT")) returned 1 [0060.264] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.264] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned="WINWORD_COL.HXC" [0060.264] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.264] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.264] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.264] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.264] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="WINWORD_COL.HXT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" [0060.264] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79756b00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5e5bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79756b00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD_F_COL.HXK", cAlternateFileName="WINWOR~3.HXK")) returned 1 [0060.264] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.264] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned="WINWORD_COL.HXT" [0060.264] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.264] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.264] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.264] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.264] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="WINWORD_F_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" [0060.264] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79756b00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5e5bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79756b00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD_K_COL.HXK", cAlternateFileName="WINWOR~4.HXK")) returned 1 [0060.264] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.264] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned="WINWORD_F_COL.HXK" [0060.264] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.264] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.265] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.265] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.265] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="WINWORD_K_COL.HXK" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" [0060.265] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x521b7160, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xa560, dwReserved0=0x0, dwReserved1=0x0, cFileName="WORKFLOW.VSL", cAlternateFileName="")) returned 1 [0060.265] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.265] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned="WINWORD_K_COL.HXK" [0060.265] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.265] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.265] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.265] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.265] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="WORKFLOW.VSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" [0060.265] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7466000, ftCreationTime.dwHighDateTime=0x1caccde, ftLastAccessTime.dwLowDateTime=0x225ee90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7466000, ftLastWriteTime.dwHighDateTime=0x1caccde, nFileSizeHigh=0x0, nFileSizeLow=0xdc158, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.DLL", cAlternateFileName="")) returned 1 [0060.265] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.265] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned="WORKFLOW.VSL" [0060.265] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.265] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.265] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.265] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.265] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="WWINTL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL" [0060.266] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb8a5d00, ftCreationTime.dwHighDateTime=0x1caccde, ftLastAccessTime.dwLowDateTime=0x2212bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb8a5d00, ftLastWriteTime.dwHighDateTime=0x1caccde, nFileSizeHigh=0x0, nFileSizeLow=0x1a780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.DLL.IDX_DLL", cAlternateFileName="WWINTL~1.IDX")) returned 1 [0060.266] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.266] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned="WWINTL.DLL" [0060.266] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.266] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.266] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.266] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.266] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="WWINTL.DLL.IDX_DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL" [0060.266] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea593000, ftCreationTime.dwHighDateTime=0x1caccde, ftLastAccessTime.dwLowDateTime=0x2284ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea593000, ftLastWriteTime.dwHighDateTime=0x1caccde, nFileSizeHigh=0x0, nFileSizeLow=0x96180, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.REST.IDX_DLL", cAlternateFileName="WWINTL~2.IDX")) returned 1 [0060.266] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.266] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.266] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.266] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.266] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.266] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="WWINTL.REST.IDX_DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" [0060.266] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c57a100, ftCreationTime.dwHighDateTime=0x1cac466, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4c57a100, ftLastWriteTime.dwHighDateTime=0x1cac466, nFileSizeHigh=0x0, nFileSizeLow=0x4188, dwReserved0=0x0, dwReserved1=0x0, cFileName="wxpr.dll", cAlternateFileName="")) returned 1 [0060.266] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.266] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.267] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.267] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.267] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.267] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="wxpr.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll" [0060.267] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fff8a00, ftCreationTime.dwHighDateTime=0x1bdff9a, ftLastAccessTime.dwLowDateTime=0x1548bc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3fff8a00, ftLastWriteTime.dwHighDateTime=0x1bdff9a, nFileSizeHigh=0x0, nFileSizeLow=0x34d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="WZCNFLCT.CHM", cAlternateFileName="")) returned 1 [0060.267] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.267] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.267] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.267] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.267] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.267] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="WZCNFLCT.CHM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM" [0060.267] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xcd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="XFUNC.VSL", cAlternateFileName="")) returned 1 [0060.267] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.267] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.267] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.267] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.267] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.267] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="XFUNC.VSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" [0060.268] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618b1900, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x618b1900, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x3283, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xlate_Complete.xsn", cAlternateFileName="XLATE_~1.XSN")) returned 1 [0060.268] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.268] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.268] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="Xlate_Complete.xsn" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn" [0060.268] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc4600, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62bc4600, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xlate_Init.xsn", cAlternateFileName="XLATE_~2.XSN")) returned 1 [0060.268] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.268] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.268] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="Xlate_Init.xsn" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn" [0060.268] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dd9100, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0xf5ee1fd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x44dd9100, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0x240d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.DLL", cAlternateFileName="")) returned 1 [0060.268] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.268] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.269] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="XLINTL32.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL" [0060.269] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x427b3700, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0xf5ebbe70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x427b3700, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0x18380, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.DLL.IDX_DLL", cAlternateFileName="XLINTL~1.IDX")) returned 1 [0060.269] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.269] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.269] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.269] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="XLINTL32.DLL.IDX_DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL" [0060.269] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x414a0a00, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0xf5ee1fd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x414a0a00, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0x5db80, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.REST.IDX_DLL", cAlternateFileName="XLINTL~2.IDX")) returned 1 [0060.269] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.269] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.269] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.269] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="XLINTL32.REST.IDX_DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" [0060.270] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43ac6400, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0xf5ee1fd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x43ac6400, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0x9380, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLLEX.DLL", cAlternateFileName="")) returned 1 [0060.270] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.270] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.270] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.270] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="XLLEX.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL" [0060.270] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae096500, ftCreationTime.dwHighDateTime=0x1c30d4d, ftLastAccessTime.dwLowDateTime=0xfa6bd7f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xae096500, ftLastWriteTime.dwHighDateTime=0x1c30d4d, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLMACRO.CHM", cAlternateFileName="")) returned 1 [0060.270] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.270] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.270] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.270] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="XLMACRO.CHM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM" [0060.270] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa6e3950, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x2b580, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL", cAlternateFileName="")) returned 1 [0060.270] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.270] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.270] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.271] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="XLSLICER.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL" [0060.271] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc255d100, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa6e3950, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc255d100, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x3180, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.IDX_DLL", cAlternateFileName="XLSLIC~1.IDX")) returned 1 [0060.271] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.271] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.271] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="XLSLICER.DLL.IDX_DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL" [0060.271] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf94f400, ftCreationTime.dwHighDateTime=0x1c556ae, ftLastAccessTime.dwLowDateTime=0x112efdf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf94f400, ftLastWriteTime.dwHighDateTime=0x1c556ae, nFileSizeHigh=0x0, nFileSizeLow=0x349922, dwReserved0=0x0, dwReserved1=0x0, cFileName="XMLSDK5.CHM", cAlternateFileName="")) returned 1 [0060.271] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0060.271] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="" [0060.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" [0060.271] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\how to decrypt files.txt")) returned 0x20 [0060.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", lpString2="XMLSDK5.CHM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM" [0060.271] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf94f400, ftCreationTime.dwHighDateTime=0x1c556ae, ftLastAccessTime.dwLowDateTime=0x112efdf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf94f400, ftLastWriteTime.dwHighDateTime=0x1c556ae, nFileSizeHigh=0x0, nFileSizeLow=0x349922, dwReserved0=0x0, dwReserved1=0x0, cFileName="XMLSDK5.CHM", cAlternateFileName="")) returned 0 [0060.272] FindClose (in: hFindFile=0x2d8068 | out: hFindFile=0x2d8068) returned 1 [0060.272] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x779e270, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x779e270, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="1036", cAlternateFileName="")) returned 1 [0060.272] lstrcmpA (lpString1=".", lpString2="1036") returned -1 [0060.272] lstrcmpA (lpString1="..", lpString2="1036") returned -1 [0060.272] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="1036" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1036") returned="C:\\Program Files\\Microsoft Office\\Office14\\1036" [0060.272] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036") returned 47 [0060.272] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x779e270, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x779e270, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d8068 [0060.273] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.273] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x779e270, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x779e270, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.273] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.273] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.273] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b069000, ftCreationTime.dwHighDateTime=0x1c99227, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b069000, ftLastWriteTime.dwHighDateTime=0x1c99227, nFileSizeHigh=0x0, nFileSizeLow=0xaa26, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSO.ACL", cAlternateFileName="")) returned 1 [0060.273] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.274] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1036\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\1036\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1036\\" [0060.274] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1036\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\1036\\") returned="" [0060.277] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0060.277] WriteFile (in: hFile=0x8c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0060.279] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.279] CloseHandle (hObject=0x8c) returned 1 [0060.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.zip") returned 0 [0060.279] lstrlenA (lpString="*.zip") returned 5 [0060.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.rar") returned 0 [0060.280] lstrlenA (lpString="*.rar") returned 5 [0060.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.7z") returned 0 [0060.280] lstrlenA (lpString="*.7z") returned 4 [0060.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.tar") returned 0 [0060.280] lstrlenA (lpString="*.tar") returned 5 [0060.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.gzip") returned 0 [0060.280] lstrlenA (lpString="*.gzip") returned 6 [0060.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.jpg") returned 0 [0060.280] lstrlenA (lpString="*.jpg") returned 5 [0060.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.jpeg") returned 0 [0060.280] lstrlenA (lpString="*.jpeg") returned 6 [0060.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.psd") returned 0 [0060.280] lstrlenA (lpString="*.psd") returned 5 [0060.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.gif") returned 0 [0060.280] lstrlenA (lpString="*.gif") returned 5 [0060.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.doc") returned 0 [0060.280] lstrlenA (lpString="*.doc") returned 5 [0060.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.docx") returned 0 [0060.280] lstrlenA (lpString="*.docx") returned 6 [0060.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.xls") returned 0 [0060.280] lstrlenA (lpString="*.xls") returned 5 [0060.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.xlsx") returned 0 [0060.280] lstrlenA (lpString="*.xlsx") returned 6 [0060.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.ppt") returned 0 [0060.280] lstrlenA (lpString="*.ppt") returned 5 [0060.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.pptx") returned 0 [0060.280] lstrlenA (lpString="*.pptx") returned 6 [0060.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.pdf") returned 0 [0060.280] lstrlenA (lpString="*.pdf") returned 5 [0060.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.mov") returned 0 [0060.281] lstrlenA (lpString="*.mov") returned 5 [0060.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.m2v") returned 0 [0060.281] lstrlenA (lpString="*.m2v") returned 5 [0060.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.3gp") returned 0 [0060.281] lstrlenA (lpString="*.3gp") returned 5 [0060.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.mpeg") returned 0 [0060.281] lstrlenA (lpString="*.mpeg") returned 6 [0060.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.mpg") returned 0 [0060.281] lstrlenA (lpString="*.mpg") returned 5 [0060.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.flv") returned 0 [0060.281] lstrlenA (lpString="*.flv") returned 5 [0060.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.avi") returned 0 [0060.281] lstrlenA (lpString="*.avi") returned 5 [0060.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.mp4") returned 0 [0060.281] lstrlenA (lpString="*.mp4") returned 5 [0060.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.wmv") returned 0 [0060.281] lstrlenA (lpString="*.wmv") returned 5 [0060.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.divx") returned 0 [0060.281] lstrlenA (lpString="*.divx") returned 6 [0060.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.mkv") returned 0 [0060.281] lstrlenA (lpString="*.mkv") returned 5 [0060.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.mp3") returned 0 [0060.281] lstrlenA (lpString="*.mp3") returned 5 [0060.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.wav") returned 0 [0060.281] lstrlenA (lpString="*.wav") returned 5 [0060.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.flac") returned 0 [0060.281] lstrlenA (lpString="*.flac") returned 6 [0060.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.ape") returned 0 [0060.282] lstrlenA (lpString="*.ape") returned 5 [0060.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.wma") returned 0 [0060.282] lstrlenA (lpString="*.wma") returned 5 [0060.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.ac3") returned 0 [0060.282] lstrlenA (lpString="*.ac3") returned 5 [0060.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL", pszSpec="*.mxf") returned 0 [0060.282] lstrlenA (lpString="*.mxf") returned 5 [0060.282] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b069000, ftCreationTime.dwHighDateTime=0x1c99227, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b069000, ftLastWriteTime.dwHighDateTime=0x1c99227, nFileSizeHigh=0x0, nFileSizeLow=0xaa26, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSO.ACL", cAlternateFileName="")) returned 0 [0060.282] FindClose (in: hFindFile=0x2d8068 | out: hFindFile=0x2d8068) returned 1 [0060.282] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a4f390, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a4f390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="3082", cAlternateFileName="")) returned 1 [0060.282] lstrcmpA (lpString1=".", lpString2="3082") returned -1 [0060.282] lstrcmpA (lpString1="..", lpString2="3082") returned -1 [0060.282] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a4f390, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a4f390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d8068 [0060.283] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.283] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a4f390, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a4f390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.283] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.283] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.283] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6ae900, ftCreationTime.dwHighDateTime=0x1c9922b, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d6ae900, ftLastWriteTime.dwHighDateTime=0x1c9922b, nFileSizeHigh=0x0, nFileSizeLow=0xc57c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSO.ACL", cAlternateFileName="")) returned 1 [0060.284] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.284] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\3082\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\3082\\") returned="" [0060.284] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0060.284] WriteFile (in: hFile=0x8c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0060.286] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.286] CloseHandle (hObject=0x8c) returned 1 [0060.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.zip") returned 0 [0060.286] lstrlenA (lpString="*.zip") returned 5 [0060.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.rar") returned 0 [0060.286] lstrlenA (lpString="*.rar") returned 5 [0060.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.7z") returned 0 [0060.286] lstrlenA (lpString="*.7z") returned 4 [0060.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.tar") returned 0 [0060.286] lstrlenA (lpString="*.tar") returned 5 [0060.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.gzip") returned 0 [0060.286] lstrlenA (lpString="*.gzip") returned 6 [0060.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.jpg") returned 0 [0060.286] lstrlenA (lpString="*.jpg") returned 5 [0060.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.jpeg") returned 0 [0060.286] lstrlenA (lpString="*.jpeg") returned 6 [0060.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.psd") returned 0 [0060.286] lstrlenA (lpString="*.psd") returned 5 [0060.286] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.gif") returned 0 [0060.287] lstrlenA (lpString="*.gif") returned 5 [0060.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.doc") returned 0 [0060.287] lstrlenA (lpString="*.doc") returned 5 [0060.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.docx") returned 0 [0060.287] lstrlenA (lpString="*.docx") returned 6 [0060.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.xls") returned 0 [0060.287] lstrlenA (lpString="*.xls") returned 5 [0060.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.xlsx") returned 0 [0060.287] lstrlenA (lpString="*.xlsx") returned 6 [0060.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.ppt") returned 0 [0060.287] lstrlenA (lpString="*.ppt") returned 5 [0060.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.pptx") returned 0 [0060.287] lstrlenA (lpString="*.pptx") returned 6 [0060.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.pdf") returned 0 [0060.287] lstrlenA (lpString="*.pdf") returned 5 [0060.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.mov") returned 0 [0060.287] lstrlenA (lpString="*.mov") returned 5 [0060.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.m2v") returned 0 [0060.287] lstrlenA (lpString="*.m2v") returned 5 [0060.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.3gp") returned 0 [0060.287] lstrlenA (lpString="*.3gp") returned 5 [0060.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.mpeg") returned 0 [0060.287] lstrlenA (lpString="*.mpeg") returned 6 [0060.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.mpg") returned 0 [0060.287] lstrlenA (lpString="*.mpg") returned 5 [0060.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.flv") returned 0 [0060.287] lstrlenA (lpString="*.flv") returned 5 [0060.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.avi") returned 0 [0060.288] lstrlenA (lpString="*.avi") returned 5 [0060.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.mp4") returned 0 [0060.288] lstrlenA (lpString="*.mp4") returned 5 [0060.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.wmv") returned 0 [0060.288] lstrlenA (lpString="*.wmv") returned 5 [0060.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.divx") returned 0 [0060.288] lstrlenA (lpString="*.divx") returned 6 [0060.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.mkv") returned 0 [0060.288] lstrlenA (lpString="*.mkv") returned 5 [0060.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.mp3") returned 0 [0060.288] lstrlenA (lpString="*.mp3") returned 5 [0060.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.wav") returned 0 [0060.288] lstrlenA (lpString="*.wav") returned 5 [0060.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.flac") returned 0 [0060.288] lstrlenA (lpString="*.flac") returned 6 [0060.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.ape") returned 0 [0060.288] lstrlenA (lpString="*.ape") returned 5 [0060.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.wma") returned 0 [0060.288] lstrlenA (lpString="*.wma") returned 5 [0060.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.ac3") returned 0 [0060.288] lstrlenA (lpString="*.ac3") returned 5 [0060.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", pszSpec="*.mxf") returned 0 [0060.288] lstrlenA (lpString="*.mxf") returned 5 [0060.288] FindNextFileA (in: hFindFile=0x2d8068, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6ae900, ftCreationTime.dwHighDateTime=0x1c9922b, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d6ae900, ftLastWriteTime.dwHighDateTime=0x1c9922b, nFileSizeHigh=0x0, nFileSizeLow=0xc57c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSO.ACL", cAlternateFileName="")) returned 0 [0060.288] FindClose (in: hFindFile=0x2d8068 | out: hFindFile=0x2d8068) returned 1 [0060.289] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x50ff7a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x1313b0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ACCDDS.DLL", cAlternateFileName="")) returned 1 [0060.289] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.289] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0060.289] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0060.289] WriteFile (in: hFile=0x88, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0060.291] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.291] CloseHandle (hObject=0x88) returned 1 [0060.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.zip") returned 0 [0060.291] lstrlenA (lpString="*.zip") returned 5 [0060.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.rar") returned 0 [0060.291] lstrlenA (lpString="*.rar") returned 5 [0060.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.7z") returned 0 [0060.291] lstrlenA (lpString="*.7z") returned 4 [0060.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.tar") returned 0 [0060.291] lstrlenA (lpString="*.tar") returned 5 [0060.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.gzip") returned 0 [0060.291] lstrlenA (lpString="*.gzip") returned 6 [0060.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.jpg") returned 0 [0060.292] lstrlenA (lpString="*.jpg") returned 5 [0060.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.jpeg") returned 0 [0060.292] lstrlenA (lpString="*.jpeg") returned 6 [0060.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.psd") returned 0 [0060.292] lstrlenA (lpString="*.psd") returned 5 [0060.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.gif") returned 0 [0060.292] lstrlenA (lpString="*.gif") returned 5 [0060.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.doc") returned 0 [0060.292] lstrlenA (lpString="*.doc") returned 5 [0060.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.docx") returned 0 [0060.292] lstrlenA (lpString="*.docx") returned 6 [0060.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.xls") returned 0 [0060.292] lstrlenA (lpString="*.xls") returned 5 [0060.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.xlsx") returned 0 [0060.292] lstrlenA (lpString="*.xlsx") returned 6 [0060.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.ppt") returned 0 [0060.292] lstrlenA (lpString="*.ppt") returned 5 [0060.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.pptx") returned 0 [0060.292] lstrlenA (lpString="*.pptx") returned 6 [0060.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.pdf") returned 0 [0060.292] lstrlenA (lpString="*.pdf") returned 5 [0060.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.mov") returned 0 [0060.292] lstrlenA (lpString="*.mov") returned 5 [0060.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.m2v") returned 0 [0060.292] lstrlenA (lpString="*.m2v") returned 5 [0060.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.3gp") returned 0 [0060.292] lstrlenA (lpString="*.3gp") returned 5 [0060.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.mpeg") returned 0 [0060.293] lstrlenA (lpString="*.mpeg") returned 6 [0060.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.mpg") returned 0 [0060.293] lstrlenA (lpString="*.mpg") returned 5 [0060.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.flv") returned 0 [0060.293] lstrlenA (lpString="*.flv") returned 5 [0060.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.avi") returned 0 [0060.293] lstrlenA (lpString="*.avi") returned 5 [0060.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.mp4") returned 0 [0060.293] lstrlenA (lpString="*.mp4") returned 5 [0060.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.wmv") returned 0 [0060.293] lstrlenA (lpString="*.wmv") returned 5 [0060.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.divx") returned 0 [0060.293] lstrlenA (lpString="*.divx") returned 6 [0060.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.mkv") returned 0 [0060.293] lstrlenA (lpString="*.mkv") returned 5 [0060.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.mp3") returned 0 [0060.293] lstrlenA (lpString="*.mp3") returned 5 [0060.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.wav") returned 0 [0060.293] lstrlenA (lpString="*.wav") returned 5 [0060.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.flac") returned 0 [0060.293] lstrlenA (lpString="*.flac") returned 6 [0060.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.ape") returned 0 [0060.293] lstrlenA (lpString="*.ape") returned 5 [0060.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.wma") returned 0 [0060.293] lstrlenA (lpString="*.wma") returned 5 [0060.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.ac3") returned 0 [0060.294] lstrlenA (lpString="*.ac3") returned 5 [0060.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL", pszSpec="*.mxf") returned 0 [0060.294] lstrlenA (lpString="*.mxf") returned 5 [0060.294] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x5e8e0f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x8d7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCDDSF.DLL", cAlternateFileName="")) returned 1 [0060.294] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.294] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0060.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.zip") returned 0 [0060.294] lstrlenA (lpString="*.zip") returned 5 [0060.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.rar") returned 0 [0060.294] lstrlenA (lpString="*.rar") returned 5 [0060.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.7z") returned 0 [0060.294] lstrlenA (lpString="*.7z") returned 4 [0060.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.tar") returned 0 [0060.294] lstrlenA (lpString="*.tar") returned 5 [0060.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.gzip") returned 0 [0060.294] lstrlenA (lpString="*.gzip") returned 6 [0060.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.jpg") returned 0 [0060.294] lstrlenA (lpString="*.jpg") returned 5 [0060.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.jpeg") returned 0 [0060.294] lstrlenA (lpString="*.jpeg") returned 6 [0060.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.psd") returned 0 [0060.295] lstrlenA (lpString="*.psd") returned 5 [0060.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.gif") returned 0 [0060.295] lstrlenA (lpString="*.gif") returned 5 [0060.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.doc") returned 0 [0060.295] lstrlenA (lpString="*.doc") returned 5 [0060.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.docx") returned 0 [0060.295] lstrlenA (lpString="*.docx") returned 6 [0060.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.xls") returned 0 [0060.295] lstrlenA (lpString="*.xls") returned 5 [0060.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.xlsx") returned 0 [0060.295] lstrlenA (lpString="*.xlsx") returned 6 [0060.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.ppt") returned 0 [0060.295] lstrlenA (lpString="*.ppt") returned 5 [0060.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.pptx") returned 0 [0060.295] lstrlenA (lpString="*.pptx") returned 6 [0060.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.pdf") returned 0 [0060.295] lstrlenA (lpString="*.pdf") returned 5 [0060.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.mov") returned 0 [0060.295] lstrlenA (lpString="*.mov") returned 5 [0060.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.m2v") returned 0 [0060.295] lstrlenA (lpString="*.m2v") returned 5 [0060.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.3gp") returned 0 [0060.295] lstrlenA (lpString="*.3gp") returned 5 [0060.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.mpeg") returned 0 [0060.295] lstrlenA (lpString="*.mpeg") returned 6 [0060.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.mpg") returned 0 [0060.295] lstrlenA (lpString="*.mpg") returned 5 [0060.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.flv") returned 0 [0060.296] lstrlenA (lpString="*.flv") returned 5 [0060.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.avi") returned 0 [0060.296] lstrlenA (lpString="*.avi") returned 5 [0060.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.mp4") returned 0 [0060.296] lstrlenA (lpString="*.mp4") returned 5 [0060.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.wmv") returned 0 [0060.296] lstrlenA (lpString="*.wmv") returned 5 [0060.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.divx") returned 0 [0060.296] lstrlenA (lpString="*.divx") returned 6 [0060.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.mkv") returned 0 [0060.296] lstrlenA (lpString="*.mkv") returned 5 [0060.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.mp3") returned 0 [0060.296] lstrlenA (lpString="*.mp3") returned 5 [0060.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.wav") returned 0 [0060.296] lstrlenA (lpString="*.wav") returned 5 [0060.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.flac") returned 0 [0060.296] lstrlenA (lpString="*.flac") returned 6 [0060.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.ape") returned 0 [0060.296] lstrlenA (lpString="*.ape") returned 5 [0060.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.wma") returned 0 [0060.296] lstrlenA (lpString="*.wma") returned 5 [0060.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.ac3") returned 0 [0060.296] lstrlenA (lpString="*.ac3") returned 5 [0060.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL", pszSpec="*.mxf") returned 0 [0060.296] lstrlenA (lpString="*.mxf") returned 5 [0060.296] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x5e8e0f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x86db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCDDSLM.DLL", cAlternateFileName="")) returned 1 [0060.296] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.297] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0060.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.zip") returned 0 [0060.297] lstrlenA (lpString="*.zip") returned 5 [0060.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.rar") returned 0 [0060.297] lstrlenA (lpString="*.rar") returned 5 [0060.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.7z") returned 0 [0060.297] lstrlenA (lpString="*.7z") returned 4 [0060.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.tar") returned 0 [0060.297] lstrlenA (lpString="*.tar") returned 5 [0060.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.gzip") returned 0 [0060.297] lstrlenA (lpString="*.gzip") returned 6 [0060.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.jpg") returned 0 [0060.297] lstrlenA (lpString="*.jpg") returned 5 [0060.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.jpeg") returned 0 [0060.297] lstrlenA (lpString="*.jpeg") returned 6 [0060.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.psd") returned 0 [0060.297] lstrlenA (lpString="*.psd") returned 5 [0060.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.gif") returned 0 [0060.297] lstrlenA (lpString="*.gif") returned 5 [0060.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.doc") returned 0 [0060.297] lstrlenA (lpString="*.doc") returned 5 [0060.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.docx") returned 0 [0060.297] lstrlenA (lpString="*.docx") returned 6 [0060.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.xls") returned 0 [0060.297] lstrlenA (lpString="*.xls") returned 5 [0060.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.xlsx") returned 0 [0060.297] lstrlenA (lpString="*.xlsx") returned 6 [0060.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.ppt") returned 0 [0060.298] lstrlenA (lpString="*.ppt") returned 5 [0060.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.pptx") returned 0 [0060.298] lstrlenA (lpString="*.pptx") returned 6 [0060.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.pdf") returned 0 [0060.298] lstrlenA (lpString="*.pdf") returned 5 [0060.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.mov") returned 0 [0060.298] lstrlenA (lpString="*.mov") returned 5 [0060.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.m2v") returned 0 [0060.298] lstrlenA (lpString="*.m2v") returned 5 [0060.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.3gp") returned 0 [0060.298] lstrlenA (lpString="*.3gp") returned 5 [0060.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.mpeg") returned 0 [0060.298] lstrlenA (lpString="*.mpeg") returned 6 [0060.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.mpg") returned 0 [0060.298] lstrlenA (lpString="*.mpg") returned 5 [0060.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.flv") returned 0 [0060.298] lstrlenA (lpString="*.flv") returned 5 [0060.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.avi") returned 0 [0060.298] lstrlenA (lpString="*.avi") returned 5 [0060.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.mp4") returned 0 [0060.298] lstrlenA (lpString="*.mp4") returned 5 [0060.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.wmv") returned 0 [0060.298] lstrlenA (lpString="*.wmv") returned 5 [0060.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.divx") returned 0 [0060.298] lstrlenA (lpString="*.divx") returned 6 [0060.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.mkv") returned 0 [0060.298] lstrlenA (lpString="*.mkv") returned 5 [0060.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.mp3") returned 0 [0060.299] lstrlenA (lpString="*.mp3") returned 5 [0060.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.wav") returned 0 [0060.299] lstrlenA (lpString="*.wav") returned 5 [0060.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.flac") returned 0 [0060.299] lstrlenA (lpString="*.flac") returned 6 [0060.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.ape") returned 0 [0060.299] lstrlenA (lpString="*.ape") returned 5 [0060.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.wma") returned 0 [0060.299] lstrlenA (lpString="*.wma") returned 5 [0060.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.ac3") returned 0 [0060.299] lstrlenA (lpString="*.ac3") returned 5 [0060.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL", pszSpec="*.mxf") returned 0 [0060.299] lstrlenA (lpString="*.mxf") returned 5 [0060.299] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603a86d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessWeb", cAlternateFileName="ACCESS~1")) returned 1 [0060.299] lstrcmpA (lpString1=".", lpString2="AccessWeb") returned -1 [0060.299] lstrcmpA (lpString1="..", lpString2="AccessWeb") returned -1 [0060.299] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603a86d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2d807e, cFileName=".", cAlternateFileName="")) returned 0x2d7ff8 [0060.300] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.300] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603a86d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0060.301] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.301] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.301] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a45600, ftCreationTime.dwHighDateTime=0x1c90da0, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0a45600, ftLastWriteTime.dwHighDateTime=0x1c90da0, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CLNTWRAP.HTM", cAlternateFileName="")) returned 1 [0060.301] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.301] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\") returned="" [0060.306] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.306] CloseHandle (hObject=0x8c) returned 1 [0060.306] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.zip") returned 0 [0060.306] lstrlenA (lpString="*.zip") returned 5 [0060.306] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.rar") returned 0 [0060.306] lstrlenA (lpString="*.rar") returned 5 [0060.306] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.7z") returned 0 [0060.306] lstrlenA (lpString="*.7z") returned 4 [0060.306] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.tar") returned 0 [0060.306] lstrlenA (lpString="*.tar") returned 5 [0060.306] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.gzip") returned 0 [0060.306] lstrlenA (lpString="*.gzip") returned 6 [0060.306] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.jpg") returned 0 [0060.306] lstrlenA (lpString="*.jpg") returned 5 [0060.306] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.jpeg") returned 0 [0060.306] lstrlenA (lpString="*.jpeg") returned 6 [0060.306] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.psd") returned 0 [0060.306] lstrlenA (lpString="*.psd") returned 5 [0060.306] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.gif") returned 0 [0060.306] lstrlenA (lpString="*.gif") returned 5 [0060.306] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.doc") returned 0 [0060.307] lstrlenA (lpString="*.doc") returned 5 [0060.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.docx") returned 0 [0060.307] lstrlenA (lpString="*.docx") returned 6 [0060.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.xls") returned 0 [0060.307] lstrlenA (lpString="*.xls") returned 5 [0060.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.xlsx") returned 0 [0060.307] lstrlenA (lpString="*.xlsx") returned 6 [0060.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.ppt") returned 0 [0060.307] lstrlenA (lpString="*.ppt") returned 5 [0060.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.pptx") returned 0 [0060.307] lstrlenA (lpString="*.pptx") returned 6 [0060.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.pdf") returned 0 [0060.307] lstrlenA (lpString="*.pdf") returned 5 [0060.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.mov") returned 0 [0060.307] lstrlenA (lpString="*.mov") returned 5 [0060.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.m2v") returned 0 [0060.307] lstrlenA (lpString="*.m2v") returned 5 [0060.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.3gp") returned 0 [0060.307] lstrlenA (lpString="*.3gp") returned 5 [0060.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.mpeg") returned 0 [0060.307] lstrlenA (lpString="*.mpeg") returned 6 [0060.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.mpg") returned 0 [0060.307] lstrlenA (lpString="*.mpg") returned 5 [0060.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.flv") returned 0 [0060.307] lstrlenA (lpString="*.flv") returned 5 [0060.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.avi") returned 0 [0060.307] lstrlenA (lpString="*.avi") returned 5 [0060.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.mp4") returned 0 [0060.308] lstrlenA (lpString="*.mp4") returned 5 [0060.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.wmv") returned 0 [0060.308] lstrlenA (lpString="*.wmv") returned 5 [0060.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.divx") returned 0 [0060.308] lstrlenA (lpString="*.divx") returned 6 [0060.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.mkv") returned 0 [0060.308] lstrlenA (lpString="*.mkv") returned 5 [0060.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.mp3") returned 0 [0060.308] lstrlenA (lpString="*.mp3") returned 5 [0060.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.wav") returned 0 [0060.308] lstrlenA (lpString="*.wav") returned 5 [0060.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.flac") returned 0 [0060.308] lstrlenA (lpString="*.flac") returned 6 [0060.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.ape") returned 0 [0060.308] lstrlenA (lpString="*.ape") returned 5 [0060.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.wma") returned 0 [0060.308] lstrlenA (lpString="*.wma") returned 5 [0060.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.ac3") returned 0 [0060.308] lstrlenA (lpString="*.ac3") returned 5 [0060.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM", pszSpec="*.mxf") returned 0 [0060.308] lstrlenA (lpString="*.mxf") returned 5 [0060.308] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e52d000, ftCreationTime.dwHighDateTime=0x1ca1017, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9e52d000, ftLastWriteTime.dwHighDateTime=0x1ca1017, nFileSizeHigh=0x0, nFileSizeLow=0x104cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RPT2HTM4.XSL", cAlternateFileName="")) returned 1 [0060.308] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.308] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\") returned="" [0060.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.zip") returned 0 [0060.309] lstrlenA (lpString="*.zip") returned 5 [0060.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.rar") returned 0 [0060.309] lstrlenA (lpString="*.rar") returned 5 [0060.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.7z") returned 0 [0060.309] lstrlenA (lpString="*.7z") returned 4 [0060.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.tar") returned 0 [0060.309] lstrlenA (lpString="*.tar") returned 5 [0060.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.gzip") returned 0 [0060.309] lstrlenA (lpString="*.gzip") returned 6 [0060.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.jpg") returned 0 [0060.309] lstrlenA (lpString="*.jpg") returned 5 [0060.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.jpeg") returned 0 [0060.309] lstrlenA (lpString="*.jpeg") returned 6 [0060.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.psd") returned 0 [0060.309] lstrlenA (lpString="*.psd") returned 5 [0060.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.gif") returned 0 [0060.309] lstrlenA (lpString="*.gif") returned 5 [0060.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.doc") returned 0 [0060.309] lstrlenA (lpString="*.doc") returned 5 [0060.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.docx") returned 0 [0060.309] lstrlenA (lpString="*.docx") returned 6 [0060.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.xls") returned 0 [0060.309] lstrlenA (lpString="*.xls") returned 5 [0060.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.xlsx") returned 0 [0060.309] lstrlenA (lpString="*.xlsx") returned 6 [0060.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.ppt") returned 0 [0060.309] lstrlenA (lpString="*.ppt") returned 5 [0060.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.pptx") returned 0 [0060.309] lstrlenA (lpString="*.pptx") returned 6 [0060.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.pdf") returned 0 [0060.310] lstrlenA (lpString="*.pdf") returned 5 [0060.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.mov") returned 0 [0060.310] lstrlenA (lpString="*.mov") returned 5 [0060.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.m2v") returned 0 [0060.310] lstrlenA (lpString="*.m2v") returned 5 [0060.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.3gp") returned 0 [0060.310] lstrlenA (lpString="*.3gp") returned 5 [0060.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.mpeg") returned 0 [0060.310] lstrlenA (lpString="*.mpeg") returned 6 [0060.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.mpg") returned 0 [0060.310] lstrlenA (lpString="*.mpg") returned 5 [0060.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.flv") returned 0 [0060.310] lstrlenA (lpString="*.flv") returned 5 [0060.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.avi") returned 0 [0060.310] lstrlenA (lpString="*.avi") returned 5 [0060.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.mp4") returned 0 [0060.310] lstrlenA (lpString="*.mp4") returned 5 [0060.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.wmv") returned 0 [0060.310] lstrlenA (lpString="*.wmv") returned 5 [0060.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.divx") returned 0 [0060.310] lstrlenA (lpString="*.divx") returned 6 [0060.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.mkv") returned 0 [0060.310] lstrlenA (lpString="*.mkv") returned 5 [0060.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.mp3") returned 0 [0060.310] lstrlenA (lpString="*.mp3") returned 5 [0060.310] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.wav") returned 0 [0060.310] lstrlenA (lpString="*.wav") returned 5 [0060.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.flac") returned 0 [0060.311] lstrlenA (lpString="*.flac") returned 6 [0060.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.ape") returned 0 [0060.311] lstrlenA (lpString="*.ape") returned 5 [0060.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.wma") returned 0 [0060.311] lstrlenA (lpString="*.wma") returned 5 [0060.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.ac3") returned 0 [0060.311] lstrlenA (lpString="*.ac3") returned 5 [0060.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL", pszSpec="*.mxf") returned 0 [0060.311] lstrlenA (lpString="*.mxf") returned 5 [0060.311] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa39d00, ftCreationTime.dwHighDateTime=0x1c89eb3, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfa39d00, ftLastWriteTime.dwHighDateTime=0x1c89eb3, nFileSizeHigh=0x0, nFileSizeLow=0x3ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="SERVWRAP.ASP", cAlternateFileName="")) returned 1 [0060.311] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.311] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\") returned="" [0060.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.zip") returned 0 [0060.311] lstrlenA (lpString="*.zip") returned 5 [0060.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.rar") returned 0 [0060.311] lstrlenA (lpString="*.rar") returned 5 [0060.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.7z") returned 0 [0060.311] lstrlenA (lpString="*.7z") returned 4 [0060.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.tar") returned 0 [0060.311] lstrlenA (lpString="*.tar") returned 5 [0060.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.gzip") returned 0 [0060.311] lstrlenA (lpString="*.gzip") returned 6 [0060.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.jpg") returned 0 [0060.311] lstrlenA (lpString="*.jpg") returned 5 [0060.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.jpeg") returned 0 [0060.311] lstrlenA (lpString="*.jpeg") returned 6 [0060.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.psd") returned 0 [0060.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.gif") returned 0 [0060.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.doc") returned 0 [0060.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP", pszSpec="*.docx") returned 0 [0060.312] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa39d00, ftCreationTime.dwHighDateTime=0x1c89eb3, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfa39d00, ftLastWriteTime.dwHighDateTime=0x1c89eb3, nFileSizeHigh=0x0, nFileSizeLow=0x3ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="SERVWRAP.ASP", cAlternateFileName="")) returned 0 [0060.312] FindClose (in: hFindFile=0x2d7ff8 | out: hFindFile=0x2d7ff8) returned 1 [0060.312] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf73e1e00, ftCreationTime.dwHighDateTime=0x1cacb3c, ftLastAccessTime.dwLowDateTime=0x51090010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf73e1e00, ftLastWriteTime.dwHighDateTime=0x1cacb3c, nFileSizeHigh=0x0, nFileSizeLow=0x161d60, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ACCICONS.EXE", cAlternateFileName="")) returned 1 [0060.312] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.312] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x510dc2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x452988, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCVDT.DLL", cAlternateFileName="")) returned 1 [0060.312] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.312] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5ead0130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ead0130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCWIZ", cAlternateFileName="")) returned 1 [0060.312] lstrcmpA (lpString1=".", lpString2="ACCWIZ") returned -1 [0060.312] lstrcmpA (lpString1="..", lpString2="ACCWIZ") returned -1 [0060.313] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5ead0130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ead0130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2d807e, cFileName=".", cAlternateFileName="")) returned 0x2d8070 [0060.315] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.315] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5ead0130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ead0130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0060.315] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.315] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.315] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2df3800, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5ea11a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2df3800, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0x5f6000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ACWZDAT12.ACCDU", cAlternateFileName="ACWZDA~1.ACC")) returned 1 [0060.315] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.316] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.316] CloseHandle (hObject=0x8c) returned 1 [0060.317] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2df3800, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5ea37bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2df3800, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZLIB.ACCDE", cAlternateFileName="ACWZLI~1.ACC")) returned 1 [0060.317] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.317] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2df3800, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x511e6c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2df3800, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0x8f8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZMAIN.ACCDE", cAlternateFileName="ACWZMA~1.ACC")) returned 1 [0060.317] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.317] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4106500, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5eaa9fd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4106500, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0xb39000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZTOOL.ACCDE", cAlternateFileName="ACWZTO~1.ACC")) returned 1 [0060.317] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.317] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4106500, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5ead0130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4106500, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0x348000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZUSR12.ACCDU", cAlternateFileName="ACWZUS~1.ACC")) returned 1 [0060.317] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.317] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4106500, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5e41e350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4106500, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0xbf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UTILITY.ACCDA", cAlternateFileName="UTILIT~1.ACC")) returned 1 [0060.317] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.317] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4106500, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5e41e350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4106500, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0xbf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UTILITY.ACCDA", cAlternateFileName="UTILIT~1.ACC")) returned 0 [0060.317] FindClose (in: hFindFile=0x2d8070 | out: hFindFile=0x2d8070) returned 1 [0060.317] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x5e953370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x33580, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ACCWIZ.DLL", cAlternateFileName="")) returned 1 [0060.318] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.318] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c38c00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82c38c00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1 [0060.318] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.318] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x695e6e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADDINS", cAlternateFileName="")) returned 1 [0060.318] lstrcmpA (lpString1=".", lpString2="ADDINS") returned -1 [0060.318] lstrcmpA (lpString1="..", lpString2="ADDINS") returned -1 [0060.318] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x695e6e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2d807e, cFileName=".", cAlternateFileName="")) returned 0x2d8070 [0060.320] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.320] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x695e6e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0060.320] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.320] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.320] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x51090010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e388, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ACCOLK.DLL", cAlternateFileName="")) returned 1 [0060.320] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.322] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.322] CloseHandle (hObject=0x8c) returned 1 [0060.322] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x2e780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSAddin.dll", cAlternateFileName="")) returned 1 [0060.322] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.322] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4065b100, ftCreationTime.dwHighDateTime=0x1cab7cf, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4065b100, ftLastWriteTime.dwHighDateTime=0x1cab7cf, nFileSizeHigh=0x0, nFileSizeLow=0x17380, dwReserved0=0x0, dwReserved1=0x0, cFileName="ColleagueImport.dll", cAlternateFileName="COLLEA~1.DLL")) returned 1 [0060.322] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.322] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0725100, ftCreationTime.dwHighDateTime=0x1bdbc1e, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0725100, ftLastWriteTime.dwHighDateTime=0x1bdbc1e, nFileSizeHigh=0x0, nFileSizeLow=0x33e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FAXEXT.ECF", cAlternateFileName="")) returned 1 [0060.322] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.322] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87891c00, ftCreationTime.dwHighDateTime=0x1ca15c9, ftLastAccessTime.dwLowDateTime=0x5279f530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87891c00, ftLastWriteTime.dwHighDateTime=0x1ca15c9, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSEC.DLL", cAlternateFileName="")) returned 1 [0060.322] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.322] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87891c00, ftCreationTime.dwHighDateTime=0x1ca15c9, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87891c00, ftLastWriteTime.dwHighDateTime=0x1ca15c9, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSEC.XML", cAlternateFileName="")) returned 1 [0060.323] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.323] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbea7100, ftCreationTime.dwHighDateTime=0x1bdf1f8, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdbea7100, ftLastWriteTime.dwHighDateTime=0x1bdf1f8, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSPC.ECF", cAlternateFileName="")) returned 1 [0060.323] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.323] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8a70000, ftCreationTime.dwHighDateTime=0x1ca200c, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd8a70000, ftLastWriteTime.dwHighDateTime=0x1ca200c, nFileSizeHigh=0x0, nFileSizeLow=0x25348, dwReserved0=0x0, dwReserved1=0x0, cFileName="otkloadr_x64.dll", cAlternateFileName="OTKLOA~1.DLL")) returned 1 [0060.323] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.323] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6927e500, ftCreationTime.dwHighDateTime=0x1c8597f, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6927e500, ftLastWriteTime.dwHighDateTime=0x1c8597f, nFileSizeHigh=0x0, nFileSizeLow=0x786, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTEX.ECF", cAlternateFileName="")) returned 1 [0060.323] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.323] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ef300, ftCreationTime.dwHighDateTime=0x1c8597f, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x704ef300, ftLastWriteTime.dwHighDateTime=0x1c8597f, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTEX2.ECF", cAlternateFileName="")) returned 1 [0060.323] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.323] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x59c42b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x13b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLVBA.DLL", cAlternateFileName="")) returned 1 [0060.323] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.323] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f32200, ftCreationTime.dwHighDateTime=0x1bdf1f8, ftLastAccessTime.dwLowDateTime=0x1710610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4f32200, ftLastWriteTime.dwHighDateTime=0x1bdf1f8, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMAILEXT.ECF", cAlternateFileName="")) returned 1 [0060.323] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.323] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f65c00, ftCreationTime.dwHighDateTime=0x1cab7cf, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81f65c00, ftLastWriteTime.dwHighDateTime=0x1cab7cf, nFileSizeHigh=0x0, nFileSizeLow=0x17a360, dwReserved0=0x0, dwReserved1=0x0, cFileName="UmOutlookAddin.dll", cAlternateFileName="UMOUTL~1.DLL")) returned 1 [0060.323] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.324] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f65c00, ftCreationTime.dwHighDateTime=0x1cab7cf, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81f65c00, ftLastWriteTime.dwHighDateTime=0x1cab7cf, nFileSizeHigh=0x0, nFileSizeLow=0x17a360, dwReserved0=0x0, dwReserved1=0x0, cFileName="UmOutlookAddin.dll", cAlternateFileName="UMOUTL~1.DLL")) returned 0 [0060.324] FindClose (in: hFindFile=0x2d8070 | out: hFindFile=0x2d8070) returned 1 [0060.324] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eaab00, ftCreationTime.dwHighDateTime=0x1c9c978, ftLastAccessTime.dwLowDateTime=0x512a5350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84eaab00, ftLastWriteTime.dwHighDateTime=0x1c9c978, nFileSizeHigh=0x0, nFileSizeLow=0x1934ce, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ADVCMP.DIC", cAlternateFileName="")) returned 1 [0060.324] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.324] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd33c7e00, ftCreationTime.dwHighDateTime=0x1c18605, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd33c7e00, ftLastWriteTime.dwHighDateTime=0x1c18605, nFileSizeHigh=0x0, nFileSizeLow=0x3a1fd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADVTEL.DIC", cAlternateFileName="")) returned 1 [0060.324] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.324] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x895c9700, ftCreationTime.dwHighDateTime=0x1c9c96b, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x895c9700, ftLastWriteTime.dwHighDateTime=0x1c9c96b, nFileSizeHigh=0x0, nFileSizeLow=0x2e25e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADVZIP.DIC", cAlternateFileName="")) returned 1 [0060.324] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.324] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xcf779b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x17fb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="AEC.DLL", cAlternateFileName="")) returned 1 [0060.324] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.324] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23ac1100, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2441900, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x23ac1100, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xc2788, dwReserved0=0x0, dwReserved1=0x0, cFileName="AECUTILS.DLL", cAlternateFileName="")) returned 1 [0060.324] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.324] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31e1b00, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x5171bc90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb31e1b00, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x46080, dwReserved0=0x0, dwReserved1=0x0, cFileName="ASCIIENG.LNG", cAlternateFileName="")) returned 1 [0060.324] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.325] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3d5cf00, ftCreationTime.dwHighDateTime=0x1ca982d, ftLastAccessTime.dwLowDateTime=0x5171bc90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3d5cf00, ftLastWriteTime.dwHighDateTime=0x1ca982d, nFileSizeHigh=0x0, nFileSizeLow=0x22db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUDIOSEARCHLTS.DLL", cAlternateFileName="AUDIOS~1.DLL")) returned 1 [0060.325] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.325] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3d5cf00, ftCreationTime.dwHighDateTime=0x1ca982d, ftLastAccessTime.dwLowDateTime=0x5f3e3510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3d5cf00, ftLastWriteTime.dwHighDateTime=0x1ca982d, nFileSizeHigh=0x0, nFileSizeLow=0x197378, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUDIOSEARCHMAIN.DLL", cAlternateFileName="AUDIOS~3.DLL")) returned 1 [0060.325] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.325] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3d5cf00, ftCreationTime.dwHighDateTime=0x1ca982d, ftLastAccessTime.dwLowDateTime=0x51741df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3d5cf00, ftLastWriteTime.dwHighDateTime=0x1ca982d, nFileSizeHigh=0x0, nFileSizeLow=0x223998, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUDIOSEARCHSAPIFE.DLL", cAlternateFileName="AUDIOS~2.DLL")) returned 1 [0060.325] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.325] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b828500, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b828500, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x10d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTHZAX.DLL", cAlternateFileName="")) returned 1 [0060.325] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.325] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0xc380, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSAutogen.dll", cAlternateFileName="BCSAUT~1.DLL")) returned 1 [0060.325] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.325] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x9b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSClient.Msg.dll", cAlternateFileName="BCSCLI~1.DLL")) returned 1 [0060.325] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.326] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1067d600, ftCreationTime.dwHighDateTime=0x1cac1f1, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1067d600, ftLastWriteTime.dwHighDateTime=0x1cac1f1, nFileSizeHigh=0x0, nFileSizeLow=0x6886, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSClientManifest.man", cAlternateFileName="BCSCLI~1.MAN")) returned 1 [0060.326] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.326] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd44f00, ftCreationTime.dwHighDateTime=0x1cac1f1, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd44f00, ftLastWriteTime.dwHighDateTime=0x1cac1f1, nFileSizeHigh=0x0, nFileSizeLow=0x8d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSEvents.man", cAlternateFileName="BCSEVE~1.MAN")) returned 1 [0060.326] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.326] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c6a8100, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x67a61010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c6a8100, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x11380, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSLaunch.dll", cAlternateFileName="BCSLAU~1.DLL")) returned 1 [0060.326] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.326] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4052c000, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x575e0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4052c000, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x21980, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSProxy.dll", cAlternateFileName="")) returned 1 [0060.326] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.326] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x568a2e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x95d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSRuntime.dll", cAlternateFileName="BCSRUN~1.DLL")) returned 1 [0060.326] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.326] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x67a3aeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x3780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSRuntimeUI.dll", cAlternateFileName="BCSRUN~2.DLL")) returned 1 [0060.326] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.326] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x28f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSStr32.dll", cAlternateFileName="")) returned 1 [0060.326] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.326] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x5812f0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x1b780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSSync.exe", cAlternateFileName="")) returned 1 [0060.327] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.327] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x457bf900, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x457bf900, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x65ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="bdcmetadata.xsd", cAlternateFileName="BDCMET~2.XSD")) returned 1 [0060.327] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.327] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x457bf900, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0x5197d290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x457bf900, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x3321, dwReserved0=0x0, dwReserved1=0x0, cFileName="bdcmetadataresource.xsd", cAlternateFileName="BDCMET~1.XSD")) returned 1 [0060.327] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.327] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f409670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bibliography", cAlternateFileName="BIBLIO~1")) returned 1 [0060.327] lstrcmpA (lpString1=".", lpString2="Bibliography") returned -1 [0060.327] lstrcmpA (lpString1="..", lpString2="Bibliography") returned -1 [0060.327] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f409670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2d807e, cFileName=".", cAlternateFileName="")) returned 0x2d7ff8 [0060.337] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.337] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f409670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0060.337] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.337] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.337] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21181300, ftCreationTime.dwHighDateTime=0x1c6a343, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21181300, ftLastWriteTime.dwHighDateTime=0x1c6a343, nFileSizeHigh=0x0, nFileSizeLow=0x7925, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Author2String.XSL", cAlternateFileName="AUTHOR~1.XSL")) returned 1 [0060.337] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.338] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.338] CloseHandle (hObject=0x8c) returned 1 [0060.339] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21181300, ftCreationTime.dwHighDateTime=0x1c6a343, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21181300, ftLastWriteTime.dwHighDateTime=0x1c6a343, nFileSizeHigh=0x0, nFileSizeLow=0xfe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Author2XML.XSL", cAlternateFileName="AUTHOR~2.XSL")) returned 1 [0060.339] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.339] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sort", cAlternateFileName="")) returned 1 [0060.339] lstrcmpA (lpString1=".", lpString2="Sort") returned -1 [0060.339] lstrcmpA (lpString1="..", lpString2="Sort") returned -1 [0060.339] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d80d8, cFileName=".", cAlternateFileName="")) returned 0x2d80c8 [0060.339] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.339] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0060.339] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.339] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.339] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8b62, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AUTHOR.XSL", cAlternateFileName="")) returned 1 [0060.339] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.341] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.341] CloseHandle (hObject=0x90) returned 1 [0060.341] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8a54, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAG.XSL", cAlternateFileName="")) returned 1 [0060.341] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.341] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8c3e, dwReserved0=0x74, dwReserved1=0x0, cFileName="TITLE.XSL", cAlternateFileName="")) returned 1 [0060.342] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.342] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8bee, dwReserved0=0x74, dwReserved1=0x0, cFileName="YEAR.XSL", cAlternateFileName="")) returned 1 [0060.342] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.342] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8bee, dwReserved0=0x74, dwReserved1=0x0, cFileName="YEAR.XSL", cAlternateFileName="")) returned 0 [0060.342] FindClose (in: hFindFile=0x2d80c8 | out: hFindFile=0x2d80c8) returned 1 [0060.342] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Style", cAlternateFileName="")) returned 1 [0060.342] lstrcmpA (lpString1=".", lpString2="Style") returned -1 [0060.342] lstrcmpA (lpString1="..", lpString2="Style") returned -1 [0060.342] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d80c8 [0060.344] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.345] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.345] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.345] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.345] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9eed00, ftCreationTime.dwHighDateTime=0x1ca5c5e, ftLastAccessTime.dwLowDateTime=0x51448270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec9eed00, ftLastWriteTime.dwHighDateTime=0x1ca5c5e, nFileSizeHigh=0x0, nFileSizeLow=0x5cd04, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="APA.XSL", cAlternateFileName="")) returned 1 [0060.345] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.346] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.346] CloseHandle (hObject=0x90) returned 1 [0060.346] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24a63000, ftCreationTime.dwHighDateTime=0x1ca5c5f, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24a63000, ftLastWriteTime.dwHighDateTime=0x1ca5c5f, nFileSizeHigh=0x0, nFileSizeLow=0x5282c, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHICAGO.XSL", cAlternateFileName="")) returned 1 [0060.346] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.346] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25ddce00, ftCreationTime.dwHighDateTime=0x1c93006, ftLastAccessTime.dwLowDateTime=0x619f9510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25ddce00, ftLastWriteTime.dwHighDateTime=0x1c93006, nFileSizeHigh=0x0, nFileSizeLow=0x40188, dwReserved0=0x740078, dwReserved1=0x0, cFileName="GB.XSL", cAlternateFileName="")) returned 1 [0060.347] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.347] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe44d2300, ftCreationTime.dwHighDateTime=0x1c93005, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe44d2300, ftLastWriteTime.dwHighDateTime=0x1c93005, nFileSizeHigh=0x0, nFileSizeLow=0x3cd76, dwReserved0=0x740078, dwReserved1=0x0, cFileName="GostName.XSL", cAlternateFileName="")) returned 1 [0060.347] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.347] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828cb900, ftCreationTime.dwHighDateTime=0x1c93005, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x828cb900, ftLastWriteTime.dwHighDateTime=0x1c93005, nFileSizeHigh=0x0, nFileSizeLow=0x3b9d6, dwReserved0=0x740078, dwReserved1=0x0, cFileName="GostTitle.XSL", cAlternateFileName="GOSTTI~1.XSL")) returned 1 [0060.347] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.347] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbd7dc00, ftCreationTime.dwHighDateTime=0x1c93004, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbd7dc00, ftLastWriteTime.dwHighDateTime=0x1c93004, nFileSizeHigh=0x0, nFileSizeLow=0x4033d, dwReserved0=0x740078, dwReserved1=0x0, cFileName="ISO690.XSL", cAlternateFileName="")) returned 1 [0060.347] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.347] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a982900, ftCreationTime.dwHighDateTime=0x1c93004, ftLastAccessTime.dwLowDateTime=0x56263450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a982900, ftLastWriteTime.dwHighDateTime=0x1c93004, nFileSizeHigh=0x0, nFileSizeLow=0x3ee6f, dwReserved0=0x740078, dwReserved1=0x0, cFileName="ISO690Nmerical.XSL", cAlternateFileName="ISO690~1.XSL")) returned 1 [0060.347] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.347] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e2f9800, ftCreationTime.dwHighDateTime=0x1ca5c5f, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e2f9800, ftLastWriteTime.dwHighDateTime=0x1ca5c5f, nFileSizeHigh=0x0, nFileSizeLow=0x49051, dwReserved0=0x740078, dwReserved1=0x0, cFileName="MLA.XSL", cAlternateFileName="")) returned 1 [0060.347] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.347] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fb63100, ftCreationTime.dwHighDateTime=0x1c6da3c, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2fb63100, ftLastWriteTime.dwHighDateTime=0x1c6da3c, nFileSizeHigh=0x0, nFileSizeLow=0x3bd45, dwReserved0=0x740078, dwReserved1=0x0, cFileName="SIST02.XSL", cAlternateFileName="")) returned 1 [0060.347] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.347] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3556a600, ftCreationTime.dwHighDateTime=0x1ca5c5f, ftLastAccessTime.dwLowDateTime=0x5aeb55b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3556a600, ftLastWriteTime.dwHighDateTime=0x1ca5c5f, nFileSizeHigh=0x0, nFileSizeLow=0x52a0d, dwReserved0=0x740078, dwReserved1=0x0, cFileName="TURABIAN.XSL", cAlternateFileName="")) returned 1 [0060.347] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.348] FindNextFileA (in: hFindFile=0x2d80c8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3556a600, ftCreationTime.dwHighDateTime=0x1ca5c5f, ftLastAccessTime.dwLowDateTime=0x5aeb55b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3556a600, ftLastWriteTime.dwHighDateTime=0x1ca5c5f, nFileSizeHigh=0x0, nFileSizeLow=0x52a0d, dwReserved0=0x740078, dwReserved1=0x0, cFileName="TURABIAN.XSL", cAlternateFileName="")) returned 0 [0060.348] FindClose (in: hFindFile=0x2d80c8 | out: hFindFile=0x2d80c8) returned 1 [0060.348] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Style", cAlternateFileName="")) returned 0 [0060.348] FindClose (in: hFindFile=0x2d7ff8 | out: hFindFile=0x2d7ff8) returned 1 [0060.348] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="BORDERS", cAlternateFileName="")) returned 1 [0060.348] lstrcmpA (lpString1=".", lpString2="BORDERS") returned -1 [0060.348] lstrcmpA (lpString1="..", lpString2="BORDERS") returned -1 [0060.348] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2d8070 [0060.350] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.350] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.350] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.350] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.350] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x7df6, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MSART1.BDR", cAlternateFileName="")) returned 1 [0060.350] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.352] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.352] CloseHandle (hObject=0x8c) returned 1 [0060.352] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x244c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART10.BDR", cAlternateFileName="")) returned 1 [0060.352] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.352] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x78c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART11.BDR", cAlternateFileName="")) returned 1 [0060.352] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.353] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xe584, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART12.BDR", cAlternateFileName="")) returned 1 [0060.353] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.353] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART13.BDR", cAlternateFileName="")) returned 1 [0060.353] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.353] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xc8bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART14.BDR", cAlternateFileName="")) returned 1 [0060.353] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.353] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x6b14, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART15.BDR", cAlternateFileName="")) returned 1 [0060.353] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.353] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xb854, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART2.BDR", cAlternateFileName="")) returned 1 [0060.353] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.353] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xe12e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART3.BDR", cAlternateFileName="")) returned 1 [0060.353] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.353] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x3902, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART4.BDR", cAlternateFileName="")) returned 1 [0060.353] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.353] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x3dac, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART5.BDR", cAlternateFileName="")) returned 1 [0060.354] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.354] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xd7b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART6.BDR", cAlternateFileName="")) returned 1 [0060.354] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.354] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART7.BDR", cAlternateFileName="")) returned 1 [0060.354] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.354] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xbfca, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART8.BDR", cAlternateFileName="")) returned 1 [0060.354] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.354] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xc696, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART9.BDR", cAlternateFileName="")) returned 1 [0060.354] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.354] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xc696, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART9.BDR", cAlternateFileName="")) returned 0 [0060.354] FindClose (in: hFindFile=0x2d8070 | out: hFindFile=0x2d8070) returned 1 [0060.354] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee75d00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd248dbc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ee75d00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x2d998, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="BRTVIEW.DLL", cAlternateFileName="")) returned 1 [0060.354] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.354] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xcf8844c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xe7380, dwReserved0=0x0, dwReserved1=0x0, cFileName="BSTORM.DLL", cAlternateFileName="")) returned 1 [0060.355] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.355] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500f7b00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd83c4bc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x500f7b00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x81d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="CDLMSO.DLL", cAlternateFileName="")) returned 1 [0060.355] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.355] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x7b09, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.HLP", cAlternateFileName="")) returned 1 [0060.355] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.355] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44f4800, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44f4800, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0xdcc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CharSetTable.chr", cAlternateFileName="CHARSE~1.CHR")) returned 1 [0060.355] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.355] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22bf4c00, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf0edea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x22bf4c00, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x41f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLVIEW.EXE", cAlternateFileName="")) returned 1 [0060.355] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.355] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2149b700, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd24d9e80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2149b700, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xb0578, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMAX20.DLL", cAlternateFileName="")) returned 1 [0060.355] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.355] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.355] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.356] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.356] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.356] lstrcmpA (lpString1=".", lpString2="CONVERT") returned -1 [0060.356] lstrcmpA (lpString1="..", lpString2="CONVERT") returned -1 [0060.356] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2d807e, cFileName=".", cAlternateFileName="")) returned 0x2d8070 [0060.359] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.359] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.359] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.359] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0060.359] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0060.359] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2d7ff8 [0060.363] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.363] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.363] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.363] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.365] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.365] CloseHandle (hObject=0x90) returned 1 [0060.365] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.365] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.365] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.365] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.365] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.365] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.366] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.366] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.366] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.366] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.366] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.366] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.366] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.366] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.368] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.368] CloseHandle (hObject=0x8c) returned 1 [0060.368] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.368] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.368] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.368] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.368] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.368] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.369] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.369] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.369] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.369] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.369] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.369] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.369] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.369] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.369] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0060.369] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0060.370] lstrcmpA (lpString1=".", lpString2="Document Parts") returned -1 [0060.370] lstrcmpA (lpString1="..", lpString2="Document Parts") returned -1 [0060.370] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2d807e, cFileName=".", cAlternateFileName="")) returned 0x2d8080 [0060.371] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.371] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.371] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.372] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0060.372] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0060.372] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2d7ff8 [0060.372] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.372] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.372] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.372] lstrcmpA (lpString1=".", lpString2="14") returned -1 [0060.372] lstrcmpA (lpString1="..", lpString2="14") returned -1 [0060.372] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df3c0, dwReserved1=0x2df3bb, cFileName=".", cAlternateFileName="")) returned 0x2d8038 [0060.372] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.373] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.373] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.374] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.374] CloseHandle (hObject=0x94) returned 1 [0060.376] lstrcmpA (lpString1=".", lpString2="FORMS") returned -1 [0060.376] lstrcmpA (lpString1="..", lpString2="FORMS") returned -1 [0060.376] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2d807e, cFileName=".", cAlternateFileName="")) returned 0x2d8070 [0060.376] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.376] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.376] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.376] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0060.376] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0060.376] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2d7ff8 [0060.379] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.380] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.380] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.381] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.381] CloseHandle (hObject=0x90) returned 1 [0060.415] lstrcmpA (lpString1=".", lpString2="Groove") returned -1 [0060.415] lstrcmpA (lpString1="..", lpString2="Groove") returned -1 [0060.415] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x582abeb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2d807e, cFileName=".", cAlternateFileName="")) returned 0x2d8070 [0060.417] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.418] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.418] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.418] lstrcmpA (lpString1=".", lpString2="Certificates") returned -1 [0060.418] lstrcmpA (lpString1="..", lpString2="Certificates") returned -1 [0060.418] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2d7ff8 [0060.419] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.419] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.419] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.419] lstrcmpA (lpString1=".", lpString2="groove.net") returned -1 [0060.419] lstrcmpA (lpString1="..", lpString2="groove.net") returned -1 [0060.419] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df3c0, dwReserved1=0x2df3bb, cFileName=".", cAlternateFileName="")) returned 0x2d8158 [0060.420] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.420] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.420] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.420] lstrcmpA (lpString1=".", lpString2="Components") returned -1 [0060.420] lstrcmpA (lpString1="..", lpString2="Components") returned -1 [0060.420] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d2c00d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x2e03c3, cFileName=".", cAlternateFileName="")) returned 0x2d80b0 [0060.421] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.421] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.421] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.423] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.423] CloseHandle (hObject=0x98) returned 1 [0060.423] lstrcmpA (lpString1=".", lpString2="ManagedObjects") returned -1 [0060.423] lstrcmpA (lpString1="..", lpString2="ManagedObjects") returned -1 [0060.423] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a95a430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d80b0 [0060.443] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.443] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.444] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.445] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.445] CloseHandle (hObject=0x98) returned 1 [0060.446] lstrcmpA (lpString1=".", lpString2="Servers") returned -1 [0060.446] lstrcmpA (lpString1="..", lpString2="Servers") returned -1 [0060.446] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d80b0 [0060.446] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.446] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.446] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.448] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.448] CloseHandle (hObject=0x98) returned 1 [0060.448] lstrcmpA (lpString1=".", lpString2="Verisign") returned -1 [0060.448] lstrcmpA (lpString1="..", lpString2="Verisign") returned -1 [0060.448] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2d8150 [0060.450] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.450] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.450] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.450] lstrcmpA (lpString1=".", lpString2="Components") returned -1 [0060.450] lstrcmpA (lpString1="..", lpString2="Components") returned -1 [0060.450] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70744630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x2e03c3, cFileName=".", cAlternateFileName="")) returned 0x2d80b0 [0060.452] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.452] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.452] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.454] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.454] CloseHandle (hObject=0x98) returned 1 [0060.458] lstrcmpA (lpString1=".", lpString2="Sounds") returned -1 [0060.458] lstrcmpA (lpString1="..", lpString2="Sounds") returned -1 [0060.458] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52a72f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52a72f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650056, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2d7ff8 [0060.459] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.459] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.459] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.459] lstrcmpA (lpString1=".", lpString2="People") returned -1 [0060.459] lstrcmpA (lpString1="..", lpString2="People") returned -1 [0060.459] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a72f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df3c0, dwReserved1=0x2df3bb, cFileName=".", cAlternateFileName="")) returned 0x2d8140 [0060.463] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.463] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.463] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.468] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.468] CloseHandle (hObject=0x94) returned 1 [0060.472] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.473] CloseHandle (hObject=0x94) returned 1 [0060.473] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\cough.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\cough.wav.wannacry")) returned 1 [0060.474] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GIGGLE.WAV") returned -1 [0060.474] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GIGGLE.WAV") returned 1 [0060.474] lstrcmpiA (lpString1="", lpString2="GIGGLE.WAV") returned -1 [0060.474] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV") returned="COUGH.WAV" [0060.474] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" [0060.474] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned="" [0060.478] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV") returned="GIGGLE.WAV" [0060.478] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.478] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x77e2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x77e2, lpOverlapped=0x0) returned 1 [0060.479] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.479] CloseHandle (hObject=0x94) returned 1 [0060.479] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\giggle.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\giggle.wav.wannacry")) returned 1 [0060.480] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV") returned="GIGGLE.WAV" [0060.480] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" [0060.480] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned="" [0060.480] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt" [0060.480] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\how to decrypt files.txt")) returned 0x20 [0060.480] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", lpString2="HICCUP.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV" [0060.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.zip") returned 0 [0060.481] lstrlenA (lpString="*.zip") returned 5 [0060.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.rar") returned 0 [0060.481] lstrlenA (lpString="*.rar") returned 5 [0060.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.7z") returned 0 [0060.481] lstrlenA (lpString="*.7z") returned 4 [0060.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.tar") returned 0 [0060.481] lstrlenA (lpString="*.tar") returned 5 [0060.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.gzip") returned 0 [0060.481] lstrlenA (lpString="*.gzip") returned 6 [0060.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.jpg") returned 0 [0060.481] lstrlenA (lpString="*.jpg") returned 5 [0060.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.jpeg") returned 0 [0060.481] lstrlenA (lpString="*.jpeg") returned 6 [0060.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.psd") returned 0 [0060.481] lstrlenA (lpString="*.psd") returned 5 [0060.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.gif") returned 0 [0060.481] lstrlenA (lpString="*.gif") returned 5 [0060.482] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.doc") returned 0 [0060.482] lstrlenA (lpString="*.doc") returned 5 [0060.482] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.docx") returned 0 [0060.482] lstrlenA (lpString="*.docx") returned 6 [0060.482] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.xls") returned 0 [0060.482] lstrlenA (lpString="*.xls") returned 5 [0060.482] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.xlsx") returned 0 [0060.482] lstrlenA (lpString="*.xlsx") returned 6 [0060.482] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.ppt") returned 0 [0060.482] lstrlenA (lpString="*.ppt") returned 5 [0060.482] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.pptx") returned 0 [0060.482] lstrlenA (lpString="*.pptx") returned 6 [0060.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.pdf") returned 0 [0060.483] lstrlenA (lpString="*.pdf") returned 5 [0060.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.mov") returned 0 [0060.483] lstrlenA (lpString="*.mov") returned 5 [0060.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.m2v") returned 0 [0060.483] lstrlenA (lpString="*.m2v") returned 5 [0060.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.3gp") returned 0 [0060.483] lstrlenA (lpString="*.3gp") returned 5 [0060.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.mpeg") returned 0 [0060.483] lstrlenA (lpString="*.mpeg") returned 6 [0060.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.mpg") returned 0 [0060.483] lstrlenA (lpString="*.mpg") returned 5 [0060.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.flv") returned 0 [0060.484] lstrlenA (lpString="*.flv") returned 5 [0060.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.avi") returned 0 [0060.484] lstrlenA (lpString="*.avi") returned 5 [0060.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.mp4") returned 0 [0060.484] lstrlenA (lpString="*.mp4") returned 5 [0060.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.wmv") returned 0 [0060.484] lstrlenA (lpString="*.wmv") returned 5 [0060.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.divx") returned 0 [0060.484] lstrlenA (lpString="*.divx") returned 6 [0060.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.mkv") returned 0 [0060.484] lstrlenA (lpString="*.mkv") returned 5 [0060.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.mp3") returned 0 [0060.484] lstrlenA (lpString="*.mp3") returned 5 [0060.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", pszSpec="*.wav") returned 1 [0060.485] lstrlenA (lpString="*.wav") returned 5 [0060.485] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV" [0060.485] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV" [0060.485] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV." [0060.485] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV.wannacry" [0060.485] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\hiccup.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0060.487] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38ea [0060.487] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61cccf30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea)) returned 1 [0060.487] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.487] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x386c, lpOverlapped=0x0) returned 1 [0060.515] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV") returned="HICCUP.WAV" [0060.515] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.515] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x386c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x386c, lpOverlapped=0x0) returned 1 [0060.515] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.515] CloseHandle (hObject=0x94) returned 1 [0060.515] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\hiccup.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\hiccup.wav.wannacry")) returned 1 [0060.516] FindNextFileA (in: hFindFile=0x2d8140, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x58adaa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3b00, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="MMHMM.WAV", cAlternateFileName="")) returned 1 [0060.517] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0060.517] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MMHMM.WAV") returned -1 [0060.517] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MMHMM.WAV") returned -1 [0060.517] lstrcmpiA (lpString1="", lpString2="MMHMM.WAV") returned -1 [0060.517] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV") returned="HICCUP.WAV" [0060.517] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" [0060.517] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned="" [0060.517] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt" [0060.517] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\how to decrypt files.txt")) returned 0x20 [0060.517] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", lpString2="MMHMM.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV" [0060.517] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.zip") returned 0 [0060.517] lstrlenA (lpString="*.zip") returned 5 [0060.517] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.rar") returned 0 [0060.517] lstrlenA (lpString="*.rar") returned 5 [0060.517] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.7z") returned 0 [0060.517] lstrlenA (lpString="*.7z") returned 4 [0060.517] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.tar") returned 0 [0060.517] lstrlenA (lpString="*.tar") returned 5 [0060.517] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.gzip") returned 0 [0060.517] lstrlenA (lpString="*.gzip") returned 6 [0060.517] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.jpg") returned 0 [0060.517] lstrlenA (lpString="*.jpg") returned 5 [0060.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.jpeg") returned 0 [0060.518] lstrlenA (lpString="*.jpeg") returned 6 [0060.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.psd") returned 0 [0060.518] lstrlenA (lpString="*.psd") returned 5 [0060.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.gif") returned 0 [0060.518] lstrlenA (lpString="*.gif") returned 5 [0060.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.doc") returned 0 [0060.518] lstrlenA (lpString="*.doc") returned 5 [0060.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.docx") returned 0 [0060.518] lstrlenA (lpString="*.docx") returned 6 [0060.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.xls") returned 0 [0060.518] lstrlenA (lpString="*.xls") returned 5 [0060.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.xlsx") returned 0 [0060.518] lstrlenA (lpString="*.xlsx") returned 6 [0060.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.ppt") returned 0 [0060.518] lstrlenA (lpString="*.ppt") returned 5 [0060.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.pptx") returned 0 [0060.518] lstrlenA (lpString="*.pptx") returned 6 [0060.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.pdf") returned 0 [0060.518] lstrlenA (lpString="*.pdf") returned 5 [0060.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.mov") returned 0 [0060.518] lstrlenA (lpString="*.mov") returned 5 [0060.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.m2v") returned 0 [0060.518] lstrlenA (lpString="*.m2v") returned 5 [0060.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.3gp") returned 0 [0060.519] lstrlenA (lpString="*.3gp") returned 5 [0060.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.mpeg") returned 0 [0060.519] lstrlenA (lpString="*.mpeg") returned 6 [0060.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.mpg") returned 0 [0060.519] lstrlenA (lpString="*.mpg") returned 5 [0060.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.flv") returned 0 [0060.519] lstrlenA (lpString="*.flv") returned 5 [0060.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.avi") returned 0 [0060.519] lstrlenA (lpString="*.avi") returned 5 [0060.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.mp4") returned 0 [0060.519] lstrlenA (lpString="*.mp4") returned 5 [0060.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.wmv") returned 0 [0060.519] lstrlenA (lpString="*.wmv") returned 5 [0060.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.divx") returned 0 [0060.519] lstrlenA (lpString="*.divx") returned 6 [0060.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.mkv") returned 0 [0060.519] lstrlenA (lpString="*.mkv") returned 5 [0060.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.mp3") returned 0 [0060.519] lstrlenA (lpString="*.mp3") returned 5 [0060.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", pszSpec="*.wav") returned 1 [0060.519] lstrlenA (lpString="*.wav") returned 5 [0060.519] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV" [0060.519] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\mmhmm.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0060.520] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b00 [0060.520] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x58adaa50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea)) returned 1 [0060.520] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.520] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3a82, lpOverlapped=0x0) returned 1 [0060.523] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV") returned="MMHMM.WAV" [0060.523] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.523] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3a82, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3a82, lpOverlapped=0x0) returned 1 [0060.523] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.523] CloseHandle (hObject=0x94) returned 1 [0060.523] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\mmhmm.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\mmhmm.wav.wannacry")) returned 1 [0060.524] FindNextFileA (in: hFindFile=0x2d8140, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9c84, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="SNEEZE.WAV", cAlternateFileName="")) returned 1 [0060.524] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0060.524] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SNEEZE.WAV") returned -1 [0060.525] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SNEEZE.WAV") returned -1 [0060.525] lstrcmpiA (lpString1="", lpString2="SNEEZE.WAV") returned -1 [0060.525] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV") returned="MMHMM.WAV" [0060.525] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned="" [0060.525] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt" [0060.525] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\how to decrypt files.txt")) returned 0x20 [0060.525] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", lpString2="SNEEZE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV" [0060.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.zip") returned 0 [0060.525] lstrlenA (lpString="*.zip") returned 5 [0060.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.rar") returned 0 [0060.525] lstrlenA (lpString="*.rar") returned 5 [0060.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.7z") returned 0 [0060.525] lstrlenA (lpString="*.7z") returned 4 [0060.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.tar") returned 0 [0060.525] lstrlenA (lpString="*.tar") returned 5 [0060.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.gzip") returned 0 [0060.525] lstrlenA (lpString="*.gzip") returned 6 [0060.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.jpg") returned 0 [0060.525] lstrlenA (lpString="*.jpg") returned 5 [0060.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.jpeg") returned 0 [0060.525] lstrlenA (lpString="*.jpeg") returned 6 [0060.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.psd") returned 0 [0060.526] lstrlenA (lpString="*.psd") returned 5 [0060.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.gif") returned 0 [0060.526] lstrlenA (lpString="*.gif") returned 5 [0060.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.doc") returned 0 [0060.526] lstrlenA (lpString="*.doc") returned 5 [0060.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.docx") returned 0 [0060.526] lstrlenA (lpString="*.docx") returned 6 [0060.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.xls") returned 0 [0060.526] lstrlenA (lpString="*.xls") returned 5 [0060.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.xlsx") returned 0 [0060.526] lstrlenA (lpString="*.xlsx") returned 6 [0060.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.ppt") returned 0 [0060.526] lstrlenA (lpString="*.ppt") returned 5 [0060.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.pptx") returned 0 [0060.526] lstrlenA (lpString="*.pptx") returned 6 [0060.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.pdf") returned 0 [0060.526] lstrlenA (lpString="*.pdf") returned 5 [0060.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.mov") returned 0 [0060.526] lstrlenA (lpString="*.mov") returned 5 [0060.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.m2v") returned 0 [0060.526] lstrlenA (lpString="*.m2v") returned 5 [0060.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.3gp") returned 0 [0060.526] lstrlenA (lpString="*.3gp") returned 5 [0060.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.mpeg") returned 0 [0060.526] lstrlenA (lpString="*.mpeg") returned 6 [0060.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.mpg") returned 0 [0060.526] lstrlenA (lpString="*.mpg") returned 5 [0060.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.flv") returned 0 [0060.527] lstrlenA (lpString="*.flv") returned 5 [0060.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.avi") returned 0 [0060.527] lstrlenA (lpString="*.avi") returned 5 [0060.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.mp4") returned 0 [0060.527] lstrlenA (lpString="*.mp4") returned 5 [0060.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.wmv") returned 0 [0060.527] lstrlenA (lpString="*.wmv") returned 5 [0060.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.divx") returned 0 [0060.527] lstrlenA (lpString="*.divx") returned 6 [0060.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.mkv") returned 0 [0060.527] lstrlenA (lpString="*.mkv") returned 5 [0060.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.mp3") returned 0 [0060.527] lstrlenA (lpString="*.mp3") returned 5 [0060.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", pszSpec="*.wav") returned 1 [0060.527] lstrlenA (lpString="*.wav") returned 5 [0060.527] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV" [0060.527] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV" [0060.527] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV." [0060.527] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV.wannacry" [0060.527] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\sneeze.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0060.529] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9c84 [0060.529] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a9f29b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea)) returned 1 [0060.529] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.529] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x9c06, lpOverlapped=0x0) returned 1 [0060.533] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV") returned="SNEEZE.WAV" [0060.533] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.533] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x9c06, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x9c06, lpOverlapped=0x0) returned 1 [0060.533] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.533] CloseHandle (hObject=0x94) returned 1 [0060.533] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\sneeze.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\sneeze.wav.wannacry")) returned 1 [0060.534] FindNextFileA (in: hFindFile=0x2d8140, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x8d36, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="THROAT.WAV", cAlternateFileName="")) returned 1 [0060.534] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0060.534] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="THROAT.WAV") returned -1 [0060.535] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THROAT.WAV") returned -1 [0060.535] lstrcmpiA (lpString1="", lpString2="THROAT.WAV") returned -1 [0060.535] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV") returned="SNEEZE.WAV" [0060.535] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" [0060.535] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned="" [0060.535] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt" [0060.535] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\how to decrypt files.txt")) returned 0x20 [0060.535] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", lpString2="THROAT.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV" [0060.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.zip") returned 0 [0060.535] lstrlenA (lpString="*.zip") returned 5 [0060.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.rar") returned 0 [0060.535] lstrlenA (lpString="*.rar") returned 5 [0060.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.7z") returned 0 [0060.535] lstrlenA (lpString="*.7z") returned 4 [0060.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.tar") returned 0 [0060.535] lstrlenA (lpString="*.tar") returned 5 [0060.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.gzip") returned 0 [0060.535] lstrlenA (lpString="*.gzip") returned 6 [0060.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.jpg") returned 0 [0060.535] lstrlenA (lpString="*.jpg") returned 5 [0060.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.jpeg") returned 0 [0060.535] lstrlenA (lpString="*.jpeg") returned 6 [0060.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.psd") returned 0 [0060.535] lstrlenA (lpString="*.psd") returned 5 [0060.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.gif") returned 0 [0060.536] lstrlenA (lpString="*.gif") returned 5 [0060.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.doc") returned 0 [0060.536] lstrlenA (lpString="*.doc") returned 5 [0060.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.docx") returned 0 [0060.536] lstrlenA (lpString="*.docx") returned 6 [0060.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.xls") returned 0 [0060.536] lstrlenA (lpString="*.xls") returned 5 [0060.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.xlsx") returned 0 [0060.536] lstrlenA (lpString="*.xlsx") returned 6 [0060.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.ppt") returned 0 [0060.536] lstrlenA (lpString="*.ppt") returned 5 [0060.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.pptx") returned 0 [0060.536] lstrlenA (lpString="*.pptx") returned 6 [0060.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.pdf") returned 0 [0060.536] lstrlenA (lpString="*.pdf") returned 5 [0060.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.mov") returned 0 [0060.536] lstrlenA (lpString="*.mov") returned 5 [0060.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.m2v") returned 0 [0060.536] lstrlenA (lpString="*.m2v") returned 5 [0060.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.3gp") returned 0 [0060.536] lstrlenA (lpString="*.3gp") returned 5 [0060.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.mpeg") returned 0 [0060.536] lstrlenA (lpString="*.mpeg") returned 6 [0060.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.mpg") returned 0 [0060.536] lstrlenA (lpString="*.mpg") returned 5 [0060.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.flv") returned 0 [0060.536] lstrlenA (lpString="*.flv") returned 5 [0060.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.avi") returned 0 [0060.537] lstrlenA (lpString="*.avi") returned 5 [0060.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.mp4") returned 0 [0060.537] lstrlenA (lpString="*.mp4") returned 5 [0060.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.wmv") returned 0 [0060.537] lstrlenA (lpString="*.wmv") returned 5 [0060.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.divx") returned 0 [0060.537] lstrlenA (lpString="*.divx") returned 6 [0060.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.mkv") returned 0 [0060.537] lstrlenA (lpString="*.mkv") returned 5 [0060.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.mp3") returned 0 [0060.537] lstrlenA (lpString="*.mp3") returned 5 [0060.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", pszSpec="*.wav") returned 1 [0060.537] lstrlenA (lpString="*.wav") returned 5 [0060.537] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV" [0060.537] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV" [0060.537] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV." [0060.537] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV.wannacry" [0060.537] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\throat.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0060.539] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8d36 [0060.539] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d4d5410, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea)) returned 1 [0060.539] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.539] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x8cb8, lpOverlapped=0x0) returned 1 [0060.542] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV") returned="THROAT.WAV" [0060.542] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.542] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x8cb8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x8cb8, lpOverlapped=0x0) returned 1 [0060.542] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.542] CloseHandle (hObject=0x94) returned 1 [0060.542] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\throat.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\throat.wav.wannacry")) returned 1 [0060.543] FindNextFileA (in: hFindFile=0x2d8140, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7302, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="Whistling.wav", cAlternateFileName="WHISTL~1.WAV")) returned 1 [0060.543] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0060.543] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Whistling.wav") returned -1 [0060.544] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Whistling.wav") returned -1 [0060.544] lstrcmpiA (lpString1="", lpString2="Whistling.wav") returned -1 [0060.544] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV") returned="THROAT.WAV" [0060.544] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" [0060.544] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned="" [0060.544] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt" [0060.544] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\how to decrypt files.txt")) returned 0x20 [0060.544] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", lpString2="Whistling.wav" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav" [0060.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.zip") returned 0 [0060.544] lstrlenA (lpString="*.zip") returned 5 [0060.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.rar") returned 0 [0060.544] lstrlenA (lpString="*.rar") returned 5 [0060.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.7z") returned 0 [0060.544] lstrlenA (lpString="*.7z") returned 4 [0060.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.tar") returned 0 [0060.544] lstrlenA (lpString="*.tar") returned 5 [0060.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.gzip") returned 0 [0060.544] lstrlenA (lpString="*.gzip") returned 6 [0060.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.jpg") returned 0 [0060.544] lstrlenA (lpString="*.jpg") returned 5 [0060.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.jpeg") returned 0 [0060.544] lstrlenA (lpString="*.jpeg") returned 6 [0060.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.psd") returned 0 [0060.545] lstrlenA (lpString="*.psd") returned 5 [0060.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.gif") returned 0 [0060.545] lstrlenA (lpString="*.gif") returned 5 [0060.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.doc") returned 0 [0060.545] lstrlenA (lpString="*.doc") returned 5 [0060.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.docx") returned 0 [0060.545] lstrlenA (lpString="*.docx") returned 6 [0060.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.xls") returned 0 [0060.545] lstrlenA (lpString="*.xls") returned 5 [0060.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.xlsx") returned 0 [0060.545] lstrlenA (lpString="*.xlsx") returned 6 [0060.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.ppt") returned 0 [0060.545] lstrlenA (lpString="*.ppt") returned 5 [0060.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.pptx") returned 0 [0060.545] lstrlenA (lpString="*.pptx") returned 6 [0060.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.pdf") returned 0 [0060.545] lstrlenA (lpString="*.pdf") returned 5 [0060.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.mov") returned 0 [0060.545] lstrlenA (lpString="*.mov") returned 5 [0060.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.m2v") returned 0 [0060.545] lstrlenA (lpString="*.m2v") returned 5 [0060.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.3gp") returned 0 [0060.545] lstrlenA (lpString="*.3gp") returned 5 [0060.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.mpeg") returned 0 [0060.545] lstrlenA (lpString="*.mpeg") returned 6 [0060.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.mpg") returned 0 [0060.545] lstrlenA (lpString="*.mpg") returned 5 [0060.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.flv") returned 0 [0060.546] lstrlenA (lpString="*.flv") returned 5 [0060.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.avi") returned 0 [0060.546] lstrlenA (lpString="*.avi") returned 5 [0060.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.mp4") returned 0 [0060.546] lstrlenA (lpString="*.mp4") returned 5 [0060.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.wmv") returned 0 [0060.546] lstrlenA (lpString="*.wmv") returned 5 [0060.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.divx") returned 0 [0060.546] lstrlenA (lpString="*.divx") returned 6 [0060.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.mkv") returned 0 [0060.546] lstrlenA (lpString="*.mkv") returned 5 [0060.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.mp3") returned 0 [0060.546] lstrlenA (lpString="*.mp3") returned 5 [0060.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", pszSpec="*.wav") returned 1 [0060.546] lstrlenA (lpString="*.wav") returned 5 [0060.546] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav" [0060.546] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav" [0060.546] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav." [0060.546] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav.wannacry" [0060.546] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\whistling.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0060.549] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7302 [0060.549] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x708e7550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea)) returned 1 [0060.549] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.549] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x7284, lpOverlapped=0x0) returned 1 [0060.553] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav") returned="Whistling.wav" [0060.553] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.553] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x7284, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x7284, lpOverlapped=0x0) returned 1 [0060.553] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.553] CloseHandle (hObject=0x94) returned 1 [0060.553] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\whistling.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\whistling.wav.wannacry")) returned 1 [0060.554] FindNextFileA (in: hFindFile=0x2d8140, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7302, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="Whistling.wav", cAlternateFileName="WHISTL~1.WAV")) returned 0 [0060.554] FindClose (in: hFindFile=0x2d8140 | out: hFindFile=0x2d8140) returned 1 [0060.555] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d8180, dwReserved1=0x3, cFileName="Places", cAlternateFileName="")) returned 1 [0060.555] lstrcmpA (lpString1=".", lpString2="Places") returned -1 [0060.555] lstrcmpA (lpString1="..", lpString2="Places") returned -1 [0060.555] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\*.*") returned="*.*" [0060.555] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\", lpString2="Places" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places" [0060.555] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places") returned 63 [0060.555] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName=".", cAlternateFileName="")) returned 0x2d8140 [0060.558] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.558] FindNextFileA (in: hFindFile=0x2d8140, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0060.558] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.558] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.558] FindNextFileA (in: hFindFile=0x2d8140, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x84e0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ALARM.WAV", cAlternateFileName="")) returned 1 [0060.558] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0060.558] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ALARM.WAV") returned 1 [0060.558] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ALARM.WAV") returned 1 [0060.558] lstrcmpiA (lpString1="", lpString2="ALARM.WAV") returned -1 [0060.558] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\*.*") returned="*.*" [0060.558] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" [0060.558] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="" [0060.558] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt" [0060.558] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\how to decrypt files.txt")) returned 0xffffffff [0060.558] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0060.559] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0060.559] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0060.560] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.561] CloseHandle (hObject=0x94) returned 1 [0060.561] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpString2="ALARM.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV" [0060.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.zip") returned 0 [0060.561] lstrlenA (lpString="*.zip") returned 5 [0060.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.rar") returned 0 [0060.561] lstrlenA (lpString="*.rar") returned 5 [0060.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.7z") returned 0 [0060.561] lstrlenA (lpString="*.7z") returned 4 [0060.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.tar") returned 0 [0060.561] lstrlenA (lpString="*.tar") returned 5 [0060.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.gzip") returned 0 [0060.561] lstrlenA (lpString="*.gzip") returned 6 [0060.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.jpg") returned 0 [0060.561] lstrlenA (lpString="*.jpg") returned 5 [0060.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.jpeg") returned 0 [0060.561] lstrlenA (lpString="*.jpeg") returned 6 [0060.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.psd") returned 0 [0060.561] lstrlenA (lpString="*.psd") returned 5 [0060.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.gif") returned 0 [0060.561] lstrlenA (lpString="*.gif") returned 5 [0060.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.doc") returned 0 [0060.561] lstrlenA (lpString="*.doc") returned 5 [0060.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.docx") returned 0 [0060.561] lstrlenA (lpString="*.docx") returned 6 [0060.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.xls") returned 0 [0060.562] lstrlenA (lpString="*.xls") returned 5 [0060.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.xlsx") returned 0 [0060.562] lstrlenA (lpString="*.xlsx") returned 6 [0060.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.ppt") returned 0 [0060.562] lstrlenA (lpString="*.ppt") returned 5 [0060.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.pptx") returned 0 [0060.562] lstrlenA (lpString="*.pptx") returned 6 [0060.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.pdf") returned 0 [0060.562] lstrlenA (lpString="*.pdf") returned 5 [0060.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.mov") returned 0 [0060.562] lstrlenA (lpString="*.mov") returned 5 [0060.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.m2v") returned 0 [0060.562] lstrlenA (lpString="*.m2v") returned 5 [0060.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.3gp") returned 0 [0060.562] lstrlenA (lpString="*.3gp") returned 5 [0060.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.mpeg") returned 0 [0060.562] lstrlenA (lpString="*.mpeg") returned 6 [0060.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.mpg") returned 0 [0060.562] lstrlenA (lpString="*.mpg") returned 5 [0060.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.flv") returned 0 [0060.562] lstrlenA (lpString="*.flv") returned 5 [0060.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.avi") returned 0 [0060.562] lstrlenA (lpString="*.avi") returned 5 [0060.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.mp4") returned 0 [0060.562] lstrlenA (lpString="*.mp4") returned 5 [0060.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.wmv") returned 0 [0060.563] lstrlenA (lpString="*.wmv") returned 5 [0060.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.divx") returned 0 [0060.563] lstrlenA (lpString="*.divx") returned 6 [0060.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.mkv") returned 0 [0060.563] lstrlenA (lpString="*.mkv") returned 5 [0060.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.mp3") returned 0 [0060.563] lstrlenA (lpString="*.mp3") returned 5 [0060.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", pszSpec="*.wav") returned 1 [0060.563] lstrlenA (lpString="*.wav") returned 5 [0060.563] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV" [0060.563] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV" [0060.563] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV." [0060.563] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV.wannacry" [0060.563] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\alarm.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0060.564] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x84e0 [0060.564] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea)) returned 1 [0060.564] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.564] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x8462, lpOverlapped=0x0) returned 1 [0060.566] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV") returned="ALARM.WAV" [0060.566] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.567] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x8462, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x8462, lpOverlapped=0x0) returned 1 [0060.567] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.567] CloseHandle (hObject=0x94) returned 1 [0060.567] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\alarm.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\alarm.wav.wannacry")) returned 1 [0060.568] FindNextFileA (in: hFindFile=0x2d8140, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xeb78, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="BUZZ.WAV", cAlternateFileName="")) returned 1 [0060.568] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0060.568] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BUZZ.WAV") returned 1 [0060.568] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BUZZ.WAV") returned 1 [0060.568] lstrcmpiA (lpString1="", lpString2="BUZZ.WAV") returned -1 [0060.568] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV") returned="ALARM.WAV" [0060.568] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" [0060.568] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="" [0060.568] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt" [0060.568] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\how to decrypt files.txt")) returned 0x20 [0060.569] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpString2="BUZZ.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV" [0060.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.zip") returned 0 [0060.569] lstrlenA (lpString="*.zip") returned 5 [0060.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.rar") returned 0 [0060.569] lstrlenA (lpString="*.rar") returned 5 [0060.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.7z") returned 0 [0060.569] lstrlenA (lpString="*.7z") returned 4 [0060.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.tar") returned 0 [0060.569] lstrlenA (lpString="*.tar") returned 5 [0060.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.gzip") returned 0 [0060.569] lstrlenA (lpString="*.gzip") returned 6 [0060.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.jpg") returned 0 [0060.569] lstrlenA (lpString="*.jpg") returned 5 [0060.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.jpeg") returned 0 [0060.569] lstrlenA (lpString="*.jpeg") returned 6 [0060.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.psd") returned 0 [0060.569] lstrlenA (lpString="*.psd") returned 5 [0060.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.gif") returned 0 [0060.569] lstrlenA (lpString="*.gif") returned 5 [0060.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.doc") returned 0 [0060.569] lstrlenA (lpString="*.doc") returned 5 [0060.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.docx") returned 0 [0060.569] lstrlenA (lpString="*.docx") returned 6 [0060.569] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.xls") returned 0 [0060.569] lstrlenA (lpString="*.xls") returned 5 [0060.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.xlsx") returned 0 [0060.570] lstrlenA (lpString="*.xlsx") returned 6 [0060.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.ppt") returned 0 [0060.570] lstrlenA (lpString="*.ppt") returned 5 [0060.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.pptx") returned 0 [0060.570] lstrlenA (lpString="*.pptx") returned 6 [0060.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.pdf") returned 0 [0060.570] lstrlenA (lpString="*.pdf") returned 5 [0060.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.mov") returned 0 [0060.570] lstrlenA (lpString="*.mov") returned 5 [0060.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.m2v") returned 0 [0060.570] lstrlenA (lpString="*.m2v") returned 5 [0060.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.3gp") returned 0 [0060.570] lstrlenA (lpString="*.3gp") returned 5 [0060.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.mpeg") returned 0 [0060.570] lstrlenA (lpString="*.mpeg") returned 6 [0060.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.mpg") returned 0 [0060.570] lstrlenA (lpString="*.mpg") returned 5 [0060.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.flv") returned 0 [0060.570] lstrlenA (lpString="*.flv") returned 5 [0060.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.avi") returned 0 [0060.570] lstrlenA (lpString="*.avi") returned 5 [0060.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.mp4") returned 0 [0060.570] lstrlenA (lpString="*.mp4") returned 5 [0060.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.wmv") returned 0 [0060.570] lstrlenA (lpString="*.wmv") returned 5 [0060.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.divx") returned 0 [0060.570] lstrlenA (lpString="*.divx") returned 6 [0060.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.mkv") returned 0 [0060.571] lstrlenA (lpString="*.mkv") returned 5 [0060.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.mp3") returned 0 [0060.571] lstrlenA (lpString="*.mp3") returned 5 [0060.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", pszSpec="*.wav") returned 1 [0060.571] lstrlenA (lpString="*.wav") returned 5 [0060.571] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV" [0060.571] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV" [0060.571] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV." [0060.571] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV.wannacry" [0060.571] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\buzz.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0060.572] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeb78 [0060.572] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b925d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea)) returned 1 [0060.572] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.572] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xeafa, lpOverlapped=0x0) returned 1 [0060.574] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV") returned="BUZZ.WAV" [0060.574] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.574] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xeafa, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xeafa, lpOverlapped=0x0) returned 1 [0060.575] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.575] CloseHandle (hObject=0x94) returned 1 [0060.575] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\buzz.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\buzz.wav.wannacry")) returned 1 [0060.576] FindNextFileA (in: hFindFile=0x2d8140, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52b0b4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd686, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="LASER.WAV", cAlternateFileName="")) returned 1 [0060.576] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0060.576] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LASER.WAV") returned -1 [0060.576] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LASER.WAV") returned -1 [0060.576] lstrcmpiA (lpString1="", lpString2="LASER.WAV") returned -1 [0060.576] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV") returned="BUZZ.WAV" [0060.576] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" [0060.576] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="" [0060.576] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt" [0060.576] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\how to decrypt files.txt")) returned 0x20 [0060.576] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpString2="LASER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV" [0060.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.zip") returned 0 [0060.576] lstrlenA (lpString="*.zip") returned 5 [0060.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.rar") returned 0 [0060.577] lstrlenA (lpString="*.rar") returned 5 [0060.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.7z") returned 0 [0060.577] lstrlenA (lpString="*.7z") returned 4 [0060.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.tar") returned 0 [0060.577] lstrlenA (lpString="*.tar") returned 5 [0060.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.gzip") returned 0 [0060.577] lstrlenA (lpString="*.gzip") returned 6 [0060.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.jpg") returned 0 [0060.577] lstrlenA (lpString="*.jpg") returned 5 [0060.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.jpeg") returned 0 [0060.577] lstrlenA (lpString="*.jpeg") returned 6 [0060.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.psd") returned 0 [0060.577] lstrlenA (lpString="*.psd") returned 5 [0060.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.gif") returned 0 [0060.577] lstrlenA (lpString="*.gif") returned 5 [0060.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.doc") returned 0 [0060.577] lstrlenA (lpString="*.doc") returned 5 [0060.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.docx") returned 0 [0060.577] lstrlenA (lpString="*.docx") returned 6 [0060.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.xls") returned 0 [0060.577] lstrlenA (lpString="*.xls") returned 5 [0060.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.xlsx") returned 0 [0060.577] lstrlenA (lpString="*.xlsx") returned 6 [0060.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.ppt") returned 0 [0060.577] lstrlenA (lpString="*.ppt") returned 5 [0060.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.pptx") returned 0 [0060.577] lstrlenA (lpString="*.pptx") returned 6 [0060.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.pdf") returned 0 [0060.578] lstrlenA (lpString="*.pdf") returned 5 [0060.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.mov") returned 0 [0060.578] lstrlenA (lpString="*.mov") returned 5 [0060.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.m2v") returned 0 [0060.578] lstrlenA (lpString="*.m2v") returned 5 [0060.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.3gp") returned 0 [0060.578] lstrlenA (lpString="*.3gp") returned 5 [0060.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.mpeg") returned 0 [0060.578] lstrlenA (lpString="*.mpeg") returned 6 [0060.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.mpg") returned 0 [0060.578] lstrlenA (lpString="*.mpg") returned 5 [0060.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.flv") returned 0 [0060.578] lstrlenA (lpString="*.flv") returned 5 [0060.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.avi") returned 0 [0060.578] lstrlenA (lpString="*.avi") returned 5 [0060.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.mp4") returned 0 [0060.578] lstrlenA (lpString="*.mp4") returned 5 [0060.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.wmv") returned 0 [0060.578] lstrlenA (lpString="*.wmv") returned 5 [0060.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.divx") returned 0 [0060.578] lstrlenA (lpString="*.divx") returned 6 [0060.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.mkv") returned 0 [0060.578] lstrlenA (lpString="*.mkv") returned 5 [0060.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.mp3") returned 0 [0060.578] lstrlenA (lpString="*.mp3") returned 5 [0060.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", pszSpec="*.wav") returned 1 [0060.578] lstrlenA (lpString="*.wav") returned 5 [0060.578] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV" [0060.579] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV" [0060.579] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV." [0060.579] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV.wannacry" [0060.579] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\laser.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0060.579] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd686 [0060.579] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x52b0b4d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6d003d00, dwHighDateTime=0x1c747ea)) returned 1 [0060.579] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.580] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd608, lpOverlapped=0x0) returned 1 [0060.583] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV") returned="LASER.WAV" [0060.583] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.583] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd608, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd608, lpOverlapped=0x0) returned 1 [0060.584] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.584] CloseHandle (hObject=0x94) returned 1 [0060.584] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\laser.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\laser.wav.wannacry")) returned 1 [0060.585] FindNextFileA (in: hFindFile=0x2d8140, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x100ea, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="RADAR.WAV", cAlternateFileName="")) returned 1 [0060.585] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0060.585] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RADAR.WAV") returned -1 [0060.585] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RADAR.WAV") returned -1 [0060.585] lstrcmpiA (lpString1="", lpString2="RADAR.WAV") returned -1 [0060.585] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV") returned="LASER.WAV" [0060.585] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" [0060.585] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="" [0060.585] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt" [0060.586] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\how to decrypt files.txt")) returned 0x20 [0060.586] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpString2="RADAR.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV" [0060.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.zip") returned 0 [0060.586] lstrlenA (lpString="*.zip") returned 5 [0060.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.rar") returned 0 [0060.586] lstrlenA (lpString="*.rar") returned 5 [0060.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.7z") returned 0 [0060.586] lstrlenA (lpString="*.7z") returned 4 [0060.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.tar") returned 0 [0060.586] lstrlenA (lpString="*.tar") returned 5 [0060.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.gzip") returned 0 [0060.586] lstrlenA (lpString="*.gzip") returned 6 [0060.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.jpg") returned 0 [0060.586] lstrlenA (lpString="*.jpg") returned 5 [0060.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.jpeg") returned 0 [0060.586] lstrlenA (lpString="*.jpeg") returned 6 [0060.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.psd") returned 0 [0060.586] lstrlenA (lpString="*.psd") returned 5 [0060.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.gif") returned 0 [0060.586] lstrlenA (lpString="*.gif") returned 5 [0060.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.doc") returned 0 [0060.586] lstrlenA (lpString="*.doc") returned 5 [0060.586] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.docx") returned 0 [0060.587] lstrlenA (lpString="*.docx") returned 6 [0060.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.xls") returned 0 [0060.587] lstrlenA (lpString="*.xls") returned 5 [0060.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.xlsx") returned 0 [0060.587] lstrlenA (lpString="*.xlsx") returned 6 [0060.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.ppt") returned 0 [0060.587] lstrlenA (lpString="*.ppt") returned 5 [0060.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.pptx") returned 0 [0060.587] lstrlenA (lpString="*.pptx") returned 6 [0060.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.pdf") returned 0 [0060.587] lstrlenA (lpString="*.pdf") returned 5 [0060.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.mov") returned 0 [0060.587] lstrlenA (lpString="*.mov") returned 5 [0060.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.m2v") returned 0 [0060.587] lstrlenA (lpString="*.m2v") returned 5 [0060.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.3gp") returned 0 [0060.587] lstrlenA (lpString="*.3gp") returned 5 [0060.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.mpeg") returned 0 [0060.587] lstrlenA (lpString="*.mpeg") returned 6 [0060.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.mpg") returned 0 [0060.587] lstrlenA (lpString="*.mpg") returned 5 [0060.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.flv") returned 0 [0060.587] lstrlenA (lpString="*.flv") returned 5 [0060.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.avi") returned 0 [0060.587] lstrlenA (lpString="*.avi") returned 5 [0060.587] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.mp4") returned 0 [0060.587] lstrlenA (lpString="*.mp4") returned 5 [0060.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.wmv") returned 0 [0060.588] lstrlenA (lpString="*.wmv") returned 5 [0060.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.divx") returned 0 [0060.588] lstrlenA (lpString="*.divx") returned 6 [0060.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.mkv") returned 0 [0060.588] lstrlenA (lpString="*.mkv") returned 5 [0060.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.mp3") returned 0 [0060.588] lstrlenA (lpString="*.mp3") returned 5 [0060.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", pszSpec="*.wav") returned 1 [0060.588] lstrlenA (lpString="*.wav") returned 5 [0060.588] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV" [0060.588] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV" [0060.588] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV." [0060.588] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV.wannacry" [0060.588] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\radar.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0060.591] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100ea [0060.591] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d0d0ef0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea)) returned 1 [0060.591] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.591] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1006c, lpOverlapped=0x0) returned 1 [0060.594] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV") returned="RADAR.WAV" [0060.595] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.595] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1006c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1006c, lpOverlapped=0x0) returned 1 [0060.595] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.595] CloseHandle (hObject=0x94) returned 1 [0060.595] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\radar.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\radar.wav.wannacry")) returned 1 [0060.596] FindNextFileA (in: hFindFile=0x2d8140, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd64a, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TOOT.WAV", cAlternateFileName="")) returned 1 [0060.596] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0060.597] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TOOT.WAV") returned -1 [0060.597] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TOOT.WAV") returned -1 [0060.597] lstrcmpiA (lpString1="", lpString2="TOOT.WAV") returned -1 [0060.597] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV") returned="RADAR.WAV" [0060.597] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" [0060.597] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="" [0060.597] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt" [0060.597] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\how to decrypt files.txt")) returned 0x20 [0060.597] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpString2="TOOT.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV" [0060.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.zip") returned 0 [0060.597] lstrlenA (lpString="*.zip") returned 5 [0060.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.rar") returned 0 [0060.597] lstrlenA (lpString="*.rar") returned 5 [0060.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.7z") returned 0 [0060.597] lstrlenA (lpString="*.7z") returned 4 [0060.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.tar") returned 0 [0060.597] lstrlenA (lpString="*.tar") returned 5 [0060.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.gzip") returned 0 [0060.597] lstrlenA (lpString="*.gzip") returned 6 [0060.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.jpg") returned 0 [0060.597] lstrlenA (lpString="*.jpg") returned 5 [0060.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.jpeg") returned 0 [0060.598] lstrlenA (lpString="*.jpeg") returned 6 [0060.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.psd") returned 0 [0060.598] lstrlenA (lpString="*.psd") returned 5 [0060.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.gif") returned 0 [0060.598] lstrlenA (lpString="*.gif") returned 5 [0060.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.doc") returned 0 [0060.598] lstrlenA (lpString="*.doc") returned 5 [0060.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.docx") returned 0 [0060.598] lstrlenA (lpString="*.docx") returned 6 [0060.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.xls") returned 0 [0060.598] lstrlenA (lpString="*.xls") returned 5 [0060.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.xlsx") returned 0 [0060.598] lstrlenA (lpString="*.xlsx") returned 6 [0060.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.ppt") returned 0 [0060.598] lstrlenA (lpString="*.ppt") returned 5 [0060.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.pptx") returned 0 [0060.598] lstrlenA (lpString="*.pptx") returned 6 [0060.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.pdf") returned 0 [0060.598] lstrlenA (lpString="*.pdf") returned 5 [0060.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.mov") returned 0 [0060.598] lstrlenA (lpString="*.mov") returned 5 [0060.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.m2v") returned 0 [0060.598] lstrlenA (lpString="*.m2v") returned 5 [0060.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.3gp") returned 0 [0060.599] lstrlenA (lpString="*.3gp") returned 5 [0060.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.mpeg") returned 0 [0060.599] lstrlenA (lpString="*.mpeg") returned 6 [0060.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.mpg") returned 0 [0060.599] lstrlenA (lpString="*.mpg") returned 5 [0060.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.flv") returned 0 [0060.599] lstrlenA (lpString="*.flv") returned 5 [0060.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.avi") returned 0 [0060.599] lstrlenA (lpString="*.avi") returned 5 [0060.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.mp4") returned 0 [0060.599] lstrlenA (lpString="*.mp4") returned 5 [0060.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.wmv") returned 0 [0060.599] lstrlenA (lpString="*.wmv") returned 5 [0060.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.divx") returned 0 [0060.599] lstrlenA (lpString="*.divx") returned 6 [0060.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.mkv") returned 0 [0060.599] lstrlenA (lpString="*.mkv") returned 5 [0060.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.mp3") returned 0 [0060.599] lstrlenA (lpString="*.mp3") returned 5 [0060.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", pszSpec="*.wav") returned 1 [0060.599] lstrlenA (lpString="*.wav") returned 5 [0060.599] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV" [0060.600] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV" [0060.600] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV." [0060.600] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV.wannacry" [0060.600] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\toot.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0060.602] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd64a [0060.602] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d547830, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea)) returned 1 [0060.602] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.603] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd5cc, lpOverlapped=0x0) returned 1 [0060.606] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV") returned="TOOT.WAV" [0060.606] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.606] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd5cc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd5cc, lpOverlapped=0x0) returned 1 [0060.606] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.606] CloseHandle (hObject=0x94) returned 1 [0060.606] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\toot.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\toot.wav.wannacry")) returned 1 [0060.607] FindNextFileA (in: hFindFile=0x2d8140, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xea72, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="VIBE.WAV", cAlternateFileName="")) returned 1 [0060.607] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0060.608] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VIBE.WAV") returned -1 [0060.608] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VIBE.WAV") returned -1 [0060.608] lstrcmpiA (lpString1="", lpString2="VIBE.WAV") returned -1 [0060.608] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV") returned="TOOT.WAV" [0060.608] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" [0060.608] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="" [0060.608] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt" [0060.608] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\how to decrypt files.txt")) returned 0x20 [0060.608] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpString2="VIBE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV" [0060.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.zip") returned 0 [0060.608] lstrlenA (lpString="*.zip") returned 5 [0060.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.rar") returned 0 [0060.608] lstrlenA (lpString="*.rar") returned 5 [0060.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.7z") returned 0 [0060.608] lstrlenA (lpString="*.7z") returned 4 [0060.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.tar") returned 0 [0060.608] lstrlenA (lpString="*.tar") returned 5 [0060.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.gzip") returned 0 [0060.608] lstrlenA (lpString="*.gzip") returned 6 [0060.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.jpg") returned 0 [0060.608] lstrlenA (lpString="*.jpg") returned 5 [0060.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.jpeg") returned 0 [0060.608] lstrlenA (lpString="*.jpeg") returned 6 [0060.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.psd") returned 0 [0060.609] lstrlenA (lpString="*.psd") returned 5 [0060.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.gif") returned 0 [0060.609] lstrlenA (lpString="*.gif") returned 5 [0060.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.doc") returned 0 [0060.609] lstrlenA (lpString="*.doc") returned 5 [0060.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.docx") returned 0 [0060.609] lstrlenA (lpString="*.docx") returned 6 [0060.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.xls") returned 0 [0060.609] lstrlenA (lpString="*.xls") returned 5 [0060.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.xlsx") returned 0 [0060.609] lstrlenA (lpString="*.xlsx") returned 6 [0060.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.ppt") returned 0 [0060.609] lstrlenA (lpString="*.ppt") returned 5 [0060.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.pptx") returned 0 [0060.609] lstrlenA (lpString="*.pptx") returned 6 [0060.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.pdf") returned 0 [0060.609] lstrlenA (lpString="*.pdf") returned 5 [0060.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.mov") returned 0 [0060.609] lstrlenA (lpString="*.mov") returned 5 [0060.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.m2v") returned 0 [0060.609] lstrlenA (lpString="*.m2v") returned 5 [0060.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.3gp") returned 0 [0060.609] lstrlenA (lpString="*.3gp") returned 5 [0060.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.mpeg") returned 0 [0060.609] lstrlenA (lpString="*.mpeg") returned 6 [0060.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.mpg") returned 0 [0060.610] lstrlenA (lpString="*.mpg") returned 5 [0060.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.flv") returned 0 [0060.610] lstrlenA (lpString="*.flv") returned 5 [0060.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.avi") returned 0 [0060.610] lstrlenA (lpString="*.avi") returned 5 [0060.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.mp4") returned 0 [0060.610] lstrlenA (lpString="*.mp4") returned 5 [0060.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.wmv") returned 0 [0060.610] lstrlenA (lpString="*.wmv") returned 5 [0060.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.divx") returned 0 [0060.610] lstrlenA (lpString="*.divx") returned 6 [0060.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.mkv") returned 0 [0060.610] lstrlenA (lpString="*.mkv") returned 5 [0060.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.mp3") returned 0 [0060.610] lstrlenA (lpString="*.mp3") returned 5 [0060.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", pszSpec="*.wav") returned 1 [0060.610] lstrlenA (lpString="*.wav") returned 5 [0060.610] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV" [0060.610] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV" [0060.610] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV." [0060.610] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV.wannacry" [0060.610] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\vibe.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0060.612] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xea72 [0060.612] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e490770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea)) returned 1 [0060.612] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.612] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xe9f4, lpOverlapped=0x0) returned 1 [0060.618] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV") returned="VIBE.WAV" [0060.618] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.618] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xe9f4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xe9f4, lpOverlapped=0x0) returned 1 [0060.619] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.619] CloseHandle (hObject=0x94) returned 1 [0060.619] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\vibe.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\vibe.wav.wannacry")) returned 1 [0060.620] FindNextFileA (in: hFindFile=0x2d8140, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e54ee50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xae8a, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="WARN.WAV", cAlternateFileName="")) returned 1 [0060.621] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0060.621] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WARN.WAV") returned -1 [0060.621] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WARN.WAV") returned -1 [0060.621] lstrcmpiA (lpString1="", lpString2="WARN.WAV") returned -1 [0060.621] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV") returned="VIBE.WAV" [0060.621] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" [0060.621] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned="" [0060.621] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt" [0060.621] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\how to decrypt files.txt")) returned 0x20 [0060.621] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", lpString2="WARN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV" [0060.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.zip") returned 0 [0060.621] lstrlenA (lpString="*.zip") returned 5 [0060.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.rar") returned 0 [0060.621] lstrlenA (lpString="*.rar") returned 5 [0060.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.7z") returned 0 [0060.621] lstrlenA (lpString="*.7z") returned 4 [0060.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.tar") returned 0 [0060.621] lstrlenA (lpString="*.tar") returned 5 [0060.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.gzip") returned 0 [0060.621] lstrlenA (lpString="*.gzip") returned 6 [0060.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.jpg") returned 0 [0060.622] lstrlenA (lpString="*.jpg") returned 5 [0060.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.jpeg") returned 0 [0060.622] lstrlenA (lpString="*.jpeg") returned 6 [0060.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.psd") returned 0 [0060.622] lstrlenA (lpString="*.psd") returned 5 [0060.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.gif") returned 0 [0060.622] lstrlenA (lpString="*.gif") returned 5 [0060.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.doc") returned 0 [0060.622] lstrlenA (lpString="*.doc") returned 5 [0060.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.docx") returned 0 [0060.622] lstrlenA (lpString="*.docx") returned 6 [0060.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.xls") returned 0 [0060.622] lstrlenA (lpString="*.xls") returned 5 [0060.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.xlsx") returned 0 [0060.622] lstrlenA (lpString="*.xlsx") returned 6 [0060.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.ppt") returned 0 [0060.622] lstrlenA (lpString="*.ppt") returned 5 [0060.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.pptx") returned 0 [0060.622] lstrlenA (lpString="*.pptx") returned 6 [0060.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.pdf") returned 0 [0060.622] lstrlenA (lpString="*.pdf") returned 5 [0060.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.mov") returned 0 [0060.622] lstrlenA (lpString="*.mov") returned 5 [0060.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.m2v") returned 0 [0060.622] lstrlenA (lpString="*.m2v") returned 5 [0060.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.3gp") returned 0 [0060.623] lstrlenA (lpString="*.3gp") returned 5 [0060.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.mpeg") returned 0 [0060.623] lstrlenA (lpString="*.mpeg") returned 6 [0060.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.mpg") returned 0 [0060.623] lstrlenA (lpString="*.mpg") returned 5 [0060.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.flv") returned 0 [0060.623] lstrlenA (lpString="*.flv") returned 5 [0060.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.avi") returned 0 [0060.623] lstrlenA (lpString="*.avi") returned 5 [0060.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.mp4") returned 0 [0060.623] lstrlenA (lpString="*.mp4") returned 5 [0060.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.wmv") returned 0 [0060.623] lstrlenA (lpString="*.wmv") returned 5 [0060.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.divx") returned 0 [0060.623] lstrlenA (lpString="*.divx") returned 6 [0060.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.mkv") returned 0 [0060.623] lstrlenA (lpString="*.mkv") returned 5 [0060.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.mp3") returned 0 [0060.623] lstrlenA (lpString="*.mp3") returned 5 [0060.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", pszSpec="*.wav") returned 1 [0060.624] lstrlenA (lpString="*.wav") returned 5 [0060.624] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV" [0060.624] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV" [0060.624] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV." [0060.624] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV.wannacry" [0060.624] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\warn.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0060.626] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae8a [0060.626] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e54ee50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea)) returned 1 [0060.626] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.626] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xae0c, lpOverlapped=0x0) returned 1 [0060.628] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV") returned="WARN.WAV" [0060.628] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.628] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xae0c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xae0c, lpOverlapped=0x0) returned 1 [0060.629] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.629] CloseHandle (hObject=0x94) returned 1 [0060.629] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\warn.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\warn.wav.wannacry")) returned 1 [0060.630] FindNextFileA (in: hFindFile=0x2d8140, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e54ee50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xae8a, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="WARN.WAV", cAlternateFileName="")) returned 0 [0060.630] FindClose (in: hFindFile=0x2d8140 | out: hFindFile=0x2d8140) returned 1 [0060.630] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d8180, dwReserved1=0x3, cFileName="Things", cAlternateFileName="")) returned 1 [0060.630] lstrcmpA (lpString1=".", lpString2="Things") returned -1 [0060.630] lstrcmpA (lpString1="..", lpString2="Things") returned -1 [0060.630] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\*.*") returned="*.*" [0060.631] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\", lpString2="Things" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things" [0060.631] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things") returned 63 [0060.631] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName=".", cAlternateFileName="")) returned 0x2d8140 [0060.634] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.634] FindNextFileA (in: hFindFile=0x2d8140, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0060.634] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.634] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.634] FindNextFileA (in: hFindFile=0x2d8140, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc8fc, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CAN.WAV", cAlternateFileName="")) returned 1 [0060.634] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0060.634] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CAN.WAV") returned 1 [0060.634] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CAN.WAV") returned 1 [0060.634] lstrcmpiA (lpString1="", lpString2="CAN.WAV") returned -1 [0060.634] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\*.*") returned="*.*" [0060.634] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" [0060.634] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="" [0060.634] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt" [0060.634] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\how to decrypt files.txt")) returned 0xffffffff [0060.634] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0060.635] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0060.635] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0060.636] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.637] CloseHandle (hObject=0x94) returned 1 [0060.637] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpString2="CAN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV" [0060.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.zip") returned 0 [0060.637] lstrlenA (lpString="*.zip") returned 5 [0060.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.rar") returned 0 [0060.637] lstrlenA (lpString="*.rar") returned 5 [0060.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.7z") returned 0 [0060.637] lstrlenA (lpString="*.7z") returned 4 [0060.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.tar") returned 0 [0060.637] lstrlenA (lpString="*.tar") returned 5 [0060.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.gzip") returned 0 [0060.637] lstrlenA (lpString="*.gzip") returned 6 [0060.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.jpg") returned 0 [0060.637] lstrlenA (lpString="*.jpg") returned 5 [0060.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.jpeg") returned 0 [0060.637] lstrlenA (lpString="*.jpeg") returned 6 [0060.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.psd") returned 0 [0060.637] lstrlenA (lpString="*.psd") returned 5 [0060.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.gif") returned 0 [0060.637] lstrlenA (lpString="*.gif") returned 5 [0060.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.doc") returned 0 [0060.637] lstrlenA (lpString="*.doc") returned 5 [0060.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.docx") returned 0 [0060.637] lstrlenA (lpString="*.docx") returned 6 [0060.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.xls") returned 0 [0060.638] lstrlenA (lpString="*.xls") returned 5 [0060.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.xlsx") returned 0 [0060.638] lstrlenA (lpString="*.xlsx") returned 6 [0060.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.ppt") returned 0 [0060.638] lstrlenA (lpString="*.ppt") returned 5 [0060.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.pptx") returned 0 [0060.638] lstrlenA (lpString="*.pptx") returned 6 [0060.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.pdf") returned 0 [0060.638] lstrlenA (lpString="*.pdf") returned 5 [0060.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.mov") returned 0 [0060.638] lstrlenA (lpString="*.mov") returned 5 [0060.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.m2v") returned 0 [0060.638] lstrlenA (lpString="*.m2v") returned 5 [0060.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.3gp") returned 0 [0060.638] lstrlenA (lpString="*.3gp") returned 5 [0060.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.mpeg") returned 0 [0060.638] lstrlenA (lpString="*.mpeg") returned 6 [0060.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.mpg") returned 0 [0060.638] lstrlenA (lpString="*.mpg") returned 5 [0060.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.flv") returned 0 [0060.638] lstrlenA (lpString="*.flv") returned 5 [0060.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.avi") returned 0 [0060.638] lstrlenA (lpString="*.avi") returned 5 [0060.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.mp4") returned 0 [0060.638] lstrlenA (lpString="*.mp4") returned 5 [0060.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.wmv") returned 0 [0060.639] lstrlenA (lpString="*.wmv") returned 5 [0060.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.divx") returned 0 [0060.639] lstrlenA (lpString="*.divx") returned 6 [0060.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.mkv") returned 0 [0060.639] lstrlenA (lpString="*.mkv") returned 5 [0060.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.mp3") returned 0 [0060.639] lstrlenA (lpString="*.mp3") returned 5 [0060.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", pszSpec="*.wav") returned 1 [0060.639] lstrlenA (lpString="*.wav") returned 5 [0060.639] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV" [0060.639] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV" [0060.639] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV." [0060.639] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV.wannacry" [0060.639] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\can.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0060.641] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc8fc [0060.641] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x603362b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea)) returned 1 [0060.641] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.641] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xc87e, lpOverlapped=0x0) returned 1 [0060.643] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV") returned="CAN.WAV" [0060.644] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.644] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xc87e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xc87e, lpOverlapped=0x0) returned 1 [0060.644] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.644] CloseHandle (hObject=0x94) returned 1 [0060.644] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\can.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\can.wav.wannacry")) returned 1 [0060.645] FindNextFileA (in: hFindFile=0x2d8140, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51ce9230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9f18, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="COUPLER.WAV", cAlternateFileName="")) returned 1 [0060.645] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0060.645] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="COUPLER.WAV") returned 1 [0060.645] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="COUPLER.WAV") returned 1 [0060.646] lstrcmpiA (lpString1="", lpString2="COUPLER.WAV") returned -1 [0060.646] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV") returned="CAN.WAV" [0060.646] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" [0060.646] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="" [0060.646] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt" [0060.646] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\how to decrypt files.txt")) returned 0x20 [0060.646] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpString2="COUPLER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV" [0060.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.zip") returned 0 [0060.646] lstrlenA (lpString="*.zip") returned 5 [0060.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.rar") returned 0 [0060.646] lstrlenA (lpString="*.rar") returned 5 [0060.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.7z") returned 0 [0060.646] lstrlenA (lpString="*.7z") returned 4 [0060.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.tar") returned 0 [0060.646] lstrlenA (lpString="*.tar") returned 5 [0060.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.gzip") returned 0 [0060.646] lstrlenA (lpString="*.gzip") returned 6 [0060.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.jpg") returned 0 [0060.646] lstrlenA (lpString="*.jpg") returned 5 [0060.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.jpeg") returned 0 [0060.646] lstrlenA (lpString="*.jpeg") returned 6 [0060.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.psd") returned 0 [0060.647] lstrlenA (lpString="*.psd") returned 5 [0060.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.gif") returned 0 [0060.647] lstrlenA (lpString="*.gif") returned 5 [0060.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.doc") returned 0 [0060.647] lstrlenA (lpString="*.doc") returned 5 [0060.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.docx") returned 0 [0060.647] lstrlenA (lpString="*.docx") returned 6 [0060.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.xls") returned 0 [0060.647] lstrlenA (lpString="*.xls") returned 5 [0060.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.xlsx") returned 0 [0060.647] lstrlenA (lpString="*.xlsx") returned 6 [0060.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.ppt") returned 0 [0060.647] lstrlenA (lpString="*.ppt") returned 5 [0060.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.pptx") returned 0 [0060.647] lstrlenA (lpString="*.pptx") returned 6 [0060.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.pdf") returned 0 [0060.647] lstrlenA (lpString="*.pdf") returned 5 [0060.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.mov") returned 0 [0060.647] lstrlenA (lpString="*.mov") returned 5 [0060.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.m2v") returned 0 [0060.647] lstrlenA (lpString="*.m2v") returned 5 [0060.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.3gp") returned 0 [0060.647] lstrlenA (lpString="*.3gp") returned 5 [0060.647] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.mpeg") returned 0 [0060.648] lstrlenA (lpString="*.mpeg") returned 6 [0060.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.mpg") returned 0 [0060.648] lstrlenA (lpString="*.mpg") returned 5 [0060.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.flv") returned 0 [0060.648] lstrlenA (lpString="*.flv") returned 5 [0060.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.avi") returned 0 [0060.648] lstrlenA (lpString="*.avi") returned 5 [0060.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.mp4") returned 0 [0060.648] lstrlenA (lpString="*.mp4") returned 5 [0060.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.wmv") returned 0 [0060.648] lstrlenA (lpString="*.wmv") returned 5 [0060.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.divx") returned 0 [0060.648] lstrlenA (lpString="*.divx") returned 6 [0060.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.mkv") returned 0 [0060.648] lstrlenA (lpString="*.mkv") returned 5 [0060.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.mp3") returned 0 [0060.648] lstrlenA (lpString="*.mp3") returned 5 [0060.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", pszSpec="*.wav") returned 1 [0060.648] lstrlenA (lpString="*.wav") returned 5 [0060.648] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV" [0060.648] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV" [0060.648] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV." [0060.648] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV.wannacry" [0060.649] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\coupler.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0060.652] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9f18 [0060.652] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51ce9230, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea)) returned 1 [0060.652] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.652] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x9e9a, lpOverlapped=0x0) returned 1 [0060.658] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV") returned="COUPLER.WAV" [0060.658] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.658] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x9e9a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x9e9a, lpOverlapped=0x0) returned 1 [0060.658] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.658] CloseHandle (hObject=0x94) returned 1 [0060.658] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\coupler.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\coupler.wav.wannacry")) returned 1 [0060.660] FindNextFileA (in: hFindFile=0x2d8140, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa412, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="HORN.WAV", cAlternateFileName="")) returned 1 [0060.660] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0060.660] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HORN.WAV") returned -1 [0060.660] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HORN.WAV") returned 1 [0060.660] lstrcmpiA (lpString1="", lpString2="HORN.WAV") returned -1 [0060.660] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV") returned="COUPLER.WAV" [0060.660] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" [0060.660] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="" [0060.660] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt" [0060.660] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\how to decrypt files.txt")) returned 0x20 [0060.660] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpString2="HORN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV" [0060.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.zip") returned 0 [0060.660] lstrlenA (lpString="*.zip") returned 5 [0060.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.rar") returned 0 [0060.660] lstrlenA (lpString="*.rar") returned 5 [0060.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.7z") returned 0 [0060.660] lstrlenA (lpString="*.7z") returned 4 [0060.660] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.tar") returned 0 [0060.661] lstrlenA (lpString="*.tar") returned 5 [0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.gzip") returned 0 [0060.661] lstrlenA (lpString="*.gzip") returned 6 [0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.jpg") returned 0 [0060.661] lstrlenA (lpString="*.jpg") returned 5 [0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.jpeg") returned 0 [0060.661] lstrlenA (lpString="*.jpeg") returned 6 [0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.psd") returned 0 [0060.661] lstrlenA (lpString="*.psd") returned 5 [0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.gif") returned 0 [0060.661] lstrlenA (lpString="*.gif") returned 5 [0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.doc") returned 0 [0060.661] lstrlenA (lpString="*.doc") returned 5 [0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.docx") returned 0 [0060.661] lstrlenA (lpString="*.docx") returned 6 [0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.xls") returned 0 [0060.661] lstrlenA (lpString="*.xls") returned 5 [0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.xlsx") returned 0 [0060.661] lstrlenA (lpString="*.xlsx") returned 6 [0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.ppt") returned 0 [0060.661] lstrlenA (lpString="*.ppt") returned 5 [0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.pptx") returned 0 [0060.661] lstrlenA (lpString="*.pptx") returned 6 [0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.pdf") returned 0 [0060.661] lstrlenA (lpString="*.pdf") returned 5 [0060.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.mov") returned 0 [0060.662] lstrlenA (lpString="*.mov") returned 5 [0060.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.m2v") returned 0 [0060.662] lstrlenA (lpString="*.m2v") returned 5 [0060.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.3gp") returned 0 [0060.662] lstrlenA (lpString="*.3gp") returned 5 [0060.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.mpeg") returned 0 [0060.662] lstrlenA (lpString="*.mpeg") returned 6 [0060.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.mpg") returned 0 [0060.662] lstrlenA (lpString="*.mpg") returned 5 [0060.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.flv") returned 0 [0060.662] lstrlenA (lpString="*.flv") returned 5 [0060.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.avi") returned 0 [0060.662] lstrlenA (lpString="*.avi") returned 5 [0060.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.mp4") returned 0 [0060.662] lstrlenA (lpString="*.mp4") returned 5 [0060.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.wmv") returned 0 [0060.662] lstrlenA (lpString="*.wmv") returned 5 [0060.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.divx") returned 0 [0060.662] lstrlenA (lpString="*.divx") returned 6 [0060.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.mkv") returned 0 [0060.662] lstrlenA (lpString="*.mkv") returned 5 [0060.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.mp3") returned 0 [0060.662] lstrlenA (lpString="*.mp3") returned 5 [0060.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", pszSpec="*.wav") returned 1 [0060.663] lstrlenA (lpString="*.wav") returned 5 [0060.663] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV" [0060.663] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV" [0060.663] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV." [0060.663] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV.wannacry" [0060.663] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\horn.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0060.665] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa412 [0060.665] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61cccf30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea)) returned 1 [0060.665] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.665] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xa394, lpOverlapped=0x0) returned 1 [0060.667] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV") returned="HORN.WAV" [0060.667] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.667] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xa394, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xa394, lpOverlapped=0x0) returned 1 [0060.668] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.668] CloseHandle (hObject=0x94) returned 1 [0060.668] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\horn.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\horn.wav.wannacry")) returned 1 [0060.669] FindNextFileA (in: hFindFile=0x2d8140, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb14e, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="SHOT.WAV", cAlternateFileName="")) returned 1 [0060.669] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0060.669] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SHOT.WAV") returned -1 [0060.669] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SHOT.WAV") returned -1 [0060.669] lstrcmpiA (lpString1="", lpString2="SHOT.WAV") returned -1 [0060.669] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV") returned="HORN.WAV" [0060.669] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" [0060.670] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="" [0060.670] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt" [0060.670] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\how to decrypt files.txt")) returned 0x20 [0060.670] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpString2="SHOT.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV" [0060.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.zip") returned 0 [0060.670] lstrlenA (lpString="*.zip") returned 5 [0060.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.rar") returned 0 [0060.670] lstrlenA (lpString="*.rar") returned 5 [0060.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.7z") returned 0 [0060.670] lstrlenA (lpString="*.7z") returned 4 [0060.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.tar") returned 0 [0060.670] lstrlenA (lpString="*.tar") returned 5 [0060.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.gzip") returned 0 [0060.670] lstrlenA (lpString="*.gzip") returned 6 [0060.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.jpg") returned 0 [0060.671] lstrlenA (lpString="*.jpg") returned 5 [0060.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.jpeg") returned 0 [0060.671] lstrlenA (lpString="*.jpeg") returned 6 [0060.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.psd") returned 0 [0060.671] lstrlenA (lpString="*.psd") returned 5 [0060.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.gif") returned 0 [0060.671] lstrlenA (lpString="*.gif") returned 5 [0060.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.doc") returned 0 [0060.671] lstrlenA (lpString="*.doc") returned 5 [0060.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.docx") returned 0 [0060.671] lstrlenA (lpString="*.docx") returned 6 [0060.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.xls") returned 0 [0060.671] lstrlenA (lpString="*.xls") returned 5 [0060.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.xlsx") returned 0 [0060.671] lstrlenA (lpString="*.xlsx") returned 6 [0060.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.ppt") returned 0 [0060.671] lstrlenA (lpString="*.ppt") returned 5 [0060.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.pptx") returned 0 [0060.671] lstrlenA (lpString="*.pptx") returned 6 [0060.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.pdf") returned 0 [0060.671] lstrlenA (lpString="*.pdf") returned 5 [0060.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.mov") returned 0 [0060.671] lstrlenA (lpString="*.mov") returned 5 [0060.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.m2v") returned 0 [0060.672] lstrlenA (lpString="*.m2v") returned 5 [0060.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.3gp") returned 0 [0060.672] lstrlenA (lpString="*.3gp") returned 5 [0060.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.mpeg") returned 0 [0060.672] lstrlenA (lpString="*.mpeg") returned 6 [0060.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.mpg") returned 0 [0060.672] lstrlenA (lpString="*.mpg") returned 5 [0060.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.flv") returned 0 [0060.672] lstrlenA (lpString="*.flv") returned 5 [0060.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.avi") returned 0 [0060.672] lstrlenA (lpString="*.avi") returned 5 [0060.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.mp4") returned 0 [0060.672] lstrlenA (lpString="*.mp4") returned 5 [0060.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.wmv") returned 0 [0060.672] lstrlenA (lpString="*.wmv") returned 5 [0060.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.divx") returned 0 [0060.672] lstrlenA (lpString="*.divx") returned 6 [0060.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.mkv") returned 0 [0060.672] lstrlenA (lpString="*.mkv") returned 5 [0060.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.mp3") returned 0 [0060.672] lstrlenA (lpString="*.mp3") returned 5 [0060.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", pszSpec="*.wav") returned 1 [0060.672] lstrlenA (lpString="*.wav") returned 5 [0060.673] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV" [0060.673] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV" [0060.673] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV." [0060.673] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV.wannacry" [0060.673] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shot.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0060.674] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb14e [0060.675] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d299f70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea)) returned 1 [0060.675] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.675] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xb0d0, lpOverlapped=0x0) returned 1 [0060.677] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV") returned="SHOT.WAV" [0060.677] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.677] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xb0d0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xb0d0, lpOverlapped=0x0) returned 1 [0060.678] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.678] CloseHandle (hObject=0x94) returned 1 [0060.678] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shot.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shot.wav.wannacry")) returned 1 [0060.680] FindNextFileA (in: hFindFile=0x2d8140, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf548, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="SHOVEL.WAV", cAlternateFileName="")) returned 1 [0060.680] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0060.680] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SHOVEL.WAV") returned -1 [0060.680] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SHOVEL.WAV") returned -1 [0060.680] lstrcmpiA (lpString1="", lpString2="SHOVEL.WAV") returned -1 [0060.680] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV") returned="SHOT.WAV" [0060.680] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" [0060.680] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="" [0060.680] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt" [0060.680] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\how to decrypt files.txt")) returned 0x20 [0060.680] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpString2="SHOVEL.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV" [0060.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.zip") returned 0 [0060.681] lstrlenA (lpString="*.zip") returned 5 [0060.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.rar") returned 0 [0060.681] lstrlenA (lpString="*.rar") returned 5 [0060.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.7z") returned 0 [0060.681] lstrlenA (lpString="*.7z") returned 4 [0060.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.tar") returned 0 [0060.681] lstrlenA (lpString="*.tar") returned 5 [0060.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.gzip") returned 0 [0060.681] lstrlenA (lpString="*.gzip") returned 6 [0060.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.jpg") returned 0 [0060.681] lstrlenA (lpString="*.jpg") returned 5 [0060.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.jpeg") returned 0 [0060.681] lstrlenA (lpString="*.jpeg") returned 6 [0060.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.psd") returned 0 [0060.681] lstrlenA (lpString="*.psd") returned 5 [0060.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.gif") returned 0 [0060.681] lstrlenA (lpString="*.gif") returned 5 [0060.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.doc") returned 0 [0060.681] lstrlenA (lpString="*.doc") returned 5 [0060.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.docx") returned 0 [0060.681] lstrlenA (lpString="*.docx") returned 6 [0060.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.xls") returned 0 [0060.681] lstrlenA (lpString="*.xls") returned 5 [0060.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.xlsx") returned 0 [0060.682] lstrlenA (lpString="*.xlsx") returned 6 [0060.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.ppt") returned 0 [0060.682] lstrlenA (lpString="*.ppt") returned 5 [0060.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.pptx") returned 0 [0060.682] lstrlenA (lpString="*.pptx") returned 6 [0060.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.pdf") returned 0 [0060.682] lstrlenA (lpString="*.pdf") returned 5 [0060.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.mov") returned 0 [0060.682] lstrlenA (lpString="*.mov") returned 5 [0060.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.m2v") returned 0 [0060.682] lstrlenA (lpString="*.m2v") returned 5 [0060.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.3gp") returned 0 [0060.682] lstrlenA (lpString="*.3gp") returned 5 [0060.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.mpeg") returned 0 [0060.682] lstrlenA (lpString="*.mpeg") returned 6 [0060.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.mpg") returned 0 [0060.682] lstrlenA (lpString="*.mpg") returned 5 [0060.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.flv") returned 0 [0060.682] lstrlenA (lpString="*.flv") returned 5 [0060.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.avi") returned 0 [0060.683] lstrlenA (lpString="*.avi") returned 5 [0060.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.mp4") returned 0 [0060.683] lstrlenA (lpString="*.mp4") returned 5 [0060.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.wmv") returned 0 [0060.683] lstrlenA (lpString="*.wmv") returned 5 [0060.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.divx") returned 0 [0060.683] lstrlenA (lpString="*.divx") returned 6 [0060.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.mkv") returned 0 [0060.683] lstrlenA (lpString="*.mkv") returned 5 [0060.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.mp3") returned 0 [0060.683] lstrlenA (lpString="*.mp3") returned 5 [0060.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", pszSpec="*.wav") returned 1 [0060.683] lstrlenA (lpString="*.wav") returned 5 [0060.683] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV" [0060.683] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV" [0060.683] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV." [0060.683] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV.wannacry" [0060.683] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shovel.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0060.684] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf548 [0060.684] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d2c00d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea)) returned 1 [0060.684] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.684] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xf4ca, lpOverlapped=0x0) returned 1 [0060.687] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV") returned="SHOVEL.WAV" [0060.687] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.687] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xf4ca, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xf4ca, lpOverlapped=0x0) returned 1 [0060.687] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.688] CloseHandle (hObject=0x94) returned 1 [0060.688] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shovel.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shovel.wav.wannacry")) returned 1 [0060.689] FindNextFileA (in: hFindFile=0x2d8140, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xedd6, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="SPLASH.WAV", cAlternateFileName="")) returned 1 [0060.689] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0060.689] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SPLASH.WAV") returned -1 [0060.689] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SPLASH.WAV") returned -1 [0060.689] lstrcmpiA (lpString1="", lpString2="SPLASH.WAV") returned -1 [0060.689] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV") returned="SHOVEL.WAV" [0060.689] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" [0060.689] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="" [0060.689] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt" [0060.689] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\how to decrypt files.txt")) returned 0x20 [0060.689] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpString2="SPLASH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV" [0060.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.zip") returned 0 [0060.689] lstrlenA (lpString="*.zip") returned 5 [0060.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.rar") returned 0 [0060.689] lstrlenA (lpString="*.rar") returned 5 [0060.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.7z") returned 0 [0060.690] lstrlenA (lpString="*.7z") returned 4 [0060.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.tar") returned 0 [0060.690] lstrlenA (lpString="*.tar") returned 5 [0060.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.gzip") returned 0 [0060.690] lstrlenA (lpString="*.gzip") returned 6 [0060.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.jpg") returned 0 [0060.690] lstrlenA (lpString="*.jpg") returned 5 [0060.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.jpeg") returned 0 [0060.690] lstrlenA (lpString="*.jpeg") returned 6 [0060.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.psd") returned 0 [0060.690] lstrlenA (lpString="*.psd") returned 5 [0060.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.gif") returned 0 [0060.690] lstrlenA (lpString="*.gif") returned 5 [0060.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.doc") returned 0 [0060.690] lstrlenA (lpString="*.doc") returned 5 [0060.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.docx") returned 0 [0060.690] lstrlenA (lpString="*.docx") returned 6 [0060.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.xls") returned 0 [0060.690] lstrlenA (lpString="*.xls") returned 5 [0060.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.xlsx") returned 0 [0060.690] lstrlenA (lpString="*.xlsx") returned 6 [0060.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.ppt") returned 0 [0060.690] lstrlenA (lpString="*.ppt") returned 5 [0060.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.pptx") returned 0 [0060.690] lstrlenA (lpString="*.pptx") returned 6 [0060.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.pdf") returned 0 [0060.690] lstrlenA (lpString="*.pdf") returned 5 [0060.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.mov") returned 0 [0060.691] lstrlenA (lpString="*.mov") returned 5 [0060.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.m2v") returned 0 [0060.691] lstrlenA (lpString="*.m2v") returned 5 [0060.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.3gp") returned 0 [0060.691] lstrlenA (lpString="*.3gp") returned 5 [0060.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.mpeg") returned 0 [0060.691] lstrlenA (lpString="*.mpeg") returned 6 [0060.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.mpg") returned 0 [0060.691] lstrlenA (lpString="*.mpg") returned 5 [0060.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.flv") returned 0 [0060.691] lstrlenA (lpString="*.flv") returned 5 [0060.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.avi") returned 0 [0060.691] lstrlenA (lpString="*.avi") returned 5 [0060.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.mp4") returned 0 [0060.691] lstrlenA (lpString="*.mp4") returned 5 [0060.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.wmv") returned 0 [0060.691] lstrlenA (lpString="*.wmv") returned 5 [0060.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.divx") returned 0 [0060.691] lstrlenA (lpString="*.divx") returned 6 [0060.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.mkv") returned 0 [0060.691] lstrlenA (lpString="*.mkv") returned 5 [0060.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.mp3") returned 0 [0060.691] lstrlenA (lpString="*.mp3") returned 5 [0060.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", pszSpec="*.wav") returned 1 [0060.691] lstrlenA (lpString="*.wav") returned 5 [0060.691] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV" [0060.692] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV" [0060.692] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV." [0060.692] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV.wannacry" [0060.692] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\splash.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0060.693] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xedd6 [0060.694] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5aad71f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea)) returned 1 [0060.694] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.694] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xed58, lpOverlapped=0x0) returned 1 [0060.696] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV") returned="SPLASH.WAV" [0060.697] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.697] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xed58, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xed58, lpOverlapped=0x0) returned 1 [0060.697] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.697] CloseHandle (hObject=0x94) returned 1 [0060.697] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\splash.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\splash.wav.wannacry")) returned 1 [0060.698] FindNextFileA (in: hFindFile=0x2d8140, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x537fcc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6bbc, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="WHOOSH.WAV", cAlternateFileName="")) returned 1 [0060.699] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0060.699] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WHOOSH.WAV") returned -1 [0060.699] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WHOOSH.WAV") returned -1 [0060.699] lstrcmpiA (lpString1="", lpString2="WHOOSH.WAV") returned -1 [0060.699] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV") returned="SPLASH.WAV" [0060.699] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" [0060.699] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned="" [0060.699] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt" [0060.699] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\how to decrypt files.txt")) returned 0x20 [0060.699] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", lpString2="WHOOSH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV" [0060.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.zip") returned 0 [0060.699] lstrlenA (lpString="*.zip") returned 5 [0060.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.rar") returned 0 [0060.699] lstrlenA (lpString="*.rar") returned 5 [0060.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.7z") returned 0 [0060.699] lstrlenA (lpString="*.7z") returned 4 [0060.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.tar") returned 0 [0060.699] lstrlenA (lpString="*.tar") returned 5 [0060.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.gzip") returned 0 [0060.699] lstrlenA (lpString="*.gzip") returned 6 [0060.699] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.jpg") returned 0 [0060.699] lstrlenA (lpString="*.jpg") returned 5 [0060.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.jpeg") returned 0 [0060.700] lstrlenA (lpString="*.jpeg") returned 6 [0060.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.psd") returned 0 [0060.700] lstrlenA (lpString="*.psd") returned 5 [0060.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.gif") returned 0 [0060.700] lstrlenA (lpString="*.gif") returned 5 [0060.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.doc") returned 0 [0060.700] lstrlenA (lpString="*.doc") returned 5 [0060.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.docx") returned 0 [0060.700] lstrlenA (lpString="*.docx") returned 6 [0060.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.xls") returned 0 [0060.700] lstrlenA (lpString="*.xls") returned 5 [0060.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.xlsx") returned 0 [0060.700] lstrlenA (lpString="*.xlsx") returned 6 [0060.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.ppt") returned 0 [0060.700] lstrlenA (lpString="*.ppt") returned 5 [0060.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.pptx") returned 0 [0060.700] lstrlenA (lpString="*.pptx") returned 6 [0060.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.pdf") returned 0 [0060.700] lstrlenA (lpString="*.pdf") returned 5 [0060.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.mov") returned 0 [0060.700] lstrlenA (lpString="*.mov") returned 5 [0060.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.m2v") returned 0 [0060.700] lstrlenA (lpString="*.m2v") returned 5 [0060.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.3gp") returned 0 [0060.700] lstrlenA (lpString="*.3gp") returned 5 [0060.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.mpeg") returned 0 [0060.700] lstrlenA (lpString="*.mpeg") returned 6 [0060.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.mpg") returned 0 [0060.701] lstrlenA (lpString="*.mpg") returned 5 [0060.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.flv") returned 0 [0060.701] lstrlenA (lpString="*.flv") returned 5 [0060.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.avi") returned 0 [0060.701] lstrlenA (lpString="*.avi") returned 5 [0060.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.mp4") returned 0 [0060.701] lstrlenA (lpString="*.mp4") returned 5 [0060.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.wmv") returned 0 [0060.701] lstrlenA (lpString="*.wmv") returned 5 [0060.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.divx") returned 0 [0060.701] lstrlenA (lpString="*.divx") returned 6 [0060.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.mkv") returned 0 [0060.701] lstrlenA (lpString="*.mkv") returned 5 [0060.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.mp3") returned 0 [0060.701] lstrlenA (lpString="*.mp3") returned 5 [0060.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", pszSpec="*.wav") returned 1 [0060.701] lstrlenA (lpString="*.wav") returned 5 [0060.701] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV" [0060.701] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV" [0060.701] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV." [0060.701] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV.wannacry" [0060.701] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\whoosh.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0060.703] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6bbc [0060.703] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x537fcc70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6e316a00, dwHighDateTime=0x1c747ea)) returned 1 [0060.703] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.703] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x6b3e, lpOverlapped=0x0) returned 1 [0060.705] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV") returned="WHOOSH.WAV" [0060.705] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.705] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x6b3e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x6b3e, lpOverlapped=0x0) returned 1 [0060.706] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.706] CloseHandle (hObject=0x94) returned 1 [0060.706] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\whoosh.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\whoosh.wav.wannacry")) returned 1 [0060.707] FindNextFileA (in: hFindFile=0x2d8140, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x537fcc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6bbc, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="WHOOSH.WAV", cAlternateFileName="")) returned 0 [0060.707] FindClose (in: hFindFile=0x2d8140 | out: hFindFile=0x2d8140) returned 1 [0060.707] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d8180, dwReserved1=0x3, cFileName="Things", cAlternateFileName="")) returned 0 [0060.707] FindClose (in: hFindFile=0x2d7ff8 | out: hFindFile=0x2d7ff8) returned 1 [0060.707] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0053, dwReserved1=0x3, cFileName="ToolBMPs", cAlternateFileName="")) returned 1 [0060.707] lstrcmpA (lpString1=".", lpString2="ToolBMPs") returned -1 [0060.707] lstrcmpA (lpString1="..", lpString2="ToolBMPs") returned -1 [0060.707] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*.*") returned="*.*" [0060.707] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\", lpString2="ToolBMPs" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs" [0060.707] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs") returned 58 [0060.708] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d8180, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2d7ff8 [0060.736] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0060.736] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.738] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0060.738] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0060.738] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7093c400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7093c400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x14c9, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CalendarToolIconImages.jpg", cAlternateFileName="CALEND~1.JPG")) returned 1 [0060.738] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.738] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CalendarToolIconImages.jpg") returned 1 [0060.738] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CalendarToolIconImages.jpg") returned 1 [0060.738] lstrcmpiA (lpString1="", lpString2="CalendarToolIconImages.jpg") returned -1 [0060.738] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\*.*") returned="*.*" [0060.738] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.738] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.739] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.739] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0xffffffff [0060.739] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.740] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0060.740] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0060.742] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0060.742] CloseHandle (hObject=0x90) returned 1 [0060.742] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="CalendarToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" [0060.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", pszSpec="*.zip") returned 0 [0060.742] lstrlenA (lpString="*.zip") returned 5 [0060.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", pszSpec="*.rar") returned 0 [0060.742] lstrlenA (lpString="*.rar") returned 5 [0060.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", pszSpec="*.7z") returned 0 [0060.742] lstrlenA (lpString="*.7z") returned 4 [0060.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", pszSpec="*.tar") returned 0 [0060.742] lstrlenA (lpString="*.tar") returned 5 [0060.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", pszSpec="*.gzip") returned 0 [0060.743] lstrlenA (lpString="*.gzip") returned 6 [0060.743] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", pszSpec="*.jpg") returned 1 [0060.743] lstrlenA (lpString="*.jpg") returned 5 [0060.743] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" [0060.743] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" [0060.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg." [0060.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg.wannacry" [0060.743] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.744] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14c9 [0060.744] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7093c400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51bb8730, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7093c400, dwHighDateTime=0x1c747ea)) returned 1 [0060.744] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.744] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x144b, lpOverlapped=0x0) returned 1 [0060.746] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg") returned="CalendarToolIconImages.jpg" [0060.746] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.746] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x144b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x144b, lpOverlapped=0x0) returned 1 [0060.746] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.746] CloseHandle (hObject=0x90) returned 1 [0060.746] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg.wannacry")) returned 1 [0060.748] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7093c400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7093c400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x538, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="CalendarToolIconImagesMask.bmp", cAlternateFileName="CALEND~1.BMP")) returned 1 [0060.748] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.748] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CalendarToolIconImagesMask.bmp") returned 1 [0060.748] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CalendarToolIconImagesMask.bmp") returned 1 [0060.748] lstrcmpiA (lpString1="", lpString2="CalendarToolIconImagesMask.bmp") returned -1 [0060.748] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg") returned="CalendarToolIconImages.jpg" [0060.748] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.748] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.748] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.748] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.748] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="CalendarToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp" [0060.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0060.748] lstrlenA (lpString="*.zip") returned 5 [0060.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0060.748] lstrlenA (lpString="*.rar") returned 5 [0060.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0060.748] lstrlenA (lpString="*.7z") returned 4 [0060.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0060.748] lstrlenA (lpString="*.tar") returned 5 [0060.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0060.748] lstrlenA (lpString="*.gzip") returned 6 [0060.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0060.749] lstrlenA (lpString="*.jpg") returned 5 [0060.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0060.749] lstrlenA (lpString="*.jpeg") returned 6 [0060.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0060.749] lstrlenA (lpString="*.psd") returned 5 [0060.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.gif") returned 0 [0060.749] lstrlenA (lpString="*.gif") returned 5 [0060.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.doc") returned 0 [0060.749] lstrlenA (lpString="*.doc") returned 5 [0060.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.docx") returned 0 [0060.749] lstrlenA (lpString="*.docx") returned 6 [0060.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.xls") returned 0 [0060.749] lstrlenA (lpString="*.xls") returned 5 [0060.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.xlsx") returned 0 [0060.749] lstrlenA (lpString="*.xlsx") returned 6 [0060.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.ppt") returned 0 [0060.749] lstrlenA (lpString="*.ppt") returned 5 [0060.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.pptx") returned 0 [0060.749] lstrlenA (lpString="*.pptx") returned 6 [0060.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.pdf") returned 0 [0060.749] lstrlenA (lpString="*.pdf") returned 5 [0060.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.mov") returned 0 [0060.749] lstrlenA (lpString="*.mov") returned 5 [0060.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.m2v") returned 0 [0060.749] lstrlenA (lpString="*.m2v") returned 5 [0060.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.3gp") returned 0 [0060.749] lstrlenA (lpString="*.3gp") returned 5 [0060.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.mpeg") returned 0 [0060.750] lstrlenA (lpString="*.mpeg") returned 6 [0060.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.mpg") returned 0 [0060.750] lstrlenA (lpString="*.mpg") returned 5 [0060.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.flv") returned 0 [0060.750] lstrlenA (lpString="*.flv") returned 5 [0060.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.avi") returned 0 [0060.750] lstrlenA (lpString="*.avi") returned 5 [0060.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.mp4") returned 0 [0060.750] lstrlenA (lpString="*.mp4") returned 5 [0060.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.wmv") returned 0 [0060.750] lstrlenA (lpString="*.wmv") returned 5 [0060.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.divx") returned 0 [0060.750] lstrlenA (lpString="*.divx") returned 6 [0060.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.mkv") returned 0 [0060.750] lstrlenA (lpString="*.mkv") returned 5 [0060.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.mp3") returned 0 [0060.750] lstrlenA (lpString="*.mp3") returned 5 [0060.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.wav") returned 0 [0060.750] lstrlenA (lpString="*.wav") returned 5 [0060.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.flac") returned 0 [0060.750] lstrlenA (lpString="*.flac") returned 6 [0060.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.ape") returned 0 [0060.750] lstrlenA (lpString="*.ape") returned 5 [0060.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.wma") returned 0 [0060.750] lstrlenA (lpString="*.wma") returned 5 [0060.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.ac3") returned 0 [0060.750] lstrlenA (lpString="*.ac3") returned 5 [0060.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", pszSpec="*.mxf") returned 0 [0060.751] lstrlenA (lpString="*.mxf") returned 5 [0060.751] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ChessIconImages.bmp", cAlternateFileName="CHESSI~1.BMP")) returned 1 [0060.751] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.751] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ChessIconImages.bmp") returned 1 [0060.751] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ChessIconImages.bmp") returned 1 [0060.751] lstrcmpiA (lpString1="", lpString2="ChessIconImages.bmp") returned -1 [0060.751] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp") returned="CalendarToolIconImagesMask.bmp" [0060.751] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.751] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.751] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.751] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.751] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="ChessIconImages.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp" [0060.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.zip") returned 0 [0060.751] lstrlenA (lpString="*.zip") returned 5 [0060.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.rar") returned 0 [0060.751] lstrlenA (lpString="*.rar") returned 5 [0060.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.7z") returned 0 [0060.751] lstrlenA (lpString="*.7z") returned 4 [0060.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.tar") returned 0 [0060.751] lstrlenA (lpString="*.tar") returned 5 [0060.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.gzip") returned 0 [0060.751] lstrlenA (lpString="*.gzip") returned 6 [0060.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.jpg") returned 0 [0060.752] lstrlenA (lpString="*.jpg") returned 5 [0060.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.jpeg") returned 0 [0060.752] lstrlenA (lpString="*.jpeg") returned 6 [0060.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.psd") returned 0 [0060.752] lstrlenA (lpString="*.psd") returned 5 [0060.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.gif") returned 0 [0060.752] lstrlenA (lpString="*.gif") returned 5 [0060.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.doc") returned 0 [0060.752] lstrlenA (lpString="*.doc") returned 5 [0060.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.docx") returned 0 [0060.752] lstrlenA (lpString="*.docx") returned 6 [0060.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.xls") returned 0 [0060.752] lstrlenA (lpString="*.xls") returned 5 [0060.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.xlsx") returned 0 [0060.752] lstrlenA (lpString="*.xlsx") returned 6 [0060.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.ppt") returned 0 [0060.752] lstrlenA (lpString="*.ppt") returned 5 [0060.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.pptx") returned 0 [0060.752] lstrlenA (lpString="*.pptx") returned 6 [0060.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.pdf") returned 0 [0060.752] lstrlenA (lpString="*.pdf") returned 5 [0060.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.mov") returned 0 [0060.752] lstrlenA (lpString="*.mov") returned 5 [0060.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.m2v") returned 0 [0060.752] lstrlenA (lpString="*.m2v") returned 5 [0060.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.3gp") returned 0 [0060.752] lstrlenA (lpString="*.3gp") returned 5 [0060.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.mpeg") returned 0 [0060.753] lstrlenA (lpString="*.mpeg") returned 6 [0060.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.mpg") returned 0 [0060.753] lstrlenA (lpString="*.mpg") returned 5 [0060.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.flv") returned 0 [0060.753] lstrlenA (lpString="*.flv") returned 5 [0060.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.avi") returned 0 [0060.753] lstrlenA (lpString="*.avi") returned 5 [0060.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.mp4") returned 0 [0060.753] lstrlenA (lpString="*.mp4") returned 5 [0060.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.wmv") returned 0 [0060.753] lstrlenA (lpString="*.wmv") returned 5 [0060.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.divx") returned 0 [0060.753] lstrlenA (lpString="*.divx") returned 6 [0060.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.mkv") returned 0 [0060.753] lstrlenA (lpString="*.mkv") returned 5 [0060.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.mp3") returned 0 [0060.753] lstrlenA (lpString="*.mp3") returned 5 [0060.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.wav") returned 0 [0060.753] lstrlenA (lpString="*.wav") returned 5 [0060.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.flac") returned 0 [0060.753] lstrlenA (lpString="*.flac") returned 6 [0060.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.ape") returned 0 [0060.753] lstrlenA (lpString="*.ape") returned 5 [0060.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.wma") returned 0 [0060.753] lstrlenA (lpString="*.wma") returned 5 [0060.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.ac3") returned 0 [0060.753] lstrlenA (lpString="*.ac3") returned 5 [0060.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", pszSpec="*.mxf") returned 0 [0060.754] lstrlenA (lpString="*.mxf") returned 5 [0060.754] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x0, dwReserved1=0x0, cFileName="ChessIconImagesMask.bmp", cAlternateFileName="CHESSI~2.BMP")) returned 1 [0060.754] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.754] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ChessIconImagesMask.bmp") returned 1 [0060.754] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ChessIconImagesMask.bmp") returned 1 [0060.754] lstrcmpiA (lpString1="", lpString2="ChessIconImagesMask.bmp") returned -1 [0060.754] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp") returned="ChessIconImages.bmp" [0060.754] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.754] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.754] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.754] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.754] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="ChessIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp" [0060.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0060.754] lstrlenA (lpString="*.zip") returned 5 [0060.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0060.754] lstrlenA (lpString="*.rar") returned 5 [0060.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0060.754] lstrlenA (lpString="*.7z") returned 4 [0060.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0060.754] lstrlenA (lpString="*.tar") returned 5 [0060.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0060.754] lstrlenA (lpString="*.gzip") returned 6 [0060.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0060.755] lstrlenA (lpString="*.jpg") returned 5 [0060.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0060.755] lstrlenA (lpString="*.jpeg") returned 6 [0060.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0060.755] lstrlenA (lpString="*.psd") returned 5 [0060.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.gif") returned 0 [0060.755] lstrlenA (lpString="*.gif") returned 5 [0060.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.doc") returned 0 [0060.755] lstrlenA (lpString="*.doc") returned 5 [0060.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.docx") returned 0 [0060.755] lstrlenA (lpString="*.docx") returned 6 [0060.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.xls") returned 0 [0060.755] lstrlenA (lpString="*.xls") returned 5 [0060.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.xlsx") returned 0 [0060.755] lstrlenA (lpString="*.xlsx") returned 6 [0060.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.ppt") returned 0 [0060.755] lstrlenA (lpString="*.ppt") returned 5 [0060.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.pptx") returned 0 [0060.755] lstrlenA (lpString="*.pptx") returned 6 [0060.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.pdf") returned 0 [0060.755] lstrlenA (lpString="*.pdf") returned 5 [0060.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.mov") returned 0 [0060.755] lstrlenA (lpString="*.mov") returned 5 [0060.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.m2v") returned 0 [0060.755] lstrlenA (lpString="*.m2v") returned 5 [0060.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.3gp") returned 0 [0060.755] lstrlenA (lpString="*.3gp") returned 5 [0060.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.mpeg") returned 0 [0060.756] lstrlenA (lpString="*.mpeg") returned 6 [0060.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.mpg") returned 0 [0060.756] lstrlenA (lpString="*.mpg") returned 5 [0060.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.flv") returned 0 [0060.756] lstrlenA (lpString="*.flv") returned 5 [0060.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.avi") returned 0 [0060.756] lstrlenA (lpString="*.avi") returned 5 [0060.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.mp4") returned 0 [0060.756] lstrlenA (lpString="*.mp4") returned 5 [0060.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.wmv") returned 0 [0060.756] lstrlenA (lpString="*.wmv") returned 5 [0060.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.divx") returned 0 [0060.756] lstrlenA (lpString="*.divx") returned 6 [0060.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.mkv") returned 0 [0060.756] lstrlenA (lpString="*.mkv") returned 5 [0060.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.mp3") returned 0 [0060.756] lstrlenA (lpString="*.mp3") returned 5 [0060.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.wav") returned 0 [0060.756] lstrlenA (lpString="*.wav") returned 5 [0060.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.flac") returned 0 [0060.756] lstrlenA (lpString="*.flac") returned 6 [0060.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.ape") returned 0 [0060.756] lstrlenA (lpString="*.ape") returned 5 [0060.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.wma") returned 0 [0060.757] lstrlenA (lpString="*.wma") returned 5 [0060.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.ac3") returned 0 [0060.757] lstrlenA (lpString="*.ac3") returned 5 [0060.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", pszSpec="*.mxf") returned 0 [0060.757] lstrlenA (lpString="*.mxf") returned 5 [0060.757] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d0f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CreateSpaceImage.jpg", cAlternateFileName="CREATE~1.JPG")) returned 1 [0060.757] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.757] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CreateSpaceImage.jpg") returned 1 [0060.757] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CreateSpaceImage.jpg") returned 1 [0060.757] lstrcmpiA (lpString1="", lpString2="CreateSpaceImage.jpg") returned -1 [0060.757] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp") returned="ChessIconImagesMask.bmp" [0060.757] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.757] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.757] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.757] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.757] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="CreateSpaceImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" [0060.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", pszSpec="*.zip") returned 0 [0060.757] lstrlenA (lpString="*.zip") returned 5 [0060.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", pszSpec="*.rar") returned 0 [0060.757] lstrlenA (lpString="*.rar") returned 5 [0060.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", pszSpec="*.7z") returned 0 [0060.758] lstrlenA (lpString="*.7z") returned 4 [0060.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", pszSpec="*.tar") returned 0 [0060.758] lstrlenA (lpString="*.tar") returned 5 [0060.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", pszSpec="*.gzip") returned 0 [0060.758] lstrlenA (lpString="*.gzip") returned 6 [0060.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", pszSpec="*.jpg") returned 1 [0060.758] lstrlenA (lpString="*.jpg") returned 5 [0060.758] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" [0060.758] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" [0060.758] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg." [0060.758] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg.wannacry" [0060.758] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.759] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x296b [0060.759] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x71c4f100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51d0f390, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x71c4f100, dwHighDateTime=0x1c747ea)) returned 1 [0060.759] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.759] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x28ed, lpOverlapped=0x0) returned 1 [0060.761] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg") returned="CreateSpaceImage.jpg" [0060.761] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.761] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x28ed, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x28ed, lpOverlapped=0x0) returned 1 [0060.762] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.762] CloseHandle (hObject=0x90) returned 1 [0060.762] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg.wannacry")) returned 1 [0060.763] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d0f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf78, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="CreateSpaceImageMask.bmp", cAlternateFileName="CREATE~1.BMP")) returned 1 [0060.763] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.763] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CreateSpaceImageMask.bmp") returned 1 [0060.763] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CreateSpaceImageMask.bmp") returned 1 [0060.763] lstrcmpiA (lpString1="", lpString2="CreateSpaceImageMask.bmp") returned -1 [0060.763] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg") returned="CreateSpaceImage.jpg" [0060.763] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.763] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.763] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.763] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.763] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="CreateSpaceImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp" [0060.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.zip") returned 0 [0060.764] lstrlenA (lpString="*.zip") returned 5 [0060.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.rar") returned 0 [0060.764] lstrlenA (lpString="*.rar") returned 5 [0060.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.7z") returned 0 [0060.764] lstrlenA (lpString="*.7z") returned 4 [0060.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.tar") returned 0 [0060.764] lstrlenA (lpString="*.tar") returned 5 [0060.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.gzip") returned 0 [0060.764] lstrlenA (lpString="*.gzip") returned 6 [0060.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.jpg") returned 0 [0060.764] lstrlenA (lpString="*.jpg") returned 5 [0060.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.jpeg") returned 0 [0060.764] lstrlenA (lpString="*.jpeg") returned 6 [0060.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.psd") returned 0 [0060.764] lstrlenA (lpString="*.psd") returned 5 [0060.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.gif") returned 0 [0060.764] lstrlenA (lpString="*.gif") returned 5 [0060.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.doc") returned 0 [0060.764] lstrlenA (lpString="*.doc") returned 5 [0060.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.docx") returned 0 [0060.764] lstrlenA (lpString="*.docx") returned 6 [0060.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.xls") returned 0 [0060.764] lstrlenA (lpString="*.xls") returned 5 [0060.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.xlsx") returned 0 [0060.764] lstrlenA (lpString="*.xlsx") returned 6 [0060.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.ppt") returned 0 [0060.765] lstrlenA (lpString="*.ppt") returned 5 [0060.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.pptx") returned 0 [0060.765] lstrlenA (lpString="*.pptx") returned 6 [0060.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.pdf") returned 0 [0060.765] lstrlenA (lpString="*.pdf") returned 5 [0060.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.mov") returned 0 [0060.765] lstrlenA (lpString="*.mov") returned 5 [0060.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.m2v") returned 0 [0060.765] lstrlenA (lpString="*.m2v") returned 5 [0060.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.3gp") returned 0 [0060.765] lstrlenA (lpString="*.3gp") returned 5 [0060.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.mpeg") returned 0 [0060.765] lstrlenA (lpString="*.mpeg") returned 6 [0060.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.mpg") returned 0 [0060.765] lstrlenA (lpString="*.mpg") returned 5 [0060.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.flv") returned 0 [0060.765] lstrlenA (lpString="*.flv") returned 5 [0060.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.avi") returned 0 [0060.765] lstrlenA (lpString="*.avi") returned 5 [0060.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.mp4") returned 0 [0060.765] lstrlenA (lpString="*.mp4") returned 5 [0060.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.wmv") returned 0 [0060.765] lstrlenA (lpString="*.wmv") returned 5 [0060.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.divx") returned 0 [0060.765] lstrlenA (lpString="*.divx") returned 6 [0060.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.mkv") returned 0 [0060.765] lstrlenA (lpString="*.mkv") returned 5 [0060.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.mp3") returned 0 [0060.766] lstrlenA (lpString="*.mp3") returned 5 [0060.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.wav") returned 0 [0060.766] lstrlenA (lpString="*.wav") returned 5 [0060.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.flac") returned 0 [0060.766] lstrlenA (lpString="*.flac") returned 6 [0060.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.ape") returned 0 [0060.766] lstrlenA (lpString="*.ape") returned 5 [0060.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.wma") returned 0 [0060.766] lstrlenA (lpString="*.wma") returned 5 [0060.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.ac3") returned 0 [0060.766] lstrlenA (lpString="*.ac3") returned 5 [0060.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", pszSpec="*.mxf") returned 0 [0060.766] lstrlenA (lpString="*.mxf") returned 5 [0060.766] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataListIconImages.jpg", cAlternateFileName="DATALI~1.JPG")) returned 1 [0060.766] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.766] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DataListIconImages.jpg") returned 1 [0060.766] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DataListIconImages.jpg") returned 1 [0060.766] lstrcmpiA (lpString1="", lpString2="DataListIconImages.jpg") returned -1 [0060.766] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp") returned="CreateSpaceImageMask.bmp" [0060.766] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.766] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.766] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.766] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.767] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="DataListIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" [0060.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", pszSpec="*.zip") returned 0 [0060.767] lstrlenA (lpString="*.zip") returned 5 [0060.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", pszSpec="*.rar") returned 0 [0060.767] lstrlenA (lpString="*.rar") returned 5 [0060.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", pszSpec="*.7z") returned 0 [0060.767] lstrlenA (lpString="*.7z") returned 4 [0060.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", pszSpec="*.tar") returned 0 [0060.767] lstrlenA (lpString="*.tar") returned 5 [0060.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", pszSpec="*.gzip") returned 0 [0060.767] lstrlenA (lpString="*.gzip") returned 6 [0060.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", pszSpec="*.jpg") returned 1 [0060.767] lstrlenA (lpString="*.jpg") returned 5 [0060.767] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" [0060.767] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" [0060.767] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg." [0060.767] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg.wannacry" [0060.767] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.769] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16c7 [0060.769] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x71c4f100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x606ee510, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x71c4f100, dwHighDateTime=0x1c747ea)) returned 1 [0060.769] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.769] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1649, lpOverlapped=0x0) returned 1 [0060.771] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg") returned="DataListIconImages.jpg" [0060.771] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.771] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1649, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1649, lpOverlapped=0x0) returned 1 [0060.772] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.772] CloseHandle (hObject=0x90) returned 1 [0060.772] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg.wannacry")) returned 1 [0060.773] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="DataListIconImagesMask.bmp", cAlternateFileName="DATALI~1.BMP")) returned 1 [0060.773] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.773] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DataListIconImagesMask.bmp") returned 1 [0060.773] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DataListIconImagesMask.bmp") returned 1 [0060.773] lstrcmpiA (lpString1="", lpString2="DataListIconImagesMask.bmp") returned -1 [0060.773] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg") returned="DataListIconImages.jpg" [0060.773] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.773] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.773] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.773] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.773] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="DataListIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" [0060.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0060.774] lstrlenA (lpString="*.zip") returned 5 [0060.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0060.774] lstrlenA (lpString="*.rar") returned 5 [0060.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0060.774] lstrlenA (lpString="*.7z") returned 4 [0060.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0060.774] lstrlenA (lpString="*.tar") returned 5 [0060.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0060.774] lstrlenA (lpString="*.gzip") returned 6 [0060.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0060.774] lstrlenA (lpString="*.jpg") returned 5 [0060.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0060.774] lstrlenA (lpString="*.jpeg") returned 6 [0060.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0060.774] lstrlenA (lpString="*.psd") returned 5 [0060.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.gif") returned 0 [0060.774] lstrlenA (lpString="*.gif") returned 5 [0060.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.doc") returned 0 [0060.774] lstrlenA (lpString="*.doc") returned 5 [0060.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.docx") returned 0 [0060.774] lstrlenA (lpString="*.docx") returned 6 [0060.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.xls") returned 0 [0060.774] lstrlenA (lpString="*.xls") returned 5 [0060.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.xlsx") returned 0 [0060.774] lstrlenA (lpString="*.xlsx") returned 6 [0060.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.ppt") returned 0 [0060.774] lstrlenA (lpString="*.ppt") returned 5 [0060.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.pptx") returned 0 [0060.775] lstrlenA (lpString="*.pptx") returned 6 [0060.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.pdf") returned 0 [0060.775] lstrlenA (lpString="*.pdf") returned 5 [0060.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.mov") returned 0 [0060.775] lstrlenA (lpString="*.mov") returned 5 [0060.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.m2v") returned 0 [0060.775] lstrlenA (lpString="*.m2v") returned 5 [0060.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.3gp") returned 0 [0060.775] lstrlenA (lpString="*.3gp") returned 5 [0060.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.mpeg") returned 0 [0060.775] lstrlenA (lpString="*.mpeg") returned 6 [0060.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.mpg") returned 0 [0060.775] lstrlenA (lpString="*.mpg") returned 5 [0060.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.flv") returned 0 [0060.775] lstrlenA (lpString="*.flv") returned 5 [0060.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.avi") returned 0 [0060.775] lstrlenA (lpString="*.avi") returned 5 [0060.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.mp4") returned 0 [0060.775] lstrlenA (lpString="*.mp4") returned 5 [0060.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.wmv") returned 0 [0060.775] lstrlenA (lpString="*.wmv") returned 5 [0060.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.divx") returned 0 [0060.775] lstrlenA (lpString="*.divx") returned 6 [0060.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.mkv") returned 0 [0060.775] lstrlenA (lpString="*.mkv") returned 5 [0060.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.mp3") returned 0 [0060.775] lstrlenA (lpString="*.mp3") returned 5 [0060.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.wav") returned 0 [0060.776] lstrlenA (lpString="*.wav") returned 5 [0060.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.flac") returned 0 [0060.776] lstrlenA (lpString="*.flac") returned 6 [0060.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.ape") returned 0 [0060.776] lstrlenA (lpString="*.ape") returned 5 [0060.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.wma") returned 0 [0060.776] lstrlenA (lpString="*.wma") returned 5 [0060.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.ac3") returned 0 [0060.776] lstrlenA (lpString="*.ac3") returned 5 [0060.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", pszSpec="*.mxf") returned 0 [0060.776] lstrlenA (lpString="*.mxf") returned 5 [0060.776] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72f61e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataViewIconImages.jpg", cAlternateFileName="DATAVI~1.JPG")) returned 1 [0060.776] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.776] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DataViewIconImages.jpg") returned 1 [0060.776] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DataViewIconImages.jpg") returned 1 [0060.776] lstrcmpiA (lpString1="", lpString2="DataViewIconImages.jpg") returned -1 [0060.776] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp") returned="DataListIconImagesMask.bmp" [0060.776] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.776] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.776] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.776] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.776] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="DataViewIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" [0060.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", pszSpec="*.zip") returned 0 [0060.777] lstrlenA (lpString="*.zip") returned 5 [0060.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", pszSpec="*.rar") returned 0 [0060.777] lstrlenA (lpString="*.rar") returned 5 [0060.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", pszSpec="*.7z") returned 0 [0060.777] lstrlenA (lpString="*.7z") returned 4 [0060.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", pszSpec="*.tar") returned 0 [0060.777] lstrlenA (lpString="*.tar") returned 5 [0060.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", pszSpec="*.gzip") returned 0 [0060.777] lstrlenA (lpString="*.gzip") returned 6 [0060.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", pszSpec="*.jpg") returned 1 [0060.777] lstrlenA (lpString="*.jpg") returned 5 [0060.777] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" [0060.777] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" [0060.777] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg." [0060.777] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg.wannacry" [0060.777] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.779] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16c7 [0060.779] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x72f61e00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x606ee510, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x72f61e00, dwHighDateTime=0x1c747ea)) returned 1 [0060.779] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.779] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1649, lpOverlapped=0x0) returned 1 [0060.781] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg") returned="DataViewIconImages.jpg" [0060.781] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.781] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1649, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1649, lpOverlapped=0x0) returned 1 [0060.781] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.781] CloseHandle (hObject=0x90) returned 1 [0060.781] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg.wannacry")) returned 1 [0060.782] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72f61e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="DataViewIconImagesMask.bmp", cAlternateFileName="DATAVI~1.BMP")) returned 1 [0060.782] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.783] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DataViewIconImagesMask.bmp") returned 1 [0060.783] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DataViewIconImagesMask.bmp") returned 1 [0060.783] lstrcmpiA (lpString1="", lpString2="DataViewIconImagesMask.bmp") returned -1 [0060.783] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg") returned="DataViewIconImages.jpg" [0060.783] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.783] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.783] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.783] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.783] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="DataViewIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp" [0060.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0060.783] lstrlenA (lpString="*.zip") returned 5 [0060.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0060.783] lstrlenA (lpString="*.rar") returned 5 [0060.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0060.783] lstrlenA (lpString="*.7z") returned 4 [0060.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0060.783] lstrlenA (lpString="*.tar") returned 5 [0060.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0060.783] lstrlenA (lpString="*.gzip") returned 6 [0060.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0060.783] lstrlenA (lpString="*.jpg") returned 5 [0060.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0060.784] lstrlenA (lpString="*.jpeg") returned 6 [0060.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0060.784] lstrlenA (lpString="*.psd") returned 5 [0060.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.gif") returned 0 [0060.784] lstrlenA (lpString="*.gif") returned 5 [0060.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.doc") returned 0 [0060.784] lstrlenA (lpString="*.doc") returned 5 [0060.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.docx") returned 0 [0060.784] lstrlenA (lpString="*.docx") returned 6 [0060.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.xls") returned 0 [0060.784] lstrlenA (lpString="*.xls") returned 5 [0060.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.xlsx") returned 0 [0060.784] lstrlenA (lpString="*.xlsx") returned 6 [0060.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.ppt") returned 0 [0060.784] lstrlenA (lpString="*.ppt") returned 5 [0060.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.pptx") returned 0 [0060.784] lstrlenA (lpString="*.pptx") returned 6 [0060.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.pdf") returned 0 [0060.784] lstrlenA (lpString="*.pdf") returned 5 [0060.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.mov") returned 0 [0060.784] lstrlenA (lpString="*.mov") returned 5 [0060.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.m2v") returned 0 [0060.784] lstrlenA (lpString="*.m2v") returned 5 [0060.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.3gp") returned 0 [0060.784] lstrlenA (lpString="*.3gp") returned 5 [0060.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.mpeg") returned 0 [0060.784] lstrlenA (lpString="*.mpeg") returned 6 [0060.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.mpg") returned 0 [0060.785] lstrlenA (lpString="*.mpg") returned 5 [0060.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.flv") returned 0 [0060.785] lstrlenA (lpString="*.flv") returned 5 [0060.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.avi") returned 0 [0060.785] lstrlenA (lpString="*.avi") returned 5 [0060.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.mp4") returned 0 [0060.785] lstrlenA (lpString="*.mp4") returned 5 [0060.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.wmv") returned 0 [0060.785] lstrlenA (lpString="*.wmv") returned 5 [0060.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.divx") returned 0 [0060.785] lstrlenA (lpString="*.divx") returned 6 [0060.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.mkv") returned 0 [0060.785] lstrlenA (lpString="*.mkv") returned 5 [0060.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.mp3") returned 0 [0060.785] lstrlenA (lpString="*.mp3") returned 5 [0060.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.wav") returned 0 [0060.785] lstrlenA (lpString="*.wav") returned 5 [0060.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.flac") returned 0 [0060.785] lstrlenA (lpString="*.flac") returned 6 [0060.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.ape") returned 0 [0060.785] lstrlenA (lpString="*.ape") returned 5 [0060.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.wma") returned 0 [0060.785] lstrlenA (lpString="*.wma") returned 5 [0060.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.ac3") returned 0 [0060.785] lstrlenA (lpString="*.ac3") returned 5 [0060.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.mxf") returned 0 [0060.786] lstrlenA (lpString="*.mxf") returned 5 [0060.786] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72f61e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2eaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiscussionToolIconImages.jpg", cAlternateFileName="DISCUS~1.JPG")) returned 1 [0060.786] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.786] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiscussionToolIconImages.jpg") returned 1 [0060.786] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiscussionToolIconImages.jpg") returned 1 [0060.786] lstrcmpiA (lpString1="", lpString2="DiscussionToolIconImages.jpg") returned -1 [0060.786] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp") returned="DataViewIconImagesMask.bmp" [0060.786] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.786] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.786] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="DiscussionToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" [0060.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", pszSpec="*.zip") returned 0 [0060.786] lstrlenA (lpString="*.zip") returned 5 [0060.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", pszSpec="*.rar") returned 0 [0060.786] lstrlenA (lpString="*.rar") returned 5 [0060.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", pszSpec="*.7z") returned 0 [0060.786] lstrlenA (lpString="*.7z") returned 4 [0060.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", pszSpec="*.tar") returned 0 [0060.786] lstrlenA (lpString="*.tar") returned 5 [0060.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", pszSpec="*.gzip") returned 0 [0060.786] lstrlenA (lpString="*.gzip") returned 6 [0060.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", pszSpec="*.jpg") returned 1 [0060.787] lstrlenA (lpString="*.jpg") returned 5 [0060.787] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" [0060.787] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" [0060.787] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg." [0060.787] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg.wannacry" [0060.787] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.788] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2eaf [0060.789] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x72f61e00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x607d2d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x72f61e00, dwHighDateTime=0x1c747ea)) returned 1 [0060.789] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.789] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2e31, lpOverlapped=0x0) returned 1 [0060.791] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg") returned="DiscussionToolIconImages.jpg" [0060.791] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.791] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2e31, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2e31, lpOverlapped=0x0) returned 1 [0060.791] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.791] CloseHandle (hObject=0x90) returned 1 [0060.791] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg.wannacry")) returned 1 [0060.792] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72f61e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="DiscussionToolIconImagesMask.bmp", cAlternateFileName="DISCUS~1.BMP")) returned 1 [0060.792] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.792] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiscussionToolIconImagesMask.bmp") returned 1 [0060.792] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiscussionToolIconImagesMask.bmp") returned 1 [0060.792] lstrcmpiA (lpString1="", lpString2="DiscussionToolIconImagesMask.bmp") returned -1 [0060.793] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg") returned="DiscussionToolIconImages.jpg" [0060.793] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.793] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.793] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.793] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.793] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="DiscussionToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp" [0060.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0060.793] lstrlenA (lpString="*.zip") returned 5 [0060.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0060.793] lstrlenA (lpString="*.rar") returned 5 [0060.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0060.793] lstrlenA (lpString="*.7z") returned 4 [0060.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0060.793] lstrlenA (lpString="*.tar") returned 5 [0060.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0060.793] lstrlenA (lpString="*.gzip") returned 6 [0060.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0060.793] lstrlenA (lpString="*.jpg") returned 5 [0060.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0060.793] lstrlenA (lpString="*.jpeg") returned 6 [0060.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0060.794] lstrlenA (lpString="*.psd") returned 5 [0060.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.gif") returned 0 [0060.794] lstrlenA (lpString="*.gif") returned 5 [0060.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.doc") returned 0 [0060.794] lstrlenA (lpString="*.doc") returned 5 [0060.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.docx") returned 0 [0060.794] lstrlenA (lpString="*.docx") returned 6 [0060.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.xls") returned 0 [0060.794] lstrlenA (lpString="*.xls") returned 5 [0060.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.xlsx") returned 0 [0060.794] lstrlenA (lpString="*.xlsx") returned 6 [0060.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.ppt") returned 0 [0060.794] lstrlenA (lpString="*.ppt") returned 5 [0060.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.pptx") returned 0 [0060.794] lstrlenA (lpString="*.pptx") returned 6 [0060.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.pdf") returned 0 [0060.794] lstrlenA (lpString="*.pdf") returned 5 [0060.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.mov") returned 0 [0060.794] lstrlenA (lpString="*.mov") returned 5 [0060.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.m2v") returned 0 [0060.794] lstrlenA (lpString="*.m2v") returned 5 [0060.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.3gp") returned 0 [0060.794] lstrlenA (lpString="*.3gp") returned 5 [0060.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.mpeg") returned 0 [0060.794] lstrlenA (lpString="*.mpeg") returned 6 [0060.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.mpg") returned 0 [0060.795] lstrlenA (lpString="*.mpg") returned 5 [0060.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.flv") returned 0 [0060.795] lstrlenA (lpString="*.flv") returned 5 [0060.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.avi") returned 0 [0060.795] lstrlenA (lpString="*.avi") returned 5 [0060.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.mp4") returned 0 [0060.795] lstrlenA (lpString="*.mp4") returned 5 [0060.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.wmv") returned 0 [0060.795] lstrlenA (lpString="*.wmv") returned 5 [0060.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.divx") returned 0 [0060.795] lstrlenA (lpString="*.divx") returned 6 [0060.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.mkv") returned 0 [0060.795] lstrlenA (lpString="*.mkv") returned 5 [0060.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.mp3") returned 0 [0060.795] lstrlenA (lpString="*.mp3") returned 5 [0060.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.wav") returned 0 [0060.795] lstrlenA (lpString="*.wav") returned 5 [0060.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.flac") returned 0 [0060.795] lstrlenA (lpString="*.flac") returned 6 [0060.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.ape") returned 0 [0060.795] lstrlenA (lpString="*.ape") returned 5 [0060.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.wma") returned 0 [0060.795] lstrlenA (lpString="*.wma") returned 5 [0060.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.ac3") returned 0 [0060.795] lstrlenA (lpString="*.ac3") returned 5 [0060.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.mxf") returned 0 [0060.796] lstrlenA (lpString="*.mxf") returned 5 [0060.796] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72f61e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2a0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Form_StatusImage.jpg", cAlternateFileName="FORM_S~1.JPG")) returned 1 [0060.796] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.796] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Form_StatusImage.jpg") returned -1 [0060.796] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Form_StatusImage.jpg") returned 1 [0060.796] lstrcmpiA (lpString1="", lpString2="Form_StatusImage.jpg") returned -1 [0060.796] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp") returned="DiscussionToolIconImagesMask.bmp" [0060.796] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.796] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.796] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.796] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.796] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="Form_StatusImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" [0060.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", pszSpec="*.zip") returned 0 [0060.796] lstrlenA (lpString="*.zip") returned 5 [0060.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", pszSpec="*.rar") returned 0 [0060.796] lstrlenA (lpString="*.rar") returned 5 [0060.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", pszSpec="*.7z") returned 0 [0060.796] lstrlenA (lpString="*.7z") returned 4 [0060.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", pszSpec="*.tar") returned 0 [0060.796] lstrlenA (lpString="*.tar") returned 5 [0060.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", pszSpec="*.gzip") returned 0 [0060.796] lstrlenA (lpString="*.gzip") returned 6 [0060.796] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", pszSpec="*.jpg") returned 1 [0060.797] lstrlenA (lpString="*.jpg") returned 5 [0060.797] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" [0060.797] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" [0060.797] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg." [0060.797] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg.wannacry" [0060.797] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.798] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a0f [0060.798] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x72f61e00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528d0030, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x72f61e00, dwHighDateTime=0x1c747ea)) returned 1 [0060.798] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.798] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2991, lpOverlapped=0x0) returned 1 [0060.800] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg") returned="Form_StatusImage.jpg" [0060.800] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.800] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2991, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2991, lpOverlapped=0x0) returned 1 [0060.801] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.801] CloseHandle (hObject=0x90) returned 1 [0060.801] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg.wannacry")) returned 1 [0060.802] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74274b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3618, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="Form_StatusImageMask.bmp", cAlternateFileName="FORM_S~1.BMP")) returned 1 [0060.802] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.802] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Form_StatusImageMask.bmp") returned -1 [0060.802] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Form_StatusImageMask.bmp") returned 1 [0060.802] lstrcmpiA (lpString1="", lpString2="Form_StatusImageMask.bmp") returned -1 [0060.802] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg") returned="Form_StatusImage.jpg" [0060.802] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.802] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.802] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.802] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.802] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="Form_StatusImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp" [0060.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.zip") returned 0 [0060.803] lstrlenA (lpString="*.zip") returned 5 [0060.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.rar") returned 0 [0060.803] lstrlenA (lpString="*.rar") returned 5 [0060.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.7z") returned 0 [0060.803] lstrlenA (lpString="*.7z") returned 4 [0060.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.tar") returned 0 [0060.803] lstrlenA (lpString="*.tar") returned 5 [0060.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.gzip") returned 0 [0060.803] lstrlenA (lpString="*.gzip") returned 6 [0060.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.jpg") returned 0 [0060.803] lstrlenA (lpString="*.jpg") returned 5 [0060.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.jpeg") returned 0 [0060.803] lstrlenA (lpString="*.jpeg") returned 6 [0060.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.psd") returned 0 [0060.803] lstrlenA (lpString="*.psd") returned 5 [0060.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.gif") returned 0 [0060.803] lstrlenA (lpString="*.gif") returned 5 [0060.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.doc") returned 0 [0060.803] lstrlenA (lpString="*.doc") returned 5 [0060.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.docx") returned 0 [0060.804] lstrlenA (lpString="*.docx") returned 6 [0060.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.xls") returned 0 [0060.804] lstrlenA (lpString="*.xls") returned 5 [0060.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.xlsx") returned 0 [0060.804] lstrlenA (lpString="*.xlsx") returned 6 [0060.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.ppt") returned 0 [0060.804] lstrlenA (lpString="*.ppt") returned 5 [0060.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.pptx") returned 0 [0060.804] lstrlenA (lpString="*.pptx") returned 6 [0060.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.pdf") returned 0 [0060.804] lstrlenA (lpString="*.pdf") returned 5 [0060.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.mov") returned 0 [0060.804] lstrlenA (lpString="*.mov") returned 5 [0060.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.m2v") returned 0 [0060.804] lstrlenA (lpString="*.m2v") returned 5 [0060.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.3gp") returned 0 [0060.804] lstrlenA (lpString="*.3gp") returned 5 [0060.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.mpeg") returned 0 [0060.804] lstrlenA (lpString="*.mpeg") returned 6 [0060.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.mpg") returned 0 [0060.804] lstrlenA (lpString="*.mpg") returned 5 [0060.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.flv") returned 0 [0060.804] lstrlenA (lpString="*.flv") returned 5 [0060.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.avi") returned 0 [0060.804] lstrlenA (lpString="*.avi") returned 5 [0060.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.mp4") returned 0 [0060.804] lstrlenA (lpString="*.mp4") returned 5 [0060.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.wmv") returned 0 [0060.805] lstrlenA (lpString="*.wmv") returned 5 [0060.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.divx") returned 0 [0060.805] lstrlenA (lpString="*.divx") returned 6 [0060.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.mkv") returned 0 [0060.805] lstrlenA (lpString="*.mkv") returned 5 [0060.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.mp3") returned 0 [0060.805] lstrlenA (lpString="*.mp3") returned 5 [0060.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.wav") returned 0 [0060.805] lstrlenA (lpString="*.wav") returned 5 [0060.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.flac") returned 0 [0060.805] lstrlenA (lpString="*.flac") returned 6 [0060.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.ape") returned 0 [0060.805] lstrlenA (lpString="*.ape") returned 5 [0060.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.wma") returned 0 [0060.805] lstrlenA (lpString="*.wma") returned 5 [0060.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.ac3") returned 0 [0060.805] lstrlenA (lpString="*.ac3") returned 5 [0060.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.mxf") returned 0 [0060.805] lstrlenA (lpString="*.mxf") returned 5 [0060.805] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61c0e850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74274b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1d29, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRIP.JPG", cAlternateFileName="")) returned 1 [0060.805] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.805] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GRIP.JPG") returned -1 [0060.805] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GRIP.JPG") returned 1 [0060.805] lstrcmpiA (lpString1="", lpString2="GRIP.JPG") returned -1 [0060.805] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp") returned="Form_StatusImageMask.bmp" [0060.805] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.806] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.806] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.806] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.806] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="GRIP.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" [0060.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", pszSpec="*.zip") returned 0 [0060.806] lstrlenA (lpString="*.zip") returned 5 [0060.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", pszSpec="*.rar") returned 0 [0060.806] lstrlenA (lpString="*.rar") returned 5 [0060.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", pszSpec="*.7z") returned 0 [0060.806] lstrlenA (lpString="*.7z") returned 4 [0060.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", pszSpec="*.tar") returned 0 [0060.806] lstrlenA (lpString="*.tar") returned 5 [0060.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", pszSpec="*.gzip") returned 0 [0060.806] lstrlenA (lpString="*.gzip") returned 6 [0060.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", pszSpec="*.jpg") returned 1 [0060.806] lstrlenA (lpString="*.jpg") returned 5 [0060.806] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" [0060.806] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" [0060.806] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG." [0060.806] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG.wannacry" [0060.806] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.808] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d29 [0060.808] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x74274b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61c0e850, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x74274b00, dwHighDateTime=0x1c747ea)) returned 1 [0060.808] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.808] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1cab, lpOverlapped=0x0) returned 1 [0060.810] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG") returned="GRIP.JPG" [0060.810] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.810] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1cab, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1cab, lpOverlapped=0x0) returned 1 [0060.811] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.811] CloseHandle (hObject=0x90) returned 1 [0060.811] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg.wannacry")) returned 1 [0060.812] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61c0e850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74274b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc38, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="GRIPMASK.BMP", cAlternateFileName="")) returned 1 [0060.812] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.812] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GRIPMASK.BMP") returned -1 [0060.812] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GRIPMASK.BMP") returned 1 [0060.812] lstrcmpiA (lpString1="", lpString2="GRIPMASK.BMP") returned -1 [0060.812] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG") returned="GRIP.JPG" [0060.812] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.812] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.812] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.812] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.812] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="GRIPMASK.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP" [0060.812] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.zip") returned 0 [0060.812] lstrlenA (lpString="*.zip") returned 5 [0060.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.rar") returned 0 [0060.813] lstrlenA (lpString="*.rar") returned 5 [0060.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.7z") returned 0 [0060.813] lstrlenA (lpString="*.7z") returned 4 [0060.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.tar") returned 0 [0060.813] lstrlenA (lpString="*.tar") returned 5 [0060.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.gzip") returned 0 [0060.813] lstrlenA (lpString="*.gzip") returned 6 [0060.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.jpg") returned 0 [0060.813] lstrlenA (lpString="*.jpg") returned 5 [0060.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.jpeg") returned 0 [0060.813] lstrlenA (lpString="*.jpeg") returned 6 [0060.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.psd") returned 0 [0060.813] lstrlenA (lpString="*.psd") returned 5 [0060.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.gif") returned 0 [0060.813] lstrlenA (lpString="*.gif") returned 5 [0060.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.doc") returned 0 [0060.813] lstrlenA (lpString="*.doc") returned 5 [0060.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.docx") returned 0 [0060.813] lstrlenA (lpString="*.docx") returned 6 [0060.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.xls") returned 0 [0060.813] lstrlenA (lpString="*.xls") returned 5 [0060.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.xlsx") returned 0 [0060.813] lstrlenA (lpString="*.xlsx") returned 6 [0060.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.ppt") returned 0 [0060.814] lstrlenA (lpString="*.ppt") returned 5 [0060.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.pptx") returned 0 [0060.814] lstrlenA (lpString="*.pptx") returned 6 [0060.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.pdf") returned 0 [0060.814] lstrlenA (lpString="*.pdf") returned 5 [0060.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.mov") returned 0 [0060.814] lstrlenA (lpString="*.mov") returned 5 [0060.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.m2v") returned 0 [0060.814] lstrlenA (lpString="*.m2v") returned 5 [0060.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.3gp") returned 0 [0060.814] lstrlenA (lpString="*.3gp") returned 5 [0060.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.mpeg") returned 0 [0060.814] lstrlenA (lpString="*.mpeg") returned 6 [0060.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.mpg") returned 0 [0060.814] lstrlenA (lpString="*.mpg") returned 5 [0060.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.flv") returned 0 [0060.814] lstrlenA (lpString="*.flv") returned 5 [0060.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.avi") returned 0 [0060.814] lstrlenA (lpString="*.avi") returned 5 [0060.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.mp4") returned 0 [0060.814] lstrlenA (lpString="*.mp4") returned 5 [0060.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.wmv") returned 0 [0060.814] lstrlenA (lpString="*.wmv") returned 5 [0060.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.divx") returned 0 [0060.814] lstrlenA (lpString="*.divx") returned 6 [0060.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.mkv") returned 0 [0060.815] lstrlenA (lpString="*.mkv") returned 5 [0060.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.mp3") returned 0 [0060.815] lstrlenA (lpString="*.mp3") returned 5 [0060.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.wav") returned 0 [0060.815] lstrlenA (lpString="*.wav") returned 5 [0060.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.flac") returned 0 [0060.815] lstrlenA (lpString="*.flac") returned 6 [0060.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.ape") returned 0 [0060.815] lstrlenA (lpString="*.ape") returned 5 [0060.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.wma") returned 0 [0060.815] lstrlenA (lpString="*.wma") returned 5 [0060.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.ac3") returned 0 [0060.815] lstrlenA (lpString="*.ac3") returned 5 [0060.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.mxf") returned 0 [0060.815] lstrlenA (lpString="*.mxf") returned 5 [0060.815] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74274b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="InformationIcon.jpg", cAlternateFileName="INFORM~1.JPG")) returned 1 [0060.815] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.815] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InformationIcon.jpg") returned -1 [0060.815] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InformationIcon.jpg") returned -1 [0060.815] lstrcmpiA (lpString1="", lpString2="InformationIcon.jpg") returned -1 [0060.815] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP") returned="GRIPMASK.BMP" [0060.815] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.815] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.815] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.815] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.816] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="InformationIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" [0060.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", pszSpec="*.zip") returned 0 [0060.816] lstrlenA (lpString="*.zip") returned 5 [0060.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", pszSpec="*.rar") returned 0 [0060.816] lstrlenA (lpString="*.rar") returned 5 [0060.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", pszSpec="*.7z") returned 0 [0060.816] lstrlenA (lpString="*.7z") returned 4 [0060.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", pszSpec="*.tar") returned 0 [0060.816] lstrlenA (lpString="*.tar") returned 5 [0060.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", pszSpec="*.gzip") returned 0 [0060.816] lstrlenA (lpString="*.gzip") returned 6 [0060.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", pszSpec="*.jpg") returned 1 [0060.816] lstrlenA (lpString="*.jpg") returned 5 [0060.816] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" [0060.816] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" [0060.816] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg." [0060.816] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg.wannacry" [0060.816] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.818] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbe5 [0060.818] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x74274b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61cf3090, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x74274b00, dwHighDateTime=0x1c747ea)) returned 1 [0060.818] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.818] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xb67, lpOverlapped=0x0) returned 1 [0060.820] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg") returned="InformationIcon.jpg" [0060.820] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.820] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xb67, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xb67, lpOverlapped=0x0) returned 1 [0060.821] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.821] CloseHandle (hObject=0x90) returned 1 [0060.821] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg.wannacry")) returned 1 [0060.822] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74274b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="InformationIconMask.bmp", cAlternateFileName="INFORM~1.BMP")) returned 1 [0060.822] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.822] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InformationIconMask.bmp") returned -1 [0060.822] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InformationIconMask.bmp") returned -1 [0060.822] lstrcmpiA (lpString1="", lpString2="InformationIconMask.bmp") returned -1 [0060.822] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg") returned="InformationIcon.jpg" [0060.822] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.822] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.822] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.822] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.822] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="InformationIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp" [0060.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.zip") returned 0 [0060.823] lstrlenA (lpString="*.zip") returned 5 [0060.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.rar") returned 0 [0060.823] lstrlenA (lpString="*.rar") returned 5 [0060.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.7z") returned 0 [0060.823] lstrlenA (lpString="*.7z") returned 4 [0060.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.tar") returned 0 [0060.823] lstrlenA (lpString="*.tar") returned 5 [0060.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.gzip") returned 0 [0060.823] lstrlenA (lpString="*.gzip") returned 6 [0060.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.jpg") returned 0 [0060.823] lstrlenA (lpString="*.jpg") returned 5 [0060.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.jpeg") returned 0 [0060.823] lstrlenA (lpString="*.jpeg") returned 6 [0060.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.psd") returned 0 [0060.823] lstrlenA (lpString="*.psd") returned 5 [0060.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.gif") returned 0 [0060.823] lstrlenA (lpString="*.gif") returned 5 [0060.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.doc") returned 0 [0060.823] lstrlenA (lpString="*.doc") returned 5 [0060.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.docx") returned 0 [0060.823] lstrlenA (lpString="*.docx") returned 6 [0060.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.xls") returned 0 [0060.823] lstrlenA (lpString="*.xls") returned 5 [0060.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.xlsx") returned 0 [0060.823] lstrlenA (lpString="*.xlsx") returned 6 [0060.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.ppt") returned 0 [0060.823] lstrlenA (lpString="*.ppt") returned 5 [0060.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.pptx") returned 0 [0060.824] lstrlenA (lpString="*.pptx") returned 6 [0060.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.pdf") returned 0 [0060.824] lstrlenA (lpString="*.pdf") returned 5 [0060.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.mov") returned 0 [0060.824] lstrlenA (lpString="*.mov") returned 5 [0060.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.m2v") returned 0 [0060.824] lstrlenA (lpString="*.m2v") returned 5 [0060.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.3gp") returned 0 [0060.824] lstrlenA (lpString="*.3gp") returned 5 [0060.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.mpeg") returned 0 [0060.824] lstrlenA (lpString="*.mpeg") returned 6 [0060.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.mpg") returned 0 [0060.824] lstrlenA (lpString="*.mpg") returned 5 [0060.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.flv") returned 0 [0060.824] lstrlenA (lpString="*.flv") returned 5 [0060.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.avi") returned 0 [0060.824] lstrlenA (lpString="*.avi") returned 5 [0060.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.mp4") returned 0 [0060.824] lstrlenA (lpString="*.mp4") returned 5 [0060.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.wmv") returned 0 [0060.824] lstrlenA (lpString="*.wmv") returned 5 [0060.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.divx") returned 0 [0060.824] lstrlenA (lpString="*.divx") returned 6 [0060.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.mkv") returned 0 [0060.824] lstrlenA (lpString="*.mkv") returned 5 [0060.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.mp3") returned 0 [0060.824] lstrlenA (lpString="*.mp3") returned 5 [0060.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.wav") returned 0 [0060.825] lstrlenA (lpString="*.wav") returned 5 [0060.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.flac") returned 0 [0060.825] lstrlenA (lpString="*.flac") returned 6 [0060.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.ape") returned 0 [0060.825] lstrlenA (lpString="*.ape") returned 5 [0060.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.wma") returned 0 [0060.825] lstrlenA (lpString="*.wma") returned 5 [0060.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.ac3") returned 0 [0060.825] lstrlenA (lpString="*.ac3") returned 5 [0060.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.mxf") returned 0 [0060.825] lstrlenA (lpString="*.mxf") returned 5 [0060.825] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x675aa300, ftCreationTime.dwHighDateTime=0x1c9f921, ftLastAccessTime.dwLowDateTime=0x581a1510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x675aa300, ftLastWriteTime.dwHighDateTime=0x1c9f921, nFileSizeHigh=0x0, nFileSizeLow=0xceed, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoginDialogBackground.jpg", cAlternateFileName="LOGIND~1.JPG")) returned 1 [0060.825] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.825] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LoginDialogBackground.jpg") returned -1 [0060.825] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LoginDialogBackground.jpg") returned -1 [0060.825] lstrcmpiA (lpString1="", lpString2="LoginDialogBackground.jpg") returned -1 [0060.825] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp") returned="InformationIconMask.bmp" [0060.825] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.825] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.825] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.825] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.825] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="LoginDialogBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" [0060.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", pszSpec="*.zip") returned 0 [0060.826] lstrlenA (lpString="*.zip") returned 5 [0060.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", pszSpec="*.rar") returned 0 [0060.826] lstrlenA (lpString="*.rar") returned 5 [0060.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", pszSpec="*.7z") returned 0 [0060.826] lstrlenA (lpString="*.7z") returned 4 [0060.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", pszSpec="*.tar") returned 0 [0060.826] lstrlenA (lpString="*.tar") returned 5 [0060.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", pszSpec="*.gzip") returned 0 [0060.826] lstrlenA (lpString="*.gzip") returned 6 [0060.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", pszSpec="*.jpg") returned 1 [0060.826] lstrlenA (lpString="*.jpg") returned 5 [0060.826] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" [0060.826] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" [0060.826] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg." [0060.826] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.wannacry" [0060.826] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.827] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xceed [0060.827] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x675aa300, dwHighDateTime=0x1c9f921), lpLastAccessTime=0x407536*(dwLowDateTime=0x581a1510, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x675aa300, dwHighDateTime=0x1c9f921)) returned 1 [0060.827] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.827] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xce6f, lpOverlapped=0x0) returned 1 [0060.830] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg") returned="LoginDialogBackground.jpg" [0060.830] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.830] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xce6f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xce6f, lpOverlapped=0x0) returned 1 [0060.830] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.831] CloseHandle (hObject=0x90) returned 1 [0060.831] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg.wannacry")) returned 1 [0060.832] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e93, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="LoginTool24x24Images.jpg", cAlternateFileName="LOGINT~1.JPG")) returned 1 [0060.832] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.832] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LoginTool24x24Images.jpg") returned -1 [0060.832] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LoginTool24x24Images.jpg") returned -1 [0060.832] lstrcmpiA (lpString1="", lpString2="LoginTool24x24Images.jpg") returned -1 [0060.832] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg") returned="LoginDialogBackground.jpg" [0060.832] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.832] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.832] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.832] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.832] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="LoginTool24x24Images.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" [0060.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", pszSpec="*.zip") returned 0 [0060.832] lstrlenA (lpString="*.zip") returned 5 [0060.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", pszSpec="*.rar") returned 0 [0060.832] lstrlenA (lpString="*.rar") returned 5 [0060.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", pszSpec="*.7z") returned 0 [0060.833] lstrlenA (lpString="*.7z") returned 4 [0060.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", pszSpec="*.tar") returned 0 [0060.833] lstrlenA (lpString="*.tar") returned 5 [0060.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", pszSpec="*.gzip") returned 0 [0060.833] lstrlenA (lpString="*.gzip") returned 6 [0060.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", pszSpec="*.jpg") returned 1 [0060.833] lstrlenA (lpString="*.jpg") returned 5 [0060.833] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" [0060.833] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" [0060.833] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg." [0060.833] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.wannacry" [0060.833] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.834] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e93 [0060.835] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x695e6e70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea)) returned 1 [0060.835] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.835] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1e15, lpOverlapped=0x0) returned 1 [0060.836] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg") returned="LoginTool24x24Images.jpg" [0060.837] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.837] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1e15, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1e15, lpOverlapped=0x0) returned 1 [0060.837] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.837] CloseHandle (hObject=0x90) returned 1 [0060.837] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg.wannacry")) returned 1 [0060.838] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xaf8, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="LoginTool24x24ImagesMask.bmp", cAlternateFileName="LOGINT~1.BMP")) returned 1 [0060.838] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.838] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LoginTool24x24ImagesMask.bmp") returned -1 [0060.838] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LoginTool24x24ImagesMask.bmp") returned -1 [0060.838] lstrcmpiA (lpString1="", lpString2="LoginTool24x24ImagesMask.bmp") returned -1 [0060.838] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg") returned="LoginTool24x24Images.jpg" [0060.838] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.838] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.838] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.838] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.838] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="LoginTool24x24ImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" [0060.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.zip") returned 0 [0060.839] lstrlenA (lpString="*.zip") returned 5 [0060.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.rar") returned 0 [0060.839] lstrlenA (lpString="*.rar") returned 5 [0060.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.7z") returned 0 [0060.839] lstrlenA (lpString="*.7z") returned 4 [0060.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.tar") returned 0 [0060.839] lstrlenA (lpString="*.tar") returned 5 [0060.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.gzip") returned 0 [0060.839] lstrlenA (lpString="*.gzip") returned 6 [0060.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.jpg") returned 0 [0060.839] lstrlenA (lpString="*.jpg") returned 5 [0060.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0060.839] lstrlenA (lpString="*.jpeg") returned 6 [0060.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.psd") returned 0 [0060.839] lstrlenA (lpString="*.psd") returned 5 [0060.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.gif") returned 0 [0060.839] lstrlenA (lpString="*.gif") returned 5 [0060.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.doc") returned 0 [0060.839] lstrlenA (lpString="*.doc") returned 5 [0060.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.docx") returned 0 [0060.839] lstrlenA (lpString="*.docx") returned 6 [0060.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.xls") returned 0 [0060.839] lstrlenA (lpString="*.xls") returned 5 [0060.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.xlsx") returned 0 [0060.839] lstrlenA (lpString="*.xlsx") returned 6 [0060.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.ppt") returned 0 [0060.839] lstrlenA (lpString="*.ppt") returned 5 [0060.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.pptx") returned 0 [0060.840] lstrlenA (lpString="*.pptx") returned 6 [0060.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.pdf") returned 0 [0060.840] lstrlenA (lpString="*.pdf") returned 5 [0060.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.mov") returned 0 [0060.840] lstrlenA (lpString="*.mov") returned 5 [0060.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.m2v") returned 0 [0060.840] lstrlenA (lpString="*.m2v") returned 5 [0060.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.3gp") returned 0 [0060.840] lstrlenA (lpString="*.3gp") returned 5 [0060.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.mpeg") returned 0 [0060.840] lstrlenA (lpString="*.mpeg") returned 6 [0060.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.mpg") returned 0 [0060.840] lstrlenA (lpString="*.mpg") returned 5 [0060.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.flv") returned 0 [0060.840] lstrlenA (lpString="*.flv") returned 5 [0060.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.avi") returned 0 [0060.840] lstrlenA (lpString="*.avi") returned 5 [0060.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.mp4") returned 0 [0060.840] lstrlenA (lpString="*.mp4") returned 5 [0060.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.wmv") returned 0 [0060.840] lstrlenA (lpString="*.wmv") returned 5 [0060.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.divx") returned 0 [0060.840] lstrlenA (lpString="*.divx") returned 6 [0060.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.mkv") returned 0 [0060.840] lstrlenA (lpString="*.mkv") returned 5 [0060.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.mp3") returned 0 [0060.841] lstrlenA (lpString="*.mp3") returned 5 [0060.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.wav") returned 0 [0060.841] lstrlenA (lpString="*.wav") returned 5 [0060.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.flac") returned 0 [0060.841] lstrlenA (lpString="*.flac") returned 6 [0060.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.ape") returned 0 [0060.841] lstrlenA (lpString="*.ape") returned 5 [0060.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.wma") returned 0 [0060.841] lstrlenA (lpString="*.wma") returned 5 [0060.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.ac3") returned 0 [0060.841] lstrlenA (lpString="*.ac3") returned 5 [0060.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.mxf") returned 0 [0060.841] lstrlenA (lpString="*.mxf") returned 5 [0060.841] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x25e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessageAttachmentIconImages.jpg", cAlternateFileName="MESSAG~2.JPG")) returned 1 [0060.841] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.841] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MessageAttachmentIconImages.jpg") returned -1 [0060.841] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MessageAttachmentIconImages.jpg") returned -1 [0060.841] lstrcmpiA (lpString1="", lpString2="MessageAttachmentIconImages.jpg") returned -1 [0060.841] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp") returned="LoginTool24x24ImagesMask.bmp" [0060.841] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.841] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.841] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.841] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.841] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="MessageAttachmentIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" [0060.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", pszSpec="*.zip") returned 0 [0060.842] lstrlenA (lpString="*.zip") returned 5 [0060.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", pszSpec="*.rar") returned 0 [0060.842] lstrlenA (lpString="*.rar") returned 5 [0060.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", pszSpec="*.7z") returned 0 [0060.842] lstrlenA (lpString="*.7z") returned 4 [0060.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", pszSpec="*.tar") returned 0 [0060.842] lstrlenA (lpString="*.tar") returned 5 [0060.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", pszSpec="*.gzip") returned 0 [0060.842] lstrlenA (lpString="*.gzip") returned 6 [0060.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", pszSpec="*.jpg") returned 1 [0060.842] lstrlenA (lpString="*.jpg") returned 5 [0060.842] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" [0060.842] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" [0060.842] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg." [0060.842] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.wannacry" [0060.842] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.843] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25e5 [0060.843] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x69a5d7b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea)) returned 1 [0060.843] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.843] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2567, lpOverlapped=0x0) returned 1 [0060.845] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg") returned="MessageAttachmentIconImages.jpg" [0060.845] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.845] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2567, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2567, lpOverlapped=0x0) returned 1 [0060.846] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.846] CloseHandle (hObject=0x90) returned 1 [0060.846] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg.wannacry")) returned 1 [0060.847] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="MessageAttachmentIconImagesMask.bmp", cAlternateFileName="MESSAG~1.BMP")) returned 1 [0060.847] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.847] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MessageAttachmentIconImagesMask.bmp") returned -1 [0060.847] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MessageAttachmentIconImagesMask.bmp") returned -1 [0060.847] lstrcmpiA (lpString1="", lpString2="MessageAttachmentIconImagesMask.bmp") returned -1 [0060.847] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg") returned="MessageAttachmentIconImages.jpg" [0060.847] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.847] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.847] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.847] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.847] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="MessageAttachmentIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" [0060.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0060.847] lstrlenA (lpString="*.zip") returned 5 [0060.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0060.848] lstrlenA (lpString="*.rar") returned 5 [0060.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0060.848] lstrlenA (lpString="*.7z") returned 4 [0060.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0060.848] lstrlenA (lpString="*.tar") returned 5 [0060.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0060.848] lstrlenA (lpString="*.gzip") returned 6 [0060.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0060.848] lstrlenA (lpString="*.jpg") returned 5 [0060.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0060.848] lstrlenA (lpString="*.jpeg") returned 6 [0060.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0060.848] lstrlenA (lpString="*.psd") returned 5 [0060.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.gif") returned 0 [0060.848] lstrlenA (lpString="*.gif") returned 5 [0060.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.doc") returned 0 [0060.848] lstrlenA (lpString="*.doc") returned 5 [0060.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.docx") returned 0 [0060.848] lstrlenA (lpString="*.docx") returned 6 [0060.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.xls") returned 0 [0060.848] lstrlenA (lpString="*.xls") returned 5 [0060.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.xlsx") returned 0 [0060.848] lstrlenA (lpString="*.xlsx") returned 6 [0060.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.ppt") returned 0 [0060.848] lstrlenA (lpString="*.ppt") returned 5 [0060.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.pptx") returned 0 [0060.849] lstrlenA (lpString="*.pptx") returned 6 [0060.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.pdf") returned 0 [0060.849] lstrlenA (lpString="*.pdf") returned 5 [0060.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.mov") returned 0 [0060.849] lstrlenA (lpString="*.mov") returned 5 [0060.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.m2v") returned 0 [0060.849] lstrlenA (lpString="*.m2v") returned 5 [0060.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.3gp") returned 0 [0060.849] lstrlenA (lpString="*.3gp") returned 5 [0060.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.mpeg") returned 0 [0060.849] lstrlenA (lpString="*.mpeg") returned 6 [0060.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.mpg") returned 0 [0060.849] lstrlenA (lpString="*.mpg") returned 5 [0060.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.flv") returned 0 [0060.849] lstrlenA (lpString="*.flv") returned 5 [0060.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.avi") returned 0 [0060.849] lstrlenA (lpString="*.avi") returned 5 [0060.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.mp4") returned 0 [0060.849] lstrlenA (lpString="*.mp4") returned 5 [0060.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.wmv") returned 0 [0060.849] lstrlenA (lpString="*.wmv") returned 5 [0060.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.divx") returned 0 [0060.849] lstrlenA (lpString="*.divx") returned 6 [0060.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.mkv") returned 0 [0060.849] lstrlenA (lpString="*.mkv") returned 5 [0060.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.mp3") returned 0 [0060.849] lstrlenA (lpString="*.mp3") returned 5 [0060.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.wav") returned 0 [0060.850] lstrlenA (lpString="*.wav") returned 5 [0060.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.flac") returned 0 [0060.850] lstrlenA (lpString="*.flac") returned 6 [0060.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.ape") returned 0 [0060.850] lstrlenA (lpString="*.ape") returned 5 [0060.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.wma") returned 0 [0060.850] lstrlenA (lpString="*.wma") returned 5 [0060.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.ac3") returned 0 [0060.850] lstrlenA (lpString="*.ac3") returned 5 [0060.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.mxf") returned 0 [0060.850] lstrlenA (lpString="*.mxf") returned 5 [0060.850] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x22f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessageHistoryIconImages.jpg", cAlternateFileName="MESSAG~1.JPG")) returned 1 [0060.850] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.850] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MessageHistoryIconImages.jpg") returned -1 [0060.850] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MessageHistoryIconImages.jpg") returned -1 [0060.850] lstrcmpiA (lpString1="", lpString2="MessageHistoryIconImages.jpg") returned -1 [0060.850] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp") returned="MessageAttachmentIconImagesMask.bmp" [0060.850] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.850] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.850] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.850] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.850] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="MessageHistoryIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" [0060.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", pszSpec="*.zip") returned 0 [0060.851] lstrlenA (lpString="*.zip") returned 5 [0060.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", pszSpec="*.rar") returned 0 [0060.851] lstrlenA (lpString="*.rar") returned 5 [0060.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", pszSpec="*.7z") returned 0 [0060.851] lstrlenA (lpString="*.7z") returned 4 [0060.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", pszSpec="*.tar") returned 0 [0060.851] lstrlenA (lpString="*.tar") returned 5 [0060.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", pszSpec="*.gzip") returned 0 [0060.851] lstrlenA (lpString="*.gzip") returned 6 [0060.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", pszSpec="*.jpg") returned 1 [0060.851] lstrlenA (lpString="*.jpg") returned 5 [0060.851] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" [0060.851] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" [0060.851] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg." [0060.851] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.wannacry" [0060.851] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.852] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x22f6 [0060.853] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x583906f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea)) returned 1 [0060.853] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.853] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2278, lpOverlapped=0x0) returned 1 [0060.855] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg") returned="MessageHistoryIconImages.jpg" [0060.855] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.855] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2278, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2278, lpOverlapped=0x0) returned 1 [0060.855] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.855] CloseHandle (hObject=0x90) returned 1 [0060.855] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg.wannacry")) returned 1 [0060.856] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="MessageHistoryIconImagesMask.bmp", cAlternateFileName="MESSAG~2.BMP")) returned 1 [0060.856] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.856] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MessageHistoryIconImagesMask.bmp") returned -1 [0060.856] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MessageHistoryIconImagesMask.bmp") returned -1 [0060.856] lstrcmpiA (lpString1="", lpString2="MessageHistoryIconImagesMask.bmp") returned -1 [0060.856] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg") returned="MessageHistoryIconImages.jpg" [0060.856] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.856] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.856] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.857] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.857] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="MessageHistoryIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" [0060.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0060.857] lstrlenA (lpString="*.zip") returned 5 [0060.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0060.857] lstrlenA (lpString="*.rar") returned 5 [0060.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0060.857] lstrlenA (lpString="*.7z") returned 4 [0060.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0060.857] lstrlenA (lpString="*.tar") returned 5 [0060.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0060.857] lstrlenA (lpString="*.gzip") returned 6 [0060.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0060.857] lstrlenA (lpString="*.jpg") returned 5 [0060.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0060.857] lstrlenA (lpString="*.jpeg") returned 6 [0060.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0060.857] lstrlenA (lpString="*.psd") returned 5 [0060.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.gif") returned 0 [0060.857] lstrlenA (lpString="*.gif") returned 5 [0060.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.doc") returned 0 [0060.857] lstrlenA (lpString="*.doc") returned 5 [0060.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.docx") returned 0 [0060.857] lstrlenA (lpString="*.docx") returned 6 [0060.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.xls") returned 0 [0060.858] lstrlenA (lpString="*.xls") returned 5 [0060.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.xlsx") returned 0 [0060.858] lstrlenA (lpString="*.xlsx") returned 6 [0060.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.ppt") returned 0 [0060.858] lstrlenA (lpString="*.ppt") returned 5 [0060.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.pptx") returned 0 [0060.858] lstrlenA (lpString="*.pptx") returned 6 [0060.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.pdf") returned 0 [0060.858] lstrlenA (lpString="*.pdf") returned 5 [0060.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.mov") returned 0 [0060.858] lstrlenA (lpString="*.mov") returned 5 [0060.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.m2v") returned 0 [0060.858] lstrlenA (lpString="*.m2v") returned 5 [0060.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.3gp") returned 0 [0060.858] lstrlenA (lpString="*.3gp") returned 5 [0060.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.mpeg") returned 0 [0060.858] lstrlenA (lpString="*.mpeg") returned 6 [0060.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.mpg") returned 0 [0060.858] lstrlenA (lpString="*.mpg") returned 5 [0060.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.flv") returned 0 [0060.858] lstrlenA (lpString="*.flv") returned 5 [0060.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.avi") returned 0 [0060.858] lstrlenA (lpString="*.avi") returned 5 [0060.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.mp4") returned 0 [0060.858] lstrlenA (lpString="*.mp4") returned 5 [0060.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.wmv") returned 0 [0060.859] lstrlenA (lpString="*.wmv") returned 5 [0060.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.divx") returned 0 [0060.859] lstrlenA (lpString="*.divx") returned 6 [0060.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.mkv") returned 0 [0060.859] lstrlenA (lpString="*.mkv") returned 5 [0060.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.mp3") returned 0 [0060.859] lstrlenA (lpString="*.mp3") returned 5 [0060.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.wav") returned 0 [0060.859] lstrlenA (lpString="*.wav") returned 5 [0060.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.flac") returned 0 [0060.859] lstrlenA (lpString="*.flac") returned 6 [0060.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.ape") returned 0 [0060.859] lstrlenA (lpString="*.ape") returned 5 [0060.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.wma") returned 0 [0060.859] lstrlenA (lpString="*.wma") returned 5 [0060.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.ac3") returned 0 [0060.859] lstrlenA (lpString="*.ac3") returned 5 [0060.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.mxf") returned 0 [0060.859] lstrlenA (lpString="*.mxf") returned 5 [0060.859] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46b7a400, ftCreationTime.dwHighDateTime=0x1c9e8b3, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46b7a400, ftLastWriteTime.dwHighDateTime=0x1c9e8b3, nFileSizeHigh=0x0, nFileSizeLow=0x3efd, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotifierBackground.jpg", cAlternateFileName="NOTIFI~1.JPG")) returned 1 [0060.859] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.859] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NotifierBackground.jpg") returned -1 [0060.859] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NotifierBackground.jpg") returned -1 [0060.859] lstrcmpiA (lpString1="", lpString2="NotifierBackground.jpg") returned -1 [0060.859] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp") returned="MessageHistoryIconImagesMask.bmp" [0060.859] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.860] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.860] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.860] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.860] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="NotifierBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" [0060.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", pszSpec="*.zip") returned 0 [0060.860] lstrlenA (lpString="*.zip") returned 5 [0060.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", pszSpec="*.rar") returned 0 [0060.860] lstrlenA (lpString="*.rar") returned 5 [0060.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", pszSpec="*.7z") returned 0 [0060.860] lstrlenA (lpString="*.7z") returned 4 [0060.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", pszSpec="*.tar") returned 0 [0060.860] lstrlenA (lpString="*.tar") returned 5 [0060.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", pszSpec="*.gzip") returned 0 [0060.860] lstrlenA (lpString="*.gzip") returned 6 [0060.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", pszSpec="*.jpg") returned 1 [0060.860] lstrlenA (lpString="*.jpg") returned 5 [0060.860] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" [0060.860] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" [0060.860] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg." [0060.860] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg.wannacry" [0060.860] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.862] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3efd [0060.862] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x46b7a400, dwHighDateTime=0x1c9e8b3), lpLastAccessTime=0x407536*(dwLowDateTime=0x59590d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x46b7a400, dwHighDateTime=0x1c9e8b3)) returned 1 [0060.862] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.862] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3e7f, lpOverlapped=0x0) returned 1 [0060.864] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg") returned="NotifierBackground.jpg" [0060.864] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.864] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3e7f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3e7f, lpOverlapped=0x0) returned 1 [0060.865] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.865] CloseHandle (hObject=0x90) returned 1 [0060.865] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg.wannacry")) returned 1 [0060.866] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50410c00, ftCreationTime.dwHighDateTime=0x1c9e8b3, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50410c00, ftLastWriteTime.dwHighDateTime=0x1c9e8b3, nFileSizeHigh=0x0, nFileSizeLow=0x40aa, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="NotifierBackgroundRTL.jpg", cAlternateFileName="NOTIFI~2.JPG")) returned 1 [0060.866] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.866] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NotifierBackgroundRTL.jpg") returned -1 [0060.866] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NotifierBackgroundRTL.jpg") returned -1 [0060.866] lstrcmpiA (lpString1="", lpString2="NotifierBackgroundRTL.jpg") returned -1 [0060.866] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg") returned="NotifierBackground.jpg" [0060.866] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.866] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.866] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.866] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.866] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="NotifierBackgroundRTL.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" [0060.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", pszSpec="*.zip") returned 0 [0060.867] lstrlenA (lpString="*.zip") returned 5 [0060.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", pszSpec="*.rar") returned 0 [0060.867] lstrlenA (lpString="*.rar") returned 5 [0060.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", pszSpec="*.7z") returned 0 [0060.867] lstrlenA (lpString="*.7z") returned 4 [0060.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", pszSpec="*.tar") returned 0 [0060.867] lstrlenA (lpString="*.tar") returned 5 [0060.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", pszSpec="*.gzip") returned 0 [0060.867] lstrlenA (lpString="*.gzip") returned 6 [0060.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", pszSpec="*.jpg") returned 1 [0060.867] lstrlenA (lpString="*.jpg") returned 5 [0060.867] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" [0060.867] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" [0060.867] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg." [0060.867] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.wannacry" [0060.867] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.868] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40aa [0060.868] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x50410c00, dwHighDateTime=0x1c9e8b3), lpLastAccessTime=0x407536*(dwLowDateTime=0x59590d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x50410c00, dwHighDateTime=0x1c9e8b3)) returned 1 [0060.868] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.868] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x402c, lpOverlapped=0x0) returned 1 [0060.870] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg") returned="NotifierBackgroundRTL.jpg" [0060.870] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.870] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x402c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x402c, lpOverlapped=0x0) returned 1 [0060.870] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.870] CloseHandle (hObject=0x90) returned 1 [0060.870] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg.wannacry")) returned 1 [0060.871] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79304700, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x6a513ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79304700, ftLastWriteTime.dwHighDateTime=0x1c91151, nFileSizeHigh=0x0, nFileSizeLow=0x2f2, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="NotifierCloseButton.jpg", cAlternateFileName="NO00D7~1.JPG")) returned 1 [0060.872] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.872] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NotifierCloseButton.jpg") returned -1 [0060.872] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NotifierCloseButton.jpg") returned -1 [0060.872] lstrcmpiA (lpString1="", lpString2="NotifierCloseButton.jpg") returned -1 [0060.872] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg") returned="NotifierBackgroundRTL.jpg" [0060.873] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.873] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.873] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.873] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.873] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="NotifierCloseButton.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" [0060.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", pszSpec="*.zip") returned 0 [0060.873] lstrlenA (lpString="*.zip") returned 5 [0060.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", pszSpec="*.rar") returned 0 [0060.873] lstrlenA (lpString="*.rar") returned 5 [0060.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", pszSpec="*.7z") returned 0 [0060.873] lstrlenA (lpString="*.7z") returned 4 [0060.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", pszSpec="*.tar") returned 0 [0060.873] lstrlenA (lpString="*.tar") returned 5 [0060.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", pszSpec="*.gzip") returned 0 [0060.873] lstrlenA (lpString="*.gzip") returned 6 [0060.873] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", pszSpec="*.jpg") returned 1 [0060.873] lstrlenA (lpString="*.jpg") returned 5 [0060.873] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" [0060.873] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" [0060.873] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg." [0060.873] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.wannacry" [0060.873] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.876] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f2 [0060.876] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x79304700, dwHighDateTime=0x1c91151), lpLastAccessTime=0x407536*(dwLowDateTime=0x6a513ab0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x79304700, dwHighDateTime=0x1c91151)) returned 1 [0060.876] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.876] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x274, lpOverlapped=0x0) returned 1 [0060.878] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg") returned="NotifierCloseButton.jpg" [0060.878] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.878] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x274, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x274, lpOverlapped=0x0) returned 1 [0060.879] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.879] CloseHandle (hObject=0x90) returned 1 [0060.879] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg.wannacry")) returned 1 [0060.883] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f262800, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x6a539c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f262800, ftLastWriteTime.dwHighDateTime=0x1c91151, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="NotifierDisableDownArrow.jpg", cAlternateFileName="NO74B3~1.JPG")) returned 1 [0060.883] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.883] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NotifierDisableDownArrow.jpg") returned -1 [0060.883] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NotifierDisableDownArrow.jpg") returned -1 [0060.883] lstrcmpiA (lpString1="", lpString2="NotifierDisableDownArrow.jpg") returned -1 [0060.883] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg") returned="NotifierCloseButton.jpg" [0060.883] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.883] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.883] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.883] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.883] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="NotifierDisableDownArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" [0060.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", pszSpec="*.zip") returned 0 [0060.883] lstrlenA (lpString="*.zip") returned 5 [0060.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", pszSpec="*.rar") returned 0 [0060.883] lstrlenA (lpString="*.rar") returned 5 [0060.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", pszSpec="*.7z") returned 0 [0060.884] lstrlenA (lpString="*.7z") returned 4 [0060.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", pszSpec="*.tar") returned 0 [0060.884] lstrlenA (lpString="*.tar") returned 5 [0060.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", pszSpec="*.gzip") returned 0 [0060.884] lstrlenA (lpString="*.gzip") returned 6 [0060.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", pszSpec="*.jpg") returned 1 [0060.884] lstrlenA (lpString="*.jpg") returned 5 [0060.884] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" [0060.884] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" [0060.884] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg." [0060.884] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.wannacry" [0060.884] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.885] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2cc [0060.885] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7f262800, dwHighDateTime=0x1c91151), lpLastAccessTime=0x407536*(dwLowDateTime=0x6a539c10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7f262800, dwHighDateTime=0x1c91151)) returned 1 [0060.885] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.885] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x24e, lpOverlapped=0x0) returned 1 [0060.886] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg") returned="NotifierDisableDownArrow.jpg" [0060.887] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.887] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x24e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x24e, lpOverlapped=0x0) returned 1 [0060.887] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.887] CloseHandle (hObject=0x90) returned 1 [0060.887] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg.wannacry")) returned 1 [0060.888] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b9af00, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82b9af00, ftLastWriteTime.dwHighDateTime=0x1c91151, nFileSizeHigh=0x0, nFileSizeLow=0x307, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="NotifierDisableUpArrow.jpg", cAlternateFileName="NOTIFI~3.JPG")) returned 1 [0060.888] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.888] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NotifierDisableUpArrow.jpg") returned -1 [0060.888] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NotifierDisableUpArrow.jpg") returned -1 [0060.888] lstrcmpiA (lpString1="", lpString2="NotifierDisableUpArrow.jpg") returned -1 [0060.888] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg") returned="NotifierDisableDownArrow.jpg" [0060.888] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.888] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.888] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.888] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.888] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="NotifierDisableUpArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" [0060.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", pszSpec="*.zip") returned 0 [0060.889] lstrlenA (lpString="*.zip") returned 5 [0060.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", pszSpec="*.rar") returned 0 [0060.889] lstrlenA (lpString="*.rar") returned 5 [0060.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", pszSpec="*.7z") returned 0 [0060.889] lstrlenA (lpString="*.7z") returned 4 [0060.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", pszSpec="*.tar") returned 0 [0060.889] lstrlenA (lpString="*.tar") returned 5 [0060.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", pszSpec="*.gzip") returned 0 [0060.889] lstrlenA (lpString="*.gzip") returned 6 [0060.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", pszSpec="*.jpg") returned 1 [0060.889] lstrlenA (lpString="*.jpg") returned 5 [0060.889] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" [0060.889] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" [0060.889] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg." [0060.889] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.wannacry" [0060.889] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.890] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x307 [0060.890] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x82b9af00, dwHighDateTime=0x1c91151), lpLastAccessTime=0x407536*(dwLowDateTime=0x59590d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x82b9af00, dwHighDateTime=0x1c91151)) returned 1 [0060.890] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.890] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x289, lpOverlapped=0x0) returned 1 [0060.892] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg") returned="NotifierDisableUpArrow.jpg" [0060.892] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.892] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x289, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x289, lpOverlapped=0x0) returned 1 [0060.892] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.892] CloseHandle (hObject=0x90) returned 1 [0060.892] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg.wannacry")) returned 1 [0060.893] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x864d3600, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x864d3600, ftLastWriteTime.dwHighDateTime=0x1c91151, nFileSizeHigh=0x0, nFileSizeLow=0x368, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="NotifierDownArrow.jpg", cAlternateFileName="NOTIFI~4.JPG")) returned 1 [0060.893] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.893] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NotifierDownArrow.jpg") returned -1 [0060.893] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NotifierDownArrow.jpg") returned -1 [0060.893] lstrcmpiA (lpString1="", lpString2="NotifierDownArrow.jpg") returned -1 [0060.893] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg") returned="NotifierDisableUpArrow.jpg" [0060.893] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.893] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.893] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.893] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.894] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="NotifierDownArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" [0060.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", pszSpec="*.zip") returned 0 [0060.894] lstrlenA (lpString="*.zip") returned 5 [0060.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", pszSpec="*.rar") returned 0 [0060.894] lstrlenA (lpString="*.rar") returned 5 [0060.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", pszSpec="*.7z") returned 0 [0060.894] lstrlenA (lpString="*.7z") returned 4 [0060.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", pszSpec="*.tar") returned 0 [0060.894] lstrlenA (lpString="*.tar") returned 5 [0060.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", pszSpec="*.gzip") returned 0 [0060.894] lstrlenA (lpString="*.gzip") returned 6 [0060.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", pszSpec="*.jpg") returned 1 [0060.894] lstrlenA (lpString="*.jpg") returned 5 [0060.894] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" [0060.894] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" [0060.894] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg." [0060.894] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.wannacry" [0060.894] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.895] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x368 [0060.895] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x864d3600, dwHighDateTime=0x1c91151), lpLastAccessTime=0x407536*(dwLowDateTime=0x59590d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x864d3600, dwHighDateTime=0x1c91151)) returned 1 [0060.895] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.895] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2ea, lpOverlapped=0x0) returned 1 [0060.897] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg") returned="NotifierDownArrow.jpg" [0060.897] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.897] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2ea, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2ea, lpOverlapped=0x0) returned 1 [0060.897] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.897] CloseHandle (hObject=0x90) returned 1 [0060.897] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg.wannacry")) returned 1 [0060.898] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89e0bd00, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x6a87fa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89e0bd00, ftLastWriteTime.dwHighDateTime=0x1c91151, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="NotifierUpArrow.jpg", cAlternateFileName="NO6669~1.JPG")) returned 1 [0060.898] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.898] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NotifierUpArrow.jpg") returned -1 [0060.898] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NotifierUpArrow.jpg") returned -1 [0060.898] lstrcmpiA (lpString1="", lpString2="NotifierUpArrow.jpg") returned -1 [0060.898] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg") returned="NotifierDownArrow.jpg" [0060.898] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.898] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.898] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.899] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.899] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="NotifierUpArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" [0060.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", pszSpec="*.zip") returned 0 [0060.899] lstrlenA (lpString="*.zip") returned 5 [0060.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", pszSpec="*.rar") returned 0 [0060.899] lstrlenA (lpString="*.rar") returned 5 [0060.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", pszSpec="*.7z") returned 0 [0060.899] lstrlenA (lpString="*.7z") returned 4 [0060.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", pszSpec="*.tar") returned 0 [0060.899] lstrlenA (lpString="*.tar") returned 5 [0060.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", pszSpec="*.gzip") returned 0 [0060.899] lstrlenA (lpString="*.gzip") returned 6 [0060.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", pszSpec="*.jpg") returned 1 [0060.899] lstrlenA (lpString="*.jpg") returned 5 [0060.899] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" [0060.899] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" [0060.899] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg." [0060.899] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.wannacry" [0060.899] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.900] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c0 [0060.900] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x89e0bd00, dwHighDateTime=0x1c91151), lpLastAccessTime=0x407536*(dwLowDateTime=0x6a87fa50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x89e0bd00, dwHighDateTime=0x1c91151)) returned 1 [0060.900] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.900] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x342, lpOverlapped=0x0) returned 1 [0060.902] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg") returned="NotifierUpArrow.jpg" [0060.902] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.902] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x342, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x342, lpOverlapped=0x0) returned 1 [0060.902] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.902] CloseHandle (hObject=0x90) returned 1 [0060.902] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg.wannacry")) returned 1 [0060.903] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8472000, ftCreationTime.dwHighDateTime=0x1c90f02, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8472000, ftLastWriteTime.dwHighDateTime=0x1c90f02, nFileSizeHigh=0x0, nFileSizeLow=0x133a, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="NotifierWindowMask.bmp", cAlternateFileName="NOTIFI~1.BMP")) returned 1 [0060.903] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.903] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NotifierWindowMask.bmp") returned -1 [0060.903] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NotifierWindowMask.bmp") returned -1 [0060.903] lstrcmpiA (lpString1="", lpString2="NotifierWindowMask.bmp") returned -1 [0060.903] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg") returned="NotifierUpArrow.jpg" [0060.903] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.903] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.903] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="NotifierWindowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" [0060.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.zip") returned 0 [0060.903] lstrlenA (lpString="*.zip") returned 5 [0060.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.rar") returned 0 [0060.903] lstrlenA (lpString="*.rar") returned 5 [0060.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.7z") returned 0 [0060.904] lstrlenA (lpString="*.7z") returned 4 [0060.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.tar") returned 0 [0060.904] lstrlenA (lpString="*.tar") returned 5 [0060.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.gzip") returned 0 [0060.904] lstrlenA (lpString="*.gzip") returned 6 [0060.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.jpg") returned 0 [0060.904] lstrlenA (lpString="*.jpg") returned 5 [0060.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.jpeg") returned 0 [0060.904] lstrlenA (lpString="*.jpeg") returned 6 [0060.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.psd") returned 0 [0060.904] lstrlenA (lpString="*.psd") returned 5 [0060.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.gif") returned 0 [0060.904] lstrlenA (lpString="*.gif") returned 5 [0060.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.doc") returned 0 [0060.904] lstrlenA (lpString="*.doc") returned 5 [0060.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.docx") returned 0 [0060.904] lstrlenA (lpString="*.docx") returned 6 [0060.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.xls") returned 0 [0060.904] lstrlenA (lpString="*.xls") returned 5 [0060.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.xlsx") returned 0 [0060.904] lstrlenA (lpString="*.xlsx") returned 6 [0060.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.ppt") returned 0 [0060.904] lstrlenA (lpString="*.ppt") returned 5 [0060.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.pptx") returned 0 [0060.904] lstrlenA (lpString="*.pptx") returned 6 [0060.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.pdf") returned 0 [0060.905] lstrlenA (lpString="*.pdf") returned 5 [0060.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.mov") returned 0 [0060.905] lstrlenA (lpString="*.mov") returned 5 [0060.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.m2v") returned 0 [0060.905] lstrlenA (lpString="*.m2v") returned 5 [0060.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.3gp") returned 0 [0060.905] lstrlenA (lpString="*.3gp") returned 5 [0060.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.mpeg") returned 0 [0060.905] lstrlenA (lpString="*.mpeg") returned 6 [0060.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.mpg") returned 0 [0060.905] lstrlenA (lpString="*.mpg") returned 5 [0060.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.flv") returned 0 [0060.905] lstrlenA (lpString="*.flv") returned 5 [0060.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.avi") returned 0 [0060.905] lstrlenA (lpString="*.avi") returned 5 [0060.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.mp4") returned 0 [0060.906] lstrlenA (lpString="*.mp4") returned 5 [0060.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.wmv") returned 0 [0060.906] lstrlenA (lpString="*.wmv") returned 5 [0060.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.divx") returned 0 [0060.906] lstrlenA (lpString="*.divx") returned 6 [0060.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.mkv") returned 0 [0060.906] lstrlenA (lpString="*.mkv") returned 5 [0060.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.mp3") returned 0 [0060.906] lstrlenA (lpString="*.mp3") returned 5 [0060.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.wav") returned 0 [0060.906] lstrlenA (lpString="*.wav") returned 5 [0060.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.flac") returned 0 [0060.906] lstrlenA (lpString="*.flac") returned 6 [0060.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.ape") returned 0 [0060.906] lstrlenA (lpString="*.ape") returned 5 [0060.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.wma") returned 0 [0060.907] lstrlenA (lpString="*.wma") returned 5 [0060.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.ac3") returned 0 [0060.907] lstrlenA (lpString="*.ac3") returned 5 [0060.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.mxf") returned 0 [0060.907] lstrlenA (lpString="*.mxf") returned 5 [0060.907] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a588200, ftCreationTime.dwHighDateTime=0x1c90f02, ftLastAccessTime.dwLowDateTime=0x6a87fa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3a588200, ftLastWriteTime.dwHighDateTime=0x1c90f02, nFileSizeHigh=0x0, nFileSizeLow=0x133a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotifierWindowMaskRTL.bmp", cAlternateFileName="NOTIFI~2.BMP")) returned 1 [0060.907] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.907] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NotifierWindowMaskRTL.bmp") returned -1 [0060.907] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NotifierWindowMaskRTL.bmp") returned -1 [0060.907] lstrcmpiA (lpString1="", lpString2="NotifierWindowMaskRTL.bmp") returned -1 [0060.907] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp") returned="NotifierWindowMask.bmp" [0060.907] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.907] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.907] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.907] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.908] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="NotifierWindowMaskRTL.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" [0060.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.zip") returned 0 [0060.908] lstrlenA (lpString="*.zip") returned 5 [0060.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.rar") returned 0 [0060.908] lstrlenA (lpString="*.rar") returned 5 [0060.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.7z") returned 0 [0060.908] lstrlenA (lpString="*.7z") returned 4 [0060.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.tar") returned 0 [0060.908] lstrlenA (lpString="*.tar") returned 5 [0060.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.gzip") returned 0 [0060.908] lstrlenA (lpString="*.gzip") returned 6 [0060.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.jpg") returned 0 [0060.908] lstrlenA (lpString="*.jpg") returned 5 [0060.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.jpeg") returned 0 [0060.908] lstrlenA (lpString="*.jpeg") returned 6 [0060.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.psd") returned 0 [0060.908] lstrlenA (lpString="*.psd") returned 5 [0060.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.gif") returned 0 [0060.908] lstrlenA (lpString="*.gif") returned 5 [0060.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.doc") returned 0 [0060.908] lstrlenA (lpString="*.doc") returned 5 [0060.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.docx") returned 0 [0060.909] lstrlenA (lpString="*.docx") returned 6 [0060.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.xls") returned 0 [0060.909] lstrlenA (lpString="*.xls") returned 5 [0060.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.xlsx") returned 0 [0060.909] lstrlenA (lpString="*.xlsx") returned 6 [0060.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.ppt") returned 0 [0060.909] lstrlenA (lpString="*.ppt") returned 5 [0060.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.pptx") returned 0 [0060.909] lstrlenA (lpString="*.pptx") returned 6 [0060.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.pdf") returned 0 [0060.909] lstrlenA (lpString="*.pdf") returned 5 [0060.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.mov") returned 0 [0060.909] lstrlenA (lpString="*.mov") returned 5 [0060.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.m2v") returned 0 [0060.909] lstrlenA (lpString="*.m2v") returned 5 [0060.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.3gp") returned 0 [0060.909] lstrlenA (lpString="*.3gp") returned 5 [0060.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.mpeg") returned 0 [0060.909] lstrlenA (lpString="*.mpeg") returned 6 [0060.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.mpg") returned 0 [0060.909] lstrlenA (lpString="*.mpg") returned 5 [0060.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.flv") returned 0 [0060.909] lstrlenA (lpString="*.flv") returned 5 [0060.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.avi") returned 0 [0060.909] lstrlenA (lpString="*.avi") returned 5 [0060.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.mp4") returned 0 [0060.909] lstrlenA (lpString="*.mp4") returned 5 [0060.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.wmv") returned 0 [0060.910] lstrlenA (lpString="*.wmv") returned 5 [0060.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.divx") returned 0 [0060.910] lstrlenA (lpString="*.divx") returned 6 [0060.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.mkv") returned 0 [0060.910] lstrlenA (lpString="*.mkv") returned 5 [0060.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.mp3") returned 0 [0060.910] lstrlenA (lpString="*.mp3") returned 5 [0060.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.wav") returned 0 [0060.910] lstrlenA (lpString="*.wav") returned 5 [0060.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.flac") returned 0 [0060.910] lstrlenA (lpString="*.flac") returned 6 [0060.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.ape") returned 0 [0060.910] lstrlenA (lpString="*.ape") returned 5 [0060.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.wma") returned 0 [0060.910] lstrlenA (lpString="*.wma") returned 5 [0060.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.ac3") returned 0 [0060.910] lstrlenA (lpString="*.ac3") returned 5 [0060.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.mxf") returned 0 [0060.910] lstrlenA (lpString="*.mxf") returned 5 [0060.910] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7689a500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7689a500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e35, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlineToolIconImages.jpg", cAlternateFileName="OUTLIN~1.JPG")) returned 1 [0060.910] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.911] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OutlineToolIconImages.jpg") returned -1 [0060.911] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutlineToolIconImages.jpg") returned -1 [0060.911] lstrcmpiA (lpString1="", lpString2="OutlineToolIconImages.jpg") returned -1 [0060.911] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp") returned="NotifierWindowMaskRTL.bmp" [0060.911] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.911] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.911] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.911] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.911] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="OutlineToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" [0060.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", pszSpec="*.zip") returned 0 [0060.911] lstrlenA (lpString="*.zip") returned 5 [0060.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", pszSpec="*.rar") returned 0 [0060.911] lstrlenA (lpString="*.rar") returned 5 [0060.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", pszSpec="*.7z") returned 0 [0060.911] lstrlenA (lpString="*.7z") returned 4 [0060.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", pszSpec="*.tar") returned 0 [0060.912] lstrlenA (lpString="*.tar") returned 5 [0060.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", pszSpec="*.gzip") returned 0 [0060.912] lstrlenA (lpString="*.gzip") returned 6 [0060.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", pszSpec="*.jpg") returned 1 [0060.912] lstrlenA (lpString="*.jpg") returned 5 [0060.912] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" [0060.912] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" [0060.912] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg." [0060.912] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg.wannacry" [0060.912] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.926] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e35 [0060.926] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7689a500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x59995270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7689a500, dwHighDateTime=0x1c747ea)) returned 1 [0060.926] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.926] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1db7, lpOverlapped=0x0) returned 1 [0060.928] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg") returned="OutlineToolIconImages.jpg" [0060.928] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.928] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1db7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1db7, lpOverlapped=0x0) returned 1 [0060.929] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.929] CloseHandle (hObject=0x90) returned 1 [0060.929] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg.wannacry")) returned 1 [0060.930] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6c393490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1938, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="OutlineToolIconImagesMask.bmp", cAlternateFileName="OUTLIN~1.BMP")) returned 1 [0060.930] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.930] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OutlineToolIconImagesMask.bmp") returned -1 [0060.930] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutlineToolIconImagesMask.bmp") returned -1 [0060.930] lstrcmpiA (lpString1="", lpString2="OutlineToolIconImagesMask.bmp") returned -1 [0060.930] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg") returned="OutlineToolIconImages.jpg" [0060.930] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.930] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.930] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.931] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.931] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="OutlineToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp" [0060.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0060.931] lstrlenA (lpString="*.zip") returned 5 [0060.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0060.931] lstrlenA (lpString="*.rar") returned 5 [0060.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0060.931] lstrlenA (lpString="*.7z") returned 4 [0060.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0060.931] lstrlenA (lpString="*.tar") returned 5 [0060.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0060.931] lstrlenA (lpString="*.gzip") returned 6 [0060.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0060.931] lstrlenA (lpString="*.jpg") returned 5 [0060.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0060.931] lstrlenA (lpString="*.jpeg") returned 6 [0060.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0060.931] lstrlenA (lpString="*.psd") returned 5 [0060.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.gif") returned 0 [0060.931] lstrlenA (lpString="*.gif") returned 5 [0060.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.doc") returned 0 [0060.931] lstrlenA (lpString="*.doc") returned 5 [0060.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.docx") returned 0 [0060.931] lstrlenA (lpString="*.docx") returned 6 [0060.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.xls") returned 0 [0060.932] lstrlenA (lpString="*.xls") returned 5 [0060.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.xlsx") returned 0 [0060.932] lstrlenA (lpString="*.xlsx") returned 6 [0060.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.ppt") returned 0 [0060.932] lstrlenA (lpString="*.ppt") returned 5 [0060.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.pptx") returned 0 [0060.932] lstrlenA (lpString="*.pptx") returned 6 [0060.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.pdf") returned 0 [0060.932] lstrlenA (lpString="*.pdf") returned 5 [0060.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.mov") returned 0 [0060.932] lstrlenA (lpString="*.mov") returned 5 [0060.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.m2v") returned 0 [0060.932] lstrlenA (lpString="*.m2v") returned 5 [0060.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.3gp") returned 0 [0060.932] lstrlenA (lpString="*.3gp") returned 5 [0060.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.mpeg") returned 0 [0060.932] lstrlenA (lpString="*.mpeg") returned 6 [0060.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.mpg") returned 0 [0060.932] lstrlenA (lpString="*.mpg") returned 5 [0060.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.flv") returned 0 [0060.932] lstrlenA (lpString="*.flv") returned 5 [0060.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.avi") returned 0 [0060.932] lstrlenA (lpString="*.avi") returned 5 [0060.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.mp4") returned 0 [0060.933] lstrlenA (lpString="*.mp4") returned 5 [0060.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.wmv") returned 0 [0060.933] lstrlenA (lpString="*.wmv") returned 5 [0060.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.divx") returned 0 [0060.933] lstrlenA (lpString="*.divx") returned 6 [0060.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.mkv") returned 0 [0060.933] lstrlenA (lpString="*.mkv") returned 5 [0060.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.mp3") returned 0 [0060.933] lstrlenA (lpString="*.mp3") returned 5 [0060.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.wav") returned 0 [0060.933] lstrlenA (lpString="*.wav") returned 5 [0060.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.flac") returned 0 [0060.933] lstrlenA (lpString="*.flac") returned 6 [0060.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.ape") returned 0 [0060.933] lstrlenA (lpString="*.ape") returned 5 [0060.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.wma") returned 0 [0060.933] lstrlenA (lpString="*.wma") returned 5 [0060.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.ac3") returned 0 [0060.933] lstrlenA (lpString="*.ac3") returned 5 [0060.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.mxf") returned 0 [0060.933] lstrlenA (lpString="*.mxf") returned 5 [0060.933] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6cd3edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutofSyncIconImages.jpg", cAlternateFileName="OUTOFS~1.JPG")) returned 1 [0060.933] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.934] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OutofSyncIconImages.jpg") returned -1 [0060.934] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutofSyncIconImages.jpg") returned -1 [0060.934] lstrcmpiA (lpString1="", lpString2="OutofSyncIconImages.jpg") returned -1 [0060.934] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp") returned="OutlineToolIconImagesMask.bmp" [0060.934] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.934] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.934] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.934] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.934] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="OutofSyncIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" [0060.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", pszSpec="*.zip") returned 0 [0060.934] lstrlenA (lpString="*.zip") returned 5 [0060.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", pszSpec="*.rar") returned 0 [0060.934] lstrlenA (lpString="*.rar") returned 5 [0060.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", pszSpec="*.7z") returned 0 [0060.934] lstrlenA (lpString="*.7z") returned 4 [0060.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", pszSpec="*.tar") returned 0 [0060.934] lstrlenA (lpString="*.tar") returned 5 [0060.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", pszSpec="*.gzip") returned 0 [0060.934] lstrlenA (lpString="*.gzip") returned 6 [0060.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", pszSpec="*.jpg") returned 1 [0060.934] lstrlenA (lpString="*.jpg") returned 5 [0060.934] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" [0060.935] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" [0060.935] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg." [0060.935] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.wannacry" [0060.935] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.936] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf8d [0060.936] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6cd3edf0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea)) returned 1 [0060.936] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.936] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xf0f, lpOverlapped=0x0) returned 1 [0060.938] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg") returned="OutofSyncIconImages.jpg" [0060.938] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.938] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xf0f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xf0f, lpOverlapped=0x0) returned 1 [0060.939] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.939] CloseHandle (hObject=0x90) returned 1 [0060.939] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg.wannacry")) returned 1 [0060.940] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x59c42b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="OutofSyncIconImagesMask.bmp", cAlternateFileName="OUTOFS~1.BMP")) returned 1 [0060.940] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.940] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OutofSyncIconImagesMask.bmp") returned -1 [0060.940] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutofSyncIconImagesMask.bmp") returned -1 [0060.940] lstrcmpiA (lpString1="", lpString2="OutofSyncIconImagesMask.bmp") returned -1 [0060.940] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg") returned="OutofSyncIconImages.jpg" [0060.940] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.940] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.940] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.940] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.940] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="OutofSyncIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" [0060.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0060.941] lstrlenA (lpString="*.zip") returned 5 [0060.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0060.941] lstrlenA (lpString="*.rar") returned 5 [0060.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0060.941] lstrlenA (lpString="*.7z") returned 4 [0060.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0060.941] lstrlenA (lpString="*.tar") returned 5 [0060.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0060.941] lstrlenA (lpString="*.gzip") returned 6 [0060.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0060.941] lstrlenA (lpString="*.jpg") returned 5 [0060.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0060.941] lstrlenA (lpString="*.jpeg") returned 6 [0060.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0060.941] lstrlenA (lpString="*.psd") returned 5 [0060.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.gif") returned 0 [0060.941] lstrlenA (lpString="*.gif") returned 5 [0060.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.doc") returned 0 [0060.941] lstrlenA (lpString="*.doc") returned 5 [0060.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.docx") returned 0 [0060.942] lstrlenA (lpString="*.docx") returned 6 [0060.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.xls") returned 0 [0060.942] lstrlenA (lpString="*.xls") returned 5 [0060.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.xlsx") returned 0 [0060.942] lstrlenA (lpString="*.xlsx") returned 6 [0060.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.ppt") returned 0 [0060.942] lstrlenA (lpString="*.ppt") returned 5 [0060.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.pptx") returned 0 [0060.942] lstrlenA (lpString="*.pptx") returned 6 [0060.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.pdf") returned 0 [0060.942] lstrlenA (lpString="*.pdf") returned 5 [0060.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.mov") returned 0 [0060.942] lstrlenA (lpString="*.mov") returned 5 [0060.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.m2v") returned 0 [0060.942] lstrlenA (lpString="*.m2v") returned 5 [0060.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.3gp") returned 0 [0060.943] lstrlenA (lpString="*.3gp") returned 5 [0060.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.mpeg") returned 0 [0060.943] lstrlenA (lpString="*.mpeg") returned 6 [0060.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.mpg") returned 0 [0060.943] lstrlenA (lpString="*.mpg") returned 5 [0060.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.flv") returned 0 [0060.943] lstrlenA (lpString="*.flv") returned 5 [0060.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.avi") returned 0 [0060.943] lstrlenA (lpString="*.avi") returned 5 [0060.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.mp4") returned 0 [0060.943] lstrlenA (lpString="*.mp4") returned 5 [0060.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.wmv") returned 0 [0060.943] lstrlenA (lpString="*.wmv") returned 5 [0060.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.divx") returned 0 [0060.943] lstrlenA (lpString="*.divx") returned 6 [0060.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.mkv") returned 0 [0060.943] lstrlenA (lpString="*.mkv") returned 5 [0060.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.mp3") returned 0 [0060.944] lstrlenA (lpString="*.mp3") returned 5 [0060.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.wav") returned 0 [0060.944] lstrlenA (lpString="*.wav") returned 5 [0060.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.flac") returned 0 [0060.944] lstrlenA (lpString="*.flac") returned 6 [0060.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.ape") returned 0 [0060.944] lstrlenA (lpString="*.ape") returned 5 [0060.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.wma") returned 0 [0060.944] lstrlenA (lpString="*.wma") returned 5 [0060.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.ac3") returned 0 [0060.944] lstrlenA (lpString="*.ac3") returned 5 [0060.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.mxf") returned 0 [0060.944] lstrlenA (lpString="*.mxf") returned 5 [0060.944] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a3c500, ftCreationTime.dwHighDateTime=0x1ca032f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7a3c500, ftLastWriteTime.dwHighDateTime=0x1ca032f, nFileSizeHigh=0x0, nFileSizeLow=0x5203, dwReserved0=0x0, dwReserved1=0x0, cFileName="PicturesToolIconImages.jpg", cAlternateFileName="PICTUR~1.JPG")) returned 1 [0060.945] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.945] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PicturesToolIconImages.jpg") returned -1 [0060.945] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PicturesToolIconImages.jpg") returned -1 [0060.945] lstrcmpiA (lpString1="", lpString2="PicturesToolIconImages.jpg") returned -1 [0060.945] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp") returned="OutofSyncIconImagesMask.bmp" [0060.945] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.945] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.945] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.945] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.945] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="PicturesToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" [0060.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", pszSpec="*.zip") returned 0 [0060.945] lstrlenA (lpString="*.zip") returned 5 [0060.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", pszSpec="*.rar") returned 0 [0060.945] lstrlenA (lpString="*.rar") returned 5 [0060.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", pszSpec="*.7z") returned 0 [0060.945] lstrlenA (lpString="*.7z") returned 4 [0060.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", pszSpec="*.tar") returned 0 [0060.946] lstrlenA (lpString="*.tar") returned 5 [0060.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", pszSpec="*.gzip") returned 0 [0060.946] lstrlenA (lpString="*.gzip") returned 6 [0060.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", pszSpec="*.jpg") returned 1 [0060.946] lstrlenA (lpString="*.jpg") returned 5 [0060.946] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" [0060.946] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" [0060.946] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg." [0060.946] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg.wannacry" [0060.946] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.949] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5203 [0060.949] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7a3c500, dwHighDateTime=0x1ca032f), lpLastAccessTime=0x407536*(dwLowDateTime=0x6cee1d10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7a3c500, dwHighDateTime=0x1ca032f)) returned 1 [0060.949] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.949] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x5185, lpOverlapped=0x0) returned 1 [0060.952] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg") returned="PicturesToolIconImages.jpg" [0060.952] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.952] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x5185, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x5185, lpOverlapped=0x0) returned 1 [0060.952] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.952] CloseHandle (hObject=0x90) returned 1 [0060.953] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg.wannacry")) returned 1 [0060.954] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe1a5d00, ftCreationTime.dwHighDateTime=0x1ca032e, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe1a5d00, ftLastWriteTime.dwHighDateTime=0x1ca032e, nFileSizeHigh=0x0, nFileSizeLow=0x1238, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PicturesToolIconImagesMask.bmp", cAlternateFileName="PICTUR~1.BMP")) returned 1 [0060.954] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.954] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PicturesToolIconImagesMask.bmp") returned -1 [0060.954] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PicturesToolIconImagesMask.bmp") returned -1 [0060.954] lstrcmpiA (lpString1="", lpString2="PicturesToolIconImagesMask.bmp") returned -1 [0060.954] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg") returned="PicturesToolIconImages.jpg" [0060.954] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.954] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.954] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.954] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.954] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="PicturesToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp" [0060.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0060.954] lstrlenA (lpString="*.zip") returned 5 [0060.954] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0060.955] lstrlenA (lpString="*.rar") returned 5 [0060.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0060.955] lstrlenA (lpString="*.7z") returned 4 [0060.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0060.955] lstrlenA (lpString="*.tar") returned 5 [0060.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0060.955] lstrlenA (lpString="*.gzip") returned 6 [0060.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0060.955] lstrlenA (lpString="*.jpg") returned 5 [0060.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0060.955] lstrlenA (lpString="*.jpeg") returned 6 [0060.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0060.955] lstrlenA (lpString="*.psd") returned 5 [0060.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.gif") returned 0 [0060.955] lstrlenA (lpString="*.gif") returned 5 [0060.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.doc") returned 0 [0060.955] lstrlenA (lpString="*.doc") returned 5 [0060.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.docx") returned 0 [0060.955] lstrlenA (lpString="*.docx") returned 6 [0060.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.xls") returned 0 [0060.955] lstrlenA (lpString="*.xls") returned 5 [0060.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.xlsx") returned 0 [0060.955] lstrlenA (lpString="*.xlsx") returned 6 [0060.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.ppt") returned 0 [0060.955] lstrlenA (lpString="*.ppt") returned 5 [0060.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.pptx") returned 0 [0060.955] lstrlenA (lpString="*.pptx") returned 6 [0060.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.pdf") returned 0 [0060.956] lstrlenA (lpString="*.pdf") returned 5 [0060.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.mov") returned 0 [0060.956] lstrlenA (lpString="*.mov") returned 5 [0060.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.m2v") returned 0 [0060.956] lstrlenA (lpString="*.m2v") returned 5 [0060.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.3gp") returned 0 [0060.956] lstrlenA (lpString="*.3gp") returned 5 [0060.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.mpeg") returned 0 [0060.956] lstrlenA (lpString="*.mpeg") returned 6 [0060.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.mpg") returned 0 [0060.956] lstrlenA (lpString="*.mpg") returned 5 [0060.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.flv") returned 0 [0060.956] lstrlenA (lpString="*.flv") returned 5 [0060.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.avi") returned 0 [0060.956] lstrlenA (lpString="*.avi") returned 5 [0060.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.mp4") returned 0 [0060.956] lstrlenA (lpString="*.mp4") returned 5 [0060.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.wmv") returned 0 [0060.956] lstrlenA (lpString="*.wmv") returned 5 [0060.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.divx") returned 0 [0060.956] lstrlenA (lpString="*.divx") returned 6 [0060.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.mkv") returned 0 [0060.956] lstrlenA (lpString="*.mkv") returned 5 [0060.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.mp3") returned 0 [0060.957] lstrlenA (lpString="*.mp3") returned 5 [0060.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.wav") returned 0 [0060.957] lstrlenA (lpString="*.wav") returned 5 [0060.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.flac") returned 0 [0060.957] lstrlenA (lpString="*.flac") returned 6 [0060.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.ape") returned 0 [0060.957] lstrlenA (lpString="*.ape") returned 5 [0060.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.wma") returned 0 [0060.957] lstrlenA (lpString="*.wma") returned 5 [0060.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.ac3") returned 0 [0060.957] lstrlenA (lpString="*.ac3") returned 5 [0060.957] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.mxf") returned 0 [0060.957] lstrlenA (lpString="*.mxf") returned 5 [0060.957] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuestionIcon.jpg", cAlternateFileName="QUESTI~1.JPG")) returned 1 [0060.957] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.957] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QuestionIcon.jpg") returned -1 [0060.957] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuestionIcon.jpg") returned -1 [0060.957] lstrcmpiA (lpString1="", lpString2="QuestionIcon.jpg") returned -1 [0060.957] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp") returned="PicturesToolIconImagesMask.bmp" [0060.957] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.957] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.957] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.957] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.958] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="QuestionIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" [0060.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", pszSpec="*.zip") returned 0 [0060.958] lstrlenA (lpString="*.zip") returned 5 [0060.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", pszSpec="*.rar") returned 0 [0060.958] lstrlenA (lpString="*.rar") returned 5 [0060.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", pszSpec="*.7z") returned 0 [0060.958] lstrlenA (lpString="*.7z") returned 4 [0060.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", pszSpec="*.tar") returned 0 [0060.958] lstrlenA (lpString="*.tar") returned 5 [0060.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", pszSpec="*.gzip") returned 0 [0060.958] lstrlenA (lpString="*.gzip") returned 6 [0060.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", pszSpec="*.jpg") returned 1 [0060.958] lstrlenA (lpString="*.jpg") returned 5 [0060.958] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" [0060.958] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" [0060.958] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg." [0060.958] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg.wannacry" [0060.958] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.959] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc1b [0060.959] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d0d0ef0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea)) returned 1 [0060.959] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.959] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xb9d, lpOverlapped=0x0) returned 1 [0060.962] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg") returned="QuestionIcon.jpg" [0060.962] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.962] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xb9d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xb9d, lpOverlapped=0x0) returned 1 [0060.962] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.962] CloseHandle (hObject=0x90) returned 1 [0060.962] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg.wannacry")) returned 1 [0060.963] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="QuestionIconMask.bmp", cAlternateFileName="QUESTI~1.BMP")) returned 1 [0060.963] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.963] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QuestionIconMask.bmp") returned -1 [0060.963] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuestionIconMask.bmp") returned -1 [0060.963] lstrcmpiA (lpString1="", lpString2="QuestionIconMask.bmp") returned -1 [0060.963] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg") returned="QuestionIcon.jpg" [0060.963] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.963] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.963] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.964] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.964] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="QuestionIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp" [0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.zip") returned 0 [0060.964] lstrlenA (lpString="*.zip") returned 5 [0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.rar") returned 0 [0060.964] lstrlenA (lpString="*.rar") returned 5 [0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.7z") returned 0 [0060.964] lstrlenA (lpString="*.7z") returned 4 [0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.tar") returned 0 [0060.964] lstrlenA (lpString="*.tar") returned 5 [0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.gzip") returned 0 [0060.964] lstrlenA (lpString="*.gzip") returned 6 [0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.jpg") returned 0 [0060.964] lstrlenA (lpString="*.jpg") returned 5 [0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.jpeg") returned 0 [0060.964] lstrlenA (lpString="*.jpeg") returned 6 [0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.psd") returned 0 [0060.964] lstrlenA (lpString="*.psd") returned 5 [0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.gif") returned 0 [0060.964] lstrlenA (lpString="*.gif") returned 5 [0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.doc") returned 0 [0060.964] lstrlenA (lpString="*.doc") returned 5 [0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.docx") returned 0 [0060.964] lstrlenA (lpString="*.docx") returned 6 [0060.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.xls") returned 0 [0060.964] lstrlenA (lpString="*.xls") returned 5 [0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.xlsx") returned 0 [0060.965] lstrlenA (lpString="*.xlsx") returned 6 [0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.ppt") returned 0 [0060.965] lstrlenA (lpString="*.ppt") returned 5 [0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.pptx") returned 0 [0060.965] lstrlenA (lpString="*.pptx") returned 6 [0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.pdf") returned 0 [0060.965] lstrlenA (lpString="*.pdf") returned 5 [0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.mov") returned 0 [0060.965] lstrlenA (lpString="*.mov") returned 5 [0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.m2v") returned 0 [0060.965] lstrlenA (lpString="*.m2v") returned 5 [0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.3gp") returned 0 [0060.965] lstrlenA (lpString="*.3gp") returned 5 [0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.mpeg") returned 0 [0060.965] lstrlenA (lpString="*.mpeg") returned 6 [0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.mpg") returned 0 [0060.965] lstrlenA (lpString="*.mpg") returned 5 [0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.flv") returned 0 [0060.965] lstrlenA (lpString="*.flv") returned 5 [0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.avi") returned 0 [0060.965] lstrlenA (lpString="*.avi") returned 5 [0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.mp4") returned 0 [0060.965] lstrlenA (lpString="*.mp4") returned 5 [0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.wmv") returned 0 [0060.965] lstrlenA (lpString="*.wmv") returned 5 [0060.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.divx") returned 0 [0060.966] lstrlenA (lpString="*.divx") returned 6 [0060.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.mkv") returned 0 [0060.966] lstrlenA (lpString="*.mkv") returned 5 [0060.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.mp3") returned 0 [0060.966] lstrlenA (lpString="*.mp3") returned 5 [0060.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.wav") returned 0 [0060.966] lstrlenA (lpString="*.wav") returned 5 [0060.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.flac") returned 0 [0060.966] lstrlenA (lpString="*.flac") returned 6 [0060.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.ape") returned 0 [0060.966] lstrlenA (lpString="*.ape") returned 5 [0060.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.wma") returned 0 [0060.966] lstrlenA (lpString="*.wma") returned 5 [0060.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.ac3") returned 0 [0060.966] lstrlenA (lpString="*.ac3") returned 5 [0060.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.mxf") returned 0 [0060.966] lstrlenA (lpString="*.mxf") returned 5 [0060.966] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x64fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared16x16Images.jpg", cAlternateFileName="SHARED~1.JPG")) returned 1 [0060.966] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.966] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Shared16x16Images.jpg") returned -1 [0060.966] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Shared16x16Images.jpg") returned -1 [0060.966] lstrcmpiA (lpString1="", lpString2="Shared16x16Images.jpg") returned -1 [0060.966] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp") returned="QuestionIconMask.bmp" [0060.966] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.966] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.966] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.967] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.967] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="Shared16x16Images.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" [0060.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", pszSpec="*.zip") returned 0 [0060.967] lstrlenA (lpString="*.zip") returned 5 [0060.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", pszSpec="*.rar") returned 0 [0060.967] lstrlenA (lpString="*.rar") returned 5 [0060.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", pszSpec="*.7z") returned 0 [0060.967] lstrlenA (lpString="*.7z") returned 4 [0060.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", pszSpec="*.tar") returned 0 [0060.967] lstrlenA (lpString="*.tar") returned 5 [0060.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", pszSpec="*.gzip") returned 0 [0060.967] lstrlenA (lpString="*.gzip") returned 6 [0060.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", pszSpec="*.jpg") returned 1 [0060.967] lstrlenA (lpString="*.jpg") returned 5 [0060.967] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" [0060.967] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" [0060.967] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg." [0060.967] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg.wannacry" [0060.967] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.969] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x64fa [0060.969] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d299f70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea)) returned 1 [0060.969] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.969] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x647c, lpOverlapped=0x0) returned 1 [0060.971] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg") returned="Shared16x16Images.jpg" [0060.971] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.971] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x647c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x647c, lpOverlapped=0x0) returned 1 [0060.971] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.972] CloseHandle (hObject=0x90) returned 1 [0060.972] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg.wannacry")) returned 1 [0060.973] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="Shared16x16ImagesMask.bmp", cAlternateFileName="SHARED~1.BMP")) returned 1 [0060.973] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.973] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Shared16x16ImagesMask.bmp") returned -1 [0060.973] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Shared16x16ImagesMask.bmp") returned -1 [0060.973] lstrcmpiA (lpString1="", lpString2="Shared16x16ImagesMask.bmp") returned -1 [0060.973] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg") returned="Shared16x16Images.jpg" [0060.973] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.973] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.973] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.973] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.973] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="Shared16x16ImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" [0060.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.zip") returned 0 [0060.973] lstrlenA (lpString="*.zip") returned 5 [0060.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.rar") returned 0 [0060.973] lstrlenA (lpString="*.rar") returned 5 [0060.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.7z") returned 0 [0060.973] lstrlenA (lpString="*.7z") returned 4 [0060.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.tar") returned 0 [0060.973] lstrlenA (lpString="*.tar") returned 5 [0060.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.gzip") returned 0 [0060.974] lstrlenA (lpString="*.gzip") returned 6 [0060.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.jpg") returned 0 [0060.974] lstrlenA (lpString="*.jpg") returned 5 [0060.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0060.974] lstrlenA (lpString="*.jpeg") returned 6 [0060.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.psd") returned 0 [0060.974] lstrlenA (lpString="*.psd") returned 5 [0060.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.gif") returned 0 [0060.974] lstrlenA (lpString="*.gif") returned 5 [0060.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.doc") returned 0 [0060.974] lstrlenA (lpString="*.doc") returned 5 [0060.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.docx") returned 0 [0060.974] lstrlenA (lpString="*.docx") returned 6 [0060.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.xls") returned 0 [0060.974] lstrlenA (lpString="*.xls") returned 5 [0060.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.xlsx") returned 0 [0060.974] lstrlenA (lpString="*.xlsx") returned 6 [0060.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.ppt") returned 0 [0060.974] lstrlenA (lpString="*.ppt") returned 5 [0060.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.pptx") returned 0 [0060.974] lstrlenA (lpString="*.pptx") returned 6 [0060.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.pdf") returned 0 [0060.974] lstrlenA (lpString="*.pdf") returned 5 [0060.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.mov") returned 0 [0060.974] lstrlenA (lpString="*.mov") returned 5 [0060.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.m2v") returned 0 [0060.975] lstrlenA (lpString="*.m2v") returned 5 [0060.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.3gp") returned 0 [0060.975] lstrlenA (lpString="*.3gp") returned 5 [0060.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.mpeg") returned 0 [0060.975] lstrlenA (lpString="*.mpeg") returned 6 [0060.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.mpg") returned 0 [0060.975] lstrlenA (lpString="*.mpg") returned 5 [0060.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.flv") returned 0 [0060.975] lstrlenA (lpString="*.flv") returned 5 [0060.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.avi") returned 0 [0060.975] lstrlenA (lpString="*.avi") returned 5 [0060.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.mp4") returned 0 [0060.975] lstrlenA (lpString="*.mp4") returned 5 [0060.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.wmv") returned 0 [0060.975] lstrlenA (lpString="*.wmv") returned 5 [0060.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.divx") returned 0 [0060.975] lstrlenA (lpString="*.divx") returned 6 [0060.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.mkv") returned 0 [0060.975] lstrlenA (lpString="*.mkv") returned 5 [0060.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.mp3") returned 0 [0060.975] lstrlenA (lpString="*.mp3") returned 5 [0060.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.wav") returned 0 [0060.975] lstrlenA (lpString="*.wav") returned 5 [0060.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.flac") returned 0 [0060.975] lstrlenA (lpString="*.flac") returned 6 [0060.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.ape") returned 0 [0060.976] lstrlenA (lpString="*.ape") returned 5 [0060.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.wma") returned 0 [0060.976] lstrlenA (lpString="*.wma") returned 5 [0060.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.ac3") returned 0 [0060.976] lstrlenA (lpString="*.ac3") returned 5 [0060.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.mxf") returned 0 [0060.976] lstrlenA (lpString="*.mxf") returned 5 [0060.976] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1963, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared24x24Images.jpg", cAlternateFileName="SHARED~2.JPG")) returned 1 [0060.976] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.976] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Shared24x24Images.jpg") returned -1 [0060.976] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Shared24x24Images.jpg") returned -1 [0060.976] lstrcmpiA (lpString1="", lpString2="Shared24x24Images.jpg") returned -1 [0060.976] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp") returned="Shared16x16ImagesMask.bmp" [0060.976] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.976] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.976] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.976] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.976] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="Shared24x24Images.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" [0060.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", pszSpec="*.zip") returned 0 [0060.976] lstrlenA (lpString="*.zip") returned 5 [0060.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", pszSpec="*.rar") returned 0 [0060.976] lstrlenA (lpString="*.rar") returned 5 [0060.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", pszSpec="*.7z") returned 0 [0060.977] lstrlenA (lpString="*.7z") returned 4 [0060.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", pszSpec="*.tar") returned 0 [0060.977] lstrlenA (lpString="*.tar") returned 5 [0060.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", pszSpec="*.gzip") returned 0 [0060.977] lstrlenA (lpString="*.gzip") returned 6 [0060.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", pszSpec="*.jpg") returned 1 [0060.977] lstrlenA (lpString="*.jpg") returned 5 [0060.977] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" [0060.977] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" [0060.977] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg." [0060.977] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg.wannacry" [0060.977] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.978] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1963 [0060.978] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d299f70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea)) returned 1 [0060.978] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.978] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x18e5, lpOverlapped=0x0) returned 1 [0060.980] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg") returned="Shared24x24Images.jpg" [0060.980] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.980] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x18e5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x18e5, lpOverlapped=0x0) returned 1 [0060.980] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.980] CloseHandle (hObject=0x90) returned 1 [0060.980] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg.wannacry")) returned 1 [0060.981] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1638, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="Shared24x24ImagesMask.bmp", cAlternateFileName="SHARED~2.BMP")) returned 1 [0060.981] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.981] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Shared24x24ImagesMask.bmp") returned -1 [0060.981] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Shared24x24ImagesMask.bmp") returned -1 [0060.982] lstrcmpiA (lpString1="", lpString2="Shared24x24ImagesMask.bmp") returned -1 [0060.982] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg") returned="Shared24x24Images.jpg" [0060.982] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.982] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.982] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.982] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.982] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="Shared24x24ImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" [0060.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.zip") returned 0 [0060.982] lstrlenA (lpString="*.zip") returned 5 [0060.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.rar") returned 0 [0060.982] lstrlenA (lpString="*.rar") returned 5 [0060.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.7z") returned 0 [0060.982] lstrlenA (lpString="*.7z") returned 4 [0060.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.tar") returned 0 [0060.982] lstrlenA (lpString="*.tar") returned 5 [0060.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.gzip") returned 0 [0060.982] lstrlenA (lpString="*.gzip") returned 6 [0060.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.jpg") returned 0 [0060.982] lstrlenA (lpString="*.jpg") returned 5 [0060.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0060.982] lstrlenA (lpString="*.jpeg") returned 6 [0060.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.psd") returned 0 [0060.983] lstrlenA (lpString="*.psd") returned 5 [0060.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.gif") returned 0 [0060.983] lstrlenA (lpString="*.gif") returned 5 [0060.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.doc") returned 0 [0060.983] lstrlenA (lpString="*.doc") returned 5 [0060.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.docx") returned 0 [0060.983] lstrlenA (lpString="*.docx") returned 6 [0060.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.xls") returned 0 [0060.983] lstrlenA (lpString="*.xls") returned 5 [0060.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.xlsx") returned 0 [0060.983] lstrlenA (lpString="*.xlsx") returned 6 [0060.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.ppt") returned 0 [0060.983] lstrlenA (lpString="*.ppt") returned 5 [0060.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.pptx") returned 0 [0060.983] lstrlenA (lpString="*.pptx") returned 6 [0060.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.pdf") returned 0 [0060.983] lstrlenA (lpString="*.pdf") returned 5 [0060.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.mov") returned 0 [0060.983] lstrlenA (lpString="*.mov") returned 5 [0060.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.m2v") returned 0 [0060.983] lstrlenA (lpString="*.m2v") returned 5 [0060.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.3gp") returned 0 [0060.983] lstrlenA (lpString="*.3gp") returned 5 [0060.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.mpeg") returned 0 [0060.983] lstrlenA (lpString="*.mpeg") returned 6 [0060.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.mpg") returned 0 [0060.984] lstrlenA (lpString="*.mpg") returned 5 [0060.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.flv") returned 0 [0060.984] lstrlenA (lpString="*.flv") returned 5 [0060.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.avi") returned 0 [0060.984] lstrlenA (lpString="*.avi") returned 5 [0060.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.mp4") returned 0 [0060.984] lstrlenA (lpString="*.mp4") returned 5 [0060.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.wmv") returned 0 [0060.984] lstrlenA (lpString="*.wmv") returned 5 [0060.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.divx") returned 0 [0060.984] lstrlenA (lpString="*.divx") returned 6 [0060.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.mkv") returned 0 [0060.984] lstrlenA (lpString="*.mkv") returned 5 [0060.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.mp3") returned 0 [0060.984] lstrlenA (lpString="*.mp3") returned 5 [0060.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.wav") returned 0 [0060.984] lstrlenA (lpString="*.wav") returned 5 [0060.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.flac") returned 0 [0060.984] lstrlenA (lpString="*.flac") returned 6 [0060.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.ape") returned 0 [0060.984] lstrlenA (lpString="*.ape") returned 5 [0060.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.wma") returned 0 [0060.984] lstrlenA (lpString="*.wma") returned 5 [0060.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.ac3") returned 0 [0060.984] lstrlenA (lpString="*.ac3") returned 5 [0060.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.mxf") returned 0 [0060.985] lstrlenA (lpString="*.mxf") returned 5 [0060.985] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2d38, dwReserved0=0x0, dwReserved1=0x0, cFileName="SketchIconImages.bmp", cAlternateFileName="SKETCH~1.BMP")) returned 1 [0060.985] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.985] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SketchIconImages.bmp") returned -1 [0060.985] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SketchIconImages.bmp") returned -1 [0060.985] lstrcmpiA (lpString1="", lpString2="SketchIconImages.bmp") returned -1 [0060.985] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp") returned="Shared24x24ImagesMask.bmp" [0060.985] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.985] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.985] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.985] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.985] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="SketchIconImages.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp" [0060.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.zip") returned 0 [0060.985] lstrlenA (lpString="*.zip") returned 5 [0060.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.rar") returned 0 [0060.985] lstrlenA (lpString="*.rar") returned 5 [0060.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.7z") returned 0 [0060.985] lstrlenA (lpString="*.7z") returned 4 [0060.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.tar") returned 0 [0060.985] lstrlenA (lpString="*.tar") returned 5 [0060.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.gzip") returned 0 [0060.986] lstrlenA (lpString="*.gzip") returned 6 [0060.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.jpg") returned 0 [0060.986] lstrlenA (lpString="*.jpg") returned 5 [0060.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.jpeg") returned 0 [0060.986] lstrlenA (lpString="*.jpeg") returned 6 [0060.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.psd") returned 0 [0060.986] lstrlenA (lpString="*.psd") returned 5 [0060.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.gif") returned 0 [0060.986] lstrlenA (lpString="*.gif") returned 5 [0060.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.doc") returned 0 [0060.986] lstrlenA (lpString="*.doc") returned 5 [0060.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.docx") returned 0 [0060.986] lstrlenA (lpString="*.docx") returned 6 [0060.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.xls") returned 0 [0060.986] lstrlenA (lpString="*.xls") returned 5 [0060.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.xlsx") returned 0 [0060.986] lstrlenA (lpString="*.xlsx") returned 6 [0060.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.ppt") returned 0 [0060.986] lstrlenA (lpString="*.ppt") returned 5 [0060.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.pptx") returned 0 [0060.986] lstrlenA (lpString="*.pptx") returned 6 [0060.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.pdf") returned 0 [0060.986] lstrlenA (lpString="*.pdf") returned 5 [0060.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.mov") returned 0 [0060.987] lstrlenA (lpString="*.mov") returned 5 [0060.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.m2v") returned 0 [0060.987] lstrlenA (lpString="*.m2v") returned 5 [0060.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.3gp") returned 0 [0060.987] lstrlenA (lpString="*.3gp") returned 5 [0060.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.mpeg") returned 0 [0060.987] lstrlenA (lpString="*.mpeg") returned 6 [0060.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.mpg") returned 0 [0060.987] lstrlenA (lpString="*.mpg") returned 5 [0060.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.flv") returned 0 [0060.987] lstrlenA (lpString="*.flv") returned 5 [0060.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.avi") returned 0 [0060.987] lstrlenA (lpString="*.avi") returned 5 [0060.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.mp4") returned 0 [0060.987] lstrlenA (lpString="*.mp4") returned 5 [0060.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.wmv") returned 0 [0060.987] lstrlenA (lpString="*.wmv") returned 5 [0060.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.divx") returned 0 [0060.987] lstrlenA (lpString="*.divx") returned 6 [0060.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.mkv") returned 0 [0060.987] lstrlenA (lpString="*.mkv") returned 5 [0060.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.mp3") returned 0 [0060.987] lstrlenA (lpString="*.mp3") returned 5 [0060.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.wav") returned 0 [0060.987] lstrlenA (lpString="*.wav") returned 5 [0060.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.flac") returned 0 [0060.988] lstrlenA (lpString="*.flac") returned 6 [0060.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.ape") returned 0 [0060.988] lstrlenA (lpString="*.ape") returned 5 [0060.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.wma") returned 0 [0060.988] lstrlenA (lpString="*.wma") returned 5 [0060.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.ac3") returned 0 [0060.988] lstrlenA (lpString="*.ac3") returned 5 [0060.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.mxf") returned 0 [0060.988] lstrlenA (lpString="*.mxf") returned 5 [0060.988] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd97, dwReserved0=0x0, dwReserved1=0x0, cFileName="spacebackupicons.jpg", cAlternateFileName="SPACEB~1.JPG")) returned 1 [0060.988] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.988] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="spacebackupicons.jpg") returned -1 [0060.988] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="spacebackupicons.jpg") returned -1 [0060.988] lstrcmpiA (lpString1="", lpString2="spacebackupicons.jpg") returned -1 [0060.988] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp") returned="SketchIconImages.bmp" [0060.988] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.988] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.988] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="spacebackupicons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" [0060.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", pszSpec="*.zip") returned 0 [0060.988] lstrlenA (lpString="*.zip") returned 5 [0060.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", pszSpec="*.rar") returned 0 [0060.988] lstrlenA (lpString="*.rar") returned 5 [0060.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", pszSpec="*.7z") returned 0 [0060.989] lstrlenA (lpString="*.7z") returned 4 [0060.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", pszSpec="*.tar") returned 0 [0060.989] lstrlenA (lpString="*.tar") returned 5 [0060.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", pszSpec="*.gzip") returned 0 [0060.989] lstrlenA (lpString="*.gzip") returned 6 [0060.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", pszSpec="*.jpg") returned 1 [0060.989] lstrlenA (lpString="*.jpg") returned 5 [0060.989] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" [0060.989] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" [0060.989] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg." [0060.989] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg.wannacry" [0060.989] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.990] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd97 [0060.990] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5aad71f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea)) returned 1 [0060.990] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.990] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd19, lpOverlapped=0x0) returned 1 [0060.992] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg") returned="spacebackupicons.jpg" [0060.992] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0060.992] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd19, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd19, lpOverlapped=0x0) returned 1 [0060.993] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0060.993] CloseHandle (hObject=0x90) returned 1 [0060.993] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg.wannacry")) returned 1 [0060.994] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="spacebackupiconsmask.bmp", cAlternateFileName="SPACEB~1.BMP")) returned 1 [0060.994] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.994] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="spacebackupiconsmask.bmp") returned -1 [0060.994] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="spacebackupiconsmask.bmp") returned -1 [0060.994] lstrcmpiA (lpString1="", lpString2="spacebackupiconsmask.bmp") returned -1 [0060.994] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg") returned="spacebackupicons.jpg" [0060.994] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.994] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.994] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.994] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.994] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="spacebackupiconsmask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp" [0060.994] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.zip") returned 0 [0060.994] lstrlenA (lpString="*.zip") returned 5 [0060.994] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.rar") returned 0 [0060.994] lstrlenA (lpString="*.rar") returned 5 [0060.994] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.7z") returned 0 [0060.995] lstrlenA (lpString="*.7z") returned 4 [0060.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.tar") returned 0 [0060.995] lstrlenA (lpString="*.tar") returned 5 [0060.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.gzip") returned 0 [0060.995] lstrlenA (lpString="*.gzip") returned 6 [0060.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.jpg") returned 0 [0060.995] lstrlenA (lpString="*.jpg") returned 5 [0060.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.jpeg") returned 0 [0060.995] lstrlenA (lpString="*.jpeg") returned 6 [0060.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.psd") returned 0 [0060.995] lstrlenA (lpString="*.psd") returned 5 [0060.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.gif") returned 0 [0060.995] lstrlenA (lpString="*.gif") returned 5 [0060.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.doc") returned 0 [0060.995] lstrlenA (lpString="*.doc") returned 5 [0060.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.docx") returned 0 [0060.995] lstrlenA (lpString="*.docx") returned 6 [0060.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.xls") returned 0 [0060.995] lstrlenA (lpString="*.xls") returned 5 [0060.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.xlsx") returned 0 [0060.995] lstrlenA (lpString="*.xlsx") returned 6 [0060.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.ppt") returned 0 [0060.995] lstrlenA (lpString="*.ppt") returned 5 [0060.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.pptx") returned 0 [0060.995] lstrlenA (lpString="*.pptx") returned 6 [0060.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.pdf") returned 0 [0060.995] lstrlenA (lpString="*.pdf") returned 5 [0060.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.mov") returned 0 [0060.996] lstrlenA (lpString="*.mov") returned 5 [0060.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.m2v") returned 0 [0060.996] lstrlenA (lpString="*.m2v") returned 5 [0060.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.3gp") returned 0 [0060.996] lstrlenA (lpString="*.3gp") returned 5 [0060.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.mpeg") returned 0 [0060.996] lstrlenA (lpString="*.mpeg") returned 6 [0060.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.mpg") returned 0 [0060.996] lstrlenA (lpString="*.mpg") returned 5 [0060.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.flv") returned 0 [0060.996] lstrlenA (lpString="*.flv") returned 5 [0060.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.avi") returned 0 [0060.996] lstrlenA (lpString="*.avi") returned 5 [0060.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.mp4") returned 0 [0060.996] lstrlenA (lpString="*.mp4") returned 5 [0060.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.wmv") returned 0 [0060.996] lstrlenA (lpString="*.wmv") returned 5 [0060.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.divx") returned 0 [0060.996] lstrlenA (lpString="*.divx") returned 6 [0060.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.mkv") returned 0 [0060.996] lstrlenA (lpString="*.mkv") returned 5 [0060.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.mp3") returned 0 [0060.996] lstrlenA (lpString="*.mp3") returned 5 [0060.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.wav") returned 0 [0060.996] lstrlenA (lpString="*.wav") returned 5 [0060.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.flac") returned 0 [0060.996] lstrlenA (lpString="*.flac") returned 6 [0060.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.ape") returned 0 [0060.997] lstrlenA (lpString="*.ape") returned 5 [0060.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.wma") returned 0 [0060.997] lstrlenA (lpString="*.wma") returned 5 [0060.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.ac3") returned 0 [0060.997] lstrlenA (lpString="*.ac3") returned 5 [0060.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.mxf") returned 0 [0060.997] lstrlenA (lpString="*.mxf") returned 5 [0060.997] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd14, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOPICON.JPG", cAlternateFileName="")) returned 1 [0060.997] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0060.997] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="STOPICON.JPG") returned -1 [0060.997] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="STOPICON.JPG") returned -1 [0060.997] lstrcmpiA (lpString1="", lpString2="STOPICON.JPG") returned -1 [0060.997] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp") returned="spacebackupiconsmask.bmp" [0060.997] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0060.997] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0060.997] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0060.997] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0060.997] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="STOPICON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" [0060.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", pszSpec="*.zip") returned 0 [0060.997] lstrlenA (lpString="*.zip") returned 5 [0060.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", pszSpec="*.rar") returned 0 [0060.997] lstrlenA (lpString="*.rar") returned 5 [0060.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", pszSpec="*.7z") returned 0 [0060.998] lstrlenA (lpString="*.7z") returned 4 [0060.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", pszSpec="*.tar") returned 0 [0060.998] lstrlenA (lpString="*.tar") returned 5 [0060.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", pszSpec="*.gzip") returned 0 [0060.998] lstrlenA (lpString="*.gzip") returned 6 [0060.998] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", pszSpec="*.jpg") returned 1 [0060.998] lstrlenA (lpString="*.jpg") returned 5 [0060.998] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" [0060.998] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" [0060.998] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG." [0060.998] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG.wannacry" [0060.998] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0060.999] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd14 [0061.000] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d3f0bd0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea)) returned 1 [0061.000] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.000] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xc96, lpOverlapped=0x0) returned 1 [0061.002] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG") returned="STOPICON.JPG" [0061.002] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.002] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xc96, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xc96, lpOverlapped=0x0) returned 1 [0061.002] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.003] CloseHandle (hObject=0x90) returned 1 [0061.003] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg.wannacry")) returned 1 [0061.003] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="StopIconMask.bmp", cAlternateFileName="STOPIC~1.BMP")) returned 1 [0061.004] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0061.004] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StopIconMask.bmp") returned -1 [0061.004] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StopIconMask.bmp") returned -1 [0061.004] lstrcmpiA (lpString1="", lpString2="StopIconMask.bmp") returned -1 [0061.004] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG") returned="STOPICON.JPG" [0061.004] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0061.004] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0061.004] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0061.004] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0061.004] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="StopIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp" [0061.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.zip") returned 0 [0061.004] lstrlenA (lpString="*.zip") returned 5 [0061.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.rar") returned 0 [0061.004] lstrlenA (lpString="*.rar") returned 5 [0061.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.7z") returned 0 [0061.004] lstrlenA (lpString="*.7z") returned 4 [0061.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.tar") returned 0 [0061.004] lstrlenA (lpString="*.tar") returned 5 [0061.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.gzip") returned 0 [0061.004] lstrlenA (lpString="*.gzip") returned 6 [0061.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.jpg") returned 0 [0061.004] lstrlenA (lpString="*.jpg") returned 5 [0061.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.jpeg") returned 0 [0061.005] lstrlenA (lpString="*.jpeg") returned 6 [0061.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.psd") returned 0 [0061.005] lstrlenA (lpString="*.psd") returned 5 [0061.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.gif") returned 0 [0061.005] lstrlenA (lpString="*.gif") returned 5 [0061.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.doc") returned 0 [0061.005] lstrlenA (lpString="*.doc") returned 5 [0061.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.docx") returned 0 [0061.005] lstrlenA (lpString="*.docx") returned 6 [0061.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.xls") returned 0 [0061.005] lstrlenA (lpString="*.xls") returned 5 [0061.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.xlsx") returned 0 [0061.005] lstrlenA (lpString="*.xlsx") returned 6 [0061.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.ppt") returned 0 [0061.005] lstrlenA (lpString="*.ppt") returned 5 [0061.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.pptx") returned 0 [0061.005] lstrlenA (lpString="*.pptx") returned 6 [0061.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.pdf") returned 0 [0061.005] lstrlenA (lpString="*.pdf") returned 5 [0061.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.mov") returned 0 [0061.005] lstrlenA (lpString="*.mov") returned 5 [0061.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.m2v") returned 0 [0061.005] lstrlenA (lpString="*.m2v") returned 5 [0061.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.3gp") returned 0 [0061.005] lstrlenA (lpString="*.3gp") returned 5 [0061.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.mpeg") returned 0 [0061.005] lstrlenA (lpString="*.mpeg") returned 6 [0061.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.mpg") returned 0 [0061.006] lstrlenA (lpString="*.mpg") returned 5 [0061.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.flv") returned 0 [0061.006] lstrlenA (lpString="*.flv") returned 5 [0061.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.avi") returned 0 [0061.006] lstrlenA (lpString="*.avi") returned 5 [0061.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.mp4") returned 0 [0061.006] lstrlenA (lpString="*.mp4") returned 5 [0061.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.wmv") returned 0 [0061.006] lstrlenA (lpString="*.wmv") returned 5 [0061.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.divx") returned 0 [0061.006] lstrlenA (lpString="*.divx") returned 6 [0061.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.mkv") returned 0 [0061.006] lstrlenA (lpString="*.mkv") returned 5 [0061.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.mp3") returned 0 [0061.006] lstrlenA (lpString="*.mp3") returned 5 [0061.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.wav") returned 0 [0061.006] lstrlenA (lpString="*.wav") returned 5 [0061.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.flac") returned 0 [0061.006] lstrlenA (lpString="*.flac") returned 6 [0061.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.ape") returned 0 [0061.006] lstrlenA (lpString="*.ape") returned 5 [0061.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.wma") returned 0 [0061.007] lstrlenA (lpString="*.wma") returned 5 [0061.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.ac3") returned 0 [0061.007] lstrlenA (lpString="*.ac3") returned 5 [0061.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.mxf") returned 0 [0061.007] lstrlenA (lpString="*.mxf") returned 5 [0061.007] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d554a00, ftCreationTime.dwHighDateTime=0x1ca0b45, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d554a00, ftLastWriteTime.dwHighDateTime=0x1ca0b45, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaskbarIconImages256Colors.bmp", cAlternateFileName="TASKBA~1.BMP")) returned 1 [0061.007] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0061.007] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TaskbarIconImages256Colors.bmp") returned -1 [0061.007] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TaskbarIconImages256Colors.bmp") returned -1 [0061.007] lstrcmpiA (lpString1="", lpString2="TaskbarIconImages256Colors.bmp") returned -1 [0061.007] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp") returned="StopIconMask.bmp" [0061.007] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0061.007] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0061.007] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0061.007] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0061.007] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="TaskbarIconImages256Colors.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" [0061.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.zip") returned 0 [0061.007] lstrlenA (lpString="*.zip") returned 5 [0061.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.rar") returned 0 [0061.007] lstrlenA (lpString="*.rar") returned 5 [0061.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.7z") returned 0 [0061.007] lstrlenA (lpString="*.7z") returned 4 [0061.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.tar") returned 0 [0061.008] lstrlenA (lpString="*.tar") returned 5 [0061.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.gzip") returned 0 [0061.008] lstrlenA (lpString="*.gzip") returned 6 [0061.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.jpg") returned 0 [0061.008] lstrlenA (lpString="*.jpg") returned 5 [0061.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.jpeg") returned 0 [0061.008] lstrlenA (lpString="*.jpeg") returned 6 [0061.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.psd") returned 0 [0061.008] lstrlenA (lpString="*.psd") returned 5 [0061.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.gif") returned 0 [0061.008] lstrlenA (lpString="*.gif") returned 5 [0061.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.doc") returned 0 [0061.008] lstrlenA (lpString="*.doc") returned 5 [0061.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.docx") returned 0 [0061.008] lstrlenA (lpString="*.docx") returned 6 [0061.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.xls") returned 0 [0061.008] lstrlenA (lpString="*.xls") returned 5 [0061.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.xlsx") returned 0 [0061.008] lstrlenA (lpString="*.xlsx") returned 6 [0061.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.ppt") returned 0 [0061.008] lstrlenA (lpString="*.ppt") returned 5 [0061.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.pptx") returned 0 [0061.008] lstrlenA (lpString="*.pptx") returned 6 [0061.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.pdf") returned 0 [0061.008] lstrlenA (lpString="*.pdf") returned 5 [0061.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.mov") returned 0 [0061.008] lstrlenA (lpString="*.mov") returned 5 [0061.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.m2v") returned 0 [0061.009] lstrlenA (lpString="*.m2v") returned 5 [0061.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.3gp") returned 0 [0061.009] lstrlenA (lpString="*.3gp") returned 5 [0061.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.mpeg") returned 0 [0061.009] lstrlenA (lpString="*.mpeg") returned 6 [0061.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.mpg") returned 0 [0061.009] lstrlenA (lpString="*.mpg") returned 5 [0061.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.flv") returned 0 [0061.009] lstrlenA (lpString="*.flv") returned 5 [0061.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.avi") returned 0 [0061.009] lstrlenA (lpString="*.avi") returned 5 [0061.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.mp4") returned 0 [0061.009] lstrlenA (lpString="*.mp4") returned 5 [0061.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.wmv") returned 0 [0061.009] lstrlenA (lpString="*.wmv") returned 5 [0061.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.divx") returned 0 [0061.009] lstrlenA (lpString="*.divx") returned 6 [0061.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.mkv") returned 0 [0061.009] lstrlenA (lpString="*.mkv") returned 5 [0061.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.mp3") returned 0 [0061.009] lstrlenA (lpString="*.mp3") returned 5 [0061.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.wav") returned 0 [0061.009] lstrlenA (lpString="*.wav") returned 5 [0061.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.flac") returned 0 [0061.009] lstrlenA (lpString="*.flac") returned 6 [0061.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.ape") returned 0 [0061.009] lstrlenA (lpString="*.ape") returned 5 [0061.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.wma") returned 0 [0061.010] lstrlenA (lpString="*.wma") returned 5 [0061.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.ac3") returned 0 [0061.010] lstrlenA (lpString="*.ac3") returned 5 [0061.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.mxf") returned 0 [0061.010] lstrlenA (lpString="*.mxf") returned 5 [0061.010] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cd49300, ftCreationTime.dwHighDateTime=0x1ca0b45, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd49300, ftLastWriteTime.dwHighDateTime=0x1ca0b45, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaskbarIconImagesMask256Colors.bmp", cAlternateFileName="TASKBA~2.BMP")) returned 1 [0061.010] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0061.010] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TaskbarIconImagesMask256Colors.bmp") returned -1 [0061.010] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TaskbarIconImagesMask256Colors.bmp") returned -1 [0061.010] lstrcmpiA (lpString1="", lpString2="TaskbarIconImagesMask256Colors.bmp") returned -1 [0061.010] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp") returned="TaskbarIconImages256Colors.bmp" [0061.010] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0061.010] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0061.010] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0061.010] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0061.010] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="TaskbarIconImagesMask256Colors.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" [0061.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.zip") returned 0 [0061.010] lstrlenA (lpString="*.zip") returned 5 [0061.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.rar") returned 0 [0061.010] lstrlenA (lpString="*.rar") returned 5 [0061.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.7z") returned 0 [0061.010] lstrlenA (lpString="*.7z") returned 4 [0061.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.tar") returned 0 [0061.010] lstrlenA (lpString="*.tar") returned 5 [0061.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.gzip") returned 0 [0061.011] lstrlenA (lpString="*.gzip") returned 6 [0061.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.jpg") returned 0 [0061.011] lstrlenA (lpString="*.jpg") returned 5 [0061.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.jpeg") returned 0 [0061.011] lstrlenA (lpString="*.jpeg") returned 6 [0061.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.psd") returned 0 [0061.011] lstrlenA (lpString="*.psd") returned 5 [0061.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.gif") returned 0 [0061.011] lstrlenA (lpString="*.gif") returned 5 [0061.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.doc") returned 0 [0061.011] lstrlenA (lpString="*.doc") returned 5 [0061.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.docx") returned 0 [0061.011] lstrlenA (lpString="*.docx") returned 6 [0061.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.xls") returned 0 [0061.011] lstrlenA (lpString="*.xls") returned 5 [0061.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.xlsx") returned 0 [0061.011] lstrlenA (lpString="*.xlsx") returned 6 [0061.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.ppt") returned 0 [0061.011] lstrlenA (lpString="*.ppt") returned 5 [0061.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.pptx") returned 0 [0061.011] lstrlenA (lpString="*.pptx") returned 6 [0061.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.pdf") returned 0 [0061.011] lstrlenA (lpString="*.pdf") returned 5 [0061.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.mov") returned 0 [0061.011] lstrlenA (lpString="*.mov") returned 5 [0061.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.m2v") returned 0 [0061.012] lstrlenA (lpString="*.m2v") returned 5 [0061.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.3gp") returned 0 [0061.012] lstrlenA (lpString="*.3gp") returned 5 [0061.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.mpeg") returned 0 [0061.012] lstrlenA (lpString="*.mpeg") returned 6 [0061.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.mpg") returned 0 [0061.012] lstrlenA (lpString="*.mpg") returned 5 [0061.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.flv") returned 0 [0061.012] lstrlenA (lpString="*.flv") returned 5 [0061.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.avi") returned 0 [0061.012] lstrlenA (lpString="*.avi") returned 5 [0061.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.mp4") returned 0 [0061.012] lstrlenA (lpString="*.mp4") returned 5 [0061.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.wmv") returned 0 [0061.012] lstrlenA (lpString="*.wmv") returned 5 [0061.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.divx") returned 0 [0061.012] lstrlenA (lpString="*.divx") returned 6 [0061.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.mkv") returned 0 [0061.012] lstrlenA (lpString="*.mkv") returned 5 [0061.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.mp3") returned 0 [0061.012] lstrlenA (lpString="*.mp3") returned 5 [0061.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.wav") returned 0 [0061.012] lstrlenA (lpString="*.wav") returned 5 [0061.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.flac") returned 0 [0061.012] lstrlenA (lpString="*.flac") returned 6 [0061.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.ape") returned 0 [0061.012] lstrlenA (lpString="*.ape") returned 5 [0061.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.wma") returned 0 [0061.013] lstrlenA (lpString="*.wma") returned 5 [0061.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.ac3") returned 0 [0061.013] lstrlenA (lpString="*.ac3") returned 5 [0061.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.mxf") returned 0 [0061.013] lstrlenA (lpString="*.mxf") returned 5 [0061.013] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a1d2c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5adf6ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7a1d2c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2605, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipsImage.jpg", cAlternateFileName="TIPSIM~1.JPG")) returned 1 [0061.013] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0061.013] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TipsImage.jpg") returned -1 [0061.013] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TipsImage.jpg") returned -1 [0061.013] lstrcmpiA (lpString1="", lpString2="TipsImage.jpg") returned -1 [0061.013] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp") returned="TaskbarIconImagesMask256Colors.bmp" [0061.013] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0061.013] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0061.013] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0061.013] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0061.013] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="TipsImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" [0061.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", pszSpec="*.zip") returned 0 [0061.013] lstrlenA (lpString="*.zip") returned 5 [0061.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", pszSpec="*.rar") returned 0 [0061.013] lstrlenA (lpString="*.rar") returned 5 [0061.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", pszSpec="*.7z") returned 0 [0061.013] lstrlenA (lpString="*.7z") returned 4 [0061.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", pszSpec="*.tar") returned 0 [0061.013] lstrlenA (lpString="*.tar") returned 5 [0061.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", pszSpec="*.gzip") returned 0 [0061.014] lstrlenA (lpString="*.gzip") returned 6 [0061.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", pszSpec="*.jpg") returned 1 [0061.014] lstrlenA (lpString="*.jpg") returned 5 [0061.014] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" [0061.014] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" [0061.014] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg." [0061.014] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg.wannacry" [0061.014] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0061.018] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2605 [0061.018] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7a1d2c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5adf6ed0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7a1d2c00, dwHighDateTime=0x1c747ea)) returned 1 [0061.018] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.018] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2587, lpOverlapped=0x0) returned 1 [0061.020] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg") returned="TipsImage.jpg" [0061.021] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.021] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2587, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2587, lpOverlapped=0x0) returned 1 [0061.021] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.021] CloseHandle (hObject=0x90) returned 1 [0061.021] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg.wannacry")) returned 1 [0061.023] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a1d2c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ae1d030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7a1d2c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="TipsImageMask.bmp", cAlternateFileName="TIPSIM~1.BMP")) returned 1 [0061.023] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0061.023] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TipsImageMask.bmp") returned -1 [0061.023] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TipsImageMask.bmp") returned -1 [0061.023] lstrcmpiA (lpString1="", lpString2="TipsImageMask.bmp") returned -1 [0061.023] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg") returned="TipsImage.jpg" [0061.023] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0061.023] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0061.023] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0061.023] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0061.023] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="TipsImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp" [0061.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.zip") returned 0 [0061.023] lstrlenA (lpString="*.zip") returned 5 [0061.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.rar") returned 0 [0061.023] lstrlenA (lpString="*.rar") returned 5 [0061.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.7z") returned 0 [0061.023] lstrlenA (lpString="*.7z") returned 4 [0061.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.tar") returned 0 [0061.023] lstrlenA (lpString="*.tar") returned 5 [0061.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.gzip") returned 0 [0061.023] lstrlenA (lpString="*.gzip") returned 6 [0061.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.jpg") returned 0 [0061.023] lstrlenA (lpString="*.jpg") returned 5 [0061.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.jpeg") returned 0 [0061.024] lstrlenA (lpString="*.jpeg") returned 6 [0061.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.psd") returned 0 [0061.024] lstrlenA (lpString="*.psd") returned 5 [0061.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.gif") returned 0 [0061.024] lstrlenA (lpString="*.gif") returned 5 [0061.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.doc") returned 0 [0061.024] lstrlenA (lpString="*.doc") returned 5 [0061.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.docx") returned 0 [0061.024] lstrlenA (lpString="*.docx") returned 6 [0061.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.xls") returned 0 [0061.024] lstrlenA (lpString="*.xls") returned 5 [0061.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.xlsx") returned 0 [0061.024] lstrlenA (lpString="*.xlsx") returned 6 [0061.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.ppt") returned 0 [0061.024] lstrlenA (lpString="*.ppt") returned 5 [0061.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.pptx") returned 0 [0061.024] lstrlenA (lpString="*.pptx") returned 6 [0061.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.pdf") returned 0 [0061.024] lstrlenA (lpString="*.pdf") returned 5 [0061.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.mov") returned 0 [0061.024] lstrlenA (lpString="*.mov") returned 5 [0061.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.m2v") returned 0 [0061.024] lstrlenA (lpString="*.m2v") returned 5 [0061.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.3gp") returned 0 [0061.024] lstrlenA (lpString="*.3gp") returned 5 [0061.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.mpeg") returned 0 [0061.024] lstrlenA (lpString="*.mpeg") returned 6 [0061.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.mpg") returned 0 [0061.025] lstrlenA (lpString="*.mpg") returned 5 [0061.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.flv") returned 0 [0061.025] lstrlenA (lpString="*.flv") returned 5 [0061.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.avi") returned 0 [0061.025] lstrlenA (lpString="*.avi") returned 5 [0061.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.mp4") returned 0 [0061.025] lstrlenA (lpString="*.mp4") returned 5 [0061.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.wmv") returned 0 [0061.025] lstrlenA (lpString="*.wmv") returned 5 [0061.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.divx") returned 0 [0061.025] lstrlenA (lpString="*.divx") returned 6 [0061.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.mkv") returned 0 [0061.025] lstrlenA (lpString="*.mkv") returned 5 [0061.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.mp3") returned 0 [0061.025] lstrlenA (lpString="*.mp3") returned 5 [0061.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.wav") returned 0 [0061.025] lstrlenA (lpString="*.wav") returned 5 [0061.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.flac") returned 0 [0061.025] lstrlenA (lpString="*.flac") returned 6 [0061.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.ape") returned 0 [0061.025] lstrlenA (lpString="*.ape") returned 5 [0061.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.wma") returned 0 [0061.025] lstrlenA (lpString="*.wma") returned 5 [0061.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.ac3") returned 0 [0061.025] lstrlenA (lpString="*.ac3") returned 5 [0061.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.mxf") returned 0 [0061.025] lstrlenA (lpString="*.mxf") returned 5 [0061.025] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4e5900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b4e5900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0x0, dwReserved1=0x0, cFileName="VeriSignLogo.jpg", cAlternateFileName="VERISI~1.JPG")) returned 1 [0061.026] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0061.026] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VeriSignLogo.jpg") returned -1 [0061.026] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VeriSignLogo.jpg") returned -1 [0061.026] lstrcmpiA (lpString1="", lpString2="VeriSignLogo.jpg") returned -1 [0061.026] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp") returned="TipsImageMask.bmp" [0061.026] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0061.026] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0061.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0061.026] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0061.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="VeriSignLogo.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" [0061.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", pszSpec="*.zip") returned 0 [0061.026] lstrlenA (lpString="*.zip") returned 5 [0061.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", pszSpec="*.rar") returned 0 [0061.026] lstrlenA (lpString="*.rar") returned 5 [0061.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", pszSpec="*.7z") returned 0 [0061.026] lstrlenA (lpString="*.7z") returned 4 [0061.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", pszSpec="*.tar") returned 0 [0061.026] lstrlenA (lpString="*.tar") returned 5 [0061.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", pszSpec="*.gzip") returned 0 [0061.026] lstrlenA (lpString="*.gzip") returned 6 [0061.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", pszSpec="*.jpg") returned 1 [0061.026] lstrlenA (lpString="*.jpg") returned 5 [0061.026] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" [0061.027] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" [0061.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg." [0061.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg.wannacry" [0061.027] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0061.027] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x450 [0061.027] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7b4e5900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e490770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7b4e5900, dwHighDateTime=0x1c747ea)) returned 1 [0061.028] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.028] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3d2, lpOverlapped=0x0) returned 1 [0061.030] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg") returned="VeriSignLogo.jpg" [0061.030] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.030] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3d2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3d2, lpOverlapped=0x0) returned 1 [0061.030] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.030] CloseHandle (hObject=0x90) returned 1 [0061.031] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg.wannacry")) returned 1 [0061.032] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bafc00, ftCreationTime.dwHighDateTime=0x1ca032f, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90bafc00, ftLastWriteTime.dwHighDateTime=0x1ca032f, nFileSizeHigh=0x0, nFileSizeLow=0x5431, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="WebToolIconImages.jpg", cAlternateFileName="WEBTOO~1.JPG")) returned 1 [0061.032] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0061.032] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WebToolIconImages.jpg") returned -1 [0061.032] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebToolIconImages.jpg") returned -1 [0061.032] lstrcmpiA (lpString1="", lpString2="WebToolIconImages.jpg") returned -1 [0061.032] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg") returned="VeriSignLogo.jpg" [0061.032] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0061.032] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0061.032] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0061.032] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0061.032] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="WebToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" [0061.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", pszSpec="*.zip") returned 0 [0061.032] lstrlenA (lpString="*.zip") returned 5 [0061.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", pszSpec="*.rar") returned 0 [0061.032] lstrlenA (lpString="*.rar") returned 5 [0061.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", pszSpec="*.7z") returned 0 [0061.032] lstrlenA (lpString="*.7z") returned 4 [0061.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", pszSpec="*.tar") returned 0 [0061.032] lstrlenA (lpString="*.tar") returned 5 [0061.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", pszSpec="*.gzip") returned 0 [0061.032] lstrlenA (lpString="*.gzip") returned 6 [0061.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", pszSpec="*.jpg") returned 1 [0061.033] lstrlenA (lpString="*.jpg") returned 5 [0061.033] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" [0061.033] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" [0061.033] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg." [0061.033] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg.wannacry" [0061.033] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0061.033] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5431 [0061.033] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90bafc00, dwHighDateTime=0x1ca032f), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e5c1270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90bafc00, dwHighDateTime=0x1ca032f)) returned 1 [0061.034] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.034] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x53b3, lpOverlapped=0x0) returned 1 [0061.036] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg") returned="WebToolIconImages.jpg" [0061.036] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.036] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x53b3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x53b3, lpOverlapped=0x0) returned 1 [0061.036] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.036] CloseHandle (hObject=0x90) returned 1 [0061.036] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg.wannacry")) returned 1 [0061.038] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8862c100, ftCreationTime.dwHighDateTime=0x1ca032f, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8862c100, ftLastWriteTime.dwHighDateTime=0x1ca032f, nFileSizeHigh=0x0, nFileSizeLow=0x1538, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="WebToolIconImagesMask.bmp", cAlternateFileName="WEBTOO~1.BMP")) returned 1 [0061.038] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0061.038] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WebToolIconImagesMask.bmp") returned -1 [0061.038] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebToolIconImagesMask.bmp") returned -1 [0061.038] lstrcmpiA (lpString1="", lpString2="WebToolIconImagesMask.bmp") returned -1 [0061.038] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg") returned="WebToolIconImages.jpg" [0061.038] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0061.038] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0061.038] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0061.038] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0061.038] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="WebToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp" [0061.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0061.038] lstrlenA (lpString="*.zip") returned 5 [0061.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0061.038] lstrlenA (lpString="*.rar") returned 5 [0061.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0061.039] lstrlenA (lpString="*.7z") returned 4 [0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0061.039] lstrlenA (lpString="*.tar") returned 5 [0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0061.039] lstrlenA (lpString="*.gzip") returned 6 [0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0061.039] lstrlenA (lpString="*.jpg") returned 5 [0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0061.039] lstrlenA (lpString="*.jpeg") returned 6 [0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0061.039] lstrlenA (lpString="*.psd") returned 5 [0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.gif") returned 0 [0061.039] lstrlenA (lpString="*.gif") returned 5 [0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.doc") returned 0 [0061.039] lstrlenA (lpString="*.doc") returned 5 [0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.docx") returned 0 [0061.039] lstrlenA (lpString="*.docx") returned 6 [0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.xls") returned 0 [0061.039] lstrlenA (lpString="*.xls") returned 5 [0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.xlsx") returned 0 [0061.039] lstrlenA (lpString="*.xlsx") returned 6 [0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.ppt") returned 0 [0061.039] lstrlenA (lpString="*.ppt") returned 5 [0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.pptx") returned 0 [0061.039] lstrlenA (lpString="*.pptx") returned 6 [0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.pdf") returned 0 [0061.039] lstrlenA (lpString="*.pdf") returned 5 [0061.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.mov") returned 0 [0061.040] lstrlenA (lpString="*.mov") returned 5 [0061.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.m2v") returned 0 [0061.040] lstrlenA (lpString="*.m2v") returned 5 [0061.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.3gp") returned 0 [0061.040] lstrlenA (lpString="*.3gp") returned 5 [0061.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.mpeg") returned 0 [0061.040] lstrlenA (lpString="*.mpeg") returned 6 [0061.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.mpg") returned 0 [0061.040] lstrlenA (lpString="*.mpg") returned 5 [0061.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.flv") returned 0 [0061.040] lstrlenA (lpString="*.flv") returned 5 [0061.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.avi") returned 0 [0061.040] lstrlenA (lpString="*.avi") returned 5 [0061.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.mp4") returned 0 [0061.040] lstrlenA (lpString="*.mp4") returned 5 [0061.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.wmv") returned 0 [0061.040] lstrlenA (lpString="*.wmv") returned 5 [0061.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.divx") returned 0 [0061.040] lstrlenA (lpString="*.divx") returned 6 [0061.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.mkv") returned 0 [0061.040] lstrlenA (lpString="*.mkv") returned 5 [0061.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.mp3") returned 0 [0061.040] lstrlenA (lpString="*.mp3") returned 5 [0061.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.wav") returned 0 [0061.040] lstrlenA (lpString="*.wav") returned 5 [0061.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.flac") returned 0 [0061.040] lstrlenA (lpString="*.flac") returned 6 [0061.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.ape") returned 0 [0061.041] lstrlenA (lpString="*.ape") returned 5 [0061.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.wma") returned 0 [0061.041] lstrlenA (lpString="*.wma") returned 5 [0061.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.ac3") returned 0 [0061.041] lstrlenA (lpString="*.ac3") returned 5 [0061.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.mxf") returned 0 [0061.041] lstrlenA (lpString="*.mxf") returned 5 [0061.041] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4e5900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x708c13f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b4e5900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1995, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebToolImages16x16.jpg", cAlternateFileName="WEBTOO~2.JPG")) returned 1 [0061.041] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0061.041] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WebToolImages16x16.jpg") returned -1 [0061.041] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebToolImages16x16.jpg") returned -1 [0061.041] lstrcmpiA (lpString1="", lpString2="WebToolImages16x16.jpg") returned -1 [0061.041] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp") returned="WebToolIconImagesMask.bmp" [0061.041] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0061.041] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0061.041] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0061.041] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0061.041] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="WebToolImages16x16.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" [0061.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", pszSpec="*.zip") returned 0 [0061.041] lstrlenA (lpString="*.zip") returned 5 [0061.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", pszSpec="*.rar") returned 0 [0061.041] lstrlenA (lpString="*.rar") returned 5 [0061.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", pszSpec="*.7z") returned 0 [0061.042] lstrlenA (lpString="*.7z") returned 4 [0061.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", pszSpec="*.tar") returned 0 [0061.042] lstrlenA (lpString="*.tar") returned 5 [0061.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", pszSpec="*.gzip") returned 0 [0061.042] lstrlenA (lpString="*.gzip") returned 6 [0061.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", pszSpec="*.jpg") returned 1 [0061.042] lstrlenA (lpString="*.jpg") returned 5 [0061.042] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" [0061.042] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" [0061.042] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0061.043] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1995 [0061.043] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7b4e5900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x708c13f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7b4e5900, dwHighDateTime=0x1c747ea)) returned 1 [0061.043] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.043] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1917, lpOverlapped=0x0) returned 1 [0061.045] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg") returned="WebToolImages16x16.jpg" [0061.045] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.045] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1917, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1917, lpOverlapped=0x0) returned 1 [0061.045] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.046] CloseHandle (hObject=0x90) returned 1 [0061.046] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg.wannacry")) returned 1 [0061.047] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4e5900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b4e5900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="WebToolImagesMask16x16.bmp", cAlternateFileName="WEBTOO~2.BMP")) returned 1 [0061.047] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0061.047] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WebToolImagesMask16x16.bmp") returned -1 [0061.047] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebToolImagesMask16x16.bmp") returned -1 [0061.047] lstrcmpiA (lpString1="", lpString2="WebToolImagesMask16x16.bmp") returned -1 [0061.047] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg") returned="WebToolImages16x16.jpg" [0061.047] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0061.047] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0061.047] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0061.047] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="WebToolImagesMask16x16.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp" [0061.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.zip") returned 0 [0061.047] lstrlenA (lpString="*.zip") returned 5 [0061.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.rar") returned 0 [0061.047] lstrlenA (lpString="*.rar") returned 5 [0061.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.7z") returned 0 [0061.047] lstrlenA (lpString="*.7z") returned 4 [0061.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.tar") returned 0 [0061.047] lstrlenA (lpString="*.tar") returned 5 [0061.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.gzip") returned 0 [0061.047] lstrlenA (lpString="*.gzip") returned 6 [0061.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.jpg") returned 0 [0061.048] lstrlenA (lpString="*.jpg") returned 5 [0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.jpeg") returned 0 [0061.048] lstrlenA (lpString="*.jpeg") returned 6 [0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.psd") returned 0 [0061.048] lstrlenA (lpString="*.psd") returned 5 [0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.gif") returned 0 [0061.048] lstrlenA (lpString="*.gif") returned 5 [0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.doc") returned 0 [0061.048] lstrlenA (lpString="*.doc") returned 5 [0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.docx") returned 0 [0061.048] lstrlenA (lpString="*.docx") returned 6 [0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.xls") returned 0 [0061.048] lstrlenA (lpString="*.xls") returned 5 [0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.xlsx") returned 0 [0061.048] lstrlenA (lpString="*.xlsx") returned 6 [0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.ppt") returned 0 [0061.048] lstrlenA (lpString="*.ppt") returned 5 [0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.pptx") returned 0 [0061.048] lstrlenA (lpString="*.pptx") returned 6 [0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.pdf") returned 0 [0061.048] lstrlenA (lpString="*.pdf") returned 5 [0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.mov") returned 0 [0061.048] lstrlenA (lpString="*.mov") returned 5 [0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.m2v") returned 0 [0061.048] lstrlenA (lpString="*.m2v") returned 5 [0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.3gp") returned 0 [0061.048] lstrlenA (lpString="*.3gp") returned 5 [0061.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.mpeg") returned 0 [0061.049] lstrlenA (lpString="*.mpeg") returned 6 [0061.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.mpg") returned 0 [0061.049] lstrlenA (lpString="*.mpg") returned 5 [0061.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.flv") returned 0 [0061.049] lstrlenA (lpString="*.flv") returned 5 [0061.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.avi") returned 0 [0061.049] lstrlenA (lpString="*.avi") returned 5 [0061.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.mp4") returned 0 [0061.049] lstrlenA (lpString="*.mp4") returned 5 [0061.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.wmv") returned 0 [0061.049] lstrlenA (lpString="*.wmv") returned 5 [0061.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.divx") returned 0 [0061.049] lstrlenA (lpString="*.divx") returned 6 [0061.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.mkv") returned 0 [0061.049] lstrlenA (lpString="*.mkv") returned 5 [0061.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.mp3") returned 0 [0061.049] lstrlenA (lpString="*.mp3") returned 5 [0061.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.wav") returned 0 [0061.049] lstrlenA (lpString="*.wav") returned 5 [0061.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.flac") returned 0 [0061.049] lstrlenA (lpString="*.flac") returned 6 [0061.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.ape") returned 0 [0061.049] lstrlenA (lpString="*.ape") returned 5 [0061.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.wma") returned 0 [0061.049] lstrlenA (lpString="*.wma") returned 5 [0061.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.ac3") returned 0 [0061.049] lstrlenA (lpString="*.ac3") returned 5 [0061.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.mxf") returned 0 [0061.050] lstrlenA (lpString="*.mxf") returned 5 [0061.050] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2308, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSSFilesToolIconImages.jpg", cAlternateFileName="WSSFIL~1.JPG")) returned 1 [0061.050] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0061.050] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WSSFilesToolIconImages.jpg") returned -1 [0061.050] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WSSFilesToolIconImages.jpg") returned -1 [0061.050] lstrcmpiA (lpString1="", lpString2="WSSFilesToolIconImages.jpg") returned -1 [0061.050] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp") returned="WebToolImagesMask16x16.bmp" [0061.050] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0061.050] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0061.050] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0061.050] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0061.050] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="WSSFilesToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" [0061.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", pszSpec="*.zip") returned 0 [0061.050] lstrlenA (lpString="*.zip") returned 5 [0061.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", pszSpec="*.rar") returned 0 [0061.050] lstrlenA (lpString="*.rar") returned 5 [0061.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", pszSpec="*.7z") returned 0 [0061.050] lstrlenA (lpString="*.7z") returned 4 [0061.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", pszSpec="*.tar") returned 0 [0061.050] lstrlenA (lpString="*.tar") returned 5 [0061.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", pszSpec="*.gzip") returned 0 [0061.050] lstrlenA (lpString="*.gzip") returned 6 [0061.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", pszSpec="*.jpg") returned 1 [0061.051] lstrlenA (lpString="*.jpg") returned 5 [0061.051] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" [0061.051] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" [0061.051] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg." [0061.051] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg.wannacry" [0061.051] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0061.052] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2308 [0061.052] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7c7f8600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x709f1ef0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7c7f8600, dwHighDateTime=0x1c747ea)) returned 1 [0061.052] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.052] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x228a, lpOverlapped=0x0) returned 1 [0061.106] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg") returned="WSSFilesToolIconImages.jpg" [0061.106] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.106] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x228a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x228a, lpOverlapped=0x0) returned 1 [0061.106] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.107] CloseHandle (hObject=0x90) returned 1 [0061.107] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg.wannacry")) returned 1 [0061.108] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e633690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="WSSFilesToolIconImagesMask.bmp", cAlternateFileName="WSSFIL~1.BMP")) returned 1 [0061.108] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0061.108] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WSSFilesToolIconImagesMask.bmp") returned -1 [0061.108] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WSSFilesToolIconImagesMask.bmp") returned -1 [0061.108] lstrcmpiA (lpString1="", lpString2="WSSFilesToolIconImagesMask.bmp") returned -1 [0061.108] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg") returned="WSSFilesToolIconImages.jpg" [0061.108] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" [0061.108] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned="" [0061.108] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" [0061.108] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\how to decrypt files.txt")) returned 0x20 [0061.108] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="WSSFilesToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp" [0061.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0061.109] lstrlenA (lpString="*.zip") returned 5 [0061.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0061.109] lstrlenA (lpString="*.rar") returned 5 [0061.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0061.109] lstrlenA (lpString="*.7z") returned 4 [0061.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0061.109] lstrlenA (lpString="*.tar") returned 5 [0061.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0061.109] lstrlenA (lpString="*.gzip") returned 6 [0061.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0061.109] lstrlenA (lpString="*.jpg") returned 5 [0061.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0061.109] lstrlenA (lpString="*.jpeg") returned 6 [0061.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0061.109] lstrlenA (lpString="*.psd") returned 5 [0061.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.gif") returned 0 [0061.109] lstrlenA (lpString="*.gif") returned 5 [0061.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.doc") returned 0 [0061.109] lstrlenA (lpString="*.doc") returned 5 [0061.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.docx") returned 0 [0061.109] lstrlenA (lpString="*.docx") returned 6 [0061.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.xls") returned 0 [0061.109] lstrlenA (lpString="*.xls") returned 5 [0061.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.xlsx") returned 0 [0061.109] lstrlenA (lpString="*.xlsx") returned 6 [0061.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.ppt") returned 0 [0061.110] lstrlenA (lpString="*.ppt") returned 5 [0061.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.pptx") returned 0 [0061.110] lstrlenA (lpString="*.pptx") returned 6 [0061.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.pdf") returned 0 [0061.110] lstrlenA (lpString="*.pdf") returned 5 [0061.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.mov") returned 0 [0061.110] lstrlenA (lpString="*.mov") returned 5 [0061.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.m2v") returned 0 [0061.110] lstrlenA (lpString="*.m2v") returned 5 [0061.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.3gp") returned 0 [0061.110] lstrlenA (lpString="*.3gp") returned 5 [0061.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.mpeg") returned 0 [0061.110] lstrlenA (lpString="*.mpeg") returned 6 [0061.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.mpg") returned 0 [0061.110] lstrlenA (lpString="*.mpg") returned 5 [0061.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.flv") returned 0 [0061.110] lstrlenA (lpString="*.flv") returned 5 [0061.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.avi") returned 0 [0061.110] lstrlenA (lpString="*.avi") returned 5 [0061.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.mp4") returned 0 [0061.110] lstrlenA (lpString="*.mp4") returned 5 [0061.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.wmv") returned 0 [0061.110] lstrlenA (lpString="*.wmv") returned 5 [0061.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.divx") returned 0 [0061.111] lstrlenA (lpString="*.divx") returned 6 [0061.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.mkv") returned 0 [0061.111] lstrlenA (lpString="*.mkv") returned 5 [0061.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.mp3") returned 0 [0061.111] lstrlenA (lpString="*.mp3") returned 5 [0061.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.wav") returned 0 [0061.111] lstrlenA (lpString="*.wav") returned 5 [0061.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.flac") returned 0 [0061.111] lstrlenA (lpString="*.flac") returned 6 [0061.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.ape") returned 0 [0061.111] lstrlenA (lpString="*.ape") returned 5 [0061.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.wma") returned 0 [0061.111] lstrlenA (lpString="*.wma") returned 5 [0061.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.ac3") returned 0 [0061.111] lstrlenA (lpString="*.ac3") returned 5 [0061.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.mxf") returned 0 [0061.111] lstrlenA (lpString="*.mxf") returned 5 [0061.111] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e633690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="WSSFilesToolIconImagesMask.bmp", cAlternateFileName="WSSFIL~1.BMP")) returned 0 [0061.111] FindClose (in: hFindFile=0x2d7ff8 | out: hFindFile=0x2d7ff8) returned 1 [0061.111] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ToolData", cAlternateFileName="")) returned 1 [0061.111] lstrcmpA (lpString1=".", lpString2="ToolData") returned -1 [0061.111] lstrcmpA (lpString1="..", lpString2="ToolData") returned -1 [0061.111] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*.*") returned="*.*" [0061.112] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\", lpString2="ToolData" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData" [0061.112] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData") returned 58 [0061.112] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2d7ff8 [0061.113] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0061.113] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.113] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0061.113] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0061.113] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 1 [0061.113] lstrcmpA (lpString1=".", lpString2="groove.net") returned -1 [0061.113] lstrcmpA (lpString1="..", lpString2="groove.net") returned -1 [0061.113] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\*.*") returned="*.*" [0061.113] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\", lpString2="groove.net" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" [0061.113] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net") returned 69 [0061.113] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df3c0, dwReserved1=0x2df3bb, cFileName=".", cAlternateFileName="")) returned 0x2d8150 [0061.115] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0061.116] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0061.116] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0061.116] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0061.116] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a457d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Calendar", cAlternateFileName="")) returned 1 [0061.116] lstrcmpA (lpString1=".", lpString2="Calendar") returned -1 [0061.116] lstrcmpA (lpString1="..", lpString2="Calendar") returned -1 [0061.116] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*" [0061.116] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="Calendar" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar" [0061.116] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar") returned 78 [0061.116] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a457d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x2e03c3, cFileName=".", cAlternateFileName="")) returned 0x2d80b0 [0061.119] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0061.119] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a457d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0061.119] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0061.119] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0061.119] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b62000, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4b62000, ftLastWriteTime.dwHighDateTime=0x1ca0408, nFileSizeHigh=0x0, nFileSizeLow=0x3424, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CalendarToolIconImages.jpg", cAlternateFileName="CALEND~1.JPG")) returned 1 [0061.119] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.119] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CalendarToolIconImages.jpg") returned 1 [0061.119] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CalendarToolIconImages.jpg") returned 1 [0061.119] lstrcmpiA (lpString1="", lpString2="CalendarToolIconImages.jpg") returned -1 [0061.120] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\*.*") returned="*.*" [0061.120] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" [0061.120] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned="" [0061.120] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt" [0061.120] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\how to decrypt files.txt")) returned 0xffffffff [0061.120] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.121] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0061.121] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0061.122] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0061.122] CloseHandle (hObject=0x98) returned 1 [0061.122] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", lpString2="CalendarToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" [0061.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", pszSpec="*.zip") returned 0 [0061.122] lstrlenA (lpString="*.zip") returned 5 [0061.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", pszSpec="*.rar") returned 0 [0061.122] lstrlenA (lpString="*.rar") returned 5 [0061.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", pszSpec="*.7z") returned 0 [0061.122] lstrlenA (lpString="*.7z") returned 4 [0061.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", pszSpec="*.tar") returned 0 [0061.123] lstrlenA (lpString="*.tar") returned 5 [0061.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", pszSpec="*.gzip") returned 0 [0061.123] lstrlenA (lpString="*.gzip") returned 6 [0061.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", pszSpec="*.jpg") returned 1 [0061.123] lstrlenA (lpString="*.jpg") returned 5 [0061.123] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" [0061.123] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" [0061.123] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg." [0061.123] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg.wannacry" [0061.123] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.124] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3424 [0061.124] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc4b62000, dwHighDateTime=0x1ca0408), lpLastAccessTime=0x407536*(dwLowDateTime=0x51bb8730, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc4b62000, dwHighDateTime=0x1ca0408)) returned 1 [0061.124] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.124] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x33a6, lpOverlapped=0x0) returned 1 [0061.126] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg") returned="CalendarToolIconImages.jpg" [0061.126] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.126] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x33a6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x33a6, lpOverlapped=0x0) returned 1 [0061.127] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.127] CloseHandle (hObject=0x98) returned 1 [0061.127] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg.wannacry")) returned 1 [0061.128] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb2cb800, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb2cb800, ftLastWriteTime.dwHighDateTime=0x1ca0408, nFileSizeHigh=0x0, nFileSizeLow=0xc38, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="CalendarToolIconImagesMask.bmp", cAlternateFileName="CALEND~1.BMP")) returned 1 [0061.128] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.128] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CalendarToolIconImagesMask.bmp") returned 1 [0061.128] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CalendarToolIconImagesMask.bmp") returned 1 [0061.128] lstrcmpiA (lpString1="", lpString2="CalendarToolIconImagesMask.bmp") returned -1 [0061.128] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg") returned="CalendarToolIconImages.jpg" [0061.128] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" [0061.128] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned="" [0061.128] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt" [0061.128] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\how to decrypt files.txt")) returned 0x20 [0061.128] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", lpString2="CalendarToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" [0061.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0061.128] lstrlenA (lpString="*.zip") returned 5 [0061.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0061.128] lstrlenA (lpString="*.rar") returned 5 [0061.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0061.129] lstrlenA (lpString="*.7z") returned 4 [0061.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0061.129] lstrlenA (lpString="*.tar") returned 5 [0061.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0061.129] lstrlenA (lpString="*.gzip") returned 6 [0061.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0061.129] lstrlenA (lpString="*.jpg") returned 5 [0061.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0061.129] lstrlenA (lpString="*.jpeg") returned 6 [0061.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0061.129] lstrlenA (lpString="*.psd") returned 5 [0061.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.gif") returned 0 [0061.129] lstrlenA (lpString="*.gif") returned 5 [0061.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.doc") returned 0 [0061.129] lstrlenA (lpString="*.doc") returned 5 [0061.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.docx") returned 0 [0061.130] lstrlenA (lpString="*.docx") returned 6 [0061.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.xls") returned 0 [0061.130] lstrlenA (lpString="*.xls") returned 5 [0061.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.xlsx") returned 0 [0061.130] lstrlenA (lpString="*.xlsx") returned 6 [0061.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.ppt") returned 0 [0061.130] lstrlenA (lpString="*.ppt") returned 5 [0061.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.pptx") returned 0 [0061.130] lstrlenA (lpString="*.pptx") returned 6 [0061.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.pdf") returned 0 [0061.130] lstrlenA (lpString="*.pdf") returned 5 [0061.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.mov") returned 0 [0061.130] lstrlenA (lpString="*.mov") returned 5 [0061.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.m2v") returned 0 [0061.130] lstrlenA (lpString="*.m2v") returned 5 [0061.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.3gp") returned 0 [0061.130] lstrlenA (lpString="*.3gp") returned 5 [0061.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.mpeg") returned 0 [0061.131] lstrlenA (lpString="*.mpeg") returned 6 [0061.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.mpg") returned 0 [0061.131] lstrlenA (lpString="*.mpg") returned 5 [0061.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.flv") returned 0 [0061.131] lstrlenA (lpString="*.flv") returned 5 [0061.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.avi") returned 0 [0061.131] lstrlenA (lpString="*.avi") returned 5 [0061.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.mp4") returned 0 [0061.131] lstrlenA (lpString="*.mp4") returned 5 [0061.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.wmv") returned 0 [0061.131] lstrlenA (lpString="*.wmv") returned 5 [0061.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.divx") returned 0 [0061.131] lstrlenA (lpString="*.divx") returned 6 [0061.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.mkv") returned 0 [0061.131] lstrlenA (lpString="*.mkv") returned 5 [0061.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.mp3") returned 0 [0061.131] lstrlenA (lpString="*.mp3") returned 5 [0061.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.wav") returned 0 [0061.132] lstrlenA (lpString="*.wav") returned 5 [0061.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.flac") returned 0 [0061.132] lstrlenA (lpString="*.flac") returned 6 [0061.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.ape") returned 0 [0061.132] lstrlenA (lpString="*.ape") returned 5 [0061.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.wma") returned 0 [0061.132] lstrlenA (lpString="*.wma") returned 5 [0061.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.ac3") returned 0 [0061.132] lstrlenA (lpString="*.ac3") returned 5 [0061.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.mxf") returned 0 [0061.132] lstrlenA (lpString="*.mxf") returned 5 [0061.132] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3fa2, dwReserved0=0x20004f, dwReserved1=0x450044, cFileName="CalendarViewButtonImages.jpg", cAlternateFileName="CALEND~2.JPG")) returned 1 [0061.132] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.132] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CalendarViewButtonImages.jpg") returned 1 [0061.132] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CalendarViewButtonImages.jpg") returned 1 [0061.132] lstrcmpiA (lpString1="", lpString2="CalendarViewButtonImages.jpg") returned -1 [0061.133] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp") returned="CalendarToolIconImagesMask.bmp" [0061.133] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" [0061.133] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned="" [0061.133] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt" [0061.133] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\how to decrypt files.txt")) returned 0x20 [0061.133] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", lpString2="CalendarViewButtonImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" [0061.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", pszSpec="*.zip") returned 0 [0061.133] lstrlenA (lpString="*.zip") returned 5 [0061.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", pszSpec="*.rar") returned 0 [0061.133] lstrlenA (lpString="*.rar") returned 5 [0061.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", pszSpec="*.7z") returned 0 [0061.133] lstrlenA (lpString="*.7z") returned 4 [0061.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", pszSpec="*.tar") returned 0 [0061.133] lstrlenA (lpString="*.tar") returned 5 [0061.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", pszSpec="*.gzip") returned 0 [0061.134] lstrlenA (lpString="*.gzip") returned 6 [0061.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", pszSpec="*.jpg") returned 1 [0061.134] lstrlenA (lpString="*.jpg") returned 5 [0061.134] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" [0061.134] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" [0061.134] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg." [0061.134] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg.wannacry" [0061.134] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.135] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3fa2 [0061.135] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7c7f8600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51bb8730, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7c7f8600, dwHighDateTime=0x1c747ea)) returned 1 [0061.135] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.135] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3f24, lpOverlapped=0x0) returned 1 [0061.137] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg") returned="CalendarViewButtonImages.jpg" [0061.137] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.137] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3f24, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3f24, lpOverlapped=0x0) returned 1 [0061.138] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.138] CloseHandle (hObject=0x98) returned 1 [0061.138] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg.wannacry")) returned 1 [0061.139] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52b0b4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1b49, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="GlobeButtonImage.jpg", cAlternateFileName="GLOBEB~1.JPG")) returned 1 [0061.139] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.139] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GlobeButtonImage.jpg") returned -1 [0061.139] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GlobeButtonImage.jpg") returned 1 [0061.139] lstrcmpiA (lpString1="", lpString2="GlobeButtonImage.jpg") returned -1 [0061.139] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg") returned="CalendarViewButtonImages.jpg" [0061.139] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" [0061.139] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned="" [0061.139] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt" [0061.139] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\how to decrypt files.txt")) returned 0x20 [0061.140] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", lpString2="GlobeButtonImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" [0061.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", pszSpec="*.zip") returned 0 [0061.140] lstrlenA (lpString="*.zip") returned 5 [0061.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", pszSpec="*.rar") returned 0 [0061.140] lstrlenA (lpString="*.rar") returned 5 [0061.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", pszSpec="*.7z") returned 0 [0061.140] lstrlenA (lpString="*.7z") returned 4 [0061.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", pszSpec="*.tar") returned 0 [0061.140] lstrlenA (lpString="*.tar") returned 5 [0061.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", pszSpec="*.gzip") returned 0 [0061.140] lstrlenA (lpString="*.gzip") returned 6 [0061.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", pszSpec="*.jpg") returned 1 [0061.140] lstrlenA (lpString="*.jpg") returned 5 [0061.140] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" [0061.140] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" [0061.140] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg." [0061.140] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg.wannacry" [0061.140] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.142] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b49 [0061.142] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7c7f8600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x52b0b4d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7c7f8600, dwHighDateTime=0x1c747ea)) returned 1 [0061.142] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.142] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1acb, lpOverlapped=0x0) returned 1 [0061.145] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg") returned="GlobeButtonImage.jpg" [0061.145] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.145] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1acb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1acb, lpOverlapped=0x0) returned 1 [0061.145] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.145] CloseHandle (hObject=0x98) returned 1 [0061.146] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg.wannacry")) returned 1 [0061.147] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="GlobeButtonImageMask.bmp", cAlternateFileName="GLOBEB~1.BMP")) returned 1 [0061.147] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.147] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GlobeButtonImageMask.bmp") returned -1 [0061.147] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GlobeButtonImageMask.bmp") returned 1 [0061.147] lstrcmpiA (lpString1="", lpString2="GlobeButtonImageMask.bmp") returned -1 [0061.147] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg") returned="GlobeButtonImage.jpg" [0061.147] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" [0061.147] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned="" [0061.147] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt" [0061.149] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\how to decrypt files.txt")) returned 0x20 [0061.149] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", lpString2="GlobeButtonImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" [0061.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.zip") returned 0 [0061.150] lstrlenA (lpString="*.zip") returned 5 [0061.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.rar") returned 0 [0061.150] lstrlenA (lpString="*.rar") returned 5 [0061.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.7z") returned 0 [0061.150] lstrlenA (lpString="*.7z") returned 4 [0061.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.tar") returned 0 [0061.150] lstrlenA (lpString="*.tar") returned 5 [0061.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.gzip") returned 0 [0061.150] lstrlenA (lpString="*.gzip") returned 6 [0061.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.jpg") returned 0 [0061.150] lstrlenA (lpString="*.jpg") returned 5 [0061.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.jpeg") returned 0 [0061.150] lstrlenA (lpString="*.jpeg") returned 6 [0061.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.psd") returned 0 [0061.150] lstrlenA (lpString="*.psd") returned 5 [0061.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.gif") returned 0 [0061.151] lstrlenA (lpString="*.gif") returned 5 [0061.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.doc") returned 0 [0061.151] lstrlenA (lpString="*.doc") returned 5 [0061.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.docx") returned 0 [0061.151] lstrlenA (lpString="*.docx") returned 6 [0061.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.xls") returned 0 [0061.151] lstrlenA (lpString="*.xls") returned 5 [0061.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.xlsx") returned 0 [0061.151] lstrlenA (lpString="*.xlsx") returned 6 [0061.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.ppt") returned 0 [0061.151] lstrlenA (lpString="*.ppt") returned 5 [0061.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.pptx") returned 0 [0061.151] lstrlenA (lpString="*.pptx") returned 6 [0061.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.pdf") returned 0 [0061.151] lstrlenA (lpString="*.pdf") returned 5 [0061.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.mov") returned 0 [0061.151] lstrlenA (lpString="*.mov") returned 5 [0061.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.m2v") returned 0 [0061.151] lstrlenA (lpString="*.m2v") returned 5 [0061.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.3gp") returned 0 [0061.151] lstrlenA (lpString="*.3gp") returned 5 [0061.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.mpeg") returned 0 [0061.151] lstrlenA (lpString="*.mpeg") returned 6 [0061.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.mpg") returned 0 [0061.152] lstrlenA (lpString="*.mpg") returned 5 [0061.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.flv") returned 0 [0061.152] lstrlenA (lpString="*.flv") returned 5 [0061.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.avi") returned 0 [0061.152] lstrlenA (lpString="*.avi") returned 5 [0061.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.mp4") returned 0 [0061.152] lstrlenA (lpString="*.mp4") returned 5 [0061.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.wmv") returned 0 [0061.152] lstrlenA (lpString="*.wmv") returned 5 [0061.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.divx") returned 0 [0061.152] lstrlenA (lpString="*.divx") returned 6 [0061.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.mkv") returned 0 [0061.152] lstrlenA (lpString="*.mkv") returned 5 [0061.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.mp3") returned 0 [0061.152] lstrlenA (lpString="*.mp3") returned 5 [0061.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.wav") returned 0 [0061.152] lstrlenA (lpString="*.wav") returned 5 [0061.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.flac") returned 0 [0061.152] lstrlenA (lpString="*.flac") returned 6 [0061.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.ape") returned 0 [0061.152] lstrlenA (lpString="*.ape") returned 5 [0061.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.wma") returned 0 [0061.153] lstrlenA (lpString="*.wma") returned 5 [0061.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.ac3") returned 0 [0061.153] lstrlenA (lpString="*.ac3") returned 5 [0061.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.mxf") returned 0 [0061.153] lstrlenA (lpString="*.mxf") returned 5 [0061.153] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="GlobeButtonImageMask.bmp", cAlternateFileName="GLOBEB~1.BMP")) returned 0 [0061.153] FindClose (in: hFindFile=0x2d80b0 | out: hFindFile=0x2d80b0) returned 1 [0061.153] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="CommonData", cAlternateFileName="COMMON~1")) returned 1 [0061.153] lstrcmpA (lpString1=".", lpString2="CommonData") returned -1 [0061.153] lstrcmpA (lpString1="..", lpString2="CommonData") returned -1 [0061.153] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*" [0061.153] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="CommonData" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0061.153] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned 80 [0061.153] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20004f, dwReserved1=0x450044, cFileName=".", cAlternateFileName="")) returned 0x2d80b0 [0061.156] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0061.156] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x450000, cFileName="..", cAlternateFileName="")) returned 1 [0061.157] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0061.157] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0061.157] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x633fe700, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x633fe700, ftLastWriteTime.dwHighDateTime=0x1c95fc8, nFileSizeHigh=0x0, nFileSizeLow=0x44c9, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AlertImage_Auto.jpg", cAlternateFileName="ALERTI~3.JPG")) returned 1 [0061.157] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.157] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AlertImage_Auto.jpg") returned 1 [0061.157] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_Auto.jpg") returned 1 [0061.157] lstrcmpiA (lpString1="", lpString2="AlertImage_Auto.jpg") returned -1 [0061.157] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\*.*") returned="*.*" [0061.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0061.158] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="" [0061.158] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" [0061.158] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0xffffffff [0061.158] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.159] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0061.159] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0061.160] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0061.160] CloseHandle (hObject=0x98) returned 1 [0061.160] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_Auto.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" [0061.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", pszSpec="*.zip") returned 0 [0061.161] lstrlenA (lpString="*.zip") returned 5 [0061.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", pszSpec="*.rar") returned 0 [0061.161] lstrlenA (lpString="*.rar") returned 5 [0061.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", pszSpec="*.7z") returned 0 [0061.161] lstrlenA (lpString="*.7z") returned 4 [0061.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", pszSpec="*.tar") returned 0 [0061.161] lstrlenA (lpString="*.tar") returned 5 [0061.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", pszSpec="*.gzip") returned 0 [0061.161] lstrlenA (lpString="*.gzip") returned 6 [0061.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", pszSpec="*.jpg") returned 1 [0061.161] lstrlenA (lpString="*.jpg") returned 5 [0061.161] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" [0061.161] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" [0061.161] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg." [0061.161] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.wannacry" [0061.161] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.163] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x44c9 [0061.164] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x633fe700, dwHighDateTime=0x1c95fc8), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x633fe700, dwHighDateTime=0x1c95fc8)) returned 1 [0061.164] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.164] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x444b, lpOverlapped=0x0) returned 1 [0061.169] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg") returned="AlertImage_Auto.jpg" [0061.169] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.169] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x444b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x444b, lpOverlapped=0x0) returned 1 [0061.169] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.170] CloseHandle (hObject=0x98) returned 1 [0061.170] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg.wannacry")) returned 1 [0061.171] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3390df00, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3390df00, ftLastWriteTime.dwHighDateTime=0x1c95fc8, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="AlertImage_AutoMask.bmp", cAlternateFileName="AL1E3B~1.BMP")) returned 1 [0061.171] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.171] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AlertImage_AutoMask.bmp") returned 1 [0061.171] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_AutoMask.bmp") returned 1 [0061.171] lstrcmpiA (lpString1="", lpString2="AlertImage_AutoMask.bmp") returned -1 [0061.171] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg") returned="AlertImage_Auto.jpg" [0061.171] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0061.171] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="" [0061.171] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" [0061.172] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20 [0061.172] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_AutoMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" [0061.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.zip") returned 0 [0061.172] lstrlenA (lpString="*.zip") returned 5 [0061.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.rar") returned 0 [0061.172] lstrlenA (lpString="*.rar") returned 5 [0061.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.7z") returned 0 [0061.172] lstrlenA (lpString="*.7z") returned 4 [0061.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.tar") returned 0 [0061.172] lstrlenA (lpString="*.tar") returned 5 [0061.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.gzip") returned 0 [0061.172] lstrlenA (lpString="*.gzip") returned 6 [0061.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.jpg") returned 0 [0061.172] lstrlenA (lpString="*.jpg") returned 5 [0061.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.jpeg") returned 0 [0061.172] lstrlenA (lpString="*.jpeg") returned 6 [0061.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.psd") returned 0 [0061.172] lstrlenA (lpString="*.psd") returned 5 [0061.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.gif") returned 0 [0061.173] lstrlenA (lpString="*.gif") returned 5 [0061.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.doc") returned 0 [0061.173] lstrlenA (lpString="*.doc") returned 5 [0061.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.docx") returned 0 [0061.173] lstrlenA (lpString="*.docx") returned 6 [0061.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.xls") returned 0 [0061.173] lstrlenA (lpString="*.xls") returned 5 [0061.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.xlsx") returned 0 [0061.173] lstrlenA (lpString="*.xlsx") returned 6 [0061.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.ppt") returned 0 [0061.173] lstrlenA (lpString="*.ppt") returned 5 [0061.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.pptx") returned 0 [0061.173] lstrlenA (lpString="*.pptx") returned 6 [0061.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.pdf") returned 0 [0061.173] lstrlenA (lpString="*.pdf") returned 5 [0061.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.mov") returned 0 [0061.173] lstrlenA (lpString="*.mov") returned 5 [0061.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.m2v") returned 0 [0061.173] lstrlenA (lpString="*.m2v") returned 5 [0061.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.3gp") returned 0 [0061.173] lstrlenA (lpString="*.3gp") returned 5 [0061.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.mpeg") returned 0 [0061.173] lstrlenA (lpString="*.mpeg") returned 6 [0061.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.mpg") returned 0 [0061.174] lstrlenA (lpString="*.mpg") returned 5 [0061.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.flv") returned 0 [0061.174] lstrlenA (lpString="*.flv") returned 5 [0061.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.avi") returned 0 [0061.174] lstrlenA (lpString="*.avi") returned 5 [0061.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.mp4") returned 0 [0061.174] lstrlenA (lpString="*.mp4") returned 5 [0061.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.wmv") returned 0 [0061.174] lstrlenA (lpString="*.wmv") returned 5 [0061.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.divx") returned 0 [0061.174] lstrlenA (lpString="*.divx") returned 6 [0061.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.mkv") returned 0 [0061.174] lstrlenA (lpString="*.mkv") returned 5 [0061.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.mp3") returned 0 [0061.174] lstrlenA (lpString="*.mp3") returned 5 [0061.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.wav") returned 0 [0061.174] lstrlenA (lpString="*.wav") returned 5 [0061.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.flac") returned 0 [0061.174] lstrlenA (lpString="*.flac") returned 6 [0061.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.ape") returned 0 [0061.174] lstrlenA (lpString="*.ape") returned 5 [0061.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.wma") returned 0 [0061.174] lstrlenA (lpString="*.wma") returned 5 [0061.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.ac3") returned 0 [0061.174] lstrlenA (lpString="*.ac3") returned 5 [0061.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.mxf") returned 0 [0061.175] lstrlenA (lpString="*.mxf") returned 5 [0061.175] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db0b300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7db0b300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3356, dwReserved0=0x540020, dwReserved1=0x20004f, cFileName="AlertImage_ContactHigh.jpg", cAlternateFileName="ALERTI~1.JPG")) returned 1 [0061.175] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.175] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AlertImage_ContactHigh.jpg") returned 1 [0061.175] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_ContactHigh.jpg") returned 1 [0061.175] lstrcmpiA (lpString1="", lpString2="AlertImage_ContactHigh.jpg") returned -1 [0061.175] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp") returned="AlertImage_AutoMask.bmp" [0061.175] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0061.175] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="" [0061.175] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" [0061.175] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20 [0061.175] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_ContactHigh.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" [0061.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", pszSpec="*.zip") returned 0 [0061.175] lstrlenA (lpString="*.zip") returned 5 [0061.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", pszSpec="*.rar") returned 0 [0061.175] lstrlenA (lpString="*.rar") returned 5 [0061.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", pszSpec="*.7z") returned 0 [0061.175] lstrlenA (lpString="*.7z") returned 4 [0061.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", pszSpec="*.tar") returned 0 [0061.175] lstrlenA (lpString="*.tar") returned 5 [0061.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", pszSpec="*.gzip") returned 0 [0061.176] lstrlenA (lpString="*.gzip") returned 6 [0061.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", pszSpec="*.jpg") returned 1 [0061.176] lstrlenA (lpString="*.jpg") returned 5 [0061.176] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" [0061.176] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" [0061.176] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg." [0061.176] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.wannacry" [0061.176] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.177] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3356 [0061.177] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7db0b300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7db0b300, dwHighDateTime=0x1c747ea)) returned 1 [0061.177] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.177] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x32d8, lpOverlapped=0x0) returned 1 [0061.184] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg") returned="AlertImage_ContactHigh.jpg" [0061.184] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.184] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x32d8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x32d8, lpOverlapped=0x0) returned 1 [0061.185] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.185] CloseHandle (hObject=0x98) returned 1 [0061.185] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg.wannacry")) returned 1 [0061.186] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db0b300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7db0b300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c70, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="AlertImage_ContactHighMask.bmp", cAlternateFileName="ALERTI~1.BMP")) returned 1 [0061.186] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.186] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AlertImage_ContactHighMask.bmp") returned 1 [0061.186] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_ContactHighMask.bmp") returned 1 [0061.186] lstrcmpiA (lpString1="", lpString2="AlertImage_ContactHighMask.bmp") returned -1 [0061.186] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg") returned="AlertImage_ContactHigh.jpg" [0061.186] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0061.186] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="" [0061.186] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" [0061.186] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20 [0061.186] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_ContactHighMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" [0061.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.zip") returned 0 [0061.187] lstrlenA (lpString="*.zip") returned 5 [0061.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.rar") returned 0 [0061.187] lstrlenA (lpString="*.rar") returned 5 [0061.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.7z") returned 0 [0061.187] lstrlenA (lpString="*.7z") returned 4 [0061.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.tar") returned 0 [0061.187] lstrlenA (lpString="*.tar") returned 5 [0061.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.gzip") returned 0 [0061.187] lstrlenA (lpString="*.gzip") returned 6 [0061.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.jpg") returned 0 [0061.187] lstrlenA (lpString="*.jpg") returned 5 [0061.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.jpeg") returned 0 [0061.187] lstrlenA (lpString="*.jpeg") returned 6 [0061.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.psd") returned 0 [0061.187] lstrlenA (lpString="*.psd") returned 5 [0061.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.gif") returned 0 [0061.187] lstrlenA (lpString="*.gif") returned 5 [0061.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.doc") returned 0 [0061.187] lstrlenA (lpString="*.doc") returned 5 [0061.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.docx") returned 0 [0061.187] lstrlenA (lpString="*.docx") returned 6 [0061.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.xls") returned 0 [0061.187] lstrlenA (lpString="*.xls") returned 5 [0061.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.xlsx") returned 0 [0061.187] lstrlenA (lpString="*.xlsx") returned 6 [0061.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.ppt") returned 0 [0061.188] lstrlenA (lpString="*.ppt") returned 5 [0061.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.pptx") returned 0 [0061.188] lstrlenA (lpString="*.pptx") returned 6 [0061.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.pdf") returned 0 [0061.188] lstrlenA (lpString="*.pdf") returned 5 [0061.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.mov") returned 0 [0061.188] lstrlenA (lpString="*.mov") returned 5 [0061.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.m2v") returned 0 [0061.188] lstrlenA (lpString="*.m2v") returned 5 [0061.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.3gp") returned 0 [0061.188] lstrlenA (lpString="*.3gp") returned 5 [0061.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.mpeg") returned 0 [0061.188] lstrlenA (lpString="*.mpeg") returned 6 [0061.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.mpg") returned 0 [0061.188] lstrlenA (lpString="*.mpg") returned 5 [0061.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.flv") returned 0 [0061.188] lstrlenA (lpString="*.flv") returned 5 [0061.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.avi") returned 0 [0061.188] lstrlenA (lpString="*.avi") returned 5 [0061.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.mp4") returned 0 [0061.188] lstrlenA (lpString="*.mp4") returned 5 [0061.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.wmv") returned 0 [0061.188] lstrlenA (lpString="*.wmv") returned 5 [0061.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.divx") returned 0 [0061.188] lstrlenA (lpString="*.divx") returned 6 [0061.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.mkv") returned 0 [0061.189] lstrlenA (lpString="*.mkv") returned 5 [0061.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.mp3") returned 0 [0061.189] lstrlenA (lpString="*.mp3") returned 5 [0061.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.wav") returned 0 [0061.189] lstrlenA (lpString="*.wav") returned 5 [0061.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.flac") returned 0 [0061.189] lstrlenA (lpString="*.flac") returned 6 [0061.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.ape") returned 0 [0061.189] lstrlenA (lpString="*.ape") returned 5 [0061.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.wma") returned 0 [0061.189] lstrlenA (lpString="*.wma") returned 5 [0061.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.ac3") returned 0 [0061.189] lstrlenA (lpString="*.ac3") returned 5 [0061.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.mxf") returned 0 [0061.189] lstrlenA (lpString="*.mxf") returned 5 [0061.189] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db0b300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7db0b300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2f79, dwReserved0=0x540020, dwReserved1=0x20004f, cFileName="AlertImage_ContactLow.jpg", cAlternateFileName="ALERTI~4.JPG")) returned 1 [0061.189] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.189] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AlertImage_ContactLow.jpg") returned 1 [0061.189] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_ContactLow.jpg") returned 1 [0061.189] lstrcmpiA (lpString1="", lpString2="AlertImage_ContactLow.jpg") returned -1 [0061.189] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp") returned="AlertImage_ContactHighMask.bmp" [0061.189] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0061.189] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="" [0061.189] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" [0061.189] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20 [0061.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_ContactLow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" [0061.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", pszSpec="*.zip") returned 0 [0061.190] lstrlenA (lpString="*.zip") returned 5 [0061.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", pszSpec="*.rar") returned 0 [0061.190] lstrlenA (lpString="*.rar") returned 5 [0061.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", pszSpec="*.7z") returned 0 [0061.190] lstrlenA (lpString="*.7z") returned 4 [0061.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", pszSpec="*.tar") returned 0 [0061.190] lstrlenA (lpString="*.tar") returned 5 [0061.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", pszSpec="*.gzip") returned 0 [0061.190] lstrlenA (lpString="*.gzip") returned 6 [0061.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", pszSpec="*.jpg") returned 1 [0061.190] lstrlenA (lpString="*.jpg") returned 5 [0061.190] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" [0061.190] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" [0061.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg." [0061.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg.wannacry" [0061.190] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.191] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f79 [0061.191] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7db0b300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7db0b300, dwHighDateTime=0x1c747ea)) returned 1 [0061.191] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.191] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2efb, lpOverlapped=0x0) returned 1 [0061.193] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg") returned="AlertImage_ContactLow.jpg" [0061.193] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.193] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2efb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2efb, lpOverlapped=0x0) returned 1 [0061.194] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.194] CloseHandle (hObject=0x98) returned 1 [0061.194] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg.wannacry")) returned 1 [0061.195] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db0b300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7db0b300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c70, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="AlertImage_ContactLowMask.bmp", cAlternateFileName="AL1F1D~1.BMP")) returned 1 [0061.195] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.195] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AlertImage_ContactLowMask.bmp") returned 1 [0061.195] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_ContactLowMask.bmp") returned 1 [0061.195] lstrcmpiA (lpString1="", lpString2="AlertImage_ContactLowMask.bmp") returned -1 [0061.195] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg") returned="AlertImage_ContactLow.jpg" [0061.195] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0061.195] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="" [0061.195] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" [0061.195] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20 [0061.196] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_ContactLowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp" [0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.zip") returned 0 [0061.196] lstrlenA (lpString="*.zip") returned 5 [0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.rar") returned 0 [0061.196] lstrlenA (lpString="*.rar") returned 5 [0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.7z") returned 0 [0061.196] lstrlenA (lpString="*.7z") returned 4 [0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.tar") returned 0 [0061.196] lstrlenA (lpString="*.tar") returned 5 [0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.gzip") returned 0 [0061.196] lstrlenA (lpString="*.gzip") returned 6 [0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.jpg") returned 0 [0061.196] lstrlenA (lpString="*.jpg") returned 5 [0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.jpeg") returned 0 [0061.196] lstrlenA (lpString="*.jpeg") returned 6 [0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.psd") returned 0 [0061.196] lstrlenA (lpString="*.psd") returned 5 [0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.gif") returned 0 [0061.196] lstrlenA (lpString="*.gif") returned 5 [0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.doc") returned 0 [0061.196] lstrlenA (lpString="*.doc") returned 5 [0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.docx") returned 0 [0061.196] lstrlenA (lpString="*.docx") returned 6 [0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.xls") returned 0 [0061.196] lstrlenA (lpString="*.xls") returned 5 [0061.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.xlsx") returned 0 [0061.196] lstrlenA (lpString="*.xlsx") returned 6 [0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.ppt") returned 0 [0061.197] lstrlenA (lpString="*.ppt") returned 5 [0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.pptx") returned 0 [0061.197] lstrlenA (lpString="*.pptx") returned 6 [0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.pdf") returned 0 [0061.197] lstrlenA (lpString="*.pdf") returned 5 [0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.mov") returned 0 [0061.197] lstrlenA (lpString="*.mov") returned 5 [0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.m2v") returned 0 [0061.197] lstrlenA (lpString="*.m2v") returned 5 [0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.3gp") returned 0 [0061.197] lstrlenA (lpString="*.3gp") returned 5 [0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.mpeg") returned 0 [0061.197] lstrlenA (lpString="*.mpeg") returned 6 [0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.mpg") returned 0 [0061.197] lstrlenA (lpString="*.mpg") returned 5 [0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.flv") returned 0 [0061.197] lstrlenA (lpString="*.flv") returned 5 [0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.avi") returned 0 [0061.197] lstrlenA (lpString="*.avi") returned 5 [0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.mp4") returned 0 [0061.197] lstrlenA (lpString="*.mp4") returned 5 [0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.wmv") returned 0 [0061.197] lstrlenA (lpString="*.wmv") returned 5 [0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.divx") returned 0 [0061.197] lstrlenA (lpString="*.divx") returned 6 [0061.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.mkv") returned 0 [0061.198] lstrlenA (lpString="*.mkv") returned 5 [0061.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.mp3") returned 0 [0061.198] lstrlenA (lpString="*.mp3") returned 5 [0061.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.wav") returned 0 [0061.198] lstrlenA (lpString="*.wav") returned 5 [0061.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.flac") returned 0 [0061.198] lstrlenA (lpString="*.flac") returned 6 [0061.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.ape") returned 0 [0061.198] lstrlenA (lpString="*.ape") returned 5 [0061.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.wma") returned 0 [0061.198] lstrlenA (lpString="*.wma") returned 5 [0061.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.ac3") returned 0 [0061.198] lstrlenA (lpString="*.ac3") returned 5 [0061.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.mxf") returned 0 [0061.198] lstrlenA (lpString="*.mxf") returned 5 [0061.198] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc125fc00, ftCreationTime.dwHighDateTime=0x1c95fd3, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc125fc00, ftLastWriteTime.dwHighDateTime=0x1c95fd3, nFileSizeHigh=0x0, nFileSizeLow=0x480d, dwReserved0=0x540020, dwReserved1=0x20004f, cFileName="AlertImage_FileHigh.jpg", cAlternateFileName="ALERTI~2.JPG")) returned 1 [0061.198] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.198] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AlertImage_FileHigh.jpg") returned 1 [0061.198] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_FileHigh.jpg") returned 1 [0061.198] lstrcmpiA (lpString1="", lpString2="AlertImage_FileHigh.jpg") returned -1 [0061.198] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp") returned="AlertImage_ContactLowMask.bmp" [0061.198] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0061.198] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="" [0061.198] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" [0061.198] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20 [0061.199] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_FileHigh.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" [0061.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", pszSpec="*.zip") returned 0 [0061.199] lstrlenA (lpString="*.zip") returned 5 [0061.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", pszSpec="*.rar") returned 0 [0061.199] lstrlenA (lpString="*.rar") returned 5 [0061.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", pszSpec="*.7z") returned 0 [0061.199] lstrlenA (lpString="*.7z") returned 4 [0061.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", pszSpec="*.tar") returned 0 [0061.199] lstrlenA (lpString="*.tar") returned 5 [0061.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", pszSpec="*.gzip") returned 0 [0061.199] lstrlenA (lpString="*.gzip") returned 6 [0061.199] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", pszSpec="*.jpg") returned 1 [0061.199] lstrlenA (lpString="*.jpg") returned 5 [0061.199] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" [0061.199] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" [0061.199] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg." [0061.199] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg.wannacry" [0061.199] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.201] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x480d [0061.201] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc125fc00, dwHighDateTime=0x1c95fd3), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc125fc00, dwHighDateTime=0x1c95fd3)) returned 1 [0061.201] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.201] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x478f, lpOverlapped=0x0) returned 1 [0061.203] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg") returned="AlertImage_FileHigh.jpg" [0061.203] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.203] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x478f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x478f, lpOverlapped=0x0) returned 1 [0061.203] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.203] CloseHandle (hObject=0x98) returned 1 [0061.203] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg.wannacry")) returned 1 [0061.204] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b558100, ftCreationTime.dwHighDateTime=0x1c95fd2, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b558100, ftLastWriteTime.dwHighDateTime=0x1c95fd2, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="AlertImage_FileHighMask.bmp", cAlternateFileName="ALERTI~2.BMP")) returned 1 [0061.204] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.204] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AlertImage_FileHighMask.bmp") returned 1 [0061.204] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_FileHighMask.bmp") returned 1 [0061.205] lstrcmpiA (lpString1="", lpString2="AlertImage_FileHighMask.bmp") returned -1 [0061.205] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg") returned="AlertImage_FileHigh.jpg" [0061.205] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0061.205] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="" [0061.205] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" [0061.205] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20 [0061.205] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_FileHighMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp" [0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.zip") returned 0 [0061.205] lstrlenA (lpString="*.zip") returned 5 [0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.rar") returned 0 [0061.205] lstrlenA (lpString="*.rar") returned 5 [0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.7z") returned 0 [0061.205] lstrlenA (lpString="*.7z") returned 4 [0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.tar") returned 0 [0061.205] lstrlenA (lpString="*.tar") returned 5 [0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.gzip") returned 0 [0061.205] lstrlenA (lpString="*.gzip") returned 6 [0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.jpg") returned 0 [0061.205] lstrlenA (lpString="*.jpg") returned 5 [0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.jpeg") returned 0 [0061.205] lstrlenA (lpString="*.jpeg") returned 6 [0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.psd") returned 0 [0061.205] lstrlenA (lpString="*.psd") returned 5 [0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.gif") returned 0 [0061.205] lstrlenA (lpString="*.gif") returned 5 [0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.doc") returned 0 [0061.205] lstrlenA (lpString="*.doc") returned 5 [0061.205] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.docx") returned 0 [0061.206] lstrlenA (lpString="*.docx") returned 6 [0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.xls") returned 0 [0061.206] lstrlenA (lpString="*.xls") returned 5 [0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.xlsx") returned 0 [0061.206] lstrlenA (lpString="*.xlsx") returned 6 [0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.ppt") returned 0 [0061.206] lstrlenA (lpString="*.ppt") returned 5 [0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.pptx") returned 0 [0061.206] lstrlenA (lpString="*.pptx") returned 6 [0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.pdf") returned 0 [0061.206] lstrlenA (lpString="*.pdf") returned 5 [0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.mov") returned 0 [0061.206] lstrlenA (lpString="*.mov") returned 5 [0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.m2v") returned 0 [0061.206] lstrlenA (lpString="*.m2v") returned 5 [0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.3gp") returned 0 [0061.206] lstrlenA (lpString="*.3gp") returned 5 [0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.mpeg") returned 0 [0061.206] lstrlenA (lpString="*.mpeg") returned 6 [0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.mpg") returned 0 [0061.206] lstrlenA (lpString="*.mpg") returned 5 [0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.flv") returned 0 [0061.206] lstrlenA (lpString="*.flv") returned 5 [0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.avi") returned 0 [0061.206] lstrlenA (lpString="*.avi") returned 5 [0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.mp4") returned 0 [0061.206] lstrlenA (lpString="*.mp4") returned 5 [0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.wmv") returned 0 [0061.206] lstrlenA (lpString="*.wmv") returned 5 [0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.divx") returned 0 [0061.206] lstrlenA (lpString="*.divx") returned 6 [0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.mkv") returned 0 [0061.206] lstrlenA (lpString="*.mkv") returned 5 [0061.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.mp3") returned 0 [0061.206] lstrlenA (lpString="*.mp3") returned 5 [0061.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.wav") returned 0 [0061.207] lstrlenA (lpString="*.wav") returned 5 [0061.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.flac") returned 0 [0061.207] lstrlenA (lpString="*.flac") returned 6 [0061.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.ape") returned 0 [0061.207] lstrlenA (lpString="*.ape") returned 5 [0061.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.wma") returned 0 [0061.207] lstrlenA (lpString="*.wma") returned 5 [0061.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.ac3") returned 0 [0061.207] lstrlenA (lpString="*.ac3") returned 5 [0061.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.mxf") returned 0 [0061.207] lstrlenA (lpString="*.mxf") returned 5 [0061.207] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5eab000, ftCreationTime.dwHighDateTime=0x1c95fd3, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5eab000, ftLastWriteTime.dwHighDateTime=0x1c95fd3, nFileSizeHigh=0x0, nFileSizeLow=0x46de, dwReserved0=0x540020, dwReserved1=0x20004f, cFileName="AlertImage_FileOff.jpg", cAlternateFileName="AL97F4~1.JPG")) returned 1 [0061.207] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.207] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AlertImage_FileOff.jpg") returned 1 [0061.207] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_FileOff.jpg") returned 1 [0061.207] lstrcmpiA (lpString1="", lpString2="AlertImage_FileOff.jpg") returned -1 [0061.207] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp") returned="AlertImage_FileHighMask.bmp" [0061.207] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0061.207] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="" [0061.207] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" [0061.207] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20 [0061.207] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_FileOff.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" [0061.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", pszSpec="*.zip") returned 0 [0061.207] lstrlenA (lpString="*.zip") returned 5 [0061.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", pszSpec="*.rar") returned 0 [0061.207] lstrlenA (lpString="*.rar") returned 5 [0061.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", pszSpec="*.7z") returned 0 [0061.207] lstrlenA (lpString="*.7z") returned 4 [0061.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", pszSpec="*.tar") returned 0 [0061.207] lstrlenA (lpString="*.tar") returned 5 [0061.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", pszSpec="*.gzip") returned 0 [0061.208] lstrlenA (lpString="*.gzip") returned 6 [0061.208] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", pszSpec="*.jpg") returned 1 [0061.208] lstrlenA (lpString="*.jpg") returned 5 [0061.208] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" [0061.208] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" [0061.208] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg." [0061.208] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg.wannacry" [0061.208] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.210] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46de [0061.210] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc5eab000, dwHighDateTime=0x1c95fd3), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc5eab000, dwHighDateTime=0x1c95fd3)) returned 1 [0061.210] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.210] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4660, lpOverlapped=0x0) returned 1 [0061.212] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg") returned="AlertImage_FileOff.jpg" [0061.212] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.212] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4660, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4660, lpOverlapped=0x0) returned 1 [0061.213] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.213] CloseHandle (hObject=0x98) returned 1 [0061.213] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg.wannacry")) returned 1 [0061.214] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x427c8f00, ftCreationTime.dwHighDateTime=0x1c95fd2, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x427c8f00, ftLastWriteTime.dwHighDateTime=0x1c95fd2, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="AlertImage_FileOffMask.bmp", cAlternateFileName="ALFE83~1.BMP")) returned 1 [0061.214] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.214] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AlertImage_FileOffMask.bmp") returned 1 [0061.214] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_FileOffMask.bmp") returned 1 [0061.214] lstrcmpiA (lpString1="", lpString2="AlertImage_FileOffMask.bmp") returned -1 [0061.214] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg") returned="AlertImage_FileOff.jpg" [0061.214] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0061.214] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="" [0061.214] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" [0061.214] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20 [0061.214] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_FileOffMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp" [0061.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.zip") returned 0 [0061.215] lstrlenA (lpString="*.zip") returned 5 [0061.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.rar") returned 0 [0061.215] lstrlenA (lpString="*.rar") returned 5 [0061.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.7z") returned 0 [0061.215] lstrlenA (lpString="*.7z") returned 4 [0061.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.tar") returned 0 [0061.215] lstrlenA (lpString="*.tar") returned 5 [0061.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.gzip") returned 0 [0061.215] lstrlenA (lpString="*.gzip") returned 6 [0061.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.jpg") returned 0 [0061.215] lstrlenA (lpString="*.jpg") returned 5 [0061.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.jpeg") returned 0 [0061.215] lstrlenA (lpString="*.jpeg") returned 6 [0061.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.psd") returned 0 [0061.215] lstrlenA (lpString="*.psd") returned 5 [0061.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.gif") returned 0 [0061.215] lstrlenA (lpString="*.gif") returned 5 [0061.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.doc") returned 0 [0061.215] lstrlenA (lpString="*.doc") returned 5 [0061.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.docx") returned 0 [0061.215] lstrlenA (lpString="*.docx") returned 6 [0061.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.xls") returned 0 [0061.215] lstrlenA (lpString="*.xls") returned 5 [0061.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.xlsx") returned 0 [0061.216] lstrlenA (lpString="*.xlsx") returned 6 [0061.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.ppt") returned 0 [0061.216] lstrlenA (lpString="*.ppt") returned 5 [0061.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.pptx") returned 0 [0061.216] lstrlenA (lpString="*.pptx") returned 6 [0061.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.pdf") returned 0 [0061.216] lstrlenA (lpString="*.pdf") returned 5 [0061.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.mov") returned 0 [0061.216] lstrlenA (lpString="*.mov") returned 5 [0061.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.m2v") returned 0 [0061.216] lstrlenA (lpString="*.m2v") returned 5 [0061.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.3gp") returned 0 [0061.216] lstrlenA (lpString="*.3gp") returned 5 [0061.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.mpeg") returned 0 [0061.216] lstrlenA (lpString="*.mpeg") returned 6 [0061.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.mpg") returned 0 [0061.216] lstrlenA (lpString="*.mpg") returned 5 [0061.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.flv") returned 0 [0061.216] lstrlenA (lpString="*.flv") returned 5 [0061.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.avi") returned 0 [0061.216] lstrlenA (lpString="*.avi") returned 5 [0061.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.mp4") returned 0 [0061.216] lstrlenA (lpString="*.mp4") returned 5 [0061.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.wmv") returned 0 [0061.216] lstrlenA (lpString="*.wmv") returned 5 [0061.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.divx") returned 0 [0061.216] lstrlenA (lpString="*.divx") returned 6 [0061.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.mkv") returned 0 [0061.217] lstrlenA (lpString="*.mkv") returned 5 [0061.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.mp3") returned 0 [0061.217] lstrlenA (lpString="*.mp3") returned 5 [0061.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.wav") returned 0 [0061.217] lstrlenA (lpString="*.wav") returned 5 [0061.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.flac") returned 0 [0061.217] lstrlenA (lpString="*.flac") returned 6 [0061.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.ape") returned 0 [0061.217] lstrlenA (lpString="*.ape") returned 5 [0061.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.wma") returned 0 [0061.217] lstrlenA (lpString="*.wma") returned 5 [0061.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.ac3") returned 0 [0061.217] lstrlenA (lpString="*.ac3") returned 5 [0061.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.mxf") returned 0 [0061.217] lstrlenA (lpString="*.mxf") returned 5 [0061.217] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b7f600, ftCreationTime.dwHighDateTime=0x1c95f2a, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2b7f600, ftLastWriteTime.dwHighDateTime=0x1c95f2a, nFileSizeHigh=0x0, nFileSizeLow=0x13ca, dwReserved0=0x540020, dwReserved1=0x20004f, cFileName="AlertImage_High.jpg", cAlternateFileName="AL5980~1.JPG")) returned 1 [0061.217] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.217] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AlertImage_High.jpg") returned 1 [0061.217] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_High.jpg") returned 1 [0061.217] lstrcmpiA (lpString1="", lpString2="AlertImage_High.jpg") returned -1 [0061.217] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp") returned="AlertImage_FileOffMask.bmp" [0061.217] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0061.217] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="" [0061.218] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" [0061.218] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20 [0061.218] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_High.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" [0061.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", pszSpec="*.zip") returned 0 [0061.218] lstrlenA (lpString="*.zip") returned 5 [0061.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", pszSpec="*.rar") returned 0 [0061.218] lstrlenA (lpString="*.rar") returned 5 [0061.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", pszSpec="*.7z") returned 0 [0061.218] lstrlenA (lpString="*.7z") returned 4 [0061.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", pszSpec="*.tar") returned 0 [0061.218] lstrlenA (lpString="*.tar") returned 5 [0061.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", pszSpec="*.gzip") returned 0 [0061.218] lstrlenA (lpString="*.gzip") returned 6 [0061.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", pszSpec="*.jpg") returned 1 [0061.218] lstrlenA (lpString="*.jpg") returned 5 [0061.218] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" [0061.218] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" [0061.218] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg." [0061.218] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg.wannacry" [0061.218] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.219] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13ca [0061.219] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa2b7f600, dwHighDateTime=0x1c95f2a), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa2b7f600, dwHighDateTime=0x1c95f2a)) returned 1 [0061.219] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.219] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x134c, lpOverlapped=0x0) returned 1 [0061.222] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg") returned="AlertImage_High.jpg" [0061.222] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.222] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x134c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x134c, lpOverlapped=0x0) returned 1 [0061.222] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.222] CloseHandle (hObject=0x98) returned 1 [0061.222] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg.wannacry")) returned 1 [0061.223] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3177400, ftCreationTime.dwHighDateTime=0x1c95f2a, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3177400, ftLastWriteTime.dwHighDateTime=0x1c95f2a, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="AlertImage_HighMask.bmp", cAlternateFileName="ALERTI~3.BMP")) returned 1 [0061.223] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.223] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AlertImage_HighMask.bmp") returned 1 [0061.223] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_HighMask.bmp") returned 1 [0061.223] lstrcmpiA (lpString1="", lpString2="AlertImage_HighMask.bmp") returned -1 [0061.223] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg") returned="AlertImage_High.jpg" [0061.223] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0061.224] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="" [0061.224] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" [0061.224] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20 [0061.224] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_HighMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp" [0061.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.zip") returned 0 [0061.224] lstrlenA (lpString="*.zip") returned 5 [0061.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.rar") returned 0 [0061.224] lstrlenA (lpString="*.rar") returned 5 [0061.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.7z") returned 0 [0061.224] lstrlenA (lpString="*.7z") returned 4 [0061.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.tar") returned 0 [0061.224] lstrlenA (lpString="*.tar") returned 5 [0061.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.gzip") returned 0 [0061.224] lstrlenA (lpString="*.gzip") returned 6 [0061.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.jpg") returned 0 [0061.224] lstrlenA (lpString="*.jpg") returned 5 [0061.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.jpeg") returned 0 [0061.224] lstrlenA (lpString="*.jpeg") returned 6 [0061.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.psd") returned 0 [0061.224] lstrlenA (lpString="*.psd") returned 5 [0061.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.gif") returned 0 [0061.224] lstrlenA (lpString="*.gif") returned 5 [0061.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.doc") returned 0 [0061.225] lstrlenA (lpString="*.doc") returned 5 [0061.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.docx") returned 0 [0061.225] lstrlenA (lpString="*.docx") returned 6 [0061.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.xls") returned 0 [0061.225] lstrlenA (lpString="*.xls") returned 5 [0061.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.xlsx") returned 0 [0061.225] lstrlenA (lpString="*.xlsx") returned 6 [0061.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.ppt") returned 0 [0061.225] lstrlenA (lpString="*.ppt") returned 5 [0061.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.pptx") returned 0 [0061.225] lstrlenA (lpString="*.pptx") returned 6 [0061.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.pdf") returned 0 [0061.225] lstrlenA (lpString="*.pdf") returned 5 [0061.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.mov") returned 0 [0061.225] lstrlenA (lpString="*.mov") returned 5 [0061.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.m2v") returned 0 [0061.225] lstrlenA (lpString="*.m2v") returned 5 [0061.225] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.3gp") returned 0 [0061.225] lstrlenA (lpString="*.3gp") returned 5 [0061.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.mpeg") returned 0 [0061.226] lstrlenA (lpString="*.mpeg") returned 6 [0061.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.mpg") returned 0 [0061.226] lstrlenA (lpString="*.mpg") returned 5 [0061.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.flv") returned 0 [0061.226] lstrlenA (lpString="*.flv") returned 5 [0061.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.avi") returned 0 [0061.226] lstrlenA (lpString="*.avi") returned 5 [0061.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.mp4") returned 0 [0061.226] lstrlenA (lpString="*.mp4") returned 5 [0061.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.wmv") returned 0 [0061.226] lstrlenA (lpString="*.wmv") returned 5 [0061.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.divx") returned 0 [0061.226] lstrlenA (lpString="*.divx") returned 6 [0061.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.mkv") returned 0 [0061.226] lstrlenA (lpString="*.mkv") returned 5 [0061.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.mp3") returned 0 [0061.226] lstrlenA (lpString="*.mp3") returned 5 [0061.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.wav") returned 0 [0061.226] lstrlenA (lpString="*.wav") returned 5 [0061.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.flac") returned 0 [0061.227] lstrlenA (lpString="*.flac") returned 6 [0061.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.ape") returned 0 [0061.227] lstrlenA (lpString="*.ape") returned 5 [0061.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.wma") returned 0 [0061.227] lstrlenA (lpString="*.wma") returned 5 [0061.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.ac3") returned 0 [0061.227] lstrlenA (lpString="*.ac3") returned 5 [0061.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.mxf") returned 0 [0061.227] lstrlenA (lpString="*.mxf") returned 5 [0061.227] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefeaa500, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefeaa500, ftLastWriteTime.dwHighDateTime=0x1c95fc8, nFileSizeHigh=0x0, nFileSizeLow=0x41de, dwReserved0=0x540020, dwReserved1=0x20004f, cFileName="AlertImage_Medium.jpg", cAlternateFileName="ALF33C~1.JPG")) returned 1 [0061.227] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.227] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AlertImage_Medium.jpg") returned 1 [0061.227] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_Medium.jpg") returned 1 [0061.227] lstrcmpiA (lpString1="", lpString2="AlertImage_Medium.jpg") returned -1 [0061.227] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp") returned="AlertImage_HighMask.bmp" [0061.227] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0061.227] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="" [0061.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" [0061.227] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20 [0061.228] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_Medium.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" [0061.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", pszSpec="*.zip") returned 0 [0061.228] lstrlenA (lpString="*.zip") returned 5 [0061.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", pszSpec="*.rar") returned 0 [0061.228] lstrlenA (lpString="*.rar") returned 5 [0061.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", pszSpec="*.7z") returned 0 [0061.228] lstrlenA (lpString="*.7z") returned 4 [0061.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", pszSpec="*.tar") returned 0 [0061.228] lstrlenA (lpString="*.tar") returned 5 [0061.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", pszSpec="*.gzip") returned 0 [0061.228] lstrlenA (lpString="*.gzip") returned 6 [0061.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", pszSpec="*.jpg") returned 1 [0061.228] lstrlenA (lpString="*.jpg") returned 5 [0061.228] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" [0061.228] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" [0061.228] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg." [0061.228] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg.wannacry" [0061.228] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.230] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x41de [0061.230] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xefeaa500, dwHighDateTime=0x1c95fc8), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xefeaa500, dwHighDateTime=0x1c95fc8)) returned 1 [0061.230] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.230] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4160, lpOverlapped=0x0) returned 1 [0061.233] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg") returned="AlertImage_Medium.jpg" [0061.233] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.233] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4160, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4160, lpOverlapped=0x0) returned 1 [0061.233] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.233] CloseHandle (hObject=0x98) returned 1 [0061.233] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg.wannacry")) returned 1 [0061.235] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd34e6d00, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd34e6d00, ftLastWriteTime.dwHighDateTime=0x1c95fc8, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="AlertImage_MediumMAsk.bmp", cAlternateFileName="ALERTI~4.BMP")) returned 1 [0061.235] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.235] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AlertImage_MediumMAsk.bmp") returned 1 [0061.235] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_MediumMAsk.bmp") returned 1 [0061.235] lstrcmpiA (lpString1="", lpString2="AlertImage_MediumMAsk.bmp") returned -1 [0061.235] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg") returned="AlertImage_Medium.jpg" [0061.235] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0061.235] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="" [0061.235] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" [0061.235] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20 [0061.235] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_MediumMAsk.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp" [0061.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.zip") returned 0 [0061.235] lstrlenA (lpString="*.zip") returned 5 [0061.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.rar") returned 0 [0061.235] lstrlenA (lpString="*.rar") returned 5 [0061.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.7z") returned 0 [0061.235] lstrlenA (lpString="*.7z") returned 4 [0061.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.tar") returned 0 [0061.235] lstrlenA (lpString="*.tar") returned 5 [0061.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.gzip") returned 0 [0061.236] lstrlenA (lpString="*.gzip") returned 6 [0061.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.jpg") returned 0 [0061.236] lstrlenA (lpString="*.jpg") returned 5 [0061.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.jpeg") returned 0 [0061.236] lstrlenA (lpString="*.jpeg") returned 6 [0061.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.psd") returned 0 [0061.236] lstrlenA (lpString="*.psd") returned 5 [0061.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.gif") returned 0 [0061.236] lstrlenA (lpString="*.gif") returned 5 [0061.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.doc") returned 0 [0061.236] lstrlenA (lpString="*.doc") returned 5 [0061.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.docx") returned 0 [0061.236] lstrlenA (lpString="*.docx") returned 6 [0061.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.xls") returned 0 [0061.236] lstrlenA (lpString="*.xls") returned 5 [0061.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.xlsx") returned 0 [0061.236] lstrlenA (lpString="*.xlsx") returned 6 [0061.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.ppt") returned 0 [0061.236] lstrlenA (lpString="*.ppt") returned 5 [0061.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.pptx") returned 0 [0061.236] lstrlenA (lpString="*.pptx") returned 6 [0061.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.pdf") returned 0 [0061.236] lstrlenA (lpString="*.pdf") returned 5 [0061.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.mov") returned 0 [0061.237] lstrlenA (lpString="*.mov") returned 5 [0061.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.m2v") returned 0 [0061.237] lstrlenA (lpString="*.m2v") returned 5 [0061.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.3gp") returned 0 [0061.237] lstrlenA (lpString="*.3gp") returned 5 [0061.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.mpeg") returned 0 [0061.237] lstrlenA (lpString="*.mpeg") returned 6 [0061.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.mpg") returned 0 [0061.237] lstrlenA (lpString="*.mpg") returned 5 [0061.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.flv") returned 0 [0061.237] lstrlenA (lpString="*.flv") returned 5 [0061.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.avi") returned 0 [0061.237] lstrlenA (lpString="*.avi") returned 5 [0061.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.mp4") returned 0 [0061.237] lstrlenA (lpString="*.mp4") returned 5 [0061.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.wmv") returned 0 [0061.237] lstrlenA (lpString="*.wmv") returned 5 [0061.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.divx") returned 0 [0061.237] lstrlenA (lpString="*.divx") returned 6 [0061.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.mkv") returned 0 [0061.237] lstrlenA (lpString="*.mkv") returned 5 [0061.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.mp3") returned 0 [0061.237] lstrlenA (lpString="*.mp3") returned 5 [0061.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.wav") returned 0 [0061.237] lstrlenA (lpString="*.wav") returned 5 [0061.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.flac") returned 0 [0061.238] lstrlenA (lpString="*.flac") returned 6 [0061.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.ape") returned 0 [0061.238] lstrlenA (lpString="*.ape") returned 5 [0061.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.wma") returned 0 [0061.238] lstrlenA (lpString="*.wma") returned 5 [0061.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.ac3") returned 0 [0061.238] lstrlenA (lpString="*.ac3") returned 5 [0061.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.mxf") returned 0 [0061.238] lstrlenA (lpString="*.mxf") returned 5 [0061.238] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e983f00, ftCreationTime.dwHighDateTime=0x1c95fc9, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e983f00, ftLastWriteTime.dwHighDateTime=0x1c95fc9, nFileSizeHigh=0x0, nFileSizeLow=0x3e78, dwReserved0=0x540020, dwReserved1=0x20004f, cFileName="AlertImage_Off.jpg", cAlternateFileName="AL0F2A~1.JPG")) returned 1 [0061.238] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.238] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AlertImage_Off.jpg") returned 1 [0061.238] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_Off.jpg") returned 1 [0061.238] lstrcmpiA (lpString1="", lpString2="AlertImage_Off.jpg") returned -1 [0061.238] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp") returned="AlertImage_MediumMAsk.bmp" [0061.238] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0061.238] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="" [0061.238] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" [0061.238] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20 [0061.238] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_Off.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" [0061.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", pszSpec="*.zip") returned 0 [0061.239] lstrlenA (lpString="*.zip") returned 5 [0061.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", pszSpec="*.rar") returned 0 [0061.239] lstrlenA (lpString="*.rar") returned 5 [0061.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", pszSpec="*.7z") returned 0 [0061.239] lstrlenA (lpString="*.7z") returned 4 [0061.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", pszSpec="*.tar") returned 0 [0061.239] lstrlenA (lpString="*.tar") returned 5 [0061.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", pszSpec="*.gzip") returned 0 [0061.239] lstrlenA (lpString="*.gzip") returned 6 [0061.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", pszSpec="*.jpg") returned 1 [0061.239] lstrlenA (lpString="*.jpg") returned 5 [0061.239] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" [0061.239] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" [0061.239] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg." [0061.239] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg.wannacry" [0061.239] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.240] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e78 [0061.240] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3e983f00, dwHighDateTime=0x1c95fc9), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3e983f00, dwHighDateTime=0x1c95fc9)) returned 1 [0061.240] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.240] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3dfa, lpOverlapped=0x0) returned 1 [0061.243] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg") returned="AlertImage_Off.jpg" [0061.243] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.243] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3dfa, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3dfa, lpOverlapped=0x0) returned 1 [0061.243] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.244] CloseHandle (hObject=0x98) returned 1 [0061.244] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg.wannacry")) returned 1 [0061.245] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x258f8e00, ftCreationTime.dwHighDateTime=0x1c95fc9, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x258f8e00, ftLastWriteTime.dwHighDateTime=0x1c95fc9, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="AlertImage_OffMask.bmp", cAlternateFileName="ALA9A1~1.BMP")) returned 1 [0061.245] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.245] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AlertImage_OffMask.bmp") returned 1 [0061.245] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_OffMask.bmp") returned 1 [0061.245] lstrcmpiA (lpString1="", lpString2="AlertImage_OffMask.bmp") returned -1 [0061.245] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg") returned="AlertImage_Off.jpg" [0061.245] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0061.245] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="" [0061.245] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" [0061.245] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20 [0061.245] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_OffMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp" [0061.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.zip") returned 0 [0061.245] lstrlenA (lpString="*.zip") returned 5 [0061.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.rar") returned 0 [0061.246] lstrlenA (lpString="*.rar") returned 5 [0061.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.7z") returned 0 [0061.246] lstrlenA (lpString="*.7z") returned 4 [0061.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.tar") returned 0 [0061.246] lstrlenA (lpString="*.tar") returned 5 [0061.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.gzip") returned 0 [0061.246] lstrlenA (lpString="*.gzip") returned 6 [0061.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.jpg") returned 0 [0061.246] lstrlenA (lpString="*.jpg") returned 5 [0061.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.jpeg") returned 0 [0061.246] lstrlenA (lpString="*.jpeg") returned 6 [0061.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.psd") returned 0 [0061.246] lstrlenA (lpString="*.psd") returned 5 [0061.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.gif") returned 0 [0061.246] lstrlenA (lpString="*.gif") returned 5 [0061.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.doc") returned 0 [0061.246] lstrlenA (lpString="*.doc") returned 5 [0061.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.docx") returned 0 [0061.246] lstrlenA (lpString="*.docx") returned 6 [0061.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.xls") returned 0 [0061.246] lstrlenA (lpString="*.xls") returned 5 [0061.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.xlsx") returned 0 [0061.246] lstrlenA (lpString="*.xlsx") returned 6 [0061.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.ppt") returned 0 [0061.246] lstrlenA (lpString="*.ppt") returned 5 [0061.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.pptx") returned 0 [0061.247] lstrlenA (lpString="*.pptx") returned 6 [0061.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.pdf") returned 0 [0061.247] lstrlenA (lpString="*.pdf") returned 5 [0061.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.mov") returned 0 [0061.247] lstrlenA (lpString="*.mov") returned 5 [0061.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.m2v") returned 0 [0061.247] lstrlenA (lpString="*.m2v") returned 5 [0061.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.3gp") returned 0 [0061.247] lstrlenA (lpString="*.3gp") returned 5 [0061.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.mpeg") returned 0 [0061.247] lstrlenA (lpString="*.mpeg") returned 6 [0061.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.mpg") returned 0 [0061.247] lstrlenA (lpString="*.mpg") returned 5 [0061.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.flv") returned 0 [0061.247] lstrlenA (lpString="*.flv") returned 5 [0061.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.avi") returned 0 [0061.247] lstrlenA (lpString="*.avi") returned 5 [0061.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.mp4") returned 0 [0061.247] lstrlenA (lpString="*.mp4") returned 5 [0061.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.wmv") returned 0 [0061.247] lstrlenA (lpString="*.wmv") returned 5 [0061.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.divx") returned 0 [0061.247] lstrlenA (lpString="*.divx") returned 6 [0061.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.mkv") returned 0 [0061.247] lstrlenA (lpString="*.mkv") returned 5 [0061.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.mp3") returned 0 [0061.248] lstrlenA (lpString="*.mp3") returned 5 [0061.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.wav") returned 0 [0061.248] lstrlenA (lpString="*.wav") returned 5 [0061.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.flac") returned 0 [0061.248] lstrlenA (lpString="*.flac") returned 6 [0061.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.ape") returned 0 [0061.248] lstrlenA (lpString="*.ape") returned 5 [0061.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.wma") returned 0 [0061.248] lstrlenA (lpString="*.wma") returned 5 [0061.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.ac3") returned 0 [0061.248] lstrlenA (lpString="*.ac3") returned 5 [0061.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.mxf") returned 0 [0061.248] lstrlenA (lpString="*.mxf") returned 5 [0061.248] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbb75100, ftCreationTime.dwHighDateTime=0x1c9bcb4, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbb75100, ftLastWriteTime.dwHighDateTime=0x1c9bcb4, nFileSizeHigh=0x0, nFileSizeLow=0x2256, dwReserved0=0x540020, dwReserved1=0x20004f, cFileName="CommsIncomingImage.jpg", cAlternateFileName="COMMSI~1.JPG")) returned 1 [0061.248] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.248] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CommsIncomingImage.jpg") returned 1 [0061.248] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CommsIncomingImage.jpg") returned 1 [0061.248] lstrcmpiA (lpString1="", lpString2="CommsIncomingImage.jpg") returned -1 [0061.248] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp") returned="AlertImage_OffMask.bmp" [0061.248] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0061.248] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="" [0061.248] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" [0061.248] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20 [0061.249] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="CommsIncomingImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" [0061.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", pszSpec="*.zip") returned 0 [0061.249] lstrlenA (lpString="*.zip") returned 5 [0061.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", pszSpec="*.rar") returned 0 [0061.249] lstrlenA (lpString="*.rar") returned 5 [0061.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", pszSpec="*.7z") returned 0 [0061.249] lstrlenA (lpString="*.7z") returned 4 [0061.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", pszSpec="*.tar") returned 0 [0061.249] lstrlenA (lpString="*.tar") returned 5 [0061.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", pszSpec="*.gzip") returned 0 [0061.249] lstrlenA (lpString="*.gzip") returned 6 [0061.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", pszSpec="*.jpg") returned 1 [0061.249] lstrlenA (lpString="*.jpg") returned 5 [0061.249] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" [0061.249] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" [0061.249] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg." [0061.249] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg.wannacry" [0061.249] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.251] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2256 [0061.251] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfbb75100, dwHighDateTime=0x1c9bcb4), lpLastAccessTime=0x407536*(dwLowDateTime=0x603f4990, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xfbb75100, dwHighDateTime=0x1c9bcb4)) returned 1 [0061.251] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.251] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x21d8, lpOverlapped=0x0) returned 1 [0061.253] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg") returned="CommsIncomingImage.jpg" [0061.253] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.253] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x21d8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x21d8, lpOverlapped=0x0) returned 1 [0061.253] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.254] CloseHandle (hObject=0x98) returned 1 [0061.254] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg.wannacry")) returned 1 [0061.255] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d183d00, ftCreationTime.dwHighDateTime=0x1c9bcb5, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d183d00, ftLastWriteTime.dwHighDateTime=0x1c9bcb5, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="CommsIncomingImageMask.bmp", cAlternateFileName="COMMSI~2.BMP")) returned 1 [0061.255] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.255] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CommsIncomingImageMask.bmp") returned 1 [0061.255] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CommsIncomingImageMask.bmp") returned 1 [0061.255] lstrcmpiA (lpString1="", lpString2="CommsIncomingImageMask.bmp") returned -1 [0061.255] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg") returned="CommsIncomingImage.jpg" [0061.255] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0061.255] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="" [0061.255] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" [0061.255] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20 [0061.255] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="CommsIncomingImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp" [0061.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.zip") returned 0 [0061.255] lstrlenA (lpString="*.zip") returned 5 [0061.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.rar") returned 0 [0061.255] lstrlenA (lpString="*.rar") returned 5 [0061.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.7z") returned 0 [0061.256] lstrlenA (lpString="*.7z") returned 4 [0061.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.tar") returned 0 [0061.256] lstrlenA (lpString="*.tar") returned 5 [0061.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.gzip") returned 0 [0061.256] lstrlenA (lpString="*.gzip") returned 6 [0061.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.jpg") returned 0 [0061.256] lstrlenA (lpString="*.jpg") returned 5 [0061.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.jpeg") returned 0 [0061.256] lstrlenA (lpString="*.jpeg") returned 6 [0061.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.psd") returned 0 [0061.256] lstrlenA (lpString="*.psd") returned 5 [0061.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.gif") returned 0 [0061.256] lstrlenA (lpString="*.gif") returned 5 [0061.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.doc") returned 0 [0061.256] lstrlenA (lpString="*.doc") returned 5 [0061.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.docx") returned 0 [0061.256] lstrlenA (lpString="*.docx") returned 6 [0061.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.xls") returned 0 [0061.256] lstrlenA (lpString="*.xls") returned 5 [0061.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.xlsx") returned 0 [0061.256] lstrlenA (lpString="*.xlsx") returned 6 [0061.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.ppt") returned 0 [0061.256] lstrlenA (lpString="*.ppt") returned 5 [0061.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.pptx") returned 0 [0061.257] lstrlenA (lpString="*.pptx") returned 6 [0061.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.pdf") returned 0 [0061.257] lstrlenA (lpString="*.pdf") returned 5 [0061.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.mov") returned 0 [0061.257] lstrlenA (lpString="*.mov") returned 5 [0061.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.m2v") returned 0 [0061.257] lstrlenA (lpString="*.m2v") returned 5 [0061.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.3gp") returned 0 [0061.257] lstrlenA (lpString="*.3gp") returned 5 [0061.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.mpeg") returned 0 [0061.257] lstrlenA (lpString="*.mpeg") returned 6 [0061.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.mpg") returned 0 [0061.257] lstrlenA (lpString="*.mpg") returned 5 [0061.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.flv") returned 0 [0061.257] lstrlenA (lpString="*.flv") returned 5 [0061.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.avi") returned 0 [0061.257] lstrlenA (lpString="*.avi") returned 5 [0061.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.mp4") returned 0 [0061.257] lstrlenA (lpString="*.mp4") returned 5 [0061.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.wmv") returned 0 [0061.257] lstrlenA (lpString="*.wmv") returned 5 [0061.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.divx") returned 0 [0061.257] lstrlenA (lpString="*.divx") returned 6 [0061.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.mkv") returned 0 [0061.257] lstrlenA (lpString="*.mkv") returned 5 [0061.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.mp3") returned 0 [0061.257] lstrlenA (lpString="*.mp3") returned 5 [0061.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.wav") returned 0 [0061.258] lstrlenA (lpString="*.wav") returned 5 [0061.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.flac") returned 0 [0061.258] lstrlenA (lpString="*.flac") returned 6 [0061.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.ape") returned 0 [0061.258] lstrlenA (lpString="*.ape") returned 5 [0061.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.wma") returned 0 [0061.258] lstrlenA (lpString="*.wma") returned 5 [0061.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.ac3") returned 0 [0061.258] lstrlenA (lpString="*.ac3") returned 5 [0061.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.mxf") returned 0 [0061.258] lstrlenA (lpString="*.mxf") returned 5 [0061.258] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee1e000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ee1e000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x630, dwReserved0=0x540020, dwReserved1=0x20004f, cFileName="CommsIncomingImageMaskSmall.bmp", cAlternateFileName="COMMSI~1.BMP")) returned 1 [0061.258] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.258] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CommsIncomingImageMaskSmall.bmp") returned 1 [0061.258] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CommsIncomingImageMaskSmall.bmp") returned 1 [0061.258] lstrcmpiA (lpString1="", lpString2="CommsIncomingImageMaskSmall.bmp") returned -1 [0061.258] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp") returned="CommsIncomingImageMask.bmp" [0061.258] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0061.258] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="" [0061.259] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" [0061.259] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20 [0061.259] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="CommsIncomingImageMaskSmall.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp" [0061.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.zip") returned 0 [0061.259] lstrlenA (lpString="*.zip") returned 5 [0061.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.rar") returned 0 [0061.259] lstrlenA (lpString="*.rar") returned 5 [0061.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.7z") returned 0 [0061.259] lstrlenA (lpString="*.7z") returned 4 [0061.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.tar") returned 0 [0061.259] lstrlenA (lpString="*.tar") returned 5 [0061.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.gzip") returned 0 [0061.259] lstrlenA (lpString="*.gzip") returned 6 [0061.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.jpg") returned 0 [0061.259] lstrlenA (lpString="*.jpg") returned 5 [0061.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.jpeg") returned 0 [0061.259] lstrlenA (lpString="*.jpeg") returned 6 [0061.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.psd") returned 0 [0061.259] lstrlenA (lpString="*.psd") returned 5 [0061.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.gif") returned 0 [0061.259] lstrlenA (lpString="*.gif") returned 5 [0061.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.doc") returned 0 [0061.259] lstrlenA (lpString="*.doc") returned 5 [0061.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.docx") returned 0 [0061.260] lstrlenA (lpString="*.docx") returned 6 [0061.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.xls") returned 0 [0061.260] lstrlenA (lpString="*.xls") returned 5 [0061.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.xlsx") returned 0 [0061.260] lstrlenA (lpString="*.xlsx") returned 6 [0061.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.ppt") returned 0 [0061.260] lstrlenA (lpString="*.ppt") returned 5 [0061.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.pptx") returned 0 [0061.260] lstrlenA (lpString="*.pptx") returned 6 [0061.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.pdf") returned 0 [0061.260] lstrlenA (lpString="*.pdf") returned 5 [0061.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.mov") returned 0 [0061.260] lstrlenA (lpString="*.mov") returned 5 [0061.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.m2v") returned 0 [0061.260] lstrlenA (lpString="*.m2v") returned 5 [0061.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.3gp") returned 0 [0061.260] lstrlenA (lpString="*.3gp") returned 5 [0061.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.mpeg") returned 0 [0061.260] lstrlenA (lpString="*.mpeg") returned 6 [0061.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.mpg") returned 0 [0061.260] lstrlenA (lpString="*.mpg") returned 5 [0061.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.flv") returned 0 [0061.260] lstrlenA (lpString="*.flv") returned 5 [0061.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.avi") returned 0 [0061.260] lstrlenA (lpString="*.avi") returned 5 [0061.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.mp4") returned 0 [0061.260] lstrlenA (lpString="*.mp4") returned 5 [0061.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.wmv") returned 0 [0061.261] lstrlenA (lpString="*.wmv") returned 5 [0061.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.divx") returned 0 [0061.261] lstrlenA (lpString="*.divx") returned 6 [0061.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.mkv") returned 0 [0061.261] lstrlenA (lpString="*.mkv") returned 5 [0061.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.mp3") returned 0 [0061.261] lstrlenA (lpString="*.mp3") returned 5 [0061.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.wav") returned 0 [0061.261] lstrlenA (lpString="*.wav") returned 5 [0061.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.flac") returned 0 [0061.261] lstrlenA (lpString="*.flac") returned 6 [0061.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.ape") returned 0 [0061.261] lstrlenA (lpString="*.ape") returned 5 [0061.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.wma") returned 0 [0061.261] lstrlenA (lpString="*.wma") returned 5 [0061.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.ac3") returned 0 [0061.261] lstrlenA (lpString="*.ac3") returned 5 [0061.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.mxf") returned 0 [0061.261] lstrlenA (lpString="*.mxf") returned 5 [0061.261] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee1e000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ee1e000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1de3, dwReserved0=0x540020, dwReserved1=0x20004f, cFileName="CommsIncomingImageSmall.jpg", cAlternateFileName="COMMSI~2.JPG")) returned 1 [0061.261] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.261] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CommsIncomingImageSmall.jpg") returned 1 [0061.261] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CommsIncomingImageSmall.jpg") returned 1 [0061.261] lstrcmpiA (lpString1="", lpString2="CommsIncomingImageSmall.jpg") returned -1 [0061.261] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp") returned="CommsIncomingImageMaskSmall.bmp" [0061.261] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0061.262] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="" [0061.262] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" [0061.262] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20 [0061.262] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="CommsIncomingImageSmall.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" [0061.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", pszSpec="*.zip") returned 0 [0061.262] lstrlenA (lpString="*.zip") returned 5 [0061.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", pszSpec="*.rar") returned 0 [0061.262] lstrlenA (lpString="*.rar") returned 5 [0061.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", pszSpec="*.7z") returned 0 [0061.262] lstrlenA (lpString="*.7z") returned 4 [0061.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", pszSpec="*.tar") returned 0 [0061.262] lstrlenA (lpString="*.tar") returned 5 [0061.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", pszSpec="*.gzip") returned 0 [0061.262] lstrlenA (lpString="*.gzip") returned 6 [0061.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", pszSpec="*.jpg") returned 1 [0061.262] lstrlenA (lpString="*.jpg") returned 5 [0061.262] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" [0061.262] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" [0061.262] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg." [0061.262] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg.wannacry" [0061.262] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.263] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1de3 [0061.263] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7ee1e000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x603f4990, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7ee1e000, dwHighDateTime=0x1c747ea)) returned 1 [0061.263] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.263] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1d65, lpOverlapped=0x0) returned 1 [0061.266] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg") returned="CommsIncomingImageSmall.jpg" [0061.266] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.266] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1d65, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1d65, lpOverlapped=0x0) returned 1 [0061.266] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.266] CloseHandle (hObject=0x98) returned 1 [0061.266] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg.wannacry")) returned 1 [0061.267] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c468e00, ftCreationTime.dwHighDateTime=0x1c9bcb5, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c468e00, ftLastWriteTime.dwHighDateTime=0x1c9bcb5, nFileSizeHigh=0x0, nFileSizeLow=0x22c0, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="CommsOutgoingImage.jpg", cAlternateFileName="COMMSO~2.JPG")) returned 1 [0061.267] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.267] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CommsOutgoingImage.jpg") returned 1 [0061.267] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CommsOutgoingImage.jpg") returned 1 [0061.268] lstrcmpiA (lpString1="", lpString2="CommsOutgoingImage.jpg") returned -1 [0061.268] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg") returned="CommsIncomingImageSmall.jpg" [0061.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0061.268] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="" [0061.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" [0061.268] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20 [0061.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="CommsOutgoingImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" [0061.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", pszSpec="*.zip") returned 0 [0061.268] lstrlenA (lpString="*.zip") returned 5 [0061.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", pszSpec="*.rar") returned 0 [0061.268] lstrlenA (lpString="*.rar") returned 5 [0061.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", pszSpec="*.7z") returned 0 [0061.268] lstrlenA (lpString="*.7z") returned 4 [0061.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", pszSpec="*.tar") returned 0 [0061.268] lstrlenA (lpString="*.tar") returned 5 [0061.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", pszSpec="*.gzip") returned 0 [0061.268] lstrlenA (lpString="*.gzip") returned 6 [0061.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", pszSpec="*.jpg") returned 1 [0061.268] lstrlenA (lpString="*.jpg") returned 5 [0061.268] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" [0061.268] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" [0061.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg." [0061.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg.wannacry" [0061.269] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.270] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x22c0 [0061.270] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5c468e00, dwHighDateTime=0x1c9bcb5), lpLastAccessTime=0x407536*(dwLowDateTime=0x6041aaf0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5c468e00, dwHighDateTime=0x1c9bcb5)) returned 1 [0061.271] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.271] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2242, lpOverlapped=0x0) returned 1 [0061.273] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg") returned="CommsOutgoingImage.jpg" [0061.273] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.273] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2242, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2242, lpOverlapped=0x0) returned 1 [0061.273] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.273] CloseHandle (hObject=0x98) returned 1 [0061.273] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg.wannacry")) returned 1 [0061.274] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf59600, ftCreationTime.dwHighDateTime=0x1c9bcb5, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bf59600, ftLastWriteTime.dwHighDateTime=0x1c9bcb5, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="CommsOutgoingImageMask.bmp", cAlternateFileName="COMMSO~1.BMP")) returned 1 [0061.274] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.274] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CommsOutgoingImageMask.bmp") returned 1 [0061.274] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CommsOutgoingImageMask.bmp") returned 1 [0061.274] lstrcmpiA (lpString1="", lpString2="CommsOutgoingImageMask.bmp") returned -1 [0061.274] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg") returned="CommsOutgoingImage.jpg" [0061.275] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0061.275] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="" [0061.275] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" [0061.275] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20 [0061.275] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="CommsOutgoingImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp" [0061.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.zip") returned 0 [0061.275] lstrlenA (lpString="*.zip") returned 5 [0061.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.rar") returned 0 [0061.275] lstrlenA (lpString="*.rar") returned 5 [0061.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.7z") returned 0 [0061.275] lstrlenA (lpString="*.7z") returned 4 [0061.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.tar") returned 0 [0061.275] lstrlenA (lpString="*.tar") returned 5 [0061.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.gzip") returned 0 [0061.275] lstrlenA (lpString="*.gzip") returned 6 [0061.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.jpg") returned 0 [0061.275] lstrlenA (lpString="*.jpg") returned 5 [0061.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.jpeg") returned 0 [0061.275] lstrlenA (lpString="*.jpeg") returned 6 [0061.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.psd") returned 0 [0061.275] lstrlenA (lpString="*.psd") returned 5 [0061.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.gif") returned 0 [0061.276] lstrlenA (lpString="*.gif") returned 5 [0061.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.doc") returned 0 [0061.276] lstrlenA (lpString="*.doc") returned 5 [0061.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.docx") returned 0 [0061.276] lstrlenA (lpString="*.docx") returned 6 [0061.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.xls") returned 0 [0061.276] lstrlenA (lpString="*.xls") returned 5 [0061.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.xlsx") returned 0 [0061.276] lstrlenA (lpString="*.xlsx") returned 6 [0061.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.ppt") returned 0 [0061.276] lstrlenA (lpString="*.ppt") returned 5 [0061.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.pptx") returned 0 [0061.276] lstrlenA (lpString="*.pptx") returned 6 [0061.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.pdf") returned 0 [0061.276] lstrlenA (lpString="*.pdf") returned 5 [0061.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.mov") returned 0 [0061.276] lstrlenA (lpString="*.mov") returned 5 [0061.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.m2v") returned 0 [0061.276] lstrlenA (lpString="*.m2v") returned 5 [0061.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.3gp") returned 0 [0061.276] lstrlenA (lpString="*.3gp") returned 5 [0061.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.mpeg") returned 0 [0061.276] lstrlenA (lpString="*.mpeg") returned 6 [0061.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.mpg") returned 0 [0061.276] lstrlenA (lpString="*.mpg") returned 5 [0061.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.flv") returned 0 [0061.277] lstrlenA (lpString="*.flv") returned 5 [0061.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.avi") returned 0 [0061.277] lstrlenA (lpString="*.avi") returned 5 [0061.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.mp4") returned 0 [0061.277] lstrlenA (lpString="*.mp4") returned 5 [0061.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.wmv") returned 0 [0061.277] lstrlenA (lpString="*.wmv") returned 5 [0061.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.divx") returned 0 [0061.277] lstrlenA (lpString="*.divx") returned 6 [0061.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.mkv") returned 0 [0061.277] lstrlenA (lpString="*.mkv") returned 5 [0061.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.mp3") returned 0 [0061.277] lstrlenA (lpString="*.mp3") returned 5 [0061.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.wav") returned 0 [0061.277] lstrlenA (lpString="*.wav") returned 5 [0061.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.flac") returned 0 [0061.277] lstrlenA (lpString="*.flac") returned 6 [0061.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.ape") returned 0 [0061.277] lstrlenA (lpString="*.ape") returned 5 [0061.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.wma") returned 0 [0061.277] lstrlenA (lpString="*.wma") returned 5 [0061.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.ac3") returned 0 [0061.277] lstrlenA (lpString="*.ac3") returned 5 [0061.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.mxf") returned 0 [0061.277] lstrlenA (lpString="*.mxf") returned 5 [0061.278] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee1e000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ee1e000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x630, dwReserved0=0x540020, dwReserved1=0x20004f, cFileName="CommsOutgoingImageMaskSmall.bmp", cAlternateFileName="COMMSO~2.BMP")) returned 1 [0061.278] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.278] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CommsOutgoingImageMaskSmall.bmp") returned 1 [0061.278] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CommsOutgoingImageMaskSmall.bmp") returned 1 [0061.278] lstrcmpiA (lpString1="", lpString2="CommsOutgoingImageMaskSmall.bmp") returned -1 [0061.278] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp") returned="CommsOutgoingImageMask.bmp" [0061.278] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0061.278] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="" [0061.278] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" [0061.278] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20 [0061.278] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="CommsOutgoingImageMaskSmall.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp" [0061.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.zip") returned 0 [0061.278] lstrlenA (lpString="*.zip") returned 5 [0061.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.rar") returned 0 [0061.278] lstrlenA (lpString="*.rar") returned 5 [0061.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.7z") returned 0 [0061.278] lstrlenA (lpString="*.7z") returned 4 [0061.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.tar") returned 0 [0061.278] lstrlenA (lpString="*.tar") returned 5 [0061.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.gzip") returned 0 [0061.278] lstrlenA (lpString="*.gzip") returned 6 [0061.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.jpg") returned 0 [0061.279] lstrlenA (lpString="*.jpg") returned 5 [0061.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.jpeg") returned 0 [0061.279] lstrlenA (lpString="*.jpeg") returned 6 [0061.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.psd") returned 0 [0061.279] lstrlenA (lpString="*.psd") returned 5 [0061.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.gif") returned 0 [0061.279] lstrlenA (lpString="*.gif") returned 5 [0061.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.doc") returned 0 [0061.279] lstrlenA (lpString="*.doc") returned 5 [0061.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.docx") returned 0 [0061.279] lstrlenA (lpString="*.docx") returned 6 [0061.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.xls") returned 0 [0061.279] lstrlenA (lpString="*.xls") returned 5 [0061.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.xlsx") returned 0 [0061.279] lstrlenA (lpString="*.xlsx") returned 6 [0061.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.ppt") returned 0 [0061.279] lstrlenA (lpString="*.ppt") returned 5 [0061.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.pptx") returned 0 [0061.279] lstrlenA (lpString="*.pptx") returned 6 [0061.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.pdf") returned 0 [0061.280] lstrlenA (lpString="*.pdf") returned 5 [0061.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.mov") returned 0 [0061.280] lstrlenA (lpString="*.mov") returned 5 [0061.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.m2v") returned 0 [0061.280] lstrlenA (lpString="*.m2v") returned 5 [0061.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.3gp") returned 0 [0061.280] lstrlenA (lpString="*.3gp") returned 5 [0061.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.mpeg") returned 0 [0061.280] lstrlenA (lpString="*.mpeg") returned 6 [0061.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.mpg") returned 0 [0061.280] lstrlenA (lpString="*.mpg") returned 5 [0061.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.flv") returned 0 [0061.280] lstrlenA (lpString="*.flv") returned 5 [0061.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.avi") returned 0 [0061.280] lstrlenA (lpString="*.avi") returned 5 [0061.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.mp4") returned 0 [0061.280] lstrlenA (lpString="*.mp4") returned 5 [0061.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.wmv") returned 0 [0061.280] lstrlenA (lpString="*.wmv") returned 5 [0061.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.divx") returned 0 [0061.280] lstrlenA (lpString="*.divx") returned 6 [0061.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.mkv") returned 0 [0061.281] lstrlenA (lpString="*.mkv") returned 5 [0061.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.mp3") returned 0 [0061.281] lstrlenA (lpString="*.mp3") returned 5 [0061.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.wav") returned 0 [0061.281] lstrlenA (lpString="*.wav") returned 5 [0061.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.flac") returned 0 [0061.281] lstrlenA (lpString="*.flac") returned 6 [0061.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.ape") returned 0 [0061.281] lstrlenA (lpString="*.ape") returned 5 [0061.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.wma") returned 0 [0061.281] lstrlenA (lpString="*.wma") returned 5 [0061.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.ac3") returned 0 [0061.281] lstrlenA (lpString="*.ac3") returned 5 [0061.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.mxf") returned 0 [0061.281] lstrlenA (lpString="*.mxf") returned 5 [0061.281] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee1e000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ee1e000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1dd7, dwReserved0=0x540020, dwReserved1=0x20004f, cFileName="CommsOutgoingImageSmall.jpg", cAlternateFileName="COMMSO~1.JPG")) returned 1 [0061.281] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.281] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CommsOutgoingImageSmall.jpg") returned 1 [0061.281] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CommsOutgoingImageSmall.jpg") returned 1 [0061.281] lstrcmpiA (lpString1="", lpString2="CommsOutgoingImageSmall.jpg") returned -1 [0061.281] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp") returned="CommsOutgoingImageMaskSmall.bmp" [0061.281] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0061.281] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="" [0061.281] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" [0061.282] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20 [0061.282] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="CommsOutgoingImageSmall.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" [0061.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", pszSpec="*.zip") returned 0 [0061.282] lstrlenA (lpString="*.zip") returned 5 [0061.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", pszSpec="*.rar") returned 0 [0061.282] lstrlenA (lpString="*.rar") returned 5 [0061.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", pszSpec="*.7z") returned 0 [0061.282] lstrlenA (lpString="*.7z") returned 4 [0061.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", pszSpec="*.tar") returned 0 [0061.282] lstrlenA (lpString="*.tar") returned 5 [0061.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", pszSpec="*.gzip") returned 0 [0061.282] lstrlenA (lpString="*.gzip") returned 6 [0061.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", pszSpec="*.jpg") returned 1 [0061.282] lstrlenA (lpString="*.jpg") returned 5 [0061.282] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" [0061.282] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" [0061.282] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg." [0061.282] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg.wannacry" [0061.282] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.283] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1dd7 [0061.283] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7ee1e000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51cc30d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7ee1e000, dwHighDateTime=0x1c747ea)) returned 1 [0061.283] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.284] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1d59, lpOverlapped=0x0) returned 1 [0061.287] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg") returned="CommsOutgoingImageSmall.jpg" [0061.287] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.287] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1d59, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1d59, lpOverlapped=0x0) returned 1 [0061.287] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.288] CloseHandle (hObject=0x98) returned 1 [0061.288] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg.wannacry")) returned 1 [0061.289] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2798, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="MessageBoxIconImages.jpg", cAlternateFileName="MESSAG~1.JPG")) returned 1 [0061.289] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.289] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MessageBoxIconImages.jpg") returned -1 [0061.289] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MessageBoxIconImages.jpg") returned -1 [0061.289] lstrcmpiA (lpString1="", lpString2="MessageBoxIconImages.jpg") returned -1 [0061.289] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg") returned="CommsOutgoingImageSmall.jpg" [0061.289] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0061.289] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="" [0061.289] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" [0061.289] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20 [0061.289] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="MessageBoxIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" [0061.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", pszSpec="*.zip") returned 0 [0061.289] lstrlenA (lpString="*.zip") returned 5 [0061.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", pszSpec="*.rar") returned 0 [0061.290] lstrlenA (lpString="*.rar") returned 5 [0061.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", pszSpec="*.7z") returned 0 [0061.290] lstrlenA (lpString="*.7z") returned 4 [0061.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", pszSpec="*.tar") returned 0 [0061.290] lstrlenA (lpString="*.tar") returned 5 [0061.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", pszSpec="*.gzip") returned 0 [0061.290] lstrlenA (lpString="*.gzip") returned 6 [0061.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", pszSpec="*.jpg") returned 1 [0061.290] lstrlenA (lpString="*.jpg") returned 5 [0061.290] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" [0061.290] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" [0061.290] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg." [0061.290] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg.wannacry" [0061.290] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.291] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2798 [0061.291] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x80130d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x69a5d7b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x80130d00, dwHighDateTime=0x1c747ea)) returned 1 [0061.291] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.291] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x271a, lpOverlapped=0x0) returned 1 [0061.293] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg") returned="MessageBoxIconImages.jpg" [0061.293] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.294] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x271a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x271a, lpOverlapped=0x0) returned 1 [0061.294] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.294] CloseHandle (hObject=0x98) returned 1 [0061.294] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg.wannacry")) returned 1 [0061.295] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc0, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="MessageBoxIconImagesMask.bmp", cAlternateFileName="MESSAG~1.BMP")) returned 1 [0061.295] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.295] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MessageBoxIconImagesMask.bmp") returned -1 [0061.295] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MessageBoxIconImagesMask.bmp") returned -1 [0061.295] lstrcmpiA (lpString1="", lpString2="MessageBoxIconImagesMask.bmp") returned -1 [0061.295] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg") returned="MessageBoxIconImages.jpg" [0061.295] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0061.295] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="" [0061.295] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" [0061.295] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20 [0061.296] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="MessageBoxIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp" [0061.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0061.296] lstrlenA (lpString="*.zip") returned 5 [0061.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0061.296] lstrlenA (lpString="*.rar") returned 5 [0061.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0061.296] lstrlenA (lpString="*.7z") returned 4 [0061.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0061.296] lstrlenA (lpString="*.tar") returned 5 [0061.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0061.296] lstrlenA (lpString="*.gzip") returned 6 [0061.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0061.296] lstrlenA (lpString="*.jpg") returned 5 [0061.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0061.296] lstrlenA (lpString="*.jpeg") returned 6 [0061.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0061.296] lstrlenA (lpString="*.psd") returned 5 [0061.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.gif") returned 0 [0061.296] lstrlenA (lpString="*.gif") returned 5 [0061.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.doc") returned 0 [0061.296] lstrlenA (lpString="*.doc") returned 5 [0061.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.docx") returned 0 [0061.296] lstrlenA (lpString="*.docx") returned 6 [0061.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.xls") returned 0 [0061.297] lstrlenA (lpString="*.xls") returned 5 [0061.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.xlsx") returned 0 [0061.297] lstrlenA (lpString="*.xlsx") returned 6 [0061.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.ppt") returned 0 [0061.297] lstrlenA (lpString="*.ppt") returned 5 [0061.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.pptx") returned 0 [0061.297] lstrlenA (lpString="*.pptx") returned 6 [0061.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.pdf") returned 0 [0061.297] lstrlenA (lpString="*.pdf") returned 5 [0061.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.mov") returned 0 [0061.297] lstrlenA (lpString="*.mov") returned 5 [0061.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.m2v") returned 0 [0061.297] lstrlenA (lpString="*.m2v") returned 5 [0061.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.3gp") returned 0 [0061.297] lstrlenA (lpString="*.3gp") returned 5 [0061.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.mpeg") returned 0 [0061.297] lstrlenA (lpString="*.mpeg") returned 6 [0061.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.mpg") returned 0 [0061.297] lstrlenA (lpString="*.mpg") returned 5 [0061.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.flv") returned 0 [0061.297] lstrlenA (lpString="*.flv") returned 5 [0061.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.avi") returned 0 [0061.297] lstrlenA (lpString="*.avi") returned 5 [0061.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.mp4") returned 0 [0061.297] lstrlenA (lpString="*.mp4") returned 5 [0061.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.wmv") returned 0 [0061.298] lstrlenA (lpString="*.wmv") returned 5 [0061.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.divx") returned 0 [0061.298] lstrlenA (lpString="*.divx") returned 6 [0061.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.mkv") returned 0 [0061.298] lstrlenA (lpString="*.mkv") returned 5 [0061.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.mp3") returned 0 [0061.298] lstrlenA (lpString="*.mp3") returned 5 [0061.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.wav") returned 0 [0061.298] lstrlenA (lpString="*.wav") returned 5 [0061.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.flac") returned 0 [0061.298] lstrlenA (lpString="*.flac") returned 6 [0061.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.ape") returned 0 [0061.298] lstrlenA (lpString="*.ape") returned 5 [0061.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.wma") returned 0 [0061.298] lstrlenA (lpString="*.wma") returned 5 [0061.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.ac3") returned 0 [0061.298] lstrlenA (lpString="*.ac3") returned 5 [0061.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.mxf") returned 0 [0061.298] lstrlenA (lpString="*.mxf") returned 5 [0061.298] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c135400, ftCreationTime.dwHighDateTime=0x1ca0330, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c135400, ftLastWriteTime.dwHighDateTime=0x1ca0330, nFileSizeHigh=0x0, nFileSizeLow=0x1fec, dwReserved0=0x540020, dwReserved1=0x20004f, cFileName="UnreadIcon.jpg", cAlternateFileName="UNREAD~1.JPG")) returned 1 [0061.298] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.298] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UnreadIcon.jpg") returned -1 [0061.298] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UnreadIcon.jpg") returned -1 [0061.299] lstrcmpiA (lpString1="", lpString2="UnreadIcon.jpg") returned -1 [0061.299] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp") returned="MessageBoxIconImagesMask.bmp" [0061.299] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0061.299] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="" [0061.299] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" [0061.299] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20 [0061.299] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="UnreadIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" [0061.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", pszSpec="*.zip") returned 0 [0061.299] lstrlenA (lpString="*.zip") returned 5 [0061.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", pszSpec="*.rar") returned 0 [0061.299] lstrlenA (lpString="*.rar") returned 5 [0061.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", pszSpec="*.7z") returned 0 [0061.299] lstrlenA (lpString="*.7z") returned 4 [0061.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", pszSpec="*.tar") returned 0 [0061.299] lstrlenA (lpString="*.tar") returned 5 [0061.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", pszSpec="*.gzip") returned 0 [0061.299] lstrlenA (lpString="*.gzip") returned 6 [0061.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", pszSpec="*.jpg") returned 1 [0061.299] lstrlenA (lpString="*.jpg") returned 5 [0061.299] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" [0061.299] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" [0061.300] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg." [0061.300] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.wannacry" [0061.300] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.301] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fec [0061.301] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6c135400, dwHighDateTime=0x1ca0330), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e3d2090, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6c135400, dwHighDateTime=0x1ca0330)) returned 1 [0061.301] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.301] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1f6e, lpOverlapped=0x0) returned 1 [0061.304] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg") returned="UnreadIcon.jpg" [0061.304] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.304] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1f6e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1f6e, lpOverlapped=0x0) returned 1 [0061.307] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.307] CloseHandle (hObject=0x98) returned 1 [0061.307] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg.wannacry")) returned 1 [0061.308] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb98fc100, ftCreationTime.dwHighDateTime=0x1ca0330, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb98fc100, ftLastWriteTime.dwHighDateTime=0x1ca0330, nFileSizeHigh=0x0, nFileSizeLow=0x1ffe, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="UnreadIconImages.jpg", cAlternateFileName="UNREAD~2.JPG")) returned 1 [0061.308] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.308] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UnreadIconImages.jpg") returned -1 [0061.308] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UnreadIconImages.jpg") returned -1 [0061.309] lstrcmpiA (lpString1="", lpString2="UnreadIconImages.jpg") returned -1 [0061.309] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg") returned="UnreadIcon.jpg" [0061.309] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0061.309] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="" [0061.309] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" [0061.309] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20 [0061.309] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="UnreadIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" [0061.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", pszSpec="*.zip") returned 0 [0061.309] lstrlenA (lpString="*.zip") returned 5 [0061.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", pszSpec="*.rar") returned 0 [0061.309] lstrlenA (lpString="*.rar") returned 5 [0061.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", pszSpec="*.7z") returned 0 [0061.309] lstrlenA (lpString="*.7z") returned 4 [0061.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", pszSpec="*.tar") returned 0 [0061.309] lstrlenA (lpString="*.tar") returned 5 [0061.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", pszSpec="*.gzip") returned 0 [0061.309] lstrlenA (lpString="*.gzip") returned 6 [0061.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", pszSpec="*.jpg") returned 1 [0061.309] lstrlenA (lpString="*.jpg") returned 5 [0061.309] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" [0061.309] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" [0061.310] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg." [0061.310] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg.wannacry" [0061.310] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.312] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ffe [0061.312] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb98fc100, dwHighDateTime=0x1ca0330), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e3d2090, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb98fc100, dwHighDateTime=0x1ca0330)) returned 1 [0061.312] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.312] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1f80, lpOverlapped=0x0) returned 1 [0061.314] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg") returned="UnreadIconImages.jpg" [0061.314] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.314] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1f80, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1f80, lpOverlapped=0x0) returned 1 [0061.314] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.314] CloseHandle (hObject=0x98) returned 1 [0061.314] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg.wannacry")) returned 1 [0061.319] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb90c2000, ftCreationTime.dwHighDateTime=0x1ca035a, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb90c2000, ftLastWriteTime.dwHighDateTime=0x1ca035a, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="UnreadIconImagesMask.bmp", cAlternateFileName="UNREAD~1.BMP")) returned 1 [0061.319] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.319] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UnreadIconImagesMask.bmp") returned -1 [0061.319] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UnreadIconImagesMask.bmp") returned -1 [0061.319] lstrcmpiA (lpString1="", lpString2="UnreadIconImagesMask.bmp") returned -1 [0061.320] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg") returned="UnreadIconImages.jpg" [0061.320] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" [0061.320] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned="" [0061.320] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" [0061.320] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\how to decrypt files.txt")) returned 0x20 [0061.320] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="UnreadIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp" [0061.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0061.320] lstrlenA (lpString="*.zip") returned 5 [0061.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0061.320] lstrlenA (lpString="*.rar") returned 5 [0061.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0061.320] lstrlenA (lpString="*.7z") returned 4 [0061.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0061.320] lstrlenA (lpString="*.tar") returned 5 [0061.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0061.320] lstrlenA (lpString="*.gzip") returned 6 [0061.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0061.320] lstrlenA (lpString="*.jpg") returned 5 [0061.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0061.320] lstrlenA (lpString="*.jpeg") returned 6 [0061.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0061.321] lstrlenA (lpString="*.psd") returned 5 [0061.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.gif") returned 0 [0061.321] lstrlenA (lpString="*.gif") returned 5 [0061.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.doc") returned 0 [0061.321] lstrlenA (lpString="*.doc") returned 5 [0061.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.docx") returned 0 [0061.321] lstrlenA (lpString="*.docx") returned 6 [0061.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.xls") returned 0 [0061.321] lstrlenA (lpString="*.xls") returned 5 [0061.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.xlsx") returned 0 [0061.321] lstrlenA (lpString="*.xlsx") returned 6 [0061.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.ppt") returned 0 [0061.321] lstrlenA (lpString="*.ppt") returned 5 [0061.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.pptx") returned 0 [0061.321] lstrlenA (lpString="*.pptx") returned 6 [0061.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.pdf") returned 0 [0061.321] lstrlenA (lpString="*.pdf") returned 5 [0061.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.mov") returned 0 [0061.321] lstrlenA (lpString="*.mov") returned 5 [0061.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.m2v") returned 0 [0061.321] lstrlenA (lpString="*.m2v") returned 5 [0061.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.3gp") returned 0 [0061.321] lstrlenA (lpString="*.3gp") returned 5 [0061.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.mpeg") returned 0 [0061.322] lstrlenA (lpString="*.mpeg") returned 6 [0061.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.mpg") returned 0 [0061.322] lstrlenA (lpString="*.mpg") returned 5 [0061.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.flv") returned 0 [0061.322] lstrlenA (lpString="*.flv") returned 5 [0061.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.avi") returned 0 [0061.322] lstrlenA (lpString="*.avi") returned 5 [0061.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.mp4") returned 0 [0061.322] lstrlenA (lpString="*.mp4") returned 5 [0061.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.wmv") returned 0 [0061.322] lstrlenA (lpString="*.wmv") returned 5 [0061.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.divx") returned 0 [0061.322] lstrlenA (lpString="*.divx") returned 6 [0061.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.mkv") returned 0 [0061.322] lstrlenA (lpString="*.mkv") returned 5 [0061.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.mp3") returned 0 [0061.322] lstrlenA (lpString="*.mp3") returned 5 [0061.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.wav") returned 0 [0061.322] lstrlenA (lpString="*.wav") returned 5 [0061.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.flac") returned 0 [0061.322] lstrlenA (lpString="*.flac") returned 6 [0061.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.ape") returned 0 [0061.322] lstrlenA (lpString="*.ape") returned 5 [0061.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.wma") returned 0 [0061.322] lstrlenA (lpString="*.wma") returned 5 [0061.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.ac3") returned 0 [0061.323] lstrlenA (lpString="*.ac3") returned 5 [0061.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.mxf") returned 0 [0061.323] lstrlenA (lpString="*.mxf") returned 5 [0061.323] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb90c2000, ftCreationTime.dwHighDateTime=0x1ca035a, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb90c2000, ftLastWriteTime.dwHighDateTime=0x1ca035a, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="UnreadIconImagesMask.bmp", cAlternateFileName="UNREAD~1.BMP")) returned 0 [0061.323] FindClose (in: hFindFile=0x2d80b0 | out: hFindFile=0x2d80b0) returned 1 [0061.323] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 1 [0061.323] lstrcmpA (lpString1=".", lpString2="Computers") returned -1 [0061.323] lstrcmpA (lpString1="..", lpString2="Computers") returned -1 [0061.323] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*" [0061.323] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="Computers" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers" [0061.323] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers") returned 79 [0061.323] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540020, dwReserved1=0x20004f, cFileName=".", cAlternateFileName="")) returned 0x2d80b0 [0061.323] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0061.323] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x200000, cFileName="..", cAlternateFileName="")) returned 1 [0061.324] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0061.324] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0061.324] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="computericon.jpg", cAlternateFileName="COMPUT~1.JPG")) returned 1 [0061.324] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.324] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="computericon.jpg") returned 1 [0061.324] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="computericon.jpg") returned 1 [0061.324] lstrcmpiA (lpString1="", lpString2="computericon.jpg") returned -1 [0061.324] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\*.*") returned="*.*" [0061.324] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\" [0061.324] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\") returned="" [0061.324] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\HOW TO DECRYPT FILES.txt" [0061.324] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\how to decrypt files.txt")) returned 0xffffffff [0061.324] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.327] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0061.327] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0061.329] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0061.329] CloseHandle (hObject=0x98) returned 1 [0061.329] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\", lpString2="computericon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" [0061.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", pszSpec="*.zip") returned 0 [0061.329] lstrlenA (lpString="*.zip") returned 5 [0061.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", pszSpec="*.rar") returned 0 [0061.338] lstrlenA (lpString="*.rar") returned 5 [0061.338] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", pszSpec="*.7z") returned 0 [0061.338] lstrlenA (lpString="*.7z") returned 4 [0061.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", pszSpec="*.tar") returned 0 [0061.339] lstrlenA (lpString="*.tar") returned 5 [0061.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", pszSpec="*.gzip") returned 0 [0061.339] lstrlenA (lpString="*.gzip") returned 6 [0061.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", pszSpec="*.jpg") returned 1 [0061.339] lstrlenA (lpString="*.jpg") returned 5 [0061.339] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" [0061.339] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" [0061.339] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg." [0061.339] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.wannacry" [0061.339] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.341] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe1b [0061.341] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x80130d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60440c50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x80130d00, dwHighDateTime=0x1c747ea)) returned 1 [0061.341] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.341] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd9d, lpOverlapped=0x0) returned 1 [0061.343] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg") returned="computericon.jpg" [0061.343] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.343] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd9d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd9d, lpOverlapped=0x0) returned 1 [0061.343] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.343] CloseHandle (hObject=0x98) returned 1 [0061.343] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg.wannacry")) returned 1 [0061.345] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="computericonMask.bmp", cAlternateFileName="COMPUT~1.BMP")) returned 1 [0061.345] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.345] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="computericonMask.bmp") returned 1 [0061.345] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="computericonMask.bmp") returned 1 [0061.345] lstrcmpiA (lpString1="", lpString2="computericonMask.bmp") returned -1 [0061.345] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg") returned="computericon.jpg" [0061.345] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\" [0061.345] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\") returned="" [0061.345] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\HOW TO DECRYPT FILES.txt" [0061.345] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\how to decrypt files.txt")) returned 0x20 [0061.345] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\", lpString2="computericonMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" [0061.345] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.zip") returned 0 [0061.345] lstrlenA (lpString="*.zip") returned 5 [0061.345] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.rar") returned 0 [0061.345] lstrlenA (lpString="*.rar") returned 5 [0061.345] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.7z") returned 0 [0061.345] lstrlenA (lpString="*.7z") returned 4 [0061.345] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.tar") returned 0 [0061.345] lstrlenA (lpString="*.tar") returned 5 [0061.345] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.gzip") returned 0 [0061.346] lstrlenA (lpString="*.gzip") returned 6 [0061.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.jpg") returned 0 [0061.346] lstrlenA (lpString="*.jpg") returned 5 [0061.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.jpeg") returned 0 [0061.346] lstrlenA (lpString="*.jpeg") returned 6 [0061.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.psd") returned 0 [0061.346] lstrlenA (lpString="*.psd") returned 5 [0061.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.gif") returned 0 [0061.346] lstrlenA (lpString="*.gif") returned 5 [0061.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.doc") returned 0 [0061.346] lstrlenA (lpString="*.doc") returned 5 [0061.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.docx") returned 0 [0061.346] lstrlenA (lpString="*.docx") returned 6 [0061.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.xls") returned 0 [0061.346] lstrlenA (lpString="*.xls") returned 5 [0061.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.xlsx") returned 0 [0061.346] lstrlenA (lpString="*.xlsx") returned 6 [0061.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.ppt") returned 0 [0061.346] lstrlenA (lpString="*.ppt") returned 5 [0061.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.pptx") returned 0 [0061.346] lstrlenA (lpString="*.pptx") returned 6 [0061.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.pdf") returned 0 [0061.346] lstrlenA (lpString="*.pdf") returned 5 [0061.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.mov") returned 0 [0061.347] lstrlenA (lpString="*.mov") returned 5 [0061.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.m2v") returned 0 [0061.347] lstrlenA (lpString="*.m2v") returned 5 [0061.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.3gp") returned 0 [0061.347] lstrlenA (lpString="*.3gp") returned 5 [0061.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.mpeg") returned 0 [0061.347] lstrlenA (lpString="*.mpeg") returned 6 [0061.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.mpg") returned 0 [0061.347] lstrlenA (lpString="*.mpg") returned 5 [0061.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.flv") returned 0 [0061.347] lstrlenA (lpString="*.flv") returned 5 [0061.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.avi") returned 0 [0061.347] lstrlenA (lpString="*.avi") returned 5 [0061.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.mp4") returned 0 [0061.347] lstrlenA (lpString="*.mp4") returned 5 [0061.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.wmv") returned 0 [0061.347] lstrlenA (lpString="*.wmv") returned 5 [0061.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.divx") returned 0 [0061.347] lstrlenA (lpString="*.divx") returned 6 [0061.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.mkv") returned 0 [0061.347] lstrlenA (lpString="*.mkv") returned 5 [0061.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.mp3") returned 0 [0061.347] lstrlenA (lpString="*.mp3") returned 5 [0061.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.wav") returned 0 [0061.348] lstrlenA (lpString="*.wav") returned 5 [0061.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.flac") returned 0 [0061.348] lstrlenA (lpString="*.flac") returned 6 [0061.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.ape") returned 0 [0061.348] lstrlenA (lpString="*.ape") returned 5 [0061.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.wma") returned 0 [0061.348] lstrlenA (lpString="*.wma") returned 5 [0061.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.ac3") returned 0 [0061.348] lstrlenA (lpString="*.ac3") returned 5 [0061.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.mxf") returned 0 [0061.348] lstrlenA (lpString="*.mxf") returned 5 [0061.348] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="computericonMask.bmp", cAlternateFileName="COMPUT~1.BMP")) returned 0 [0061.348] FindClose (in: hFindFile=0x2d80b0 | out: hFindFile=0x2d80b0) returned 1 [0061.348] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Discussion", cAlternateFileName="DISCUS~1")) returned 1 [0061.348] lstrcmpA (lpString1=".", lpString2="Discussion") returned -1 [0061.348] lstrcmpA (lpString1="..", lpString2="Discussion") returned -1 [0061.348] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*" [0061.348] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="Discussion" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion" [0061.349] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion") returned 80 [0061.349] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName=".", cAlternateFileName="")) returned 0x2d80b0 [0061.350] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0061.350] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x440000, cFileName="..", cAlternateFileName="")) returned 1 [0061.350] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0061.350] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0061.350] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0009600, ftCreationTime.dwHighDateTime=0x1ca0588, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0009600, ftLastWriteTime.dwHighDateTime=0x1ca0588, nFileSizeHigh=0x0, nFileSizeLow=0x393c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DiscussionToolIconImages.jpg", cAlternateFileName="DISCUS~1.JPG")) returned 1 [0061.350] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.350] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiscussionToolIconImages.jpg") returned 1 [0061.350] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiscussionToolIconImages.jpg") returned 1 [0061.350] lstrcmpiA (lpString1="", lpString2="DiscussionToolIconImages.jpg") returned -1 [0061.350] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\*.*") returned="*.*" [0061.350] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\" [0061.350] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\") returned="" [0061.350] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\HOW TO DECRYPT FILES.txt" [0061.350] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\how to decrypt files.txt")) returned 0xffffffff [0061.351] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.354] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0061.354] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0061.355] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0061.355] CloseHandle (hObject=0x98) returned 1 [0061.355] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\", lpString2="DiscussionToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" [0061.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", pszSpec="*.zip") returned 0 [0061.355] lstrlenA (lpString="*.zip") returned 5 [0061.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", pszSpec="*.rar") returned 0 [0061.355] lstrlenA (lpString="*.rar") returned 5 [0061.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", pszSpec="*.7z") returned 0 [0061.355] lstrlenA (lpString="*.7z") returned 4 [0061.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", pszSpec="*.tar") returned 0 [0061.355] lstrlenA (lpString="*.tar") returned 5 [0061.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", pszSpec="*.gzip") returned 0 [0061.355] lstrlenA (lpString="*.gzip") returned 6 [0061.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", pszSpec="*.jpg") returned 1 [0061.355] lstrlenA (lpString="*.jpg") returned 5 [0061.355] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" [0061.355] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" [0061.356] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg." [0061.356] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg.wannacry" [0061.356] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.356] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x393c [0061.356] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb0009600, dwHighDateTime=0x1ca0588), lpLastAccessTime=0x407536*(dwLowDateTime=0x51e19d30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb0009600, dwHighDateTime=0x1ca0588)) returned 1 [0061.356] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.357] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x38be, lpOverlapped=0x0) returned 1 [0061.359] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg") returned="DiscussionToolIconImages.jpg" [0061.359] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.359] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x38be, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x38be, lpOverlapped=0x0) returned 1 [0061.359] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.359] CloseHandle (hObject=0x98) returned 1 [0061.359] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg.wannacry")) returned 1 [0061.360] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ac9e00, ftCreationTime.dwHighDateTime=0x1ca033a, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9ac9e00, ftLastWriteTime.dwHighDateTime=0x1ca033a, nFileSizeHigh=0x0, nFileSizeLow=0x1738, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="DiscussionToolIconImagesMask.bmp", cAlternateFileName="DISCUS~1.BMP")) returned 1 [0061.360] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.361] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DiscussionToolIconImagesMask.bmp") returned 1 [0061.361] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiscussionToolIconImagesMask.bmp") returned 1 [0061.361] lstrcmpiA (lpString1="", lpString2="DiscussionToolIconImagesMask.bmp") returned -1 [0061.361] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg") returned="DiscussionToolIconImages.jpg" [0061.361] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\" [0061.361] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\") returned="" [0061.361] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\HOW TO DECRYPT FILES.txt" [0061.361] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\how to decrypt files.txt")) returned 0x20 [0061.361] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\", lpString2="DiscussionToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp" [0061.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0061.361] lstrlenA (lpString="*.zip") returned 5 [0061.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0061.361] lstrlenA (lpString="*.rar") returned 5 [0061.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0061.361] lstrlenA (lpString="*.7z") returned 4 [0061.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0061.361] lstrlenA (lpString="*.tar") returned 5 [0061.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0061.361] lstrlenA (lpString="*.gzip") returned 6 [0061.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0061.361] lstrlenA (lpString="*.jpg") returned 5 [0061.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0061.361] lstrlenA (lpString="*.jpeg") returned 6 [0061.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0061.362] lstrlenA (lpString="*.psd") returned 5 [0061.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.gif") returned 0 [0061.362] lstrlenA (lpString="*.gif") returned 5 [0061.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.doc") returned 0 [0061.362] lstrlenA (lpString="*.doc") returned 5 [0061.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.docx") returned 0 [0061.362] lstrlenA (lpString="*.docx") returned 6 [0061.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.xls") returned 0 [0061.362] lstrlenA (lpString="*.xls") returned 5 [0061.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.xlsx") returned 0 [0061.362] lstrlenA (lpString="*.xlsx") returned 6 [0061.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.ppt") returned 0 [0061.362] lstrlenA (lpString="*.ppt") returned 5 [0061.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.pptx") returned 0 [0061.362] lstrlenA (lpString="*.pptx") returned 6 [0061.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.pdf") returned 0 [0061.362] lstrlenA (lpString="*.pdf") returned 5 [0061.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.mov") returned 0 [0061.362] lstrlenA (lpString="*.mov") returned 5 [0061.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.m2v") returned 0 [0061.362] lstrlenA (lpString="*.m2v") returned 5 [0061.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.3gp") returned 0 [0061.362] lstrlenA (lpString="*.3gp") returned 5 [0061.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.mpeg") returned 0 [0061.362] lstrlenA (lpString="*.mpeg") returned 6 [0061.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.mpg") returned 0 [0061.362] lstrlenA (lpString="*.mpg") returned 5 [0061.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.flv") returned 0 [0061.363] lstrlenA (lpString="*.flv") returned 5 [0061.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.avi") returned 0 [0061.363] lstrlenA (lpString="*.avi") returned 5 [0061.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.mp4") returned 0 [0061.363] lstrlenA (lpString="*.mp4") returned 5 [0061.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.wmv") returned 0 [0061.363] lstrlenA (lpString="*.wmv") returned 5 [0061.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.divx") returned 0 [0061.363] lstrlenA (lpString="*.divx") returned 6 [0061.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.mkv") returned 0 [0061.363] lstrlenA (lpString="*.mkv") returned 5 [0061.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.mp3") returned 0 [0061.363] lstrlenA (lpString="*.mp3") returned 5 [0061.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.wav") returned 0 [0061.363] lstrlenA (lpString="*.wav") returned 5 [0061.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.flac") returned 0 [0061.363] lstrlenA (lpString="*.flac") returned 6 [0061.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.ape") returned 0 [0061.363] lstrlenA (lpString="*.ape") returned 5 [0061.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.wma") returned 0 [0061.363] lstrlenA (lpString="*.wma") returned 5 [0061.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.ac3") returned 0 [0061.363] lstrlenA (lpString="*.ac3") returned 5 [0061.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.mxf") returned 0 [0061.363] lstrlenA (lpString="*.mxf") returned 5 [0061.363] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ac9e00, ftCreationTime.dwHighDateTime=0x1ca033a, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9ac9e00, ftLastWriteTime.dwHighDateTime=0x1ca033a, nFileSizeHigh=0x0, nFileSizeLow=0x1738, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="DiscussionToolIconImagesMask.bmp", cAlternateFileName="DISCUS~1.BMP")) returned 0 [0061.364] FindClose (in: hFindFile=0x2d80b0 | out: hFindFile=0x2d80b0) returned 1 [0061.364] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="DocumentShare", cAlternateFileName="DOCUME~1")) returned 1 [0061.364] lstrcmpA (lpString1=".", lpString2="DocumentShare") returned -1 [0061.364] lstrcmpA (lpString1="..", lpString2="DocumentShare") returned -1 [0061.364] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*" [0061.364] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="DocumentShare" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare" [0061.364] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare") returned 83 [0061.364] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540020, dwReserved1=0x20004f, cFileName=".", cAlternateFileName="")) returned 0x2d80b0 [0061.365] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0061.365] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x200000, cFileName="..", cAlternateFileName="")) returned 1 [0061.365] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0061.365] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0061.365] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xab11, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="WSSFilesToolHomePageBackground.jpg", cAlternateFileName="WSSFIL~1.JPG")) returned 1 [0061.365] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.365] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WSSFilesToolHomePageBackground.jpg") returned -1 [0061.365] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WSSFilesToolHomePageBackground.jpg") returned -1 [0061.365] lstrcmpiA (lpString1="", lpString2="WSSFilesToolHomePageBackground.jpg") returned -1 [0061.365] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\*.*") returned="*.*" [0061.365] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\" [0061.365] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\") returned="" [0061.365] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\HOW TO DECRYPT FILES.txt" [0061.365] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\how to decrypt files.txt")) returned 0xffffffff [0061.366] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.366] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0061.367] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0061.368] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0061.368] CloseHandle (hObject=0x98) returned 1 [0061.368] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\", lpString2="WSSFilesToolHomePageBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" [0061.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", pszSpec="*.zip") returned 0 [0061.368] lstrlenA (lpString="*.zip") returned 5 [0061.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", pszSpec="*.rar") returned 0 [0061.368] lstrlenA (lpString="*.rar") returned 5 [0061.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", pszSpec="*.7z") returned 0 [0061.368] lstrlenA (lpString="*.7z") returned 4 [0061.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", pszSpec="*.tar") returned 0 [0061.368] lstrlenA (lpString="*.tar") returned 5 [0061.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", pszSpec="*.gzip") returned 0 [0061.368] lstrlenA (lpString="*.gzip") returned 6 [0061.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", pszSpec="*.jpg") returned 1 [0061.368] lstrlenA (lpString="*.jpg") returned 5 [0061.368] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" [0061.368] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" [0061.368] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg." [0061.368] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg.wannacry" [0061.369] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.369] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xab11 [0061.369] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x81443a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x709f1ef0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x81443a00, dwHighDateTime=0x1c747ea)) returned 1 [0061.369] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.369] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xaa93, lpOverlapped=0x0) returned 1 [0061.371] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg") returned="WSSFilesToolHomePageBackground.jpg" [0061.371] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.371] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xaa93, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xaa93, lpOverlapped=0x0) returned 1 [0061.372] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.372] CloseHandle (hObject=0x98) returned 1 [0061.372] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg.wannacry")) returned 1 [0061.373] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xab11, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="WSSFilesToolHomePageBackground.jpg", cAlternateFileName="WSSFIL~1.JPG")) returned 0 [0061.373] FindClose (in: hFindFile=0x2d80b0 | out: hFindFile=0x2d80b0) returned 1 [0061.373] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="GrooveDocumentReview", cAlternateFileName="GROOVE~1")) returned 1 [0061.373] lstrcmpA (lpString1=".", lpString2="GrooveDocumentReview") returned -1 [0061.373] lstrcmpA (lpString1="..", lpString2="GrooveDocumentReview") returned -1 [0061.373] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*" [0061.373] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="GrooveDocumentReview" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview" [0061.373] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview") returned 90 [0061.373] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName=".", cAlternateFileName="")) returned 0x2d80b0 [0061.376] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0061.376] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0061.376] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0061.376] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0061.376] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2519, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ActiveTabImage.jpg", cAlternateFileName="ACTIVE~1.JPG")) returned 1 [0061.376] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.376] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ActiveTabImage.jpg") returned 1 [0061.376] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ActiveTabImage.jpg") returned 1 [0061.376] lstrcmpiA (lpString1="", lpString2="ActiveTabImage.jpg") returned -1 [0061.376] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\*.*") returned="*.*" [0061.376] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" [0061.376] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="" [0061.376] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt" [0061.376] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\how to decrypt files.txt")) returned 0xffffffff [0061.377] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.377] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0061.377] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0061.379] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0061.379] CloseHandle (hObject=0x98) returned 1 [0061.379] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="ActiveTabImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" [0061.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", pszSpec="*.zip") returned 0 [0061.379] lstrlenA (lpString="*.zip") returned 5 [0061.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", pszSpec="*.rar") returned 0 [0061.379] lstrlenA (lpString="*.rar") returned 5 [0061.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", pszSpec="*.7z") returned 0 [0061.379] lstrlenA (lpString="*.7z") returned 4 [0061.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", pszSpec="*.tar") returned 0 [0061.379] lstrlenA (lpString="*.tar") returned 5 [0061.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", pszSpec="*.gzip") returned 0 [0061.379] lstrlenA (lpString="*.gzip") returned 6 [0061.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", pszSpec="*.jpg") returned 1 [0061.379] lstrlenA (lpString="*.jpg") returned 5 [0061.379] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" [0061.379] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" [0061.379] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg." [0061.379] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg.wannacry" [0061.379] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.380] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2519 [0061.380] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x81443a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51174850, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x81443a00, dwHighDateTime=0x1c747ea)) returned 1 [0061.380] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.380] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x249b, lpOverlapped=0x0) returned 1 [0061.382] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg") returned="ActiveTabImage.jpg" [0061.382] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.382] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x249b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x249b, lpOverlapped=0x0) returned 1 [0061.383] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.383] CloseHandle (hObject=0x98) returned 1 [0061.383] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg.wannacry")) returned 1 [0061.384] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e9eb8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xca8, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="ActiveTabImageMask.bmp", cAlternateFileName="ACTIVE~1.BMP")) returned 1 [0061.384] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.384] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ActiveTabImageMask.bmp") returned 1 [0061.384] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ActiveTabImageMask.bmp") returned 1 [0061.384] lstrcmpiA (lpString1="", lpString2="ActiveTabImageMask.bmp") returned -1 [0061.384] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg") returned="ActiveTabImage.jpg" [0061.384] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" [0061.384] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="" [0061.384] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt" [0061.384] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\how to decrypt files.txt")) returned 0x20 [0061.384] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="ActiveTabImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" [0061.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.zip") returned 0 [0061.384] lstrlenA (lpString="*.zip") returned 5 [0061.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.rar") returned 0 [0061.384] lstrlenA (lpString="*.rar") returned 5 [0061.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.7z") returned 0 [0061.384] lstrlenA (lpString="*.7z") returned 4 [0061.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.tar") returned 0 [0061.384] lstrlenA (lpString="*.tar") returned 5 [0061.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.gzip") returned 0 [0061.385] lstrlenA (lpString="*.gzip") returned 6 [0061.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.jpg") returned 0 [0061.385] lstrlenA (lpString="*.jpg") returned 5 [0061.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.jpeg") returned 0 [0061.385] lstrlenA (lpString="*.jpeg") returned 6 [0061.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.psd") returned 0 [0061.385] lstrlenA (lpString="*.psd") returned 5 [0061.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.gif") returned 0 [0061.385] lstrlenA (lpString="*.gif") returned 5 [0061.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.doc") returned 0 [0061.385] lstrlenA (lpString="*.doc") returned 5 [0061.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.docx") returned 0 [0061.385] lstrlenA (lpString="*.docx") returned 6 [0061.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.xls") returned 0 [0061.385] lstrlenA (lpString="*.xls") returned 5 [0061.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.xlsx") returned 0 [0061.385] lstrlenA (lpString="*.xlsx") returned 6 [0061.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.ppt") returned 0 [0061.385] lstrlenA (lpString="*.ppt") returned 5 [0061.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.pptx") returned 0 [0061.385] lstrlenA (lpString="*.pptx") returned 6 [0061.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.pdf") returned 0 [0061.385] lstrlenA (lpString="*.pdf") returned 5 [0061.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.mov") returned 0 [0061.385] lstrlenA (lpString="*.mov") returned 5 [0061.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.m2v") returned 0 [0061.386] lstrlenA (lpString="*.m2v") returned 5 [0061.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.3gp") returned 0 [0061.386] lstrlenA (lpString="*.3gp") returned 5 [0061.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.mpeg") returned 0 [0061.386] lstrlenA (lpString="*.mpeg") returned 6 [0061.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.mpg") returned 0 [0061.386] lstrlenA (lpString="*.mpg") returned 5 [0061.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.flv") returned 0 [0061.386] lstrlenA (lpString="*.flv") returned 5 [0061.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.avi") returned 0 [0061.386] lstrlenA (lpString="*.avi") returned 5 [0061.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.mp4") returned 0 [0061.386] lstrlenA (lpString="*.mp4") returned 5 [0061.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.wmv") returned 0 [0061.386] lstrlenA (lpString="*.wmv") returned 5 [0061.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.divx") returned 0 [0061.386] lstrlenA (lpString="*.divx") returned 6 [0061.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.mkv") returned 0 [0061.386] lstrlenA (lpString="*.mkv") returned 5 [0061.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.mp3") returned 0 [0061.386] lstrlenA (lpString="*.mp3") returned 5 [0061.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.wav") returned 0 [0061.386] lstrlenA (lpString="*.wav") returned 5 [0061.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.flac") returned 0 [0061.386] lstrlenA (lpString="*.flac") returned 6 [0061.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.ape") returned 0 [0061.387] lstrlenA (lpString="*.ape") returned 5 [0061.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.wma") returned 0 [0061.387] lstrlenA (lpString="*.wma") returned 5 [0061.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.ac3") returned 0 [0061.387] lstrlenA (lpString="*.ac3") returned 5 [0061.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.mxf") returned 0 [0061.387] lstrlenA (lpString="*.mxf") returned 5 [0061.387] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9bd, dwReserved0=0x650052, dwReserved1=0x690076, cFileName="BodyPaneBackground.jpg", cAlternateFileName="BODYPA~1.JPG")) returned 1 [0061.387] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.387] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BodyPaneBackground.jpg") returned 1 [0061.387] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BodyPaneBackground.jpg") returned 1 [0061.387] lstrcmpiA (lpString1="", lpString2="BodyPaneBackground.jpg") returned -1 [0061.387] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp") returned="ActiveTabImageMask.bmp" [0061.387] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" [0061.387] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="" [0061.387] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt" [0061.387] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\how to decrypt files.txt")) returned 0x20 [0061.387] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="BodyPaneBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" [0061.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", pszSpec="*.zip") returned 0 [0061.387] lstrlenA (lpString="*.zip") returned 5 [0061.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", pszSpec="*.rar") returned 0 [0061.387] lstrlenA (lpString="*.rar") returned 5 [0061.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", pszSpec="*.7z") returned 0 [0061.388] lstrlenA (lpString="*.7z") returned 4 [0061.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", pszSpec="*.tar") returned 0 [0061.388] lstrlenA (lpString="*.tar") returned 5 [0061.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", pszSpec="*.gzip") returned 0 [0061.388] lstrlenA (lpString="*.gzip") returned 6 [0061.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", pszSpec="*.jpg") returned 1 [0061.388] lstrlenA (lpString="*.jpg") returned 5 [0061.388] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" [0061.388] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" [0061.388] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg." [0061.388] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg.wannacry" [0061.388] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.388] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9bd [0061.389] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51a15810, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea)) returned 1 [0061.389] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.389] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x93f, lpOverlapped=0x0) returned 1 [0061.390] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg") returned="BodyPaneBackground.jpg" [0061.390] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.390] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x93f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x93f, lpOverlapped=0x0) returned 1 [0061.391] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.391] CloseHandle (hObject=0x98) returned 1 [0061.391] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg.wannacry")) returned 1 [0061.392] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x24ed, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="InactiveTabImage.jpg", cAlternateFileName="INACTI~1.JPG")) returned 1 [0061.392] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.392] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InactiveTabImage.jpg") returned -1 [0061.392] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InactiveTabImage.jpg") returned -1 [0061.392] lstrcmpiA (lpString1="", lpString2="InactiveTabImage.jpg") returned -1 [0061.392] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg") returned="BodyPaneBackground.jpg" [0061.392] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" [0061.392] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="" [0061.392] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt" [0061.392] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\how to decrypt files.txt")) returned 0x20 [0061.392] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="InactiveTabImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" [0061.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", pszSpec="*.zip") returned 0 [0061.392] lstrlenA (lpString="*.zip") returned 5 [0061.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", pszSpec="*.rar") returned 0 [0061.392] lstrlenA (lpString="*.rar") returned 5 [0061.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", pszSpec="*.7z") returned 0 [0061.392] lstrlenA (lpString="*.7z") returned 4 [0061.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", pszSpec="*.tar") returned 0 [0061.392] lstrlenA (lpString="*.tar") returned 5 [0061.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", pszSpec="*.gzip") returned 0 [0061.392] lstrlenA (lpString="*.gzip") returned 6 [0061.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", pszSpec="*.jpg") returned 1 [0061.392] lstrlenA (lpString="*.jpg") returned 5 [0061.393] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" [0061.393] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" [0061.393] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg." [0061.393] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg.wannacry" [0061.393] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.395] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24ed [0061.395] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5392d770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea)) returned 1 [0061.395] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.395] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x246f, lpOverlapped=0x0) returned 1 [0061.396] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg") returned="InactiveTabImage.jpg" [0061.397] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.397] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x246f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x246f, lpOverlapped=0x0) returned 1 [0061.397] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.397] CloseHandle (hObject=0x98) returned 1 [0061.397] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg.wannacry")) returned 1 [0061.398] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xca8, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="InactiveTabImageMask.bmp", cAlternateFileName="INACTI~1.BMP")) returned 1 [0061.398] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.398] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InactiveTabImageMask.bmp") returned -1 [0061.398] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InactiveTabImageMask.bmp") returned -1 [0061.398] lstrcmpiA (lpString1="", lpString2="InactiveTabImageMask.bmp") returned -1 [0061.398] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg") returned="InactiveTabImage.jpg" [0061.398] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" [0061.398] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="" [0061.398] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt" [0061.398] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\how to decrypt files.txt")) returned 0x20 [0061.398] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="InactiveTabImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" [0061.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.zip") returned 0 [0061.398] lstrlenA (lpString="*.zip") returned 5 [0061.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.rar") returned 0 [0061.398] lstrlenA (lpString="*.rar") returned 5 [0061.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.7z") returned 0 [0061.398] lstrlenA (lpString="*.7z") returned 4 [0061.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.tar") returned 0 [0061.398] lstrlenA (lpString="*.tar") returned 5 [0061.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.gzip") returned 0 [0061.399] lstrlenA (lpString="*.gzip") returned 6 [0061.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.jpg") returned 0 [0061.399] lstrlenA (lpString="*.jpg") returned 5 [0061.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.jpeg") returned 0 [0061.399] lstrlenA (lpString="*.jpeg") returned 6 [0061.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.psd") returned 0 [0061.399] lstrlenA (lpString="*.psd") returned 5 [0061.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.gif") returned 0 [0061.399] lstrlenA (lpString="*.gif") returned 5 [0061.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.doc") returned 0 [0061.399] lstrlenA (lpString="*.doc") returned 5 [0061.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.docx") returned 0 [0061.399] lstrlenA (lpString="*.docx") returned 6 [0061.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.xls") returned 0 [0061.399] lstrlenA (lpString="*.xls") returned 5 [0061.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.xlsx") returned 0 [0061.399] lstrlenA (lpString="*.xlsx") returned 6 [0061.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.ppt") returned 0 [0061.399] lstrlenA (lpString="*.ppt") returned 5 [0061.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.pptx") returned 0 [0061.399] lstrlenA (lpString="*.pptx") returned 6 [0061.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.pdf") returned 0 [0061.399] lstrlenA (lpString="*.pdf") returned 5 [0061.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.mov") returned 0 [0061.399] lstrlenA (lpString="*.mov") returned 5 [0061.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.m2v") returned 0 [0061.399] lstrlenA (lpString="*.m2v") returned 5 [0061.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.3gp") returned 0 [0061.399] lstrlenA (lpString="*.3gp") returned 5 [0061.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.mpeg") returned 0 [0061.400] lstrlenA (lpString="*.mpeg") returned 6 [0061.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.mpg") returned 0 [0061.400] lstrlenA (lpString="*.mpg") returned 5 [0061.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.flv") returned 0 [0061.400] lstrlenA (lpString="*.flv") returned 5 [0061.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.avi") returned 0 [0061.400] lstrlenA (lpString="*.avi") returned 5 [0061.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.mp4") returned 0 [0061.400] lstrlenA (lpString="*.mp4") returned 5 [0061.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.wmv") returned 0 [0061.400] lstrlenA (lpString="*.wmv") returned 5 [0061.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.divx") returned 0 [0061.400] lstrlenA (lpString="*.divx") returned 6 [0061.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.mkv") returned 0 [0061.400] lstrlenA (lpString="*.mkv") returned 5 [0061.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.mp3") returned 0 [0061.400] lstrlenA (lpString="*.mp3") returned 5 [0061.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.wav") returned 0 [0061.400] lstrlenA (lpString="*.wav") returned 5 [0061.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.flac") returned 0 [0061.400] lstrlenA (lpString="*.flac") returned 6 [0061.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.ape") returned 0 [0061.400] lstrlenA (lpString="*.ape") returned 5 [0061.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.wma") returned 0 [0061.400] lstrlenA (lpString="*.wma") returned 5 [0061.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.ac3") returned 0 [0061.400] lstrlenA (lpString="*.ac3") returned 5 [0061.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.mxf") returned 0 [0061.401] lstrlenA (lpString="*.mxf") returned 5 [0061.401] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x98b, dwReserved0=0x650052, dwReserved1=0x690076, cFileName="MarkupIconImages.jpg", cAlternateFileName="MARKUP~1.JPG")) returned 1 [0061.401] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.401] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MarkupIconImages.jpg") returned -1 [0061.401] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MarkupIconImages.jpg") returned -1 [0061.401] lstrcmpiA (lpString1="", lpString2="MarkupIconImages.jpg") returned -1 [0061.401] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp") returned="InactiveTabImageMask.bmp" [0061.401] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" [0061.401] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="" [0061.401] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt" [0061.401] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\how to decrypt files.txt")) returned 0x20 [0061.401] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="MarkupIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" [0061.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", pszSpec="*.zip") returned 0 [0061.401] lstrlenA (lpString="*.zip") returned 5 [0061.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", pszSpec="*.rar") returned 0 [0061.401] lstrlenA (lpString="*.rar") returned 5 [0061.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", pszSpec="*.7z") returned 0 [0061.401] lstrlenA (lpString="*.7z") returned 4 [0061.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", pszSpec="*.tar") returned 0 [0061.401] lstrlenA (lpString="*.tar") returned 5 [0061.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", pszSpec="*.gzip") returned 0 [0061.401] lstrlenA (lpString="*.gzip") returned 6 [0061.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", pszSpec="*.jpg") returned 1 [0061.401] lstrlenA (lpString="*.jpg") returned 5 [0061.401] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" [0061.401] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" [0061.402] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg." [0061.402] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg.wannacry" [0061.402] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.403] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x98b [0061.403] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x696f1810, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea)) returned 1 [0061.403] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.403] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x90d, lpOverlapped=0x0) returned 1 [0061.405] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg") returned="MarkupIconImages.jpg" [0061.405] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.405] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x90d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x90d, lpOverlapped=0x0) returned 1 [0061.405] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.405] CloseHandle (hObject=0x98) returned 1 [0061.405] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg.wannacry")) returned 1 [0061.406] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x74, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="MarkupIconImagesMask.bmp", cAlternateFileName="MARKUP~1.BMP")) returned 1 [0061.406] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.406] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MarkupIconImagesMask.bmp") returned -1 [0061.406] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MarkupIconImagesMask.bmp") returned -1 [0061.406] lstrcmpiA (lpString1="", lpString2="MarkupIconImagesMask.bmp") returned -1 [0061.406] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg") returned="MarkupIconImages.jpg" [0061.406] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" [0061.406] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned="" [0061.406] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt" [0061.406] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\how to decrypt files.txt")) returned 0x20 [0061.406] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="MarkupIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" [0061.406] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0061.406] lstrlenA (lpString="*.zip") returned 5 [0061.406] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0061.406] lstrlenA (lpString="*.rar") returned 5 [0061.406] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0061.407] lstrlenA (lpString="*.7z") returned 4 [0061.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0061.407] lstrlenA (lpString="*.tar") returned 5 [0061.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0061.407] lstrlenA (lpString="*.gzip") returned 6 [0061.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0061.407] lstrlenA (lpString="*.jpg") returned 5 [0061.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0061.407] lstrlenA (lpString="*.jpeg") returned 6 [0061.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0061.407] lstrlenA (lpString="*.psd") returned 5 [0061.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.gif") returned 0 [0061.407] lstrlenA (lpString="*.gif") returned 5 [0061.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.doc") returned 0 [0061.407] lstrlenA (lpString="*.doc") returned 5 [0061.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.docx") returned 0 [0061.407] lstrlenA (lpString="*.docx") returned 6 [0061.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.xls") returned 0 [0061.407] lstrlenA (lpString="*.xls") returned 5 [0061.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.xlsx") returned 0 [0061.407] lstrlenA (lpString="*.xlsx") returned 6 [0061.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.ppt") returned 0 [0061.407] lstrlenA (lpString="*.ppt") returned 5 [0061.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.pptx") returned 0 [0061.407] lstrlenA (lpString="*.pptx") returned 6 [0061.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.pdf") returned 0 [0061.407] lstrlenA (lpString="*.pdf") returned 5 [0061.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.mov") returned 0 [0061.408] lstrlenA (lpString="*.mov") returned 5 [0061.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.m2v") returned 0 [0061.408] lstrlenA (lpString="*.m2v") returned 5 [0061.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.3gp") returned 0 [0061.408] lstrlenA (lpString="*.3gp") returned 5 [0061.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.mpeg") returned 0 [0061.408] lstrlenA (lpString="*.mpeg") returned 6 [0061.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.mpg") returned 0 [0061.408] lstrlenA (lpString="*.mpg") returned 5 [0061.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.flv") returned 0 [0061.408] lstrlenA (lpString="*.flv") returned 5 [0061.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.avi") returned 0 [0061.408] lstrlenA (lpString="*.avi") returned 5 [0061.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.mp4") returned 0 [0061.408] lstrlenA (lpString="*.mp4") returned 5 [0061.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.wmv") returned 0 [0061.408] lstrlenA (lpString="*.wmv") returned 5 [0061.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.divx") returned 0 [0061.408] lstrlenA (lpString="*.divx") returned 6 [0061.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.mkv") returned 0 [0061.408] lstrlenA (lpString="*.mkv") returned 5 [0061.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.mp3") returned 0 [0061.408] lstrlenA (lpString="*.mp3") returned 5 [0061.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.wav") returned 0 [0061.408] lstrlenA (lpString="*.wav") returned 5 [0061.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.flac") returned 0 [0061.409] lstrlenA (lpString="*.flac") returned 6 [0061.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.ape") returned 0 [0061.409] lstrlenA (lpString="*.ape") returned 5 [0061.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.wma") returned 0 [0061.409] lstrlenA (lpString="*.wma") returned 5 [0061.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.ac3") returned 0 [0061.409] lstrlenA (lpString="*.ac3") returned 5 [0061.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.mxf") returned 0 [0061.409] lstrlenA (lpString="*.mxf") returned 5 [0061.409] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x74, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="MarkupIconImagesMask.bmp", cAlternateFileName="MARKUP~1.BMP")) returned 0 [0061.409] FindClose (in: hFindFile=0x2d80b0 | out: hFindFile=0x2d80b0) returned 1 [0061.409] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="GrooveForms", cAlternateFileName="GROOVE~3")) returned 1 [0061.409] lstrcmpA (lpString1=".", lpString2="GrooveForms") returned -1 [0061.409] lstrcmpA (lpString1="..", lpString2="GrooveForms") returned -1 [0061.409] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*" [0061.409] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="GrooveForms" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms" [0061.409] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms") returned 81 [0061.409] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650052, dwReserved1=0x690076, cFileName=".", cAlternateFileName="")) returned 0x2d80b0 [0061.412] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0061.412] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x690000, cFileName="..", cAlternateFileName="")) returned 1 [0061.414] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0061.414] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0061.414] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AddToViewArrow.jpg", cAlternateFileName="ADDTOV~1.JPG")) returned 1 [0061.414] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.414] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AddToViewArrow.jpg") returned 1 [0061.414] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddToViewArrow.jpg") returned 1 [0061.414] lstrcmpiA (lpString1="", lpString2="AddToViewArrow.jpg") returned -1 [0061.414] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*.*") returned="*.*" [0061.414] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0061.414] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0061.414] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0061.414] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0xffffffff [0061.415] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.416] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0061.416] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0061.417] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0061.417] CloseHandle (hObject=0x98) returned 1 [0061.417] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="AddToViewArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" [0061.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", pszSpec="*.zip") returned 0 [0061.417] lstrlenA (lpString="*.zip") returned 5 [0061.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", pszSpec="*.rar") returned 0 [0061.418] lstrlenA (lpString="*.rar") returned 5 [0061.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", pszSpec="*.7z") returned 0 [0061.418] lstrlenA (lpString="*.7z") returned 4 [0061.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", pszSpec="*.tar") returned 0 [0061.418] lstrlenA (lpString="*.tar") returned 5 [0061.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", pszSpec="*.gzip") returned 0 [0061.418] lstrlenA (lpString="*.gzip") returned 6 [0061.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", pszSpec="*.jpg") returned 1 [0061.418] lstrlenA (lpString="*.jpg") returned 5 [0061.418] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" [0061.418] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" [0061.418] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg." [0061.418] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg.wannacry" [0061.418] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.420] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbe8 [0061.420] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5127f1f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea)) returned 1 [0061.420] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.420] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xb6a, lpOverlapped=0x0) returned 1 [0061.424] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg") returned="AddToViewArrow.jpg" [0061.424] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.424] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xb6a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xb6a, lpOverlapped=0x0) returned 1 [0061.424] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.424] CloseHandle (hObject=0x98) returned 1 [0061.424] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg.wannacry")) returned 1 [0061.425] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="AddToViewArrowMask.bmp", cAlternateFileName="ADDTOV~1.BMP")) returned 1 [0061.425] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.425] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AddToViewArrowMask.bmp") returned 1 [0061.426] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddToViewArrowMask.bmp") returned 1 [0061.426] lstrcmpiA (lpString1="", lpString2="AddToViewArrowMask.bmp") returned -1 [0061.426] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg") returned="AddToViewArrow.jpg" [0061.426] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0061.426] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0061.426] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0061.426] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0061.426] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="AddToViewArrowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp" [0061.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.zip") returned 0 [0061.426] lstrlenA (lpString="*.zip") returned 5 [0061.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.rar") returned 0 [0061.426] lstrlenA (lpString="*.rar") returned 5 [0061.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.7z") returned 0 [0061.426] lstrlenA (lpString="*.7z") returned 4 [0061.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.tar") returned 0 [0061.426] lstrlenA (lpString="*.tar") returned 5 [0061.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.gzip") returned 0 [0061.426] lstrlenA (lpString="*.gzip") returned 6 [0061.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.jpg") returned 0 [0061.426] lstrlenA (lpString="*.jpg") returned 5 [0061.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.jpeg") returned 0 [0061.426] lstrlenA (lpString="*.jpeg") returned 6 [0061.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.psd") returned 0 [0061.427] lstrlenA (lpString="*.psd") returned 5 [0061.427] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.gif") returned 0 [0061.427] lstrlenA (lpString="*.gif") returned 5 [0061.427] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.doc") returned 0 [0061.427] lstrlenA (lpString="*.doc") returned 5 [0061.427] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.docx") returned 0 [0061.427] lstrlenA (lpString="*.docx") returned 6 [0061.427] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.xls") returned 0 [0061.427] lstrlenA (lpString="*.xls") returned 5 [0061.427] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.xlsx") returned 0 [0061.427] lstrlenA (lpString="*.xlsx") returned 6 [0061.427] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.ppt") returned 0 [0061.427] lstrlenA (lpString="*.ppt") returned 5 [0061.427] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.pptx") returned 0 [0061.427] lstrlenA (lpString="*.pptx") returned 6 [0061.427] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.pdf") returned 0 [0061.427] lstrlenA (lpString="*.pdf") returned 5 [0061.427] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.mov") returned 0 [0061.427] lstrlenA (lpString="*.mov") returned 5 [0061.427] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.m2v") returned 0 [0061.427] lstrlenA (lpString="*.m2v") returned 5 [0061.427] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.3gp") returned 0 [0061.428] lstrlenA (lpString="*.3gp") returned 5 [0061.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.mpeg") returned 0 [0061.428] lstrlenA (lpString="*.mpeg") returned 6 [0061.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.mpg") returned 0 [0061.428] lstrlenA (lpString="*.mpg") returned 5 [0061.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.flv") returned 0 [0061.428] lstrlenA (lpString="*.flv") returned 5 [0061.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.avi") returned 0 [0061.428] lstrlenA (lpString="*.avi") returned 5 [0061.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.mp4") returned 0 [0061.428] lstrlenA (lpString="*.mp4") returned 5 [0061.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.wmv") returned 0 [0061.428] lstrlenA (lpString="*.wmv") returned 5 [0061.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.divx") returned 0 [0061.428] lstrlenA (lpString="*.divx") returned 6 [0061.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.mkv") returned 0 [0061.428] lstrlenA (lpString="*.mkv") returned 5 [0061.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.mp3") returned 0 [0061.428] lstrlenA (lpString="*.mp3") returned 5 [0061.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.wav") returned 0 [0061.428] lstrlenA (lpString="*.wav") returned 5 [0061.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.flac") returned 0 [0061.428] lstrlenA (lpString="*.flac") returned 6 [0061.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.ape") returned 0 [0061.428] lstrlenA (lpString="*.ape") returned 5 [0061.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.wma") returned 0 [0061.429] lstrlenA (lpString="*.wma") returned 5 [0061.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.ac3") returned 0 [0061.429] lstrlenA (lpString="*.ac3") returned 5 [0061.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.mxf") returned 0 [0061.429] lstrlenA (lpString="*.mxf") returned 5 [0061.429] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xae8, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="attention.gif", cAlternateFileName="ATTENT~1.GIF")) returned 1 [0061.429] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.429] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="attention.gif") returned 1 [0061.429] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="attention.gif") returned 1 [0061.429] lstrcmpiA (lpString1="", lpString2="attention.gif") returned -1 [0061.429] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp") returned="AddToViewArrowMask.bmp" [0061.429] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0061.429] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0061.429] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0061.429] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0061.429] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" [0061.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.zip") returned 0 [0061.429] lstrlenA (lpString="*.zip") returned 5 [0061.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.rar") returned 0 [0061.429] lstrlenA (lpString="*.rar") returned 5 [0061.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.7z") returned 0 [0061.429] lstrlenA (lpString="*.7z") returned 4 [0061.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.tar") returned 0 [0061.429] lstrlenA (lpString="*.tar") returned 5 [0061.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.gzip") returned 0 [0061.430] lstrlenA (lpString="*.gzip") returned 6 [0061.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.jpg") returned 0 [0061.430] lstrlenA (lpString="*.jpg") returned 5 [0061.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.jpeg") returned 0 [0061.430] lstrlenA (lpString="*.jpeg") returned 6 [0061.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.psd") returned 0 [0061.430] lstrlenA (lpString="*.psd") returned 5 [0061.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.gif") returned 1 [0061.430] lstrlenA (lpString="*.gif") returned 5 [0061.430] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" [0061.430] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" [0061.430] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif." [0061.430] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif.wannacry" [0061.430] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.432] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae8 [0061.432] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f409670, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1 [0061.432] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.432] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xa6a, lpOverlapped=0x0) returned 1 [0061.433] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif") returned="attention.gif" [0061.433] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.434] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xa6a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xa6a, lpOverlapped=0x0) returned 1 [0061.434] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.434] CloseHandle (hObject=0x98) returned 1 [0061.434] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif.wannacry")) returned 1 [0061.435] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x614e, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="BG_ADOBE.GIF", cAlternateFileName="")) returned 1 [0061.435] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.435] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BG_ADOBE.GIF") returned 1 [0061.435] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BG_ADOBE.GIF") returned 1 [0061.435] lstrcmpiA (lpString1="", lpString2="BG_ADOBE.GIF") returned -1 [0061.435] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif") returned="attention.gif" [0061.435] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0061.435] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0061.435] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0061.435] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0061.435] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="BG_ADOBE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF" [0061.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.zip") returned 0 [0061.435] lstrlenA (lpString="*.zip") returned 5 [0061.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.rar") returned 0 [0061.436] lstrlenA (lpString="*.rar") returned 5 [0061.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.7z") returned 0 [0061.436] lstrlenA (lpString="*.7z") returned 4 [0061.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.tar") returned 0 [0061.436] lstrlenA (lpString="*.tar") returned 5 [0061.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.gzip") returned 0 [0061.436] lstrlenA (lpString="*.gzip") returned 6 [0061.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.jpg") returned 0 [0061.436] lstrlenA (lpString="*.jpg") returned 5 [0061.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.jpeg") returned 0 [0061.436] lstrlenA (lpString="*.jpeg") returned 6 [0061.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.psd") returned 0 [0061.436] lstrlenA (lpString="*.psd") returned 5 [0061.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.gif") returned 1 [0061.436] lstrlenA (lpString="*.gif") returned 5 [0061.436] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF" [0061.436] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF" [0061.436] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF." [0061.436] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF.wannacry" [0061.436] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_adobe.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.438] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x614e [0061.438] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f61e9b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1 [0061.438] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.438] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60d0, lpOverlapped=0x0) returned 1 [0061.441] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF") returned="BG_ADOBE.GIF" [0061.441] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.441] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60d0, lpOverlapped=0x0) returned 1 [0061.441] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.441] CloseHandle (hObject=0x98) returned 1 [0061.441] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_adobe.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_adobe.gif.wannacry")) returned 1 [0061.442] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x161d, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="bg_Casual.gif", cAlternateFileName="BG_CAS~1.GIF")) returned 1 [0061.442] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.442] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_Casual.gif") returned 1 [0061.442] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Casual.gif") returned 1 [0061.442] lstrcmpiA (lpString1="", lpString2="bg_Casual.gif") returned -1 [0061.442] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF") returned="BG_ADOBE.GIF" [0061.443] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0061.443] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0061.443] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0061.443] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0061.443] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" [0061.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.zip") returned 0 [0061.443] lstrlenA (lpString="*.zip") returned 5 [0061.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.rar") returned 0 [0061.443] lstrlenA (lpString="*.rar") returned 5 [0061.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.7z") returned 0 [0061.443] lstrlenA (lpString="*.7z") returned 4 [0061.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.tar") returned 0 [0061.443] lstrlenA (lpString="*.tar") returned 5 [0061.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.gzip") returned 0 [0061.443] lstrlenA (lpString="*.gzip") returned 6 [0061.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.jpg") returned 0 [0061.443] lstrlenA (lpString="*.jpg") returned 5 [0061.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.jpeg") returned 0 [0061.443] lstrlenA (lpString="*.jpeg") returned 6 [0061.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.psd") returned 0 [0061.443] lstrlenA (lpString="*.psd") returned 5 [0061.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.gif") returned 1 [0061.443] lstrlenA (lpString="*.gif") returned 5 [0061.443] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" [0061.444] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" [0061.444] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif." [0061.444] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif.wannacry" [0061.444] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.445] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x161d [0061.445] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f61e9b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1 [0061.445] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.445] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x159f, lpOverlapped=0x0) returned 1 [0061.447] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif") returned="bg_Casual.gif" [0061.447] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.447] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x159f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x159f, lpOverlapped=0x0) returned 1 [0061.447] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.448] CloseHandle (hObject=0x98) returned 1 [0061.448] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif.wannacry")) returned 1 [0061.449] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7dd3, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="bg_Country.gif", cAlternateFileName="BG_COU~1.GIF")) returned 1 [0061.449] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.449] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_Country.gif") returned 1 [0061.449] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Country.gif") returned 1 [0061.449] lstrcmpiA (lpString1="", lpString2="bg_Country.gif") returned -1 [0061.449] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif") returned="bg_Casual.gif" [0061.449] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0061.449] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0061.449] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0061.449] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0061.449] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" [0061.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.zip") returned 0 [0061.449] lstrlenA (lpString="*.zip") returned 5 [0061.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.rar") returned 0 [0061.449] lstrlenA (lpString="*.rar") returned 5 [0061.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.7z") returned 0 [0061.449] lstrlenA (lpString="*.7z") returned 4 [0061.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.tar") returned 0 [0061.449] lstrlenA (lpString="*.tar") returned 5 [0061.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.gzip") returned 0 [0061.449] lstrlenA (lpString="*.gzip") returned 6 [0061.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.jpg") returned 0 [0061.449] lstrlenA (lpString="*.jpg") returned 5 [0061.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.jpeg") returned 0 [0061.450] lstrlenA (lpString="*.jpeg") returned 6 [0061.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.psd") returned 0 [0061.450] lstrlenA (lpString="*.psd") returned 5 [0061.450] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.gif") returned 1 [0061.450] lstrlenA (lpString="*.gif") returned 5 [0061.450] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" [0061.450] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" [0061.450] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif." [0061.450] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif.wannacry" [0061.450] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.450] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7dd3 [0061.451] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1 [0061.451] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.451] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x7d55, lpOverlapped=0x0) returned 1 [0061.453] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif") returned="bg_Country.gif" [0061.453] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.453] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x7d55, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x7d55, lpOverlapped=0x0) returned 1 [0061.453] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.453] CloseHandle (hObject=0x98) returned 1 [0061.453] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif.wannacry")) returned 1 [0061.454] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x132a, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="bg_Earthy.gif", cAlternateFileName="BG_EAR~1.GIF")) returned 1 [0061.454] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.454] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_Earthy.gif") returned 1 [0061.454] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Earthy.gif") returned 1 [0061.454] lstrcmpiA (lpString1="", lpString2="bg_Earthy.gif") returned -1 [0061.454] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif") returned="bg_Country.gif" [0061.454] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0061.454] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0061.454] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0061.454] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0061.455] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" [0061.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.zip") returned 0 [0061.455] lstrlenA (lpString="*.zip") returned 5 [0061.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.rar") returned 0 [0061.455] lstrlenA (lpString="*.rar") returned 5 [0061.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.7z") returned 0 [0061.455] lstrlenA (lpString="*.7z") returned 4 [0061.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.tar") returned 0 [0061.455] lstrlenA (lpString="*.tar") returned 5 [0061.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.gzip") returned 0 [0061.455] lstrlenA (lpString="*.gzip") returned 6 [0061.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.jpg") returned 0 [0061.455] lstrlenA (lpString="*.jpg") returned 5 [0061.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.jpeg") returned 0 [0061.455] lstrlenA (lpString="*.jpeg") returned 6 [0061.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.psd") returned 0 [0061.455] lstrlenA (lpString="*.psd") returned 5 [0061.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.gif") returned 1 [0061.455] lstrlenA (lpString="*.gif") returned 5 [0061.455] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" [0061.455] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" [0061.455] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif." [0061.455] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif.wannacry" [0061.455] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.457] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x132a [0061.457] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1 [0061.457] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.457] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x12ac, lpOverlapped=0x0) returned 1 [0061.459] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif") returned="bg_Earthy.gif" [0061.459] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.459] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x12ac, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x12ac, lpOverlapped=0x0) returned 1 [0061.459] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.460] CloseHandle (hObject=0x98) returned 1 [0061.460] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif.wannacry")) returned 1 [0061.460] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9b8, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="bg_FormsHomePage.gif", cAlternateFileName="BG_FOR~1.GIF")) returned 1 [0061.460] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.460] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_FormsHomePage.gif") returned 1 [0061.460] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_FormsHomePage.gif") returned 1 [0061.460] lstrcmpiA (lpString1="", lpString2="bg_FormsHomePage.gif") returned -1 [0061.460] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif") returned="bg_Earthy.gif" [0061.461] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0061.461] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0061.461] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0061.461] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0061.461] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_FormsHomePage.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" [0061.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.zip") returned 0 [0061.461] lstrlenA (lpString="*.zip") returned 5 [0061.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.rar") returned 0 [0061.461] lstrlenA (lpString="*.rar") returned 5 [0061.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.7z") returned 0 [0061.461] lstrlenA (lpString="*.7z") returned 4 [0061.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.tar") returned 0 [0061.461] lstrlenA (lpString="*.tar") returned 5 [0061.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.gzip") returned 0 [0061.461] lstrlenA (lpString="*.gzip") returned 6 [0061.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.jpg") returned 0 [0061.461] lstrlenA (lpString="*.jpg") returned 5 [0061.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.jpeg") returned 0 [0061.461] lstrlenA (lpString="*.jpeg") returned 6 [0061.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.psd") returned 0 [0061.461] lstrlenA (lpString="*.psd") returned 5 [0061.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.gif") returned 1 [0061.461] lstrlenA (lpString="*.gif") returned 5 [0061.461] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" [0061.461] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" [0061.461] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif." [0061.461] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif.wannacry" [0061.462] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.463] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9b8 [0061.463] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1 [0061.463] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.463] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xb93a, lpOverlapped=0x0) returned 1 [0061.466] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif") returned="bg_FormsHomePage.gif" [0061.466] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.466] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xb93a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xb93a, lpOverlapped=0x0) returned 1 [0061.467] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.467] CloseHandle (hObject=0x98) returned 1 [0061.467] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif.wannacry")) returned 1 [0061.468] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4ebb, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="bg_FormsHomePageBlank.gif", cAlternateFileName="BG_FOR~2.GIF")) returned 1 [0061.468] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.468] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_FormsHomePageBlank.gif") returned 1 [0061.468] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_FormsHomePageBlank.gif") returned 1 [0061.468] lstrcmpiA (lpString1="", lpString2="bg_FormsHomePageBlank.gif") returned -1 [0061.468] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif") returned="bg_FormsHomePage.gif" [0061.468] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0061.468] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0061.468] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0061.468] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0061.468] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_FormsHomePageBlank.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" [0061.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.zip") returned 0 [0061.468] lstrlenA (lpString="*.zip") returned 5 [0061.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.rar") returned 0 [0061.469] lstrlenA (lpString="*.rar") returned 5 [0061.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.7z") returned 0 [0061.469] lstrlenA (lpString="*.7z") returned 4 [0061.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.tar") returned 0 [0061.469] lstrlenA (lpString="*.tar") returned 5 [0061.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.gzip") returned 0 [0061.469] lstrlenA (lpString="*.gzip") returned 6 [0061.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.jpg") returned 0 [0061.469] lstrlenA (lpString="*.jpg") returned 5 [0061.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.jpeg") returned 0 [0061.469] lstrlenA (lpString="*.jpeg") returned 6 [0061.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.psd") returned 0 [0061.469] lstrlenA (lpString="*.psd") returned 5 [0061.469] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.gif") returned 1 [0061.469] lstrlenA (lpString="*.gif") returned 5 [0061.469] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" [0061.469] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" [0061.469] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif." [0061.469] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif.wannacry" [0061.469] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.473] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ebb [0061.473] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1 [0061.473] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.473] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4e3d, lpOverlapped=0x0) returned 1 [0061.475] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif") returned="bg_FormsHomePageBlank.gif" [0061.475] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.475] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4e3d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4e3d, lpOverlapped=0x0) returned 1 [0061.475] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.475] CloseHandle (hObject=0x98) returned 1 [0061.475] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif.wannacry")) returned 1 [0061.476] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5690, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="bg_GreenTea.gif", cAlternateFileName="BG_GRE~1.GIF")) returned 1 [0061.476] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.476] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_GreenTea.gif") returned 1 [0061.476] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_GreenTea.gif") returned 1 [0061.476] lstrcmpiA (lpString1="", lpString2="bg_GreenTea.gif") returned -1 [0061.476] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif") returned="bg_FormsHomePageBlank.gif" [0061.476] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0061.477] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0061.477] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0061.477] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0061.477] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" [0061.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.zip") returned 0 [0061.477] lstrlenA (lpString="*.zip") returned 5 [0061.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.rar") returned 0 [0061.477] lstrlenA (lpString="*.rar") returned 5 [0061.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.7z") returned 0 [0061.477] lstrlenA (lpString="*.7z") returned 4 [0061.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.tar") returned 0 [0061.477] lstrlenA (lpString="*.tar") returned 5 [0061.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.gzip") returned 0 [0061.477] lstrlenA (lpString="*.gzip") returned 6 [0061.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.jpg") returned 0 [0061.477] lstrlenA (lpString="*.jpg") returned 5 [0061.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.jpeg") returned 0 [0061.477] lstrlenA (lpString="*.jpeg") returned 6 [0061.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.psd") returned 0 [0061.477] lstrlenA (lpString="*.psd") returned 5 [0061.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.gif") returned 1 [0061.477] lstrlenA (lpString="*.gif") returned 5 [0061.477] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" [0061.477] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" [0061.478] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif." [0061.478] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif.wannacry" [0061.478] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.479] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5690 [0061.479] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1 [0061.479] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.479] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x5612, lpOverlapped=0x0) returned 1 [0061.482] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif") returned="bg_GreenTea.gif" [0061.482] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.482] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x5612, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x5612, lpOverlapped=0x0) returned 1 [0061.482] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.482] CloseHandle (hObject=0x98) returned 1 [0061.482] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif.wannacry")) returned 1 [0061.483] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6a, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="bg_Groove.gif", cAlternateFileName="BG_GRO~1.GIF")) returned 1 [0061.483] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.484] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_Groove.gif") returned 1 [0061.484] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Groove.gif") returned 1 [0061.484] lstrcmpiA (lpString1="", lpString2="bg_Groove.gif") returned -1 [0061.484] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif") returned="bg_GreenTea.gif" [0061.484] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0061.484] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0061.484] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0061.484] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0061.484] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" [0061.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.zip") returned 0 [0061.484] lstrlenA (lpString="*.zip") returned 5 [0061.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.rar") returned 0 [0061.484] lstrlenA (lpString="*.rar") returned 5 [0061.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.7z") returned 0 [0061.484] lstrlenA (lpString="*.7z") returned 4 [0061.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.tar") returned 0 [0061.484] lstrlenA (lpString="*.tar") returned 5 [0061.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.gzip") returned 0 [0061.484] lstrlenA (lpString="*.gzip") returned 6 [0061.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.jpg") returned 0 [0061.484] lstrlenA (lpString="*.jpg") returned 5 [0061.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.jpeg") returned 0 [0061.484] lstrlenA (lpString="*.jpeg") returned 6 [0061.484] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.psd") returned 0 [0061.484] lstrlenA (lpString="*.psd") returned 5 [0061.485] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.gif") returned 1 [0061.485] lstrlenA (lpString="*.gif") returned 5 [0061.485] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" [0061.485] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" [0061.485] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif." [0061.485] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif.wannacry" [0061.485] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.486] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6a [0061.486] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1 [0061.486] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.486] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0061.486] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.486] CloseHandle (hObject=0x98) returned 1 [0061.486] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif.wannacry")) returned 1 [0061.487] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x21a6, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="bg_LightSpirit.gif", cAlternateFileName="BG_LIG~1.GIF")) returned 1 [0061.487] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.487] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_LightSpirit.gif") returned 1 [0061.487] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_LightSpirit.gif") returned 1 [0061.487] lstrcmpiA (lpString1="", lpString2="bg_LightSpirit.gif") returned -1 [0061.487] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif") returned="bg_Groove.gif" [0061.487] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0061.487] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0061.487] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0061.487] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0061.487] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" [0061.487] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.zip") returned 0 [0061.488] lstrlenA (lpString="*.zip") returned 5 [0061.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.rar") returned 0 [0061.488] lstrlenA (lpString="*.rar") returned 5 [0061.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.7z") returned 0 [0061.488] lstrlenA (lpString="*.7z") returned 4 [0061.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.tar") returned 0 [0061.488] lstrlenA (lpString="*.tar") returned 5 [0061.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.gzip") returned 0 [0061.488] lstrlenA (lpString="*.gzip") returned 6 [0061.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.jpg") returned 0 [0061.488] lstrlenA (lpString="*.jpg") returned 5 [0061.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.jpeg") returned 0 [0061.488] lstrlenA (lpString="*.jpeg") returned 6 [0061.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.psd") returned 0 [0061.488] lstrlenA (lpString="*.psd") returned 5 [0061.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.gif") returned 1 [0061.488] lstrlenA (lpString="*.gif") returned 5 [0061.488] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" [0061.488] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" [0061.488] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif." [0061.488] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif.wannacry" [0061.488] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.489] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x21a6 [0061.489] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1 [0061.489] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.489] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2128, lpOverlapped=0x0) returned 1 [0061.492] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif") returned="bg_LightSpirit.gif" [0061.492] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.492] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2128, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2128, lpOverlapped=0x0) returned 1 [0061.492] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.492] CloseHandle (hObject=0x98) returned 1 [0061.492] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif.wannacry")) returned 1 [0061.493] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3d57, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="bg_OliveGreen.gif", cAlternateFileName="BG_OLI~1.GIF")) returned 1 [0061.493] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.493] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_OliveGreen.gif") returned 1 [0061.493] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_OliveGreen.gif") returned 1 [0061.493] lstrcmpiA (lpString1="", lpString2="bg_OliveGreen.gif") returned -1 [0061.493] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif") returned="bg_LightSpirit.gif" [0061.493] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0061.494] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0061.494] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0061.494] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0061.494] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" [0061.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.zip") returned 0 [0061.494] lstrlenA (lpString="*.zip") returned 5 [0061.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.rar") returned 0 [0061.494] lstrlenA (lpString="*.rar") returned 5 [0061.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.7z") returned 0 [0061.494] lstrlenA (lpString="*.7z") returned 4 [0061.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.tar") returned 0 [0061.494] lstrlenA (lpString="*.tar") returned 5 [0061.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.gzip") returned 0 [0061.494] lstrlenA (lpString="*.gzip") returned 6 [0061.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.jpg") returned 0 [0061.494] lstrlenA (lpString="*.jpg") returned 5 [0061.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.jpeg") returned 0 [0061.494] lstrlenA (lpString="*.jpeg") returned 6 [0061.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.psd") returned 0 [0061.494] lstrlenA (lpString="*.psd") returned 5 [0061.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.gif") returned 1 [0061.495] lstrlenA (lpString="*.gif") returned 5 [0061.495] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" [0061.495] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" [0061.495] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif." [0061.495] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif.wannacry" [0061.495] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.495] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d57 [0061.495] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1 [0061.495] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.496] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3cd9, lpOverlapped=0x0) returned 1 [0061.498] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif") returned="bg_OliveGreen.gif" [0061.498] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.498] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3cd9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3cd9, lpOverlapped=0x0) returned 1 [0061.498] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.498] CloseHandle (hObject=0x98) returned 1 [0061.499] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif.wannacry")) returned 1 [0061.499] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1845, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="bg_Premium.gif", cAlternateFileName="BG_PRE~1.GIF")) returned 1 [0061.500] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.500] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_Premium.gif") returned 1 [0061.500] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Premium.gif") returned 1 [0061.500] lstrcmpiA (lpString1="", lpString2="bg_Premium.gif") returned -1 [0061.500] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif") returned="bg_OliveGreen.gif" [0061.500] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0061.500] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0061.500] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0061.500] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0061.500] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" [0061.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.zip") returned 0 [0061.500] lstrlenA (lpString="*.zip") returned 5 [0061.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.rar") returned 0 [0061.500] lstrlenA (lpString="*.rar") returned 5 [0061.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.7z") returned 0 [0061.500] lstrlenA (lpString="*.7z") returned 4 [0061.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.tar") returned 0 [0061.501] lstrlenA (lpString="*.tar") returned 5 [0061.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.gzip") returned 0 [0061.501] lstrlenA (lpString="*.gzip") returned 6 [0061.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.jpg") returned 0 [0061.501] lstrlenA (lpString="*.jpg") returned 5 [0061.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.jpeg") returned 0 [0061.501] lstrlenA (lpString="*.jpeg") returned 6 [0061.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.psd") returned 0 [0061.501] lstrlenA (lpString="*.psd") returned 5 [0061.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.gif") returned 1 [0061.501] lstrlenA (lpString="*.gif") returned 5 [0061.501] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" [0061.501] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" [0061.501] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif." [0061.501] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif.wannacry" [0061.501] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.503] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1845 [0061.503] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1 [0061.503] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.503] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x17c7, lpOverlapped=0x0) returned 1 [0061.506] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif") returned="bg_Premium.gif" [0061.506] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.506] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x17c7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x17c7, lpOverlapped=0x0) returned 1 [0061.506] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.507] CloseHandle (hObject=0x98) returned 1 [0061.507] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif.wannacry")) returned 1 [0061.509] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5141, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="bg_SlateBlue.gif", cAlternateFileName="BG_SLA~1.GIF")) returned 1 [0061.509] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.509] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_SlateBlue.gif") returned 1 [0061.509] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_SlateBlue.gif") returned 1 [0061.509] lstrcmpiA (lpString1="", lpString2="bg_SlateBlue.gif") returned -1 [0061.509] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif") returned="bg_Premium.gif" [0061.509] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0061.509] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0061.510] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0061.510] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0061.510] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" [0061.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.zip") returned 0 [0061.510] lstrlenA (lpString="*.zip") returned 5 [0061.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.rar") returned 0 [0061.510] lstrlenA (lpString="*.rar") returned 5 [0061.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.7z") returned 0 [0061.511] lstrlenA (lpString="*.7z") returned 4 [0061.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.tar") returned 0 [0061.511] lstrlenA (lpString="*.tar") returned 5 [0061.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.gzip") returned 0 [0061.511] lstrlenA (lpString="*.gzip") returned 6 [0061.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.jpg") returned 0 [0061.511] lstrlenA (lpString="*.jpg") returned 5 [0061.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.jpeg") returned 0 [0061.511] lstrlenA (lpString="*.jpeg") returned 6 [0061.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.psd") returned 0 [0061.511] lstrlenA (lpString="*.psd") returned 5 [0061.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.gif") returned 1 [0061.511] lstrlenA (lpString="*.gif") returned 5 [0061.511] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" [0061.511] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" [0061.511] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif." [0061.511] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif.wannacry" [0061.511] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.514] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5141 [0061.514] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1 [0061.514] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.514] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x50c3, lpOverlapped=0x0) returned 1 [0061.518] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif") returned="bg_SlateBlue.gif" [0061.518] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.518] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x50c3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x50c3, lpOverlapped=0x0) returned 1 [0061.518] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.518] CloseHandle (hObject=0x98) returned 1 [0061.518] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif.wannacry")) returned 1 [0061.519] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x193c, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="bg_TexturedBlue.gif", cAlternateFileName="BG_TEX~1.GIF")) returned 1 [0061.520] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.520] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_TexturedBlue.gif") returned 1 [0061.520] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_TexturedBlue.gif") returned 1 [0061.520] lstrcmpiA (lpString1="", lpString2="bg_TexturedBlue.gif") returned -1 [0061.520] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif") returned="bg_SlateBlue.gif" [0061.520] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0061.520] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0061.520] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0061.520] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0061.520] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" [0061.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.zip") returned 0 [0061.520] lstrlenA (lpString="*.zip") returned 5 [0061.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.rar") returned 0 [0061.520] lstrlenA (lpString="*.rar") returned 5 [0061.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.7z") returned 0 [0061.520] lstrlenA (lpString="*.7z") returned 4 [0061.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.tar") returned 0 [0061.520] lstrlenA (lpString="*.tar") returned 5 [0061.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.gzip") returned 0 [0061.520] lstrlenA (lpString="*.gzip") returned 6 [0061.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.jpg") returned 0 [0061.521] lstrlenA (lpString="*.jpg") returned 5 [0061.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.jpeg") returned 0 [0061.521] lstrlenA (lpString="*.jpeg") returned 6 [0061.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.psd") returned 0 [0061.521] lstrlenA (lpString="*.psd") returned 5 [0061.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.gif") returned 1 [0061.521] lstrlenA (lpString="*.gif") returned 5 [0061.521] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" [0061.521] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" [0061.521] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif." [0061.521] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif.wannacry" [0061.521] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.523] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x193c [0061.523] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1 [0061.524] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.524] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x18be, lpOverlapped=0x0) returned 1 [0061.526] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif") returned="bg_TexturedBlue.gif" [0061.526] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.526] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x18be, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x18be, lpOverlapped=0x0) returned 1 [0061.526] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.526] CloseHandle (hObject=0x98) returned 1 [0061.526] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif.wannacry")) returned 1 [0061.527] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3c64, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="bg_VelvetRose.gif", cAlternateFileName="BG_VEL~1.GIF")) returned 1 [0061.527] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.527] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_VelvetRose.gif") returned 1 [0061.527] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_VelvetRose.gif") returned 1 [0061.527] lstrcmpiA (lpString1="", lpString2="bg_VelvetRose.gif") returned -1 [0061.527] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif") returned="bg_TexturedBlue.gif" [0061.527] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0061.528] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0061.528] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0061.528] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0061.528] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" [0061.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.zip") returned 0 [0061.528] lstrlenA (lpString="*.zip") returned 5 [0061.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.rar") returned 0 [0061.528] lstrlenA (lpString="*.rar") returned 5 [0061.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.7z") returned 0 [0061.528] lstrlenA (lpString="*.7z") returned 4 [0061.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.tar") returned 0 [0061.528] lstrlenA (lpString="*.tar") returned 5 [0061.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.gzip") returned 0 [0061.528] lstrlenA (lpString="*.gzip") returned 6 [0061.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.jpg") returned 0 [0061.528] lstrlenA (lpString="*.jpg") returned 5 [0061.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.jpeg") returned 0 [0061.528] lstrlenA (lpString="*.jpeg") returned 6 [0061.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.psd") returned 0 [0061.528] lstrlenA (lpString="*.psd") returned 5 [0061.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.gif") returned 1 [0061.528] lstrlenA (lpString="*.gif") returned 5 [0061.528] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" [0061.528] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" [0061.529] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif." [0061.529] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif.wannacry" [0061.529] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.529] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c64 [0061.529] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1 [0061.529] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.530] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3be6, lpOverlapped=0x0) returned 1 [0061.533] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif") returned="bg_VelvetRose.gif" [0061.533] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.533] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3be6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3be6, lpOverlapped=0x0) returned 1 [0061.534] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.534] CloseHandle (hObject=0x98) returned 1 [0061.534] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif.wannacry")) returned 1 [0061.535] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="button_left.gif", cAlternateFileName="BUTTON~1.GIF")) returned 1 [0061.535] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.535] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="button_left.gif") returned 1 [0061.535] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_left.gif") returned 1 [0061.535] lstrcmpiA (lpString1="", lpString2="button_left.gif") returned -1 [0061.535] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif") returned="bg_VelvetRose.gif" [0061.535] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0061.535] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0061.535] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0061.535] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0061.535] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="button_left.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" [0061.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.zip") returned 0 [0061.535] lstrlenA (lpString="*.zip") returned 5 [0061.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.rar") returned 0 [0061.535] lstrlenA (lpString="*.rar") returned 5 [0061.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.7z") returned 0 [0061.536] lstrlenA (lpString="*.7z") returned 4 [0061.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.tar") returned 0 [0061.536] lstrlenA (lpString="*.tar") returned 5 [0061.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.gzip") returned 0 [0061.536] lstrlenA (lpString="*.gzip") returned 6 [0061.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.jpg") returned 0 [0061.536] lstrlenA (lpString="*.jpg") returned 5 [0061.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.jpeg") returned 0 [0061.536] lstrlenA (lpString="*.jpeg") returned 6 [0061.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.psd") returned 0 [0061.536] lstrlenA (lpString="*.psd") returned 5 [0061.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.gif") returned 1 [0061.536] lstrlenA (lpString="*.gif") returned 5 [0061.536] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" [0061.536] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" [0061.536] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif." [0061.536] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif.wannacry" [0061.536] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.538] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x276 [0061.538] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b6c470, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1 [0061.538] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.538] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1f8, lpOverlapped=0x0) returned 1 [0061.567] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif") returned="button_left.gif" [0061.567] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.567] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1f8, lpOverlapped=0x0) returned 1 [0061.568] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.568] CloseHandle (hObject=0x98) returned 1 [0061.568] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif.wannacry")) returned 1 [0061.570] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="button_left_disable.gif", cAlternateFileName="BUTTON~2.GIF")) returned 1 [0061.570] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.570] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="button_left_disable.gif") returned 1 [0061.570] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_left_disable.gif") returned 1 [0061.570] lstrcmpiA (lpString1="", lpString2="button_left_disable.gif") returned -1 [0061.570] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif") returned="button_left.gif" [0061.570] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0061.570] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0061.570] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0061.570] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0061.571] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="button_left_disable.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" [0061.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.zip") returned 0 [0061.571] lstrlenA (lpString="*.zip") returned 5 [0061.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.rar") returned 0 [0061.571] lstrlenA (lpString="*.rar") returned 5 [0061.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.7z") returned 0 [0061.571] lstrlenA (lpString="*.7z") returned 4 [0061.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.tar") returned 0 [0061.571] lstrlenA (lpString="*.tar") returned 5 [0061.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.gzip") returned 0 [0061.571] lstrlenA (lpString="*.gzip") returned 6 [0061.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.jpg") returned 0 [0061.571] lstrlenA (lpString="*.jpg") returned 5 [0061.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.jpeg") returned 0 [0061.571] lstrlenA (lpString="*.jpeg") returned 6 [0061.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.psd") returned 0 [0061.571] lstrlenA (lpString="*.psd") returned 5 [0061.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.gif") returned 1 [0061.571] lstrlenA (lpString="*.gif") returned 5 [0061.571] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" [0061.572] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" [0061.572] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif." [0061.572] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif.wannacry" [0061.572] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.572] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe6 [0061.573] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b6c470, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1 [0061.573] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.573] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x68, lpOverlapped=0x0) returned 1 [0061.574] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif") returned="button_left_disable.gif" [0061.574] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.574] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x68, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x68, lpOverlapped=0x0) returned 1 [0061.574] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.574] CloseHandle (hObject=0x98) returned 1 [0061.574] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif.wannacry")) returned 1 [0061.575] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x41b, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="button_left_over.gif", cAlternateFileName="BUAC31~1.GIF")) returned 1 [0061.575] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.575] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="button_left_over.gif") returned 1 [0061.575] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_left_over.gif") returned 1 [0061.575] lstrcmpiA (lpString1="", lpString2="button_left_over.gif") returned -1 [0061.575] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif") returned="button_left_disable.gif" [0061.575] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0061.575] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0061.576] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0061.576] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0061.576] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="button_left_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" [0061.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.zip") returned 0 [0061.576] lstrlenA (lpString="*.zip") returned 5 [0061.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.rar") returned 0 [0061.576] lstrlenA (lpString="*.rar") returned 5 [0061.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.7z") returned 0 [0061.576] lstrlenA (lpString="*.7z") returned 4 [0061.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.tar") returned 0 [0061.576] lstrlenA (lpString="*.tar") returned 5 [0061.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.gzip") returned 0 [0061.576] lstrlenA (lpString="*.gzip") returned 6 [0061.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.jpg") returned 0 [0061.576] lstrlenA (lpString="*.jpg") returned 5 [0061.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.jpeg") returned 0 [0061.576] lstrlenA (lpString="*.jpeg") returned 6 [0061.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.psd") returned 0 [0061.576] lstrlenA (lpString="*.psd") returned 5 [0061.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.gif") returned 1 [0061.576] lstrlenA (lpString="*.gif") returned 5 [0061.576] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" [0061.577] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" [0061.577] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif." [0061.577] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif.wannacry" [0061.577] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.645] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x41b [0061.645] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x600aeb50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1 [0061.646] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.646] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x39d, lpOverlapped=0x0) returned 1 [0061.679] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif") returned="button_left_over.gif" [0061.680] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.680] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x39d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x39d, lpOverlapped=0x0) returned 1 [0061.755] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.755] CloseHandle (hObject=0x98) returned 1 [0061.755] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif.wannacry")) returned 1 [0061.757] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="button_mid.gif", cAlternateFileName="BUTTON~3.GIF")) returned 1 [0061.757] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.757] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="button_mid.gif") returned 1 [0061.757] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_mid.gif") returned 1 [0061.757] lstrcmpiA (lpString1="", lpString2="button_mid.gif") returned -1 [0061.757] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif") returned="button_left_over.gif" [0061.757] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0061.757] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0061.757] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0061.757] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0061.757] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="button_mid.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" [0061.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.zip") returned 0 [0061.757] lstrlenA (lpString="*.zip") returned 5 [0061.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.rar") returned 0 [0061.757] lstrlenA (lpString="*.rar") returned 5 [0061.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.7z") returned 0 [0061.758] lstrlenA (lpString="*.7z") returned 4 [0061.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.tar") returned 0 [0061.758] lstrlenA (lpString="*.tar") returned 5 [0061.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.gzip") returned 0 [0061.758] lstrlenA (lpString="*.gzip") returned 6 [0061.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.jpg") returned 0 [0061.758] lstrlenA (lpString="*.jpg") returned 5 [0061.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.jpeg") returned 0 [0061.758] lstrlenA (lpString="*.jpeg") returned 6 [0061.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.psd") returned 0 [0061.758] lstrlenA (lpString="*.psd") returned 5 [0061.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.gif") returned 1 [0061.758] lstrlenA (lpString="*.gif") returned 5 [0061.758] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" [0061.758] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" [0061.758] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif." [0061.759] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif.wannacry" [0061.759] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.760] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9 [0061.760] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b6c470, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1 [0061.761] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.761] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3b, lpOverlapped=0x0) returned 1 [0061.775] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif") returned="button_mid.gif" [0061.775] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.775] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3b, lpOverlapped=0x0) returned 1 [0061.777] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.777] CloseHandle (hObject=0x98) returned 1 [0061.777] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif.wannacry")) returned 1 [0061.778] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="button_mid_disable.gif", cAlternateFileName="BUABE1~1.GIF")) returned 1 [0061.778] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.778] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="button_mid_disable.gif") returned 1 [0061.778] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_mid_disable.gif") returned 1 [0061.778] lstrcmpiA (lpString1="", lpString2="button_mid_disable.gif") returned -1 [0061.779] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif") returned="button_mid.gif" [0061.779] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0061.779] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0061.779] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0061.779] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0061.779] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="button_mid_disable.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" [0061.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.zip") returned 0 [0061.779] lstrlenA (lpString="*.zip") returned 5 [0061.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.rar") returned 0 [0061.779] lstrlenA (lpString="*.rar") returned 5 [0061.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.7z") returned 0 [0061.779] lstrlenA (lpString="*.7z") returned 4 [0061.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.tar") returned 0 [0061.779] lstrlenA (lpString="*.tar") returned 5 [0061.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.gzip") returned 0 [0061.780] lstrlenA (lpString="*.gzip") returned 6 [0061.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.jpg") returned 0 [0061.780] lstrlenA (lpString="*.jpg") returned 5 [0061.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.jpeg") returned 0 [0061.780] lstrlenA (lpString="*.jpeg") returned 6 [0061.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.psd") returned 0 [0061.780] lstrlenA (lpString="*.psd") returned 5 [0061.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.gif") returned 1 [0061.780] lstrlenA (lpString="*.gif") returned 5 [0061.780] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" [0061.780] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" [0061.780] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif." [0061.780] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif.wannacry" [0061.780] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.781] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35 [0061.781] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x600aeb50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1 [0061.781] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.781] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0061.781] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.782] CloseHandle (hObject=0x98) returned 1 [0061.782] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif.wannacry")) returned 1 [0061.783] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="button_mid_over.gif", cAlternateFileName="BU1E84~1.GIF")) returned 1 [0061.783] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.783] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="button_mid_over.gif") returned 1 [0061.783] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_mid_over.gif") returned 1 [0061.783] lstrcmpiA (lpString1="", lpString2="button_mid_over.gif") returned -1 [0061.783] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif") returned="button_mid_disable.gif" [0061.783] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0061.783] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0061.783] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0061.783] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0061.783] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="button_mid_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" [0061.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.zip") returned 0 [0061.783] lstrlenA (lpString="*.zip") returned 5 [0061.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.rar") returned 0 [0061.783] lstrlenA (lpString="*.rar") returned 5 [0061.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.7z") returned 0 [0061.783] lstrlenA (lpString="*.7z") returned 4 [0061.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.tar") returned 0 [0061.784] lstrlenA (lpString="*.tar") returned 5 [0061.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.gzip") returned 0 [0061.784] lstrlenA (lpString="*.gzip") returned 6 [0061.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.jpg") returned 0 [0061.784] lstrlenA (lpString="*.jpg") returned 5 [0061.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.jpeg") returned 0 [0061.784] lstrlenA (lpString="*.jpeg") returned 6 [0061.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.psd") returned 0 [0061.784] lstrlenA (lpString="*.psd") returned 5 [0061.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.gif") returned 1 [0061.784] lstrlenA (lpString="*.gif") returned 5 [0061.784] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" [0061.784] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" [0061.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif." [0061.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif.wannacry" [0061.784] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.785] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbb [0061.785] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x600aeb50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1 [0061.785] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.785] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3d, lpOverlapped=0x0) returned 1 [0061.786] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif") returned="button_mid_over.gif" [0061.786] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.787] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3d, lpOverlapped=0x0) returned 1 [0061.787] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.790] CloseHandle (hObject=0x98) returned 1 [0061.790] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif.wannacry")) returned 1 [0061.791] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="button_right.gif", cAlternateFileName="BU7DFA~1.GIF")) returned 1 [0061.792] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.792] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="button_right.gif") returned 1 [0061.792] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_right.gif") returned 1 [0061.792] lstrcmpiA (lpString1="", lpString2="button_right.gif") returned -1 [0061.792] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif") returned="button_mid_over.gif" [0061.792] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0061.792] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0061.792] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0061.792] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0061.792] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="button_right.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" [0061.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.zip") returned 0 [0061.792] lstrlenA (lpString="*.zip") returned 5 [0061.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.rar") returned 0 [0061.792] lstrlenA (lpString="*.rar") returned 5 [0061.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.7z") returned 0 [0061.792] lstrlenA (lpString="*.7z") returned 4 [0061.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.tar") returned 0 [0061.792] lstrlenA (lpString="*.tar") returned 5 [0061.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.gzip") returned 0 [0061.793] lstrlenA (lpString="*.gzip") returned 6 [0061.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.jpg") returned 0 [0061.793] lstrlenA (lpString="*.jpg") returned 5 [0061.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.jpeg") returned 0 [0061.793] lstrlenA (lpString="*.jpeg") returned 6 [0061.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.psd") returned 0 [0061.793] lstrlenA (lpString="*.psd") returned 5 [0061.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.gif") returned 1 [0061.793] lstrlenA (lpString="*.gif") returned 5 [0061.793] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" [0061.793] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" [0061.793] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif." [0061.793] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif.wannacry" [0061.793] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.798] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x26e [0061.798] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60120f70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1 [0061.798] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.798] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1f0, lpOverlapped=0x0) returned 1 [0061.802] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif") returned="button_right.gif" [0061.802] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.803] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1f0, lpOverlapped=0x0) returned 1 [0061.803] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.803] CloseHandle (hObject=0x98) returned 1 [0061.803] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif.wannacry")) returned 1 [0061.810] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="button_right_disable.gif", cAlternateFileName="BUC143~1.GIF")) returned 1 [0061.810] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.811] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="button_right_disable.gif") returned 1 [0061.811] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_right_disable.gif") returned 1 [0061.811] lstrcmpiA (lpString1="", lpString2="button_right_disable.gif") returned -1 [0061.811] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif") returned="button_right.gif" [0061.811] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0061.811] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0061.811] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0061.811] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0061.811] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="button_right_disable.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" [0061.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.zip") returned 0 [0061.811] lstrlenA (lpString="*.zip") returned 5 [0061.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.rar") returned 0 [0061.811] lstrlenA (lpString="*.rar") returned 5 [0061.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.7z") returned 0 [0061.812] lstrlenA (lpString="*.7z") returned 4 [0061.812] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.tar") returned 0 [0061.812] lstrlenA (lpString="*.tar") returned 5 [0061.812] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.gzip") returned 0 [0061.812] lstrlenA (lpString="*.gzip") returned 6 [0061.812] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.jpg") returned 0 [0061.812] lstrlenA (lpString="*.jpg") returned 5 [0061.812] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.jpeg") returned 0 [0061.812] lstrlenA (lpString="*.jpeg") returned 6 [0061.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.psd") returned 0 [0061.813] lstrlenA (lpString="*.psd") returned 5 [0061.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.gif") returned 1 [0061.813] lstrlenA (lpString="*.gif") returned 5 [0061.813] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" [0061.813] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" [0061.813] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif." [0061.813] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif.wannacry" [0061.813] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.833] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe1 [0061.833] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60120f70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1 [0061.833] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.833] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x63, lpOverlapped=0x0) returned 1 [0061.834] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif") returned="button_right_disable.gif" [0061.834] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.834] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x63, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x63, lpOverlapped=0x0) returned 1 [0061.835] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.835] CloseHandle (hObject=0x98) returned 1 [0061.835] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif.wannacry")) returned 1 [0061.836] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x41b, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="button_right_over.gif", cAlternateFileName="BUTTON~4.GIF")) returned 1 [0061.836] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0061.836] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="button_right_over.gif") returned 1 [0061.837] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_right_over.gif") returned 1 [0061.837] lstrcmpiA (lpString1="", lpString2="button_right_over.gif") returned -1 [0061.837] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif") returned="button_right_disable.gif" [0061.837] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0061.837] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0061.837] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0061.837] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0061.837] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="button_right_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" [0061.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.zip") returned 0 [0061.837] lstrlenA (lpString="*.zip") returned 5 [0061.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.rar") returned 0 [0061.837] lstrlenA (lpString="*.rar") returned 5 [0061.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.7z") returned 0 [0061.837] lstrlenA (lpString="*.7z") returned 4 [0061.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.tar") returned 0 [0061.837] lstrlenA (lpString="*.tar") returned 5 [0061.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.gzip") returned 0 [0061.837] lstrlenA (lpString="*.gzip") returned 6 [0061.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.jpg") returned 0 [0061.837] lstrlenA (lpString="*.jpg") returned 5 [0061.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.jpeg") returned 0 [0061.837] lstrlenA (lpString="*.jpeg") returned 6 [0061.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.psd") returned 0 [0061.838] lstrlenA (lpString="*.psd") returned 5 [0061.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.gif") returned 1 [0061.838] lstrlenA (lpString="*.gif") returned 5 [0061.838] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" [0061.838] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" [0061.838] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif." [0061.838] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif.wannacry" [0061.838] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0061.855] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x41b [0061.855] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b925d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1 [0061.855] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.855] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x39d, lpOverlapped=0x0) returned 1 [0061.858] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif") returned="button_right_over.gif" [0061.858] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.858] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x39d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x39d, lpOverlapped=0x0) returned 1 [0061.858] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.858] CloseHandle (hObject=0x98) returned 1 [0061.858] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif.wannacry")) returned 1 [0061.859] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="FieldTypePreview", cAlternateFileName="FIELDT~1")) returned 1 [0061.860] lstrcmpA (lpString1=".", lpString2="FieldTypePreview") returned -1 [0061.860] lstrcmpA (lpString1="..", lpString2="FieldTypePreview") returned -1 [0061.860] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif") returned="button_right_over.gif" [0061.860] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FieldTypePreview" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" [0061.860] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned 98 [0061.860] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0069, dwReserved1=0x730065, cFileName=".", cAlternateFileName="")) returned 0x2d80f0 [0061.862] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0061.862] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x730000, cFileName="..", cAlternateFileName="")) returned 1 [0061.862] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0061.862] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0061.862] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x368c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Attachments.jpg", cAlternateFileName="ATTACH~1.JPG")) returned 1 [0061.862] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0061.862] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Attachments.jpg") returned 1 [0061.862] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Attachments.jpg") returned 1 [0061.863] lstrcmpiA (lpString1="", lpString2="Attachments.jpg") returned -1 [0061.863] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\*.*") returned="*.*" [0061.863] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0061.863] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="" [0061.863] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" [0061.863] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0xffffffff [0061.863] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0061.864] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0061.864] WriteFile (in: hFile=0x9c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0061.865] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0061.865] CloseHandle (hObject=0x9c) returned 1 [0061.866] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="Attachments.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" [0061.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", pszSpec="*.zip") returned 0 [0061.866] lstrlenA (lpString="*.zip") returned 5 [0061.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", pszSpec="*.rar") returned 0 [0061.866] lstrlenA (lpString="*.rar") returned 5 [0061.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", pszSpec="*.7z") returned 0 [0061.866] lstrlenA (lpString="*.7z") returned 4 [0061.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", pszSpec="*.tar") returned 0 [0061.866] lstrlenA (lpString="*.tar") returned 5 [0061.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", pszSpec="*.gzip") returned 0 [0061.866] lstrlenA (lpString="*.gzip") returned 6 [0061.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", pszSpec="*.jpg") returned 1 [0061.866] lstrlenA (lpString="*.jpg") returned 5 [0061.866] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" [0061.866] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" [0061.866] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg." [0061.866] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg.wannacry" [0061.866] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0061.867] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x368c [0061.867] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51767f50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1 [0061.867] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.867] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x360e, lpOverlapped=0x0) returned 1 [0061.870] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg") returned="Attachments.jpg" [0061.870] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.870] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x360e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x360e, lpOverlapped=0x0) returned 1 [0061.870] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.870] CloseHandle (hObject=0x9c) returned 1 [0061.887] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg.wannacry")) returned 1 [0061.888] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a68, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BREAK.JPG", cAlternateFileName="")) returned 1 [0061.888] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0061.888] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BREAK.JPG") returned 1 [0061.888] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BREAK.JPG") returned 1 [0061.888] lstrcmpiA (lpString1="", lpString2="BREAK.JPG") returned -1 [0061.888] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg") returned="Attachments.jpg" [0061.888] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0061.888] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="" [0061.888] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" [0061.888] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20 [0061.888] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="BREAK.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" [0061.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", pszSpec="*.zip") returned 0 [0061.889] lstrlenA (lpString="*.zip") returned 5 [0061.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", pszSpec="*.rar") returned 0 [0061.889] lstrlenA (lpString="*.rar") returned 5 [0061.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", pszSpec="*.7z") returned 0 [0061.889] lstrlenA (lpString="*.7z") returned 4 [0061.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", pszSpec="*.tar") returned 0 [0061.889] lstrlenA (lpString="*.tar") returned 5 [0061.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", pszSpec="*.gzip") returned 0 [0061.889] lstrlenA (lpString="*.gzip") returned 6 [0061.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", pszSpec="*.jpg") returned 1 [0061.889] lstrlenA (lpString="*.jpg") returned 5 [0061.889] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" [0061.889] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" [0061.889] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG." [0061.889] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG.wannacry" [0061.889] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0061.891] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a68 [0061.891] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6003c730, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1 [0061.891] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.891] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x39ea, lpOverlapped=0x0) returned 1 [0061.893] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG") returned="BREAK.JPG" [0061.893] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.893] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x39ea, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x39ea, lpOverlapped=0x0) returned 1 [0061.894] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.894] CloseHandle (hObject=0x9c) returned 1 [0061.894] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg.wannacry")) returned 1 [0061.895] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3004, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BUTTON.JPG", cAlternateFileName="")) returned 1 [0061.895] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0061.895] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BUTTON.JPG") returned 1 [0061.895] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BUTTON.JPG") returned 1 [0061.895] lstrcmpiA (lpString1="", lpString2="BUTTON.JPG") returned -1 [0061.895] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG") returned="BREAK.JPG" [0061.895] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0061.895] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="" [0061.895] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" [0061.895] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20 [0061.895] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="BUTTON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" [0061.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", pszSpec="*.zip") returned 0 [0061.895] lstrlenA (lpString="*.zip") returned 5 [0061.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", pszSpec="*.rar") returned 0 [0061.895] lstrlenA (lpString="*.rar") returned 5 [0061.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", pszSpec="*.7z") returned 0 [0061.896] lstrlenA (lpString="*.7z") returned 4 [0061.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", pszSpec="*.tar") returned 0 [0061.896] lstrlenA (lpString="*.tar") returned 5 [0061.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", pszSpec="*.gzip") returned 0 [0061.896] lstrlenA (lpString="*.gzip") returned 6 [0061.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", pszSpec="*.jpg") returned 1 [0061.896] lstrlenA (lpString="*.jpg") returned 5 [0061.896] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" [0061.896] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" [0061.896] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG." [0061.896] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG.wannacry" [0061.896] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0061.897] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3004 [0061.897] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b6c470, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1 [0061.897] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.897] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2f86, lpOverlapped=0x0) returned 1 [0061.935] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG") returned="BUTTON.JPG" [0061.935] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.935] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2f86, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2f86, lpOverlapped=0x0) returned 1 [0061.935] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.935] CloseHandle (hObject=0x9c) returned 1 [0061.935] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg.wannacry")) returned 1 [0061.937] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x33d6, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="CHECKBOX.JPG", cAlternateFileName="")) returned 1 [0061.937] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0061.937] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CHECKBOX.JPG") returned 1 [0061.937] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CHECKBOX.JPG") returned 1 [0061.937] lstrcmpiA (lpString1="", lpString2="CHECKBOX.JPG") returned -1 [0061.937] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG") returned="BUTTON.JPG" [0061.937] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0061.937] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="" [0061.937] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" [0061.937] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20 [0061.937] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="CHECKBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" [0061.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", pszSpec="*.zip") returned 0 [0061.937] lstrlenA (lpString="*.zip") returned 5 [0061.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", pszSpec="*.rar") returned 0 [0061.937] lstrlenA (lpString="*.rar") returned 5 [0061.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", pszSpec="*.7z") returned 0 [0061.937] lstrlenA (lpString="*.7z") returned 4 [0061.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", pszSpec="*.tar") returned 0 [0061.937] lstrlenA (lpString="*.tar") returned 5 [0061.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", pszSpec="*.gzip") returned 0 [0061.938] lstrlenA (lpString="*.gzip") returned 6 [0061.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", pszSpec="*.jpg") returned 1 [0061.938] lstrlenA (lpString="*.jpg") returned 5 [0061.938] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" [0061.938] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" [0061.938] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG." [0061.938] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG.wannacry" [0061.938] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0061.940] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x33d6 [0061.940] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60382570, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1 [0061.940] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.940] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3358, lpOverlapped=0x0) returned 1 [0061.942] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG") returned="CHECKBOX.JPG" [0061.942] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.942] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3358, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3358, lpOverlapped=0x0) returned 1 [0061.942] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.943] CloseHandle (hObject=0x9c) returned 1 [0061.943] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg.wannacry")) returned 1 [0061.944] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x43a3, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="COMBOBOX.JPG", cAlternateFileName="")) returned 1 [0061.944] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0061.944] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="COMBOBOX.JPG") returned 1 [0061.944] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="COMBOBOX.JPG") returned 1 [0061.944] lstrcmpiA (lpString1="", lpString2="COMBOBOX.JPG") returned -1 [0061.944] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG") returned="CHECKBOX.JPG" [0061.944] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0061.944] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="" [0061.944] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" [0061.944] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20 [0061.944] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="COMBOBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" [0061.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", pszSpec="*.zip") returned 0 [0061.945] lstrlenA (lpString="*.zip") returned 5 [0061.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", pszSpec="*.rar") returned 0 [0061.945] lstrlenA (lpString="*.rar") returned 5 [0061.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", pszSpec="*.7z") returned 0 [0061.945] lstrlenA (lpString="*.7z") returned 4 [0061.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", pszSpec="*.tar") returned 0 [0061.945] lstrlenA (lpString="*.tar") returned 5 [0061.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", pszSpec="*.gzip") returned 0 [0061.945] lstrlenA (lpString="*.gzip") returned 6 [0061.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", pszSpec="*.jpg") returned 1 [0061.945] lstrlenA (lpString="*.jpg") returned 5 [0061.945] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" [0061.945] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" [0061.945] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG." [0061.945] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG.wannacry" [0061.945] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0061.947] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43a3 [0061.947] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51cc30d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1 [0061.947] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.947] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4325, lpOverlapped=0x0) returned 1 [0061.949] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG") returned="COMBOBOX.JPG" [0061.949] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.949] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4325, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4325, lpOverlapped=0x0) returned 1 [0061.949] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.950] CloseHandle (hObject=0x9c) returned 1 [0061.950] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg.wannacry")) returned 1 [0061.952] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6048cf10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x36bd, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="CONTACT.JPG", cAlternateFileName="")) returned 1 [0061.952] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0061.952] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CONTACT.JPG") returned 1 [0061.952] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CONTACT.JPG") returned 1 [0061.952] lstrcmpiA (lpString1="", lpString2="CONTACT.JPG") returned -1 [0061.952] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG") returned="COMBOBOX.JPG" [0061.952] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0061.952] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="" [0061.952] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" [0061.952] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20 [0061.952] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="CONTACT.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" [0061.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", pszSpec="*.zip") returned 0 [0061.953] lstrlenA (lpString="*.zip") returned 5 [0061.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", pszSpec="*.rar") returned 0 [0061.953] lstrlenA (lpString="*.rar") returned 5 [0061.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", pszSpec="*.7z") returned 0 [0061.953] lstrlenA (lpString="*.7z") returned 4 [0061.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", pszSpec="*.tar") returned 0 [0061.953] lstrlenA (lpString="*.tar") returned 5 [0061.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", pszSpec="*.gzip") returned 0 [0061.953] lstrlenA (lpString="*.gzip") returned 6 [0061.953] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", pszSpec="*.jpg") returned 1 [0061.953] lstrlenA (lpString="*.jpg") returned 5 [0061.953] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" [0061.953] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" [0061.953] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG." [0061.953] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG.wannacry" [0061.953] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0061.954] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x36bd [0061.954] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6048cf10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1 [0061.954] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.954] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x363f, lpOverlapped=0x0) returned 1 [0061.957] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG") returned="CONTACT.JPG" [0061.957] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.957] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x363f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x363f, lpOverlapped=0x0) returned 1 [0061.957] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.957] CloseHandle (hObject=0x9c) returned 1 [0061.957] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg.wannacry")) returned 1 [0061.958] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3d22, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="CURRENCY.JPG", cAlternateFileName="")) returned 1 [0061.958] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0061.958] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CURRENCY.JPG") returned 1 [0061.959] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CURRENCY.JPG") returned 1 [0061.959] lstrcmpiA (lpString1="", lpString2="CURRENCY.JPG") returned -1 [0061.959] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG") returned="CONTACT.JPG" [0061.959] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0061.959] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="" [0061.959] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" [0061.959] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20 [0061.959] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="CURRENCY.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" [0061.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", pszSpec="*.zip") returned 0 [0061.959] lstrlenA (lpString="*.zip") returned 5 [0061.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", pszSpec="*.rar") returned 0 [0061.959] lstrlenA (lpString="*.rar") returned 5 [0061.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", pszSpec="*.7z") returned 0 [0061.959] lstrlenA (lpString="*.7z") returned 4 [0061.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", pszSpec="*.tar") returned 0 [0061.959] lstrlenA (lpString="*.tar") returned 5 [0061.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", pszSpec="*.gzip") returned 0 [0061.959] lstrlenA (lpString="*.gzip") returned 6 [0061.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", pszSpec="*.jpg") returned 1 [0061.959] lstrlenA (lpString="*.jpg") returned 5 [0061.959] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" [0061.960] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" [0061.960] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG." [0061.960] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG.wannacry" [0061.960] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0061.960] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d22 [0061.960] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x606ee510, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1 [0061.960] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.960] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3ca4, lpOverlapped=0x0) returned 1 [0061.963] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG") returned="CURRENCY.JPG" [0061.963] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.963] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3ca4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3ca4, lpOverlapped=0x0) returned 1 [0061.963] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.963] CloseHandle (hObject=0x9c) returned 1 [0061.963] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg.wannacry")) returned 1 [0061.964] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x42af, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="DATE.JPG", cAlternateFileName="")) returned 1 [0061.964] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0061.964] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DATE.JPG") returned 1 [0061.964] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DATE.JPG") returned 1 [0061.964] lstrcmpiA (lpString1="", lpString2="DATE.JPG") returned -1 [0061.964] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG") returned="CURRENCY.JPG" [0061.964] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0061.964] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="" [0061.964] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" [0061.965] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20 [0061.965] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="DATE.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" [0061.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", pszSpec="*.zip") returned 0 [0061.965] lstrlenA (lpString="*.zip") returned 5 [0061.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", pszSpec="*.rar") returned 0 [0061.965] lstrlenA (lpString="*.rar") returned 5 [0061.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", pszSpec="*.7z") returned 0 [0061.965] lstrlenA (lpString="*.7z") returned 4 [0061.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", pszSpec="*.tar") returned 0 [0061.965] lstrlenA (lpString="*.tar") returned 5 [0061.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", pszSpec="*.gzip") returned 0 [0061.965] lstrlenA (lpString="*.gzip") returned 6 [0061.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", pszSpec="*.jpg") returned 1 [0061.965] lstrlenA (lpString="*.jpg") returned 5 [0061.965] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" [0061.965] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" [0061.965] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG." [0061.965] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG.wannacry" [0061.965] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0061.966] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x42af [0061.966] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x606ee510, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1 [0061.966] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.966] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4231, lpOverlapped=0x0) returned 1 [0061.968] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG") returned="DATE.JPG" [0061.969] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.969] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4231, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4231, lpOverlapped=0x0) returned 1 [0061.969] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.969] CloseHandle (hObject=0x9c) returned 1 [0061.969] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg.wannacry")) returned 1 [0061.970] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4139, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="DATETIME.JPG", cAlternateFileName="")) returned 1 [0061.970] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0061.970] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DATETIME.JPG") returned 1 [0061.970] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DATETIME.JPG") returned 1 [0061.970] lstrcmpiA (lpString1="", lpString2="DATETIME.JPG") returned -1 [0061.970] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG") returned="DATE.JPG" [0061.970] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0061.970] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="" [0061.970] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" [0061.970] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20 [0061.970] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="DATETIME.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" [0061.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", pszSpec="*.zip") returned 0 [0061.971] lstrlenA (lpString="*.zip") returned 5 [0061.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", pszSpec="*.rar") returned 0 [0061.971] lstrlenA (lpString="*.rar") returned 5 [0061.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", pszSpec="*.7z") returned 0 [0061.971] lstrlenA (lpString="*.7z") returned 4 [0061.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", pszSpec="*.tar") returned 0 [0061.971] lstrlenA (lpString="*.tar") returned 5 [0061.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", pszSpec="*.gzip") returned 0 [0061.971] lstrlenA (lpString="*.gzip") returned 6 [0061.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", pszSpec="*.jpg") returned 1 [0061.971] lstrlenA (lpString="*.jpg") returned 5 [0061.971] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" [0061.971] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" [0061.971] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG." [0061.971] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG.wannacry" [0061.971] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0061.972] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4139 [0061.972] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x606ee510, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1 [0061.972] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.972] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x40bb, lpOverlapped=0x0) returned 1 [0061.974] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG") returned="DATETIME.JPG" [0061.975] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.975] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x40bb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x40bb, lpOverlapped=0x0) returned 1 [0061.975] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.975] CloseHandle (hObject=0x9c) returned 1 [0061.975] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg.wannacry")) returned 1 [0061.976] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3e01, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="DigitalInk.jpg", cAlternateFileName="DIGITA~1.JPG")) returned 1 [0061.976] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0061.976] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DigitalInk.jpg") returned 1 [0061.976] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DigitalInk.jpg") returned 1 [0061.976] lstrcmpiA (lpString1="", lpString2="DigitalInk.jpg") returned -1 [0061.976] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG") returned="DATETIME.JPG" [0061.976] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0061.976] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="" [0061.976] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" [0061.976] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20 [0061.976] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="DigitalInk.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" [0061.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", pszSpec="*.zip") returned 0 [0061.977] lstrlenA (lpString="*.zip") returned 5 [0061.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", pszSpec="*.rar") returned 0 [0061.977] lstrlenA (lpString="*.rar") returned 5 [0061.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", pszSpec="*.7z") returned 0 [0061.977] lstrlenA (lpString="*.7z") returned 4 [0061.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", pszSpec="*.tar") returned 0 [0061.977] lstrlenA (lpString="*.tar") returned 5 [0061.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", pszSpec="*.gzip") returned 0 [0061.977] lstrlenA (lpString="*.gzip") returned 6 [0061.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", pszSpec="*.jpg") returned 1 [0061.977] lstrlenA (lpString="*.jpg") returned 5 [0061.977] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" [0061.977] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" [0061.977] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg." [0061.977] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg.wannacry" [0061.977] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0061.978] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e01 [0061.978] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x607d2d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1 [0061.978] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.978] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3d83, lpOverlapped=0x0) returned 1 [0061.980] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg") returned="DigitalInk.jpg" [0061.980] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.980] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3d83, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3d83, lpOverlapped=0x0) returned 1 [0061.980] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.981] CloseHandle (hObject=0x9c) returned 1 [0061.981] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg.wannacry")) returned 1 [0061.982] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51f96af0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x20e8, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="EmbeddedView.jpg", cAlternateFileName="EMBEDD~1.JPG")) returned 1 [0061.982] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0061.982] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EmbeddedView.jpg") returned -1 [0061.982] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EmbeddedView.jpg") returned 1 [0061.982] lstrcmpiA (lpString1="", lpString2="EmbeddedView.jpg") returned -1 [0061.982] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg") returned="DigitalInk.jpg" [0061.982] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0061.982] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="" [0061.982] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" [0061.982] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20 [0061.982] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="EmbeddedView.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" [0061.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", pszSpec="*.zip") returned 0 [0061.982] lstrlenA (lpString="*.zip") returned 5 [0061.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", pszSpec="*.rar") returned 0 [0061.982] lstrlenA (lpString="*.rar") returned 5 [0061.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", pszSpec="*.7z") returned 0 [0061.982] lstrlenA (lpString="*.7z") returned 4 [0061.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", pszSpec="*.tar") returned 0 [0061.982] lstrlenA (lpString="*.tar") returned 5 [0061.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", pszSpec="*.gzip") returned 0 [0061.983] lstrlenA (lpString="*.gzip") returned 6 [0061.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", pszSpec="*.jpg") returned 1 [0061.983] lstrlenA (lpString="*.jpg") returned 5 [0061.983] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" [0061.983] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" [0061.983] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg." [0061.983] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg.wannacry" [0061.983] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0061.984] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x20e8 [0061.984] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51f96af0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1 [0061.984] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.984] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x206a, lpOverlapped=0x0) returned 1 [0061.987] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg") returned="EmbeddedView.jpg" [0061.987] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.987] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x206a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x206a, lpOverlapped=0x0) returned 1 [0061.987] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.987] CloseHandle (hObject=0x9c) returned 1 [0061.987] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg.wannacry")) returned 1 [0061.988] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3e72, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="HEADING.JPG", cAlternateFileName="")) returned 1 [0061.988] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0061.988] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HEADING.JPG") returned -1 [0061.988] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADING.JPG") returned 1 [0061.988] lstrcmpiA (lpString1="", lpString2="HEADING.JPG") returned -1 [0061.988] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg") returned="EmbeddedView.jpg" [0061.989] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0061.989] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="" [0061.989] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" [0061.989] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20 [0061.989] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HEADING.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" [0061.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", pszSpec="*.zip") returned 0 [0061.989] lstrlenA (lpString="*.zip") returned 5 [0061.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", pszSpec="*.rar") returned 0 [0061.989] lstrlenA (lpString="*.rar") returned 5 [0061.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", pszSpec="*.7z") returned 0 [0061.989] lstrlenA (lpString="*.7z") returned 4 [0061.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", pszSpec="*.tar") returned 0 [0061.989] lstrlenA (lpString="*.tar") returned 5 [0061.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", pszSpec="*.gzip") returned 0 [0061.989] lstrlenA (lpString="*.gzip") returned 6 [0061.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", pszSpec="*.jpg") returned 1 [0061.990] lstrlenA (lpString="*.jpg") returned 5 [0061.990] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" [0061.990] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" [0061.990] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG." [0061.990] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG.wannacry" [0061.990] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0061.992] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e72 [0061.992] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5386f090, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1 [0061.992] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.992] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3df4, lpOverlapped=0x0) returned 1 [0061.994] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG") returned="HEADING.JPG" [0061.994] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.995] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3df4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3df4, lpOverlapped=0x0) returned 1 [0061.995] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0061.995] CloseHandle (hObject=0x9c) returned 1 [0061.995] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg.wannacry")) returned 1 [0061.996] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x139a, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="IMAGE.JPG", cAlternateFileName="")) returned 1 [0061.996] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0061.996] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IMAGE.JPG") returned -1 [0061.996] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMAGE.JPG") returned -1 [0061.996] lstrcmpiA (lpString1="", lpString2="IMAGE.JPG") returned -1 [0061.996] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG") returned="HEADING.JPG" [0061.996] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0061.996] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="" [0061.996] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" [0061.996] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20 [0061.997] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="IMAGE.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" [0061.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", pszSpec="*.zip") returned 0 [0061.997] lstrlenA (lpString="*.zip") returned 5 [0061.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", pszSpec="*.rar") returned 0 [0061.997] lstrlenA (lpString="*.rar") returned 5 [0061.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", pszSpec="*.7z") returned 0 [0061.997] lstrlenA (lpString="*.7z") returned 4 [0061.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", pszSpec="*.tar") returned 0 [0061.997] lstrlenA (lpString="*.tar") returned 5 [0061.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", pszSpec="*.gzip") returned 0 [0061.997] lstrlenA (lpString="*.gzip") returned 6 [0061.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", pszSpec="*.jpg") returned 1 [0061.997] lstrlenA (lpString="*.jpg") returned 5 [0061.997] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" [0061.997] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" [0061.997] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG." [0061.997] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG.wannacry" [0061.997] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0061.999] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x139a [0061.999] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5392d770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1 [0061.999] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0061.999] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x131c, lpOverlapped=0x0) returned 1 [0062.001] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG") returned="IMAGE.JPG" [0062.001] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.001] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x131c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x131c, lpOverlapped=0x0) returned 1 [0062.001] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.002] CloseHandle (hObject=0x9c) returned 1 [0062.002] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg.wannacry")) returned 1 [0062.003] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x568309f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe65, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="LINE.JPG", cAlternateFileName="")) returned 1 [0062.003] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.003] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LINE.JPG") returned -1 [0062.003] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LINE.JPG") returned -1 [0062.003] lstrcmpiA (lpString1="", lpString2="LINE.JPG") returned -1 [0062.003] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG") returned="IMAGE.JPG" [0062.003] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0062.003] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="" [0062.003] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" [0062.003] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20 [0062.003] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="LINE.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" [0062.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", pszSpec="*.zip") returned 0 [0062.003] lstrlenA (lpString="*.zip") returned 5 [0062.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", pszSpec="*.rar") returned 0 [0062.003] lstrlenA (lpString="*.rar") returned 5 [0062.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", pszSpec="*.7z") returned 0 [0062.003] lstrlenA (lpString="*.7z") returned 4 [0062.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", pszSpec="*.tar") returned 0 [0062.003] lstrlenA (lpString="*.tar") returned 5 [0062.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", pszSpec="*.gzip") returned 0 [0062.003] lstrlenA (lpString="*.gzip") returned 6 [0062.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", pszSpec="*.jpg") returned 1 [0062.004] lstrlenA (lpString="*.jpg") returned 5 [0062.004] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" [0062.004] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" [0062.004] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG." [0062.004] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG.wannacry" [0062.004] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0062.005] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe65 [0062.005] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x568309f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1 [0062.006] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.006] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xde7, lpOverlapped=0x0) returned 1 [0062.008] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG") returned="LINE.JPG" [0062.008] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.008] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xde7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xde7, lpOverlapped=0x0) returned 1 [0062.008] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.008] CloseHandle (hObject=0x9c) returned 1 [0062.008] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg.wannacry")) returned 1 [0062.009] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3b3f, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="LISTBOX.JPG", cAlternateFileName="")) returned 1 [0062.009] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.009] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LISTBOX.JPG") returned -1 [0062.009] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LISTBOX.JPG") returned -1 [0062.009] lstrcmpiA (lpString1="", lpString2="LISTBOX.JPG") returned -1 [0062.009] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG") returned="LINE.JPG" [0062.009] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0062.009] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="" [0062.009] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" [0062.010] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20 [0062.010] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="LISTBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" [0062.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", pszSpec="*.zip") returned 0 [0062.010] lstrlenA (lpString="*.zip") returned 5 [0062.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", pszSpec="*.rar") returned 0 [0062.010] lstrlenA (lpString="*.rar") returned 5 [0062.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", pszSpec="*.7z") returned 0 [0062.010] lstrlenA (lpString="*.7z") returned 4 [0062.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", pszSpec="*.tar") returned 0 [0062.010] lstrlenA (lpString="*.tar") returned 5 [0062.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", pszSpec="*.gzip") returned 0 [0062.010] lstrlenA (lpString="*.gzip") returned 6 [0062.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", pszSpec="*.jpg") returned 1 [0062.010] lstrlenA (lpString="*.jpg") returned 5 [0062.010] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" [0062.010] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" [0062.010] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG." [0062.010] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG.wannacry" [0062.010] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0062.012] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b3f [0062.012] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x66293410, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1 [0062.012] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.012] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3ac1, lpOverlapped=0x0) returned 1 [0062.014] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG") returned="LISTBOX.JPG" [0062.014] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.014] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3ac1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3ac1, lpOverlapped=0x0) returned 1 [0062.014] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.014] CloseHandle (hObject=0x9c) returned 1 [0062.014] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg.wannacry")) returned 1 [0062.015] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6a87fa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x443a, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="NUMERIC.JPG", cAlternateFileName="")) returned 1 [0062.015] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.015] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NUMERIC.JPG") returned -1 [0062.015] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NUMERIC.JPG") returned -1 [0062.015] lstrcmpiA (lpString1="", lpString2="NUMERIC.JPG") returned -1 [0062.016] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG") returned="LISTBOX.JPG" [0062.016] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0062.016] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="" [0062.016] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" [0062.016] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20 [0062.016] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="NUMERIC.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" [0062.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", pszSpec="*.zip") returned 0 [0062.016] lstrlenA (lpString="*.zip") returned 5 [0062.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", pszSpec="*.rar") returned 0 [0062.016] lstrlenA (lpString="*.rar") returned 5 [0062.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", pszSpec="*.7z") returned 0 [0062.016] lstrlenA (lpString="*.7z") returned 4 [0062.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", pszSpec="*.tar") returned 0 [0062.016] lstrlenA (lpString="*.tar") returned 5 [0062.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", pszSpec="*.gzip") returned 0 [0062.016] lstrlenA (lpString="*.gzip") returned 6 [0062.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", pszSpec="*.jpg") returned 1 [0062.016] lstrlenA (lpString="*.jpg") returned 5 [0062.016] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" [0062.016] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" [0062.016] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG." [0062.017] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG.wannacry" [0062.017] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0062.018] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x443a [0062.018] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6a87fa50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1 [0062.018] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.018] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x43bc, lpOverlapped=0x0) returned 1 [0062.020] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG") returned="NUMERIC.JPG" [0062.020] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.020] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x43bc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x43bc, lpOverlapped=0x0) returned 1 [0062.021] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.021] CloseHandle (hObject=0x9c) returned 1 [0062.021] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg.wannacry")) returned 1 [0062.022] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x12f5, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PASSWORD.JPG", cAlternateFileName="")) returned 1 [0062.022] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.022] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PASSWORD.JPG") returned -1 [0062.022] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PASSWORD.JPG") returned -1 [0062.022] lstrcmpiA (lpString1="", lpString2="PASSWORD.JPG") returned -1 [0062.022] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG") returned="NUMERIC.JPG" [0062.022] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0062.022] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="" [0062.022] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" [0062.022] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20 [0062.022] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="PASSWORD.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" [0062.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", pszSpec="*.zip") returned 0 [0062.022] lstrlenA (lpString="*.zip") returned 5 [0062.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", pszSpec="*.rar") returned 0 [0062.022] lstrlenA (lpString="*.rar") returned 5 [0062.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", pszSpec="*.7z") returned 0 [0062.023] lstrlenA (lpString="*.7z") returned 4 [0062.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", pszSpec="*.tar") returned 0 [0062.023] lstrlenA (lpString="*.tar") returned 5 [0062.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", pszSpec="*.gzip") returned 0 [0062.023] lstrlenA (lpString="*.gzip") returned 6 [0062.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", pszSpec="*.jpg") returned 1 [0062.023] lstrlenA (lpString="*.jpg") returned 5 [0062.023] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" [0062.023] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" [0062.023] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG." [0062.023] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG.wannacry" [0062.023] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0062.024] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12f5 [0062.024] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6cd8b0b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1 [0062.024] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.025] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1277, lpOverlapped=0x0) returned 1 [0062.027] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG") returned="PASSWORD.JPG" [0062.027] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.027] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1277, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1277, lpOverlapped=0x0) returned 1 [0062.027] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.027] CloseHandle (hObject=0x9c) returned 1 [0062.027] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg.wannacry")) returned 1 [0062.028] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x43c8, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="RADIO.JPG", cAlternateFileName="")) returned 1 [0062.028] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.028] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RADIO.JPG") returned -1 [0062.028] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RADIO.JPG") returned -1 [0062.028] lstrcmpiA (lpString1="", lpString2="RADIO.JPG") returned -1 [0062.028] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG") returned="PASSWORD.JPG" [0062.028] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0062.028] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="" [0062.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" [0062.028] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20 [0062.029] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="RADIO.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" [0062.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", pszSpec="*.zip") returned 0 [0062.029] lstrlenA (lpString="*.zip") returned 5 [0062.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", pszSpec="*.rar") returned 0 [0062.029] lstrlenA (lpString="*.rar") returned 5 [0062.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", pszSpec="*.7z") returned 0 [0062.029] lstrlenA (lpString="*.7z") returned 4 [0062.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", pszSpec="*.tar") returned 0 [0062.029] lstrlenA (lpString="*.tar") returned 5 [0062.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", pszSpec="*.gzip") returned 0 [0062.029] lstrlenA (lpString="*.gzip") returned 6 [0062.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", pszSpec="*.jpg") returned 1 [0062.029] lstrlenA (lpString="*.jpg") returned 5 [0062.029] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" [0062.029] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" [0062.029] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG." [0062.029] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG.wannacry" [0062.029] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0062.031] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43c8 [0062.031] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a829930, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1 [0062.031] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.031] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x434a, lpOverlapped=0x0) returned 1 [0062.033] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG") returned="RADIO.JPG" [0062.033] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.033] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x434a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x434a, lpOverlapped=0x0) returned 1 [0062.034] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.034] CloseHandle (hObject=0x9c) returned 1 [0062.034] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg.wannacry")) returned 1 [0062.035] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a9342d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3ad9, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="SectionHeading.jpg", cAlternateFileName="SECTIO~1.JPG")) returned 1 [0062.035] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.035] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SectionHeading.jpg") returned -1 [0062.035] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SectionHeading.jpg") returned -1 [0062.035] lstrcmpiA (lpString1="", lpString2="SectionHeading.jpg") returned -1 [0062.035] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG") returned="RADIO.JPG" [0062.035] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0062.035] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="" [0062.035] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" [0062.035] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20 [0062.035] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="SectionHeading.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" [0062.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", pszSpec="*.zip") returned 0 [0062.035] lstrlenA (lpString="*.zip") returned 5 [0062.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", pszSpec="*.rar") returned 0 [0062.036] lstrlenA (lpString="*.rar") returned 5 [0062.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", pszSpec="*.7z") returned 0 [0062.036] lstrlenA (lpString="*.7z") returned 4 [0062.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", pszSpec="*.tar") returned 0 [0062.036] lstrlenA (lpString="*.tar") returned 5 [0062.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", pszSpec="*.gzip") returned 0 [0062.036] lstrlenA (lpString="*.gzip") returned 6 [0062.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", pszSpec="*.jpg") returned 1 [0062.036] lstrlenA (lpString="*.jpg") returned 5 [0062.036] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" [0062.036] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" [0062.036] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg." [0062.036] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg.wannacry" [0062.036] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0062.039] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ad9 [0062.039] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a9342d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1 [0062.039] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.039] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3a5b, lpOverlapped=0x0) returned 1 [0062.042] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg") returned="SectionHeading.jpg" [0062.042] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.042] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3a5b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3a5b, lpOverlapped=0x0) returned 1 [0062.042] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.043] CloseHandle (hObject=0x9c) returned 1 [0062.043] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg.wannacry")) returned 1 [0062.044] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x37a7, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="StaticText.jpg", cAlternateFileName="STATIC~1.JPG")) returned 1 [0062.044] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.044] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StaticText.jpg") returned -1 [0062.044] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StaticText.jpg") returned -1 [0062.044] lstrcmpiA (lpString1="", lpString2="StaticText.jpg") returned -1 [0062.044] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg") returned="SectionHeading.jpg" [0062.044] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0062.044] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="" [0062.044] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" [0062.044] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20 [0062.044] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="StaticText.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" [0062.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", pszSpec="*.zip") returned 0 [0062.044] lstrlenA (lpString="*.zip") returned 5 [0062.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", pszSpec="*.rar") returned 0 [0062.044] lstrlenA (lpString="*.rar") returned 5 [0062.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", pszSpec="*.7z") returned 0 [0062.044] lstrlenA (lpString="*.7z") returned 4 [0062.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", pszSpec="*.tar") returned 0 [0062.045] lstrlenA (lpString="*.tar") returned 5 [0062.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", pszSpec="*.gzip") returned 0 [0062.045] lstrlenA (lpString="*.gzip") returned 6 [0062.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", pszSpec="*.jpg") returned 1 [0062.045] lstrlenA (lpString="*.jpg") returned 5 [0062.045] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" [0062.045] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" [0062.045] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg." [0062.045] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg.wannacry" [0062.045] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0062.046] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x37a7 [0062.046] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5abe1b90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1 [0062.047] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.047] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3729, lpOverlapped=0x0) returned 1 [0062.049] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg") returned="StaticText.jpg" [0062.049] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.049] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3729, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3729, lpOverlapped=0x0) returned 1 [0062.049] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.049] CloseHandle (hObject=0x9c) returned 1 [0062.049] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg.wannacry")) returned 1 [0062.050] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3983, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="TEXTAREA.JPG", cAlternateFileName="")) returned 1 [0062.050] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.050] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TEXTAREA.JPG") returned -1 [0062.050] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TEXTAREA.JPG") returned -1 [0062.050] lstrcmpiA (lpString1="", lpString2="TEXTAREA.JPG") returned -1 [0062.050] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg") returned="StaticText.jpg" [0062.050] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0062.051] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="" [0062.051] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" [0062.051] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20 [0062.051] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="TEXTAREA.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" [0062.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", pszSpec="*.zip") returned 0 [0062.051] lstrlenA (lpString="*.zip") returned 5 [0062.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", pszSpec="*.rar") returned 0 [0062.051] lstrlenA (lpString="*.rar") returned 5 [0062.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", pszSpec="*.7z") returned 0 [0062.051] lstrlenA (lpString="*.7z") returned 4 [0062.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", pszSpec="*.tar") returned 0 [0062.051] lstrlenA (lpString="*.tar") returned 5 [0062.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", pszSpec="*.gzip") returned 0 [0062.051] lstrlenA (lpString="*.gzip") returned 6 [0062.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", pszSpec="*.jpg") returned 1 [0062.051] lstrlenA (lpString="*.jpg") returned 5 [0062.052] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" [0062.052] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" [0062.052] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG." [0062.052] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG.wannacry" [0062.052] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0062.052] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3983 [0062.052] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d462ff0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1 [0062.052] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.052] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3905, lpOverlapped=0x0) returned 1 [0062.054] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG") returned="TEXTAREA.JPG" [0062.054] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.054] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3905, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3905, lpOverlapped=0x0) returned 1 [0062.055] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.055] CloseHandle (hObject=0x9c) returned 1 [0062.055] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg.wannacry")) returned 1 [0062.056] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a97, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="TEXTBOX.JPG", cAlternateFileName="")) returned 1 [0062.056] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.056] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TEXTBOX.JPG") returned -1 [0062.056] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TEXTBOX.JPG") returned -1 [0062.056] lstrcmpiA (lpString1="", lpString2="TEXTBOX.JPG") returned -1 [0062.056] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG") returned="TEXTAREA.JPG" [0062.056] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0062.056] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="" [0062.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" [0062.056] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20 [0062.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="TEXTBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" [0062.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", pszSpec="*.zip") returned 0 [0062.056] lstrlenA (lpString="*.zip") returned 5 [0062.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", pszSpec="*.rar") returned 0 [0062.056] lstrlenA (lpString="*.rar") returned 5 [0062.056] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", pszSpec="*.7z") returned 0 [0062.056] lstrlenA (lpString="*.7z") returned 4 [0062.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", pszSpec="*.tar") returned 0 [0062.057] lstrlenA (lpString="*.tar") returned 5 [0062.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", pszSpec="*.gzip") returned 0 [0062.057] lstrlenA (lpString="*.gzip") returned 6 [0062.057] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", pszSpec="*.jpg") returned 1 [0062.057] lstrlenA (lpString="*.jpg") returned 5 [0062.057] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" [0062.057] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" [0062.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG." [0062.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG.wannacry" [0062.057] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0062.059] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a97 [0062.059] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ad12690, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1 [0062.059] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.059] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3a19, lpOverlapped=0x0) returned 1 [0062.061] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG") returned="TEXTBOX.JPG" [0062.061] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.061] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3a19, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3a19, lpOverlapped=0x0) returned 1 [0062.061] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.062] CloseHandle (hObject=0x9c) returned 1 [0062.062] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg.wannacry")) returned 1 [0062.062] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x42fa, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="TEXTVIEW.JPG", cAlternateFileName="")) returned 1 [0062.063] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.063] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TEXTVIEW.JPG") returned -1 [0062.063] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TEXTVIEW.JPG") returned -1 [0062.063] lstrcmpiA (lpString1="", lpString2="TEXTVIEW.JPG") returned -1 [0062.063] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG") returned="TEXTBOX.JPG" [0062.063] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0062.063] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="" [0062.063] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" [0062.063] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20 [0062.063] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="TEXTVIEW.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" [0062.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", pszSpec="*.zip") returned 0 [0062.063] lstrlenA (lpString="*.zip") returned 5 [0062.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", pszSpec="*.rar") returned 0 [0062.063] lstrlenA (lpString="*.rar") returned 5 [0062.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", pszSpec="*.7z") returned 0 [0062.063] lstrlenA (lpString="*.7z") returned 4 [0062.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", pszSpec="*.tar") returned 0 [0062.063] lstrlenA (lpString="*.tar") returned 5 [0062.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", pszSpec="*.gzip") returned 0 [0062.063] lstrlenA (lpString="*.gzip") returned 6 [0062.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", pszSpec="*.jpg") returned 1 [0062.064] lstrlenA (lpString="*.jpg") returned 5 [0062.064] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" [0062.064] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" [0062.064] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG." [0062.064] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG.wannacry" [0062.064] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0062.065] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x42fa [0062.065] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d462ff0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea)) returned 1 [0062.065] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.065] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x427c, lpOverlapped=0x0) returned 1 [0062.068] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG") returned="TEXTVIEW.JPG" [0062.068] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.068] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x427c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x427c, lpOverlapped=0x0) returned 1 [0062.068] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.068] CloseHandle (hObject=0x9c) returned 1 [0062.068] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg.wannacry")) returned 1 [0062.069] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4127, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="UnformattedNumeric.jpg", cAlternateFileName="UNFORM~1.JPG")) returned 1 [0062.069] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.069] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UnformattedNumeric.jpg") returned -1 [0062.069] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UnformattedNumeric.jpg") returned -1 [0062.069] lstrcmpiA (lpString1="", lpString2="UnformattedNumeric.jpg") returned -1 [0062.069] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG") returned="TEXTVIEW.JPG" [0062.069] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0062.069] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="" [0062.069] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" [0062.069] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\how to decrypt files.txt")) returned 0x20 [0062.070] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="UnformattedNumeric.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" [0062.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", pszSpec="*.zip") returned 0 [0062.070] lstrlenA (lpString="*.zip") returned 5 [0062.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", pszSpec="*.rar") returned 0 [0062.070] lstrlenA (lpString="*.rar") returned 5 [0062.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", pszSpec="*.7z") returned 0 [0062.070] lstrlenA (lpString="*.7z") returned 4 [0062.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", pszSpec="*.tar") returned 0 [0062.070] lstrlenA (lpString="*.tar") returned 5 [0062.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", pszSpec="*.gzip") returned 0 [0062.070] lstrlenA (lpString="*.gzip") returned 6 [0062.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", pszSpec="*.jpg") returned 1 [0062.070] lstrlenA (lpString="*.jpg") returned 5 [0062.070] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" [0062.070] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" [0062.070] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg." [0062.070] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg.wannacry" [0062.070] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0062.071] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4127 [0062.071] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e3d2090, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea)) returned 1 [0062.071] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.071] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x40a9, lpOverlapped=0x0) returned 1 [0062.073] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg") returned="UnformattedNumeric.jpg" [0062.073] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.073] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x40a9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x40a9, lpOverlapped=0x0) returned 1 [0062.073] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.074] CloseHandle (hObject=0x9c) returned 1 [0062.074] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg.wannacry")) returned 1 [0062.075] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4127, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="UnformattedNumeric.jpg", cAlternateFileName="UNFORM~1.JPG")) returned 0 [0062.075] FindClose (in: hFindFile=0x2d80f0 | out: hFindFile=0x2d80f0) returned 1 [0062.075] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="FORM.ICO", cAlternateFileName="")) returned 1 [0062.075] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.075] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FORM.ICO") returned -1 [0062.075] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FORM.ICO") returned 1 [0062.075] lstrcmpiA (lpString1="", lpString2="FORM.ICO") returned -1 [0062.075] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*.*") returned="*.*" [0062.075] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0062.075] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0062.075] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0062.075] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0062.075] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FORM.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO" [0062.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.zip") returned 0 [0062.075] lstrlenA (lpString="*.zip") returned 5 [0062.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.rar") returned 0 [0062.075] lstrlenA (lpString="*.rar") returned 5 [0062.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.7z") returned 0 [0062.075] lstrlenA (lpString="*.7z") returned 4 [0062.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.tar") returned 0 [0062.076] lstrlenA (lpString="*.tar") returned 5 [0062.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.gzip") returned 0 [0062.076] lstrlenA (lpString="*.gzip") returned 6 [0062.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.jpg") returned 0 [0062.076] lstrlenA (lpString="*.jpg") returned 5 [0062.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.jpeg") returned 0 [0062.076] lstrlenA (lpString="*.jpeg") returned 6 [0062.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.psd") returned 0 [0062.076] lstrlenA (lpString="*.psd") returned 5 [0062.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.gif") returned 0 [0062.076] lstrlenA (lpString="*.gif") returned 5 [0062.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.doc") returned 0 [0062.076] lstrlenA (lpString="*.doc") returned 5 [0062.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.docx") returned 0 [0062.076] lstrlenA (lpString="*.docx") returned 6 [0062.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.xls") returned 0 [0062.076] lstrlenA (lpString="*.xls") returned 5 [0062.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.xlsx") returned 0 [0062.076] lstrlenA (lpString="*.xlsx") returned 6 [0062.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.ppt") returned 0 [0062.076] lstrlenA (lpString="*.ppt") returned 5 [0062.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.pptx") returned 0 [0062.076] lstrlenA (lpString="*.pptx") returned 6 [0062.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.pdf") returned 0 [0062.076] lstrlenA (lpString="*.pdf") returned 5 [0062.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.mov") returned 0 [0062.077] lstrlenA (lpString="*.mov") returned 5 [0062.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.m2v") returned 0 [0062.077] lstrlenA (lpString="*.m2v") returned 5 [0062.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.3gp") returned 0 [0062.077] lstrlenA (lpString="*.3gp") returned 5 [0062.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.mpeg") returned 0 [0062.077] lstrlenA (lpString="*.mpeg") returned 6 [0062.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.mpg") returned 0 [0062.077] lstrlenA (lpString="*.mpg") returned 5 [0062.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.flv") returned 0 [0062.077] lstrlenA (lpString="*.flv") returned 5 [0062.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.avi") returned 0 [0062.077] lstrlenA (lpString="*.avi") returned 5 [0062.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.mp4") returned 0 [0062.077] lstrlenA (lpString="*.mp4") returned 5 [0062.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.wmv") returned 0 [0062.077] lstrlenA (lpString="*.wmv") returned 5 [0062.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.divx") returned 0 [0062.077] lstrlenA (lpString="*.divx") returned 6 [0062.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.mkv") returned 0 [0062.077] lstrlenA (lpString="*.mkv") returned 5 [0062.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.mp3") returned 0 [0062.077] lstrlenA (lpString="*.mp3") returned 5 [0062.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.wav") returned 0 [0062.077] lstrlenA (lpString="*.wav") returned 5 [0062.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.flac") returned 0 [0062.078] lstrlenA (lpString="*.flac") returned 6 [0062.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.ape") returned 0 [0062.078] lstrlenA (lpString="*.ape") returned 5 [0062.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.wma") returned 0 [0062.078] lstrlenA (lpString="*.wma") returned 5 [0062.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.ac3") returned 0 [0062.078] lstrlenA (lpString="*.ac3") returned 5 [0062.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.mxf") returned 0 [0062.078] lstrlenA (lpString="*.mxf") returned 5 [0062.078] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4b2, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="FormsBlankPage.html", cAlternateFileName="FORMSB~1.HTM")) returned 1 [0062.078] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.078] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsBlankPage.html") returned -1 [0062.078] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsBlankPage.html") returned 1 [0062.078] lstrcmpiA (lpString1="", lpString2="FormsBlankPage.html") returned -1 [0062.078] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO") returned="FORM.ICO" [0062.078] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0062.078] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0062.078] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0062.078] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0062.078] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html" [0062.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.zip") returned 0 [0062.078] lstrlenA (lpString="*.zip") returned 5 [0062.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.rar") returned 0 [0062.079] lstrlenA (lpString="*.rar") returned 5 [0062.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.7z") returned 0 [0062.079] lstrlenA (lpString="*.7z") returned 4 [0062.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.tar") returned 0 [0062.079] lstrlenA (lpString="*.tar") returned 5 [0062.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.gzip") returned 0 [0062.079] lstrlenA (lpString="*.gzip") returned 6 [0062.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.jpg") returned 0 [0062.079] lstrlenA (lpString="*.jpg") returned 5 [0062.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.jpeg") returned 0 [0062.079] lstrlenA (lpString="*.jpeg") returned 6 [0062.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.psd") returned 0 [0062.079] lstrlenA (lpString="*.psd") returned 5 [0062.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.gif") returned 0 [0062.079] lstrlenA (lpString="*.gif") returned 5 [0062.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.doc") returned 0 [0062.079] lstrlenA (lpString="*.doc") returned 5 [0062.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.docx") returned 0 [0062.079] lstrlenA (lpString="*.docx") returned 6 [0062.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.xls") returned 0 [0062.079] lstrlenA (lpString="*.xls") returned 5 [0062.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.xlsx") returned 0 [0062.079] lstrlenA (lpString="*.xlsx") returned 6 [0062.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.ppt") returned 0 [0062.079] lstrlenA (lpString="*.ppt") returned 5 [0062.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.pptx") returned 0 [0062.080] lstrlenA (lpString="*.pptx") returned 6 [0062.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.pdf") returned 0 [0062.080] lstrlenA (lpString="*.pdf") returned 5 [0062.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.mov") returned 0 [0062.080] lstrlenA (lpString="*.mov") returned 5 [0062.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.m2v") returned 0 [0062.080] lstrlenA (lpString="*.m2v") returned 5 [0062.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.3gp") returned 0 [0062.080] lstrlenA (lpString="*.3gp") returned 5 [0062.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.mpeg") returned 0 [0062.080] lstrlenA (lpString="*.mpeg") returned 6 [0062.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.mpg") returned 0 [0062.080] lstrlenA (lpString="*.mpg") returned 5 [0062.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.flv") returned 0 [0062.080] lstrlenA (lpString="*.flv") returned 5 [0062.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.avi") returned 0 [0062.080] lstrlenA (lpString="*.avi") returned 5 [0062.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.mp4") returned 0 [0062.080] lstrlenA (lpString="*.mp4") returned 5 [0062.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.wmv") returned 0 [0062.080] lstrlenA (lpString="*.wmv") returned 5 [0062.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.divx") returned 0 [0062.080] lstrlenA (lpString="*.divx") returned 6 [0062.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.mkv") returned 0 [0062.080] lstrlenA (lpString="*.mkv") returned 5 [0062.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.mp3") returned 0 [0062.080] lstrlenA (lpString="*.mp3") returned 5 [0062.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.wav") returned 0 [0062.081] lstrlenA (lpString="*.wav") returned 5 [0062.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.flac") returned 0 [0062.081] lstrlenA (lpString="*.flac") returned 6 [0062.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.ape") returned 0 [0062.081] lstrlenA (lpString="*.ape") returned 5 [0062.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.wma") returned 0 [0062.081] lstrlenA (lpString="*.wma") returned 5 [0062.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.ac3") returned 0 [0062.081] lstrlenA (lpString="*.ac3") returned 5 [0062.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.mxf") returned 0 [0062.081] lstrlenA (lpString="*.mxf") returned 5 [0062.081] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7a7, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="FormsBrowserUpgrade.html", cAlternateFileName="FORMSB~2.HTM")) returned 1 [0062.081] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.081] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsBrowserUpgrade.html") returned -1 [0062.081] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsBrowserUpgrade.html") returned 1 [0062.081] lstrcmpiA (lpString1="", lpString2="FormsBrowserUpgrade.html") returned -1 [0062.081] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html") returned="FormsBlankPage.html" [0062.081] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0062.081] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0062.081] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0062.081] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0062.081] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html" [0062.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.zip") returned 0 [0062.081] lstrlenA (lpString="*.zip") returned 5 [0062.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.rar") returned 0 [0062.081] lstrlenA (lpString="*.rar") returned 5 [0062.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.7z") returned 0 [0062.081] lstrlenA (lpString="*.7z") returned 4 [0062.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.tar") returned 0 [0062.082] lstrlenA (lpString="*.tar") returned 5 [0062.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.gzip") returned 0 [0062.082] lstrlenA (lpString="*.gzip") returned 6 [0062.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.jpg") returned 0 [0062.082] lstrlenA (lpString="*.jpg") returned 5 [0062.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.jpeg") returned 0 [0062.082] lstrlenA (lpString="*.jpeg") returned 6 [0062.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.psd") returned 0 [0062.082] lstrlenA (lpString="*.psd") returned 5 [0062.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.gif") returned 0 [0062.082] lstrlenA (lpString="*.gif") returned 5 [0062.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.doc") returned 0 [0062.082] lstrlenA (lpString="*.doc") returned 5 [0062.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.docx") returned 0 [0062.082] lstrlenA (lpString="*.docx") returned 6 [0062.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.xls") returned 0 [0062.082] lstrlenA (lpString="*.xls") returned 5 [0062.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.xlsx") returned 0 [0062.082] lstrlenA (lpString="*.xlsx") returned 6 [0062.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.ppt") returned 0 [0062.082] lstrlenA (lpString="*.ppt") returned 5 [0062.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.pptx") returned 0 [0062.082] lstrlenA (lpString="*.pptx") returned 6 [0062.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.pdf") returned 0 [0062.082] lstrlenA (lpString="*.pdf") returned 5 [0062.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.mov") returned 0 [0062.082] lstrlenA (lpString="*.mov") returned 5 [0062.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.m2v") returned 0 [0062.083] lstrlenA (lpString="*.m2v") returned 5 [0062.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.3gp") returned 0 [0062.083] lstrlenA (lpString="*.3gp") returned 5 [0062.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.mpeg") returned 0 [0062.083] lstrlenA (lpString="*.mpeg") returned 6 [0062.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.mpg") returned 0 [0062.083] lstrlenA (lpString="*.mpg") returned 5 [0062.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.flv") returned 0 [0062.083] lstrlenA (lpString="*.flv") returned 5 [0062.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.avi") returned 0 [0062.083] lstrlenA (lpString="*.avi") returned 5 [0062.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.mp4") returned 0 [0062.083] lstrlenA (lpString="*.mp4") returned 5 [0062.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.wmv") returned 0 [0062.083] lstrlenA (lpString="*.wmv") returned 5 [0062.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.divx") returned 0 [0062.083] lstrlenA (lpString="*.divx") returned 6 [0062.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.mkv") returned 0 [0062.083] lstrlenA (lpString="*.mkv") returned 5 [0062.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.mp3") returned 0 [0062.083] lstrlenA (lpString="*.mp3") returned 5 [0062.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.wav") returned 0 [0062.083] lstrlenA (lpString="*.wav") returned 5 [0062.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.flac") returned 0 [0062.083] lstrlenA (lpString="*.flac") returned 6 [0062.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.ape") returned 0 [0062.083] lstrlenA (lpString="*.ape") returned 5 [0062.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.wma") returned 0 [0062.083] lstrlenA (lpString="*.wma") returned 5 [0062.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.ac3") returned 0 [0062.083] lstrlenA (lpString="*.ac3") returned 5 [0062.084] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.mxf") returned 0 [0062.084] lstrlenA (lpString="*.mxf") returned 5 [0062.084] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x805, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="FormsDoNotTrust.html", cAlternateFileName="FORMSD~1.HTM")) returned 1 [0062.084] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.084] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsDoNotTrust.html") returned -1 [0062.084] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsDoNotTrust.html") returned 1 [0062.084] lstrcmpiA (lpString1="", lpString2="FormsDoNotTrust.html") returned -1 [0062.084] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html") returned="FormsBrowserUpgrade.html" [0062.084] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0062.084] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0062.084] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0062.084] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0062.084] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsDoNotTrust.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html" [0062.084] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.zip") returned 0 [0062.084] lstrlenA (lpString="*.zip") returned 5 [0062.084] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.rar") returned 0 [0062.084] lstrlenA (lpString="*.rar") returned 5 [0062.084] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.7z") returned 0 [0062.084] lstrlenA (lpString="*.7z") returned 4 [0062.084] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.tar") returned 0 [0062.084] lstrlenA (lpString="*.tar") returned 5 [0062.084] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.gzip") returned 0 [0062.084] lstrlenA (lpString="*.gzip") returned 6 [0062.084] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.jpg") returned 0 [0062.084] lstrlenA (lpString="*.jpg") returned 5 [0062.084] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.jpeg") returned 0 [0062.085] lstrlenA (lpString="*.jpeg") returned 6 [0062.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.psd") returned 0 [0062.085] lstrlenA (lpString="*.psd") returned 5 [0062.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.gif") returned 0 [0062.085] lstrlenA (lpString="*.gif") returned 5 [0062.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.doc") returned 0 [0062.085] lstrlenA (lpString="*.doc") returned 5 [0062.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.docx") returned 0 [0062.085] lstrlenA (lpString="*.docx") returned 6 [0062.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.xls") returned 0 [0062.085] lstrlenA (lpString="*.xls") returned 5 [0062.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.xlsx") returned 0 [0062.085] lstrlenA (lpString="*.xlsx") returned 6 [0062.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.ppt") returned 0 [0062.085] lstrlenA (lpString="*.ppt") returned 5 [0062.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.pptx") returned 0 [0062.085] lstrlenA (lpString="*.pptx") returned 6 [0062.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.pdf") returned 0 [0062.085] lstrlenA (lpString="*.pdf") returned 5 [0062.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.mov") returned 0 [0062.085] lstrlenA (lpString="*.mov") returned 5 [0062.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.m2v") returned 0 [0062.085] lstrlenA (lpString="*.m2v") returned 5 [0062.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.3gp") returned 0 [0062.085] lstrlenA (lpString="*.3gp") returned 5 [0062.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.mpeg") returned 0 [0062.085] lstrlenA (lpString="*.mpeg") returned 6 [0062.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.mpg") returned 0 [0062.085] lstrlenA (lpString="*.mpg") returned 5 [0062.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.flv") returned 0 [0062.086] lstrlenA (lpString="*.flv") returned 5 [0062.086] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.avi") returned 0 [0062.086] lstrlenA (lpString="*.avi") returned 5 [0062.086] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.mp4") returned 0 [0062.086] lstrlenA (lpString="*.mp4") returned 5 [0062.086] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.wmv") returned 0 [0062.086] lstrlenA (lpString="*.wmv") returned 5 [0062.086] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.divx") returned 0 [0062.086] lstrlenA (lpString="*.divx") returned 6 [0062.086] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.mkv") returned 0 [0062.086] lstrlenA (lpString="*.mkv") returned 5 [0062.086] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.mp3") returned 0 [0062.086] lstrlenA (lpString="*.mp3") returned 5 [0062.086] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.wav") returned 0 [0062.086] lstrlenA (lpString="*.wav") returned 5 [0062.086] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.flac") returned 0 [0062.086] lstrlenA (lpString="*.flac") returned 6 [0062.086] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.ape") returned 0 [0062.086] lstrlenA (lpString="*.ape") returned 5 [0062.086] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.wma") returned 0 [0062.086] lstrlenA (lpString="*.wma") returned 5 [0062.086] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.ac3") returned 0 [0062.086] lstrlenA (lpString="*.ac3") returned 5 [0062.086] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.mxf") returned 0 [0062.086] lstrlenA (lpString="*.mxf") returned 5 [0062.086] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc96, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="FormsHomePage.html", cAlternateFileName="FORMSH~1.HTM")) returned 1 [0062.086] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.086] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsHomePage.html") returned -1 [0062.086] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsHomePage.html") returned 1 [0062.086] lstrcmpiA (lpString1="", lpString2="FormsHomePage.html") returned -1 [0062.087] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html") returned="FormsDoNotTrust.html" [0062.087] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0062.087] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0062.087] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0062.087] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0062.087] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsHomePage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html" [0062.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.zip") returned 0 [0062.087] lstrlenA (lpString="*.zip") returned 5 [0062.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.rar") returned 0 [0062.087] lstrlenA (lpString="*.rar") returned 5 [0062.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.7z") returned 0 [0062.087] lstrlenA (lpString="*.7z") returned 4 [0062.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.tar") returned 0 [0062.087] lstrlenA (lpString="*.tar") returned 5 [0062.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.gzip") returned 0 [0062.087] lstrlenA (lpString="*.gzip") returned 6 [0062.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.jpg") returned 0 [0062.087] lstrlenA (lpString="*.jpg") returned 5 [0062.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.jpeg") returned 0 [0062.087] lstrlenA (lpString="*.jpeg") returned 6 [0062.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.psd") returned 0 [0062.087] lstrlenA (lpString="*.psd") returned 5 [0062.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.gif") returned 0 [0062.087] lstrlenA (lpString="*.gif") returned 5 [0062.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.doc") returned 0 [0062.087] lstrlenA (lpString="*.doc") returned 5 [0062.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.docx") returned 0 [0062.087] lstrlenA (lpString="*.docx") returned 6 [0062.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.xls") returned 0 [0062.088] lstrlenA (lpString="*.xls") returned 5 [0062.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.xlsx") returned 0 [0062.088] lstrlenA (lpString="*.xlsx") returned 6 [0062.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.ppt") returned 0 [0062.088] lstrlenA (lpString="*.ppt") returned 5 [0062.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.pptx") returned 0 [0062.088] lstrlenA (lpString="*.pptx") returned 6 [0062.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.pdf") returned 0 [0062.088] lstrlenA (lpString="*.pdf") returned 5 [0062.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.mov") returned 0 [0062.088] lstrlenA (lpString="*.mov") returned 5 [0062.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.m2v") returned 0 [0062.088] lstrlenA (lpString="*.m2v") returned 5 [0062.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.3gp") returned 0 [0062.088] lstrlenA (lpString="*.3gp") returned 5 [0062.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.mpeg") returned 0 [0062.088] lstrlenA (lpString="*.mpeg") returned 6 [0062.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.mpg") returned 0 [0062.088] lstrlenA (lpString="*.mpg") returned 5 [0062.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.flv") returned 0 [0062.088] lstrlenA (lpString="*.flv") returned 5 [0062.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.avi") returned 0 [0062.088] lstrlenA (lpString="*.avi") returned 5 [0062.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.mp4") returned 0 [0062.088] lstrlenA (lpString="*.mp4") returned 5 [0062.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.wmv") returned 0 [0062.088] lstrlenA (lpString="*.wmv") returned 5 [0062.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.divx") returned 0 [0062.088] lstrlenA (lpString="*.divx") returned 6 [0062.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.mkv") returned 0 [0062.088] lstrlenA (lpString="*.mkv") returned 5 [0062.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.mp3") returned 0 [0062.089] lstrlenA (lpString="*.mp3") returned 5 [0062.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.wav") returned 0 [0062.089] lstrlenA (lpString="*.wav") returned 5 [0062.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.flac") returned 0 [0062.089] lstrlenA (lpString="*.flac") returned 6 [0062.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.ape") returned 0 [0062.089] lstrlenA (lpString="*.ape") returned 5 [0062.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.wma") returned 0 [0062.089] lstrlenA (lpString="*.wma") returned 5 [0062.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.ac3") returned 0 [0062.089] lstrlenA (lpString="*.ac3") returned 5 [0062.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.mxf") returned 0 [0062.089] lstrlenA (lpString="*.mxf") returned 5 [0062.089] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x15fc, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="FormsHomePageScript.js", cAlternateFileName="FORMSH~1.JS")) returned 1 [0062.089] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.089] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsHomePageScript.js") returned -1 [0062.089] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsHomePageScript.js") returned 1 [0062.089] lstrcmpiA (lpString1="", lpString2="FormsHomePageScript.js") returned -1 [0062.089] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html") returned="FormsHomePage.html" [0062.089] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0062.089] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0062.089] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0062.089] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0062.090] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsHomePageScript.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js" [0062.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.zip") returned 0 [0062.090] lstrlenA (lpString="*.zip") returned 5 [0062.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.rar") returned 0 [0062.090] lstrlenA (lpString="*.rar") returned 5 [0062.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.7z") returned 0 [0062.090] lstrlenA (lpString="*.7z") returned 4 [0062.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.tar") returned 0 [0062.090] lstrlenA (lpString="*.tar") returned 5 [0062.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.gzip") returned 0 [0062.090] lstrlenA (lpString="*.gzip") returned 6 [0062.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.jpg") returned 0 [0062.090] lstrlenA (lpString="*.jpg") returned 5 [0062.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.jpeg") returned 0 [0062.090] lstrlenA (lpString="*.jpeg") returned 6 [0062.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.psd") returned 0 [0062.090] lstrlenA (lpString="*.psd") returned 5 [0062.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.gif") returned 0 [0062.090] lstrlenA (lpString="*.gif") returned 5 [0062.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.doc") returned 0 [0062.090] lstrlenA (lpString="*.doc") returned 5 [0062.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.docx") returned 0 [0062.090] lstrlenA (lpString="*.docx") returned 6 [0062.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.xls") returned 0 [0062.090] lstrlenA (lpString="*.xls") returned 5 [0062.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.xlsx") returned 0 [0062.090] lstrlenA (lpString="*.xlsx") returned 6 [0062.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.ppt") returned 0 [0062.091] lstrlenA (lpString="*.ppt") returned 5 [0062.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.pptx") returned 0 [0062.091] lstrlenA (lpString="*.pptx") returned 6 [0062.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.pdf") returned 0 [0062.091] lstrlenA (lpString="*.pdf") returned 5 [0062.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.mov") returned 0 [0062.091] lstrlenA (lpString="*.mov") returned 5 [0062.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.m2v") returned 0 [0062.091] lstrlenA (lpString="*.m2v") returned 5 [0062.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.3gp") returned 0 [0062.091] lstrlenA (lpString="*.3gp") returned 5 [0062.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.mpeg") returned 0 [0062.091] lstrlenA (lpString="*.mpeg") returned 6 [0062.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.mpg") returned 0 [0062.091] lstrlenA (lpString="*.mpg") returned 5 [0062.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.flv") returned 0 [0062.091] lstrlenA (lpString="*.flv") returned 5 [0062.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.avi") returned 0 [0062.091] lstrlenA (lpString="*.avi") returned 5 [0062.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.mp4") returned 0 [0062.092] lstrlenA (lpString="*.mp4") returned 5 [0062.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.wmv") returned 0 [0062.092] lstrlenA (lpString="*.wmv") returned 5 [0062.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.divx") returned 0 [0062.092] lstrlenA (lpString="*.divx") returned 6 [0062.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.mkv") returned 0 [0062.092] lstrlenA (lpString="*.mkv") returned 5 [0062.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.mp3") returned 0 [0062.092] lstrlenA (lpString="*.mp3") returned 5 [0062.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.wav") returned 0 [0062.092] lstrlenA (lpString="*.wav") returned 5 [0062.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.flac") returned 0 [0062.092] lstrlenA (lpString="*.flac") returned 6 [0062.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.ape") returned 0 [0062.092] lstrlenA (lpString="*.ape") returned 5 [0062.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.wma") returned 0 [0062.092] lstrlenA (lpString="*.wma") returned 5 [0062.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.ac3") returned 0 [0062.092] lstrlenA (lpString="*.ac3") returned 5 [0062.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.mxf") returned 0 [0062.092] lstrlenA (lpString="*.mxf") returned 5 [0062.092] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x40c, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="FormsHomePageStyle.css", cAlternateFileName="FORMSH~1.CSS")) returned 1 [0062.092] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.092] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsHomePageStyle.css") returned -1 [0062.092] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsHomePageStyle.css") returned 1 [0062.092] lstrcmpiA (lpString1="", lpString2="FormsHomePageStyle.css") returned -1 [0062.093] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js") returned="FormsHomePageScript.js" [0062.093] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0062.093] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0062.093] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0062.093] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0062.093] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsHomePageStyle.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css" [0062.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.zip") returned 0 [0062.093] lstrlenA (lpString="*.zip") returned 5 [0062.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.rar") returned 0 [0062.093] lstrlenA (lpString="*.rar") returned 5 [0062.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.7z") returned 0 [0062.093] lstrlenA (lpString="*.7z") returned 4 [0062.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.tar") returned 0 [0062.093] lstrlenA (lpString="*.tar") returned 5 [0062.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.gzip") returned 0 [0062.093] lstrlenA (lpString="*.gzip") returned 6 [0062.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.jpg") returned 0 [0062.093] lstrlenA (lpString="*.jpg") returned 5 [0062.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.jpeg") returned 0 [0062.093] lstrlenA (lpString="*.jpeg") returned 6 [0062.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.psd") returned 0 [0062.093] lstrlenA (lpString="*.psd") returned 5 [0062.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.gif") returned 0 [0062.093] lstrlenA (lpString="*.gif") returned 5 [0062.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.doc") returned 0 [0062.094] lstrlenA (lpString="*.doc") returned 5 [0062.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.docx") returned 0 [0062.094] lstrlenA (lpString="*.docx") returned 6 [0062.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.xls") returned 0 [0062.094] lstrlenA (lpString="*.xls") returned 5 [0062.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.xlsx") returned 0 [0062.094] lstrlenA (lpString="*.xlsx") returned 6 [0062.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.ppt") returned 0 [0062.094] lstrlenA (lpString="*.ppt") returned 5 [0062.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.pptx") returned 0 [0062.094] lstrlenA (lpString="*.pptx") returned 6 [0062.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.pdf") returned 0 [0062.094] lstrlenA (lpString="*.pdf") returned 5 [0062.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.mov") returned 0 [0062.094] lstrlenA (lpString="*.mov") returned 5 [0062.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.m2v") returned 0 [0062.094] lstrlenA (lpString="*.m2v") returned 5 [0062.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.3gp") returned 0 [0062.095] lstrlenA (lpString="*.3gp") returned 5 [0062.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.mpeg") returned 0 [0062.095] lstrlenA (lpString="*.mpeg") returned 6 [0062.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.mpg") returned 0 [0062.095] lstrlenA (lpString="*.mpg") returned 5 [0062.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.flv") returned 0 [0062.095] lstrlenA (lpString="*.flv") returned 5 [0062.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.avi") returned 0 [0062.095] lstrlenA (lpString="*.avi") returned 5 [0062.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.mp4") returned 0 [0062.095] lstrlenA (lpString="*.mp4") returned 5 [0062.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.wmv") returned 0 [0062.095] lstrlenA (lpString="*.wmv") returned 5 [0062.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.divx") returned 0 [0062.095] lstrlenA (lpString="*.divx") returned 6 [0062.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.mkv") returned 0 [0062.095] lstrlenA (lpString="*.mkv") returned 5 [0062.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.mp3") returned 0 [0062.095] lstrlenA (lpString="*.mp3") returned 5 [0062.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.wav") returned 0 [0062.095] lstrlenA (lpString="*.wav") returned 5 [0062.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.flac") returned 0 [0062.095] lstrlenA (lpString="*.flac") returned 6 [0062.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.ape") returned 0 [0062.095] lstrlenA (lpString="*.ape") returned 5 [0062.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.wma") returned 0 [0062.095] lstrlenA (lpString="*.wma") returned 5 [0062.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.ac3") returned 0 [0062.096] lstrlenA (lpString="*.ac3") returned 5 [0062.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.mxf") returned 0 [0062.096] lstrlenA (lpString="*.mxf") returned 5 [0062.096] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="FormsPreviewTemplate.html", cAlternateFileName="FORMSP~2.HTM")) returned 1 [0062.096] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.096] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsPreviewTemplate.html") returned -1 [0062.096] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPreviewTemplate.html") returned 1 [0062.096] lstrcmpiA (lpString1="", lpString2="FormsPreviewTemplate.html") returned -1 [0062.096] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css") returned="FormsHomePageStyle.css" [0062.096] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0062.096] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0062.096] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0062.096] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0062.096] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html" [0062.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.zip") returned 0 [0062.096] lstrlenA (lpString="*.zip") returned 5 [0062.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.rar") returned 0 [0062.096] lstrlenA (lpString="*.rar") returned 5 [0062.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.7z") returned 0 [0062.096] lstrlenA (lpString="*.7z") returned 4 [0062.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.tar") returned 0 [0062.096] lstrlenA (lpString="*.tar") returned 5 [0062.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.gzip") returned 0 [0062.096] lstrlenA (lpString="*.gzip") returned 6 [0062.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.jpg") returned 0 [0062.097] lstrlenA (lpString="*.jpg") returned 5 [0062.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.jpeg") returned 0 [0062.097] lstrlenA (lpString="*.jpeg") returned 6 [0062.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.psd") returned 0 [0062.097] lstrlenA (lpString="*.psd") returned 5 [0062.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.gif") returned 0 [0062.097] lstrlenA (lpString="*.gif") returned 5 [0062.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.doc") returned 0 [0062.097] lstrlenA (lpString="*.doc") returned 5 [0062.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.docx") returned 0 [0062.097] lstrlenA (lpString="*.docx") returned 6 [0062.097] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x262, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="FormsPrintTemplate.html", cAlternateFileName="FORMSP~1.HTM")) returned 1 [0062.097] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.097] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsPrintTemplate.html") returned -1 [0062.097] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPrintTemplate.html") returned 1 [0062.097] lstrcmpiA (lpString1="", lpString2="FormsPrintTemplate.html") returned -1 [0062.097] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html") returned="FormsPreviewTemplate.html" [0062.097] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0062.098] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0062.098] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0062.098] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0062.098] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html" [0062.098] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="FormsTemplates", cAlternateFileName="FORMST~1")) returned 1 [0062.098] lstrcmpA (lpString1=".", lpString2="FormsTemplates") returned -1 [0062.098] lstrcmpA (lpString1="..", lpString2="FormsTemplates") returned -1 [0062.098] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html") returned="FormsPrintTemplate.html" [0062.098] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsTemplates" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates" [0062.098] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f220, dwReserved1=0x2d8264, cFileName=".", cAlternateFileName="")) returned 0x2d80f0 [0062.102] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.102] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0062.102] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.102] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.102] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2021e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Customer Support.fdt", cAlternateFileName="CUSTOM~1.FDT")) returned 1 [0062.102] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.103] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Customer Support.fdt") returned 1 [0062.103] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Customer Support.fdt") returned 1 [0062.103] lstrcmpiA (lpString1="", lpString2="Customer Support.fdt") returned -1 [0062.103] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\*.*") returned="*.*" [0062.103] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" [0062.103] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned="" [0062.103] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt" [0062.103] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\how to decrypt files.txt")) returned 0xffffffff [0062.103] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0062.107] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.108] CloseHandle (hObject=0x9c) returned 1 [0062.108] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="Customer Support.fdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt" [0062.108] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x20b43, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hardware Tracker.fdt", cAlternateFileName="HARDWA~1.FDT")) returned 1 [0062.108] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.108] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Hardware Tracker.fdt") returned -1 [0062.108] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Hardware Tracker.fdt") returned 1 [0062.108] lstrcmpiA (lpString1="", lpString2="Hardware Tracker.fdt") returned -1 [0062.108] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt") returned="Customer Support.fdt" [0062.108] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" [0062.108] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned="" [0062.108] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt" [0062.108] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\how to decrypt files.txt")) returned 0x20 [0062.108] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="Hardware Tracker.fdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt" [0062.108] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x24051, dwReserved0=0x6d0072, dwReserved1=0x540073, cFileName="Hiring Requisition - Customized.fdt", cAlternateFileName="HIRING~2.FDT")) returned 1 [0062.108] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.108] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Hiring Requisition - Customized.fdt") returned -1 [0062.108] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Hiring Requisition - Customized.fdt") returned 1 [0062.108] lstrcmpiA (lpString1="", lpString2="Hiring Requisition - Customized.fdt") returned -1 [0062.108] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt") returned="Hardware Tracker.fdt" [0062.108] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" [0062.108] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned="" [0062.109] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt" [0062.109] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\how to decrypt files.txt")) returned 0x20 [0062.109] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="Hiring Requisition - Customized.fdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt" [0062.109] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x248db, dwReserved0=0x6d0072, dwReserved1=0x540073, cFileName="Hiring Requisition.fdt", cAlternateFileName="HIRING~1.FDT")) returned 1 [0062.109] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.109] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Hiring Requisition.fdt") returned -1 [0062.109] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Hiring Requisition.fdt") returned 1 [0062.109] lstrcmpiA (lpString1="", lpString2="Hiring Requisition.fdt") returned -1 [0062.109] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt") returned="Hiring Requisition - Customized.fdt" [0062.109] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" [0062.109] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned="" [0062.109] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt" [0062.109] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\how to decrypt files.txt")) returned 0x20 [0062.109] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="Hiring Requisition.fdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt" [0062.109] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a52fdb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x17d6d, dwReserved0=0x6d0072, dwReserved1=0x540073, cFileName="POLICIES.FDT", cAlternateFileName="")) returned 1 [0062.109] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.109] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="POLICIES.FDT") returned -1 [0062.109] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="POLICIES.FDT") returned -1 [0062.109] lstrcmpiA (lpString1="", lpString2="POLICIES.FDT") returned -1 [0062.109] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt") returned="Hiring Requisition.fdt" [0062.109] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" [0062.109] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned="" [0062.109] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt" [0062.109] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\how to decrypt files.txt")) returned 0x20 [0062.110] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="POLICIES.FDT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT" [0062.110] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16b33, dwReserved0=0x6d0072, dwReserved1=0x540073, cFileName="Process Library.fdt", cAlternateFileName="PROCES~1.FDT")) returned 1 [0062.110] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.110] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Process Library.fdt") returned -1 [0062.110] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Process Library.fdt") returned -1 [0062.110] lstrcmpiA (lpString1="", lpString2="Process Library.fdt") returned -1 [0062.110] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT") returned="POLICIES.FDT" [0062.110] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" [0062.110] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned="" [0062.110] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt" [0062.110] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\how to decrypt files.txt")) returned 0x20 [0062.110] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="Process Library.fdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt" [0062.110] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x18ead, dwReserved0=0x6d0072, dwReserved1=0x540073, cFileName="Status Report.fdt", cAlternateFileName="STATUS~1.FDT")) returned 1 [0062.110] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.110] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Status Report.fdt") returned -1 [0062.110] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Status Report.fdt") returned -1 [0062.110] lstrcmpiA (lpString1="", lpString2="Status Report.fdt") returned -1 [0062.110] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt") returned="Process Library.fdt" [0062.110] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" [0062.110] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned="" [0062.110] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt" [0062.110] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\how to decrypt files.txt")) returned 0x20 [0062.110] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="Status Report.fdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt" [0062.110] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e666, dwReserved0=0x6d0072, dwReserved1=0x540073, cFileName="Track Issues.fdt", cAlternateFileName="TRACKI~1.FDT")) returned 1 [0062.111] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.111] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Track Issues.fdt") returned -1 [0062.111] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Track Issues.fdt") returned -1 [0062.111] lstrcmpiA (lpString1="", lpString2="Track Issues.fdt") returned -1 [0062.111] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt") returned="Status Report.fdt" [0062.111] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" [0062.111] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned="" [0062.111] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt" [0062.111] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\how to decrypt files.txt")) returned 0x20 [0062.111] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="Track Issues.fdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt" [0062.111] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e666, dwReserved0=0x6d0072, dwReserved1=0x540073, cFileName="Track Issues.fdt", cAlternateFileName="TRACKI~1.FDT")) returned 0 [0062.111] FindClose (in: hFindFile=0x2d80f0 | out: hFindFile=0x2d80f0) returned 1 [0062.111] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6fc, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="FormsVersion1Warning.htm", cAlternateFileName="FORMSV~1.HTM")) returned 1 [0062.111] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.111] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsVersion1Warning.htm") returned -1 [0062.111] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsVersion1Warning.htm") returned 1 [0062.111] lstrcmpiA (lpString1="", lpString2="FormsVersion1Warning.htm") returned -1 [0062.111] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*.*") returned="*.*" [0062.111] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0062.111] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0062.111] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0062.111] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0062.111] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsVersion1Warning.htm" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm" [0062.112] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1499, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="FormsViewAttachmentIcons.jpg", cAlternateFileName="FORMSV~1.JPG")) returned 1 [0062.112] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.112] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsViewAttachmentIcons.jpg") returned -1 [0062.112] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewAttachmentIcons.jpg") returned 1 [0062.112] lstrcmpiA (lpString1="", lpString2="FormsViewAttachmentIcons.jpg") returned -1 [0062.112] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm") returned="FormsVersion1Warning.htm" [0062.112] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0062.112] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0062.112] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0062.112] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0062.112] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" [0062.112] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" [0062.112] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" [0062.112] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg." [0062.112] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg.wannacry" [0062.112] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.114] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1499 [0062.114] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea)) returned 1 [0062.114] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.114] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x141b, lpOverlapped=0x0) returned 1 [0062.116] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg") returned="FormsViewAttachmentIcons.jpg" [0062.116] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.116] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x141b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x141b, lpOverlapped=0x0) returned 1 [0062.116] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.116] CloseHandle (hObject=0x98) returned 1 [0062.116] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg.wannacry")) returned 1 [0062.117] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="FormsViewAttachmentIconsMask.bmp", cAlternateFileName="FORMSV~1.BMP")) returned 1 [0062.117] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.117] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsViewAttachmentIconsMask.bmp") returned -1 [0062.117] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewAttachmentIconsMask.bmp") returned 1 [0062.117] lstrcmpiA (lpString1="", lpString2="FormsViewAttachmentIconsMask.bmp") returned -1 [0062.117] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg") returned="FormsViewAttachmentIcons.jpg" [0062.117] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0062.117] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0062.117] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0062.117] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0062.118] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp" [0062.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.zip") returned 0 [0062.118] lstrlenA (lpString="*.zip") returned 5 [0062.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.rar") returned 0 [0062.118] lstrlenA (lpString="*.rar") returned 5 [0062.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.7z") returned 0 [0062.118] lstrlenA (lpString="*.7z") returned 4 [0062.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.tar") returned 0 [0062.118] lstrlenA (lpString="*.tar") returned 5 [0062.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.gzip") returned 0 [0062.118] lstrlenA (lpString="*.gzip") returned 6 [0062.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.jpg") returned 0 [0062.118] lstrlenA (lpString="*.jpg") returned 5 [0062.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.jpeg") returned 0 [0062.118] lstrlenA (lpString="*.jpeg") returned 6 [0062.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.psd") returned 0 [0062.118] lstrlenA (lpString="*.psd") returned 5 [0062.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.gif") returned 0 [0062.118] lstrlenA (lpString="*.gif") returned 5 [0062.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.doc") returned 0 [0062.118] lstrlenA (lpString="*.doc") returned 5 [0062.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.docx") returned 0 [0062.118] lstrlenA (lpString="*.docx") returned 6 [0062.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.xls") returned 0 [0062.118] lstrlenA (lpString="*.xls") returned 5 [0062.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.xlsx") returned 0 [0062.118] lstrlenA (lpString="*.xlsx") returned 6 [0062.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.ppt") returned 0 [0062.119] lstrlenA (lpString="*.ppt") returned 5 [0062.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.pptx") returned 0 [0062.119] lstrlenA (lpString="*.pptx") returned 6 [0062.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.pdf") returned 0 [0062.119] lstrlenA (lpString="*.pdf") returned 5 [0062.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mov") returned 0 [0062.119] lstrlenA (lpString="*.mov") returned 5 [0062.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.m2v") returned 0 [0062.119] lstrlenA (lpString="*.m2v") returned 5 [0062.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.3gp") returned 0 [0062.119] lstrlenA (lpString="*.3gp") returned 5 [0062.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mpeg") returned 0 [0062.119] lstrlenA (lpString="*.mpeg") returned 6 [0062.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mpg") returned 0 [0062.119] lstrlenA (lpString="*.mpg") returned 5 [0062.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.flv") returned 0 [0062.119] lstrlenA (lpString="*.flv") returned 5 [0062.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.avi") returned 0 [0062.119] lstrlenA (lpString="*.avi") returned 5 [0062.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mp4") returned 0 [0062.119] lstrlenA (lpString="*.mp4") returned 5 [0062.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.wmv") returned 0 [0062.119] lstrlenA (lpString="*.wmv") returned 5 [0062.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.divx") returned 0 [0062.119] lstrlenA (lpString="*.divx") returned 6 [0062.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mkv") returned 0 [0062.119] lstrlenA (lpString="*.mkv") returned 5 [0062.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mp3") returned 0 [0062.119] lstrlenA (lpString="*.mp3") returned 5 [0062.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.wav") returned 0 [0062.119] lstrlenA (lpString="*.wav") returned 5 [0062.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.flac") returned 0 [0062.120] lstrlenA (lpString="*.flac") returned 6 [0062.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.ape") returned 0 [0062.120] lstrlenA (lpString="*.ape") returned 5 [0062.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.wma") returned 0 [0062.120] lstrlenA (lpString="*.wma") returned 5 [0062.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.ac3") returned 0 [0062.120] lstrlenA (lpString="*.ac3") returned 5 [0062.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mxf") returned 0 [0062.120] lstrlenA (lpString="*.mxf") returned 5 [0062.120] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xfa1, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="FormsViewFrame.html", cAlternateFileName="FORMSV~2.HTM")) returned 1 [0062.120] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.120] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsViewFrame.html") returned -1 [0062.120] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewFrame.html") returned 1 [0062.120] lstrcmpiA (lpString1="", lpString2="FormsViewFrame.html") returned -1 [0062.120] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp") returned="FormsViewAttachmentIconsMask.bmp" [0062.120] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0062.120] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0062.120] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0062.120] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0062.120] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsViewFrame.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html" [0062.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.zip") returned 0 [0062.120] lstrlenA (lpString="*.zip") returned 5 [0062.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.rar") returned 0 [0062.120] lstrlenA (lpString="*.rar") returned 5 [0062.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.7z") returned 0 [0062.120] lstrlenA (lpString="*.7z") returned 4 [0062.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.tar") returned 0 [0062.121] lstrlenA (lpString="*.tar") returned 5 [0062.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.gzip") returned 0 [0062.121] lstrlenA (lpString="*.gzip") returned 6 [0062.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.jpg") returned 0 [0062.121] lstrlenA (lpString="*.jpg") returned 5 [0062.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.jpeg") returned 0 [0062.121] lstrlenA (lpString="*.jpeg") returned 6 [0062.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.psd") returned 0 [0062.121] lstrlenA (lpString="*.psd") returned 5 [0062.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.gif") returned 0 [0062.121] lstrlenA (lpString="*.gif") returned 5 [0062.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.doc") returned 0 [0062.121] lstrlenA (lpString="*.doc") returned 5 [0062.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.docx") returned 0 [0062.121] lstrlenA (lpString="*.docx") returned 6 [0062.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.xls") returned 0 [0062.121] lstrlenA (lpString="*.xls") returned 5 [0062.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.xlsx") returned 0 [0062.121] lstrlenA (lpString="*.xlsx") returned 6 [0062.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.ppt") returned 0 [0062.121] lstrlenA (lpString="*.ppt") returned 5 [0062.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.pptx") returned 0 [0062.121] lstrlenA (lpString="*.pptx") returned 6 [0062.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.pdf") returned 0 [0062.121] lstrlenA (lpString="*.pdf") returned 5 [0062.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.mov") returned 0 [0062.121] lstrlenA (lpString="*.mov") returned 5 [0062.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.m2v") returned 0 [0062.121] lstrlenA (lpString="*.m2v") returned 5 [0062.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.3gp") returned 0 [0062.121] lstrlenA (lpString="*.3gp") returned 5 [0062.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.mpeg") returned 0 [0062.122] lstrlenA (lpString="*.mpeg") returned 6 [0062.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.mpg") returned 0 [0062.122] lstrlenA (lpString="*.mpg") returned 5 [0062.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.flv") returned 0 [0062.122] lstrlenA (lpString="*.flv") returned 5 [0062.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.avi") returned 0 [0062.122] lstrlenA (lpString="*.avi") returned 5 [0062.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.mp4") returned 0 [0062.122] lstrlenA (lpString="*.mp4") returned 5 [0062.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.wmv") returned 0 [0062.122] lstrlenA (lpString="*.wmv") returned 5 [0062.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.divx") returned 0 [0062.122] lstrlenA (lpString="*.divx") returned 6 [0062.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.mkv") returned 0 [0062.122] lstrlenA (lpString="*.mkv") returned 5 [0062.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.mp3") returned 0 [0062.122] lstrlenA (lpString="*.mp3") returned 5 [0062.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.wav") returned 0 [0062.122] lstrlenA (lpString="*.wav") returned 5 [0062.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.flac") returned 0 [0062.122] lstrlenA (lpString="*.flac") returned 6 [0062.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.ape") returned 0 [0062.122] lstrlenA (lpString="*.ape") returned 5 [0062.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.wma") returned 0 [0062.122] lstrlenA (lpString="*.wma") returned 5 [0062.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.ac3") returned 0 [0062.122] lstrlenA (lpString="*.ac3") returned 5 [0062.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.mxf") returned 0 [0062.122] lstrlenA (lpString="*.mxf") returned 5 [0062.122] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x529b4870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1bfb, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="FormToolImages.jpg", cAlternateFileName="FORMTO~1.JPG")) returned 1 [0062.122] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.123] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormToolImages.jpg") returned -1 [0062.123] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormToolImages.jpg") returned 1 [0062.123] lstrcmpiA (lpString1="", lpString2="FormToolImages.jpg") returned -1 [0062.123] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html") returned="FormsViewFrame.html" [0062.123] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0062.123] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0062.123] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0062.123] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0062.123] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" [0062.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", pszSpec="*.zip") returned 0 [0062.123] lstrlenA (lpString="*.zip") returned 5 [0062.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", pszSpec="*.rar") returned 0 [0062.123] lstrlenA (lpString="*.rar") returned 5 [0062.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", pszSpec="*.7z") returned 0 [0062.123] lstrlenA (lpString="*.7z") returned 4 [0062.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", pszSpec="*.tar") returned 0 [0062.123] lstrlenA (lpString="*.tar") returned 5 [0062.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", pszSpec="*.gzip") returned 0 [0062.123] lstrlenA (lpString="*.gzip") returned 6 [0062.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", pszSpec="*.jpg") returned 1 [0062.123] lstrlenA (lpString="*.jpg") returned 5 [0062.123] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" [0062.123] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" [0062.123] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg." [0062.123] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg.wannacry" [0062.123] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.125] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1bfb [0062.125] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x529b4870, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea)) returned 1 [0062.125] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.125] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1b7d, lpOverlapped=0x0) returned 1 [0062.126] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg") returned="FormToolImages.jpg" [0062.126] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.126] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1b7d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1b7d, lpOverlapped=0x0) returned 1 [0062.127] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.127] CloseHandle (hObject=0x98) returned 1 [0062.127] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg.wannacry")) returned 1 [0062.129] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x167d1, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="GrooveFormsMetaData.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0062.129] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.129] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GrooveFormsMetaData.xml") returned -1 [0062.129] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GrooveFormsMetaData.xml") returned 1 [0062.129] lstrcmpiA (lpString1="", lpString2="GrooveFormsMetaData.xml") returned -1 [0062.129] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg") returned="FormToolImages.jpg" [0062.129] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0062.129] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0062.129] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0062.130] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0062.130] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="GrooveFormsMetaData.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml" [0062.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.zip") returned 0 [0062.130] lstrlenA (lpString="*.zip") returned 5 [0062.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.rar") returned 0 [0062.130] lstrlenA (lpString="*.rar") returned 5 [0062.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.7z") returned 0 [0062.130] lstrlenA (lpString="*.7z") returned 4 [0062.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.tar") returned 0 [0062.130] lstrlenA (lpString="*.tar") returned 5 [0062.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.gzip") returned 0 [0062.130] lstrlenA (lpString="*.gzip") returned 6 [0062.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.jpg") returned 0 [0062.130] lstrlenA (lpString="*.jpg") returned 5 [0062.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.jpeg") returned 0 [0062.130] lstrlenA (lpString="*.jpeg") returned 6 [0062.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.psd") returned 0 [0062.130] lstrlenA (lpString="*.psd") returned 5 [0062.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.gif") returned 0 [0062.130] lstrlenA (lpString="*.gif") returned 5 [0062.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.doc") returned 0 [0062.130] lstrlenA (lpString="*.doc") returned 5 [0062.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.docx") returned 0 [0062.130] lstrlenA (lpString="*.docx") returned 6 [0062.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.xls") returned 0 [0062.130] lstrlenA (lpString="*.xls") returned 5 [0062.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.xlsx") returned 0 [0062.130] lstrlenA (lpString="*.xlsx") returned 6 [0062.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.ppt") returned 0 [0062.130] lstrlenA (lpString="*.ppt") returned 5 [0062.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.pptx") returned 0 [0062.131] lstrlenA (lpString="*.pptx") returned 6 [0062.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.pdf") returned 0 [0062.131] lstrlenA (lpString="*.pdf") returned 5 [0062.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.mov") returned 0 [0062.131] lstrlenA (lpString="*.mov") returned 5 [0062.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.m2v") returned 0 [0062.131] lstrlenA (lpString="*.m2v") returned 5 [0062.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.3gp") returned 0 [0062.131] lstrlenA (lpString="*.3gp") returned 5 [0062.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.mpeg") returned 0 [0062.131] lstrlenA (lpString="*.mpeg") returned 6 [0062.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.mpg") returned 0 [0062.131] lstrlenA (lpString="*.mpg") returned 5 [0062.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.flv") returned 0 [0062.131] lstrlenA (lpString="*.flv") returned 5 [0062.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.avi") returned 0 [0062.131] lstrlenA (lpString="*.avi") returned 5 [0062.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.mp4") returned 0 [0062.131] lstrlenA (lpString="*.mp4") returned 5 [0062.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.wmv") returned 0 [0062.131] lstrlenA (lpString="*.wmv") returned 5 [0062.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.divx") returned 0 [0062.131] lstrlenA (lpString="*.divx") returned 6 [0062.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.mkv") returned 0 [0062.131] lstrlenA (lpString="*.mkv") returned 5 [0062.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.mp3") returned 0 [0062.131] lstrlenA (lpString="*.mp3") returned 5 [0062.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.wav") returned 0 [0062.131] lstrlenA (lpString="*.wav") returned 5 [0062.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.flac") returned 0 [0062.131] lstrlenA (lpString="*.flac") returned 6 [0062.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.ape") returned 0 [0062.131] lstrlenA (lpString="*.ape") returned 5 [0062.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.wma") returned 0 [0062.132] lstrlenA (lpString="*.wma") returned 5 [0062.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.ac3") returned 0 [0062.132] lstrlenA (lpString="*.ac3") returned 5 [0062.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.mxf") returned 0 [0062.132] lstrlenA (lpString="*.mxf") returned 5 [0062.132] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x360, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0062.132] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.132] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0062.132] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0062.132] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xca6, dwReserved0=0x18f3cc, dwReserved1=0x4f0048, cFileName="MENUS.JS", cAlternateFileName="")) returned 1 [0062.132] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.132] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MENUS.JS") returned -1 [0062.132] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MENUS.JS") returned -1 [0062.132] lstrcmpiA (lpString1="", lpString2="MENUS.JS") returned -1 [0062.132] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml") returned="GrooveFormsMetaData.xml" [0062.132] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0062.132] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0062.132] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0062.132] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0062.132] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="MENUS.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS" [0062.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.zip") returned 0 [0062.132] lstrlenA (lpString="*.zip") returned 5 [0062.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.rar") returned 0 [0062.132] lstrlenA (lpString="*.rar") returned 5 [0062.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.7z") returned 0 [0062.132] lstrlenA (lpString="*.7z") returned 4 [0062.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.tar") returned 0 [0062.132] lstrlenA (lpString="*.tar") returned 5 [0062.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.gzip") returned 0 [0062.133] lstrlenA (lpString="*.gzip") returned 6 [0062.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.jpg") returned 0 [0062.133] lstrlenA (lpString="*.jpg") returned 5 [0062.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.jpeg") returned 0 [0062.133] lstrlenA (lpString="*.jpeg") returned 6 [0062.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.psd") returned 0 [0062.133] lstrlenA (lpString="*.psd") returned 5 [0062.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.gif") returned 0 [0062.133] lstrlenA (lpString="*.gif") returned 5 [0062.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.doc") returned 0 [0062.133] lstrlenA (lpString="*.doc") returned 5 [0062.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.docx") returned 0 [0062.133] lstrlenA (lpString="*.docx") returned 6 [0062.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.xls") returned 0 [0062.133] lstrlenA (lpString="*.xls") returned 5 [0062.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.xlsx") returned 0 [0062.133] lstrlenA (lpString="*.xlsx") returned 6 [0062.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.ppt") returned 0 [0062.133] lstrlenA (lpString="*.ppt") returned 5 [0062.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.pptx") returned 0 [0062.133] lstrlenA (lpString="*.pptx") returned 6 [0062.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.pdf") returned 0 [0062.133] lstrlenA (lpString="*.pdf") returned 5 [0062.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.mov") returned 0 [0062.133] lstrlenA (lpString="*.mov") returned 5 [0062.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.m2v") returned 0 [0062.133] lstrlenA (lpString="*.m2v") returned 5 [0062.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.3gp") returned 0 [0062.133] lstrlenA (lpString="*.3gp") returned 5 [0062.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.mpeg") returned 0 [0062.133] lstrlenA (lpString="*.mpeg") returned 6 [0062.133] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.mpg") returned 0 [0062.133] lstrlenA (lpString="*.mpg") returned 5 [0062.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.flv") returned 0 [0062.134] lstrlenA (lpString="*.flv") returned 5 [0062.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.avi") returned 0 [0062.134] lstrlenA (lpString="*.avi") returned 5 [0062.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.mp4") returned 0 [0062.134] lstrlenA (lpString="*.mp4") returned 5 [0062.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.wmv") returned 0 [0062.134] lstrlenA (lpString="*.wmv") returned 5 [0062.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.divx") returned 0 [0062.134] lstrlenA (lpString="*.divx") returned 6 [0062.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.mkv") returned 0 [0062.134] lstrlenA (lpString="*.mkv") returned 5 [0062.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.mp3") returned 0 [0062.134] lstrlenA (lpString="*.mp3") returned 5 [0062.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.wav") returned 0 [0062.134] lstrlenA (lpString="*.wav") returned 5 [0062.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.flac") returned 0 [0062.134] lstrlenA (lpString="*.flac") returned 6 [0062.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.ape") returned 0 [0062.134] lstrlenA (lpString="*.ape") returned 5 [0062.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.wma") returned 0 [0062.134] lstrlenA (lpString="*.wma") returned 5 [0062.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.ac3") returned 0 [0062.134] lstrlenA (lpString="*.ac3") returned 5 [0062.134] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.mxf") returned 0 [0062.134] lstrlenA (lpString="*.mxf") returned 5 [0062.134] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5836a590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x33a, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="menu_arrow.gif", cAlternateFileName="MENU_A~1.GIF")) returned 1 [0062.134] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.134] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="menu_arrow.gif") returned -1 [0062.134] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="menu_arrow.gif") returned -1 [0062.134] lstrcmpiA (lpString1="", lpString2="menu_arrow.gif") returned -1 [0062.134] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS") returned="MENUS.JS" [0062.134] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0062.135] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0062.135] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0062.135] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0062.135] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="menu_arrow.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" [0062.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.zip") returned 0 [0062.135] lstrlenA (lpString="*.zip") returned 5 [0062.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.rar") returned 0 [0062.135] lstrlenA (lpString="*.rar") returned 5 [0062.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.7z") returned 0 [0062.135] lstrlenA (lpString="*.7z") returned 4 [0062.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.tar") returned 0 [0062.135] lstrlenA (lpString="*.tar") returned 5 [0062.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.gzip") returned 0 [0062.135] lstrlenA (lpString="*.gzip") returned 6 [0062.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.jpg") returned 0 [0062.135] lstrlenA (lpString="*.jpg") returned 5 [0062.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.jpeg") returned 0 [0062.135] lstrlenA (lpString="*.jpeg") returned 6 [0062.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.psd") returned 0 [0062.135] lstrlenA (lpString="*.psd") returned 5 [0062.135] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.gif") returned 1 [0062.135] lstrlenA (lpString="*.gif") returned 5 [0062.135] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" [0062.135] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" [0062.135] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif." [0062.135] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif.wannacry" [0062.135] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.137] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x33a [0062.137] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5836a590, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea)) returned 1 [0062.137] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.137] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2bc, lpOverlapped=0x0) returned 1 [0062.138] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif") returned="menu_arrow.gif" [0062.138] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.138] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2bc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2bc, lpOverlapped=0x0) returned 1 [0062.139] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.139] CloseHandle (hObject=0x98) returned 1 [0062.139] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif.wannacry")) returned 1 [0062.140] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d273e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4af, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="SEARCH.GIF", cAlternateFileName="")) returned 1 [0062.140] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.140] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SEARCH.GIF") returned -1 [0062.140] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SEARCH.GIF") returned -1 [0062.140] lstrcmpiA (lpString1="", lpString2="SEARCH.GIF") returned -1 [0062.140] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif") returned="menu_arrow.gif" [0062.140] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0062.140] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0062.140] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0062.140] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0062.140] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="SEARCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF" [0062.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.zip") returned 0 [0062.140] lstrlenA (lpString="*.zip") returned 5 [0062.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.rar") returned 0 [0062.140] lstrlenA (lpString="*.rar") returned 5 [0062.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.7z") returned 0 [0062.140] lstrlenA (lpString="*.7z") returned 4 [0062.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.tar") returned 0 [0062.140] lstrlenA (lpString="*.tar") returned 5 [0062.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.gzip") returned 0 [0062.140] lstrlenA (lpString="*.gzip") returned 6 [0062.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.jpg") returned 0 [0062.140] lstrlenA (lpString="*.jpg") returned 5 [0062.140] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.jpeg") returned 0 [0062.140] lstrlenA (lpString="*.jpeg") returned 6 [0062.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.psd") returned 0 [0062.141] lstrlenA (lpString="*.psd") returned 5 [0062.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.gif") returned 1 [0062.141] lstrlenA (lpString="*.gif") returned 5 [0062.141] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF" [0062.141] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF" [0062.141] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF." [0062.141] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF.wannacry" [0062.141] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\search.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.142] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4af [0062.142] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8acda200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d273e10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8acda200, dwHighDateTime=0x1c747ea)) returned 1 [0062.142] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.142] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x431, lpOverlapped=0x0) returned 1 [0062.144] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF") returned="SEARCH.GIF" [0062.144] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.144] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x431, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x431, lpOverlapped=0x0) returned 1 [0062.144] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.144] CloseHandle (hObject=0x98) returned 1 [0062.144] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\search.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\search.gif.wannacry")) returned 1 [0062.145] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x31, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="SPACER.GIF", cAlternateFileName="")) returned 1 [0062.145] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.145] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SPACER.GIF") returned -1 [0062.145] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SPACER.GIF") returned -1 [0062.145] lstrcmpiA (lpString1="", lpString2="SPACER.GIF") returned -1 [0062.145] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF") returned="SEARCH.GIF" [0062.145] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0062.146] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0062.146] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0062.146] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0062.146] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="SPACER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF" [0062.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.zip") returned 0 [0062.146] lstrlenA (lpString="*.zip") returned 5 [0062.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.rar") returned 0 [0062.146] lstrlenA (lpString="*.rar") returned 5 [0062.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.7z") returned 0 [0062.146] lstrlenA (lpString="*.7z") returned 4 [0062.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.tar") returned 0 [0062.146] lstrlenA (lpString="*.tar") returned 5 [0062.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.gzip") returned 0 [0062.146] lstrlenA (lpString="*.gzip") returned 6 [0062.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.jpg") returned 0 [0062.146] lstrlenA (lpString="*.jpg") returned 5 [0062.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.jpeg") returned 0 [0062.146] lstrlenA (lpString="*.jpeg") returned 6 [0062.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.psd") returned 0 [0062.146] lstrlenA (lpString="*.psd") returned 5 [0062.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.gif") returned 1 [0062.147] lstrlenA (lpString="*.gif") returned 5 [0062.147] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF" [0062.147] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF" [0062.147] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF." [0062.147] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF.wannacry" [0062.147] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\spacer.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.148] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x31 [0062.148] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8acda200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d3a4910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8acda200, dwHighDateTime=0x1c747ea)) returned 1 [0062.148] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.148] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0062.148] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.148] CloseHandle (hObject=0x98) returned 1 [0062.148] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\spacer.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\spacer.gif.wannacry")) returned 1 [0062.149] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc118, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="SUBMIT.JS", cAlternateFileName="")) returned 1 [0062.149] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.149] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SUBMIT.JS") returned -1 [0062.149] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SUBMIT.JS") returned -1 [0062.149] lstrcmpiA (lpString1="", lpString2="SUBMIT.JS") returned -1 [0062.149] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF") returned="SPACER.GIF" [0062.149] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0062.149] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0062.149] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0062.149] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0062.149] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="SUBMIT.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS" [0062.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.zip") returned 0 [0062.149] lstrlenA (lpString="*.zip") returned 5 [0062.149] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.rar") returned 0 [0062.150] lstrlenA (lpString="*.rar") returned 5 [0062.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.7z") returned 0 [0062.150] lstrlenA (lpString="*.7z") returned 4 [0062.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.tar") returned 0 [0062.150] lstrlenA (lpString="*.tar") returned 5 [0062.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.gzip") returned 0 [0062.150] lstrlenA (lpString="*.gzip") returned 6 [0062.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.jpg") returned 0 [0062.150] lstrlenA (lpString="*.jpg") returned 5 [0062.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.jpeg") returned 0 [0062.150] lstrlenA (lpString="*.jpeg") returned 6 [0062.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.psd") returned 0 [0062.150] lstrlenA (lpString="*.psd") returned 5 [0062.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.gif") returned 0 [0062.150] lstrlenA (lpString="*.gif") returned 5 [0062.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.doc") returned 0 [0062.150] lstrlenA (lpString="*.doc") returned 5 [0062.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.docx") returned 0 [0062.150] lstrlenA (lpString="*.docx") returned 6 [0062.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.xls") returned 0 [0062.150] lstrlenA (lpString="*.xls") returned 5 [0062.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.xlsx") returned 0 [0062.150] lstrlenA (lpString="*.xlsx") returned 6 [0062.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.ppt") returned 0 [0062.150] lstrlenA (lpString="*.ppt") returned 5 [0062.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.pptx") returned 0 [0062.150] lstrlenA (lpString="*.pptx") returned 6 [0062.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.pdf") returned 0 [0062.150] lstrlenA (lpString="*.pdf") returned 5 [0062.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.mov") returned 0 [0062.150] lstrlenA (lpString="*.mov") returned 5 [0062.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.m2v") returned 0 [0062.151] lstrlenA (lpString="*.m2v") returned 5 [0062.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.3gp") returned 0 [0062.151] lstrlenA (lpString="*.3gp") returned 5 [0062.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.mpeg") returned 0 [0062.151] lstrlenA (lpString="*.mpeg") returned 6 [0062.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.mpg") returned 0 [0062.151] lstrlenA (lpString="*.mpg") returned 5 [0062.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.flv") returned 0 [0062.151] lstrlenA (lpString="*.flv") returned 5 [0062.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.avi") returned 0 [0062.151] lstrlenA (lpString="*.avi") returned 5 [0062.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.mp4") returned 0 [0062.151] lstrlenA (lpString="*.mp4") returned 5 [0062.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.wmv") returned 0 [0062.151] lstrlenA (lpString="*.wmv") returned 5 [0062.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.divx") returned 0 [0062.151] lstrlenA (lpString="*.divx") returned 6 [0062.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.mkv") returned 0 [0062.151] lstrlenA (lpString="*.mkv") returned 5 [0062.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.mp3") returned 0 [0062.151] lstrlenA (lpString="*.mp3") returned 5 [0062.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.wav") returned 0 [0062.151] lstrlenA (lpString="*.wav") returned 5 [0062.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.flac") returned 0 [0062.151] lstrlenA (lpString="*.flac") returned 6 [0062.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.ape") returned 0 [0062.151] lstrlenA (lpString="*.ape") returned 5 [0062.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.wma") returned 0 [0062.151] lstrlenA (lpString="*.wma") returned 5 [0062.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.ac3") returned 0 [0062.151] lstrlenA (lpString="*.ac3") returned 5 [0062.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.mxf") returned 0 [0062.152] lstrlenA (lpString="*.mxf") returned 5 [0062.152] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e41e350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x103f, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="utilityfunctions.js", cAlternateFileName="UTILIT~1.JS")) returned 1 [0062.152] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.152] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="utilityfunctions.js") returned -1 [0062.152] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="utilityfunctions.js") returned -1 [0062.152] lstrcmpiA (lpString1="", lpString2="utilityfunctions.js") returned -1 [0062.152] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS") returned="SUBMIT.JS" [0062.152] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0062.152] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0062.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0062.152] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0062.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="utilityfunctions.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js" [0062.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.zip") returned 0 [0062.152] lstrlenA (lpString="*.zip") returned 5 [0062.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.rar") returned 0 [0062.152] lstrlenA (lpString="*.rar") returned 5 [0062.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.7z") returned 0 [0062.152] lstrlenA (lpString="*.7z") returned 4 [0062.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.tar") returned 0 [0062.152] lstrlenA (lpString="*.tar") returned 5 [0062.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.gzip") returned 0 [0062.152] lstrlenA (lpString="*.gzip") returned 6 [0062.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.jpg") returned 0 [0062.152] lstrlenA (lpString="*.jpg") returned 5 [0062.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.jpeg") returned 0 [0062.152] lstrlenA (lpString="*.jpeg") returned 6 [0062.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.psd") returned 0 [0062.152] lstrlenA (lpString="*.psd") returned 5 [0062.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.gif") returned 0 [0062.153] lstrlenA (lpString="*.gif") returned 5 [0062.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.doc") returned 0 [0062.153] lstrlenA (lpString="*.doc") returned 5 [0062.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.docx") returned 0 [0062.153] lstrlenA (lpString="*.docx") returned 6 [0062.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.xls") returned 0 [0062.153] lstrlenA (lpString="*.xls") returned 5 [0062.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.xlsx") returned 0 [0062.153] lstrlenA (lpString="*.xlsx") returned 6 [0062.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.ppt") returned 0 [0062.153] lstrlenA (lpString="*.ppt") returned 5 [0062.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.pptx") returned 0 [0062.153] lstrlenA (lpString="*.pptx") returned 6 [0062.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.pdf") returned 0 [0062.153] lstrlenA (lpString="*.pdf") returned 5 [0062.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.mov") returned 0 [0062.153] lstrlenA (lpString="*.mov") returned 5 [0062.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.m2v") returned 0 [0062.153] lstrlenA (lpString="*.m2v") returned 5 [0062.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.3gp") returned 0 [0062.153] lstrlenA (lpString="*.3gp") returned 5 [0062.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.mpeg") returned 0 [0062.153] lstrlenA (lpString="*.mpeg") returned 6 [0062.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.mpg") returned 0 [0062.153] lstrlenA (lpString="*.mpg") returned 5 [0062.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.flv") returned 0 [0062.153] lstrlenA (lpString="*.flv") returned 5 [0062.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.avi") returned 0 [0062.153] lstrlenA (lpString="*.avi") returned 5 [0062.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.mp4") returned 0 [0062.153] lstrlenA (lpString="*.mp4") returned 5 [0062.153] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.wmv") returned 0 [0062.154] lstrlenA (lpString="*.wmv") returned 5 [0062.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.divx") returned 0 [0062.154] lstrlenA (lpString="*.divx") returned 6 [0062.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.mkv") returned 0 [0062.154] lstrlenA (lpString="*.mkv") returned 5 [0062.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.mp3") returned 0 [0062.154] lstrlenA (lpString="*.mp3") returned 5 [0062.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.wav") returned 0 [0062.154] lstrlenA (lpString="*.wav") returned 5 [0062.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.flac") returned 0 [0062.154] lstrlenA (lpString="*.flac") returned 6 [0062.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.ape") returned 0 [0062.154] lstrlenA (lpString="*.ape") returned 5 [0062.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.wma") returned 0 [0062.154] lstrlenA (lpString="*.wma") returned 5 [0062.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.ac3") returned 0 [0062.154] lstrlenA (lpString="*.ac3") returned 5 [0062.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.mxf") returned 0 [0062.154] lstrlenA (lpString="*.mxf") returned 5 [0062.154] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35d6, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="validation.js", cAlternateFileName="VALIDA~1.JS")) returned 1 [0062.154] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.154] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="validation.js") returned -1 [0062.154] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="validation.js") returned -1 [0062.154] lstrcmpiA (lpString1="", lpString2="validation.js") returned -1 [0062.154] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js") returned="utilityfunctions.js" [0062.154] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0062.154] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0062.154] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0062.154] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0062.154] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="validation.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js" [0062.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.zip") returned 0 [0062.155] lstrlenA (lpString="*.zip") returned 5 [0062.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.rar") returned 0 [0062.155] lstrlenA (lpString="*.rar") returned 5 [0062.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.7z") returned 0 [0062.155] lstrlenA (lpString="*.7z") returned 4 [0062.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.tar") returned 0 [0062.155] lstrlenA (lpString="*.tar") returned 5 [0062.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.gzip") returned 0 [0062.155] lstrlenA (lpString="*.gzip") returned 6 [0062.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.jpg") returned 0 [0062.155] lstrlenA (lpString="*.jpg") returned 5 [0062.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.jpeg") returned 0 [0062.155] lstrlenA (lpString="*.jpeg") returned 6 [0062.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.psd") returned 0 [0062.155] lstrlenA (lpString="*.psd") returned 5 [0062.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.gif") returned 0 [0062.155] lstrlenA (lpString="*.gif") returned 5 [0062.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.doc") returned 0 [0062.155] lstrlenA (lpString="*.doc") returned 5 [0062.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.docx") returned 0 [0062.155] lstrlenA (lpString="*.docx") returned 6 [0062.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.xls") returned 0 [0062.155] lstrlenA (lpString="*.xls") returned 5 [0062.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.xlsx") returned 0 [0062.155] lstrlenA (lpString="*.xlsx") returned 6 [0062.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.ppt") returned 0 [0062.155] lstrlenA (lpString="*.ppt") returned 5 [0062.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.pptx") returned 0 [0062.155] lstrlenA (lpString="*.pptx") returned 6 [0062.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.pdf") returned 0 [0062.155] lstrlenA (lpString="*.pdf") returned 5 [0062.155] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.mov") returned 0 [0062.155] lstrlenA (lpString="*.mov") returned 5 [0062.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.m2v") returned 0 [0062.156] lstrlenA (lpString="*.m2v") returned 5 [0062.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.3gp") returned 0 [0062.156] lstrlenA (lpString="*.3gp") returned 5 [0062.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.mpeg") returned 0 [0062.156] lstrlenA (lpString="*.mpeg") returned 6 [0062.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.mpg") returned 0 [0062.156] lstrlenA (lpString="*.mpg") returned 5 [0062.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.flv") returned 0 [0062.156] lstrlenA (lpString="*.flv") returned 5 [0062.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.avi") returned 0 [0062.156] lstrlenA (lpString="*.avi") returned 5 [0062.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.mp4") returned 0 [0062.156] lstrlenA (lpString="*.mp4") returned 5 [0062.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.wmv") returned 0 [0062.156] lstrlenA (lpString="*.wmv") returned 5 [0062.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.divx") returned 0 [0062.156] lstrlenA (lpString="*.divx") returned 6 [0062.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.mkv") returned 0 [0062.156] lstrlenA (lpString="*.mkv") returned 5 [0062.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.mp3") returned 0 [0062.156] lstrlenA (lpString="*.mp3") returned 5 [0062.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.wav") returned 0 [0062.156] lstrlenA (lpString="*.wav") returned 5 [0062.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.flac") returned 0 [0062.156] lstrlenA (lpString="*.flac") returned 6 [0062.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.ape") returned 0 [0062.156] lstrlenA (lpString="*.ape") returned 5 [0062.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.wma") returned 0 [0062.156] lstrlenA (lpString="*.wma") returned 5 [0062.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.ac3") returned 0 [0062.156] lstrlenA (lpString="*.ac3") returned 5 [0062.156] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.mxf") returned 0 [0062.157] lstrlenA (lpString="*.mxf") returned 5 [0062.157] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="VIEW.CSS", cAlternateFileName="")) returned 1 [0062.157] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.157] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VIEW.CSS") returned -1 [0062.157] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VIEW.CSS") returned -1 [0062.157] lstrcmpiA (lpString1="", lpString2="VIEW.CSS") returned -1 [0062.157] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js") returned="validation.js" [0062.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0062.157] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0062.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0062.157] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0062.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="VIEW.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS" [0062.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.zip") returned 0 [0062.157] lstrlenA (lpString="*.zip") returned 5 [0062.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.rar") returned 0 [0062.157] lstrlenA (lpString="*.rar") returned 5 [0062.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.7z") returned 0 [0062.157] lstrlenA (lpString="*.7z") returned 4 [0062.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.tar") returned 0 [0062.157] lstrlenA (lpString="*.tar") returned 5 [0062.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.gzip") returned 0 [0062.157] lstrlenA (lpString="*.gzip") returned 6 [0062.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.jpg") returned 0 [0062.157] lstrlenA (lpString="*.jpg") returned 5 [0062.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.jpeg") returned 0 [0062.157] lstrlenA (lpString="*.jpeg") returned 6 [0062.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.psd") returned 0 [0062.157] lstrlenA (lpString="*.psd") returned 5 [0062.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.gif") returned 0 [0062.157] lstrlenA (lpString="*.gif") returned 5 [0062.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.doc") returned 0 [0062.158] lstrlenA (lpString="*.doc") returned 5 [0062.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.docx") returned 0 [0062.158] lstrlenA (lpString="*.docx") returned 6 [0062.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.xls") returned 0 [0062.158] lstrlenA (lpString="*.xls") returned 5 [0062.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.xlsx") returned 0 [0062.158] lstrlenA (lpString="*.xlsx") returned 6 [0062.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.ppt") returned 0 [0062.158] lstrlenA (lpString="*.ppt") returned 5 [0062.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.pptx") returned 0 [0062.158] lstrlenA (lpString="*.pptx") returned 6 [0062.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.pdf") returned 0 [0062.158] lstrlenA (lpString="*.pdf") returned 5 [0062.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.mov") returned 0 [0062.158] lstrlenA (lpString="*.mov") returned 5 [0062.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.m2v") returned 0 [0062.158] lstrlenA (lpString="*.m2v") returned 5 [0062.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.3gp") returned 0 [0062.158] lstrlenA (lpString="*.3gp") returned 5 [0062.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.mpeg") returned 0 [0062.158] lstrlenA (lpString="*.mpeg") returned 6 [0062.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.mpg") returned 0 [0062.158] lstrlenA (lpString="*.mpg") returned 5 [0062.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.flv") returned 0 [0062.158] lstrlenA (lpString="*.flv") returned 5 [0062.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.avi") returned 0 [0062.158] lstrlenA (lpString="*.avi") returned 5 [0062.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.mp4") returned 0 [0062.158] lstrlenA (lpString="*.mp4") returned 5 [0062.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.wmv") returned 0 [0062.158] lstrlenA (lpString="*.wmv") returned 5 [0062.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.divx") returned 0 [0062.159] lstrlenA (lpString="*.divx") returned 6 [0062.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.mkv") returned 0 [0062.159] lstrlenA (lpString="*.mkv") returned 5 [0062.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.mp3") returned 0 [0062.159] lstrlenA (lpString="*.mp3") returned 5 [0062.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.wav") returned 0 [0062.159] lstrlenA (lpString="*.wav") returned 5 [0062.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.flac") returned 0 [0062.159] lstrlenA (lpString="*.flac") returned 6 [0062.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.ape") returned 0 [0062.159] lstrlenA (lpString="*.ape") returned 5 [0062.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.wma") returned 0 [0062.159] lstrlenA (lpString="*.wma") returned 5 [0062.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.ac3") returned 0 [0062.159] lstrlenA (lpString="*.ac3") returned 5 [0062.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.mxf") returned 0 [0062.159] lstrlenA (lpString="*.mxf") returned 5 [0062.159] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="VIEW.ICO", cAlternateFileName="")) returned 1 [0062.159] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.159] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VIEW.ICO") returned -1 [0062.159] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VIEW.ICO") returned -1 [0062.159] lstrcmpiA (lpString1="", lpString2="VIEW.ICO") returned -1 [0062.159] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS") returned="VIEW.CSS" [0062.159] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0062.159] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0062.159] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0062.159] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0062.159] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="VIEW.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO" [0062.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.zip") returned 0 [0062.160] lstrlenA (lpString="*.zip") returned 5 [0062.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.rar") returned 0 [0062.160] lstrlenA (lpString="*.rar") returned 5 [0062.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.7z") returned 0 [0062.160] lstrlenA (lpString="*.7z") returned 4 [0062.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.tar") returned 0 [0062.160] lstrlenA (lpString="*.tar") returned 5 [0062.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.gzip") returned 0 [0062.160] lstrlenA (lpString="*.gzip") returned 6 [0062.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.jpg") returned 0 [0062.160] lstrlenA (lpString="*.jpg") returned 5 [0062.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.jpeg") returned 0 [0062.160] lstrlenA (lpString="*.jpeg") returned 6 [0062.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.psd") returned 0 [0062.160] lstrlenA (lpString="*.psd") returned 5 [0062.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.gif") returned 0 [0062.160] lstrlenA (lpString="*.gif") returned 5 [0062.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.doc") returned 0 [0062.160] lstrlenA (lpString="*.doc") returned 5 [0062.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.docx") returned 0 [0062.160] lstrlenA (lpString="*.docx") returned 6 [0062.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.xls") returned 0 [0062.160] lstrlenA (lpString="*.xls") returned 5 [0062.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.xlsx") returned 0 [0062.160] lstrlenA (lpString="*.xlsx") returned 6 [0062.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.ppt") returned 0 [0062.160] lstrlenA (lpString="*.ppt") returned 5 [0062.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.pptx") returned 0 [0062.160] lstrlenA (lpString="*.pptx") returned 6 [0062.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.pdf") returned 0 [0062.160] lstrlenA (lpString="*.pdf") returned 5 [0062.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.mov") returned 0 [0062.161] lstrlenA (lpString="*.mov") returned 5 [0062.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.m2v") returned 0 [0062.161] lstrlenA (lpString="*.m2v") returned 5 [0062.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.3gp") returned 0 [0062.161] lstrlenA (lpString="*.3gp") returned 5 [0062.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.mpeg") returned 0 [0062.161] lstrlenA (lpString="*.mpeg") returned 6 [0062.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.mpg") returned 0 [0062.161] lstrlenA (lpString="*.mpg") returned 5 [0062.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.flv") returned 0 [0062.161] lstrlenA (lpString="*.flv") returned 5 [0062.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.avi") returned 0 [0062.161] lstrlenA (lpString="*.avi") returned 5 [0062.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.mp4") returned 0 [0062.161] lstrlenA (lpString="*.mp4") returned 5 [0062.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.wmv") returned 0 [0062.161] lstrlenA (lpString="*.wmv") returned 5 [0062.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.divx") returned 0 [0062.161] lstrlenA (lpString="*.divx") returned 6 [0062.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.mkv") returned 0 [0062.161] lstrlenA (lpString="*.mkv") returned 5 [0062.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.mp3") returned 0 [0062.161] lstrlenA (lpString="*.mp3") returned 5 [0062.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.wav") returned 0 [0062.161] lstrlenA (lpString="*.wav") returned 5 [0062.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.flac") returned 0 [0062.161] lstrlenA (lpString="*.flac") returned 6 [0062.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.ape") returned 0 [0062.162] lstrlenA (lpString="*.ape") returned 5 [0062.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.wma") returned 0 [0062.162] lstrlenA (lpString="*.wma") returned 5 [0062.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.ac3") returned 0 [0062.162] lstrlenA (lpString="*.ac3") returned 5 [0062.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.mxf") returned 0 [0062.162] lstrlenA (lpString="*.mxf") returned 5 [0062.162] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x505b, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="VIEW.JS", cAlternateFileName="")) returned 1 [0062.162] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.162] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VIEW.JS") returned -1 [0062.162] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VIEW.JS") returned -1 [0062.162] lstrcmpiA (lpString1="", lpString2="VIEW.JS") returned -1 [0062.162] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO") returned="VIEW.ICO" [0062.162] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0062.162] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0062.162] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0062.162] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0062.162] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="VIEW.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS" [0062.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.zip") returned 0 [0062.162] lstrlenA (lpString="*.zip") returned 5 [0062.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.rar") returned 0 [0062.162] lstrlenA (lpString="*.rar") returned 5 [0062.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.7z") returned 0 [0062.162] lstrlenA (lpString="*.7z") returned 4 [0062.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.tar") returned 0 [0062.162] lstrlenA (lpString="*.tar") returned 5 [0062.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.gzip") returned 0 [0062.162] lstrlenA (lpString="*.gzip") returned 6 [0062.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.jpg") returned 0 [0062.162] lstrlenA (lpString="*.jpg") returned 5 [0062.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.jpeg") returned 0 [0062.163] lstrlenA (lpString="*.jpeg") returned 6 [0062.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.psd") returned 0 [0062.163] lstrlenA (lpString="*.psd") returned 5 [0062.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.gif") returned 0 [0062.163] lstrlenA (lpString="*.gif") returned 5 [0062.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.doc") returned 0 [0062.163] lstrlenA (lpString="*.doc") returned 5 [0062.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.docx") returned 0 [0062.163] lstrlenA (lpString="*.docx") returned 6 [0062.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.xls") returned 0 [0062.163] lstrlenA (lpString="*.xls") returned 5 [0062.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.xlsx") returned 0 [0062.163] lstrlenA (lpString="*.xlsx") returned 6 [0062.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.ppt") returned 0 [0062.163] lstrlenA (lpString="*.ppt") returned 5 [0062.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.pptx") returned 0 [0062.163] lstrlenA (lpString="*.pptx") returned 6 [0062.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.pdf") returned 0 [0062.163] lstrlenA (lpString="*.pdf") returned 5 [0062.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.mov") returned 0 [0062.163] lstrlenA (lpString="*.mov") returned 5 [0062.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.m2v") returned 0 [0062.163] lstrlenA (lpString="*.m2v") returned 5 [0062.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.3gp") returned 0 [0062.163] lstrlenA (lpString="*.3gp") returned 5 [0062.163] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.mpeg") returned 0 [0062.163] lstrlenA (lpString="*.mpeg") returned 6 [0062.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.mpg") returned 0 [0062.164] lstrlenA (lpString="*.mpg") returned 5 [0062.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.flv") returned 0 [0062.164] lstrlenA (lpString="*.flv") returned 5 [0062.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.avi") returned 0 [0062.164] lstrlenA (lpString="*.avi") returned 5 [0062.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.mp4") returned 0 [0062.164] lstrlenA (lpString="*.mp4") returned 5 [0062.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.wmv") returned 0 [0062.164] lstrlenA (lpString="*.wmv") returned 5 [0062.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.divx") returned 0 [0062.164] lstrlenA (lpString="*.divx") returned 6 [0062.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.mkv") returned 0 [0062.164] lstrlenA (lpString="*.mkv") returned 5 [0062.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.mp3") returned 0 [0062.164] lstrlenA (lpString="*.mp3") returned 5 [0062.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.wav") returned 0 [0062.164] lstrlenA (lpString="*.wav") returned 5 [0062.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.flac") returned 0 [0062.164] lstrlenA (lpString="*.flac") returned 6 [0062.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.ape") returned 0 [0062.164] lstrlenA (lpString="*.ape") returned 5 [0062.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.wma") returned 0 [0062.164] lstrlenA (lpString="*.wma") returned 5 [0062.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.ac3") returned 0 [0062.164] lstrlenA (lpString="*.ac3") returned 5 [0062.164] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", pszSpec="*.mxf") returned 0 [0062.164] lstrlenA (lpString="*.mxf") returned 5 [0062.164] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x207, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="VIEWBY.GIF", cAlternateFileName="")) returned 1 [0062.165] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.165] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VIEWBY.GIF") returned -1 [0062.165] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VIEWBY.GIF") returned -1 [0062.165] lstrcmpiA (lpString1="", lpString2="VIEWBY.GIF") returned -1 [0062.165] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS") returned="VIEW.JS" [0062.165] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0062.165] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0062.165] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0062.165] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0062.165] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="VIEWBY.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF" [0062.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", pszSpec="*.zip") returned 0 [0062.165] lstrlenA (lpString="*.zip") returned 5 [0062.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", pszSpec="*.rar") returned 0 [0062.165] lstrlenA (lpString="*.rar") returned 5 [0062.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", pszSpec="*.7z") returned 0 [0062.165] lstrlenA (lpString="*.7z") returned 4 [0062.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", pszSpec="*.tar") returned 0 [0062.165] lstrlenA (lpString="*.tar") returned 5 [0062.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", pszSpec="*.gzip") returned 0 [0062.165] lstrlenA (lpString="*.gzip") returned 6 [0062.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", pszSpec="*.jpg") returned 0 [0062.165] lstrlenA (lpString="*.jpg") returned 5 [0062.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", pszSpec="*.jpeg") returned 0 [0062.165] lstrlenA (lpString="*.jpeg") returned 6 [0062.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", pszSpec="*.psd") returned 0 [0062.165] lstrlenA (lpString="*.psd") returned 5 [0062.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", pszSpec="*.gif") returned 1 [0062.165] lstrlenA (lpString="*.gif") returned 5 [0062.166] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF" [0062.166] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF" [0062.167] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF." [0062.167] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF.wannacry" [0062.167] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewby.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.168] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x207 [0062.168] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8acda200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e490770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8acda200, dwHighDateTime=0x1c747ea)) returned 1 [0062.168] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.169] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x189, lpOverlapped=0x0) returned 1 [0062.170] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF") returned="VIEWBY.GIF" [0062.170] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.170] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x189, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x189, lpOverlapped=0x0) returned 1 [0062.170] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.170] CloseHandle (hObject=0x98) returned 1 [0062.170] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewby.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewby.gif.wannacry")) returned 1 [0062.171] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="viewDblClick.js", cAlternateFileName="VIEWDB~1.JS")) returned 1 [0062.171] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.171] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="viewDblClick.js") returned -1 [0062.171] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="viewDblClick.js") returned -1 [0062.171] lstrcmpiA (lpString1="", lpString2="viewDblClick.js") returned -1 [0062.171] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF") returned="VIEWBY.GIF" [0062.171] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0062.171] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0062.171] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0062.171] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0062.171] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="viewDblClick.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js" [0062.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.zip") returned 0 [0062.171] lstrlenA (lpString="*.zip") returned 5 [0062.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.rar") returned 0 [0062.171] lstrlenA (lpString="*.rar") returned 5 [0062.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.7z") returned 0 [0062.172] lstrlenA (lpString="*.7z") returned 4 [0062.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.tar") returned 0 [0062.172] lstrlenA (lpString="*.tar") returned 5 [0062.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.gzip") returned 0 [0062.172] lstrlenA (lpString="*.gzip") returned 6 [0062.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.jpg") returned 0 [0062.172] lstrlenA (lpString="*.jpg") returned 5 [0062.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.jpeg") returned 0 [0062.172] lstrlenA (lpString="*.jpeg") returned 6 [0062.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.psd") returned 0 [0062.172] lstrlenA (lpString="*.psd") returned 5 [0062.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.gif") returned 0 [0062.172] lstrlenA (lpString="*.gif") returned 5 [0062.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.doc") returned 0 [0062.172] lstrlenA (lpString="*.doc") returned 5 [0062.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.docx") returned 0 [0062.172] lstrlenA (lpString="*.docx") returned 6 [0062.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.xls") returned 0 [0062.172] lstrlenA (lpString="*.xls") returned 5 [0062.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.xlsx") returned 0 [0062.172] lstrlenA (lpString="*.xlsx") returned 6 [0062.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.ppt") returned 0 [0062.172] lstrlenA (lpString="*.ppt") returned 5 [0062.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.pptx") returned 0 [0062.172] lstrlenA (lpString="*.pptx") returned 6 [0062.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.pdf") returned 0 [0062.172] lstrlenA (lpString="*.pdf") returned 5 [0062.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.mov") returned 0 [0062.172] lstrlenA (lpString="*.mov") returned 5 [0062.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.m2v") returned 0 [0062.172] lstrlenA (lpString="*.m2v") returned 5 [0062.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.3gp") returned 0 [0062.173] lstrlenA (lpString="*.3gp") returned 5 [0062.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.mpeg") returned 0 [0062.173] lstrlenA (lpString="*.mpeg") returned 6 [0062.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.mpg") returned 0 [0062.173] lstrlenA (lpString="*.mpg") returned 5 [0062.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.flv") returned 0 [0062.173] lstrlenA (lpString="*.flv") returned 5 [0062.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.avi") returned 0 [0062.173] lstrlenA (lpString="*.avi") returned 5 [0062.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.mp4") returned 0 [0062.173] lstrlenA (lpString="*.mp4") returned 5 [0062.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.wmv") returned 0 [0062.173] lstrlenA (lpString="*.wmv") returned 5 [0062.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.divx") returned 0 [0062.173] lstrlenA (lpString="*.divx") returned 6 [0062.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.mkv") returned 0 [0062.173] lstrlenA (lpString="*.mkv") returned 5 [0062.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.mp3") returned 0 [0062.173] lstrlenA (lpString="*.mp3") returned 5 [0062.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.wav") returned 0 [0062.173] lstrlenA (lpString="*.wav") returned 5 [0062.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.flac") returned 0 [0062.173] lstrlenA (lpString="*.flac") returned 6 [0062.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.ape") returned 0 [0062.173] lstrlenA (lpString="*.ape") returned 5 [0062.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.wma") returned 0 [0062.173] lstrlenA (lpString="*.wma") returned 5 [0062.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.ac3") returned 0 [0062.173] lstrlenA (lpString="*.ac3") returned 5 [0062.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", pszSpec="*.mxf") returned 0 [0062.173] lstrlenA (lpString="*.mxf") returned 5 [0062.173] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd78, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName="ViewHeaderPreview.jpg", cAlternateFileName="VIEWHE~1.JPG")) returned 1 [0062.174] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.174] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ViewHeaderPreview.jpg") returned -1 [0062.174] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ViewHeaderPreview.jpg") returned -1 [0062.174] lstrcmpiA (lpString1="", lpString2="ViewHeaderPreview.jpg") returned -1 [0062.174] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js") returned="viewDblClick.js" [0062.174] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0062.174] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0062.174] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0062.174] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0062.174] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" [0062.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", pszSpec="*.zip") returned 0 [0062.174] lstrlenA (lpString="*.zip") returned 5 [0062.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", pszSpec="*.rar") returned 0 [0062.174] lstrlenA (lpString="*.rar") returned 5 [0062.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", pszSpec="*.7z") returned 0 [0062.174] lstrlenA (lpString="*.7z") returned 4 [0062.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", pszSpec="*.tar") returned 0 [0062.174] lstrlenA (lpString="*.tar") returned 5 [0062.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", pszSpec="*.gzip") returned 0 [0062.174] lstrlenA (lpString="*.gzip") returned 6 [0062.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", pszSpec="*.jpg") returned 1 [0062.175] lstrlenA (lpString="*.jpg") returned 5 [0062.175] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" [0062.175] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" [0062.175] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg." [0062.175] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg.wannacry" [0062.175] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.177] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd78 [0062.177] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8acda200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x706f8370, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8acda200, dwHighDateTime=0x1c747ea)) returned 1 [0062.177] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.177] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xcfa, lpOverlapped=0x0) returned 1 [0062.179] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg") returned="ViewHeaderPreview.jpg" [0062.179] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.179] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xcfa, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xcfa, lpOverlapped=0x0) returned 1 [0062.179] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.179] CloseHandle (hObject=0x98) returned 1 [0062.182] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg.wannacry")) returned 1 [0062.183] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="viewSelectionChanged.js", cAlternateFileName="VIEWSE~1.JS")) returned 1 [0062.183] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.183] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="viewSelectionChanged.js") returned -1 [0062.183] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="viewSelectionChanged.js") returned -1 [0062.183] lstrcmpiA (lpString1="", lpString2="viewSelectionChanged.js") returned -1 [0062.183] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg") returned="ViewHeaderPreview.jpg" [0062.183] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" [0062.183] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned="" [0062.183] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" [0062.183] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\how to decrypt files.txt")) returned 0x20 [0062.184] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="viewSelectionChanged.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js" [0062.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.zip") returned 0 [0062.184] lstrlenA (lpString="*.zip") returned 5 [0062.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.rar") returned 0 [0062.184] lstrlenA (lpString="*.rar") returned 5 [0062.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.7z") returned 0 [0062.184] lstrlenA (lpString="*.7z") returned 4 [0062.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.tar") returned 0 [0062.184] lstrlenA (lpString="*.tar") returned 5 [0062.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.gzip") returned 0 [0062.184] lstrlenA (lpString="*.gzip") returned 6 [0062.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.jpg") returned 0 [0062.184] lstrlenA (lpString="*.jpg") returned 5 [0062.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.jpeg") returned 0 [0062.184] lstrlenA (lpString="*.jpeg") returned 6 [0062.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.psd") returned 0 [0062.184] lstrlenA (lpString="*.psd") returned 5 [0062.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.gif") returned 0 [0062.184] lstrlenA (lpString="*.gif") returned 5 [0062.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.doc") returned 0 [0062.184] lstrlenA (lpString="*.doc") returned 5 [0062.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.docx") returned 0 [0062.184] lstrlenA (lpString="*.docx") returned 6 [0062.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.xls") returned 0 [0062.184] lstrlenA (lpString="*.xls") returned 5 [0062.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.xlsx") returned 0 [0062.184] lstrlenA (lpString="*.xlsx") returned 6 [0062.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.ppt") returned 0 [0062.184] lstrlenA (lpString="*.ppt") returned 5 [0062.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.pptx") returned 0 [0062.185] lstrlenA (lpString="*.pptx") returned 6 [0062.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.pdf") returned 0 [0062.185] lstrlenA (lpString="*.pdf") returned 5 [0062.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.mov") returned 0 [0062.185] lstrlenA (lpString="*.mov") returned 5 [0062.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.m2v") returned 0 [0062.185] lstrlenA (lpString="*.m2v") returned 5 [0062.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.3gp") returned 0 [0062.185] lstrlenA (lpString="*.3gp") returned 5 [0062.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.mpeg") returned 0 [0062.185] lstrlenA (lpString="*.mpeg") returned 6 [0062.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.mpg") returned 0 [0062.185] lstrlenA (lpString="*.mpg") returned 5 [0062.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.flv") returned 0 [0062.185] lstrlenA (lpString="*.flv") returned 5 [0062.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.avi") returned 0 [0062.185] lstrlenA (lpString="*.avi") returned 5 [0062.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.mp4") returned 0 [0062.185] lstrlenA (lpString="*.mp4") returned 5 [0062.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.wmv") returned 0 [0062.185] lstrlenA (lpString="*.wmv") returned 5 [0062.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.divx") returned 0 [0062.185] lstrlenA (lpString="*.divx") returned 6 [0062.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.mkv") returned 0 [0062.185] lstrlenA (lpString="*.mkv") returned 5 [0062.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.mp3") returned 0 [0062.185] lstrlenA (lpString="*.mp3") returned 5 [0062.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.wav") returned 0 [0062.185] lstrlenA (lpString="*.wav") returned 5 [0062.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.flac") returned 0 [0062.185] lstrlenA (lpString="*.flac") returned 6 [0062.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.ape") returned 0 [0062.186] lstrlenA (lpString="*.ape") returned 5 [0062.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.wma") returned 0 [0062.186] lstrlenA (lpString="*.wma") returned 5 [0062.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.ac3") returned 0 [0062.186] lstrlenA (lpString="*.ac3") returned 5 [0062.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", pszSpec="*.mxf") returned 0 [0062.186] lstrlenA (lpString="*.mxf") returned 5 [0062.186] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="viewSelectionChanged.js", cAlternateFileName="VIEWSE~1.JS")) returned 0 [0062.186] FindClose (in: hFindFile=0x2d80b0 | out: hFindFile=0x2d80b0) returned 1 [0062.186] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="GrooveForms3", cAlternateFileName="GR96F1~1")) returned 1 [0062.186] lstrcmpA (lpString1=".", lpString2="GrooveForms3") returned -1 [0062.186] lstrcmpA (lpString1="..", lpString2="GrooveForms3") returned -1 [0062.186] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*" [0062.186] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="GrooveForms3" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3" [0062.186] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3") returned 82 [0062.186] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName=".", cAlternateFileName="")) returned 0x2d80b0 [0062.197] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.197] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x4f0000, cFileName="..", cAlternateFileName="")) returned 1 [0062.198] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.198] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.198] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ADD.GIF", cAlternateFileName="")) returned 1 [0062.198] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.199] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ADD.GIF") returned 1 [0062.199] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADD.GIF") returned 1 [0062.199] lstrcmpiA (lpString1="", lpString2="ADD.GIF") returned -1 [0062.199] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*.*") returned="*.*" [0062.199] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.199] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.199] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.199] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0xffffffff [0062.200] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.200] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0062.201] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0062.201] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.202] CloseHandle (hObject=0x98) returned 1 [0062.202] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="ADD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF" [0062.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.zip") returned 0 [0062.202] lstrlenA (lpString="*.zip") returned 5 [0062.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.rar") returned 0 [0062.202] lstrlenA (lpString="*.rar") returned 5 [0062.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.7z") returned 0 [0062.202] lstrlenA (lpString="*.7z") returned 4 [0062.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.tar") returned 0 [0062.202] lstrlenA (lpString="*.tar") returned 5 [0062.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.gzip") returned 0 [0062.202] lstrlenA (lpString="*.gzip") returned 6 [0062.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.jpg") returned 0 [0062.202] lstrlenA (lpString="*.jpg") returned 5 [0062.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.jpeg") returned 0 [0062.202] lstrlenA (lpString="*.jpeg") returned 6 [0062.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.psd") returned 0 [0062.202] lstrlenA (lpString="*.psd") returned 5 [0062.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.gif") returned 1 [0062.202] lstrlenA (lpString="*.gif") returned 5 [0062.202] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF" [0062.202] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF" [0062.202] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF." [0062.202] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF.wannacry" [0062.203] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\add.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.204] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x244 [0062.204] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eaf6290, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1 [0062.204] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.204] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1c6, lpOverlapped=0x0) returned 1 [0062.205] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF") returned="ADD.GIF" [0062.205] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.205] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1c6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1c6, lpOverlapped=0x0) returned 1 [0062.205] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.205] CloseHandle (hObject=0x98) returned 1 [0062.205] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\add.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\add.gif.wannacry")) returned 1 [0062.206] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe8, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="AddToViewArrow.jpg", cAlternateFileName="ADDTOV~1.JPG")) returned 1 [0062.206] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.206] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AddToViewArrow.jpg") returned 1 [0062.206] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddToViewArrow.jpg") returned 1 [0062.206] lstrcmpiA (lpString1="", lpString2="AddToViewArrow.jpg") returned -1 [0062.206] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF") returned="ADD.GIF" [0062.207] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.207] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.207] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.207] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.207] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="AddToViewArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" [0062.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", pszSpec="*.zip") returned 0 [0062.207] lstrlenA (lpString="*.zip") returned 5 [0062.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", pszSpec="*.rar") returned 0 [0062.207] lstrlenA (lpString="*.rar") returned 5 [0062.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", pszSpec="*.7z") returned 0 [0062.207] lstrlenA (lpString="*.7z") returned 4 [0062.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", pszSpec="*.tar") returned 0 [0062.207] lstrlenA (lpString="*.tar") returned 5 [0062.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", pszSpec="*.gzip") returned 0 [0062.207] lstrlenA (lpString="*.gzip") returned 6 [0062.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", pszSpec="*.jpg") returned 1 [0062.207] lstrlenA (lpString="*.jpg") returned 5 [0062.207] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" [0062.207] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" [0062.207] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg." [0062.207] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg.wannacry" [0062.207] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.209] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbe8 [0062.209] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eaf6290, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1 [0062.209] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.209] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xb6a, lpOverlapped=0x0) returned 1 [0062.211] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg") returned="AddToViewArrow.jpg" [0062.211] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.211] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xb6a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xb6a, lpOverlapped=0x0) returned 1 [0062.211] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.211] CloseHandle (hObject=0x98) returned 1 [0062.211] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg.wannacry")) returned 1 [0062.212] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="AddToViewArrowMask.bmp", cAlternateFileName="ADDTOV~1.BMP")) returned 1 [0062.212] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.212] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AddToViewArrowMask.bmp") returned 1 [0062.212] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddToViewArrowMask.bmp") returned 1 [0062.212] lstrcmpiA (lpString1="", lpString2="AddToViewArrowMask.bmp") returned -1 [0062.212] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg") returned="AddToViewArrow.jpg" [0062.212] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.212] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.212] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.212] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.212] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="AddToViewArrowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp" [0062.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.zip") returned 0 [0062.212] lstrlenA (lpString="*.zip") returned 5 [0062.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.rar") returned 0 [0062.212] lstrlenA (lpString="*.rar") returned 5 [0062.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.7z") returned 0 [0062.212] lstrlenA (lpString="*.7z") returned 4 [0062.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.tar") returned 0 [0062.212] lstrlenA (lpString="*.tar") returned 5 [0062.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.gzip") returned 0 [0062.213] lstrlenA (lpString="*.gzip") returned 6 [0062.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.jpg") returned 0 [0062.213] lstrlenA (lpString="*.jpg") returned 5 [0062.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.jpeg") returned 0 [0062.213] lstrlenA (lpString="*.jpeg") returned 6 [0062.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.psd") returned 0 [0062.213] lstrlenA (lpString="*.psd") returned 5 [0062.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.gif") returned 0 [0062.213] lstrlenA (lpString="*.gif") returned 5 [0062.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.doc") returned 0 [0062.213] lstrlenA (lpString="*.doc") returned 5 [0062.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.docx") returned 0 [0062.213] lstrlenA (lpString="*.docx") returned 6 [0062.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.xls") returned 0 [0062.213] lstrlenA (lpString="*.xls") returned 5 [0062.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.xlsx") returned 0 [0062.213] lstrlenA (lpString="*.xlsx") returned 6 [0062.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.ppt") returned 0 [0062.213] lstrlenA (lpString="*.ppt") returned 5 [0062.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.pptx") returned 0 [0062.213] lstrlenA (lpString="*.pptx") returned 6 [0062.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.pdf") returned 0 [0062.213] lstrlenA (lpString="*.pdf") returned 5 [0062.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.mov") returned 0 [0062.213] lstrlenA (lpString="*.mov") returned 5 [0062.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.m2v") returned 0 [0062.213] lstrlenA (lpString="*.m2v") returned 5 [0062.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.3gp") returned 0 [0062.213] lstrlenA (lpString="*.3gp") returned 5 [0062.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.mpeg") returned 0 [0062.213] lstrlenA (lpString="*.mpeg") returned 6 [0062.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.mpg") returned 0 [0062.214] lstrlenA (lpString="*.mpg") returned 5 [0062.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.flv") returned 0 [0062.214] lstrlenA (lpString="*.flv") returned 5 [0062.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.avi") returned 0 [0062.214] lstrlenA (lpString="*.avi") returned 5 [0062.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.mp4") returned 0 [0062.214] lstrlenA (lpString="*.mp4") returned 5 [0062.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.wmv") returned 0 [0062.214] lstrlenA (lpString="*.wmv") returned 5 [0062.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.divx") returned 0 [0062.214] lstrlenA (lpString="*.divx") returned 6 [0062.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.mkv") returned 0 [0062.214] lstrlenA (lpString="*.mkv") returned 5 [0062.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.mp3") returned 0 [0062.214] lstrlenA (lpString="*.mp3") returned 5 [0062.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.wav") returned 0 [0062.214] lstrlenA (lpString="*.wav") returned 5 [0062.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.flac") returned 0 [0062.214] lstrlenA (lpString="*.flac") returned 6 [0062.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.ape") returned 0 [0062.214] lstrlenA (lpString="*.ape") returned 5 [0062.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.wma") returned 0 [0062.214] lstrlenA (lpString="*.wma") returned 5 [0062.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.ac3") returned 0 [0062.214] lstrlenA (lpString="*.ac3") returned 5 [0062.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.mxf") returned 0 [0062.214] lstrlenA (lpString="*.mxf") returned 5 [0062.214] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xae8, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="attention.gif", cAlternateFileName="ATTENT~1.GIF")) returned 1 [0062.214] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.214] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="attention.gif") returned 1 [0062.214] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="attention.gif") returned 1 [0062.215] lstrcmpiA (lpString1="", lpString2="attention.gif") returned -1 [0062.215] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp") returned="AddToViewArrowMask.bmp" [0062.215] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.215] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.215] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.215] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.215] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" [0062.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.zip") returned 0 [0062.215] lstrlenA (lpString="*.zip") returned 5 [0062.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.rar") returned 0 [0062.215] lstrlenA (lpString="*.rar") returned 5 [0062.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.7z") returned 0 [0062.215] lstrlenA (lpString="*.7z") returned 4 [0062.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.tar") returned 0 [0062.215] lstrlenA (lpString="*.tar") returned 5 [0062.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.gzip") returned 0 [0062.215] lstrlenA (lpString="*.gzip") returned 6 [0062.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.jpg") returned 0 [0062.215] lstrlenA (lpString="*.jpg") returned 5 [0062.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.jpeg") returned 0 [0062.215] lstrlenA (lpString="*.jpeg") returned 6 [0062.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.psd") returned 0 [0062.215] lstrlenA (lpString="*.psd") returned 5 [0062.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.gif") returned 1 [0062.215] lstrlenA (lpString="*.gif") returned 5 [0062.215] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" [0062.215] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" [0062.215] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif." [0062.215] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif.wannacry" [0062.215] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.216] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae8 [0062.216] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f409670, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1 [0062.216] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.216] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xa6a, lpOverlapped=0x0) returned 1 [0062.218] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif") returned="attention.gif" [0062.218] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.218] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xa6a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xa6a, lpOverlapped=0x0) returned 1 [0062.218] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.218] CloseHandle (hObject=0x98) returned 1 [0062.218] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif.wannacry")) returned 1 [0062.219] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x614e, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="BG_ADOBE.GIF", cAlternateFileName="")) returned 1 [0062.219] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.219] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BG_ADOBE.GIF") returned 1 [0062.219] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BG_ADOBE.GIF") returned 1 [0062.219] lstrcmpiA (lpString1="", lpString2="BG_ADOBE.GIF") returned -1 [0062.219] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif") returned="attention.gif" [0062.219] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.219] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.219] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="BG_ADOBE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF" [0062.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.zip") returned 0 [0062.219] lstrlenA (lpString="*.zip") returned 5 [0062.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.rar") returned 0 [0062.219] lstrlenA (lpString="*.rar") returned 5 [0062.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.7z") returned 0 [0062.219] lstrlenA (lpString="*.7z") returned 4 [0062.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.tar") returned 0 [0062.219] lstrlenA (lpString="*.tar") returned 5 [0062.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.gzip") returned 0 [0062.219] lstrlenA (lpString="*.gzip") returned 6 [0062.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.jpg") returned 0 [0062.220] lstrlenA (lpString="*.jpg") returned 5 [0062.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.jpeg") returned 0 [0062.220] lstrlenA (lpString="*.jpeg") returned 6 [0062.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.psd") returned 0 [0062.220] lstrlenA (lpString="*.psd") returned 5 [0062.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.gif") returned 1 [0062.220] lstrlenA (lpString="*.gif") returned 5 [0062.220] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF" [0062.220] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF" [0062.220] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF." [0062.220] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF.wannacry" [0062.220] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_adobe.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.220] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x614e [0062.220] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f61e9b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1 [0062.220] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.220] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60d0, lpOverlapped=0x0) returned 1 [0062.225] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF") returned="BG_ADOBE.GIF" [0062.225] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.225] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60d0, lpOverlapped=0x0) returned 1 [0062.225] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.225] CloseHandle (hObject=0x98) returned 1 [0062.225] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_adobe.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_adobe.gif.wannacry")) returned 1 [0062.226] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x161d, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="bg_Casual.gif", cAlternateFileName="BG_CAS~1.GIF")) returned 1 [0062.226] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.226] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_Casual.gif") returned 1 [0062.226] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Casual.gif") returned 1 [0062.226] lstrcmpiA (lpString1="", lpString2="bg_Casual.gif") returned -1 [0062.226] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF") returned="BG_ADOBE.GIF" [0062.226] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.226] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.226] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.226] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" [0062.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.zip") returned 0 [0062.227] lstrlenA (lpString="*.zip") returned 5 [0062.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.rar") returned 0 [0062.227] lstrlenA (lpString="*.rar") returned 5 [0062.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.7z") returned 0 [0062.227] lstrlenA (lpString="*.7z") returned 4 [0062.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.tar") returned 0 [0062.227] lstrlenA (lpString="*.tar") returned 5 [0062.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.gzip") returned 0 [0062.227] lstrlenA (lpString="*.gzip") returned 6 [0062.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.jpg") returned 0 [0062.227] lstrlenA (lpString="*.jpg") returned 5 [0062.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.jpeg") returned 0 [0062.227] lstrlenA (lpString="*.jpeg") returned 6 [0062.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.psd") returned 0 [0062.227] lstrlenA (lpString="*.psd") returned 5 [0062.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.gif") returned 1 [0062.227] lstrlenA (lpString="*.gif") returned 5 [0062.227] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" [0062.227] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" [0062.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif." [0062.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif.wannacry" [0062.227] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.228] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x161d [0062.228] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f61e9b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1 [0062.228] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.228] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x159f, lpOverlapped=0x0) returned 1 [0062.229] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif") returned="bg_Casual.gif" [0062.229] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.229] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x159f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x159f, lpOverlapped=0x0) returned 1 [0062.230] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.230] CloseHandle (hObject=0x98) returned 1 [0062.230] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif.wannacry")) returned 1 [0062.230] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7dd3, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="bg_Country.gif", cAlternateFileName="BG_COU~1.GIF")) returned 1 [0062.230] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.230] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_Country.gif") returned 1 [0062.230] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Country.gif") returned 1 [0062.230] lstrcmpiA (lpString1="", lpString2="bg_Country.gif") returned -1 [0062.231] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif") returned="bg_Casual.gif" [0062.231] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.231] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.231] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.231] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.231] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" [0062.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.zip") returned 0 [0062.231] lstrlenA (lpString="*.zip") returned 5 [0062.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.rar") returned 0 [0062.231] lstrlenA (lpString="*.rar") returned 5 [0062.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.7z") returned 0 [0062.231] lstrlenA (lpString="*.7z") returned 4 [0062.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.tar") returned 0 [0062.231] lstrlenA (lpString="*.tar") returned 5 [0062.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.gzip") returned 0 [0062.231] lstrlenA (lpString="*.gzip") returned 6 [0062.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.jpg") returned 0 [0062.231] lstrlenA (lpString="*.jpg") returned 5 [0062.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.jpeg") returned 0 [0062.231] lstrlenA (lpString="*.jpeg") returned 6 [0062.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.psd") returned 0 [0062.231] lstrlenA (lpString="*.psd") returned 5 [0062.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.gif") returned 1 [0062.231] lstrlenA (lpString="*.gif") returned 5 [0062.231] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" [0062.231] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" [0062.231] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif." [0062.231] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif.wannacry" [0062.231] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.232] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7dd3 [0062.232] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1 [0062.232] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.232] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x7d55, lpOverlapped=0x0) returned 1 [0062.234] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif") returned="bg_Country.gif" [0062.234] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.234] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x7d55, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x7d55, lpOverlapped=0x0) returned 1 [0062.234] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.234] CloseHandle (hObject=0x98) returned 1 [0062.234] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif.wannacry")) returned 1 [0062.235] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x132a, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="bg_Earthy.gif", cAlternateFileName="BG_EAR~1.GIF")) returned 1 [0062.235] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.235] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_Earthy.gif") returned 1 [0062.235] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Earthy.gif") returned 1 [0062.235] lstrcmpiA (lpString1="", lpString2="bg_Earthy.gif") returned -1 [0062.235] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif") returned="bg_Country.gif" [0062.235] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.235] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.235] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.235] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.235] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" [0062.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.zip") returned 0 [0062.235] lstrlenA (lpString="*.zip") returned 5 [0062.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.rar") returned 0 [0062.235] lstrlenA (lpString="*.rar") returned 5 [0062.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.7z") returned 0 [0062.235] lstrlenA (lpString="*.7z") returned 4 [0062.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.tar") returned 0 [0062.235] lstrlenA (lpString="*.tar") returned 5 [0062.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.gzip") returned 0 [0062.235] lstrlenA (lpString="*.gzip") returned 6 [0062.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.jpg") returned 0 [0062.236] lstrlenA (lpString="*.jpg") returned 5 [0062.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.jpeg") returned 0 [0062.236] lstrlenA (lpString="*.jpeg") returned 6 [0062.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.psd") returned 0 [0062.236] lstrlenA (lpString="*.psd") returned 5 [0062.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.gif") returned 1 [0062.236] lstrlenA (lpString="*.gif") returned 5 [0062.236] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" [0062.236] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" [0062.236] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif." [0062.236] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif.wannacry" [0062.236] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.236] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x132a [0062.236] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1 [0062.236] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.236] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x12ac, lpOverlapped=0x0) returned 1 [0062.239] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif") returned="bg_Earthy.gif" [0062.239] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.239] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x12ac, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x12ac, lpOverlapped=0x0) returned 1 [0062.239] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.239] CloseHandle (hObject=0x98) returned 1 [0062.239] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif.wannacry")) returned 1 [0062.240] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x167bd, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="bg_FormsHomePage.gif", cAlternateFileName="BG_FOR~2.GIF")) returned 1 [0062.240] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.240] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_FormsHomePage.gif") returned 1 [0062.240] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_FormsHomePage.gif") returned 1 [0062.240] lstrcmpiA (lpString1="", lpString2="bg_FormsHomePage.gif") returned -1 [0062.240] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif") returned="bg_Earthy.gif" [0062.240] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.240] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.240] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.240] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.240] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_FormsHomePage.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" [0062.240] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.zip") returned 0 [0062.240] lstrlenA (lpString="*.zip") returned 5 [0062.240] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.rar") returned 0 [0062.240] lstrlenA (lpString="*.rar") returned 5 [0062.240] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.7z") returned 0 [0062.240] lstrlenA (lpString="*.7z") returned 4 [0062.240] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.tar") returned 0 [0062.240] lstrlenA (lpString="*.tar") returned 5 [0062.240] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.gzip") returned 0 [0062.240] lstrlenA (lpString="*.gzip") returned 6 [0062.240] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.jpg") returned 0 [0062.240] lstrlenA (lpString="*.jpg") returned 5 [0062.241] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.jpeg") returned 0 [0062.241] lstrlenA (lpString="*.jpeg") returned 6 [0062.241] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.psd") returned 0 [0062.241] lstrlenA (lpString="*.psd") returned 5 [0062.241] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.gif") returned 1 [0062.241] lstrlenA (lpString="*.gif") returned 5 [0062.241] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" [0062.241] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" [0062.241] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif." [0062.241] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif.wannacry" [0062.241] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.241] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x167bd [0062.241] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1 [0062.241] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.241] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1673f, lpOverlapped=0x0) returned 1 [0062.244] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif") returned="bg_FormsHomePage.gif" [0062.244] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.244] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1673f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1673f, lpOverlapped=0x0) returned 1 [0062.244] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.244] CloseHandle (hObject=0x98) returned 1 [0062.244] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif.wannacry")) returned 1 [0062.245] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4ebb, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="bg_FormsHomePageBlank.gif", cAlternateFileName="BG_FOR~1.GIF")) returned 1 [0062.245] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.245] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_FormsHomePageBlank.gif") returned 1 [0062.245] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_FormsHomePageBlank.gif") returned 1 [0062.245] lstrcmpiA (lpString1="", lpString2="bg_FormsHomePageBlank.gif") returned -1 [0062.245] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif") returned="bg_FormsHomePage.gif" [0062.245] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.245] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.245] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.245] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.245] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_FormsHomePageBlank.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" [0062.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.zip") returned 0 [0062.245] lstrlenA (lpString="*.zip") returned 5 [0062.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.rar") returned 0 [0062.245] lstrlenA (lpString="*.rar") returned 5 [0062.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.7z") returned 0 [0062.245] lstrlenA (lpString="*.7z") returned 4 [0062.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.tar") returned 0 [0062.246] lstrlenA (lpString="*.tar") returned 5 [0062.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.gzip") returned 0 [0062.246] lstrlenA (lpString="*.gzip") returned 6 [0062.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.jpg") returned 0 [0062.246] lstrlenA (lpString="*.jpg") returned 5 [0062.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.jpeg") returned 0 [0062.246] lstrlenA (lpString="*.jpeg") returned 6 [0062.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.psd") returned 0 [0062.246] lstrlenA (lpString="*.psd") returned 5 [0062.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.gif") returned 1 [0062.246] lstrlenA (lpString="*.gif") returned 5 [0062.246] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" [0062.246] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" [0062.246] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif." [0062.246] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif.wannacry" [0062.246] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.246] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ebb [0062.246] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1 [0062.246] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.247] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4e3d, lpOverlapped=0x0) returned 1 [0062.248] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif") returned="bg_FormsHomePageBlank.gif" [0062.248] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.248] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4e3d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4e3d, lpOverlapped=0x0) returned 1 [0062.248] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.249] CloseHandle (hObject=0x98) returned 1 [0062.249] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif.wannacry")) returned 1 [0062.249] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x40f, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="bg_FormsHomePageSlice.gif", cAlternateFileName="BG_FOR~3.GIF")) returned 1 [0062.249] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.249] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_FormsHomePageSlice.gif") returned 1 [0062.249] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_FormsHomePageSlice.gif") returned 1 [0062.249] lstrcmpiA (lpString1="", lpString2="bg_FormsHomePageSlice.gif") returned -1 [0062.249] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif") returned="bg_FormsHomePageBlank.gif" [0062.249] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.249] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.249] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.250] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.250] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_FormsHomePageSlice.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" [0062.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.zip") returned 0 [0062.250] lstrlenA (lpString="*.zip") returned 5 [0062.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.rar") returned 0 [0062.250] lstrlenA (lpString="*.rar") returned 5 [0062.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.7z") returned 0 [0062.250] lstrlenA (lpString="*.7z") returned 4 [0062.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.tar") returned 0 [0062.250] lstrlenA (lpString="*.tar") returned 5 [0062.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.gzip") returned 0 [0062.250] lstrlenA (lpString="*.gzip") returned 6 [0062.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.jpg") returned 0 [0062.250] lstrlenA (lpString="*.jpg") returned 5 [0062.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.jpeg") returned 0 [0062.250] lstrlenA (lpString="*.jpeg") returned 6 [0062.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.psd") returned 0 [0062.250] lstrlenA (lpString="*.psd") returned 5 [0062.250] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.gif") returned 1 [0062.250] lstrlenA (lpString="*.gif") returned 5 [0062.250] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" [0062.250] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" [0062.250] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif." [0062.250] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif.wannacry" [0062.250] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.251] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40f [0062.251] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1 [0062.251] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.251] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x391, lpOverlapped=0x0) returned 1 [0062.252] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif") returned="bg_FormsHomePageSlice.gif" [0062.252] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.252] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x391, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x391, lpOverlapped=0x0) returned 1 [0062.253] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.253] CloseHandle (hObject=0x98) returned 1 [0062.253] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif.wannacry")) returned 1 [0062.253] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5690, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="bg_GreenTea.gif", cAlternateFileName="BG_GRE~1.GIF")) returned 1 [0062.253] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.253] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_GreenTea.gif") returned 1 [0062.253] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_GreenTea.gif") returned 1 [0062.253] lstrcmpiA (lpString1="", lpString2="bg_GreenTea.gif") returned -1 [0062.253] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif") returned="bg_FormsHomePageSlice.gif" [0062.253] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.254] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.254] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.254] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.254] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" [0062.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.zip") returned 0 [0062.254] lstrlenA (lpString="*.zip") returned 5 [0062.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.rar") returned 0 [0062.254] lstrlenA (lpString="*.rar") returned 5 [0062.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.7z") returned 0 [0062.254] lstrlenA (lpString="*.7z") returned 4 [0062.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.tar") returned 0 [0062.254] lstrlenA (lpString="*.tar") returned 5 [0062.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.gzip") returned 0 [0062.254] lstrlenA (lpString="*.gzip") returned 6 [0062.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.jpg") returned 0 [0062.254] lstrlenA (lpString="*.jpg") returned 5 [0062.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.jpeg") returned 0 [0062.254] lstrlenA (lpString="*.jpeg") returned 6 [0062.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.psd") returned 0 [0062.254] lstrlenA (lpString="*.psd") returned 5 [0062.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.gif") returned 1 [0062.254] lstrlenA (lpString="*.gif") returned 5 [0062.254] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" [0062.254] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" [0062.254] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif." [0062.254] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif.wannacry" [0062.254] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.255] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5690 [0062.255] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1 [0062.255] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.255] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x5612, lpOverlapped=0x0) returned 1 [0062.257] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif") returned="bg_GreenTea.gif" [0062.257] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.257] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x5612, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x5612, lpOverlapped=0x0) returned 1 [0062.257] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.257] CloseHandle (hObject=0x98) returned 1 [0062.257] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif.wannacry")) returned 1 [0062.258] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6a, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="bg_Groove.gif", cAlternateFileName="BG_GRO~1.GIF")) returned 1 [0062.258] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.258] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_Groove.gif") returned 1 [0062.258] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Groove.gif") returned 1 [0062.258] lstrcmpiA (lpString1="", lpString2="bg_Groove.gif") returned -1 [0062.258] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif") returned="bg_GreenTea.gif" [0062.258] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.258] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.258] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.258] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.258] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" [0062.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.zip") returned 0 [0062.258] lstrlenA (lpString="*.zip") returned 5 [0062.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.rar") returned 0 [0062.258] lstrlenA (lpString="*.rar") returned 5 [0062.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.7z") returned 0 [0062.258] lstrlenA (lpString="*.7z") returned 4 [0062.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.tar") returned 0 [0062.259] lstrlenA (lpString="*.tar") returned 5 [0062.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.gzip") returned 0 [0062.259] lstrlenA (lpString="*.gzip") returned 6 [0062.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.jpg") returned 0 [0062.259] lstrlenA (lpString="*.jpg") returned 5 [0062.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.jpeg") returned 0 [0062.259] lstrlenA (lpString="*.jpeg") returned 6 [0062.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.psd") returned 0 [0062.259] lstrlenA (lpString="*.psd") returned 5 [0062.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.gif") returned 1 [0062.259] lstrlenA (lpString="*.gif") returned 5 [0062.259] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" [0062.259] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" [0062.259] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif." [0062.259] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif.wannacry" [0062.259] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.259] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6a [0062.259] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1 [0062.259] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.259] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0062.260] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.260] CloseHandle (hObject=0x98) returned 1 [0062.260] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif.wannacry")) returned 1 [0062.260] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x21a6, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="bg_LightSpirit.gif", cAlternateFileName="BG_LIG~1.GIF")) returned 1 [0062.260] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.260] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_LightSpirit.gif") returned 1 [0062.260] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_LightSpirit.gif") returned 1 [0062.260] lstrcmpiA (lpString1="", lpString2="bg_LightSpirit.gif") returned -1 [0062.260] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif") returned="bg_Groove.gif" [0062.260] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.260] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.260] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.261] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.261] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" [0062.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.zip") returned 0 [0062.261] lstrlenA (lpString="*.zip") returned 5 [0062.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.rar") returned 0 [0062.261] lstrlenA (lpString="*.rar") returned 5 [0062.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.7z") returned 0 [0062.261] lstrlenA (lpString="*.7z") returned 4 [0062.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.tar") returned 0 [0062.261] lstrlenA (lpString="*.tar") returned 5 [0062.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.gzip") returned 0 [0062.261] lstrlenA (lpString="*.gzip") returned 6 [0062.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.jpg") returned 0 [0062.261] lstrlenA (lpString="*.jpg") returned 5 [0062.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.jpeg") returned 0 [0062.261] lstrlenA (lpString="*.jpeg") returned 6 [0062.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.psd") returned 0 [0062.261] lstrlenA (lpString="*.psd") returned 5 [0062.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.gif") returned 1 [0062.261] lstrlenA (lpString="*.gif") returned 5 [0062.261] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" [0062.261] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" [0062.261] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif." [0062.261] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif.wannacry" [0062.261] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.262] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x21a6 [0062.262] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1 [0062.262] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.262] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2128, lpOverlapped=0x0) returned 1 [0062.263] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif") returned="bg_LightSpirit.gif" [0062.263] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.263] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2128, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2128, lpOverlapped=0x0) returned 1 [0062.264] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.264] CloseHandle (hObject=0x98) returned 1 [0062.264] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif.wannacry")) returned 1 [0062.264] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3d57, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="bg_OliveGreen.gif", cAlternateFileName="BG_OLI~1.GIF")) returned 1 [0062.264] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.264] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_OliveGreen.gif") returned 1 [0062.264] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_OliveGreen.gif") returned 1 [0062.264] lstrcmpiA (lpString1="", lpString2="bg_OliveGreen.gif") returned -1 [0062.265] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif") returned="bg_LightSpirit.gif" [0062.265] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.265] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.265] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.265] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.265] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" [0062.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.zip") returned 0 [0062.265] lstrlenA (lpString="*.zip") returned 5 [0062.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.rar") returned 0 [0062.265] lstrlenA (lpString="*.rar") returned 5 [0062.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.7z") returned 0 [0062.265] lstrlenA (lpString="*.7z") returned 4 [0062.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.tar") returned 0 [0062.265] lstrlenA (lpString="*.tar") returned 5 [0062.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.gzip") returned 0 [0062.265] lstrlenA (lpString="*.gzip") returned 6 [0062.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.jpg") returned 0 [0062.265] lstrlenA (lpString="*.jpg") returned 5 [0062.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.jpeg") returned 0 [0062.265] lstrlenA (lpString="*.jpeg") returned 6 [0062.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.psd") returned 0 [0062.265] lstrlenA (lpString="*.psd") returned 5 [0062.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.gif") returned 1 [0062.265] lstrlenA (lpString="*.gif") returned 5 [0062.265] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" [0062.265] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" [0062.265] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif." [0062.265] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif.wannacry" [0062.265] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.266] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d57 [0062.266] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1 [0062.266] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.266] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3cd9, lpOverlapped=0x0) returned 1 [0062.268] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif") returned="bg_OliveGreen.gif" [0062.268] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.268] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3cd9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3cd9, lpOverlapped=0x0) returned 1 [0062.268] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.268] CloseHandle (hObject=0x98) returned 1 [0062.268] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif.wannacry")) returned 1 [0062.269] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1845, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="bg_Premium.gif", cAlternateFileName="BG_PRE~1.GIF")) returned 1 [0062.269] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.269] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_Premium.gif") returned 1 [0062.269] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Premium.gif") returned 1 [0062.269] lstrcmpiA (lpString1="", lpString2="bg_Premium.gif") returned -1 [0062.269] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif") returned="bg_OliveGreen.gif" [0062.269] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.269] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.269] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" [0062.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.zip") returned 0 [0062.269] lstrlenA (lpString="*.zip") returned 5 [0062.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.rar") returned 0 [0062.269] lstrlenA (lpString="*.rar") returned 5 [0062.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.7z") returned 0 [0062.269] lstrlenA (lpString="*.7z") returned 4 [0062.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.tar") returned 0 [0062.269] lstrlenA (lpString="*.tar") returned 5 [0062.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.gzip") returned 0 [0062.269] lstrlenA (lpString="*.gzip") returned 6 [0062.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.jpg") returned 0 [0062.269] lstrlenA (lpString="*.jpg") returned 5 [0062.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.jpeg") returned 0 [0062.269] lstrlenA (lpString="*.jpeg") returned 6 [0062.269] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.psd") returned 0 [0062.270] lstrlenA (lpString="*.psd") returned 5 [0062.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.gif") returned 1 [0062.270] lstrlenA (lpString="*.gif") returned 5 [0062.270] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" [0062.270] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" [0062.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif." [0062.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif.wannacry" [0062.270] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.270] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1845 [0062.270] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1 [0062.270] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.270] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x17c7, lpOverlapped=0x0) returned 1 [0062.272] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif") returned="bg_Premium.gif" [0062.272] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.272] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x17c7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x17c7, lpOverlapped=0x0) returned 1 [0062.272] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.272] CloseHandle (hObject=0x98) returned 1 [0062.272] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif.wannacry")) returned 1 [0062.273] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5141, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="bg_SlateBlue.gif", cAlternateFileName="BG_SLA~1.GIF")) returned 1 [0062.273] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.273] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_SlateBlue.gif") returned 1 [0062.273] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_SlateBlue.gif") returned 1 [0062.273] lstrcmpiA (lpString1="", lpString2="bg_SlateBlue.gif") returned -1 [0062.273] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif") returned="bg_Premium.gif" [0062.273] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.273] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.273] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.273] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.273] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" [0062.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.zip") returned 0 [0062.273] lstrlenA (lpString="*.zip") returned 5 [0062.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.rar") returned 0 [0062.273] lstrlenA (lpString="*.rar") returned 5 [0062.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.7z") returned 0 [0062.273] lstrlenA (lpString="*.7z") returned 4 [0062.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.tar") returned 0 [0062.273] lstrlenA (lpString="*.tar") returned 5 [0062.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.gzip") returned 0 [0062.273] lstrlenA (lpString="*.gzip") returned 6 [0062.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.jpg") returned 0 [0062.273] lstrlenA (lpString="*.jpg") returned 5 [0062.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.jpeg") returned 0 [0062.274] lstrlenA (lpString="*.jpeg") returned 6 [0062.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.psd") returned 0 [0062.274] lstrlenA (lpString="*.psd") returned 5 [0062.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.gif") returned 1 [0062.274] lstrlenA (lpString="*.gif") returned 5 [0062.274] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" [0062.274] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" [0062.274] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif." [0062.274] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif.wannacry" [0062.274] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.274] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5141 [0062.274] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1 [0062.274] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.274] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x50c3, lpOverlapped=0x0) returned 1 [0062.276] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif") returned="bg_SlateBlue.gif" [0062.276] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.277] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x50c3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x50c3, lpOverlapped=0x0) returned 1 [0062.277] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.277] CloseHandle (hObject=0x98) returned 1 [0062.277] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif.wannacry")) returned 1 [0062.278] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x193c, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="bg_TexturedBlue.gif", cAlternateFileName="BG_TEX~1.GIF")) returned 1 [0062.278] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.278] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_TexturedBlue.gif") returned 1 [0062.278] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_TexturedBlue.gif") returned 1 [0062.278] lstrcmpiA (lpString1="", lpString2="bg_TexturedBlue.gif") returned -1 [0062.278] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif") returned="bg_SlateBlue.gif" [0062.278] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.278] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.278] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.278] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.278] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" [0062.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.zip") returned 0 [0062.278] lstrlenA (lpString="*.zip") returned 5 [0062.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.rar") returned 0 [0062.278] lstrlenA (lpString="*.rar") returned 5 [0062.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.7z") returned 0 [0062.278] lstrlenA (lpString="*.7z") returned 4 [0062.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.tar") returned 0 [0062.278] lstrlenA (lpString="*.tar") returned 5 [0062.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.gzip") returned 0 [0062.278] lstrlenA (lpString="*.gzip") returned 6 [0062.278] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.jpg") returned 0 [0062.278] lstrlenA (lpString="*.jpg") returned 5 [0062.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.jpeg") returned 0 [0062.279] lstrlenA (lpString="*.jpeg") returned 6 [0062.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.psd") returned 0 [0062.279] lstrlenA (lpString="*.psd") returned 5 [0062.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.gif") returned 1 [0062.279] lstrlenA (lpString="*.gif") returned 5 [0062.279] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" [0062.279] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" [0062.279] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif." [0062.279] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif.wannacry" [0062.279] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.279] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x193c [0062.279] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1 [0062.279] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.279] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x18be, lpOverlapped=0x0) returned 1 [0062.281] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif") returned="bg_TexturedBlue.gif" [0062.281] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.281] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x18be, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x18be, lpOverlapped=0x0) returned 1 [0062.281] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.281] CloseHandle (hObject=0x98) returned 1 [0062.281] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif.wannacry")) returned 1 [0062.282] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3c64, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="bg_VelvetRose.gif", cAlternateFileName="BG_VEL~1.GIF")) returned 1 [0062.282] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.282] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_VelvetRose.gif") returned 1 [0062.282] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_VelvetRose.gif") returned 1 [0062.282] lstrcmpiA (lpString1="", lpString2="bg_VelvetRose.gif") returned -1 [0062.282] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif") returned="bg_TexturedBlue.gif" [0062.282] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.282] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.282] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.282] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.282] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" [0062.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.zip") returned 0 [0062.282] lstrlenA (lpString="*.zip") returned 5 [0062.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.rar") returned 0 [0062.283] lstrlenA (lpString="*.rar") returned 5 [0062.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.7z") returned 0 [0062.283] lstrlenA (lpString="*.7z") returned 4 [0062.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.tar") returned 0 [0062.283] lstrlenA (lpString="*.tar") returned 5 [0062.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.gzip") returned 0 [0062.283] lstrlenA (lpString="*.gzip") returned 6 [0062.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.jpg") returned 0 [0062.283] lstrlenA (lpString="*.jpg") returned 5 [0062.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.jpeg") returned 0 [0062.283] lstrlenA (lpString="*.jpeg") returned 6 [0062.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.psd") returned 0 [0062.283] lstrlenA (lpString="*.psd") returned 5 [0062.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.gif") returned 1 [0062.283] lstrlenA (lpString="*.gif") returned 5 [0062.283] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" [0062.283] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" [0062.283] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif." [0062.283] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif.wannacry" [0062.283] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.284] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c64 [0062.284] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1 [0062.284] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.284] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3be6, lpOverlapped=0x0) returned 1 [0062.289] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif") returned="bg_VelvetRose.gif" [0062.289] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.289] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3be6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3be6, lpOverlapped=0x0) returned 1 [0062.289] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.289] CloseHandle (hObject=0x98) returned 1 [0062.289] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif.wannacry")) returned 1 [0062.290] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="button_left.gif", cAlternateFileName="BUTTON~1.GIF")) returned 1 [0062.290] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.290] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="button_left.gif") returned 1 [0062.290] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_left.gif") returned 1 [0062.290] lstrcmpiA (lpString1="", lpString2="button_left.gif") returned -1 [0062.290] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif") returned="bg_VelvetRose.gif" [0062.290] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.290] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.290] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.290] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.291] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="button_left.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" [0062.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.zip") returned 0 [0062.291] lstrlenA (lpString="*.zip") returned 5 [0062.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.rar") returned 0 [0062.291] lstrlenA (lpString="*.rar") returned 5 [0062.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.7z") returned 0 [0062.291] lstrlenA (lpString="*.7z") returned 4 [0062.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.tar") returned 0 [0062.291] lstrlenA (lpString="*.tar") returned 5 [0062.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.gzip") returned 0 [0062.291] lstrlenA (lpString="*.gzip") returned 6 [0062.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.jpg") returned 0 [0062.291] lstrlenA (lpString="*.jpg") returned 5 [0062.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.jpeg") returned 0 [0062.291] lstrlenA (lpString="*.jpeg") returned 6 [0062.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.psd") returned 0 [0062.291] lstrlenA (lpString="*.psd") returned 5 [0062.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.gif") returned 1 [0062.291] lstrlenA (lpString="*.gif") returned 5 [0062.291] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" [0062.291] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" [0062.291] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif." [0062.291] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif.wannacry" [0062.291] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.292] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x171 [0062.292] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b6c470, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1 [0062.292] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.292] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xf3, lpOverlapped=0x0) returned 1 [0062.293] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif") returned="button_left.gif" [0062.293] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.293] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xf3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xf3, lpOverlapped=0x0) returned 1 [0062.294] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.294] CloseHandle (hObject=0x98) returned 1 [0062.294] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif.wannacry")) returned 1 [0062.295] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x176, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="button_left_over.gif", cAlternateFileName="BUTTON~2.GIF")) returned 1 [0062.295] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.295] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="button_left_over.gif") returned 1 [0062.295] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_left_over.gif") returned 1 [0062.295] lstrcmpiA (lpString1="", lpString2="button_left_over.gif") returned -1 [0062.295] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif") returned="button_left.gif" [0062.295] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.295] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.295] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.295] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.295] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="button_left_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" [0062.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.zip") returned 0 [0062.295] lstrlenA (lpString="*.zip") returned 5 [0062.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.rar") returned 0 [0062.295] lstrlenA (lpString="*.rar") returned 5 [0062.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.7z") returned 0 [0062.295] lstrlenA (lpString="*.7z") returned 4 [0062.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.tar") returned 0 [0062.295] lstrlenA (lpString="*.tar") returned 5 [0062.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.gzip") returned 0 [0062.295] lstrlenA (lpString="*.gzip") returned 6 [0062.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.jpg") returned 0 [0062.295] lstrlenA (lpString="*.jpg") returned 5 [0062.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.jpeg") returned 0 [0062.295] lstrlenA (lpString="*.jpeg") returned 6 [0062.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.psd") returned 0 [0062.296] lstrlenA (lpString="*.psd") returned 5 [0062.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.gif") returned 1 [0062.296] lstrlenA (lpString="*.gif") returned 5 [0062.296] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" [0062.296] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" [0062.296] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif." [0062.296] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif.wannacry" [0062.296] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.296] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x176 [0062.296] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b6c470, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1 [0062.296] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.296] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xf8, lpOverlapped=0x0) returned 1 [0062.297] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif") returned="button_left_over.gif" [0062.297] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.298] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xf8, lpOverlapped=0x0) returned 1 [0062.298] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.298] CloseHandle (hObject=0x98) returned 1 [0062.298] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif.wannacry")) returned 1 [0062.298] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb5, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="button_mid.gif", cAlternateFileName="BUTTON~3.GIF")) returned 1 [0062.299] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.299] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="button_mid.gif") returned 1 [0062.299] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_mid.gif") returned 1 [0062.299] lstrcmpiA (lpString1="", lpString2="button_mid.gif") returned -1 [0062.299] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif") returned="button_left_over.gif" [0062.299] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.299] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.299] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.299] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.299] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="button_mid.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" [0062.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.zip") returned 0 [0062.299] lstrlenA (lpString="*.zip") returned 5 [0062.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.rar") returned 0 [0062.299] lstrlenA (lpString="*.rar") returned 5 [0062.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.7z") returned 0 [0062.299] lstrlenA (lpString="*.7z") returned 4 [0062.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.tar") returned 0 [0062.299] lstrlenA (lpString="*.tar") returned 5 [0062.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.gzip") returned 0 [0062.299] lstrlenA (lpString="*.gzip") returned 6 [0062.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.jpg") returned 0 [0062.299] lstrlenA (lpString="*.jpg") returned 5 [0062.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.jpeg") returned 0 [0062.299] lstrlenA (lpString="*.jpeg") returned 6 [0062.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.psd") returned 0 [0062.299] lstrlenA (lpString="*.psd") returned 5 [0062.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.gif") returned 1 [0062.299] lstrlenA (lpString="*.gif") returned 5 [0062.299] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" [0062.300] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" [0062.300] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif." [0062.300] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif.wannacry" [0062.300] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.300] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb5 [0062.300] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b6c470, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1 [0062.300] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.300] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x37, lpOverlapped=0x0) returned 1 [0062.301] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif") returned="button_mid.gif" [0062.302] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.302] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x37, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x37, lpOverlapped=0x0) returned 1 [0062.302] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.302] CloseHandle (hObject=0x98) returned 1 [0062.302] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif.wannacry")) returned 1 [0062.303] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="button_mid_over.gif", cAlternateFileName="BUTTON~4.GIF")) returned 1 [0062.303] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.303] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="button_mid_over.gif") returned 1 [0062.303] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_mid_over.gif") returned 1 [0062.303] lstrcmpiA (lpString1="", lpString2="button_mid_over.gif") returned -1 [0062.303] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif") returned="button_mid.gif" [0062.303] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.303] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.303] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.303] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.303] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="button_mid_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" [0062.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.zip") returned 0 [0062.303] lstrlenA (lpString="*.zip") returned 5 [0062.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.rar") returned 0 [0062.303] lstrlenA (lpString="*.rar") returned 5 [0062.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.7z") returned 0 [0062.303] lstrlenA (lpString="*.7z") returned 4 [0062.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.tar") returned 0 [0062.303] lstrlenA (lpString="*.tar") returned 5 [0062.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.gzip") returned 0 [0062.303] lstrlenA (lpString="*.gzip") returned 6 [0062.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.jpg") returned 0 [0062.303] lstrlenA (lpString="*.jpg") returned 5 [0062.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.jpeg") returned 0 [0062.304] lstrlenA (lpString="*.jpeg") returned 6 [0062.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.psd") returned 0 [0062.304] lstrlenA (lpString="*.psd") returned 5 [0062.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.gif") returned 1 [0062.304] lstrlenA (lpString="*.gif") returned 5 [0062.304] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" [0062.304] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" [0062.304] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif." [0062.304] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif.wannacry" [0062.304] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.305] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb7 [0062.305] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b925d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1 [0062.305] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.305] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x39, lpOverlapped=0x0) returned 1 [0062.306] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif") returned="button_mid_over.gif" [0062.306] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.306] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x39, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x39, lpOverlapped=0x0) returned 1 [0062.306] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.306] CloseHandle (hObject=0x98) returned 1 [0062.306] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif.wannacry")) returned 1 [0062.307] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="button_right.gif", cAlternateFileName="BU7DFA~1.GIF")) returned 1 [0062.307] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.307] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="button_right.gif") returned 1 [0062.307] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_right.gif") returned 1 [0062.307] lstrcmpiA (lpString1="", lpString2="button_right.gif") returned -1 [0062.307] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif") returned="button_mid_over.gif" [0062.307] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.307] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.307] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.307] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.307] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="button_right.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" [0062.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.zip") returned 0 [0062.308] lstrlenA (lpString="*.zip") returned 5 [0062.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.rar") returned 0 [0062.308] lstrlenA (lpString="*.rar") returned 5 [0062.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.7z") returned 0 [0062.308] lstrlenA (lpString="*.7z") returned 4 [0062.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.tar") returned 0 [0062.308] lstrlenA (lpString="*.tar") returned 5 [0062.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.gzip") returned 0 [0062.308] lstrlenA (lpString="*.gzip") returned 6 [0062.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.jpg") returned 0 [0062.308] lstrlenA (lpString="*.jpg") returned 5 [0062.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.jpeg") returned 0 [0062.308] lstrlenA (lpString="*.jpeg") returned 6 [0062.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.psd") returned 0 [0062.308] lstrlenA (lpString="*.psd") returned 5 [0062.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.gif") returned 1 [0062.308] lstrlenA (lpString="*.gif") returned 5 [0062.308] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" [0062.308] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" [0062.308] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif." [0062.308] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif.wannacry" [0062.308] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.309] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x171 [0062.309] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b925d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1 [0062.309] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.309] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xf3, lpOverlapped=0x0) returned 1 [0062.310] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif") returned="button_right.gif" [0062.310] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.310] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xf3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xf3, lpOverlapped=0x0) returned 1 [0062.310] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.310] CloseHandle (hObject=0x98) returned 1 [0062.310] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif.wannacry")) returned 1 [0062.311] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="button_right_over.gif", cAlternateFileName="BU4B4E~1.GIF")) returned 1 [0062.311] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.311] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="button_right_over.gif") returned 1 [0062.311] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_right_over.gif") returned 1 [0062.311] lstrcmpiA (lpString1="", lpString2="button_right_over.gif") returned -1 [0062.311] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif") returned="button_right.gif" [0062.311] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.311] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.311] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.311] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.311] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="button_right_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" [0062.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.zip") returned 0 [0062.311] lstrlenA (lpString="*.zip") returned 5 [0062.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.rar") returned 0 [0062.311] lstrlenA (lpString="*.rar") returned 5 [0062.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.7z") returned 0 [0062.311] lstrlenA (lpString="*.7z") returned 4 [0062.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.tar") returned 0 [0062.312] lstrlenA (lpString="*.tar") returned 5 [0062.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.gzip") returned 0 [0062.312] lstrlenA (lpString="*.gzip") returned 6 [0062.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.jpg") returned 0 [0062.312] lstrlenA (lpString="*.jpg") returned 5 [0062.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.jpeg") returned 0 [0062.312] lstrlenA (lpString="*.jpeg") returned 6 [0062.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.psd") returned 0 [0062.312] lstrlenA (lpString="*.psd") returned 5 [0062.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.gif") returned 1 [0062.312] lstrlenA (lpString="*.gif") returned 5 [0062.312] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" [0062.312] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" [0062.312] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif." [0062.312] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif.wannacry" [0062.312] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.312] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x244 [0062.312] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b925d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1 [0062.312] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.313] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1c6, lpOverlapped=0x0) returned 1 [0062.327] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif") returned="button_right_over.gif" [0062.327] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.327] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1c6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1c6, lpOverlapped=0x0) returned 1 [0062.327] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.327] CloseHandle (hObject=0x98) returned 1 [0062.327] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif.wannacry")) returned 1 [0062.328] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="CALENDAR.GIF", cAlternateFileName="")) returned 1 [0062.328] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.328] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CALENDAR.GIF") returned 1 [0062.328] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CALENDAR.GIF") returned 1 [0062.328] lstrcmpiA (lpString1="", lpString2="CALENDAR.GIF") returned -1 [0062.328] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif") returned="button_right_over.gif" [0062.328] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.328] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.329] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.329] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.329] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="CALENDAR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF" [0062.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.zip") returned 0 [0062.329] lstrlenA (lpString="*.zip") returned 5 [0062.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.rar") returned 0 [0062.329] lstrlenA (lpString="*.rar") returned 5 [0062.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.7z") returned 0 [0062.329] lstrlenA (lpString="*.7z") returned 4 [0062.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.tar") returned 0 [0062.329] lstrlenA (lpString="*.tar") returned 5 [0062.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.gzip") returned 0 [0062.329] lstrlenA (lpString="*.gzip") returned 6 [0062.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.jpg") returned 0 [0062.329] lstrlenA (lpString="*.jpg") returned 5 [0062.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.jpeg") returned 0 [0062.329] lstrlenA (lpString="*.jpeg") returned 6 [0062.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.psd") returned 0 [0062.329] lstrlenA (lpString="*.psd") returned 5 [0062.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.gif") returned 1 [0062.329] lstrlenA (lpString="*.gif") returned 5 [0062.329] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF" [0062.329] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF" [0062.329] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF." [0062.329] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF.wannacry" [0062.329] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\calendar.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.330] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x383 [0062.330] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60120f70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1 [0062.330] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.330] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x305, lpOverlapped=0x0) returned 1 [0062.332] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF") returned="CALENDAR.GIF" [0062.332] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.332] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x305, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x305, lpOverlapped=0x0) returned 1 [0062.332] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.332] CloseHandle (hObject=0x98) returned 1 [0062.332] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\calendar.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\calendar.gif.wannacry")) returned 1 [0062.335] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="DELETE.GIF", cAlternateFileName="")) returned 1 [0062.335] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.335] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DELETE.GIF") returned 1 [0062.335] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DELETE.GIF") returned 1 [0062.335] lstrcmpiA (lpString1="", lpString2="DELETE.GIF") returned -1 [0062.335] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF") returned="CALENDAR.GIF" [0062.335] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.335] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.335] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.335] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.335] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="DELETE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF" [0062.335] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.zip") returned 0 [0062.335] lstrlenA (lpString="*.zip") returned 5 [0062.335] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.rar") returned 0 [0062.335] lstrlenA (lpString="*.rar") returned 5 [0062.335] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.7z") returned 0 [0062.335] lstrlenA (lpString="*.7z") returned 4 [0062.335] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.tar") returned 0 [0062.335] lstrlenA (lpString="*.tar") returned 5 [0062.336] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.gzip") returned 0 [0062.336] lstrlenA (lpString="*.gzip") returned 6 [0062.336] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.jpg") returned 0 [0062.336] lstrlenA (lpString="*.jpg") returned 5 [0062.336] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.jpeg") returned 0 [0062.336] lstrlenA (lpString="*.jpeg") returned 6 [0062.336] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.psd") returned 0 [0062.336] lstrlenA (lpString="*.psd") returned 5 [0062.336] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.gif") returned 1 [0062.336] lstrlenA (lpString="*.gif") returned 5 [0062.336] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF" [0062.336] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF" [0062.336] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF." [0062.336] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF.wannacry" [0062.336] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\delete.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.337] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x271 [0062.337] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60760930, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1 [0062.337] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.337] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1f3, lpOverlapped=0x0) returned 1 [0062.338] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF") returned="DELETE.GIF" [0062.338] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.338] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1f3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1f3, lpOverlapped=0x0) returned 1 [0062.339] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.339] CloseHandle (hObject=0x98) returned 1 [0062.339] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\delete.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\delete.gif.wannacry")) returned 1 [0062.341] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60975c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x369, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="ERROR.GIF", cAlternateFileName="")) returned 1 [0062.341] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.341] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ERROR.GIF") returned -1 [0062.341] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ERROR.GIF") returned 1 [0062.342] lstrcmpiA (lpString1="", lpString2="ERROR.GIF") returned -1 [0062.342] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF") returned="DELETE.GIF" [0062.342] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.342] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.342] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.342] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.342] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="ERROR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF" [0062.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.zip") returned 0 [0062.342] lstrlenA (lpString="*.zip") returned 5 [0062.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.rar") returned 0 [0062.342] lstrlenA (lpString="*.rar") returned 5 [0062.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.7z") returned 0 [0062.342] lstrlenA (lpString="*.7z") returned 4 [0062.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.tar") returned 0 [0062.342] lstrlenA (lpString="*.tar") returned 5 [0062.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.gzip") returned 0 [0062.342] lstrlenA (lpString="*.gzip") returned 6 [0062.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.jpg") returned 0 [0062.342] lstrlenA (lpString="*.jpg") returned 5 [0062.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.jpeg") returned 0 [0062.342] lstrlenA (lpString="*.jpeg") returned 6 [0062.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.psd") returned 0 [0062.342] lstrlenA (lpString="*.psd") returned 5 [0062.342] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.gif") returned 1 [0062.342] lstrlenA (lpString="*.gif") returned 5 [0062.342] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF" [0062.342] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF" [0062.342] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF." [0062.342] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF.wannacry" [0062.342] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\error.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.344] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x369 [0062.344] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60975c70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea)) returned 1 [0062.344] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.344] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2eb, lpOverlapped=0x0) returned 1 [0062.346] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF") returned="ERROR.GIF" [0062.346] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.346] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2eb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2eb, lpOverlapped=0x0) returned 1 [0062.346] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.346] CloseHandle (hObject=0x98) returned 1 [0062.346] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\error.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\error.gif.wannacry")) returned 1 [0062.347] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="FORM.ICO", cAlternateFileName="")) returned 1 [0062.347] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.347] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FORM.ICO") returned -1 [0062.347] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FORM.ICO") returned 1 [0062.347] lstrcmpiA (lpString1="", lpString2="FORM.ICO") returned -1 [0062.347] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF") returned="ERROR.GIF" [0062.347] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.347] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.347] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.347] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.347] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FORM.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO" [0062.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.zip") returned 0 [0062.347] lstrlenA (lpString="*.zip") returned 5 [0062.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.rar") returned 0 [0062.347] lstrlenA (lpString="*.rar") returned 5 [0062.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.7z") returned 0 [0062.347] lstrlenA (lpString="*.7z") returned 4 [0062.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.tar") returned 0 [0062.347] lstrlenA (lpString="*.tar") returned 5 [0062.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.gzip") returned 0 [0062.348] lstrlenA (lpString="*.gzip") returned 6 [0062.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.jpg") returned 0 [0062.348] lstrlenA (lpString="*.jpg") returned 5 [0062.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.jpeg") returned 0 [0062.348] lstrlenA (lpString="*.jpeg") returned 6 [0062.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.psd") returned 0 [0062.348] lstrlenA (lpString="*.psd") returned 5 [0062.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.gif") returned 0 [0062.348] lstrlenA (lpString="*.gif") returned 5 [0062.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.doc") returned 0 [0062.348] lstrlenA (lpString="*.doc") returned 5 [0062.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.docx") returned 0 [0062.348] lstrlenA (lpString="*.docx") returned 6 [0062.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.xls") returned 0 [0062.348] lstrlenA (lpString="*.xls") returned 5 [0062.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.xlsx") returned 0 [0062.348] lstrlenA (lpString="*.xlsx") returned 6 [0062.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.ppt") returned 0 [0062.348] lstrlenA (lpString="*.ppt") returned 5 [0062.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.pptx") returned 0 [0062.348] lstrlenA (lpString="*.pptx") returned 6 [0062.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.pdf") returned 0 [0062.348] lstrlenA (lpString="*.pdf") returned 5 [0062.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.mov") returned 0 [0062.348] lstrlenA (lpString="*.mov") returned 5 [0062.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.m2v") returned 0 [0062.348] lstrlenA (lpString="*.m2v") returned 5 [0062.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.3gp") returned 0 [0062.348] lstrlenA (lpString="*.3gp") returned 5 [0062.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.mpeg") returned 0 [0062.348] lstrlenA (lpString="*.mpeg") returned 6 [0062.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.mpg") returned 0 [0062.349] lstrlenA (lpString="*.mpg") returned 5 [0062.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.flv") returned 0 [0062.349] lstrlenA (lpString="*.flv") returned 5 [0062.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.avi") returned 0 [0062.349] lstrlenA (lpString="*.avi") returned 5 [0062.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.mp4") returned 0 [0062.349] lstrlenA (lpString="*.mp4") returned 5 [0062.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.wmv") returned 0 [0062.349] lstrlenA (lpString="*.wmv") returned 5 [0062.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.divx") returned 0 [0062.349] lstrlenA (lpString="*.divx") returned 6 [0062.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.mkv") returned 0 [0062.349] lstrlenA (lpString="*.mkv") returned 5 [0062.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.mp3") returned 0 [0062.349] lstrlenA (lpString="*.mp3") returned 5 [0062.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.wav") returned 0 [0062.349] lstrlenA (lpString="*.wav") returned 5 [0062.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.flac") returned 0 [0062.349] lstrlenA (lpString="*.flac") returned 6 [0062.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.ape") returned 0 [0062.349] lstrlenA (lpString="*.ape") returned 5 [0062.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.wma") returned 0 [0062.349] lstrlenA (lpString="*.wma") returned 5 [0062.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.ac3") returned 0 [0062.349] lstrlenA (lpString="*.ac3") returned 5 [0062.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.mxf") returned 0 [0062.349] lstrlenA (lpString="*.mxf") returned 5 [0062.349] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1388d, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FORM.JS", cAlternateFileName="")) returned 1 [0062.349] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.349] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FORM.JS") returned -1 [0062.349] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FORM.JS") returned 1 [0062.349] lstrcmpiA (lpString1="", lpString2="FORM.JS") returned -1 [0062.349] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO") returned="FORM.ICO" [0062.349] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.349] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.350] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.350] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.350] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FORM.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS" [0062.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.zip") returned 0 [0062.350] lstrlenA (lpString="*.zip") returned 5 [0062.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.rar") returned 0 [0062.350] lstrlenA (lpString="*.rar") returned 5 [0062.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.7z") returned 0 [0062.350] lstrlenA (lpString="*.7z") returned 4 [0062.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.tar") returned 0 [0062.350] lstrlenA (lpString="*.tar") returned 5 [0062.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.gzip") returned 0 [0062.350] lstrlenA (lpString="*.gzip") returned 6 [0062.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.jpg") returned 0 [0062.350] lstrlenA (lpString="*.jpg") returned 5 [0062.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.jpeg") returned 0 [0062.350] lstrlenA (lpString="*.jpeg") returned 6 [0062.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.psd") returned 0 [0062.350] lstrlenA (lpString="*.psd") returned 5 [0062.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.gif") returned 0 [0062.350] lstrlenA (lpString="*.gif") returned 5 [0062.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.doc") returned 0 [0062.350] lstrlenA (lpString="*.doc") returned 5 [0062.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.docx") returned 0 [0062.350] lstrlenA (lpString="*.docx") returned 6 [0062.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.xls") returned 0 [0062.350] lstrlenA (lpString="*.xls") returned 5 [0062.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.xlsx") returned 0 [0062.351] lstrlenA (lpString="*.xlsx") returned 6 [0062.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.ppt") returned 0 [0062.351] lstrlenA (lpString="*.ppt") returned 5 [0062.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.pptx") returned 0 [0062.351] lstrlenA (lpString="*.pptx") returned 6 [0062.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.pdf") returned 0 [0062.351] lstrlenA (lpString="*.pdf") returned 5 [0062.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.mov") returned 0 [0062.351] lstrlenA (lpString="*.mov") returned 5 [0062.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.m2v") returned 0 [0062.351] lstrlenA (lpString="*.m2v") returned 5 [0062.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.3gp") returned 0 [0062.351] lstrlenA (lpString="*.3gp") returned 5 [0062.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.mpeg") returned 0 [0062.351] lstrlenA (lpString="*.mpeg") returned 6 [0062.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.mpg") returned 0 [0062.351] lstrlenA (lpString="*.mpg") returned 5 [0062.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.flv") returned 0 [0062.351] lstrlenA (lpString="*.flv") returned 5 [0062.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.avi") returned 0 [0062.351] lstrlenA (lpString="*.avi") returned 5 [0062.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.mp4") returned 0 [0062.351] lstrlenA (lpString="*.mp4") returned 5 [0062.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.wmv") returned 0 [0062.351] lstrlenA (lpString="*.wmv") returned 5 [0062.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.divx") returned 0 [0062.351] lstrlenA (lpString="*.divx") returned 6 [0062.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.mkv") returned 0 [0062.351] lstrlenA (lpString="*.mkv") returned 5 [0062.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.mp3") returned 0 [0062.352] lstrlenA (lpString="*.mp3") returned 5 [0062.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.wav") returned 0 [0062.352] lstrlenA (lpString="*.wav") returned 5 [0062.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.flac") returned 0 [0062.352] lstrlenA (lpString="*.flac") returned 6 [0062.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.ape") returned 0 [0062.352] lstrlenA (lpString="*.ape") returned 5 [0062.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.wma") returned 0 [0062.352] lstrlenA (lpString="*.wma") returned 5 [0062.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.ac3") returned 0 [0062.352] lstrlenA (lpString="*.ac3") returned 5 [0062.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.mxf") returned 0 [0062.352] lstrlenA (lpString="*.mxf") returned 5 [0062.352] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x45d, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsBlankPage.html", cAlternateFileName="FORMSB~2.HTM")) returned 1 [0062.352] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.352] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsBlankPage.html") returned -1 [0062.352] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsBlankPage.html") returned 1 [0062.352] lstrcmpiA (lpString1="", lpString2="FormsBlankPage.html") returned -1 [0062.352] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS") returned="FORM.JS" [0062.352] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.352] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.352] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.352] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.352] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html" [0062.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.zip") returned 0 [0062.353] lstrlenA (lpString="*.zip") returned 5 [0062.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.rar") returned 0 [0062.353] lstrlenA (lpString="*.rar") returned 5 [0062.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.7z") returned 0 [0062.353] lstrlenA (lpString="*.7z") returned 4 [0062.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.tar") returned 0 [0062.353] lstrlenA (lpString="*.tar") returned 5 [0062.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.gzip") returned 0 [0062.353] lstrlenA (lpString="*.gzip") returned 6 [0062.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.jpg") returned 0 [0062.353] lstrlenA (lpString="*.jpg") returned 5 [0062.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.jpeg") returned 0 [0062.353] lstrlenA (lpString="*.jpeg") returned 6 [0062.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.psd") returned 0 [0062.353] lstrlenA (lpString="*.psd") returned 5 [0062.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.gif") returned 0 [0062.353] lstrlenA (lpString="*.gif") returned 5 [0062.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.doc") returned 0 [0062.353] lstrlenA (lpString="*.doc") returned 5 [0062.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.docx") returned 0 [0062.353] lstrlenA (lpString="*.docx") returned 6 [0062.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.xls") returned 0 [0062.353] lstrlenA (lpString="*.xls") returned 5 [0062.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.xlsx") returned 0 [0062.353] lstrlenA (lpString="*.xlsx") returned 6 [0062.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.ppt") returned 0 [0062.353] lstrlenA (lpString="*.ppt") returned 5 [0062.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.pptx") returned 0 [0062.353] lstrlenA (lpString="*.pptx") returned 6 [0062.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.pdf") returned 0 [0062.353] lstrlenA (lpString="*.pdf") returned 5 [0062.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.mov") returned 0 [0062.354] lstrlenA (lpString="*.mov") returned 5 [0062.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.m2v") returned 0 [0062.354] lstrlenA (lpString="*.m2v") returned 5 [0062.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.3gp") returned 0 [0062.354] lstrlenA (lpString="*.3gp") returned 5 [0062.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.mpeg") returned 0 [0062.354] lstrlenA (lpString="*.mpeg") returned 6 [0062.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.mpg") returned 0 [0062.354] lstrlenA (lpString="*.mpg") returned 5 [0062.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.flv") returned 0 [0062.354] lstrlenA (lpString="*.flv") returned 5 [0062.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.avi") returned 0 [0062.354] lstrlenA (lpString="*.avi") returned 5 [0062.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.mp4") returned 0 [0062.354] lstrlenA (lpString="*.mp4") returned 5 [0062.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.wmv") returned 0 [0062.354] lstrlenA (lpString="*.wmv") returned 5 [0062.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.divx") returned 0 [0062.354] lstrlenA (lpString="*.divx") returned 6 [0062.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.mkv") returned 0 [0062.354] lstrlenA (lpString="*.mkv") returned 5 [0062.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.mp3") returned 0 [0062.354] lstrlenA (lpString="*.mp3") returned 5 [0062.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.wav") returned 0 [0062.354] lstrlenA (lpString="*.wav") returned 5 [0062.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.flac") returned 0 [0062.354] lstrlenA (lpString="*.flac") returned 6 [0062.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.ape") returned 0 [0062.355] lstrlenA (lpString="*.ape") returned 5 [0062.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.wma") returned 0 [0062.355] lstrlenA (lpString="*.wma") returned 5 [0062.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.ac3") returned 0 [0062.355] lstrlenA (lpString="*.ac3") returned 5 [0062.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.mxf") returned 0 [0062.355] lstrlenA (lpString="*.mxf") returned 5 [0062.355] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x850, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsBrowserUpgrade.html", cAlternateFileName="FORMSB~1.HTM")) returned 1 [0062.355] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.355] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsBrowserUpgrade.html") returned -1 [0062.356] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsBrowserUpgrade.html") returned 1 [0062.356] lstrcmpiA (lpString1="", lpString2="FormsBrowserUpgrade.html") returned -1 [0062.356] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html") returned="FormsBlankPage.html" [0062.356] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.356] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.356] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.356] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.356] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html" [0062.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.zip") returned 0 [0062.356] lstrlenA (lpString="*.zip") returned 5 [0062.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.rar") returned 0 [0062.356] lstrlenA (lpString="*.rar") returned 5 [0062.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.7z") returned 0 [0062.356] lstrlenA (lpString="*.7z") returned 4 [0062.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.tar") returned 0 [0062.356] lstrlenA (lpString="*.tar") returned 5 [0062.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.gzip") returned 0 [0062.356] lstrlenA (lpString="*.gzip") returned 6 [0062.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.jpg") returned 0 [0062.356] lstrlenA (lpString="*.jpg") returned 5 [0062.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.jpeg") returned 0 [0062.356] lstrlenA (lpString="*.jpeg") returned 6 [0062.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.psd") returned 0 [0062.356] lstrlenA (lpString="*.psd") returned 5 [0062.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.gif") returned 0 [0062.356] lstrlenA (lpString="*.gif") returned 5 [0062.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.doc") returned 0 [0062.356] lstrlenA (lpString="*.doc") returned 5 [0062.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.docx") returned 0 [0062.356] lstrlenA (lpString="*.docx") returned 6 [0062.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.xls") returned 0 [0062.356] lstrlenA (lpString="*.xls") returned 5 [0062.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.xlsx") returned 0 [0062.357] lstrlenA (lpString="*.xlsx") returned 6 [0062.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.ppt") returned 0 [0062.357] lstrlenA (lpString="*.ppt") returned 5 [0062.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.pptx") returned 0 [0062.357] lstrlenA (lpString="*.pptx") returned 6 [0062.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.pdf") returned 0 [0062.357] lstrlenA (lpString="*.pdf") returned 5 [0062.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.mov") returned 0 [0062.357] lstrlenA (lpString="*.mov") returned 5 [0062.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.m2v") returned 0 [0062.357] lstrlenA (lpString="*.m2v") returned 5 [0062.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.3gp") returned 0 [0062.357] lstrlenA (lpString="*.3gp") returned 5 [0062.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.mpeg") returned 0 [0062.357] lstrlenA (lpString="*.mpeg") returned 6 [0062.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.mpg") returned 0 [0062.357] lstrlenA (lpString="*.mpg") returned 5 [0062.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.flv") returned 0 [0062.357] lstrlenA (lpString="*.flv") returned 5 [0062.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.avi") returned 0 [0062.357] lstrlenA (lpString="*.avi") returned 5 [0062.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.mp4") returned 0 [0062.357] lstrlenA (lpString="*.mp4") returned 5 [0062.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.wmv") returned 0 [0062.357] lstrlenA (lpString="*.wmv") returned 5 [0062.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.divx") returned 0 [0062.357] lstrlenA (lpString="*.divx") returned 6 [0062.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.mkv") returned 0 [0062.357] lstrlenA (lpString="*.mkv") returned 5 [0062.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.mp3") returned 0 [0062.357] lstrlenA (lpString="*.mp3") returned 5 [0062.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.wav") returned 0 [0062.358] lstrlenA (lpString="*.wav") returned 5 [0062.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.flac") returned 0 [0062.358] lstrlenA (lpString="*.flac") returned 6 [0062.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.ape") returned 0 [0062.358] lstrlenA (lpString="*.ape") returned 5 [0062.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.wma") returned 0 [0062.358] lstrlenA (lpString="*.wma") returned 5 [0062.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.ac3") returned 0 [0062.358] lstrlenA (lpString="*.ac3") returned 5 [0062.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.mxf") returned 0 [0062.358] lstrlenA (lpString="*.mxf") returned 5 [0062.358] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsColorChart.html", cAlternateFileName="FORMSC~1.HTM")) returned 1 [0062.358] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.358] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsColorChart.html") returned -1 [0062.358] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsColorChart.html") returned 1 [0062.358] lstrcmpiA (lpString1="", lpString2="FormsColorChart.html") returned -1 [0062.358] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html") returned="FormsBrowserUpgrade.html" [0062.358] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.358] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.358] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.358] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.358] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsColorChart.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html" [0062.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.zip") returned 0 [0062.358] lstrlenA (lpString="*.zip") returned 5 [0062.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.rar") returned 0 [0062.358] lstrlenA (lpString="*.rar") returned 5 [0062.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.7z") returned 0 [0062.358] lstrlenA (lpString="*.7z") returned 4 [0062.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.tar") returned 0 [0062.358] lstrlenA (lpString="*.tar") returned 5 [0062.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.gzip") returned 0 [0062.359] lstrlenA (lpString="*.gzip") returned 6 [0062.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.jpg") returned 0 [0062.359] lstrlenA (lpString="*.jpg") returned 5 [0062.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.jpeg") returned 0 [0062.359] lstrlenA (lpString="*.jpeg") returned 6 [0062.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.psd") returned 0 [0062.359] lstrlenA (lpString="*.psd") returned 5 [0062.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.gif") returned 0 [0062.359] lstrlenA (lpString="*.gif") returned 5 [0062.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.doc") returned 0 [0062.359] lstrlenA (lpString="*.doc") returned 5 [0062.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.docx") returned 0 [0062.359] lstrlenA (lpString="*.docx") returned 6 [0062.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.xls") returned 0 [0062.359] lstrlenA (lpString="*.xls") returned 5 [0062.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.xlsx") returned 0 [0062.359] lstrlenA (lpString="*.xlsx") returned 6 [0062.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.ppt") returned 0 [0062.359] lstrlenA (lpString="*.ppt") returned 5 [0062.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.pptx") returned 0 [0062.359] lstrlenA (lpString="*.pptx") returned 6 [0062.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.pdf") returned 0 [0062.359] lstrlenA (lpString="*.pdf") returned 5 [0062.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.mov") returned 0 [0062.359] lstrlenA (lpString="*.mov") returned 5 [0062.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.m2v") returned 0 [0062.359] lstrlenA (lpString="*.m2v") returned 5 [0062.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.3gp") returned 0 [0062.359] lstrlenA (lpString="*.3gp") returned 5 [0062.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.mpeg") returned 0 [0062.359] lstrlenA (lpString="*.mpeg") returned 6 [0062.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.mpg") returned 0 [0062.359] lstrlenA (lpString="*.mpg") returned 5 [0062.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.flv") returned 0 [0062.359] lstrlenA (lpString="*.flv") returned 5 [0062.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.avi") returned 0 [0062.360] lstrlenA (lpString="*.avi") returned 5 [0062.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.mp4") returned 0 [0062.360] lstrlenA (lpString="*.mp4") returned 5 [0062.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.wmv") returned 0 [0062.360] lstrlenA (lpString="*.wmv") returned 5 [0062.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.divx") returned 0 [0062.360] lstrlenA (lpString="*.divx") returned 6 [0062.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.mkv") returned 0 [0062.360] lstrlenA (lpString="*.mkv") returned 5 [0062.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.mp3") returned 0 [0062.360] lstrlenA (lpString="*.mp3") returned 5 [0062.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.wav") returned 0 [0062.360] lstrlenA (lpString="*.wav") returned 5 [0062.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.flac") returned 0 [0062.360] lstrlenA (lpString="*.flac") returned 6 [0062.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.ape") returned 0 [0062.360] lstrlenA (lpString="*.ape") returned 5 [0062.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.wma") returned 0 [0062.360] lstrlenA (lpString="*.wma") returned 5 [0062.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.ac3") returned 0 [0062.360] lstrlenA (lpString="*.ac3") returned 5 [0062.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.mxf") returned 0 [0062.360] lstrlenA (lpString="*.mxf") returned 5 [0062.360] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc94, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsFormTemplate.html", cAlternateFileName="FORMSF~1.HTM")) returned 1 [0062.360] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.360] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsFormTemplate.html") returned -1 [0062.360] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsFormTemplate.html") returned 1 [0062.360] lstrcmpiA (lpString1="", lpString2="FormsFormTemplate.html") returned -1 [0062.360] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html") returned="FormsColorChart.html" [0062.360] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.360] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.360] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.360] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.361] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsFormTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html" [0062.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.zip") returned 0 [0062.361] lstrlenA (lpString="*.zip") returned 5 [0062.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.rar") returned 0 [0062.361] lstrlenA (lpString="*.rar") returned 5 [0062.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.7z") returned 0 [0062.361] lstrlenA (lpString="*.7z") returned 4 [0062.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.tar") returned 0 [0062.361] lstrlenA (lpString="*.tar") returned 5 [0062.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.gzip") returned 0 [0062.361] lstrlenA (lpString="*.gzip") returned 6 [0062.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.jpg") returned 0 [0062.361] lstrlenA (lpString="*.jpg") returned 5 [0062.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.jpeg") returned 0 [0062.361] lstrlenA (lpString="*.jpeg") returned 6 [0062.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.psd") returned 0 [0062.361] lstrlenA (lpString="*.psd") returned 5 [0062.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.gif") returned 0 [0062.361] lstrlenA (lpString="*.gif") returned 5 [0062.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.doc") returned 0 [0062.361] lstrlenA (lpString="*.doc") returned 5 [0062.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.docx") returned 0 [0062.361] lstrlenA (lpString="*.docx") returned 6 [0062.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.xls") returned 0 [0062.361] lstrlenA (lpString="*.xls") returned 5 [0062.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.xlsx") returned 0 [0062.361] lstrlenA (lpString="*.xlsx") returned 6 [0062.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.ppt") returned 0 [0062.361] lstrlenA (lpString="*.ppt") returned 5 [0062.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.pptx") returned 0 [0062.361] lstrlenA (lpString="*.pptx") returned 6 [0062.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.pdf") returned 0 [0062.361] lstrlenA (lpString="*.pdf") returned 5 [0062.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.mov") returned 0 [0062.362] lstrlenA (lpString="*.mov") returned 5 [0062.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.m2v") returned 0 [0062.362] lstrlenA (lpString="*.m2v") returned 5 [0062.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.3gp") returned 0 [0062.362] lstrlenA (lpString="*.3gp") returned 5 [0062.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.mpeg") returned 0 [0062.362] lstrlenA (lpString="*.mpeg") returned 6 [0062.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.mpg") returned 0 [0062.362] lstrlenA (lpString="*.mpg") returned 5 [0062.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.flv") returned 0 [0062.362] lstrlenA (lpString="*.flv") returned 5 [0062.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.avi") returned 0 [0062.362] lstrlenA (lpString="*.avi") returned 5 [0062.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.mp4") returned 0 [0062.362] lstrlenA (lpString="*.mp4") returned 5 [0062.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.wmv") returned 0 [0062.362] lstrlenA (lpString="*.wmv") returned 5 [0062.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.divx") returned 0 [0062.362] lstrlenA (lpString="*.divx") returned 6 [0062.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.mkv") returned 0 [0062.362] lstrlenA (lpString="*.mkv") returned 5 [0062.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.mp3") returned 0 [0062.362] lstrlenA (lpString="*.mp3") returned 5 [0062.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.wav") returned 0 [0062.362] lstrlenA (lpString="*.wav") returned 5 [0062.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.flac") returned 0 [0062.362] lstrlenA (lpString="*.flac") returned 6 [0062.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.ape") returned 0 [0062.362] lstrlenA (lpString="*.ape") returned 5 [0062.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.wma") returned 0 [0062.362] lstrlenA (lpString="*.wma") returned 5 [0062.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.ac3") returned 0 [0062.363] lstrlenA (lpString="*.ac3") returned 5 [0062.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.mxf") returned 0 [0062.363] lstrlenA (lpString="*.mxf") returned 5 [0062.363] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc7c, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsHomePage.html", cAlternateFileName="FORMSH~1.HTM")) returned 1 [0062.363] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.363] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsHomePage.html") returned -1 [0062.363] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsHomePage.html") returned 1 [0062.363] lstrcmpiA (lpString1="", lpString2="FormsHomePage.html") returned -1 [0062.363] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html") returned="FormsFormTemplate.html" [0062.363] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.363] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.363] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.363] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.363] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsHomePage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html" [0062.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.zip") returned 0 [0062.363] lstrlenA (lpString="*.zip") returned 5 [0062.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.rar") returned 0 [0062.364] lstrlenA (lpString="*.rar") returned 5 [0062.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.7z") returned 0 [0062.364] lstrlenA (lpString="*.7z") returned 4 [0062.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.tar") returned 0 [0062.364] lstrlenA (lpString="*.tar") returned 5 [0062.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.gzip") returned 0 [0062.364] lstrlenA (lpString="*.gzip") returned 6 [0062.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.jpg") returned 0 [0062.364] lstrlenA (lpString="*.jpg") returned 5 [0062.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.jpeg") returned 0 [0062.364] lstrlenA (lpString="*.jpeg") returned 6 [0062.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.psd") returned 0 [0062.364] lstrlenA (lpString="*.psd") returned 5 [0062.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.gif") returned 0 [0062.364] lstrlenA (lpString="*.gif") returned 5 [0062.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.doc") returned 0 [0062.364] lstrlenA (lpString="*.doc") returned 5 [0062.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.docx") returned 0 [0062.364] lstrlenA (lpString="*.docx") returned 6 [0062.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.xls") returned 0 [0062.364] lstrlenA (lpString="*.xls") returned 5 [0062.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.xlsx") returned 0 [0062.364] lstrlenA (lpString="*.xlsx") returned 6 [0062.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.ppt") returned 0 [0062.364] lstrlenA (lpString="*.ppt") returned 5 [0062.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.pptx") returned 0 [0062.364] lstrlenA (lpString="*.pptx") returned 6 [0062.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.pdf") returned 0 [0062.364] lstrlenA (lpString="*.pdf") returned 5 [0062.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.mov") returned 0 [0062.364] lstrlenA (lpString="*.mov") returned 5 [0062.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.m2v") returned 0 [0062.365] lstrlenA (lpString="*.m2v") returned 5 [0062.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.3gp") returned 0 [0062.365] lstrlenA (lpString="*.3gp") returned 5 [0062.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.mpeg") returned 0 [0062.365] lstrlenA (lpString="*.mpeg") returned 6 [0062.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.mpg") returned 0 [0062.365] lstrlenA (lpString="*.mpg") returned 5 [0062.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.flv") returned 0 [0062.365] lstrlenA (lpString="*.flv") returned 5 [0062.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.avi") returned 0 [0062.365] lstrlenA (lpString="*.avi") returned 5 [0062.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.mp4") returned 0 [0062.365] lstrlenA (lpString="*.mp4") returned 5 [0062.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.wmv") returned 0 [0062.365] lstrlenA (lpString="*.wmv") returned 5 [0062.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.divx") returned 0 [0062.365] lstrlenA (lpString="*.divx") returned 6 [0062.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.mkv") returned 0 [0062.365] lstrlenA (lpString="*.mkv") returned 5 [0062.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.mp3") returned 0 [0062.365] lstrlenA (lpString="*.mp3") returned 5 [0062.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.wav") returned 0 [0062.365] lstrlenA (lpString="*.wav") returned 5 [0062.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.flac") returned 0 [0062.365] lstrlenA (lpString="*.flac") returned 6 [0062.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.ape") returned 0 [0062.365] lstrlenA (lpString="*.ape") returned 5 [0062.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.wma") returned 0 [0062.365] lstrlenA (lpString="*.wma") returned 5 [0062.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.ac3") returned 0 [0062.366] lstrlenA (lpString="*.ac3") returned 5 [0062.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.mxf") returned 0 [0062.366] lstrlenA (lpString="*.mxf") returned 5 [0062.366] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1dda, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsHomePageScript.js", cAlternateFileName="FORMSH~1.JS")) returned 1 [0062.366] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.366] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsHomePageScript.js") returned -1 [0062.366] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsHomePageScript.js") returned 1 [0062.366] lstrcmpiA (lpString1="", lpString2="FormsHomePageScript.js") returned -1 [0062.366] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html") returned="FormsHomePage.html" [0062.366] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.366] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.366] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.366] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.366] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsHomePageScript.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js" [0062.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.zip") returned 0 [0062.366] lstrlenA (lpString="*.zip") returned 5 [0062.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.rar") returned 0 [0062.366] lstrlenA (lpString="*.rar") returned 5 [0062.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.7z") returned 0 [0062.366] lstrlenA (lpString="*.7z") returned 4 [0062.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.tar") returned 0 [0062.366] lstrlenA (lpString="*.tar") returned 5 [0062.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.gzip") returned 0 [0062.367] lstrlenA (lpString="*.gzip") returned 6 [0062.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.jpg") returned 0 [0062.367] lstrlenA (lpString="*.jpg") returned 5 [0062.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.jpeg") returned 0 [0062.367] lstrlenA (lpString="*.jpeg") returned 6 [0062.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.psd") returned 0 [0062.367] lstrlenA (lpString="*.psd") returned 5 [0062.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.gif") returned 0 [0062.367] lstrlenA (lpString="*.gif") returned 5 [0062.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.doc") returned 0 [0062.367] lstrlenA (lpString="*.doc") returned 5 [0062.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.docx") returned 0 [0062.367] lstrlenA (lpString="*.docx") returned 6 [0062.367] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2ec, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsHomePageStyle.css", cAlternateFileName="FORMSH~1.CSS")) returned 1 [0062.367] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.367] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsHomePageStyle.css") returned -1 [0062.367] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsHomePageStyle.css") returned 1 [0062.367] lstrcmpiA (lpString1="", lpString2="FormsHomePageStyle.css") returned -1 [0062.367] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js") returned="FormsHomePageScript.js" [0062.368] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.368] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.368] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.368] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.368] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsHomePageStyle.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css" [0062.368] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7ee, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsImageTemplate.html", cAlternateFileName="FORMSI~1.HTM")) returned 1 [0062.368] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.368] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsImageTemplate.html") returned -1 [0062.368] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsImageTemplate.html") returned 1 [0062.368] lstrcmpiA (lpString1="", lpString2="FormsImageTemplate.html") returned -1 [0062.368] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css") returned="FormsHomePageStyle.css" [0062.368] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.368] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.368] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.368] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.368] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsImageTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html" [0062.368] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x856, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsMacroTemplate.html", cAlternateFileName="FORMSM~1.HTM")) returned 1 [0062.368] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.368] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsMacroTemplate.html") returned -1 [0062.368] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsMacroTemplate.html") returned 1 [0062.369] lstrcmpiA (lpString1="", lpString2="FormsMacroTemplate.html") returned -1 [0062.369] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html") returned="FormsImageTemplate.html" [0062.369] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.369] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.369] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.369] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.369] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsMacroTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html" [0062.369] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x529685b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x46fe, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsPreviewTemplate.html", cAlternateFileName="FORMSP~1.HTM")) returned 1 [0062.369] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.369] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsPreviewTemplate.html") returned -1 [0062.369] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPreviewTemplate.html") returned 1 [0062.369] lstrcmpiA (lpString1="", lpString2="FormsPreviewTemplate.html") returned -1 [0062.369] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html") returned="FormsMacroTemplate.html" [0062.369] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.369] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.369] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.369] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.369] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html" [0062.369] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x612, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsPrintTemplate.html", cAlternateFileName="FORMSP~2.HTM")) returned 1 [0062.369] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.369] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsPrintTemplate.html") returned -1 [0062.369] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPrintTemplate.html") returned 1 [0062.369] lstrcmpiA (lpString1="", lpString2="FormsPrintTemplate.html") returned -1 [0062.369] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html") returned="FormsPreviewTemplate.html" [0062.370] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.370] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.370] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.370] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.370] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html" [0062.370] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsStyles", cAlternateFileName="FORMSS~1")) returned 1 [0062.370] lstrcmpA (lpString1=".", lpString2="FormsStyles") returned -1 [0062.370] lstrcmpA (lpString1="..", lpString2="FormsStyles") returned -1 [0062.370] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html") returned="FormsPrintTemplate.html" [0062.370] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsStyles" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles" [0062.370] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f220, dwReserved1=0x2d8266, cFileName=".", cAlternateFileName="")) returned 0x2d80f0 [0062.383] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.383] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0062.384] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.384] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.384] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Adobe.css", cAlternateFileName="")) returned 1 [0062.384] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.384] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe.css") returned 1 [0062.384] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe.css") returned 1 [0062.384] lstrcmpiA (lpString1="", lpString2="Adobe.css") returned -1 [0062.384] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0062.384] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" [0062.384] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="" [0062.384] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0062.384] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0xffffffff [0062.384] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0062.388] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.388] CloseHandle (hObject=0x9c) returned 1 [0062.388] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Adobe.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css" [0062.388] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Americana", cAlternateFileName="AMERIC~1")) returned 1 [0062.388] lstrcmpA (lpString1=".", lpString2="Americana") returned -1 [0062.388] lstrcmpA (lpString1="..", lpString2="Americana") returned -1 [0062.388] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css") returned="Adobe.css" [0062.388] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Americana" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana" [0062.388] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d827e, cFileName=".", cAlternateFileName="")) returned 0x2d8278 [0062.389] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.389] FindNextFileA (in: hFindFile=0x2d8278, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0062.389] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.389] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.389] FindNextFileA (in: hFindFile=0x2d8278, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0062.389] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.389] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0062.389] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0062.390] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0062.390] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\*.*") returned="*.*" [0062.390] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\" [0062.390] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\") returned="" [0062.390] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt" [0062.390] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\how to decrypt files.txt")) returned 0xffffffff [0062.390] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.392] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.392] CloseHandle (hObject=0xa0) returned 1 [0062.392] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF" [0062.392] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF" [0062.392] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF" [0062.392] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF." [0062.392] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF.wannacry" [0062.392] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.393] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0062.393] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528d0030, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea)) returned 1 [0062.393] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.393] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd7, lpOverlapped=0x0) returned 1 [0062.394] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0062.394] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.394] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd7, lpOverlapped=0x0) returned 1 [0062.394] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.394] CloseHandle (hObject=0xa0) returned 1 [0062.394] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_off.gif.wannacry")) returned 1 [0062.396] FindNextFileA (in: hFindFile=0x2d8278, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d8190, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0062.396] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.396] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0062.397] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0062.397] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0062.397] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0062.397] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\" [0062.397] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\") returned="" [0062.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt" [0062.397] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\how to decrypt files.txt")) returned 0x20 [0062.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF" [0062.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0062.397] lstrlenA (lpString="*.zip") returned 5 [0062.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0062.397] lstrlenA (lpString="*.rar") returned 5 [0062.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0062.397] lstrlenA (lpString="*.7z") returned 4 [0062.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0062.397] lstrlenA (lpString="*.tar") returned 5 [0062.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0062.397] lstrlenA (lpString="*.gzip") returned 6 [0062.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0062.397] lstrlenA (lpString="*.jpg") returned 5 [0062.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0062.397] lstrlenA (lpString="*.jpeg") returned 6 [0062.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0062.397] lstrlenA (lpString="*.psd") returned 5 [0062.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0062.397] lstrlenA (lpString="*.gif") returned 5 [0062.397] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF" [0062.397] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF" [0062.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF." [0062.398] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF.wannacry" [0062.398] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.399] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0062.399] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea)) returned 1 [0062.399] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.399] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60, lpOverlapped=0x0) returned 1 [0062.400] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF") returned="TAB_ON.GIF" [0062.400] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.400] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60, lpOverlapped=0x0) returned 1 [0062.400] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.400] CloseHandle (hObject=0xa0) returned 1 [0062.400] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_on.gif.wannacry")) returned 1 [0062.401] FindNextFileA (in: hFindFile=0x2d8278, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d8190, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0062.401] FindClose (in: hFindFile=0x2d8278 | out: hFindFile=0x2d8278) returned 1 [0062.401] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa32, dwReserved0=0x2d82b8, dwReserved1=0x3, cFileName="Americana.css", cAlternateFileName="AMERIC~1.CSS")) returned 1 [0062.401] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.401] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Americana.css") returned 1 [0062.401] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Americana.css") returned 1 [0062.401] lstrcmpiA (lpString1="", lpString2="Americana.css") returned -1 [0062.401] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0062.401] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" [0062.401] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="" [0062.401] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0062.401] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0062.401] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Americana.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css" [0062.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.zip") returned 0 [0062.402] lstrlenA (lpString="*.zip") returned 5 [0062.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.rar") returned 0 [0062.402] lstrlenA (lpString="*.rar") returned 5 [0062.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.7z") returned 0 [0062.402] lstrlenA (lpString="*.7z") returned 4 [0062.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.tar") returned 0 [0062.402] lstrlenA (lpString="*.tar") returned 5 [0062.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.gzip") returned 0 [0062.402] lstrlenA (lpString="*.gzip") returned 6 [0062.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.jpg") returned 0 [0062.402] lstrlenA (lpString="*.jpg") returned 5 [0062.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.jpeg") returned 0 [0062.402] lstrlenA (lpString="*.jpeg") returned 6 [0062.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.psd") returned 0 [0062.402] lstrlenA (lpString="*.psd") returned 5 [0062.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.gif") returned 0 [0062.402] lstrlenA (lpString="*.gif") returned 5 [0062.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.doc") returned 0 [0062.402] lstrlenA (lpString="*.doc") returned 5 [0062.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.docx") returned 0 [0062.402] lstrlenA (lpString="*.docx") returned 6 [0062.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.xls") returned 0 [0062.402] lstrlenA (lpString="*.xls") returned 5 [0062.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.xlsx") returned 0 [0062.402] lstrlenA (lpString="*.xlsx") returned 6 [0062.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.ppt") returned 0 [0062.402] lstrlenA (lpString="*.ppt") returned 5 [0062.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.pptx") returned 0 [0062.402] lstrlenA (lpString="*.pptx") returned 6 [0062.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.pdf") returned 0 [0062.402] lstrlenA (lpString="*.pdf") returned 5 [0062.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.mov") returned 0 [0062.403] lstrlenA (lpString="*.mov") returned 5 [0062.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.m2v") returned 0 [0062.403] lstrlenA (lpString="*.m2v") returned 5 [0062.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.3gp") returned 0 [0062.403] lstrlenA (lpString="*.3gp") returned 5 [0062.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.mpeg") returned 0 [0062.403] lstrlenA (lpString="*.mpeg") returned 6 [0062.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.mpg") returned 0 [0062.403] lstrlenA (lpString="*.mpg") returned 5 [0062.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.flv") returned 0 [0062.403] lstrlenA (lpString="*.flv") returned 5 [0062.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.avi") returned 0 [0062.403] lstrlenA (lpString="*.avi") returned 5 [0062.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.mp4") returned 0 [0062.403] lstrlenA (lpString="*.mp4") returned 5 [0062.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.wmv") returned 0 [0062.403] lstrlenA (lpString="*.wmv") returned 5 [0062.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.divx") returned 0 [0062.403] lstrlenA (lpString="*.divx") returned 6 [0062.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.mkv") returned 0 [0062.403] lstrlenA (lpString="*.mkv") returned 5 [0062.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.mp3") returned 0 [0062.403] lstrlenA (lpString="*.mp3") returned 5 [0062.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.wav") returned 0 [0062.403] lstrlenA (lpString="*.wav") returned 5 [0062.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.flac") returned 0 [0062.403] lstrlenA (lpString="*.flac") returned 6 [0062.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.ape") returned 0 [0062.403] lstrlenA (lpString="*.ape") returned 5 [0062.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.wma") returned 0 [0062.403] lstrlenA (lpString="*.wma") returned 5 [0062.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.ac3") returned 0 [0062.403] lstrlenA (lpString="*.ac3") returned 5 [0062.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.mxf") returned 0 [0062.403] lstrlenA (lpString="*.mxf") returned 5 [0062.404] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="BabyBlue", cAlternateFileName="")) returned 1 [0062.404] lstrcmpA (lpString1=".", lpString2="BabyBlue") returned -1 [0062.404] lstrcmpA (lpString1="..", lpString2="BabyBlue") returned -1 [0062.404] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css") returned="Americana.css" [0062.404] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="BabyBlue" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue" [0062.404] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue") returned 103 [0062.404] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x2d827e, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0062.404] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.404] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0062.404] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.404] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.404] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0062.404] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.404] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BUTTON.GIF") returned 1 [0062.404] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BUTTON.GIF") returned 1 [0062.404] lstrcmpiA (lpString1="", lpString2="BUTTON.GIF") returned -1 [0062.404] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\*.*") returned="*.*" [0062.404] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\" [0062.404] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\") returned="" [0062.404] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" [0062.404] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\how to decrypt files.txt")) returned 0xffffffff [0062.405] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.405] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0062.405] WriteFile (in: hFile=0xa0, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0062.406] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.406] CloseHandle (hObject=0xa0) returned 1 [0062.406] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\", lpString2="BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF" [0062.406] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.zip") returned 0 [0062.406] lstrlenA (lpString="*.zip") returned 5 [0062.406] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.rar") returned 0 [0062.406] lstrlenA (lpString="*.rar") returned 5 [0062.406] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.7z") returned 0 [0062.406] lstrlenA (lpString="*.7z") returned 4 [0062.406] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.tar") returned 0 [0062.407] lstrlenA (lpString="*.tar") returned 5 [0062.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.gzip") returned 0 [0062.407] lstrlenA (lpString="*.gzip") returned 6 [0062.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.jpg") returned 0 [0062.407] lstrlenA (lpString="*.jpg") returned 5 [0062.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.jpeg") returned 0 [0062.407] lstrlenA (lpString="*.jpeg") returned 6 [0062.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.psd") returned 0 [0062.407] lstrlenA (lpString="*.psd") returned 5 [0062.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.gif") returned 1 [0062.407] lstrlenA (lpString="*.gif") returned 5 [0062.407] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF" [0062.407] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF" [0062.407] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF." [0062.407] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF.wannacry" [0062.407] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.408] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9 [0062.408] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528d0030, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea)) returned 1 [0062.408] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.408] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3b, lpOverlapped=0x0) returned 1 [0062.409] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="BUTTON.GIF" [0062.409] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.409] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3b, lpOverlapped=0x0) returned 1 [0062.409] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.409] CloseHandle (hObject=0xa0) returned 1 [0062.409] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\button.gif.wannacry")) returned 1 [0062.412] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0062.412] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.412] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HEADER.GIF") returned -1 [0062.412] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0062.412] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0062.412] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="BUTTON.GIF" [0062.412] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\" [0062.412] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\") returned="" [0062.412] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" [0062.412] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\how to decrypt files.txt")) returned 0x20 [0062.412] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF" [0062.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.zip") returned 0 [0062.412] lstrlenA (lpString="*.zip") returned 5 [0062.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.rar") returned 0 [0062.412] lstrlenA (lpString="*.rar") returned 5 [0062.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.7z") returned 0 [0062.412] lstrlenA (lpString="*.7z") returned 4 [0062.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.tar") returned 0 [0062.412] lstrlenA (lpString="*.tar") returned 5 [0062.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0062.412] lstrlenA (lpString="*.gzip") returned 6 [0062.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0062.412] lstrlenA (lpString="*.jpg") returned 5 [0062.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0062.413] lstrlenA (lpString="*.jpeg") returned 6 [0062.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.psd") returned 0 [0062.413] lstrlenA (lpString="*.psd") returned 5 [0062.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.gif") returned 1 [0062.413] lstrlenA (lpString="*.gif") returned 5 [0062.413] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF" [0062.413] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF" [0062.413] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF." [0062.413] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF.wannacry" [0062.413] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.413] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xff [0062.413] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea)) returned 1 [0062.413] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.413] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x81, lpOverlapped=0x0) returned 1 [0062.414] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="HEADER.GIF" [0062.415] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.415] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x81, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x81, lpOverlapped=0x0) returned 1 [0062.415] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.415] CloseHandle (hObject=0xa0) returned 1 [0062.415] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\header.gif.wannacry")) returned 1 [0062.416] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0062.416] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.416] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0062.416] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0062.416] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0062.416] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="HEADER.GIF" [0062.416] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\" [0062.416] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\") returned="" [0062.416] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" [0062.416] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\how to decrypt files.txt")) returned 0x20 [0062.416] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" [0062.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0062.416] lstrlenA (lpString="*.zip") returned 5 [0062.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0062.416] lstrlenA (lpString="*.rar") returned 5 [0062.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0062.416] lstrlenA (lpString="*.7z") returned 4 [0062.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0062.416] lstrlenA (lpString="*.tar") returned 5 [0062.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0062.416] lstrlenA (lpString="*.gzip") returned 6 [0062.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0062.417] lstrlenA (lpString="*.jpg") returned 5 [0062.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0062.417] lstrlenA (lpString="*.jpeg") returned 6 [0062.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0062.417] lstrlenA (lpString="*.psd") returned 5 [0062.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0062.417] lstrlenA (lpString="*.gif") returned 5 [0062.417] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" [0062.417] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" [0062.417] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF." [0062.417] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.wannacry" [0062.417] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.418] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0062.418] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea)) returned 1 [0062.418] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.418] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd7, lpOverlapped=0x0) returned 1 [0062.419] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0062.419] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.419] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd7, lpOverlapped=0x0) returned 1 [0062.419] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.422] CloseHandle (hObject=0xa0) returned 1 [0062.422] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_off.gif.wannacry")) returned 1 [0062.423] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0062.423] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.423] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0062.423] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0062.423] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0062.423] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0062.423] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\" [0062.423] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\") returned="" [0062.423] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" [0062.423] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\how to decrypt files.txt")) returned 0x20 [0062.423] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF" [0062.423] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0062.424] lstrlenA (lpString="*.zip") returned 5 [0062.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0062.424] lstrlenA (lpString="*.rar") returned 5 [0062.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0062.424] lstrlenA (lpString="*.7z") returned 4 [0062.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0062.424] lstrlenA (lpString="*.tar") returned 5 [0062.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0062.424] lstrlenA (lpString="*.gzip") returned 6 [0062.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0062.424] lstrlenA (lpString="*.jpg") returned 5 [0062.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0062.424] lstrlenA (lpString="*.jpeg") returned 6 [0062.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0062.424] lstrlenA (lpString="*.psd") returned 5 [0062.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0062.424] lstrlenA (lpString="*.gif") returned 5 [0062.424] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF" [0062.424] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF" [0062.424] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF." [0062.424] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF.wannacry" [0062.424] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.425] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0062.425] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea)) returned 1 [0062.425] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.425] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60, lpOverlapped=0x0) returned 1 [0062.426] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="TAB_ON.GIF" [0062.426] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.426] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60, lpOverlapped=0x0) returned 1 [0062.426] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.427] CloseHandle (hObject=0xa0) returned 1 [0062.427] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_on.gif.wannacry")) returned 1 [0062.427] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0062.427] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0062.427] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc4f, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="BabyBlue.css", cAlternateFileName="")) returned 1 [0062.427] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.427] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BabyBlue.css") returned 1 [0062.427] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BabyBlue.css") returned 1 [0062.428] lstrcmpiA (lpString1="", lpString2="BabyBlue.css") returned -1 [0062.428] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0062.428] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" [0062.428] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="" [0062.428] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0062.428] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0062.428] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="BabyBlue.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css" [0062.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.zip") returned 0 [0062.428] lstrlenA (lpString="*.zip") returned 5 [0062.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.rar") returned 0 [0062.428] lstrlenA (lpString="*.rar") returned 5 [0062.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.7z") returned 0 [0062.428] lstrlenA (lpString="*.7z") returned 4 [0062.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.tar") returned 0 [0062.428] lstrlenA (lpString="*.tar") returned 5 [0062.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.gzip") returned 0 [0062.428] lstrlenA (lpString="*.gzip") returned 6 [0062.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.jpg") returned 0 [0062.428] lstrlenA (lpString="*.jpg") returned 5 [0062.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.jpeg") returned 0 [0062.428] lstrlenA (lpString="*.jpeg") returned 6 [0062.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.psd") returned 0 [0062.428] lstrlenA (lpString="*.psd") returned 5 [0062.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.gif") returned 0 [0062.428] lstrlenA (lpString="*.gif") returned 5 [0062.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.doc") returned 0 [0062.428] lstrlenA (lpString="*.doc") returned 5 [0062.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.docx") returned 0 [0062.429] lstrlenA (lpString="*.docx") returned 6 [0062.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.xls") returned 0 [0062.429] lstrlenA (lpString="*.xls") returned 5 [0062.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.xlsx") returned 0 [0062.429] lstrlenA (lpString="*.xlsx") returned 6 [0062.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.ppt") returned 0 [0062.429] lstrlenA (lpString="*.ppt") returned 5 [0062.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.pptx") returned 0 [0062.429] lstrlenA (lpString="*.pptx") returned 6 [0062.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.pdf") returned 0 [0062.429] lstrlenA (lpString="*.pdf") returned 5 [0062.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.mov") returned 0 [0062.429] lstrlenA (lpString="*.mov") returned 5 [0062.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.m2v") returned 0 [0062.429] lstrlenA (lpString="*.m2v") returned 5 [0062.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.3gp") returned 0 [0062.429] lstrlenA (lpString="*.3gp") returned 5 [0062.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.mpeg") returned 0 [0062.429] lstrlenA (lpString="*.mpeg") returned 6 [0062.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.mpg") returned 0 [0062.429] lstrlenA (lpString="*.mpg") returned 5 [0062.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.flv") returned 0 [0062.429] lstrlenA (lpString="*.flv") returned 5 [0062.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.avi") returned 0 [0062.429] lstrlenA (lpString="*.avi") returned 5 [0062.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.mp4") returned 0 [0062.429] lstrlenA (lpString="*.mp4") returned 5 [0062.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.wmv") returned 0 [0062.429] lstrlenA (lpString="*.wmv") returned 5 [0062.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.divx") returned 0 [0062.429] lstrlenA (lpString="*.divx") returned 6 [0062.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.mkv") returned 0 [0062.429] lstrlenA (lpString="*.mkv") returned 5 [0062.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.mp3") returned 0 [0062.430] lstrlenA (lpString="*.mp3") returned 5 [0062.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.wav") returned 0 [0062.430] lstrlenA (lpString="*.wav") returned 5 [0062.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.flac") returned 0 [0062.430] lstrlenA (lpString="*.flac") returned 6 [0062.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.ape") returned 0 [0062.430] lstrlenA (lpString="*.ape") returned 5 [0062.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.wma") returned 0 [0062.430] lstrlenA (lpString="*.wma") returned 5 [0062.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.ac3") returned 0 [0062.430] lstrlenA (lpString="*.ac3") returned 5 [0062.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.mxf") returned 0 [0062.430] lstrlenA (lpString="*.mxf") returned 5 [0062.430] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="Biscay", cAlternateFileName="")) returned 1 [0062.430] lstrcmpA (lpString1=".", lpString2="Biscay") returned -1 [0062.430] lstrcmpA (lpString1="..", lpString2="Biscay") returned -1 [0062.430] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css") returned="BabyBlue.css" [0062.430] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Biscay" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay" [0062.430] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay") returned 101 [0062.430] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x2d827e, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0062.432] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.432] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0062.432] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.432] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.432] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0062.432] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.432] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0062.432] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0062.432] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0062.432] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\*.*") returned="*.*" [0062.432] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\" [0062.432] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\") returned="" [0062.432] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt" [0062.432] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\how to decrypt files.txt")) returned 0xffffffff [0062.432] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.433] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0062.433] WriteFile (in: hFile=0xa0, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0062.434] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.434] CloseHandle (hObject=0xa0) returned 1 [0062.434] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF" [0062.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0062.434] lstrlenA (lpString="*.zip") returned 5 [0062.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0062.434] lstrlenA (lpString="*.rar") returned 5 [0062.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0062.434] lstrlenA (lpString="*.7z") returned 4 [0062.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0062.434] lstrlenA (lpString="*.tar") returned 5 [0062.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0062.434] lstrlenA (lpString="*.gzip") returned 6 [0062.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0062.434] lstrlenA (lpString="*.jpg") returned 5 [0062.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0062.434] lstrlenA (lpString="*.jpeg") returned 6 [0062.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0062.434] lstrlenA (lpString="*.psd") returned 5 [0062.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0062.435] lstrlenA (lpString="*.gif") returned 5 [0062.435] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF" [0062.435] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF" [0062.435] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF." [0062.435] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF.wannacry" [0062.435] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.435] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0062.435] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea)) returned 1 [0062.435] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.435] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd7, lpOverlapped=0x0) returned 1 [0062.436] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0062.436] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.437] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd7, lpOverlapped=0x0) returned 1 [0062.437] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.437] CloseHandle (hObject=0xa0) returned 1 [0062.437] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_off.gif.wannacry")) returned 1 [0062.438] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0062.438] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.438] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0062.438] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0062.438] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0062.438] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0062.438] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\" [0062.438] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\") returned="" [0062.438] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt" [0062.438] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\how to decrypt files.txt")) returned 0x20 [0062.438] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF" [0062.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0062.438] lstrlenA (lpString="*.zip") returned 5 [0062.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0062.438] lstrlenA (lpString="*.rar") returned 5 [0062.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0062.438] lstrlenA (lpString="*.7z") returned 4 [0062.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0062.438] lstrlenA (lpString="*.tar") returned 5 [0062.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0062.439] lstrlenA (lpString="*.gzip") returned 6 [0062.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0062.439] lstrlenA (lpString="*.jpg") returned 5 [0062.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0062.439] lstrlenA (lpString="*.jpeg") returned 6 [0062.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0062.439] lstrlenA (lpString="*.psd") returned 5 [0062.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0062.439] lstrlenA (lpString="*.gif") returned 5 [0062.439] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF" [0062.439] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF" [0062.439] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF." [0062.439] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF.wannacry" [0062.439] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.440] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0062.440] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea)) returned 1 [0062.440] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.440] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60, lpOverlapped=0x0) returned 1 [0062.441] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="TAB_ON.GIF" [0062.441] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.441] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60, lpOverlapped=0x0) returned 1 [0062.441] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.441] CloseHandle (hObject=0xa0) returned 1 [0062.441] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_on.gif.wannacry")) returned 1 [0062.444] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0062.444] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0062.444] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd45, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="Biscay.css", cAlternateFileName="")) returned 1 [0062.444] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.444] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Biscay.css") returned 1 [0062.444] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Biscay.css") returned 1 [0062.445] lstrcmpiA (lpString1="", lpString2="Biscay.css") returned -1 [0062.445] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0062.445] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" [0062.445] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="" [0062.445] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0062.445] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0062.445] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Biscay.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css" [0062.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.zip") returned 0 [0062.445] lstrlenA (lpString="*.zip") returned 5 [0062.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.rar") returned 0 [0062.445] lstrlenA (lpString="*.rar") returned 5 [0062.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.7z") returned 0 [0062.445] lstrlenA (lpString="*.7z") returned 4 [0062.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.tar") returned 0 [0062.445] lstrlenA (lpString="*.tar") returned 5 [0062.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.gzip") returned 0 [0062.445] lstrlenA (lpString="*.gzip") returned 6 [0062.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.jpg") returned 0 [0062.445] lstrlenA (lpString="*.jpg") returned 5 [0062.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.jpeg") returned 0 [0062.445] lstrlenA (lpString="*.jpeg") returned 6 [0062.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.psd") returned 0 [0062.445] lstrlenA (lpString="*.psd") returned 5 [0062.445] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.gif") returned 0 [0062.445] lstrlenA (lpString="*.gif") returned 5 [0062.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.doc") returned 0 [0062.446] lstrlenA (lpString="*.doc") returned 5 [0062.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.docx") returned 0 [0062.446] lstrlenA (lpString="*.docx") returned 6 [0062.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.xls") returned 0 [0062.446] lstrlenA (lpString="*.xls") returned 5 [0062.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.xlsx") returned 0 [0062.446] lstrlenA (lpString="*.xlsx") returned 6 [0062.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.ppt") returned 0 [0062.446] lstrlenA (lpString="*.ppt") returned 5 [0062.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.pptx") returned 0 [0062.446] lstrlenA (lpString="*.pptx") returned 6 [0062.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.pdf") returned 0 [0062.446] lstrlenA (lpString="*.pdf") returned 5 [0062.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.mov") returned 0 [0062.446] lstrlenA (lpString="*.mov") returned 5 [0062.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.m2v") returned 0 [0062.446] lstrlenA (lpString="*.m2v") returned 5 [0062.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.3gp") returned 0 [0062.446] lstrlenA (lpString="*.3gp") returned 5 [0062.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.mpeg") returned 0 [0062.446] lstrlenA (lpString="*.mpeg") returned 6 [0062.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.mpg") returned 0 [0062.446] lstrlenA (lpString="*.mpg") returned 5 [0062.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.flv") returned 0 [0062.446] lstrlenA (lpString="*.flv") returned 5 [0062.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.avi") returned 0 [0062.446] lstrlenA (lpString="*.avi") returned 5 [0062.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.mp4") returned 0 [0062.446] lstrlenA (lpString="*.mp4") returned 5 [0062.446] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.wmv") returned 0 [0062.447] lstrlenA (lpString="*.wmv") returned 5 [0062.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.divx") returned 0 [0062.447] lstrlenA (lpString="*.divx") returned 6 [0062.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.mkv") returned 0 [0062.447] lstrlenA (lpString="*.mkv") returned 5 [0062.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.mp3") returned 0 [0062.447] lstrlenA (lpString="*.mp3") returned 5 [0062.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.wav") returned 0 [0062.447] lstrlenA (lpString="*.wav") returned 5 [0062.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.flac") returned 0 [0062.447] lstrlenA (lpString="*.flac") returned 6 [0062.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.ape") returned 0 [0062.447] lstrlenA (lpString="*.ape") returned 5 [0062.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.wma") returned 0 [0062.447] lstrlenA (lpString="*.wma") returned 5 [0062.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.ac3") returned 0 [0062.447] lstrlenA (lpString="*.ac3") returned 5 [0062.447] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.mxf") returned 0 [0062.447] lstrlenA (lpString="*.mxf") returned 5 [0062.447] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="BrightOrange", cAlternateFileName="BRIGHT~1")) returned 1 [0062.447] lstrcmpA (lpString1=".", lpString2="BrightOrange") returned -1 [0062.447] lstrcmpA (lpString1="..", lpString2="BrightOrange") returned -1 [0062.447] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css") returned="Biscay.css" [0062.447] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="BrightOrange" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange" [0062.447] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange") returned 107 [0062.447] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x2d827e, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0062.448] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.448] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0062.448] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.448] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.448] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x143, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0062.448] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.448] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="background.gif") returned 1 [0062.448] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1 [0062.448] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1 [0062.448] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\*.*") returned="*.*" [0062.448] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\" [0062.448] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\") returned="" [0062.448] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" [0062.448] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\how to decrypt files.txt")) returned 0xffffffff [0062.448] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.451] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0062.451] WriteFile (in: hFile=0xa0, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0062.452] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.452] CloseHandle (hObject=0xa0) returned 1 [0062.452] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" [0062.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.zip") returned 0 [0062.452] lstrlenA (lpString="*.zip") returned 5 [0062.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.rar") returned 0 [0062.452] lstrlenA (lpString="*.rar") returned 5 [0062.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.7z") returned 0 [0062.452] lstrlenA (lpString="*.7z") returned 4 [0062.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.tar") returned 0 [0062.452] lstrlenA (lpString="*.tar") returned 5 [0062.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.gzip") returned 0 [0062.453] lstrlenA (lpString="*.gzip") returned 6 [0062.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.jpg") returned 0 [0062.453] lstrlenA (lpString="*.jpg") returned 5 [0062.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.jpeg") returned 0 [0062.453] lstrlenA (lpString="*.jpeg") returned 6 [0062.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.psd") returned 0 [0062.453] lstrlenA (lpString="*.psd") returned 5 [0062.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.gif") returned 1 [0062.453] lstrlenA (lpString="*.gif") returned 5 [0062.453] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" [0062.453] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" [0062.453] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif." [0062.453] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif.wannacry" [0062.453] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.454] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x143 [0062.454] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea)) returned 1 [0062.454] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.454] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xc5, lpOverlapped=0x0) returned 1 [0062.455] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif") returned="background.gif" [0062.455] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.455] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xc5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xc5, lpOverlapped=0x0) returned 1 [0062.455] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.455] CloseHandle (hObject=0xa0) returned 1 [0062.455] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif.wannacry")) returned 1 [0062.456] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="button.gif", cAlternateFileName="")) returned 1 [0062.456] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.456] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="button.gif") returned 1 [0062.456] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button.gif") returned 1 [0062.456] lstrcmpiA (lpString1="", lpString2="button.gif") returned -1 [0062.456] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif") returned="background.gif" [0062.456] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\") returned="" [0062.456] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" [0062.457] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\how to decrypt files.txt")) returned 0x20 [0062.457] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\", lpString2="button.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif" [0062.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.zip") returned 0 [0062.457] lstrlenA (lpString="*.zip") returned 5 [0062.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.rar") returned 0 [0062.457] lstrlenA (lpString="*.rar") returned 5 [0062.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.7z") returned 0 [0062.457] lstrlenA (lpString="*.7z") returned 4 [0062.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.tar") returned 0 [0062.457] lstrlenA (lpString="*.tar") returned 5 [0062.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.gzip") returned 0 [0062.457] lstrlenA (lpString="*.gzip") returned 6 [0062.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.jpg") returned 0 [0062.457] lstrlenA (lpString="*.jpg") returned 5 [0062.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.jpeg") returned 0 [0062.457] lstrlenA (lpString="*.jpeg") returned 6 [0062.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.psd") returned 0 [0062.457] lstrlenA (lpString="*.psd") returned 5 [0062.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.gif") returned 1 [0062.457] lstrlenA (lpString="*.gif") returned 5 [0062.457] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.458] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9 [0062.458] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea)) returned 1 [0062.458] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.458] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3b, lpOverlapped=0x0) returned 1 [0062.460] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif") returned="button.gif" [0062.460] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.460] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3b, lpOverlapped=0x0) returned 1 [0062.460] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.460] CloseHandle (hObject=0xa0) returned 1 [0062.460] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif.wannacry")) returned 1 [0062.461] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="tab_off.gif", cAlternateFileName="")) returned 1 [0062.461] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.461] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tab_off.gif") returned -1 [0062.461] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tab_off.gif") returned -1 [0062.461] lstrcmpiA (lpString1="", lpString2="tab_off.gif") returned -1 [0062.461] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif") returned="button.gif" [0062.461] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\" [0062.461] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\") returned="" [0062.461] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" [0062.461] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\how to decrypt files.txt")) returned 0x20 [0062.462] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\", lpString2="tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" [0062.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.zip") returned 0 [0062.462] lstrlenA (lpString="*.zip") returned 5 [0062.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.rar") returned 0 [0062.462] lstrlenA (lpString="*.rar") returned 5 [0062.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.7z") returned 0 [0062.462] lstrlenA (lpString="*.7z") returned 4 [0062.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.tar") returned 0 [0062.462] lstrlenA (lpString="*.tar") returned 5 [0062.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.gzip") returned 0 [0062.462] lstrlenA (lpString="*.gzip") returned 6 [0062.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.jpg") returned 0 [0062.462] lstrlenA (lpString="*.jpg") returned 5 [0062.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.jpeg") returned 0 [0062.462] lstrlenA (lpString="*.jpeg") returned 6 [0062.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.psd") returned 0 [0062.462] lstrlenA (lpString="*.psd") returned 5 [0062.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.gif") returned 1 [0062.462] lstrlenA (lpString="*.gif") returned 5 [0062.462] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" [0062.462] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" [0062.462] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif." [0062.462] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif.wannacry" [0062.462] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.464] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0062.464] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea)) returned 1 [0062.464] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.464] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd7, lpOverlapped=0x0) returned 1 [0062.465] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif") returned="tab_off.gif" [0062.465] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.465] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd7, lpOverlapped=0x0) returned 1 [0062.465] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.466] CloseHandle (hObject=0xa0) returned 1 [0062.466] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif.wannacry")) returned 1 [0062.467] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="tab_on.gif", cAlternateFileName="")) returned 1 [0062.467] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.467] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tab_on.gif") returned -1 [0062.467] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tab_on.gif") returned -1 [0062.467] lstrcmpiA (lpString1="", lpString2="tab_on.gif") returned -1 [0062.467] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif") returned="tab_off.gif" [0062.467] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\" [0062.467] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\") returned="" [0062.467] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" [0062.467] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\how to decrypt files.txt")) returned 0x20 [0062.467] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\", lpString2="tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" [0062.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.zip") returned 0 [0062.467] lstrlenA (lpString="*.zip") returned 5 [0062.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.rar") returned 0 [0062.467] lstrlenA (lpString="*.rar") returned 5 [0062.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.7z") returned 0 [0062.468] lstrlenA (lpString="*.7z") returned 4 [0062.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.tar") returned 0 [0062.468] lstrlenA (lpString="*.tar") returned 5 [0062.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.gzip") returned 0 [0062.468] lstrlenA (lpString="*.gzip") returned 6 [0062.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.jpg") returned 0 [0062.468] lstrlenA (lpString="*.jpg") returned 5 [0062.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.jpeg") returned 0 [0062.468] lstrlenA (lpString="*.jpeg") returned 6 [0062.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.psd") returned 0 [0062.468] lstrlenA (lpString="*.psd") returned 5 [0062.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.gif") returned 1 [0062.468] lstrlenA (lpString="*.gif") returned 5 [0062.468] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" [0062.468] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" [0062.468] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif." [0062.468] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif.wannacry" [0062.468] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.469] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0062.469] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea)) returned 1 [0062.469] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.469] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60, lpOverlapped=0x0) returned 1 [0062.470] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif") returned="tab_on.gif" [0062.470] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.470] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60, lpOverlapped=0x0) returned 1 [0062.471] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.471] CloseHandle (hObject=0xa0) returned 1 [0062.471] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_on.gif.wannacry")) returned 1 [0062.472] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="tab_on.gif", cAlternateFileName="")) returned 0 [0062.472] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0062.472] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="BrightOrange.css", cAlternateFileName="BRIGHT~1.CSS")) returned 1 [0062.472] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.472] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BrightOrange.css") returned 1 [0062.472] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BrightOrange.css") returned 1 [0062.472] lstrcmpiA (lpString1="", lpString2="BrightOrange.css") returned -1 [0062.472] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0062.472] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" [0062.472] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="" [0062.472] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0062.472] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0062.472] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="BrightOrange.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css" [0062.472] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.zip") returned 0 [0062.472] lstrlenA (lpString="*.zip") returned 5 [0062.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.rar") returned 0 [0062.473] lstrlenA (lpString="*.rar") returned 5 [0062.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.7z") returned 0 [0062.473] lstrlenA (lpString="*.7z") returned 4 [0062.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.tar") returned 0 [0062.473] lstrlenA (lpString="*.tar") returned 5 [0062.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.gzip") returned 0 [0062.473] lstrlenA (lpString="*.gzip") returned 6 [0062.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.jpg") returned 0 [0062.473] lstrlenA (lpString="*.jpg") returned 5 [0062.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.jpeg") returned 0 [0062.473] lstrlenA (lpString="*.jpeg") returned 6 [0062.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.psd") returned 0 [0062.473] lstrlenA (lpString="*.psd") returned 5 [0062.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.gif") returned 0 [0062.473] lstrlenA (lpString="*.gif") returned 5 [0062.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.doc") returned 0 [0062.473] lstrlenA (lpString="*.doc") returned 5 [0062.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.docx") returned 0 [0062.473] lstrlenA (lpString="*.docx") returned 6 [0062.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.xls") returned 0 [0062.473] lstrlenA (lpString="*.xls") returned 5 [0062.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.xlsx") returned 0 [0062.473] lstrlenA (lpString="*.xlsx") returned 6 [0062.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.ppt") returned 0 [0062.473] lstrlenA (lpString="*.ppt") returned 5 [0062.473] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.pptx") returned 0 [0062.473] lstrlenA (lpString="*.pptx") returned 6 [0062.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.pdf") returned 0 [0062.474] lstrlenA (lpString="*.pdf") returned 5 [0062.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.mov") returned 0 [0062.474] lstrlenA (lpString="*.mov") returned 5 [0062.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.m2v") returned 0 [0062.474] lstrlenA (lpString="*.m2v") returned 5 [0062.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.3gp") returned 0 [0062.474] lstrlenA (lpString="*.3gp") returned 5 [0062.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.mpeg") returned 0 [0062.474] lstrlenA (lpString="*.mpeg") returned 6 [0062.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.mpg") returned 0 [0062.474] lstrlenA (lpString="*.mpg") returned 5 [0062.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.flv") returned 0 [0062.474] lstrlenA (lpString="*.flv") returned 5 [0062.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.avi") returned 0 [0062.474] lstrlenA (lpString="*.avi") returned 5 [0062.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.mp4") returned 0 [0062.474] lstrlenA (lpString="*.mp4") returned 5 [0062.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.wmv") returned 0 [0062.474] lstrlenA (lpString="*.wmv") returned 5 [0062.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.divx") returned 0 [0062.474] lstrlenA (lpString="*.divx") returned 6 [0062.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.mkv") returned 0 [0062.474] lstrlenA (lpString="*.mkv") returned 5 [0062.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.mp3") returned 0 [0062.474] lstrlenA (lpString="*.mp3") returned 5 [0062.474] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.wav") returned 0 [0062.474] lstrlenA (lpString="*.wav") returned 5 [0062.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.flac") returned 0 [0062.475] lstrlenA (lpString="*.flac") returned 6 [0062.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.ape") returned 0 [0062.475] lstrlenA (lpString="*.ape") returned 5 [0062.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.wma") returned 0 [0062.475] lstrlenA (lpString="*.wma") returned 5 [0062.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.ac3") returned 0 [0062.475] lstrlenA (lpString="*.ac3") returned 5 [0062.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.mxf") returned 0 [0062.475] lstrlenA (lpString="*.mxf") returned 5 [0062.475] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="BrightYellow", cAlternateFileName="BRIGHT~2")) returned 1 [0062.475] lstrcmpA (lpString1=".", lpString2="BrightYellow") returned -1 [0062.475] lstrcmpA (lpString1="..", lpString2="BrightYellow") returned -1 [0062.475] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css") returned="BrightOrange.css" [0062.475] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="BrightYellow" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow" [0062.475] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow") returned 107 [0062.475] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x2d827e, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0062.476] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.476] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0062.476] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.476] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.476] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16f, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0062.476] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.476] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HEADER.GIF") returned -1 [0062.476] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0062.476] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0062.476] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\*.*") returned="*.*" [0062.476] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\" [0062.476] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\") returned="" [0062.476] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt" [0062.476] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\how to decrypt files.txt")) returned 0xffffffff [0062.476] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.479] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0062.479] WriteFile (in: hFile=0xa0, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0062.480] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.481] CloseHandle (hObject=0xa0) returned 1 [0062.481] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF" [0062.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.zip") returned 0 [0062.481] lstrlenA (lpString="*.zip") returned 5 [0062.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.rar") returned 0 [0062.481] lstrlenA (lpString="*.rar") returned 5 [0062.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.7z") returned 0 [0062.481] lstrlenA (lpString="*.7z") returned 4 [0062.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.tar") returned 0 [0062.481] lstrlenA (lpString="*.tar") returned 5 [0062.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0062.481] lstrlenA (lpString="*.gzip") returned 6 [0062.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0062.481] lstrlenA (lpString="*.jpg") returned 5 [0062.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0062.481] lstrlenA (lpString="*.jpeg") returned 6 [0062.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.psd") returned 0 [0062.481] lstrlenA (lpString="*.psd") returned 5 [0062.481] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.gif") returned 1 [0062.481] lstrlenA (lpString="*.gif") returned 5 [0062.481] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF" [0062.481] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF" [0062.481] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF." [0062.481] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF.wannacry" [0062.482] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.485] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16f [0062.485] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea)) returned 1 [0062.485] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.485] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xf1, lpOverlapped=0x0) returned 1 [0062.486] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="HEADER.GIF" [0062.486] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.486] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xf1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xf1, lpOverlapped=0x0) returned 1 [0062.486] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.486] CloseHandle (hObject=0xa0) returned 1 [0062.487] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\header.gif.wannacry")) returned 1 [0062.487] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0062.487] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.487] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0062.487] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0062.487] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0062.487] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="HEADER.GIF" [0062.488] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\" [0062.488] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\") returned="" [0062.488] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt" [0062.488] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\how to decrypt files.txt")) returned 0x20 [0062.488] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" [0062.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0062.488] lstrlenA (lpString="*.zip") returned 5 [0062.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0062.488] lstrlenA (lpString="*.rar") returned 5 [0062.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0062.488] lstrlenA (lpString="*.7z") returned 4 [0062.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0062.488] lstrlenA (lpString="*.tar") returned 5 [0062.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0062.488] lstrlenA (lpString="*.gzip") returned 6 [0062.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0062.488] lstrlenA (lpString="*.jpg") returned 5 [0062.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0062.488] lstrlenA (lpString="*.jpeg") returned 6 [0062.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0062.488] lstrlenA (lpString="*.psd") returned 5 [0062.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0062.488] lstrlenA (lpString="*.gif") returned 5 [0062.489] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" [0062.489] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" [0062.489] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF." [0062.489] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.wannacry" [0062.489] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.489] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0062.489] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea)) returned 1 [0062.489] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.489] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd7, lpOverlapped=0x0) returned 1 [0062.490] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0062.490] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.490] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd7, lpOverlapped=0x0) returned 1 [0062.490] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.491] CloseHandle (hObject=0xa0) returned 1 [0062.491] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_off.gif.wannacry")) returned 1 [0062.491] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0062.491] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.491] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0062.491] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0062.491] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0062.491] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0062.491] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\" [0062.491] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\") returned="" [0062.492] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt" [0062.492] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\how to decrypt files.txt")) returned 0x20 [0062.492] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF" [0062.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0062.492] lstrlenA (lpString="*.zip") returned 5 [0062.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0062.492] lstrlenA (lpString="*.rar") returned 5 [0062.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0062.492] lstrlenA (lpString="*.7z") returned 4 [0062.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0062.492] lstrlenA (lpString="*.tar") returned 5 [0062.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0062.492] lstrlenA (lpString="*.gzip") returned 6 [0062.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0062.492] lstrlenA (lpString="*.jpg") returned 5 [0062.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0062.492] lstrlenA (lpString="*.jpeg") returned 6 [0062.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0062.492] lstrlenA (lpString="*.psd") returned 5 [0062.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0062.492] lstrlenA (lpString="*.gif") returned 5 [0062.492] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF" [0062.492] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF" [0062.492] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF." [0062.492] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF.wannacry" [0062.492] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.493] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0062.493] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea)) returned 1 [0062.493] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.493] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60, lpOverlapped=0x0) returned 1 [0062.494] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned="TAB_ON.GIF" [0062.494] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.494] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60, lpOverlapped=0x0) returned 1 [0062.494] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.494] CloseHandle (hObject=0xa0) returned 1 [0062.494] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_on.gif.wannacry")) returned 1 [0062.495] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0062.495] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0062.495] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xcb6, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="BrightYellow.css", cAlternateFileName="BRIGHT~2.CSS")) returned 1 [0062.495] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.495] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BrightYellow.css") returned 1 [0062.495] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BrightYellow.css") returned 1 [0062.495] lstrcmpiA (lpString1="", lpString2="BrightYellow.css") returned -1 [0062.495] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0062.495] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" [0062.495] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="" [0062.495] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0062.495] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0062.495] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="BrightYellow.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css" [0062.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.zip") returned 0 [0062.496] lstrlenA (lpString="*.zip") returned 5 [0062.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.rar") returned 0 [0062.496] lstrlenA (lpString="*.rar") returned 5 [0062.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.7z") returned 0 [0062.496] lstrlenA (lpString="*.7z") returned 4 [0062.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.tar") returned 0 [0062.496] lstrlenA (lpString="*.tar") returned 5 [0062.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.gzip") returned 0 [0062.496] lstrlenA (lpString="*.gzip") returned 6 [0062.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.jpg") returned 0 [0062.496] lstrlenA (lpString="*.jpg") returned 5 [0062.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.jpeg") returned 0 [0062.496] lstrlenA (lpString="*.jpeg") returned 6 [0062.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.psd") returned 0 [0062.496] lstrlenA (lpString="*.psd") returned 5 [0062.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.gif") returned 0 [0062.496] lstrlenA (lpString="*.gif") returned 5 [0062.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.doc") returned 0 [0062.496] lstrlenA (lpString="*.doc") returned 5 [0062.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.docx") returned 0 [0062.496] lstrlenA (lpString="*.docx") returned 6 [0062.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.xls") returned 0 [0062.496] lstrlenA (lpString="*.xls") returned 5 [0062.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.xlsx") returned 0 [0062.496] lstrlenA (lpString="*.xlsx") returned 6 [0062.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.ppt") returned 0 [0062.496] lstrlenA (lpString="*.ppt") returned 5 [0062.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.pptx") returned 0 [0062.496] lstrlenA (lpString="*.pptx") returned 6 [0062.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.pdf") returned 0 [0062.497] lstrlenA (lpString="*.pdf") returned 5 [0062.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.mov") returned 0 [0062.497] lstrlenA (lpString="*.mov") returned 5 [0062.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.m2v") returned 0 [0062.497] lstrlenA (lpString="*.m2v") returned 5 [0062.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.3gp") returned 0 [0062.497] lstrlenA (lpString="*.3gp") returned 5 [0062.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.mpeg") returned 0 [0062.497] lstrlenA (lpString="*.mpeg") returned 6 [0062.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.mpg") returned 0 [0062.497] lstrlenA (lpString="*.mpg") returned 5 [0062.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.flv") returned 0 [0062.497] lstrlenA (lpString="*.flv") returned 5 [0062.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.avi") returned 0 [0062.497] lstrlenA (lpString="*.avi") returned 5 [0062.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.mp4") returned 0 [0062.497] lstrlenA (lpString="*.mp4") returned 5 [0062.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.wmv") returned 0 [0062.497] lstrlenA (lpString="*.wmv") returned 5 [0062.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.divx") returned 0 [0062.497] lstrlenA (lpString="*.divx") returned 6 [0062.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.mkv") returned 0 [0062.497] lstrlenA (lpString="*.mkv") returned 5 [0062.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.mp3") returned 0 [0062.497] lstrlenA (lpString="*.mp3") returned 5 [0062.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.wav") returned 0 [0062.497] lstrlenA (lpString="*.wav") returned 5 [0062.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.flac") returned 0 [0062.497] lstrlenA (lpString="*.flac") returned 6 [0062.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.ape") returned 0 [0062.498] lstrlenA (lpString="*.ape") returned 5 [0062.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.wma") returned 0 [0062.498] lstrlenA (lpString="*.wma") returned 5 [0062.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.ac3") returned 0 [0062.498] lstrlenA (lpString="*.ac3") returned 5 [0062.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.mxf") returned 0 [0062.498] lstrlenA (lpString="*.mxf") returned 5 [0062.498] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="Casual.css", cAlternateFileName="")) returned 1 [0062.498] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.498] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Casual.css") returned 1 [0062.498] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Casual.css") returned 1 [0062.498] lstrcmpiA (lpString1="", lpString2="Casual.css") returned -1 [0062.498] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css") returned="BrightYellow.css" [0062.498] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" [0062.498] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="" [0062.498] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0062.498] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0062.498] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Casual.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css" [0062.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.zip") returned 0 [0062.498] lstrlenA (lpString="*.zip") returned 5 [0062.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.rar") returned 0 [0062.498] lstrlenA (lpString="*.rar") returned 5 [0062.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.7z") returned 0 [0062.498] lstrlenA (lpString="*.7z") returned 4 [0062.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.tar") returned 0 [0062.499] lstrlenA (lpString="*.tar") returned 5 [0062.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.gzip") returned 0 [0062.499] lstrlenA (lpString="*.gzip") returned 6 [0062.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.jpg") returned 0 [0062.499] lstrlenA (lpString="*.jpg") returned 5 [0062.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.jpeg") returned 0 [0062.499] lstrlenA (lpString="*.jpeg") returned 6 [0062.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.psd") returned 0 [0062.499] lstrlenA (lpString="*.psd") returned 5 [0062.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.gif") returned 0 [0062.499] lstrlenA (lpString="*.gif") returned 5 [0062.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.doc") returned 0 [0062.499] lstrlenA (lpString="*.doc") returned 5 [0062.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.docx") returned 0 [0062.499] lstrlenA (lpString="*.docx") returned 6 [0062.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.xls") returned 0 [0062.499] lstrlenA (lpString="*.xls") returned 5 [0062.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.xlsx") returned 0 [0062.499] lstrlenA (lpString="*.xlsx") returned 6 [0062.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.ppt") returned 0 [0062.499] lstrlenA (lpString="*.ppt") returned 5 [0062.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.pptx") returned 0 [0062.499] lstrlenA (lpString="*.pptx") returned 6 [0062.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.pdf") returned 0 [0062.499] lstrlenA (lpString="*.pdf") returned 5 [0062.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.mov") returned 0 [0062.500] lstrlenA (lpString="*.mov") returned 5 [0062.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.m2v") returned 0 [0062.500] lstrlenA (lpString="*.m2v") returned 5 [0062.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.3gp") returned 0 [0062.500] lstrlenA (lpString="*.3gp") returned 5 [0062.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.mpeg") returned 0 [0062.500] lstrlenA (lpString="*.mpeg") returned 6 [0062.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.mpg") returned 0 [0062.500] lstrlenA (lpString="*.mpg") returned 5 [0062.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.flv") returned 0 [0062.500] lstrlenA (lpString="*.flv") returned 5 [0062.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.avi") returned 0 [0062.500] lstrlenA (lpString="*.avi") returned 5 [0062.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.mp4") returned 0 [0062.500] lstrlenA (lpString="*.mp4") returned 5 [0062.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.wmv") returned 0 [0062.500] lstrlenA (lpString="*.wmv") returned 5 [0062.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.divx") returned 0 [0062.500] lstrlenA (lpString="*.divx") returned 6 [0062.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.mkv") returned 0 [0062.500] lstrlenA (lpString="*.mkv") returned 5 [0062.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.mp3") returned 0 [0062.500] lstrlenA (lpString="*.mp3") returned 5 [0062.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.wav") returned 0 [0062.500] lstrlenA (lpString="*.wav") returned 5 [0062.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.flac") returned 0 [0062.501] lstrlenA (lpString="*.flac") returned 6 [0062.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.ape") returned 0 [0062.501] lstrlenA (lpString="*.ape") returned 5 [0062.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.wma") returned 0 [0062.501] lstrlenA (lpString="*.wma") returned 5 [0062.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.ac3") returned 0 [0062.501] lstrlenA (lpString="*.ac3") returned 5 [0062.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.mxf") returned 0 [0062.501] lstrlenA (lpString="*.mxf") returned 5 [0062.501] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x604d91d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x373, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="Country.css", cAlternateFileName="")) returned 1 [0062.501] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.501] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Country.css") returned 1 [0062.501] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Country.css") returned 1 [0062.501] lstrcmpiA (lpString1="", lpString2="Country.css") returned -1 [0062.501] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css") returned="Casual.css" [0062.501] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" [0062.501] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="" [0062.501] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0062.501] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0062.501] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Country.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css" [0062.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.zip") returned 0 [0062.501] lstrlenA (lpString="*.zip") returned 5 [0062.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.rar") returned 0 [0062.501] lstrlenA (lpString="*.rar") returned 5 [0062.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.7z") returned 0 [0062.502] lstrlenA (lpString="*.7z") returned 4 [0062.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.tar") returned 0 [0062.502] lstrlenA (lpString="*.tar") returned 5 [0062.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.gzip") returned 0 [0062.502] lstrlenA (lpString="*.gzip") returned 6 [0062.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.jpg") returned 0 [0062.502] lstrlenA (lpString="*.jpg") returned 5 [0062.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.jpeg") returned 0 [0062.502] lstrlenA (lpString="*.jpeg") returned 6 [0062.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.psd") returned 0 [0062.502] lstrlenA (lpString="*.psd") returned 5 [0062.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.gif") returned 0 [0062.502] lstrlenA (lpString="*.gif") returned 5 [0062.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.doc") returned 0 [0062.502] lstrlenA (lpString="*.doc") returned 5 [0062.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.docx") returned 0 [0062.502] lstrlenA (lpString="*.docx") returned 6 [0062.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.xls") returned 0 [0062.502] lstrlenA (lpString="*.xls") returned 5 [0062.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.xlsx") returned 0 [0062.502] lstrlenA (lpString="*.xlsx") returned 6 [0062.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.ppt") returned 0 [0062.502] lstrlenA (lpString="*.ppt") returned 5 [0062.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.pptx") returned 0 [0062.502] lstrlenA (lpString="*.pptx") returned 6 [0062.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.pdf") returned 0 [0062.502] lstrlenA (lpString="*.pdf") returned 5 [0062.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.mov") returned 0 [0062.503] lstrlenA (lpString="*.mov") returned 5 [0062.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.m2v") returned 0 [0062.503] lstrlenA (lpString="*.m2v") returned 5 [0062.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.3gp") returned 0 [0062.503] lstrlenA (lpString="*.3gp") returned 5 [0062.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.mpeg") returned 0 [0062.503] lstrlenA (lpString="*.mpeg") returned 6 [0062.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.mpg") returned 0 [0062.503] lstrlenA (lpString="*.mpg") returned 5 [0062.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.flv") returned 0 [0062.503] lstrlenA (lpString="*.flv") returned 5 [0062.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.avi") returned 0 [0062.503] lstrlenA (lpString="*.avi") returned 5 [0062.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.mp4") returned 0 [0062.503] lstrlenA (lpString="*.mp4") returned 5 [0062.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.wmv") returned 0 [0062.503] lstrlenA (lpString="*.wmv") returned 5 [0062.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.divx") returned 0 [0062.503] lstrlenA (lpString="*.divx") returned 6 [0062.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.mkv") returned 0 [0062.503] lstrlenA (lpString="*.mkv") returned 5 [0062.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.mp3") returned 0 [0062.503] lstrlenA (lpString="*.mp3") returned 5 [0062.504] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.wav") returned 0 [0062.504] lstrlenA (lpString="*.wav") returned 5 [0062.504] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.flac") returned 0 [0062.504] lstrlenA (lpString="*.flac") returned 6 [0062.504] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.ape") returned 0 [0062.504] lstrlenA (lpString="*.ape") returned 5 [0062.504] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.wma") returned 0 [0062.505] lstrlenA (lpString="*.wma") returned 5 [0062.505] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.ac3") returned 0 [0062.505] lstrlenA (lpString="*.ac3") returned 5 [0062.505] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.mxf") returned 0 [0062.505] lstrlenA (lpString="*.mxf") returned 5 [0062.505] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="Desert", cAlternateFileName="")) returned 1 [0062.505] lstrcmpA (lpString1=".", lpString2="Desert") returned -1 [0062.505] lstrcmpA (lpString1="..", lpString2="Desert") returned -1 [0062.505] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css") returned="Country.css" [0062.505] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Desert" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert" [0062.505] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert") returned 101 [0062.505] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x2d827e, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0062.506] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.506] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0062.506] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.506] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.506] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0062.506] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.506] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HEADER.GIF") returned -1 [0062.506] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0062.506] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0062.506] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\*.*") returned="*.*" [0062.506] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\" [0062.506] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\") returned="" [0062.506] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt" [0062.507] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\how to decrypt files.txt")) returned 0xffffffff [0062.507] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.508] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0062.508] WriteFile (in: hFile=0xa0, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0062.509] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.509] CloseHandle (hObject=0xa0) returned 1 [0062.509] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF" [0062.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.zip") returned 0 [0062.509] lstrlenA (lpString="*.zip") returned 5 [0062.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.rar") returned 0 [0062.509] lstrlenA (lpString="*.rar") returned 5 [0062.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.7z") returned 0 [0062.509] lstrlenA (lpString="*.7z") returned 4 [0062.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.tar") returned 0 [0062.509] lstrlenA (lpString="*.tar") returned 5 [0062.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0062.509] lstrlenA (lpString="*.gzip") returned 6 [0062.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0062.509] lstrlenA (lpString="*.jpg") returned 5 [0062.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0062.510] lstrlenA (lpString="*.jpeg") returned 6 [0062.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.psd") returned 0 [0062.510] lstrlenA (lpString="*.psd") returned 5 [0062.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.gif") returned 1 [0062.510] lstrlenA (lpString="*.gif") returned 5 [0062.510] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF" [0062.510] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF" [0062.510] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF." [0062.510] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF.wannacry" [0062.510] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.511] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x94 [0062.511] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea)) returned 1 [0062.511] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.511] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x16, lpOverlapped=0x0) returned 1 [0062.512] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF") returned="HEADER.GIF" [0062.512] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.512] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x16, lpOverlapped=0x0) returned 1 [0062.512] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.512] CloseHandle (hObject=0xa0) returned 1 [0062.512] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\header.gif.wannacry")) returned 1 [0062.518] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1f0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0062.518] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.518] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0062.518] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0062.518] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0062.518] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF") returned="HEADER.GIF" [0062.518] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\" [0062.518] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\") returned="" [0062.519] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt" [0062.519] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\how to decrypt files.txt")) returned 0x20 [0062.519] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF" [0062.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0062.519] lstrlenA (lpString="*.zip") returned 5 [0062.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0062.519] lstrlenA (lpString="*.rar") returned 5 [0062.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0062.519] lstrlenA (lpString="*.7z") returned 4 [0062.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0062.519] lstrlenA (lpString="*.tar") returned 5 [0062.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0062.519] lstrlenA (lpString="*.gzip") returned 6 [0062.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0062.519] lstrlenA (lpString="*.jpg") returned 5 [0062.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0062.519] lstrlenA (lpString="*.jpeg") returned 6 [0062.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0062.519] lstrlenA (lpString="*.psd") returned 5 [0062.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0062.519] lstrlenA (lpString="*.gif") returned 5 [0062.519] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF" [0062.519] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF" [0062.519] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF." [0062.519] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF.wannacry" [0062.519] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.520] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f0 [0062.520] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea)) returned 1 [0062.520] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.520] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x172, lpOverlapped=0x0) returned 1 [0062.521] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0062.521] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.521] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x172, lpOverlapped=0x0) returned 1 [0062.521] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.521] CloseHandle (hObject=0xa0) returned 1 [0062.521] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_off.gif.wannacry")) returned 1 [0062.522] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0062.522] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.522] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0062.522] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0062.522] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0062.523] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0062.523] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\" [0062.523] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\") returned="" [0062.523] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt" [0062.523] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\how to decrypt files.txt")) returned 0x20 [0062.523] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF" [0062.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0062.523] lstrlenA (lpString="*.zip") returned 5 [0062.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0062.523] lstrlenA (lpString="*.rar") returned 5 [0062.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0062.523] lstrlenA (lpString="*.7z") returned 4 [0062.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0062.523] lstrlenA (lpString="*.tar") returned 5 [0062.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0062.523] lstrlenA (lpString="*.gzip") returned 6 [0062.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0062.523] lstrlenA (lpString="*.jpg") returned 5 [0062.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0062.523] lstrlenA (lpString="*.jpeg") returned 6 [0062.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0062.523] lstrlenA (lpString="*.psd") returned 5 [0062.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0062.523] lstrlenA (lpString="*.gif") returned 5 [0062.523] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF" [0062.523] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF" [0062.524] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF." [0062.524] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF.wannacry" [0062.524] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.524] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x401 [0062.524] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea)) returned 1 [0062.524] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.524] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x383, lpOverlapped=0x0) returned 1 [0062.526] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF") returned="TAB_ON.GIF" [0062.526] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.526] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x383, lpOverlapped=0x0) returned 1 [0062.527] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.527] CloseHandle (hObject=0xa0) returned 1 [0062.527] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_on.gif.wannacry")) returned 1 [0062.528] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0062.528] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0062.528] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x977, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="Desert.css", cAlternateFileName="")) returned 1 [0062.528] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.528] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Desert.css") returned 1 [0062.528] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Desert.css") returned 1 [0062.528] lstrcmpiA (lpString1="", lpString2="Desert.css") returned -1 [0062.528] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0062.528] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" [0062.528] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="" [0062.528] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0062.528] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0062.529] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Desert.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css" [0062.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.zip") returned 0 [0062.529] lstrlenA (lpString="*.zip") returned 5 [0062.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.rar") returned 0 [0062.529] lstrlenA (lpString="*.rar") returned 5 [0062.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.7z") returned 0 [0062.529] lstrlenA (lpString="*.7z") returned 4 [0062.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.tar") returned 0 [0062.529] lstrlenA (lpString="*.tar") returned 5 [0062.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.gzip") returned 0 [0062.529] lstrlenA (lpString="*.gzip") returned 6 [0062.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.jpg") returned 0 [0062.529] lstrlenA (lpString="*.jpg") returned 5 [0062.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.jpeg") returned 0 [0062.529] lstrlenA (lpString="*.jpeg") returned 6 [0062.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.psd") returned 0 [0062.529] lstrlenA (lpString="*.psd") returned 5 [0062.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.gif") returned 0 [0062.529] lstrlenA (lpString="*.gif") returned 5 [0062.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.doc") returned 0 [0062.529] lstrlenA (lpString="*.doc") returned 5 [0062.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.docx") returned 0 [0062.529] lstrlenA (lpString="*.docx") returned 6 [0062.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.xls") returned 0 [0062.529] lstrlenA (lpString="*.xls") returned 5 [0062.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.xlsx") returned 0 [0062.529] lstrlenA (lpString="*.xlsx") returned 6 [0062.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.ppt") returned 0 [0062.530] lstrlenA (lpString="*.ppt") returned 5 [0062.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.pptx") returned 0 [0062.530] lstrlenA (lpString="*.pptx") returned 6 [0062.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.pdf") returned 0 [0062.530] lstrlenA (lpString="*.pdf") returned 5 [0062.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.mov") returned 0 [0062.530] lstrlenA (lpString="*.mov") returned 5 [0062.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.m2v") returned 0 [0062.530] lstrlenA (lpString="*.m2v") returned 5 [0062.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.3gp") returned 0 [0062.530] lstrlenA (lpString="*.3gp") returned 5 [0062.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.mpeg") returned 0 [0062.530] lstrlenA (lpString="*.mpeg") returned 6 [0062.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.mpg") returned 0 [0062.530] lstrlenA (lpString="*.mpg") returned 5 [0062.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.flv") returned 0 [0062.530] lstrlenA (lpString="*.flv") returned 5 [0062.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.avi") returned 0 [0062.530] lstrlenA (lpString="*.avi") returned 5 [0062.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.mp4") returned 0 [0062.530] lstrlenA (lpString="*.mp4") returned 5 [0062.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.wmv") returned 0 [0062.530] lstrlenA (lpString="*.wmv") returned 5 [0062.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.divx") returned 0 [0062.532] lstrlenA (lpString="*.divx") returned 6 [0062.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.mkv") returned 0 [0062.532] lstrlenA (lpString="*.mkv") returned 5 [0062.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.mp3") returned 0 [0062.532] lstrlenA (lpString="*.mp3") returned 5 [0062.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.wav") returned 0 [0062.532] lstrlenA (lpString="*.wav") returned 5 [0062.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.flac") returned 0 [0062.532] lstrlenA (lpString="*.flac") returned 6 [0062.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.ape") returned 0 [0062.532] lstrlenA (lpString="*.ape") returned 5 [0062.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.wma") returned 0 [0062.532] lstrlenA (lpString="*.wma") returned 5 [0062.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.ac3") returned 0 [0062.532] lstrlenA (lpString="*.ac3") returned 5 [0062.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.mxf") returned 0 [0062.532] lstrlenA (lpString="*.mxf") returned 5 [0062.532] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51e3fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="Earthy.css", cAlternateFileName="")) returned 1 [0062.532] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.532] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Earthy.css") returned -1 [0062.532] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Earthy.css") returned 1 [0062.532] lstrcmpiA (lpString1="", lpString2="Earthy.css") returned -1 [0062.532] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css") returned="Desert.css" [0062.533] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" [0062.533] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="" [0062.533] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0062.533] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0062.533] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Earthy.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css" [0062.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.zip") returned 0 [0062.533] lstrlenA (lpString="*.zip") returned 5 [0062.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.rar") returned 0 [0062.533] lstrlenA (lpString="*.rar") returned 5 [0062.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.7z") returned 0 [0062.533] lstrlenA (lpString="*.7z") returned 4 [0062.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.tar") returned 0 [0062.533] lstrlenA (lpString="*.tar") returned 5 [0062.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.gzip") returned 0 [0062.533] lstrlenA (lpString="*.gzip") returned 6 [0062.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.jpg") returned 0 [0062.533] lstrlenA (lpString="*.jpg") returned 5 [0062.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.jpeg") returned 0 [0062.533] lstrlenA (lpString="*.jpeg") returned 6 [0062.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.psd") returned 0 [0062.533] lstrlenA (lpString="*.psd") returned 5 [0062.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.gif") returned 0 [0062.533] lstrlenA (lpString="*.gif") returned 5 [0062.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.doc") returned 0 [0062.533] lstrlenA (lpString="*.doc") returned 5 [0062.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.docx") returned 0 [0062.533] lstrlenA (lpString="*.docx") returned 6 [0062.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.xls") returned 0 [0062.534] lstrlenA (lpString="*.xls") returned 5 [0062.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.xlsx") returned 0 [0062.534] lstrlenA (lpString="*.xlsx") returned 6 [0062.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.ppt") returned 0 [0062.534] lstrlenA (lpString="*.ppt") returned 5 [0062.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.pptx") returned 0 [0062.534] lstrlenA (lpString="*.pptx") returned 6 [0062.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.pdf") returned 0 [0062.534] lstrlenA (lpString="*.pdf") returned 5 [0062.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.mov") returned 0 [0062.534] lstrlenA (lpString="*.mov") returned 5 [0062.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.m2v") returned 0 [0062.534] lstrlenA (lpString="*.m2v") returned 5 [0062.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.3gp") returned 0 [0062.534] lstrlenA (lpString="*.3gp") returned 5 [0062.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.mpeg") returned 0 [0062.534] lstrlenA (lpString="*.mpeg") returned 6 [0062.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.mpg") returned 0 [0062.534] lstrlenA (lpString="*.mpg") returned 5 [0062.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.flv") returned 0 [0062.534] lstrlenA (lpString="*.flv") returned 5 [0062.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.avi") returned 0 [0062.534] lstrlenA (lpString="*.avi") returned 5 [0062.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.mp4") returned 0 [0062.534] lstrlenA (lpString="*.mp4") returned 5 [0062.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.wmv") returned 0 [0062.534] lstrlenA (lpString="*.wmv") returned 5 [0062.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.divx") returned 0 [0062.535] lstrlenA (lpString="*.divx") returned 6 [0062.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.mkv") returned 0 [0062.535] lstrlenA (lpString="*.mkv") returned 5 [0062.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.mp3") returned 0 [0062.535] lstrlenA (lpString="*.mp3") returned 5 [0062.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.wav") returned 0 [0062.535] lstrlenA (lpString="*.wav") returned 5 [0062.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.flac") returned 0 [0062.535] lstrlenA (lpString="*.flac") returned 6 [0062.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.ape") returned 0 [0062.535] lstrlenA (lpString="*.ape") returned 5 [0062.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.wma") returned 0 [0062.535] lstrlenA (lpString="*.wma") returned 5 [0062.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.ac3") returned 0 [0062.535] lstrlenA (lpString="*.ac3") returned 5 [0062.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.mxf") returned 0 [0062.535] lstrlenA (lpString="*.mxf") returned 5 [0062.535] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="GrayCheck", cAlternateFileName="GRAYCH~1")) returned 1 [0062.535] lstrcmpA (lpString1=".", lpString2="GrayCheck") returned -1 [0062.535] lstrcmpA (lpString1="..", lpString2="GrayCheck") returned -1 [0062.535] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css") returned="Earthy.css" [0062.535] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="GrayCheck" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck" [0062.535] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck") returned 104 [0062.535] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x2d827e, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0062.536] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.536] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0062.536] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.536] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.536] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1b8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0062.536] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.536] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HEADER.GIF") returned -1 [0062.536] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0062.536] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0062.536] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\*.*") returned="*.*" [0062.536] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\" [0062.536] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\") returned="" [0062.536] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt" [0062.536] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\how to decrypt files.txt")) returned 0xffffffff [0062.536] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.537] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0062.537] WriteFile (in: hFile=0xa0, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0062.538] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.538] CloseHandle (hObject=0xa0) returned 1 [0062.538] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF" [0062.538] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.zip") returned 0 [0062.538] lstrlenA (lpString="*.zip") returned 5 [0062.538] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.rar") returned 0 [0062.538] lstrlenA (lpString="*.rar") returned 5 [0062.538] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.7z") returned 0 [0062.538] lstrlenA (lpString="*.7z") returned 4 [0062.538] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.tar") returned 0 [0062.539] lstrlenA (lpString="*.tar") returned 5 [0062.539] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0062.539] lstrlenA (lpString="*.gzip") returned 6 [0062.539] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0062.539] lstrlenA (lpString="*.jpg") returned 5 [0062.539] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0062.539] lstrlenA (lpString="*.jpeg") returned 6 [0062.539] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.psd") returned 0 [0062.539] lstrlenA (lpString="*.psd") returned 5 [0062.539] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.gif") returned 1 [0062.539] lstrlenA (lpString="*.gif") returned 5 [0062.539] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF" [0062.539] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF" [0062.539] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF." [0062.539] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF.wannacry" [0062.539] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.540] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b8 [0062.540] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea)) returned 1 [0062.540] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.540] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x13a, lpOverlapped=0x0) returned 1 [0062.541] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="HEADER.GIF" [0062.541] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.541] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x13a, lpOverlapped=0x0) returned 1 [0062.541] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.541] CloseHandle (hObject=0xa0) returned 1 [0062.541] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\header.gif.wannacry")) returned 1 [0062.544] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0062.544] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.544] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0062.544] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0062.544] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0062.544] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="HEADER.GIF" [0062.544] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\" [0062.544] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\") returned="" [0062.544] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt" [0062.544] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\how to decrypt files.txt")) returned 0x20 [0062.545] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" [0062.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0062.545] lstrlenA (lpString="*.zip") returned 5 [0062.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0062.545] lstrlenA (lpString="*.rar") returned 5 [0062.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0062.545] lstrlenA (lpString="*.7z") returned 4 [0062.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0062.545] lstrlenA (lpString="*.tar") returned 5 [0062.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0062.545] lstrlenA (lpString="*.gzip") returned 6 [0062.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0062.545] lstrlenA (lpString="*.jpg") returned 5 [0062.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0062.545] lstrlenA (lpString="*.jpeg") returned 6 [0062.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0062.545] lstrlenA (lpString="*.psd") returned 5 [0062.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0062.545] lstrlenA (lpString="*.gif") returned 5 [0062.545] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" [0062.545] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" [0062.545] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF." [0062.545] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.wannacry" [0062.545] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.550] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0062.550] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea)) returned 1 [0062.550] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.550] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd7, lpOverlapped=0x0) returned 1 [0062.551] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0062.551] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.551] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd7, lpOverlapped=0x0) returned 1 [0062.552] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.552] CloseHandle (hObject=0xa0) returned 1 [0062.552] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_off.gif.wannacry")) returned 1 [0062.553] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0062.553] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.553] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0062.553] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0062.553] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0062.553] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0062.553] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\" [0062.553] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\") returned="" [0062.553] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt" [0062.553] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\how to decrypt files.txt")) returned 0x20 [0062.553] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF" [0062.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0062.553] lstrlenA (lpString="*.zip") returned 5 [0062.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0062.553] lstrlenA (lpString="*.rar") returned 5 [0062.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0062.553] lstrlenA (lpString="*.7z") returned 4 [0062.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0062.553] lstrlenA (lpString="*.tar") returned 5 [0062.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0062.553] lstrlenA (lpString="*.gzip") returned 6 [0062.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0062.554] lstrlenA (lpString="*.jpg") returned 5 [0062.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0062.554] lstrlenA (lpString="*.jpeg") returned 6 [0062.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0062.554] lstrlenA (lpString="*.psd") returned 5 [0062.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0062.554] lstrlenA (lpString="*.gif") returned 5 [0062.554] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF" [0062.554] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF" [0062.554] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF." [0062.554] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF.wannacry" [0062.554] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.555] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0062.555] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea)) returned 1 [0062.555] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.555] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60, lpOverlapped=0x0) returned 1 [0062.556] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned="TAB_ON.GIF" [0062.556] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.556] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60, lpOverlapped=0x0) returned 1 [0062.556] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.556] CloseHandle (hObject=0xa0) returned 1 [0062.556] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_on.gif.wannacry")) returned 1 [0062.557] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0062.557] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0062.557] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61a91a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xaf2, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="GrayCheck.css", cAlternateFileName="GRAYCH~1.CSS")) returned 1 [0062.557] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.557] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GrayCheck.css") returned -1 [0062.557] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GrayCheck.css") returned 1 [0062.557] lstrcmpiA (lpString1="", lpString2="GrayCheck.css") returned -1 [0062.557] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0062.557] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" [0062.557] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="" [0062.557] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0062.557] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0062.557] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="GrayCheck.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css" [0062.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.zip") returned 0 [0062.557] lstrlenA (lpString="*.zip") returned 5 [0062.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.rar") returned 0 [0062.557] lstrlenA (lpString="*.rar") returned 5 [0062.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.7z") returned 0 [0062.558] lstrlenA (lpString="*.7z") returned 4 [0062.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.tar") returned 0 [0062.558] lstrlenA (lpString="*.tar") returned 5 [0062.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.gzip") returned 0 [0062.558] lstrlenA (lpString="*.gzip") returned 6 [0062.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.jpg") returned 0 [0062.558] lstrlenA (lpString="*.jpg") returned 5 [0062.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.jpeg") returned 0 [0062.558] lstrlenA (lpString="*.jpeg") returned 6 [0062.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.psd") returned 0 [0062.558] lstrlenA (lpString="*.psd") returned 5 [0062.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.gif") returned 0 [0062.558] lstrlenA (lpString="*.gif") returned 5 [0062.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.doc") returned 0 [0062.558] lstrlenA (lpString="*.doc") returned 5 [0062.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.docx") returned 0 [0062.558] lstrlenA (lpString="*.docx") returned 6 [0062.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.xls") returned 0 [0062.558] lstrlenA (lpString="*.xls") returned 5 [0062.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.xlsx") returned 0 [0062.558] lstrlenA (lpString="*.xlsx") returned 6 [0062.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.ppt") returned 0 [0062.558] lstrlenA (lpString="*.ppt") returned 5 [0062.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.pptx") returned 0 [0062.558] lstrlenA (lpString="*.pptx") returned 6 [0062.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.pdf") returned 0 [0062.558] lstrlenA (lpString="*.pdf") returned 5 [0062.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.mov") returned 0 [0062.558] lstrlenA (lpString="*.mov") returned 5 [0062.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.m2v") returned 0 [0062.558] lstrlenA (lpString="*.m2v") returned 5 [0062.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.3gp") returned 0 [0062.559] lstrlenA (lpString="*.3gp") returned 5 [0062.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.mpeg") returned 0 [0062.559] lstrlenA (lpString="*.mpeg") returned 6 [0062.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.mpg") returned 0 [0062.559] lstrlenA (lpString="*.mpg") returned 5 [0062.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.flv") returned 0 [0062.559] lstrlenA (lpString="*.flv") returned 5 [0062.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.avi") returned 0 [0062.559] lstrlenA (lpString="*.avi") returned 5 [0062.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.mp4") returned 0 [0062.559] lstrlenA (lpString="*.mp4") returned 5 [0062.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.wmv") returned 0 [0062.559] lstrlenA (lpString="*.wmv") returned 5 [0062.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.divx") returned 0 [0062.559] lstrlenA (lpString="*.divx") returned 6 [0062.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.mkv") returned 0 [0062.559] lstrlenA (lpString="*.mkv") returned 5 [0062.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.mp3") returned 0 [0062.559] lstrlenA (lpString="*.mp3") returned 5 [0062.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.wav") returned 0 [0062.559] lstrlenA (lpString="*.wav") returned 5 [0062.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.flac") returned 0 [0062.559] lstrlenA (lpString="*.flac") returned 6 [0062.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.ape") returned 0 [0062.559] lstrlenA (lpString="*.ape") returned 5 [0062.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.wma") returned 0 [0062.559] lstrlenA (lpString="*.wma") returned 5 [0062.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.ac3") returned 0 [0062.559] lstrlenA (lpString="*.ac3") returned 5 [0062.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.mxf") returned 0 [0062.559] lstrlenA (lpString="*.mxf") returned 5 [0062.559] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52c3bfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a4, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="GreenTea.css", cAlternateFileName="")) returned 1 [0062.559] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.559] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GreenTea.css") returned -1 [0062.559] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GreenTea.css") returned 1 [0062.559] lstrcmpiA (lpString1="", lpString2="GreenTea.css") returned -1 [0062.560] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css") returned="GrayCheck.css" [0062.560] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" [0062.560] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="" [0062.560] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0062.560] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0062.560] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="GreenTea.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css" [0062.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.zip") returned 0 [0062.560] lstrlenA (lpString="*.zip") returned 5 [0062.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.rar") returned 0 [0062.560] lstrlenA (lpString="*.rar") returned 5 [0062.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.7z") returned 0 [0062.560] lstrlenA (lpString="*.7z") returned 4 [0062.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.tar") returned 0 [0062.560] lstrlenA (lpString="*.tar") returned 5 [0062.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.gzip") returned 0 [0062.560] lstrlenA (lpString="*.gzip") returned 6 [0062.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.jpg") returned 0 [0062.560] lstrlenA (lpString="*.jpg") returned 5 [0062.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.jpeg") returned 0 [0062.560] lstrlenA (lpString="*.jpeg") returned 6 [0062.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.psd") returned 0 [0062.560] lstrlenA (lpString="*.psd") returned 5 [0062.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.gif") returned 0 [0062.560] lstrlenA (lpString="*.gif") returned 5 [0062.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.doc") returned 0 [0062.560] lstrlenA (lpString="*.doc") returned 5 [0062.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.docx") returned 0 [0062.560] lstrlenA (lpString="*.docx") returned 6 [0062.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.xls") returned 0 [0062.560] lstrlenA (lpString="*.xls") returned 5 [0062.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.xlsx") returned 0 [0062.560] lstrlenA (lpString="*.xlsx") returned 6 [0062.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.ppt") returned 0 [0062.561] lstrlenA (lpString="*.ppt") returned 5 [0062.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.pptx") returned 0 [0062.561] lstrlenA (lpString="*.pptx") returned 6 [0062.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.pdf") returned 0 [0062.561] lstrlenA (lpString="*.pdf") returned 5 [0062.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.mov") returned 0 [0062.561] lstrlenA (lpString="*.mov") returned 5 [0062.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.m2v") returned 0 [0062.561] lstrlenA (lpString="*.m2v") returned 5 [0062.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.3gp") returned 0 [0062.561] lstrlenA (lpString="*.3gp") returned 5 [0062.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.mpeg") returned 0 [0062.561] lstrlenA (lpString="*.mpeg") returned 6 [0062.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.mpg") returned 0 [0062.561] lstrlenA (lpString="*.mpg") returned 5 [0062.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.flv") returned 0 [0062.561] lstrlenA (lpString="*.flv") returned 5 [0062.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.avi") returned 0 [0062.561] lstrlenA (lpString="*.avi") returned 5 [0062.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.mp4") returned 0 [0062.561] lstrlenA (lpString="*.mp4") returned 5 [0062.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.wmv") returned 0 [0062.561] lstrlenA (lpString="*.wmv") returned 5 [0062.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.divx") returned 0 [0062.561] lstrlenA (lpString="*.divx") returned 6 [0062.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.mkv") returned 0 [0062.561] lstrlenA (lpString="*.mkv") returned 5 [0062.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.mp3") returned 0 [0062.561] lstrlenA (lpString="*.mp3") returned 5 [0062.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.wav") returned 0 [0062.561] lstrlenA (lpString="*.wav") returned 5 [0062.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.flac") returned 0 [0062.562] lstrlenA (lpString="*.flac") returned 6 [0062.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.ape") returned 0 [0062.562] lstrlenA (lpString="*.ape") returned 5 [0062.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.wma") returned 0 [0062.562] lstrlenA (lpString="*.wma") returned 5 [0062.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.ac3") returned 0 [0062.562] lstrlenA (lpString="*.ac3") returned 5 [0062.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.mxf") returned 0 [0062.562] lstrlenA (lpString="*.mxf") returned 5 [0062.562] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x411, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="LightSpirit.css", cAlternateFileName="LIGHTS~1.CSS")) returned 1 [0062.562] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.562] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LightSpirit.css") returned -1 [0062.562] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LightSpirit.css") returned -1 [0062.562] lstrcmpiA (lpString1="", lpString2="LightSpirit.css") returned -1 [0062.562] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css") returned="GreenTea.css" [0062.562] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" [0062.562] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="" [0062.562] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0062.562] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0062.562] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="LightSpirit.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css" [0062.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.zip") returned 0 [0062.562] lstrlenA (lpString="*.zip") returned 5 [0062.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.rar") returned 0 [0062.562] lstrlenA (lpString="*.rar") returned 5 [0062.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.7z") returned 0 [0062.563] lstrlenA (lpString="*.7z") returned 4 [0062.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.tar") returned 0 [0062.563] lstrlenA (lpString="*.tar") returned 5 [0062.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.gzip") returned 0 [0062.563] lstrlenA (lpString="*.gzip") returned 6 [0062.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.jpg") returned 0 [0062.563] lstrlenA (lpString="*.jpg") returned 5 [0062.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.jpeg") returned 0 [0062.563] lstrlenA (lpString="*.jpeg") returned 6 [0062.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.psd") returned 0 [0062.563] lstrlenA (lpString="*.psd") returned 5 [0062.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.gif") returned 0 [0062.563] lstrlenA (lpString="*.gif") returned 5 [0062.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.doc") returned 0 [0062.563] lstrlenA (lpString="*.doc") returned 5 [0062.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.docx") returned 0 [0062.563] lstrlenA (lpString="*.docx") returned 6 [0062.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.xls") returned 0 [0062.563] lstrlenA (lpString="*.xls") returned 5 [0062.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.xlsx") returned 0 [0062.563] lstrlenA (lpString="*.xlsx") returned 6 [0062.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.ppt") returned 0 [0062.563] lstrlenA (lpString="*.ppt") returned 5 [0062.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.pptx") returned 0 [0062.563] lstrlenA (lpString="*.pptx") returned 6 [0062.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.pdf") returned 0 [0062.563] lstrlenA (lpString="*.pdf") returned 5 [0062.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.mov") returned 0 [0062.563] lstrlenA (lpString="*.mov") returned 5 [0062.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.m2v") returned 0 [0062.563] lstrlenA (lpString="*.m2v") returned 5 [0062.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.3gp") returned 0 [0062.563] lstrlenA (lpString="*.3gp") returned 5 [0062.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.mpeg") returned 0 [0062.564] lstrlenA (lpString="*.mpeg") returned 6 [0062.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.mpg") returned 0 [0062.564] lstrlenA (lpString="*.mpg") returned 5 [0062.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.flv") returned 0 [0062.564] lstrlenA (lpString="*.flv") returned 5 [0062.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.avi") returned 0 [0062.564] lstrlenA (lpString="*.avi") returned 5 [0062.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.mp4") returned 0 [0062.564] lstrlenA (lpString="*.mp4") returned 5 [0062.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.wmv") returned 0 [0062.564] lstrlenA (lpString="*.wmv") returned 5 [0062.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.divx") returned 0 [0062.564] lstrlenA (lpString="*.divx") returned 6 [0062.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.mkv") returned 0 [0062.564] lstrlenA (lpString="*.mkv") returned 5 [0062.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.mp3") returned 0 [0062.564] lstrlenA (lpString="*.mp3") returned 5 [0062.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.wav") returned 0 [0062.564] lstrlenA (lpString="*.wav") returned 5 [0062.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.flac") returned 0 [0062.564] lstrlenA (lpString="*.flac") returned 6 [0062.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.ape") returned 0 [0062.564] lstrlenA (lpString="*.ape") returned 5 [0062.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.wma") returned 0 [0062.564] lstrlenA (lpString="*.wma") returned 5 [0062.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.ac3") returned 0 [0062.564] lstrlenA (lpString="*.ac3") returned 5 [0062.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.mxf") returned 0 [0062.564] lstrlenA (lpString="*.mxf") returned 5 [0062.564] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="Lime", cAlternateFileName="")) returned 1 [0062.564] lstrcmpA (lpString1=".", lpString2="Lime") returned -1 [0062.564] lstrcmpA (lpString1="..", lpString2="Lime") returned -1 [0062.564] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css") returned="LightSpirit.css" [0062.565] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Lime" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime" [0062.565] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime") returned 99 [0062.565] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x2d827e, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0062.565] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.565] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0062.565] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.565] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.565] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0062.565] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.565] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0062.565] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0062.565] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0062.565] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\*.*") returned="*.*" [0062.565] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\" [0062.565] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\") returned="" [0062.565] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt" [0062.565] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\how to decrypt files.txt")) returned 0xffffffff [0062.565] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.567] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0062.567] WriteFile (in: hFile=0xa0, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0062.568] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.568] CloseHandle (hObject=0xa0) returned 1 [0062.568] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF" [0062.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0062.568] lstrlenA (lpString="*.zip") returned 5 [0062.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0062.568] lstrlenA (lpString="*.rar") returned 5 [0062.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0062.568] lstrlenA (lpString="*.7z") returned 4 [0062.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0062.568] lstrlenA (lpString="*.tar") returned 5 [0062.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0062.568] lstrlenA (lpString="*.gzip") returned 6 [0062.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0062.568] lstrlenA (lpString="*.jpg") returned 5 [0062.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0062.568] lstrlenA (lpString="*.jpeg") returned 6 [0062.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0062.568] lstrlenA (lpString="*.psd") returned 5 [0062.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0062.568] lstrlenA (lpString="*.gif") returned 5 [0062.568] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF" [0062.568] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF" [0062.569] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF." [0062.569] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF.wannacry" [0062.569] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.570] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ce [0062.570] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea)) returned 1 [0062.570] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.570] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x150, lpOverlapped=0x0) returned 1 [0062.571] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0062.571] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.571] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x150, lpOverlapped=0x0) returned 1 [0062.572] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.572] CloseHandle (hObject=0xa0) returned 1 [0062.572] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_off.gif.wannacry")) returned 1 [0062.573] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0062.573] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.573] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0062.573] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0062.573] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0062.573] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0062.573] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\" [0062.573] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\") returned="" [0062.573] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt" [0062.573] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\how to decrypt files.txt")) returned 0x20 [0062.573] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF" [0062.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0062.574] lstrlenA (lpString="*.zip") returned 5 [0062.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0062.574] lstrlenA (lpString="*.rar") returned 5 [0062.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0062.574] lstrlenA (lpString="*.7z") returned 4 [0062.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0062.574] lstrlenA (lpString="*.tar") returned 5 [0062.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0062.574] lstrlenA (lpString="*.gzip") returned 6 [0062.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0062.574] lstrlenA (lpString="*.jpg") returned 5 [0062.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0062.574] lstrlenA (lpString="*.jpeg") returned 6 [0062.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0062.574] lstrlenA (lpString="*.psd") returned 5 [0062.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0062.574] lstrlenA (lpString="*.gif") returned 5 [0062.574] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF" [0062.574] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF" [0062.574] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF." [0062.574] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF.wannacry" [0062.574] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.575] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10b [0062.575] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea)) returned 1 [0062.575] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.575] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x8d, lpOverlapped=0x0) returned 1 [0062.576] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF") returned="TAB_ON.GIF" [0062.576] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.576] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x8d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x8d, lpOverlapped=0x0) returned 1 [0062.576] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.576] CloseHandle (hObject=0xa0) returned 1 [0062.577] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_on.gif.wannacry")) returned 1 [0062.579] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0062.579] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0062.580] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xcfb, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="Lime.css", cAlternateFileName="")) returned 1 [0062.580] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.580] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Lime.css") returned -1 [0062.580] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Lime.css") returned -1 [0062.580] lstrcmpiA (lpString1="", lpString2="Lime.css") returned -1 [0062.580] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0062.580] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" [0062.580] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="" [0062.580] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0062.580] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0062.580] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Lime.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css" [0062.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.zip") returned 0 [0062.580] lstrlenA (lpString="*.zip") returned 5 [0062.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.rar") returned 0 [0062.580] lstrlenA (lpString="*.rar") returned 5 [0062.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.7z") returned 0 [0062.580] lstrlenA (lpString="*.7z") returned 4 [0062.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.tar") returned 0 [0062.580] lstrlenA (lpString="*.tar") returned 5 [0062.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.gzip") returned 0 [0062.580] lstrlenA (lpString="*.gzip") returned 6 [0062.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.jpg") returned 0 [0062.580] lstrlenA (lpString="*.jpg") returned 5 [0062.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.jpeg") returned 0 [0062.580] lstrlenA (lpString="*.jpeg") returned 6 [0062.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.psd") returned 0 [0062.580] lstrlenA (lpString="*.psd") returned 5 [0062.580] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.gif") returned 0 [0062.581] lstrlenA (lpString="*.gif") returned 5 [0062.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.doc") returned 0 [0062.581] lstrlenA (lpString="*.doc") returned 5 [0062.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.docx") returned 0 [0062.581] lstrlenA (lpString="*.docx") returned 6 [0062.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.xls") returned 0 [0062.581] lstrlenA (lpString="*.xls") returned 5 [0062.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.xlsx") returned 0 [0062.581] lstrlenA (lpString="*.xlsx") returned 6 [0062.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.ppt") returned 0 [0062.581] lstrlenA (lpString="*.ppt") returned 5 [0062.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.pptx") returned 0 [0062.581] lstrlenA (lpString="*.pptx") returned 6 [0062.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.pdf") returned 0 [0062.581] lstrlenA (lpString="*.pdf") returned 5 [0062.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.mov") returned 0 [0062.581] lstrlenA (lpString="*.mov") returned 5 [0062.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.m2v") returned 0 [0062.581] lstrlenA (lpString="*.m2v") returned 5 [0062.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.3gp") returned 0 [0062.581] lstrlenA (lpString="*.3gp") returned 5 [0062.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.mpeg") returned 0 [0062.581] lstrlenA (lpString="*.mpeg") returned 6 [0062.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.mpg") returned 0 [0062.581] lstrlenA (lpString="*.mpg") returned 5 [0062.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.flv") returned 0 [0062.581] lstrlenA (lpString="*.flv") returned 5 [0062.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.avi") returned 0 [0062.581] lstrlenA (lpString="*.avi") returned 5 [0062.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.mp4") returned 0 [0062.582] lstrlenA (lpString="*.mp4") returned 5 [0062.582] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.wmv") returned 0 [0062.582] lstrlenA (lpString="*.wmv") returned 5 [0062.582] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.divx") returned 0 [0062.582] lstrlenA (lpString="*.divx") returned 6 [0062.582] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.mkv") returned 0 [0062.582] lstrlenA (lpString="*.mkv") returned 5 [0062.582] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.mp3") returned 0 [0062.582] lstrlenA (lpString="*.mp3") returned 5 [0062.582] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.wav") returned 0 [0062.582] lstrlenA (lpString="*.wav") returned 5 [0062.582] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.flac") returned 0 [0062.582] lstrlenA (lpString="*.flac") returned 6 [0062.582] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.ape") returned 0 [0062.582] lstrlenA (lpString="*.ape") returned 5 [0062.582] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.wma") returned 0 [0062.582] lstrlenA (lpString="*.wma") returned 5 [0062.582] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.ac3") returned 0 [0062.582] lstrlenA (lpString="*.ac3") returned 5 [0062.582] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.mxf") returned 0 [0062.582] lstrlenA (lpString="*.mxf") returned 5 [0062.582] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x362, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="Maroon.css", cAlternateFileName="")) returned 1 [0062.582] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.582] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Maroon.css") returned -1 [0062.582] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Maroon.css") returned -1 [0062.582] lstrcmpiA (lpString1="", lpString2="Maroon.css") returned -1 [0062.582] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css") returned="Lime.css" [0062.582] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" [0062.582] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="" [0062.583] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0062.583] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0062.583] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Maroon.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css" [0062.583] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.zip") returned 0 [0062.583] lstrlenA (lpString="*.zip") returned 5 [0062.583] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.rar") returned 0 [0062.583] lstrlenA (lpString="*.rar") returned 5 [0062.583] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.7z") returned 0 [0062.583] lstrlenA (lpString="*.7z") returned 4 [0062.583] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.tar") returned 0 [0062.583] lstrlenA (lpString="*.tar") returned 5 [0062.583] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.gzip") returned 0 [0062.583] lstrlenA (lpString="*.gzip") returned 6 [0062.583] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.jpg") returned 0 [0062.583] lstrlenA (lpString="*.jpg") returned 5 [0062.583] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.jpeg") returned 0 [0062.583] lstrlenA (lpString="*.jpeg") returned 6 [0062.583] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.psd") returned 0 [0062.583] lstrlenA (lpString="*.psd") returned 5 [0062.583] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.gif") returned 0 [0062.583] lstrlenA (lpString="*.gif") returned 5 [0062.583] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.doc") returned 0 [0062.583] lstrlenA (lpString="*.doc") returned 5 [0062.583] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.docx") returned 0 [0062.583] lstrlenA (lpString="*.docx") returned 6 [0062.583] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.xls") returned 0 [0062.583] lstrlenA (lpString="*.xls") returned 5 [0062.583] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.xlsx") returned 0 [0062.584] lstrlenA (lpString="*.xlsx") returned 6 [0062.584] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.ppt") returned 0 [0062.584] lstrlenA (lpString="*.ppt") returned 5 [0062.584] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.pptx") returned 0 [0062.584] lstrlenA (lpString="*.pptx") returned 6 [0062.584] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.pdf") returned 0 [0062.584] lstrlenA (lpString="*.pdf") returned 5 [0062.584] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.mov") returned 0 [0062.584] lstrlenA (lpString="*.mov") returned 5 [0062.584] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.m2v") returned 0 [0062.584] lstrlenA (lpString="*.m2v") returned 5 [0062.584] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.3gp") returned 0 [0062.584] lstrlenA (lpString="*.3gp") returned 5 [0062.584] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.mpeg") returned 0 [0062.584] lstrlenA (lpString="*.mpeg") returned 6 [0062.584] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.mpg") returned 0 [0062.584] lstrlenA (lpString="*.mpg") returned 5 [0062.584] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.flv") returned 0 [0062.584] lstrlenA (lpString="*.flv") returned 5 [0062.584] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.avi") returned 0 [0062.584] lstrlenA (lpString="*.avi") returned 5 [0062.584] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.mp4") returned 0 [0062.584] lstrlenA (lpString="*.mp4") returned 5 [0062.584] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.wmv") returned 0 [0062.584] lstrlenA (lpString="*.wmv") returned 5 [0062.584] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.divx") returned 0 [0062.584] lstrlenA (lpString="*.divx") returned 6 [0062.584] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.mkv") returned 0 [0062.584] lstrlenA (lpString="*.mkv") returned 5 [0062.584] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.mp3") returned 0 [0062.584] lstrlenA (lpString="*.mp3") returned 5 [0062.584] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.wav") returned 0 [0062.585] lstrlenA (lpString="*.wav") returned 5 [0062.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.flac") returned 0 [0062.585] lstrlenA (lpString="*.flac") returned 6 [0062.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.ape") returned 0 [0062.585] lstrlenA (lpString="*.ape") returned 5 [0062.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.wma") returned 0 [0062.585] lstrlenA (lpString="*.wma") returned 5 [0062.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.ac3") returned 0 [0062.585] lstrlenA (lpString="*.ac3") returned 5 [0062.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.mxf") returned 0 [0062.585] lstrlenA (lpString="*.mxf") returned 5 [0062.585] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="Oasis", cAlternateFileName="")) returned 1 [0062.585] lstrcmpA (lpString1=".", lpString2="Oasis") returned -1 [0062.585] lstrcmpA (lpString1="..", lpString2="Oasis") returned -1 [0062.585] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css") returned="Maroon.css" [0062.585] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Oasis" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis" [0062.585] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis") returned 100 [0062.585] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x2d827e, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0062.585] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.585] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0062.585] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.585] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.586] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x86c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0062.586] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.586] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HEADER.GIF") returned -1 [0062.586] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0062.586] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0062.586] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\*.*") returned="*.*" [0062.586] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\" [0062.586] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\") returned="" [0062.586] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt" [0062.586] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\how to decrypt files.txt")) returned 0xffffffff [0062.586] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.587] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0062.587] WriteFile (in: hFile=0xa0, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0062.588] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.588] CloseHandle (hObject=0xa0) returned 1 [0062.588] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF" [0062.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.zip") returned 0 [0062.588] lstrlenA (lpString="*.zip") returned 5 [0062.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.rar") returned 0 [0062.588] lstrlenA (lpString="*.rar") returned 5 [0062.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.7z") returned 0 [0062.588] lstrlenA (lpString="*.7z") returned 4 [0062.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.tar") returned 0 [0062.588] lstrlenA (lpString="*.tar") returned 5 [0062.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0062.588] lstrlenA (lpString="*.gzip") returned 6 [0062.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0062.588] lstrlenA (lpString="*.jpg") returned 5 [0062.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0062.588] lstrlenA (lpString="*.jpeg") returned 6 [0062.588] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.psd") returned 0 [0062.588] lstrlenA (lpString="*.psd") returned 5 [0062.589] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.gif") returned 1 [0062.589] lstrlenA (lpString="*.gif") returned 5 [0062.589] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF" [0062.589] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF" [0062.589] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF." [0062.589] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF.wannacry" [0062.589] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.591] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x86c [0062.591] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea)) returned 1 [0062.591] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.591] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x7ee, lpOverlapped=0x0) returned 1 [0062.592] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF") returned="HEADER.GIF" [0062.592] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.592] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x7ee, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x7ee, lpOverlapped=0x0) returned 1 [0062.593] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.593] CloseHandle (hObject=0xa0) returned 1 [0062.593] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\header.gif.wannacry")) returned 1 [0062.596] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1f0, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0062.596] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.596] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0062.596] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0062.596] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0062.596] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF") returned="HEADER.GIF" [0062.596] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\" [0062.596] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\") returned="" [0062.596] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt" [0062.596] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\how to decrypt files.txt")) returned 0x20 [0062.596] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF" [0062.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0062.596] lstrlenA (lpString="*.zip") returned 5 [0062.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0062.596] lstrlenA (lpString="*.rar") returned 5 [0062.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0062.596] lstrlenA (lpString="*.7z") returned 4 [0062.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0062.596] lstrlenA (lpString="*.tar") returned 5 [0062.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0062.596] lstrlenA (lpString="*.gzip") returned 6 [0062.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0062.596] lstrlenA (lpString="*.jpg") returned 5 [0062.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0062.596] lstrlenA (lpString="*.jpeg") returned 6 [0062.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0062.596] lstrlenA (lpString="*.psd") returned 5 [0062.596] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0062.597] lstrlenA (lpString="*.gif") returned 5 [0062.597] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF" [0062.597] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF" [0062.597] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF." [0062.597] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF.wannacry" [0062.597] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.597] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f0 [0062.597] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea)) returned 1 [0062.597] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.597] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x172, lpOverlapped=0x0) returned 1 [0062.598] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0062.598] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.599] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x172, lpOverlapped=0x0) returned 1 [0062.599] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.599] CloseHandle (hObject=0xa0) returned 1 [0062.599] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_off.gif.wannacry")) returned 1 [0062.600] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0062.600] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.600] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0062.600] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0062.600] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0062.600] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0062.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\" [0062.600] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\") returned="" [0062.600] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt" [0062.600] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\how to decrypt files.txt")) returned 0x20 [0062.600] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF" [0062.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0062.600] lstrlenA (lpString="*.zip") returned 5 [0062.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0062.600] lstrlenA (lpString="*.rar") returned 5 [0062.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0062.600] lstrlenA (lpString="*.7z") returned 4 [0062.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0062.600] lstrlenA (lpString="*.tar") returned 5 [0062.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0062.600] lstrlenA (lpString="*.gzip") returned 6 [0062.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0062.600] lstrlenA (lpString="*.jpg") returned 5 [0062.600] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0062.601] lstrlenA (lpString="*.jpeg") returned 6 [0062.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0062.601] lstrlenA (lpString="*.psd") returned 5 [0062.601] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0062.601] lstrlenA (lpString="*.gif") returned 5 [0062.601] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF" [0062.601] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF" [0062.601] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF." [0062.601] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF.wannacry" [0062.601] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.601] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x401 [0062.601] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea)) returned 1 [0062.601] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.602] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x383, lpOverlapped=0x0) returned 1 [0062.603] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF") returned="TAB_ON.GIF" [0062.603] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.603] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x383, lpOverlapped=0x0) returned 1 [0062.603] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.604] CloseHandle (hObject=0xa0) returned 1 [0062.604] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_on.gif.wannacry")) returned 1 [0062.604] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0062.604] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0062.604] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbf2, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="Oasis.css", cAlternateFileName="")) returned 1 [0062.605] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.605] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Oasis.css") returned -1 [0062.605] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Oasis.css") returned -1 [0062.605] lstrcmpiA (lpString1="", lpString2="Oasis.css") returned -1 [0062.605] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0062.605] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" [0062.605] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="" [0062.605] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0062.605] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0062.605] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Oasis.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css" [0062.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.zip") returned 0 [0062.605] lstrlenA (lpString="*.zip") returned 5 [0062.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.rar") returned 0 [0062.605] lstrlenA (lpString="*.rar") returned 5 [0062.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.7z") returned 0 [0062.605] lstrlenA (lpString="*.7z") returned 4 [0062.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.tar") returned 0 [0062.605] lstrlenA (lpString="*.tar") returned 5 [0062.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.gzip") returned 0 [0062.605] lstrlenA (lpString="*.gzip") returned 6 [0062.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.jpg") returned 0 [0062.605] lstrlenA (lpString="*.jpg") returned 5 [0062.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.jpeg") returned 0 [0062.605] lstrlenA (lpString="*.jpeg") returned 6 [0062.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.psd") returned 0 [0062.605] lstrlenA (lpString="*.psd") returned 5 [0062.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.gif") returned 0 [0062.605] lstrlenA (lpString="*.gif") returned 5 [0062.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.doc") returned 0 [0062.606] lstrlenA (lpString="*.doc") returned 5 [0062.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.docx") returned 0 [0062.606] lstrlenA (lpString="*.docx") returned 6 [0062.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.xls") returned 0 [0062.606] lstrlenA (lpString="*.xls") returned 5 [0062.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.xlsx") returned 0 [0062.606] lstrlenA (lpString="*.xlsx") returned 6 [0062.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.ppt") returned 0 [0062.606] lstrlenA (lpString="*.ppt") returned 5 [0062.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.pptx") returned 0 [0062.606] lstrlenA (lpString="*.pptx") returned 6 [0062.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.pdf") returned 0 [0062.606] lstrlenA (lpString="*.pdf") returned 5 [0062.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.mov") returned 0 [0062.606] lstrlenA (lpString="*.mov") returned 5 [0062.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.m2v") returned 0 [0062.606] lstrlenA (lpString="*.m2v") returned 5 [0062.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.3gp") returned 0 [0062.606] lstrlenA (lpString="*.3gp") returned 5 [0062.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.mpeg") returned 0 [0062.606] lstrlenA (lpString="*.mpeg") returned 6 [0062.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.mpg") returned 0 [0062.606] lstrlenA (lpString="*.mpg") returned 5 [0062.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.flv") returned 0 [0062.606] lstrlenA (lpString="*.flv") returned 5 [0062.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.avi") returned 0 [0062.606] lstrlenA (lpString="*.avi") returned 5 [0062.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.mp4") returned 0 [0062.607] lstrlenA (lpString="*.mp4") returned 5 [0062.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.wmv") returned 0 [0062.607] lstrlenA (lpString="*.wmv") returned 5 [0062.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.divx") returned 0 [0062.607] lstrlenA (lpString="*.divx") returned 6 [0062.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.mkv") returned 0 [0062.607] lstrlenA (lpString="*.mkv") returned 5 [0062.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.mp3") returned 0 [0062.607] lstrlenA (lpString="*.mp3") returned 5 [0062.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.wav") returned 0 [0062.607] lstrlenA (lpString="*.wav") returned 5 [0062.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.flac") returned 0 [0062.607] lstrlenA (lpString="*.flac") returned 6 [0062.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.ape") returned 0 [0062.607] lstrlenA (lpString="*.ape") returned 5 [0062.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.wma") returned 0 [0062.607] lstrlenA (lpString="*.wma") returned 5 [0062.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.ac3") returned 0 [0062.607] lstrlenA (lpString="*.ac3") returned 5 [0062.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.mxf") returned 0 [0062.607] lstrlenA (lpString="*.mxf") returned 5 [0062.607] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6bd79c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x38d, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="OliveGreen.css", cAlternateFileName="OLIVEG~1.CSS")) returned 1 [0062.607] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.607] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OliveGreen.css") returned -1 [0062.607] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OliveGreen.css") returned -1 [0062.608] lstrcmpiA (lpString1="", lpString2="OliveGreen.css") returned -1 [0062.608] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css") returned="Oasis.css" [0062.608] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" [0062.608] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="" [0062.608] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0062.608] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0062.608] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="OliveGreen.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css" [0062.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.zip") returned 0 [0062.608] lstrlenA (lpString="*.zip") returned 5 [0062.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.rar") returned 0 [0062.608] lstrlenA (lpString="*.rar") returned 5 [0062.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.7z") returned 0 [0062.608] lstrlenA (lpString="*.7z") returned 4 [0062.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.tar") returned 0 [0062.608] lstrlenA (lpString="*.tar") returned 5 [0062.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.gzip") returned 0 [0062.608] lstrlenA (lpString="*.gzip") returned 6 [0062.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.jpg") returned 0 [0062.608] lstrlenA (lpString="*.jpg") returned 5 [0062.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.jpeg") returned 0 [0062.608] lstrlenA (lpString="*.jpeg") returned 6 [0062.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.psd") returned 0 [0062.608] lstrlenA (lpString="*.psd") returned 5 [0062.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.gif") returned 0 [0062.608] lstrlenA (lpString="*.gif") returned 5 [0062.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.doc") returned 0 [0062.608] lstrlenA (lpString="*.doc") returned 5 [0062.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.docx") returned 0 [0062.609] lstrlenA (lpString="*.docx") returned 6 [0062.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.xls") returned 0 [0062.609] lstrlenA (lpString="*.xls") returned 5 [0062.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.xlsx") returned 0 [0062.609] lstrlenA (lpString="*.xlsx") returned 6 [0062.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.ppt") returned 0 [0062.609] lstrlenA (lpString="*.ppt") returned 5 [0062.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.pptx") returned 0 [0062.609] lstrlenA (lpString="*.pptx") returned 6 [0062.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.pdf") returned 0 [0062.609] lstrlenA (lpString="*.pdf") returned 5 [0062.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.mov") returned 0 [0062.609] lstrlenA (lpString="*.mov") returned 5 [0062.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.m2v") returned 0 [0062.609] lstrlenA (lpString="*.m2v") returned 5 [0062.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.3gp") returned 0 [0062.609] lstrlenA (lpString="*.3gp") returned 5 [0062.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.mpeg") returned 0 [0062.609] lstrlenA (lpString="*.mpeg") returned 6 [0062.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.mpg") returned 0 [0062.609] lstrlenA (lpString="*.mpg") returned 5 [0062.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.flv") returned 0 [0062.609] lstrlenA (lpString="*.flv") returned 5 [0062.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.avi") returned 0 [0062.609] lstrlenA (lpString="*.avi") returned 5 [0062.609] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.mp4") returned 0 [0062.609] lstrlenA (lpString="*.mp4") returned 5 [0062.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.wmv") returned 0 [0062.610] lstrlenA (lpString="*.wmv") returned 5 [0062.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.divx") returned 0 [0062.610] lstrlenA (lpString="*.divx") returned 6 [0062.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.mkv") returned 0 [0062.610] lstrlenA (lpString="*.mkv") returned 5 [0062.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.mp3") returned 0 [0062.610] lstrlenA (lpString="*.mp3") returned 5 [0062.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.wav") returned 0 [0062.610] lstrlenA (lpString="*.wav") returned 5 [0062.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.flac") returned 0 [0062.610] lstrlenA (lpString="*.flac") returned 6 [0062.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.ape") returned 0 [0062.610] lstrlenA (lpString="*.ape") returned 5 [0062.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.wma") returned 0 [0062.610] lstrlenA (lpString="*.wma") returned 5 [0062.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.ac3") returned 0 [0062.610] lstrlenA (lpString="*.ac3") returned 5 [0062.610] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.mxf") returned 0 [0062.610] lstrlenA (lpString="*.mxf") returned 5 [0062.610] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="Premium.css", cAlternateFileName="")) returned 1 [0062.610] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.610] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Premium.css") returned -1 [0062.610] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Premium.css") returned -1 [0062.610] lstrcmpiA (lpString1="", lpString2="Premium.css") returned -1 [0062.610] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css") returned="OliveGreen.css" [0062.610] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" [0062.610] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="" [0062.611] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0062.611] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0062.611] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Premium.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css" [0062.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.zip") returned 0 [0062.611] lstrlenA (lpString="*.zip") returned 5 [0062.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.rar") returned 0 [0062.611] lstrlenA (lpString="*.rar") returned 5 [0062.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.7z") returned 0 [0062.611] lstrlenA (lpString="*.7z") returned 4 [0062.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.tar") returned 0 [0062.611] lstrlenA (lpString="*.tar") returned 5 [0062.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.gzip") returned 0 [0062.611] lstrlenA (lpString="*.gzip") returned 6 [0062.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.jpg") returned 0 [0062.611] lstrlenA (lpString="*.jpg") returned 5 [0062.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.jpeg") returned 0 [0062.611] lstrlenA (lpString="*.jpeg") returned 6 [0062.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.psd") returned 0 [0062.611] lstrlenA (lpString="*.psd") returned 5 [0062.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.gif") returned 0 [0062.611] lstrlenA (lpString="*.gif") returned 5 [0062.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.doc") returned 0 [0062.611] lstrlenA (lpString="*.doc") returned 5 [0062.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.docx") returned 0 [0062.611] lstrlenA (lpString="*.docx") returned 6 [0062.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.xls") returned 0 [0062.611] lstrlenA (lpString="*.xls") returned 5 [0062.611] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.xlsx") returned 0 [0062.612] lstrlenA (lpString="*.xlsx") returned 6 [0062.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.ppt") returned 0 [0062.612] lstrlenA (lpString="*.ppt") returned 5 [0062.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.pptx") returned 0 [0062.612] lstrlenA (lpString="*.pptx") returned 6 [0062.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.pdf") returned 0 [0062.612] lstrlenA (lpString="*.pdf") returned 5 [0062.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.mov") returned 0 [0062.612] lstrlenA (lpString="*.mov") returned 5 [0062.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.m2v") returned 0 [0062.612] lstrlenA (lpString="*.m2v") returned 5 [0062.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.3gp") returned 0 [0062.612] lstrlenA (lpString="*.3gp") returned 5 [0062.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.mpeg") returned 0 [0062.612] lstrlenA (lpString="*.mpeg") returned 6 [0062.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.mpg") returned 0 [0062.612] lstrlenA (lpString="*.mpg") returned 5 [0062.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.flv") returned 0 [0062.612] lstrlenA (lpString="*.flv") returned 5 [0062.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.avi") returned 0 [0062.612] lstrlenA (lpString="*.avi") returned 5 [0062.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.mp4") returned 0 [0062.612] lstrlenA (lpString="*.mp4") returned 5 [0062.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.wmv") returned 0 [0062.612] lstrlenA (lpString="*.wmv") returned 5 [0062.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.divx") returned 0 [0062.612] lstrlenA (lpString="*.divx") returned 6 [0062.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.mkv") returned 0 [0062.612] lstrlenA (lpString="*.mkv") returned 5 [0062.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.mp3") returned 0 [0062.612] lstrlenA (lpString="*.mp3") returned 5 [0062.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.wav") returned 0 [0062.613] lstrlenA (lpString="*.wav") returned 5 [0062.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.flac") returned 0 [0062.613] lstrlenA (lpString="*.flac") returned 6 [0062.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.ape") returned 0 [0062.613] lstrlenA (lpString="*.ape") returned 5 [0062.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.wma") returned 0 [0062.613] lstrlenA (lpString="*.wma") returned 5 [0062.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.ac3") returned 0 [0062.613] lstrlenA (lpString="*.ac3") returned 5 [0062.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.mxf") returned 0 [0062.613] lstrlenA (lpString="*.mxf") returned 5 [0062.613] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="Slate", cAlternateFileName="")) returned 1 [0062.613] lstrcmpA (lpString1=".", lpString2="Slate") returned -1 [0062.613] lstrcmpA (lpString1="..", lpString2="Slate") returned -1 [0062.613] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css") returned="Premium.css" [0062.613] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Slate" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate" [0062.613] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate") returned 100 [0062.613] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x2d827e, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0062.614] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.614] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0062.614] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.614] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.614] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0062.614] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.614] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0062.614] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0062.614] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0062.614] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\*.*") returned="*.*" [0062.614] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\" [0062.614] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\") returned="" [0062.614] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt" [0062.614] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\how to decrypt files.txt")) returned 0xffffffff [0062.614] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.615] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0062.615] WriteFile (in: hFile=0xa0, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0062.616] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.616] CloseHandle (hObject=0xa0) returned 1 [0062.616] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF" [0062.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0062.616] lstrlenA (lpString="*.zip") returned 5 [0062.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0062.616] lstrlenA (lpString="*.rar") returned 5 [0062.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0062.617] lstrlenA (lpString="*.7z") returned 4 [0062.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0062.617] lstrlenA (lpString="*.tar") returned 5 [0062.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0062.617] lstrlenA (lpString="*.gzip") returned 6 [0062.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0062.617] lstrlenA (lpString="*.jpg") returned 5 [0062.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0062.617] lstrlenA (lpString="*.jpeg") returned 6 [0062.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0062.617] lstrlenA (lpString="*.psd") returned 5 [0062.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0062.617] lstrlenA (lpString="*.gif") returned 5 [0062.617] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF" [0062.617] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF" [0062.617] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF." [0062.617] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF.wannacry" [0062.617] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.618] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16c [0062.618] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea)) returned 1 [0062.618] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.618] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xee, lpOverlapped=0x0) returned 1 [0062.619] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0062.619] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.619] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xee, lpOverlapped=0x0) returned 1 [0062.619] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.619] CloseHandle (hObject=0xa0) returned 1 [0062.619] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_off.gif.wannacry")) returned 1 [0062.620] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0062.620] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.620] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0062.620] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0062.620] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0062.620] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0062.620] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\" [0062.620] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\") returned="" [0062.620] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt" [0062.620] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\how to decrypt files.txt")) returned 0x20 [0062.620] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF" [0062.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0062.621] lstrlenA (lpString="*.zip") returned 5 [0062.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0062.621] lstrlenA (lpString="*.rar") returned 5 [0062.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0062.621] lstrlenA (lpString="*.7z") returned 4 [0062.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0062.621] lstrlenA (lpString="*.tar") returned 5 [0062.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0062.621] lstrlenA (lpString="*.gzip") returned 6 [0062.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0062.621] lstrlenA (lpString="*.jpg") returned 5 [0062.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0062.621] lstrlenA (lpString="*.jpeg") returned 6 [0062.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0062.621] lstrlenA (lpString="*.psd") returned 5 [0062.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0062.621] lstrlenA (lpString="*.gif") returned 5 [0062.621] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF" [0062.621] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF" [0062.621] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF." [0062.621] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF.wannacry" [0062.621] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.622] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16c [0062.622] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea)) returned 1 [0062.622] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.622] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xee, lpOverlapped=0x0) returned 1 [0062.623] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF") returned="TAB_ON.GIF" [0062.623] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.623] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xee, lpOverlapped=0x0) returned 1 [0062.623] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.623] CloseHandle (hObject=0xa0) returned 1 [0062.623] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_on.gif.wannacry")) returned 1 [0062.626] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0062.626] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0062.626] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd41, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="Slate.css", cAlternateFileName="")) returned 1 [0062.626] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.626] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Slate.css") returned -1 [0062.626] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Slate.css") returned -1 [0062.626] lstrcmpiA (lpString1="", lpString2="Slate.css") returned -1 [0062.626] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0062.626] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" [0062.626] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="" [0062.626] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0062.626] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0062.627] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Slate.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css" [0062.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.zip") returned 0 [0062.627] lstrlenA (lpString="*.zip") returned 5 [0062.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.rar") returned 0 [0062.627] lstrlenA (lpString="*.rar") returned 5 [0062.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.7z") returned 0 [0062.627] lstrlenA (lpString="*.7z") returned 4 [0062.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.tar") returned 0 [0062.627] lstrlenA (lpString="*.tar") returned 5 [0062.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.gzip") returned 0 [0062.627] lstrlenA (lpString="*.gzip") returned 6 [0062.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.jpg") returned 0 [0062.627] lstrlenA (lpString="*.jpg") returned 5 [0062.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.jpeg") returned 0 [0062.627] lstrlenA (lpString="*.jpeg") returned 6 [0062.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.psd") returned 0 [0062.627] lstrlenA (lpString="*.psd") returned 5 [0062.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.gif") returned 0 [0062.627] lstrlenA (lpString="*.gif") returned 5 [0062.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.doc") returned 0 [0062.627] lstrlenA (lpString="*.doc") returned 5 [0062.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.docx") returned 0 [0062.627] lstrlenA (lpString="*.docx") returned 6 [0062.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.xls") returned 0 [0062.627] lstrlenA (lpString="*.xls") returned 5 [0062.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.xlsx") returned 0 [0062.627] lstrlenA (lpString="*.xlsx") returned 6 [0062.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.ppt") returned 0 [0062.627] lstrlenA (lpString="*.ppt") returned 5 [0062.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.pptx") returned 0 [0062.627] lstrlenA (lpString="*.pptx") returned 6 [0062.627] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.pdf") returned 0 [0062.628] lstrlenA (lpString="*.pdf") returned 5 [0062.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.mov") returned 0 [0062.628] lstrlenA (lpString="*.mov") returned 5 [0062.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.m2v") returned 0 [0062.628] lstrlenA (lpString="*.m2v") returned 5 [0062.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.3gp") returned 0 [0062.628] lstrlenA (lpString="*.3gp") returned 5 [0062.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.mpeg") returned 0 [0062.628] lstrlenA (lpString="*.mpeg") returned 6 [0062.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.mpg") returned 0 [0062.628] lstrlenA (lpString="*.mpg") returned 5 [0062.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.flv") returned 0 [0062.628] lstrlenA (lpString="*.flv") returned 5 [0062.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.avi") returned 0 [0062.628] lstrlenA (lpString="*.avi") returned 5 [0062.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.mp4") returned 0 [0062.628] lstrlenA (lpString="*.mp4") returned 5 [0062.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.wmv") returned 0 [0062.628] lstrlenA (lpString="*.wmv") returned 5 [0062.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.divx") returned 0 [0062.628] lstrlenA (lpString="*.divx") returned 6 [0062.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.mkv") returned 0 [0062.628] lstrlenA (lpString="*.mkv") returned 5 [0062.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.mp3") returned 0 [0062.628] lstrlenA (lpString="*.mp3") returned 5 [0062.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.wav") returned 0 [0062.628] lstrlenA (lpString="*.wav") returned 5 [0062.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.flac") returned 0 [0062.628] lstrlenA (lpString="*.flac") returned 6 [0062.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.ape") returned 0 [0062.628] lstrlenA (lpString="*.ape") returned 5 [0062.628] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.wma") returned 0 [0062.629] lstrlenA (lpString="*.wma") returned 5 [0062.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.ac3") returned 0 [0062.629] lstrlenA (lpString="*.ac3") returned 5 [0062.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.mxf") returned 0 [0062.629] lstrlenA (lpString="*.mxf") returned 5 [0062.629] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="SlateBlue.css", cAlternateFileName="SLATEB~1.CSS")) returned 1 [0062.629] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.629] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SlateBlue.css") returned -1 [0062.629] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SlateBlue.css") returned -1 [0062.629] lstrcmpiA (lpString1="", lpString2="SlateBlue.css") returned -1 [0062.629] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css") returned="Slate.css" [0062.629] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" [0062.629] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="" [0062.629] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0062.629] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0062.629] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="SlateBlue.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css" [0062.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.zip") returned 0 [0062.629] lstrlenA (lpString="*.zip") returned 5 [0062.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.rar") returned 0 [0062.629] lstrlenA (lpString="*.rar") returned 5 [0062.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.7z") returned 0 [0062.629] lstrlenA (lpString="*.7z") returned 4 [0062.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.tar") returned 0 [0062.629] lstrlenA (lpString="*.tar") returned 5 [0062.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.gzip") returned 0 [0062.629] lstrlenA (lpString="*.gzip") returned 6 [0062.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.jpg") returned 0 [0062.629] lstrlenA (lpString="*.jpg") returned 5 [0062.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.jpeg") returned 0 [0062.630] lstrlenA (lpString="*.jpeg") returned 6 [0062.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.psd") returned 0 [0062.630] lstrlenA (lpString="*.psd") returned 5 [0062.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.gif") returned 0 [0062.630] lstrlenA (lpString="*.gif") returned 5 [0062.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.doc") returned 0 [0062.630] lstrlenA (lpString="*.doc") returned 5 [0062.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.docx") returned 0 [0062.630] lstrlenA (lpString="*.docx") returned 6 [0062.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.xls") returned 0 [0062.630] lstrlenA (lpString="*.xls") returned 5 [0062.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.xlsx") returned 0 [0062.630] lstrlenA (lpString="*.xlsx") returned 6 [0062.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.ppt") returned 0 [0062.630] lstrlenA (lpString="*.ppt") returned 5 [0062.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.pptx") returned 0 [0062.630] lstrlenA (lpString="*.pptx") returned 6 [0062.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.pdf") returned 0 [0062.630] lstrlenA (lpString="*.pdf") returned 5 [0062.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.mov") returned 0 [0062.630] lstrlenA (lpString="*.mov") returned 5 [0062.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.m2v") returned 0 [0062.630] lstrlenA (lpString="*.m2v") returned 5 [0062.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.3gp") returned 0 [0062.630] lstrlenA (lpString="*.3gp") returned 5 [0062.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.mpeg") returned 0 [0062.630] lstrlenA (lpString="*.mpeg") returned 6 [0062.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.mpg") returned 0 [0062.630] lstrlenA (lpString="*.mpg") returned 5 [0062.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.flv") returned 0 [0062.631] lstrlenA (lpString="*.flv") returned 5 [0062.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.avi") returned 0 [0062.631] lstrlenA (lpString="*.avi") returned 5 [0062.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.mp4") returned 0 [0062.631] lstrlenA (lpString="*.mp4") returned 5 [0062.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.wmv") returned 0 [0062.631] lstrlenA (lpString="*.wmv") returned 5 [0062.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.divx") returned 0 [0062.631] lstrlenA (lpString="*.divx") returned 6 [0062.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.mkv") returned 0 [0062.631] lstrlenA (lpString="*.mkv") returned 5 [0062.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.mp3") returned 0 [0062.631] lstrlenA (lpString="*.mp3") returned 5 [0062.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.wav") returned 0 [0062.631] lstrlenA (lpString="*.wav") returned 5 [0062.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.flac") returned 0 [0062.631] lstrlenA (lpString="*.flac") returned 6 [0062.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.ape") returned 0 [0062.631] lstrlenA (lpString="*.ape") returned 5 [0062.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.wma") returned 0 [0062.631] lstrlenA (lpString="*.wma") returned 5 [0062.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.ac3") returned 0 [0062.631] lstrlenA (lpString="*.ac3") returned 5 [0062.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.mxf") returned 0 [0062.631] lstrlenA (lpString="*.mxf") returned 5 [0062.631] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="SoftBlue", cAlternateFileName="")) returned 1 [0062.631] lstrcmpA (lpString1=".", lpString2="SoftBlue") returned -1 [0062.631] lstrcmpA (lpString1="..", lpString2="SoftBlue") returned -1 [0062.631] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css") returned="SlateBlue.css" [0062.631] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="SoftBlue" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue" [0062.631] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue") returned 103 [0062.632] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x2d827e, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0062.632] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.632] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0062.632] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.632] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.632] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1afa, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0062.632] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.632] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="background.gif") returned 1 [0062.632] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1 [0062.632] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1 [0062.632] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\*.*") returned="*.*" [0062.632] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\" [0062.632] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\") returned="" [0062.632] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt" [0062.632] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\how to decrypt files.txt")) returned 0xffffffff [0062.632] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.635] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0062.635] WriteFile (in: hFile=0xa0, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0062.637] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.637] CloseHandle (hObject=0xa0) returned 1 [0062.637] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" [0062.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.zip") returned 0 [0062.637] lstrlenA (lpString="*.zip") returned 5 [0062.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.rar") returned 0 [0062.637] lstrlenA (lpString="*.rar") returned 5 [0062.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.7z") returned 0 [0062.637] lstrlenA (lpString="*.7z") returned 4 [0062.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.tar") returned 0 [0062.638] lstrlenA (lpString="*.tar") returned 5 [0062.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.gzip") returned 0 [0062.638] lstrlenA (lpString="*.gzip") returned 6 [0062.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.jpg") returned 0 [0062.638] lstrlenA (lpString="*.jpg") returned 5 [0062.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.jpeg") returned 0 [0062.638] lstrlenA (lpString="*.jpeg") returned 6 [0062.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.psd") returned 0 [0062.638] lstrlenA (lpString="*.psd") returned 5 [0062.638] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.gif") returned 1 [0062.638] lstrlenA (lpString="*.gif") returned 5 [0062.638] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" [0062.638] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" [0062.638] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif." [0062.638] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif.wannacry" [0062.638] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.639] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1afa [0062.639] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1 [0062.639] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.640] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1a7c, lpOverlapped=0x0) returned 1 [0062.641] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif") returned="background.gif" [0062.641] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.641] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1a7c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1a7c, lpOverlapped=0x0) returned 1 [0062.642] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.642] CloseHandle (hObject=0xa0) returned 1 [0062.642] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif.wannacry")) returned 1 [0062.643] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="tab_off.gif", cAlternateFileName="")) returned 1 [0062.643] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.643] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tab_off.gif") returned -1 [0062.643] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tab_off.gif") returned -1 [0062.643] lstrcmpiA (lpString1="", lpString2="tab_off.gif") returned -1 [0062.643] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif") returned="background.gif" [0062.643] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\" [0062.643] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\") returned="" [0062.643] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt" [0062.643] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\how to decrypt files.txt")) returned 0x20 [0062.643] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\", lpString2="tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" [0062.643] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.zip") returned 0 [0062.643] lstrlenA (lpString="*.zip") returned 5 [0062.643] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.rar") returned 0 [0062.643] lstrlenA (lpString="*.rar") returned 5 [0062.643] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.7z") returned 0 [0062.643] lstrlenA (lpString="*.7z") returned 4 [0062.643] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.tar") returned 0 [0062.643] lstrlenA (lpString="*.tar") returned 5 [0062.644] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.gzip") returned 0 [0062.644] lstrlenA (lpString="*.gzip") returned 6 [0062.644] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.jpg") returned 0 [0062.644] lstrlenA (lpString="*.jpg") returned 5 [0062.644] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.jpeg") returned 0 [0062.644] lstrlenA (lpString="*.jpeg") returned 6 [0062.644] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.psd") returned 0 [0062.644] lstrlenA (lpString="*.psd") returned 5 [0062.644] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.gif") returned 1 [0062.644] lstrlenA (lpString="*.gif") returned 5 [0062.644] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" [0062.644] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" [0062.644] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif." [0062.644] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif.wannacry" [0062.644] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.645] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0062.645] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1 [0062.645] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.645] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd7, lpOverlapped=0x0) returned 1 [0062.646] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif") returned="tab_off.gif" [0062.646] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.646] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd7, lpOverlapped=0x0) returned 1 [0062.646] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.647] CloseHandle (hObject=0xa0) returned 1 [0062.647] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif.wannacry")) returned 1 [0062.647] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="tab_on.gif", cAlternateFileName="")) returned 1 [0062.647] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.648] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tab_on.gif") returned -1 [0062.648] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tab_on.gif") returned -1 [0062.648] lstrcmpiA (lpString1="", lpString2="tab_on.gif") returned -1 [0062.648] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif") returned="tab_off.gif" [0062.648] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\" [0062.648] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\") returned="" [0062.648] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt" [0062.648] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\how to decrypt files.txt")) returned 0x20 [0062.648] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\", lpString2="tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" [0062.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.zip") returned 0 [0062.648] lstrlenA (lpString="*.zip") returned 5 [0062.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.rar") returned 0 [0062.648] lstrlenA (lpString="*.rar") returned 5 [0062.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.7z") returned 0 [0062.648] lstrlenA (lpString="*.7z") returned 4 [0062.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.tar") returned 0 [0062.648] lstrlenA (lpString="*.tar") returned 5 [0062.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.gzip") returned 0 [0062.648] lstrlenA (lpString="*.gzip") returned 6 [0062.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.jpg") returned 0 [0062.648] lstrlenA (lpString="*.jpg") returned 5 [0062.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.jpeg") returned 0 [0062.648] lstrlenA (lpString="*.jpeg") returned 6 [0062.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.psd") returned 0 [0062.648] lstrlenA (lpString="*.psd") returned 5 [0062.648] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.gif") returned 1 [0062.648] lstrlenA (lpString="*.gif") returned 5 [0062.648] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" [0062.648] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" [0062.648] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif." [0062.648] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif.wannacry" [0062.649] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.649] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0062.649] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1 [0062.649] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.649] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60, lpOverlapped=0x0) returned 1 [0062.650] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif") returned="tab_on.gif" [0062.650] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.650] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60, lpOverlapped=0x0) returned 1 [0062.650] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.650] CloseHandle (hObject=0xa0) returned 1 [0062.650] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_on.gif.wannacry")) returned 1 [0062.651] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="tab_on.gif", cAlternateFileName="")) returned 0 [0062.651] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0062.651] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe34, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="SoftBlue.css", cAlternateFileName="")) returned 1 [0062.651] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.651] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SoftBlue.css") returned -1 [0062.651] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SoftBlue.css") returned -1 [0062.651] lstrcmpiA (lpString1="", lpString2="SoftBlue.css") returned -1 [0062.651] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0062.651] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" [0062.651] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="" [0062.651] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0062.651] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0062.651] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="SoftBlue.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css" [0062.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.zip") returned 0 [0062.651] lstrlenA (lpString="*.zip") returned 5 [0062.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.rar") returned 0 [0062.651] lstrlenA (lpString="*.rar") returned 5 [0062.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.7z") returned 0 [0062.652] lstrlenA (lpString="*.7z") returned 4 [0062.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.tar") returned 0 [0062.652] lstrlenA (lpString="*.tar") returned 5 [0062.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.gzip") returned 0 [0062.652] lstrlenA (lpString="*.gzip") returned 6 [0062.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.jpg") returned 0 [0062.652] lstrlenA (lpString="*.jpg") returned 5 [0062.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.jpeg") returned 0 [0062.652] lstrlenA (lpString="*.jpeg") returned 6 [0062.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.psd") returned 0 [0062.652] lstrlenA (lpString="*.psd") returned 5 [0062.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.gif") returned 0 [0062.652] lstrlenA (lpString="*.gif") returned 5 [0062.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.doc") returned 0 [0062.652] lstrlenA (lpString="*.doc") returned 5 [0062.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.docx") returned 0 [0062.652] lstrlenA (lpString="*.docx") returned 6 [0062.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.xls") returned 0 [0062.652] lstrlenA (lpString="*.xls") returned 5 [0062.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.xlsx") returned 0 [0062.652] lstrlenA (lpString="*.xlsx") returned 6 [0062.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.ppt") returned 0 [0062.652] lstrlenA (lpString="*.ppt") returned 5 [0062.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.pptx") returned 0 [0062.652] lstrlenA (lpString="*.pptx") returned 6 [0062.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.pdf") returned 0 [0062.652] lstrlenA (lpString="*.pdf") returned 5 [0062.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.mov") returned 0 [0062.652] lstrlenA (lpString="*.mov") returned 5 [0062.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.m2v") returned 0 [0062.652] lstrlenA (lpString="*.m2v") returned 5 [0062.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.3gp") returned 0 [0062.652] lstrlenA (lpString="*.3gp") returned 5 [0062.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.mpeg") returned 0 [0062.653] lstrlenA (lpString="*.mpeg") returned 6 [0062.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.mpg") returned 0 [0062.653] lstrlenA (lpString="*.mpg") returned 5 [0062.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.flv") returned 0 [0062.653] lstrlenA (lpString="*.flv") returned 5 [0062.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.avi") returned 0 [0062.653] lstrlenA (lpString="*.avi") returned 5 [0062.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.mp4") returned 0 [0062.653] lstrlenA (lpString="*.mp4") returned 5 [0062.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.wmv") returned 0 [0062.653] lstrlenA (lpString="*.wmv") returned 5 [0062.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.divx") returned 0 [0062.653] lstrlenA (lpString="*.divx") returned 6 [0062.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.mkv") returned 0 [0062.653] lstrlenA (lpString="*.mkv") returned 5 [0062.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.mp3") returned 0 [0062.653] lstrlenA (lpString="*.mp3") returned 5 [0062.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.wav") returned 0 [0062.653] lstrlenA (lpString="*.wav") returned 5 [0062.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.flac") returned 0 [0062.653] lstrlenA (lpString="*.flac") returned 6 [0062.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.ape") returned 0 [0062.653] lstrlenA (lpString="*.ape") returned 5 [0062.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.wma") returned 0 [0062.653] lstrlenA (lpString="*.wma") returned 5 [0062.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.ac3") returned 0 [0062.653] lstrlenA (lpString="*.ac3") returned 5 [0062.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.mxf") returned 0 [0062.653] lstrlenA (lpString="*.mxf") returned 5 [0062.653] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="SpringGreen", cAlternateFileName="SPRING~1")) returned 1 [0062.653] lstrcmpA (lpString1=".", lpString2="SpringGreen") returned -1 [0062.653] lstrcmpA (lpString1="..", lpString2="SpringGreen") returned -1 [0062.653] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css") returned="SoftBlue.css" [0062.653] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="SpringGreen" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen" [0062.653] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen") returned 106 [0062.654] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x2d827e, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0062.654] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.654] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0062.654] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.654] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.654] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0062.654] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.654] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BUTTON.GIF") returned 1 [0062.654] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BUTTON.GIF") returned 1 [0062.654] lstrcmpiA (lpString1="", lpString2="BUTTON.GIF") returned -1 [0062.654] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\*.*") returned="*.*" [0062.654] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\" [0062.654] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\") returned="" [0062.654] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" [0062.654] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\how to decrypt files.txt")) returned 0xffffffff [0062.654] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.655] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0062.655] WriteFile (in: hFile=0xa0, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0062.656] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.656] CloseHandle (hObject=0xa0) returned 1 [0062.656] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\", lpString2="BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF" [0062.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.zip") returned 0 [0062.656] lstrlenA (lpString="*.zip") returned 5 [0062.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.rar") returned 0 [0062.656] lstrlenA (lpString="*.rar") returned 5 [0062.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.7z") returned 0 [0062.656] lstrlenA (lpString="*.7z") returned 4 [0062.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.tar") returned 0 [0062.656] lstrlenA (lpString="*.tar") returned 5 [0062.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.gzip") returned 0 [0062.656] lstrlenA (lpString="*.gzip") returned 6 [0062.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.jpg") returned 0 [0062.656] lstrlenA (lpString="*.jpg") returned 5 [0062.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.jpeg") returned 0 [0062.656] lstrlenA (lpString="*.jpeg") returned 6 [0062.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.psd") returned 0 [0062.656] lstrlenA (lpString="*.psd") returned 5 [0062.656] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.gif") returned 1 [0062.657] lstrlenA (lpString="*.gif") returned 5 [0062.657] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF" [0062.657] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF" [0062.657] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF." [0062.657] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF.wannacry" [0062.657] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.657] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ac [0062.657] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1 [0062.657] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.657] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x12e, lpOverlapped=0x0) returned 1 [0062.658] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="BUTTON.GIF" [0062.658] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.658] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x12e, lpOverlapped=0x0) returned 1 [0062.659] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.659] CloseHandle (hObject=0xa0) returned 1 [0062.659] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\button.gif.wannacry")) returned 1 [0062.664] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0062.664] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.664] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0062.664] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0062.664] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0062.664] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="BUTTON.GIF" [0062.664] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\" [0062.664] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\") returned="" [0062.665] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" [0062.665] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\how to decrypt files.txt")) returned 0x20 [0062.665] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" [0062.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0062.665] lstrlenA (lpString="*.zip") returned 5 [0062.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0062.665] lstrlenA (lpString="*.rar") returned 5 [0062.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0062.665] lstrlenA (lpString="*.7z") returned 4 [0062.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0062.665] lstrlenA (lpString="*.tar") returned 5 [0062.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0062.665] lstrlenA (lpString="*.gzip") returned 6 [0062.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0062.665] lstrlenA (lpString="*.jpg") returned 5 [0062.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0062.665] lstrlenA (lpString="*.jpeg") returned 6 [0062.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0062.665] lstrlenA (lpString="*.psd") returned 5 [0062.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0062.665] lstrlenA (lpString="*.gif") returned 5 [0062.665] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" [0062.665] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" [0062.665] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF." [0062.665] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.wannacry" [0062.665] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.666] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0062.666] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1 [0062.666] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.666] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd7, lpOverlapped=0x0) returned 1 [0062.668] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0062.668] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.668] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd7, lpOverlapped=0x0) returned 1 [0062.668] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.668] CloseHandle (hObject=0xa0) returned 1 [0062.668] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_off.gif.wannacry")) returned 1 [0062.669] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0062.669] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.670] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0062.670] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0062.670] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0062.670] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0062.670] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\" [0062.670] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\") returned="" [0062.670] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" [0062.670] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\how to decrypt files.txt")) returned 0x20 [0062.670] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF" [0062.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0062.670] lstrlenA (lpString="*.zip") returned 5 [0062.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0062.670] lstrlenA (lpString="*.rar") returned 5 [0062.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0062.670] lstrlenA (lpString="*.7z") returned 4 [0062.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0062.670] lstrlenA (lpString="*.tar") returned 5 [0062.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0062.670] lstrlenA (lpString="*.gzip") returned 6 [0062.670] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0062.671] lstrlenA (lpString="*.jpg") returned 5 [0062.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0062.671] lstrlenA (lpString="*.jpeg") returned 6 [0062.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0062.671] lstrlenA (lpString="*.psd") returned 5 [0062.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0062.671] lstrlenA (lpString="*.gif") returned 5 [0062.671] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF" [0062.671] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF" [0062.671] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF." [0062.671] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF.wannacry" [0062.671] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.672] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0062.672] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1 [0062.672] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.672] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60, lpOverlapped=0x0) returned 1 [0062.673] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned="TAB_ON.GIF" [0062.673] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.673] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60, lpOverlapped=0x0) returned 1 [0062.673] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.674] CloseHandle (hObject=0xa0) returned 1 [0062.674] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_on.gif.wannacry")) returned 1 [0062.675] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0062.675] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0062.675] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="SpringGreen.css", cAlternateFileName="SPRING~1.CSS")) returned 1 [0062.675] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.675] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SpringGreen.css") returned -1 [0062.675] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SpringGreen.css") returned -1 [0062.675] lstrcmpiA (lpString1="", lpString2="SpringGreen.css") returned -1 [0062.675] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0062.675] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" [0062.675] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="" [0062.675] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0062.675] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0062.675] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="SpringGreen.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css" [0062.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.zip") returned 0 [0062.676] lstrlenA (lpString="*.zip") returned 5 [0062.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.rar") returned 0 [0062.676] lstrlenA (lpString="*.rar") returned 5 [0062.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.7z") returned 0 [0062.676] lstrlenA (lpString="*.7z") returned 4 [0062.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.tar") returned 0 [0062.676] lstrlenA (lpString="*.tar") returned 5 [0062.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.gzip") returned 0 [0062.676] lstrlenA (lpString="*.gzip") returned 6 [0062.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.jpg") returned 0 [0062.676] lstrlenA (lpString="*.jpg") returned 5 [0062.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.jpeg") returned 0 [0062.676] lstrlenA (lpString="*.jpeg") returned 6 [0062.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.psd") returned 0 [0062.676] lstrlenA (lpString="*.psd") returned 5 [0062.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.gif") returned 0 [0062.676] lstrlenA (lpString="*.gif") returned 5 [0062.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.doc") returned 0 [0062.676] lstrlenA (lpString="*.doc") returned 5 [0062.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.docx") returned 0 [0062.676] lstrlenA (lpString="*.docx") returned 6 [0062.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.xls") returned 0 [0062.676] lstrlenA (lpString="*.xls") returned 5 [0062.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.xlsx") returned 0 [0062.676] lstrlenA (lpString="*.xlsx") returned 6 [0062.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.ppt") returned 0 [0062.676] lstrlenA (lpString="*.ppt") returned 5 [0062.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.pptx") returned 0 [0062.676] lstrlenA (lpString="*.pptx") returned 6 [0062.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.pdf") returned 0 [0062.676] lstrlenA (lpString="*.pdf") returned 5 [0062.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.mov") returned 0 [0062.676] lstrlenA (lpString="*.mov") returned 5 [0062.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.m2v") returned 0 [0062.677] lstrlenA (lpString="*.m2v") returned 5 [0062.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.3gp") returned 0 [0062.677] lstrlenA (lpString="*.3gp") returned 5 [0062.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.mpeg") returned 0 [0062.677] lstrlenA (lpString="*.mpeg") returned 6 [0062.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.mpg") returned 0 [0062.677] lstrlenA (lpString="*.mpg") returned 5 [0062.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.flv") returned 0 [0062.677] lstrlenA (lpString="*.flv") returned 5 [0062.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.avi") returned 0 [0062.677] lstrlenA (lpString="*.avi") returned 5 [0062.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.mp4") returned 0 [0062.677] lstrlenA (lpString="*.mp4") returned 5 [0062.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.wmv") returned 0 [0062.677] lstrlenA (lpString="*.wmv") returned 5 [0062.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.divx") returned 0 [0062.677] lstrlenA (lpString="*.divx") returned 6 [0062.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.mkv") returned 0 [0062.677] lstrlenA (lpString="*.mkv") returned 5 [0062.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.mp3") returned 0 [0062.677] lstrlenA (lpString="*.mp3") returned 5 [0062.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.wav") returned 0 [0062.677] lstrlenA (lpString="*.wav") returned 5 [0062.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.flac") returned 0 [0062.677] lstrlenA (lpString="*.flac") returned 6 [0062.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.ape") returned 0 [0062.677] lstrlenA (lpString="*.ape") returned 5 [0062.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.wma") returned 0 [0062.677] lstrlenA (lpString="*.wma") returned 5 [0062.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.ac3") returned 0 [0062.677] lstrlenA (lpString="*.ac3") returned 5 [0062.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.mxf") returned 0 [0062.677] lstrlenA (lpString="*.mxf") returned 5 [0062.677] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x736, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="Sts.css", cAlternateFileName="")) returned 1 [0062.678] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.678] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Sts.css") returned -1 [0062.678] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Sts.css") returned -1 [0062.678] lstrcmpiA (lpString1="", lpString2="Sts.css") returned -1 [0062.678] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css") returned="SpringGreen.css" [0062.678] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" [0062.678] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="" [0062.678] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0062.678] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0062.678] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Sts.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css" [0062.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.zip") returned 0 [0062.678] lstrlenA (lpString="*.zip") returned 5 [0062.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.rar") returned 0 [0062.678] lstrlenA (lpString="*.rar") returned 5 [0062.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.7z") returned 0 [0062.678] lstrlenA (lpString="*.7z") returned 4 [0062.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.tar") returned 0 [0062.678] lstrlenA (lpString="*.tar") returned 5 [0062.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.gzip") returned 0 [0062.678] lstrlenA (lpString="*.gzip") returned 6 [0062.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.jpg") returned 0 [0062.678] lstrlenA (lpString="*.jpg") returned 5 [0062.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.jpeg") returned 0 [0062.678] lstrlenA (lpString="*.jpeg") returned 6 [0062.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.psd") returned 0 [0062.678] lstrlenA (lpString="*.psd") returned 5 [0062.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.gif") returned 0 [0062.678] lstrlenA (lpString="*.gif") returned 5 [0062.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.doc") returned 0 [0062.679] lstrlenA (lpString="*.doc") returned 5 [0062.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.docx") returned 0 [0062.679] lstrlenA (lpString="*.docx") returned 6 [0062.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.xls") returned 0 [0062.679] lstrlenA (lpString="*.xls") returned 5 [0062.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.xlsx") returned 0 [0062.679] lstrlenA (lpString="*.xlsx") returned 6 [0062.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.ppt") returned 0 [0062.679] lstrlenA (lpString="*.ppt") returned 5 [0062.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.pptx") returned 0 [0062.679] lstrlenA (lpString="*.pptx") returned 6 [0062.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.pdf") returned 0 [0062.679] lstrlenA (lpString="*.pdf") returned 5 [0062.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.mov") returned 0 [0062.679] lstrlenA (lpString="*.mov") returned 5 [0062.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.m2v") returned 0 [0062.679] lstrlenA (lpString="*.m2v") returned 5 [0062.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.3gp") returned 0 [0062.679] lstrlenA (lpString="*.3gp") returned 5 [0062.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.mpeg") returned 0 [0062.679] lstrlenA (lpString="*.mpeg") returned 6 [0062.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.mpg") returned 0 [0062.679] lstrlenA (lpString="*.mpg") returned 5 [0062.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.flv") returned 0 [0062.679] lstrlenA (lpString="*.flv") returned 5 [0062.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.avi") returned 0 [0062.679] lstrlenA (lpString="*.avi") returned 5 [0062.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.mp4") returned 0 [0062.679] lstrlenA (lpString="*.mp4") returned 5 [0062.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.wmv") returned 0 [0062.679] lstrlenA (lpString="*.wmv") returned 5 [0062.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.divx") returned 0 [0062.679] lstrlenA (lpString="*.divx") returned 6 [0062.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.mkv") returned 0 [0062.680] lstrlenA (lpString="*.mkv") returned 5 [0062.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.mp3") returned 0 [0062.680] lstrlenA (lpString="*.mp3") returned 5 [0062.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.wav") returned 0 [0062.680] lstrlenA (lpString="*.wav") returned 5 [0062.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.flac") returned 0 [0062.680] lstrlenA (lpString="*.flac") returned 6 [0062.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.ape") returned 0 [0062.680] lstrlenA (lpString="*.ape") returned 5 [0062.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.wma") returned 0 [0062.680] lstrlenA (lpString="*.wma") returned 5 [0062.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.ac3") returned 0 [0062.680] lstrlenA (lpString="*.ac3") returned 5 [0062.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.mxf") returned 0 [0062.680] lstrlenA (lpString="*.mxf") returned 5 [0062.680] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="STS2", cAlternateFileName="")) returned 1 [0062.680] lstrcmpA (lpString1=".", lpString2="STS2") returned -1 [0062.680] lstrcmpA (lpString1="..", lpString2="STS2") returned -1 [0062.680] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css") returned="Sts.css" [0062.680] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="STS2" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2" [0062.680] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2") returned 99 [0062.680] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x2d827e, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0062.681] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.681] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0062.681] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.681] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.681] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0062.681] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.681] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="background.gif") returned 1 [0062.681] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1 [0062.681] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1 [0062.681] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\*.*") returned="*.*" [0062.681] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\" [0062.682] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\") returned="" [0062.682] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" [0062.682] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\how to decrypt files.txt")) returned 0xffffffff [0062.682] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.684] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0062.684] WriteFile (in: hFile=0xa0, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0062.685] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.685] CloseHandle (hObject=0xa0) returned 1 [0062.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" [0062.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.zip") returned 0 [0062.686] lstrlenA (lpString="*.zip") returned 5 [0062.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.rar") returned 0 [0062.686] lstrlenA (lpString="*.rar") returned 5 [0062.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.7z") returned 0 [0062.686] lstrlenA (lpString="*.7z") returned 4 [0062.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.tar") returned 0 [0062.686] lstrlenA (lpString="*.tar") returned 5 [0062.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.gzip") returned 0 [0062.686] lstrlenA (lpString="*.gzip") returned 6 [0062.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.jpg") returned 0 [0062.686] lstrlenA (lpString="*.jpg") returned 5 [0062.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.jpeg") returned 0 [0062.686] lstrlenA (lpString="*.jpeg") returned 6 [0062.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.psd") returned 0 [0062.686] lstrlenA (lpString="*.psd") returned 5 [0062.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.gif") returned 1 [0062.686] lstrlenA (lpString="*.gif") returned 5 [0062.686] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" [0062.686] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" [0062.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif." [0062.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif.wannacry" [0062.686] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.687] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe9 [0062.687] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1 [0062.687] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.687] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x6b, lpOverlapped=0x0) returned 1 [0062.688] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif") returned="background.gif" [0062.688] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.688] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x6b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x6b, lpOverlapped=0x0) returned 1 [0062.688] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.688] CloseHandle (hObject=0xa0) returned 1 [0062.689] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif.wannacry")) returned 1 [0062.690] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xcbd, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="header.gif", cAlternateFileName="")) returned 1 [0062.690] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.690] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="header.gif") returned -1 [0062.690] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="header.gif") returned 1 [0062.690] lstrcmpiA (lpString1="", lpString2="header.gif") returned -1 [0062.690] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif") returned="background.gif" [0062.690] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\" [0062.690] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\") returned="" [0062.690] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" [0062.690] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\how to decrypt files.txt")) returned 0x20 [0062.690] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\", lpString2="header.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" [0062.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.zip") returned 0 [0062.690] lstrlenA (lpString="*.zip") returned 5 [0062.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.rar") returned 0 [0062.690] lstrlenA (lpString="*.rar") returned 5 [0062.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.7z") returned 0 [0062.690] lstrlenA (lpString="*.7z") returned 4 [0062.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.tar") returned 0 [0062.690] lstrlenA (lpString="*.tar") returned 5 [0062.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.gzip") returned 0 [0062.691] lstrlenA (lpString="*.gzip") returned 6 [0062.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.jpg") returned 0 [0062.691] lstrlenA (lpString="*.jpg") returned 5 [0062.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.jpeg") returned 0 [0062.691] lstrlenA (lpString="*.jpeg") returned 6 [0062.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.psd") returned 0 [0062.691] lstrlenA (lpString="*.psd") returned 5 [0062.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.gif") returned 1 [0062.691] lstrlenA (lpString="*.gif") returned 5 [0062.691] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" [0062.691] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" [0062.691] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif." [0062.691] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif.wannacry" [0062.691] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.692] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcbd [0062.692] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1 [0062.692] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.692] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xc3f, lpOverlapped=0x0) returned 1 [0062.694] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif") returned="header.gif" [0062.694] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.695] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xc3f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xc3f, lpOverlapped=0x0) returned 1 [0062.695] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.695] CloseHandle (hObject=0xa0) returned 1 [0062.695] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif.wannacry")) returned 1 [0062.696] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="tab_off.gif", cAlternateFileName="")) returned 1 [0062.696] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.696] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tab_off.gif") returned -1 [0062.696] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tab_off.gif") returned -1 [0062.696] lstrcmpiA (lpString1="", lpString2="tab_off.gif") returned -1 [0062.696] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif") returned="header.gif" [0062.696] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\" [0062.696] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\") returned="" [0062.696] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" [0062.696] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\how to decrypt files.txt")) returned 0x20 [0062.696] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\", lpString2="tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" [0062.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.zip") returned 0 [0062.696] lstrlenA (lpString="*.zip") returned 5 [0062.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.rar") returned 0 [0062.696] lstrlenA (lpString="*.rar") returned 5 [0062.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.7z") returned 0 [0062.696] lstrlenA (lpString="*.7z") returned 4 [0062.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.tar") returned 0 [0062.696] lstrlenA (lpString="*.tar") returned 5 [0062.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.gzip") returned 0 [0062.697] lstrlenA (lpString="*.gzip") returned 6 [0062.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.jpg") returned 0 [0062.697] lstrlenA (lpString="*.jpg") returned 5 [0062.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.jpeg") returned 0 [0062.697] lstrlenA (lpString="*.jpeg") returned 6 [0062.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.psd") returned 0 [0062.697] lstrlenA (lpString="*.psd") returned 5 [0062.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.gif") returned 1 [0062.697] lstrlenA (lpString="*.gif") returned 5 [0062.697] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" [0062.697] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" [0062.697] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif." [0062.697] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif.wannacry" [0062.697] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.698] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ce [0062.698] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1 [0062.698] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.698] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x150, lpOverlapped=0x0) returned 1 [0062.699] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif") returned="tab_off.gif" [0062.699] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.699] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x150, lpOverlapped=0x0) returned 1 [0062.699] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.699] CloseHandle (hObject=0xa0) returned 1 [0062.699] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif.wannacry")) returned 1 [0062.700] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="tab_on.gif", cAlternateFileName="")) returned 1 [0062.700] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.700] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tab_on.gif") returned -1 [0062.700] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tab_on.gif") returned -1 [0062.700] lstrcmpiA (lpString1="", lpString2="tab_on.gif") returned -1 [0062.700] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif") returned="tab_off.gif" [0062.701] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\" [0062.701] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\") returned="" [0062.701] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" [0062.701] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\how to decrypt files.txt")) returned 0x20 [0062.701] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\", lpString2="tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" [0062.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.zip") returned 0 [0062.701] lstrlenA (lpString="*.zip") returned 5 [0062.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.rar") returned 0 [0062.701] lstrlenA (lpString="*.rar") returned 5 [0062.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.7z") returned 0 [0062.701] lstrlenA (lpString="*.7z") returned 4 [0062.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.tar") returned 0 [0062.701] lstrlenA (lpString="*.tar") returned 5 [0062.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.gzip") returned 0 [0062.701] lstrlenA (lpString="*.gzip") returned 6 [0062.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.jpg") returned 0 [0062.701] lstrlenA (lpString="*.jpg") returned 5 [0062.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.jpeg") returned 0 [0062.701] lstrlenA (lpString="*.jpeg") returned 6 [0062.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.psd") returned 0 [0062.701] lstrlenA (lpString="*.psd") returned 5 [0062.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.gif") returned 1 [0062.701] lstrlenA (lpString="*.gif") returned 5 [0062.701] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" [0062.701] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" [0062.701] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif." [0062.701] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif.wannacry" [0062.701] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.703] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x108 [0062.703] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1 [0062.703] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.703] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x8a, lpOverlapped=0x0) returned 1 [0062.704] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif") returned="tab_on.gif" [0062.704] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.704] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x8a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x8a, lpOverlapped=0x0) returned 1 [0062.704] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.704] CloseHandle (hObject=0xa0) returned 1 [0062.704] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_on.gif.wannacry")) returned 1 [0062.705] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="tab_on.gif", cAlternateFileName="")) returned 0 [0062.705] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0062.705] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="Sts2.css", cAlternateFileName="")) returned 1 [0062.706] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.706] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Sts2.css") returned -1 [0062.706] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Sts2.css") returned -1 [0062.706] lstrcmpiA (lpString1="", lpString2="Sts2.css") returned -1 [0062.706] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0062.706] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" [0062.706] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="" [0062.706] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0062.706] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0062.706] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Sts2.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css" [0062.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.zip") returned 0 [0062.706] lstrlenA (lpString="*.zip") returned 5 [0062.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.rar") returned 0 [0062.706] lstrlenA (lpString="*.rar") returned 5 [0062.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.7z") returned 0 [0062.706] lstrlenA (lpString="*.7z") returned 4 [0062.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.tar") returned 0 [0062.706] lstrlenA (lpString="*.tar") returned 5 [0062.706] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.gzip") returned 0 [0062.718] lstrlenA (lpString="*.gzip") returned 6 [0062.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.jpg") returned 0 [0062.718] lstrlenA (lpString="*.jpg") returned 5 [0062.718] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.jpeg") returned 0 [0062.718] lstrlenA (lpString="*.jpeg") returned 6 [0062.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.psd") returned 0 [0062.719] lstrlenA (lpString="*.psd") returned 5 [0062.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.gif") returned 0 [0062.719] lstrlenA (lpString="*.gif") returned 5 [0062.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.doc") returned 0 [0062.719] lstrlenA (lpString="*.doc") returned 5 [0062.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.docx") returned 0 [0062.719] lstrlenA (lpString="*.docx") returned 6 [0062.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.xls") returned 0 [0062.719] lstrlenA (lpString="*.xls") returned 5 [0062.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.xlsx") returned 0 [0062.719] lstrlenA (lpString="*.xlsx") returned 6 [0062.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.ppt") returned 0 [0062.719] lstrlenA (lpString="*.ppt") returned 5 [0062.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.pptx") returned 0 [0062.719] lstrlenA (lpString="*.pptx") returned 6 [0062.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.pdf") returned 0 [0062.719] lstrlenA (lpString="*.pdf") returned 5 [0062.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.mov") returned 0 [0062.719] lstrlenA (lpString="*.mov") returned 5 [0062.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.m2v") returned 0 [0062.719] lstrlenA (lpString="*.m2v") returned 5 [0062.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.3gp") returned 0 [0062.719] lstrlenA (lpString="*.3gp") returned 5 [0062.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.mpeg") returned 0 [0062.719] lstrlenA (lpString="*.mpeg") returned 6 [0062.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.mpg") returned 0 [0062.719] lstrlenA (lpString="*.mpg") returned 5 [0062.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.flv") returned 0 [0062.719] lstrlenA (lpString="*.flv") returned 5 [0062.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.avi") returned 0 [0062.720] lstrlenA (lpString="*.avi") returned 5 [0062.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.mp4") returned 0 [0062.720] lstrlenA (lpString="*.mp4") returned 5 [0062.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.wmv") returned 0 [0062.720] lstrlenA (lpString="*.wmv") returned 5 [0062.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.divx") returned 0 [0062.720] lstrlenA (lpString="*.divx") returned 6 [0062.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.mkv") returned 0 [0062.720] lstrlenA (lpString="*.mkv") returned 5 [0062.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.mp3") returned 0 [0062.720] lstrlenA (lpString="*.mp3") returned 5 [0062.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.wav") returned 0 [0062.720] lstrlenA (lpString="*.wav") returned 5 [0062.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.flac") returned 0 [0062.720] lstrlenA (lpString="*.flac") returned 6 [0062.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.ape") returned 0 [0062.720] lstrlenA (lpString="*.ape") returned 5 [0062.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.wma") returned 0 [0062.720] lstrlenA (lpString="*.wma") returned 5 [0062.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.ac3") returned 0 [0062.720] lstrlenA (lpString="*.ac3") returned 5 [0062.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.mxf") returned 0 [0062.720] lstrlenA (lpString="*.mxf") returned 5 [0062.720] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5291c2f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="Swirl", cAlternateFileName="")) returned 1 [0062.720] lstrcmpA (lpString1=".", lpString2="Swirl") returned -1 [0062.720] lstrcmpA (lpString1="..", lpString2="Swirl") returned -1 [0062.720] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css") returned="Sts2.css" [0062.720] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Swirl" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl" [0062.721] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl") returned 100 [0062.721] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5291c2f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x2d827e, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0062.721] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.721] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5291c2f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0062.721] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.721] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.721] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x32f, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0062.721] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.721] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="background.gif") returned 1 [0062.721] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1 [0062.721] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1 [0062.721] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\*.*") returned="*.*" [0062.721] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\" [0062.721] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\") returned="" [0062.722] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" [0062.722] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\how to decrypt files.txt")) returned 0xffffffff [0062.722] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.725] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0062.725] WriteFile (in: hFile=0xa0, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0062.727] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.727] CloseHandle (hObject=0xa0) returned 1 [0062.727] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" [0062.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.zip") returned 0 [0062.727] lstrlenA (lpString="*.zip") returned 5 [0062.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.rar") returned 0 [0062.727] lstrlenA (lpString="*.rar") returned 5 [0062.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.7z") returned 0 [0062.727] lstrlenA (lpString="*.7z") returned 4 [0062.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.tar") returned 0 [0062.727] lstrlenA (lpString="*.tar") returned 5 [0062.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.gzip") returned 0 [0062.727] lstrlenA (lpString="*.gzip") returned 6 [0062.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.jpg") returned 0 [0062.727] lstrlenA (lpString="*.jpg") returned 5 [0062.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.jpeg") returned 0 [0062.727] lstrlenA (lpString="*.jpeg") returned 6 [0062.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.psd") returned 0 [0062.727] lstrlenA (lpString="*.psd") returned 5 [0062.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.gif") returned 1 [0062.728] lstrlenA (lpString="*.gif") returned 5 [0062.728] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" [0062.728] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" [0062.728] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif." [0062.728] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif.wannacry" [0062.728] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.729] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x32f [0062.729] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea)) returned 1 [0062.729] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.729] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2b1, lpOverlapped=0x0) returned 1 [0062.731] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif") returned="background.gif" [0062.731] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.731] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2b1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2b1, lpOverlapped=0x0) returned 1 [0062.731] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.731] CloseHandle (hObject=0xa0) returned 1 [0062.731] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif.wannacry")) returned 1 [0062.732] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6993, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="header.gif", cAlternateFileName="")) returned 1 [0062.732] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.732] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="header.gif") returned -1 [0062.732] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="header.gif") returned 1 [0062.732] lstrcmpiA (lpString1="", lpString2="header.gif") returned -1 [0062.732] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif") returned="background.gif" [0062.732] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\" [0062.732] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\") returned="" [0062.732] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" [0062.733] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\how to decrypt files.txt")) returned 0x20 [0062.733] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\", lpString2="header.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" [0062.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.zip") returned 0 [0062.733] lstrlenA (lpString="*.zip") returned 5 [0062.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.rar") returned 0 [0062.733] lstrlenA (lpString="*.rar") returned 5 [0062.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.7z") returned 0 [0062.733] lstrlenA (lpString="*.7z") returned 4 [0062.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.tar") returned 0 [0062.733] lstrlenA (lpString="*.tar") returned 5 [0062.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.gzip") returned 0 [0062.733] lstrlenA (lpString="*.gzip") returned 6 [0062.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.jpg") returned 0 [0062.733] lstrlenA (lpString="*.jpg") returned 5 [0062.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.jpeg") returned 0 [0062.733] lstrlenA (lpString="*.jpeg") returned 6 [0062.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.psd") returned 0 [0062.733] lstrlenA (lpString="*.psd") returned 5 [0062.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.gif") returned 1 [0062.733] lstrlenA (lpString="*.gif") returned 5 [0062.733] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" [0062.733] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" [0062.733] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif." [0062.733] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif.wannacry" [0062.733] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.735] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6993 [0062.735] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea)) returned 1 [0062.735] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.735] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x6915, lpOverlapped=0x0) returned 1 [0062.737] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif") returned="header.gif" [0062.737] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.737] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x6915, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x6915, lpOverlapped=0x0) returned 1 [0062.737] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.737] CloseHandle (hObject=0xa0) returned 1 [0062.737] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif.wannacry")) returned 1 [0062.739] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="tab_off.gif", cAlternateFileName="")) returned 1 [0062.739] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.739] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tab_off.gif") returned -1 [0062.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tab_off.gif") returned -1 [0062.739] lstrcmpiA (lpString1="", lpString2="tab_off.gif") returned -1 [0062.739] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif") returned="header.gif" [0062.739] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\" [0062.739] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\") returned="" [0062.739] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" [0062.739] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\how to decrypt files.txt")) returned 0x20 [0062.739] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\", lpString2="tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" [0062.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.zip") returned 0 [0062.739] lstrlenA (lpString="*.zip") returned 5 [0062.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.rar") returned 0 [0062.740] lstrlenA (lpString="*.rar") returned 5 [0062.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.7z") returned 0 [0062.740] lstrlenA (lpString="*.7z") returned 4 [0062.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.tar") returned 0 [0062.740] lstrlenA (lpString="*.tar") returned 5 [0062.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.gzip") returned 0 [0062.740] lstrlenA (lpString="*.gzip") returned 6 [0062.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.jpg") returned 0 [0062.740] lstrlenA (lpString="*.jpg") returned 5 [0062.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.jpeg") returned 0 [0062.740] lstrlenA (lpString="*.jpeg") returned 6 [0062.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.psd") returned 0 [0062.740] lstrlenA (lpString="*.psd") returned 5 [0062.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.gif") returned 1 [0062.740] lstrlenA (lpString="*.gif") returned 5 [0062.740] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" [0062.740] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" [0062.740] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif." [0062.740] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif.wannacry" [0062.740] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.741] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0062.741] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea)) returned 1 [0062.741] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.741] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd7, lpOverlapped=0x0) returned 1 [0062.742] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif") returned="tab_off.gif" [0062.744] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.744] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd7, lpOverlapped=0x0) returned 1 [0062.744] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.744] CloseHandle (hObject=0xa0) returned 1 [0062.744] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif.wannacry")) returned 1 [0062.745] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="tab_on.gif", cAlternateFileName="")) returned 1 [0062.745] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0062.745] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tab_on.gif") returned -1 [0062.745] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tab_on.gif") returned -1 [0062.746] lstrcmpiA (lpString1="", lpString2="tab_on.gif") returned -1 [0062.746] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif") returned="tab_off.gif" [0062.746] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\" [0062.746] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\") returned="" [0062.746] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" [0062.746] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\how to decrypt files.txt")) returned 0x20 [0062.746] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\", lpString2="tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" [0062.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.zip") returned 0 [0062.746] lstrlenA (lpString="*.zip") returned 5 [0062.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.rar") returned 0 [0062.746] lstrlenA (lpString="*.rar") returned 5 [0062.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.7z") returned 0 [0062.746] lstrlenA (lpString="*.7z") returned 4 [0062.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.tar") returned 0 [0062.746] lstrlenA (lpString="*.tar") returned 5 [0062.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.gzip") returned 0 [0062.746] lstrlenA (lpString="*.gzip") returned 6 [0062.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.jpg") returned 0 [0062.746] lstrlenA (lpString="*.jpg") returned 5 [0062.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.jpeg") returned 0 [0062.746] lstrlenA (lpString="*.jpeg") returned 6 [0062.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.psd") returned 0 [0062.747] lstrlenA (lpString="*.psd") returned 5 [0062.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.gif") returned 1 [0062.747] lstrlenA (lpString="*.gif") returned 5 [0062.747] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" [0062.747] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" [0062.747] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif." [0062.747] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif.wannacry" [0062.747] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0062.748] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0062.748] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea)) returned 1 [0062.748] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.748] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60, lpOverlapped=0x0) returned 1 [0062.749] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif") returned="tab_on.gif" [0062.749] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.749] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60, lpOverlapped=0x0) returned 1 [0062.749] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.749] CloseHandle (hObject=0xa0) returned 1 [0062.749] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_on.gif.wannacry")) returned 1 [0062.750] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="tab_on.gif", cAlternateFileName="")) returned 0 [0062.750] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0062.750] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc23, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="Swirl.css", cAlternateFileName="")) returned 1 [0062.750] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.750] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Swirl.css") returned -1 [0062.750] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Swirl.css") returned -1 [0062.750] lstrcmpiA (lpString1="", lpString2="Swirl.css") returned -1 [0062.750] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0062.750] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" [0062.750] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="" [0062.750] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0062.750] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0062.750] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Swirl.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css" [0062.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.zip") returned 0 [0062.751] lstrlenA (lpString="*.zip") returned 5 [0062.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.rar") returned 0 [0062.751] lstrlenA (lpString="*.rar") returned 5 [0062.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.7z") returned 0 [0062.751] lstrlenA (lpString="*.7z") returned 4 [0062.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.tar") returned 0 [0062.751] lstrlenA (lpString="*.tar") returned 5 [0062.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.gzip") returned 0 [0062.751] lstrlenA (lpString="*.gzip") returned 6 [0062.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.jpg") returned 0 [0062.751] lstrlenA (lpString="*.jpg") returned 5 [0062.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.jpeg") returned 0 [0062.751] lstrlenA (lpString="*.jpeg") returned 6 [0062.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.psd") returned 0 [0062.751] lstrlenA (lpString="*.psd") returned 5 [0062.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.gif") returned 0 [0062.751] lstrlenA (lpString="*.gif") returned 5 [0062.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.doc") returned 0 [0062.751] lstrlenA (lpString="*.doc") returned 5 [0062.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.docx") returned 0 [0062.751] lstrlenA (lpString="*.docx") returned 6 [0062.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.xls") returned 0 [0062.751] lstrlenA (lpString="*.xls") returned 5 [0062.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.xlsx") returned 0 [0062.751] lstrlenA (lpString="*.xlsx") returned 6 [0062.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.ppt") returned 0 [0062.751] lstrlenA (lpString="*.ppt") returned 5 [0062.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.pptx") returned 0 [0062.751] lstrlenA (lpString="*.pptx") returned 6 [0062.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.pdf") returned 0 [0062.751] lstrlenA (lpString="*.pdf") returned 5 [0062.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.mov") returned 0 [0062.751] lstrlenA (lpString="*.mov") returned 5 [0062.751] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.m2v") returned 0 [0062.751] lstrlenA (lpString="*.m2v") returned 5 [0062.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.3gp") returned 0 [0062.752] lstrlenA (lpString="*.3gp") returned 5 [0062.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.mpeg") returned 0 [0062.752] lstrlenA (lpString="*.mpeg") returned 6 [0062.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.mpg") returned 0 [0062.752] lstrlenA (lpString="*.mpg") returned 5 [0062.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.flv") returned 0 [0062.752] lstrlenA (lpString="*.flv") returned 5 [0062.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.avi") returned 0 [0062.752] lstrlenA (lpString="*.avi") returned 5 [0062.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.mp4") returned 0 [0062.752] lstrlenA (lpString="*.mp4") returned 5 [0062.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.wmv") returned 0 [0062.752] lstrlenA (lpString="*.wmv") returned 5 [0062.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.divx") returned 0 [0062.752] lstrlenA (lpString="*.divx") returned 6 [0062.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.mkv") returned 0 [0062.752] lstrlenA (lpString="*.mkv") returned 5 [0062.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.mp3") returned 0 [0062.752] lstrlenA (lpString="*.mp3") returned 5 [0062.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.wav") returned 0 [0062.752] lstrlenA (lpString="*.wav") returned 5 [0062.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.flac") returned 0 [0062.752] lstrlenA (lpString="*.flac") returned 6 [0062.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.ape") returned 0 [0062.752] lstrlenA (lpString="*.ape") returned 5 [0062.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.wma") returned 0 [0062.752] lstrlenA (lpString="*.wma") returned 5 [0062.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.ac3") returned 0 [0062.752] lstrlenA (lpString="*.ac3") returned 5 [0062.752] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.mxf") returned 0 [0062.752] lstrlenA (lpString="*.mxf") returned 5 [0062.752] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5acc63d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x37a, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="Teal.css", cAlternateFileName="")) returned 1 [0062.752] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.752] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Teal.css") returned -1 [0062.753] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Teal.css") returned -1 [0062.753] lstrcmpiA (lpString1="", lpString2="Teal.css") returned -1 [0062.753] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css") returned="Swirl.css" [0062.753] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" [0062.753] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="" [0062.753] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0062.753] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0062.753] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Teal.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css" [0062.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.zip") returned 0 [0062.753] lstrlenA (lpString="*.zip") returned 5 [0062.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.rar") returned 0 [0062.753] lstrlenA (lpString="*.rar") returned 5 [0062.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.7z") returned 0 [0062.753] lstrlenA (lpString="*.7z") returned 4 [0062.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.tar") returned 0 [0062.753] lstrlenA (lpString="*.tar") returned 5 [0062.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.gzip") returned 0 [0062.753] lstrlenA (lpString="*.gzip") returned 6 [0062.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.jpg") returned 0 [0062.753] lstrlenA (lpString="*.jpg") returned 5 [0062.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.jpeg") returned 0 [0062.753] lstrlenA (lpString="*.jpeg") returned 6 [0062.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.psd") returned 0 [0062.753] lstrlenA (lpString="*.psd") returned 5 [0062.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.gif") returned 0 [0062.753] lstrlenA (lpString="*.gif") returned 5 [0062.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.doc") returned 0 [0062.753] lstrlenA (lpString="*.doc") returned 5 [0062.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.docx") returned 0 [0062.753] lstrlenA (lpString="*.docx") returned 6 [0062.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.xls") returned 0 [0062.754] lstrlenA (lpString="*.xls") returned 5 [0062.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.xlsx") returned 0 [0062.754] lstrlenA (lpString="*.xlsx") returned 6 [0062.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.ppt") returned 0 [0062.754] lstrlenA (lpString="*.ppt") returned 5 [0062.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.pptx") returned 0 [0062.754] lstrlenA (lpString="*.pptx") returned 6 [0062.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.pdf") returned 0 [0062.754] lstrlenA (lpString="*.pdf") returned 5 [0062.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.mov") returned 0 [0062.754] lstrlenA (lpString="*.mov") returned 5 [0062.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.m2v") returned 0 [0062.754] lstrlenA (lpString="*.m2v") returned 5 [0062.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.3gp") returned 0 [0062.754] lstrlenA (lpString="*.3gp") returned 5 [0062.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.mpeg") returned 0 [0062.754] lstrlenA (lpString="*.mpeg") returned 6 [0062.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.mpg") returned 0 [0062.754] lstrlenA (lpString="*.mpg") returned 5 [0062.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.flv") returned 0 [0062.754] lstrlenA (lpString="*.flv") returned 5 [0062.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.avi") returned 0 [0062.754] lstrlenA (lpString="*.avi") returned 5 [0062.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.mp4") returned 0 [0062.754] lstrlenA (lpString="*.mp4") returned 5 [0062.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.wmv") returned 0 [0062.754] lstrlenA (lpString="*.wmv") returned 5 [0062.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.divx") returned 0 [0062.754] lstrlenA (lpString="*.divx") returned 6 [0062.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.mkv") returned 0 [0062.754] lstrlenA (lpString="*.mkv") returned 5 [0062.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.mp3") returned 0 [0062.754] lstrlenA (lpString="*.mp3") returned 5 [0062.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.wav") returned 0 [0062.755] lstrlenA (lpString="*.wav") returned 5 [0062.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.flac") returned 0 [0062.755] lstrlenA (lpString="*.flac") returned 6 [0062.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.ape") returned 0 [0062.755] lstrlenA (lpString="*.ape") returned 5 [0062.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.wma") returned 0 [0062.755] lstrlenA (lpString="*.wma") returned 5 [0062.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.ac3") returned 0 [0062.755] lstrlenA (lpString="*.ac3") returned 5 [0062.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.mxf") returned 0 [0062.755] lstrlenA (lpString="*.mxf") returned 5 [0062.755] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x37b, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="TexturedBlue.css", cAlternateFileName="TEXTUR~1.CSS")) returned 1 [0062.755] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.755] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TexturedBlue.css") returned -1 [0062.755] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TexturedBlue.css") returned -1 [0062.755] lstrcmpiA (lpString1="", lpString2="TexturedBlue.css") returned -1 [0062.755] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css") returned="Teal.css" [0062.755] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" [0062.755] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="" [0062.755] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0062.755] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0062.755] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="TexturedBlue.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css" [0062.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.zip") returned 0 [0062.755] lstrlenA (lpString="*.zip") returned 5 [0062.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.rar") returned 0 [0062.755] lstrlenA (lpString="*.rar") returned 5 [0062.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.7z") returned 0 [0062.755] lstrlenA (lpString="*.7z") returned 4 [0062.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.tar") returned 0 [0062.755] lstrlenA (lpString="*.tar") returned 5 [0062.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.gzip") returned 0 [0062.755] lstrlenA (lpString="*.gzip") returned 6 [0062.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.jpg") returned 0 [0062.756] lstrlenA (lpString="*.jpg") returned 5 [0062.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.jpeg") returned 0 [0062.756] lstrlenA (lpString="*.jpeg") returned 6 [0062.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.psd") returned 0 [0062.756] lstrlenA (lpString="*.psd") returned 5 [0062.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.gif") returned 0 [0062.756] lstrlenA (lpString="*.gif") returned 5 [0062.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.doc") returned 0 [0062.756] lstrlenA (lpString="*.doc") returned 5 [0062.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.docx") returned 0 [0062.756] lstrlenA (lpString="*.docx") returned 6 [0062.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.xls") returned 0 [0062.756] lstrlenA (lpString="*.xls") returned 5 [0062.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.xlsx") returned 0 [0062.756] lstrlenA (lpString="*.xlsx") returned 6 [0062.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.ppt") returned 0 [0062.756] lstrlenA (lpString="*.ppt") returned 5 [0062.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.pptx") returned 0 [0062.756] lstrlenA (lpString="*.pptx") returned 6 [0062.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.pdf") returned 0 [0062.756] lstrlenA (lpString="*.pdf") returned 5 [0062.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.mov") returned 0 [0062.756] lstrlenA (lpString="*.mov") returned 5 [0062.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.m2v") returned 0 [0062.756] lstrlenA (lpString="*.m2v") returned 5 [0062.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.3gp") returned 0 [0062.756] lstrlenA (lpString="*.3gp") returned 5 [0062.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.mpeg") returned 0 [0062.756] lstrlenA (lpString="*.mpeg") returned 6 [0062.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.mpg") returned 0 [0062.756] lstrlenA (lpString="*.mpg") returned 5 [0062.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.flv") returned 0 [0062.756] lstrlenA (lpString="*.flv") returned 5 [0062.756] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.avi") returned 0 [0062.757] lstrlenA (lpString="*.avi") returned 5 [0062.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.mp4") returned 0 [0062.757] lstrlenA (lpString="*.mp4") returned 5 [0062.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.wmv") returned 0 [0062.757] lstrlenA (lpString="*.wmv") returned 5 [0062.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.divx") returned 0 [0062.757] lstrlenA (lpString="*.divx") returned 6 [0062.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.mkv") returned 0 [0062.757] lstrlenA (lpString="*.mkv") returned 5 [0062.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.mp3") returned 0 [0062.757] lstrlenA (lpString="*.mp3") returned 5 [0062.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.wav") returned 0 [0062.757] lstrlenA (lpString="*.wav") returned 5 [0062.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.flac") returned 0 [0062.757] lstrlenA (lpString="*.flac") returned 6 [0062.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.ape") returned 0 [0062.757] lstrlenA (lpString="*.ape") returned 5 [0062.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.wma") returned 0 [0062.757] lstrlenA (lpString="*.wma") returned 5 [0062.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.ac3") returned 0 [0062.757] lstrlenA (lpString="*.ac3") returned 5 [0062.757] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.mxf") returned 0 [0062.758] lstrlenA (lpString="*.mxf") returned 5 [0062.758] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x375, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="VelvetRose.css", cAlternateFileName="VELVET~1.CSS")) returned 1 [0062.758] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0062.758] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VelvetRose.css") returned -1 [0062.758] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VelvetRose.css") returned -1 [0062.758] lstrcmpiA (lpString1="", lpString2="VelvetRose.css") returned -1 [0062.758] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css") returned="TexturedBlue.css" [0062.758] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" [0062.758] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned="" [0062.758] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0062.758] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0062.758] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="VelvetRose.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css" [0062.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.zip") returned 0 [0062.758] lstrlenA (lpString="*.zip") returned 5 [0062.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.rar") returned 0 [0062.758] lstrlenA (lpString="*.rar") returned 5 [0062.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.7z") returned 0 [0062.758] lstrlenA (lpString="*.7z") returned 4 [0062.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.tar") returned 0 [0062.758] lstrlenA (lpString="*.tar") returned 5 [0062.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.gzip") returned 0 [0062.758] lstrlenA (lpString="*.gzip") returned 6 [0062.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.jpg") returned 0 [0062.758] lstrlenA (lpString="*.jpg") returned 5 [0062.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.jpeg") returned 0 [0062.758] lstrlenA (lpString="*.jpeg") returned 6 [0062.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.psd") returned 0 [0062.758] lstrlenA (lpString="*.psd") returned 5 [0062.758] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.gif") returned 0 [0062.758] lstrlenA (lpString="*.gif") returned 5 [0062.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.doc") returned 0 [0062.759] lstrlenA (lpString="*.doc") returned 5 [0062.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.docx") returned 0 [0062.759] lstrlenA (lpString="*.docx") returned 6 [0062.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.xls") returned 0 [0062.759] lstrlenA (lpString="*.xls") returned 5 [0062.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.xlsx") returned 0 [0062.759] lstrlenA (lpString="*.xlsx") returned 6 [0062.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.ppt") returned 0 [0062.759] lstrlenA (lpString="*.ppt") returned 5 [0062.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.pptx") returned 0 [0062.759] lstrlenA (lpString="*.pptx") returned 6 [0062.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.pdf") returned 0 [0062.759] lstrlenA (lpString="*.pdf") returned 5 [0062.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.mov") returned 0 [0062.759] lstrlenA (lpString="*.mov") returned 5 [0062.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.m2v") returned 0 [0062.759] lstrlenA (lpString="*.m2v") returned 5 [0062.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.3gp") returned 0 [0062.759] lstrlenA (lpString="*.3gp") returned 5 [0062.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.mpeg") returned 0 [0062.759] lstrlenA (lpString="*.mpeg") returned 6 [0062.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.mpg") returned 0 [0062.759] lstrlenA (lpString="*.mpg") returned 5 [0062.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.flv") returned 0 [0062.759] lstrlenA (lpString="*.flv") returned 5 [0062.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.avi") returned 0 [0062.759] lstrlenA (lpString="*.avi") returned 5 [0062.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.mp4") returned 0 [0062.759] lstrlenA (lpString="*.mp4") returned 5 [0062.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.wmv") returned 0 [0062.759] lstrlenA (lpString="*.wmv") returned 5 [0062.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.divx") returned 0 [0062.760] lstrlenA (lpString="*.divx") returned 6 [0062.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.mkv") returned 0 [0062.760] lstrlenA (lpString="*.mkv") returned 5 [0062.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.mp3") returned 0 [0062.760] lstrlenA (lpString="*.mp3") returned 5 [0062.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.wav") returned 0 [0062.760] lstrlenA (lpString="*.wav") returned 5 [0062.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.flac") returned 0 [0062.760] lstrlenA (lpString="*.flac") returned 6 [0062.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.ape") returned 0 [0062.760] lstrlenA (lpString="*.ape") returned 5 [0062.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.wma") returned 0 [0062.760] lstrlenA (lpString="*.wma") returned 5 [0062.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.ac3") returned 0 [0062.760] lstrlenA (lpString="*.ac3") returned 5 [0062.760] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.mxf") returned 0 [0062.760] lstrlenA (lpString="*.mxf") returned 5 [0062.760] FindNextFileA (in: hFindFile=0x2d80f0, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x375, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="VelvetRose.css", cAlternateFileName="VELVET~1.CSS")) returned 0 [0062.760] FindClose (in: hFindFile=0x2d80f0 | out: hFindFile=0x2d80f0) returned 1 [0062.760] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x8f6, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="FormsVersion1Warning.htm", cAlternateFileName="FORMSV~1.HTM")) returned 1 [0062.760] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.760] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsVersion1Warning.htm") returned -1 [0062.760] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsVersion1Warning.htm") returned 1 [0062.760] lstrcmpiA (lpString1="", lpString2="FormsVersion1Warning.htm") returned -1 [0062.760] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*.*") returned="*.*" [0062.760] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.760] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.760] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.761] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.761] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsVersion1Warning.htm" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm" [0062.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.zip") returned 0 [0062.761] lstrlenA (lpString="*.zip") returned 5 [0062.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.rar") returned 0 [0062.761] lstrlenA (lpString="*.rar") returned 5 [0062.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.7z") returned 0 [0062.761] lstrlenA (lpString="*.7z") returned 4 [0062.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.tar") returned 0 [0062.761] lstrlenA (lpString="*.tar") returned 5 [0062.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.gzip") returned 0 [0062.761] lstrlenA (lpString="*.gzip") returned 6 [0062.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.jpg") returned 0 [0062.761] lstrlenA (lpString="*.jpg") returned 5 [0062.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.jpeg") returned 0 [0062.761] lstrlenA (lpString="*.jpeg") returned 6 [0062.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.psd") returned 0 [0062.761] lstrlenA (lpString="*.psd") returned 5 [0062.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.gif") returned 0 [0062.761] lstrlenA (lpString="*.gif") returned 5 [0062.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.doc") returned 0 [0062.761] lstrlenA (lpString="*.doc") returned 5 [0062.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.docx") returned 0 [0062.761] lstrlenA (lpString="*.docx") returned 6 [0062.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.xls") returned 0 [0062.761] lstrlenA (lpString="*.xls") returned 5 [0062.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.xlsx") returned 0 [0062.761] lstrlenA (lpString="*.xlsx") returned 6 [0062.761] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.ppt") returned 0 [0062.762] lstrlenA (lpString="*.ppt") returned 5 [0062.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.pptx") returned 0 [0062.762] lstrlenA (lpString="*.pptx") returned 6 [0062.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.pdf") returned 0 [0062.762] lstrlenA (lpString="*.pdf") returned 5 [0062.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.mov") returned 0 [0062.762] lstrlenA (lpString="*.mov") returned 5 [0062.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.m2v") returned 0 [0062.762] lstrlenA (lpString="*.m2v") returned 5 [0062.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.3gp") returned 0 [0062.762] lstrlenA (lpString="*.3gp") returned 5 [0062.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.mpeg") returned 0 [0062.762] lstrlenA (lpString="*.mpeg") returned 6 [0062.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.mpg") returned 0 [0062.762] lstrlenA (lpString="*.mpg") returned 5 [0062.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.flv") returned 0 [0062.762] lstrlenA (lpString="*.flv") returned 5 [0062.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.avi") returned 0 [0062.762] lstrlenA (lpString="*.avi") returned 5 [0062.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.mp4") returned 0 [0062.762] lstrlenA (lpString="*.mp4") returned 5 [0062.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.wmv") returned 0 [0062.762] lstrlenA (lpString="*.wmv") returned 5 [0062.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.divx") returned 0 [0062.762] lstrlenA (lpString="*.divx") returned 6 [0062.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.mkv") returned 0 [0062.762] lstrlenA (lpString="*.mkv") returned 5 [0062.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.mp3") returned 0 [0062.762] lstrlenA (lpString="*.mp3") returned 5 [0062.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.wav") returned 0 [0062.762] lstrlenA (lpString="*.wav") returned 5 [0062.762] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.flac") returned 0 [0062.763] lstrlenA (lpString="*.flac") returned 6 [0062.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.ape") returned 0 [0062.763] lstrlenA (lpString="*.ape") returned 5 [0062.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.wma") returned 0 [0062.763] lstrlenA (lpString="*.wma") returned 5 [0062.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.ac3") returned 0 [0062.763] lstrlenA (lpString="*.ac3") returned 5 [0062.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.mxf") returned 0 [0062.763] lstrlenA (lpString="*.mxf") returned 5 [0062.763] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2ee3, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsViewAttachmentIcons.jpg", cAlternateFileName="FORMSV~1.JPG")) returned 1 [0062.763] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.763] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsViewAttachmentIcons.jpg") returned -1 [0062.763] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewAttachmentIcons.jpg") returned 1 [0062.763] lstrcmpiA (lpString1="", lpString2="FormsViewAttachmentIcons.jpg") returned -1 [0062.763] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm") returned="FormsVersion1Warning.htm" [0062.763] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.763] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.763] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.763] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.763] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" [0062.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", pszSpec="*.zip") returned 0 [0062.763] lstrlenA (lpString="*.zip") returned 5 [0062.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", pszSpec="*.rar") returned 0 [0062.763] lstrlenA (lpString="*.rar") returned 5 [0062.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", pszSpec="*.7z") returned 0 [0062.763] lstrlenA (lpString="*.7z") returned 4 [0062.763] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", pszSpec="*.tar") returned 0 [0062.763] lstrlenA (lpString="*.tar") returned 5 [0062.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", pszSpec="*.gzip") returned 0 [0062.764] lstrlenA (lpString="*.gzip") returned 6 [0062.764] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", pszSpec="*.jpg") returned 1 [0062.764] lstrlenA (lpString="*.jpg") returned 5 [0062.764] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" [0062.764] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" [0062.764] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg." [0062.764] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg.wannacry" [0062.764] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.765] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ee3 [0062.765] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea)) returned 1 [0062.766] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.766] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2e65, lpOverlapped=0x0) returned 1 [0062.767] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg") returned="FormsViewAttachmentIcons.jpg" [0062.767] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.768] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2e65, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2e65, lpOverlapped=0x0) returned 1 [0062.768] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.768] CloseHandle (hObject=0x98) returned 1 [0062.768] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg.wannacry")) returned 1 [0062.769] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="FormsViewAttachmentIconsMask.bmp", cAlternateFileName="FORMSV~1.BMP")) returned 1 [0062.769] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.769] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsViewAttachmentIconsMask.bmp") returned -1 [0062.769] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewAttachmentIconsMask.bmp") returned 1 [0062.769] lstrcmpiA (lpString1="", lpString2="FormsViewAttachmentIconsMask.bmp") returned -1 [0062.769] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg") returned="FormsViewAttachmentIcons.jpg" [0062.769] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.769] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.769] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.769] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.769] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp" [0062.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.zip") returned 0 [0062.770] lstrlenA (lpString="*.zip") returned 5 [0062.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.rar") returned 0 [0062.770] lstrlenA (lpString="*.rar") returned 5 [0062.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.7z") returned 0 [0062.770] lstrlenA (lpString="*.7z") returned 4 [0062.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.tar") returned 0 [0062.770] lstrlenA (lpString="*.tar") returned 5 [0062.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.gzip") returned 0 [0062.770] lstrlenA (lpString="*.gzip") returned 6 [0062.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.jpg") returned 0 [0062.770] lstrlenA (lpString="*.jpg") returned 5 [0062.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.jpeg") returned 0 [0062.770] lstrlenA (lpString="*.jpeg") returned 6 [0062.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.psd") returned 0 [0062.770] lstrlenA (lpString="*.psd") returned 5 [0062.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.gif") returned 0 [0062.770] lstrlenA (lpString="*.gif") returned 5 [0062.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.doc") returned 0 [0062.770] lstrlenA (lpString="*.doc") returned 5 [0062.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.docx") returned 0 [0062.770] lstrlenA (lpString="*.docx") returned 6 [0062.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.xls") returned 0 [0062.770] lstrlenA (lpString="*.xls") returned 5 [0062.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.xlsx") returned 0 [0062.770] lstrlenA (lpString="*.xlsx") returned 6 [0062.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.ppt") returned 0 [0062.770] lstrlenA (lpString="*.ppt") returned 5 [0062.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.pptx") returned 0 [0062.770] lstrlenA (lpString="*.pptx") returned 6 [0062.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.pdf") returned 0 [0062.770] lstrlenA (lpString="*.pdf") returned 5 [0062.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mov") returned 0 [0062.770] lstrlenA (lpString="*.mov") returned 5 [0062.770] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.m2v") returned 0 [0062.771] lstrlenA (lpString="*.m2v") returned 5 [0062.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.3gp") returned 0 [0062.771] lstrlenA (lpString="*.3gp") returned 5 [0062.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mpeg") returned 0 [0062.771] lstrlenA (lpString="*.mpeg") returned 6 [0062.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mpg") returned 0 [0062.771] lstrlenA (lpString="*.mpg") returned 5 [0062.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.flv") returned 0 [0062.771] lstrlenA (lpString="*.flv") returned 5 [0062.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.avi") returned 0 [0062.771] lstrlenA (lpString="*.avi") returned 5 [0062.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mp4") returned 0 [0062.771] lstrlenA (lpString="*.mp4") returned 5 [0062.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.wmv") returned 0 [0062.771] lstrlenA (lpString="*.wmv") returned 5 [0062.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.divx") returned 0 [0062.771] lstrlenA (lpString="*.divx") returned 6 [0062.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mkv") returned 0 [0062.771] lstrlenA (lpString="*.mkv") returned 5 [0062.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mp3") returned 0 [0062.771] lstrlenA (lpString="*.mp3") returned 5 [0062.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.wav") returned 0 [0062.771] lstrlenA (lpString="*.wav") returned 5 [0062.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.flac") returned 0 [0062.771] lstrlenA (lpString="*.flac") returned 6 [0062.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.ape") returned 0 [0062.771] lstrlenA (lpString="*.ape") returned 5 [0062.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.wma") returned 0 [0062.771] lstrlenA (lpString="*.wma") returned 5 [0062.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.ac3") returned 0 [0062.771] lstrlenA (lpString="*.ac3") returned 5 [0062.771] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mxf") returned 0 [0062.771] lstrlenA (lpString="*.mxf") returned 5 [0062.771] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1313, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsViewFrame.html", cAlternateFileName="FORMSV~2.HTM")) returned 1 [0062.771] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.772] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsViewFrame.html") returned -1 [0062.772] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewFrame.html") returned 1 [0062.772] lstrcmpiA (lpString1="", lpString2="FormsViewFrame.html") returned -1 [0062.772] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp") returned="FormsViewAttachmentIconsMask.bmp" [0062.772] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.772] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.772] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.772] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.772] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsViewFrame.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html" [0062.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.zip") returned 0 [0062.772] lstrlenA (lpString="*.zip") returned 5 [0062.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.rar") returned 0 [0062.772] lstrlenA (lpString="*.rar") returned 5 [0062.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.7z") returned 0 [0062.772] lstrlenA (lpString="*.7z") returned 4 [0062.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.tar") returned 0 [0062.772] lstrlenA (lpString="*.tar") returned 5 [0062.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.gzip") returned 0 [0062.772] lstrlenA (lpString="*.gzip") returned 6 [0062.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.jpg") returned 0 [0062.772] lstrlenA (lpString="*.jpg") returned 5 [0062.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.jpeg") returned 0 [0062.772] lstrlenA (lpString="*.jpeg") returned 6 [0062.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.psd") returned 0 [0062.772] lstrlenA (lpString="*.psd") returned 5 [0062.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.gif") returned 0 [0062.772] lstrlenA (lpString="*.gif") returned 5 [0062.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.doc") returned 0 [0062.772] lstrlenA (lpString="*.doc") returned 5 [0062.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.docx") returned 0 [0062.772] lstrlenA (lpString="*.docx") returned 6 [0062.772] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.xls") returned 0 [0062.772] lstrlenA (lpString="*.xls") returned 5 [0062.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.xlsx") returned 0 [0062.773] lstrlenA (lpString="*.xlsx") returned 6 [0062.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.ppt") returned 0 [0062.773] lstrlenA (lpString="*.ppt") returned 5 [0062.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.pptx") returned 0 [0062.773] lstrlenA (lpString="*.pptx") returned 6 [0062.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.pdf") returned 0 [0062.773] lstrlenA (lpString="*.pdf") returned 5 [0062.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.mov") returned 0 [0062.773] lstrlenA (lpString="*.mov") returned 5 [0062.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.m2v") returned 0 [0062.773] lstrlenA (lpString="*.m2v") returned 5 [0062.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.3gp") returned 0 [0062.773] lstrlenA (lpString="*.3gp") returned 5 [0062.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.mpeg") returned 0 [0062.773] lstrlenA (lpString="*.mpeg") returned 6 [0062.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.mpg") returned 0 [0062.773] lstrlenA (lpString="*.mpg") returned 5 [0062.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.flv") returned 0 [0062.773] lstrlenA (lpString="*.flv") returned 5 [0062.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.avi") returned 0 [0062.773] lstrlenA (lpString="*.avi") returned 5 [0062.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.mp4") returned 0 [0062.773] lstrlenA (lpString="*.mp4") returned 5 [0062.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.wmv") returned 0 [0062.773] lstrlenA (lpString="*.wmv") returned 5 [0062.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.divx") returned 0 [0062.773] lstrlenA (lpString="*.divx") returned 6 [0062.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.mkv") returned 0 [0062.773] lstrlenA (lpString="*.mkv") returned 5 [0062.773] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.mp3") returned 0 [0062.773] lstrlenA (lpString="*.mp3") returned 5 [0062.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.wav") returned 0 [0062.774] lstrlenA (lpString="*.wav") returned 5 [0062.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.flac") returned 0 [0062.774] lstrlenA (lpString="*.flac") returned 6 [0062.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.ape") returned 0 [0062.774] lstrlenA (lpString="*.ape") returned 5 [0062.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.wma") returned 0 [0062.774] lstrlenA (lpString="*.wma") returned 5 [0062.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.ac3") returned 0 [0062.774] lstrlenA (lpString="*.ac3") returned 5 [0062.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.mxf") returned 0 [0062.774] lstrlenA (lpString="*.mxf") returned 5 [0062.774] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa89, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsViewTemplate.html", cAlternateFileName="FORMSV~3.HTM")) returned 1 [0062.774] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.774] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsViewTemplate.html") returned -1 [0062.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewTemplate.html") returned 1 [0062.774] lstrcmpiA (lpString1="", lpString2="FormsViewTemplate.html") returned -1 [0062.774] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html") returned="FormsViewFrame.html" [0062.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.774] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.774] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.774] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.774] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsViewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html" [0062.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.zip") returned 0 [0062.774] lstrlenA (lpString="*.zip") returned 5 [0062.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.rar") returned 0 [0062.774] lstrlenA (lpString="*.rar") returned 5 [0062.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.7z") returned 0 [0062.775] lstrlenA (lpString="*.7z") returned 4 [0062.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.tar") returned 0 [0062.775] lstrlenA (lpString="*.tar") returned 5 [0062.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.gzip") returned 0 [0062.775] lstrlenA (lpString="*.gzip") returned 6 [0062.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.jpg") returned 0 [0062.775] lstrlenA (lpString="*.jpg") returned 5 [0062.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.jpeg") returned 0 [0062.775] lstrlenA (lpString="*.jpeg") returned 6 [0062.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.psd") returned 0 [0062.775] lstrlenA (lpString="*.psd") returned 5 [0062.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.gif") returned 0 [0062.775] lstrlenA (lpString="*.gif") returned 5 [0062.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.doc") returned 0 [0062.775] lstrlenA (lpString="*.doc") returned 5 [0062.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.docx") returned 0 [0062.775] lstrlenA (lpString="*.docx") returned 6 [0062.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.xls") returned 0 [0062.775] lstrlenA (lpString="*.xls") returned 5 [0062.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.xlsx") returned 0 [0062.775] lstrlenA (lpString="*.xlsx") returned 6 [0062.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.ppt") returned 0 [0062.775] lstrlenA (lpString="*.ppt") returned 5 [0062.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.pptx") returned 0 [0062.775] lstrlenA (lpString="*.pptx") returned 6 [0062.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.pdf") returned 0 [0062.775] lstrlenA (lpString="*.pdf") returned 5 [0062.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.mov") returned 0 [0062.775] lstrlenA (lpString="*.mov") returned 5 [0062.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.m2v") returned 0 [0062.776] lstrlenA (lpString="*.m2v") returned 5 [0062.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.3gp") returned 0 [0062.776] lstrlenA (lpString="*.3gp") returned 5 [0062.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.mpeg") returned 0 [0062.776] lstrlenA (lpString="*.mpeg") returned 6 [0062.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.mpg") returned 0 [0062.776] lstrlenA (lpString="*.mpg") returned 5 [0062.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.flv") returned 0 [0062.776] lstrlenA (lpString="*.flv") returned 5 [0062.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.avi") returned 0 [0062.776] lstrlenA (lpString="*.avi") returned 5 [0062.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.mp4") returned 0 [0062.776] lstrlenA (lpString="*.mp4") returned 5 [0062.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.wmv") returned 0 [0062.776] lstrlenA (lpString="*.wmv") returned 5 [0062.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.divx") returned 0 [0062.776] lstrlenA (lpString="*.divx") returned 6 [0062.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.mkv") returned 0 [0062.776] lstrlenA (lpString="*.mkv") returned 5 [0062.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.mp3") returned 0 [0062.776] lstrlenA (lpString="*.mp3") returned 5 [0062.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.wav") returned 0 [0062.776] lstrlenA (lpString="*.wav") returned 5 [0062.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.flac") returned 0 [0062.776] lstrlenA (lpString="*.flac") returned 6 [0062.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.ape") returned 0 [0062.776] lstrlenA (lpString="*.ape") returned 5 [0062.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.wma") returned 0 [0062.776] lstrlenA (lpString="*.wma") returned 5 [0062.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.ac3") returned 0 [0062.777] lstrlenA (lpString="*.ac3") returned 5 [0062.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.mxf") returned 0 [0062.777] lstrlenA (lpString="*.mxf") returned 5 [0062.777] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x529b4870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1bfb, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormToolImages.jpg", cAlternateFileName="FORMTO~1.JPG")) returned 1 [0062.777] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.777] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormToolImages.jpg") returned -1 [0062.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormToolImages.jpg") returned 1 [0062.777] lstrcmpiA (lpString1="", lpString2="FormToolImages.jpg") returned -1 [0062.777] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html") returned="FormsViewTemplate.html" [0062.777] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.777] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.777] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.777] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.777] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" [0062.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", pszSpec="*.zip") returned 0 [0062.777] lstrlenA (lpString="*.zip") returned 5 [0062.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", pszSpec="*.rar") returned 0 [0062.777] lstrlenA (lpString="*.rar") returned 5 [0062.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", pszSpec="*.7z") returned 0 [0062.777] lstrlenA (lpString="*.7z") returned 4 [0062.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", pszSpec="*.tar") returned 0 [0062.777] lstrlenA (lpString="*.tar") returned 5 [0062.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", pszSpec="*.gzip") returned 0 [0062.777] lstrlenA (lpString="*.gzip") returned 6 [0062.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", pszSpec="*.jpg") returned 1 [0062.777] lstrlenA (lpString="*.jpg") returned 5 [0062.777] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" [0062.777] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" [0062.777] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg." [0062.777] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg.wannacry" [0062.778] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.778] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1bfb [0062.778] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x529b4870, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea)) returned 1 [0062.778] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.778] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1b7d, lpOverlapped=0x0) returned 1 [0062.780] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg") returned="FormToolImages.jpg" [0062.780] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.780] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1b7d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1b7d, lpOverlapped=0x0) returned 1 [0062.780] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.780] CloseHandle (hObject=0x98) returned 1 [0062.780] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg.wannacry")) returned 1 [0062.781] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x23ed, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="form_edit.js", cAlternateFileName="FORM_E~1.JS")) returned 1 [0062.781] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.781] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="form_edit.js") returned -1 [0062.782] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="form_edit.js") returned 1 [0062.782] lstrcmpiA (lpString1="", lpString2="form_edit.js") returned -1 [0062.782] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg") returned="FormToolImages.jpg" [0062.782] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.782] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.782] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="form_edit.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js" [0062.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.zip") returned 0 [0062.782] lstrlenA (lpString="*.zip") returned 5 [0062.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.rar") returned 0 [0062.782] lstrlenA (lpString="*.rar") returned 5 [0062.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.7z") returned 0 [0062.782] lstrlenA (lpString="*.7z") returned 4 [0062.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.tar") returned 0 [0062.782] lstrlenA (lpString="*.tar") returned 5 [0062.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.gzip") returned 0 [0062.782] lstrlenA (lpString="*.gzip") returned 6 [0062.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.jpg") returned 0 [0062.782] lstrlenA (lpString="*.jpg") returned 5 [0062.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.jpeg") returned 0 [0062.782] lstrlenA (lpString="*.jpeg") returned 6 [0062.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.psd") returned 0 [0062.782] lstrlenA (lpString="*.psd") returned 5 [0062.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.gif") returned 0 [0062.782] lstrlenA (lpString="*.gif") returned 5 [0062.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.doc") returned 0 [0062.782] lstrlenA (lpString="*.doc") returned 5 [0062.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.docx") returned 0 [0062.782] lstrlenA (lpString="*.docx") returned 6 [0062.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.xls") returned 0 [0062.783] lstrlenA (lpString="*.xls") returned 5 [0062.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.xlsx") returned 0 [0062.783] lstrlenA (lpString="*.xlsx") returned 6 [0062.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.ppt") returned 0 [0062.783] lstrlenA (lpString="*.ppt") returned 5 [0062.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.pptx") returned 0 [0062.783] lstrlenA (lpString="*.pptx") returned 6 [0062.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.pdf") returned 0 [0062.783] lstrlenA (lpString="*.pdf") returned 5 [0062.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.mov") returned 0 [0062.783] lstrlenA (lpString="*.mov") returned 5 [0062.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.m2v") returned 0 [0062.783] lstrlenA (lpString="*.m2v") returned 5 [0062.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.3gp") returned 0 [0062.783] lstrlenA (lpString="*.3gp") returned 5 [0062.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.mpeg") returned 0 [0062.783] lstrlenA (lpString="*.mpeg") returned 6 [0062.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.mpg") returned 0 [0062.783] lstrlenA (lpString="*.mpg") returned 5 [0062.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.flv") returned 0 [0062.783] lstrlenA (lpString="*.flv") returned 5 [0062.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.avi") returned 0 [0062.783] lstrlenA (lpString="*.avi") returned 5 [0062.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.mp4") returned 0 [0062.783] lstrlenA (lpString="*.mp4") returned 5 [0062.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.wmv") returned 0 [0062.783] lstrlenA (lpString="*.wmv") returned 5 [0062.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.divx") returned 0 [0062.783] lstrlenA (lpString="*.divx") returned 6 [0062.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.mkv") returned 0 [0062.783] lstrlenA (lpString="*.mkv") returned 5 [0062.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.mp3") returned 0 [0062.783] lstrlenA (lpString="*.mp3") returned 5 [0062.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.wav") returned 0 [0062.784] lstrlenA (lpString="*.wav") returned 5 [0062.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.flac") returned 0 [0062.784] lstrlenA (lpString="*.flac") returned 6 [0062.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.ape") returned 0 [0062.784] lstrlenA (lpString="*.ape") returned 5 [0062.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.wma") returned 0 [0062.784] lstrlenA (lpString="*.wma") returned 5 [0062.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.ac3") returned 0 [0062.784] lstrlenA (lpString="*.ac3") returned 5 [0062.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.mxf") returned 0 [0062.784] lstrlenA (lpString="*.mxf") returned 5 [0062.784] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x360, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0062.784] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.784] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0062.784] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0062.784] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x18f3cc, dwReserved1=0x4f0048, cFileName="LAUNCH.GIF", cAlternateFileName="")) returned 1 [0062.784] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.784] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LAUNCH.GIF") returned -1 [0062.784] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LAUNCH.GIF") returned -1 [0062.784] lstrcmpiA (lpString1="", lpString2="LAUNCH.GIF") returned -1 [0062.784] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js") returned="form_edit.js" [0062.784] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.784] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.784] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="LAUNCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF" [0062.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.zip") returned 0 [0062.784] lstrlenA (lpString="*.zip") returned 5 [0062.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.rar") returned 0 [0062.784] lstrlenA (lpString="*.rar") returned 5 [0062.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.7z") returned 0 [0062.785] lstrlenA (lpString="*.7z") returned 4 [0062.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.tar") returned 0 [0062.785] lstrlenA (lpString="*.tar") returned 5 [0062.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.gzip") returned 0 [0062.785] lstrlenA (lpString="*.gzip") returned 6 [0062.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.jpg") returned 0 [0062.785] lstrlenA (lpString="*.jpg") returned 5 [0062.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.jpeg") returned 0 [0062.785] lstrlenA (lpString="*.jpeg") returned 6 [0062.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.psd") returned 0 [0062.785] lstrlenA (lpString="*.psd") returned 5 [0062.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.gif") returned 1 [0062.785] lstrlenA (lpString="*.gif") returned 5 [0062.785] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF" [0062.785] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF" [0062.785] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF." [0062.785] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF.wannacry" [0062.785] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\launch.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.786] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x267 [0062.787] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x66247150, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea)) returned 1 [0062.787] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.787] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1e9, lpOverlapped=0x0) returned 1 [0062.788] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF") returned="LAUNCH.GIF" [0062.788] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.788] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1e9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1e9, lpOverlapped=0x0) returned 1 [0062.788] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.788] CloseHandle (hObject=0x98) returned 1 [0062.788] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\launch.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\launch.gif.wannacry")) returned 1 [0062.790] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x418f4a00, ftCreationTime.dwHighDateTime=0x1c9fe9d, ftLastAccessTime.dwLowDateTime=0x58285d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x418f4a00, ftLastWriteTime.dwHighDateTime=0x1c9fe9d, nFileSizeHigh=0x0, nFileSizeLow=0x30074, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="macroprogress.gif", cAlternateFileName="MACROP~1.GIF")) returned 1 [0062.790] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.790] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="macroprogress.gif") returned -1 [0062.790] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="macroprogress.gif") returned -1 [0062.790] lstrcmpiA (lpString1="", lpString2="macroprogress.gif") returned -1 [0062.790] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF") returned="LAUNCH.GIF" [0062.791] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.791] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.791] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.791] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.791] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="macroprogress.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" [0062.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.zip") returned 0 [0062.791] lstrlenA (lpString="*.zip") returned 5 [0062.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.rar") returned 0 [0062.791] lstrlenA (lpString="*.rar") returned 5 [0062.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.7z") returned 0 [0062.791] lstrlenA (lpString="*.7z") returned 4 [0062.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.tar") returned 0 [0062.791] lstrlenA (lpString="*.tar") returned 5 [0062.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.gzip") returned 0 [0062.791] lstrlenA (lpString="*.gzip") returned 6 [0062.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.jpg") returned 0 [0062.791] lstrlenA (lpString="*.jpg") returned 5 [0062.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.jpeg") returned 0 [0062.791] lstrlenA (lpString="*.jpeg") returned 6 [0062.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.psd") returned 0 [0062.791] lstrlenA (lpString="*.psd") returned 5 [0062.791] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.gif") returned 1 [0062.791] lstrlenA (lpString="*.gif") returned 5 [0062.791] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" [0062.791] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" [0062.791] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif." [0062.791] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif.wannacry" [0062.792] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.793] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x30074 [0062.793] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x418f4a00, dwHighDateTime=0x1c9fe9d), lpLastAccessTime=0x407536*(dwLowDateTime=0x58285d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x418f4a00, dwHighDateTime=0x1c9fe9d)) returned 1 [0062.793] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.793] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2fff6, lpOverlapped=0x0) returned 1 [0062.796] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif") returned="macroprogress.gif" [0062.796] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.796] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2fff6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2fff6, lpOverlapped=0x0) returned 1 [0062.797] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.797] CloseHandle (hObject=0x98) returned 1 [0062.797] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif.wannacry")) returned 1 [0062.798] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d0aad90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1018, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="PublicFunctions.js", cAlternateFileName="PUBLIC~1.JS")) returned 1 [0062.799] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.799] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PublicFunctions.js") returned -1 [0062.799] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PublicFunctions.js") returned -1 [0062.799] lstrcmpiA (lpString1="", lpString2="PublicFunctions.js") returned -1 [0062.799] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif") returned="macroprogress.gif" [0062.799] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.799] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.799] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.799] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.799] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="PublicFunctions.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js" [0062.799] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.zip") returned 0 [0062.799] lstrlenA (lpString="*.zip") returned 5 [0062.799] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.rar") returned 0 [0062.799] lstrlenA (lpString="*.rar") returned 5 [0062.799] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.7z") returned 0 [0062.799] lstrlenA (lpString="*.7z") returned 4 [0062.799] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.tar") returned 0 [0062.799] lstrlenA (lpString="*.tar") returned 5 [0062.799] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.gzip") returned 0 [0062.799] lstrlenA (lpString="*.gzip") returned 6 [0062.799] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.jpg") returned 0 [0062.799] lstrlenA (lpString="*.jpg") returned 5 [0062.799] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.jpeg") returned 0 [0062.799] lstrlenA (lpString="*.jpeg") returned 6 [0062.799] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.psd") returned 0 [0062.799] lstrlenA (lpString="*.psd") returned 5 [0062.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.gif") returned 0 [0062.800] lstrlenA (lpString="*.gif") returned 5 [0062.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.doc") returned 0 [0062.800] lstrlenA (lpString="*.doc") returned 5 [0062.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.docx") returned 0 [0062.800] lstrlenA (lpString="*.docx") returned 6 [0062.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.xls") returned 0 [0062.800] lstrlenA (lpString="*.xls") returned 5 [0062.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.xlsx") returned 0 [0062.800] lstrlenA (lpString="*.xlsx") returned 6 [0062.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.ppt") returned 0 [0062.800] lstrlenA (lpString="*.ppt") returned 5 [0062.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.pptx") returned 0 [0062.800] lstrlenA (lpString="*.pptx") returned 6 [0062.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.pdf") returned 0 [0062.800] lstrlenA (lpString="*.pdf") returned 5 [0062.800] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.mov") returned 0 [0062.801] lstrlenA (lpString="*.mov") returned 5 [0062.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.m2v") returned 0 [0062.801] lstrlenA (lpString="*.m2v") returned 5 [0062.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.3gp") returned 0 [0062.801] lstrlenA (lpString="*.3gp") returned 5 [0062.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.mpeg") returned 0 [0062.801] lstrlenA (lpString="*.mpeg") returned 6 [0062.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.mpg") returned 0 [0062.801] lstrlenA (lpString="*.mpg") returned 5 [0062.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.flv") returned 0 [0062.801] lstrlenA (lpString="*.flv") returned 5 [0062.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.avi") returned 0 [0062.801] lstrlenA (lpString="*.avi") returned 5 [0062.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.mp4") returned 0 [0062.801] lstrlenA (lpString="*.mp4") returned 5 [0062.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.wmv") returned 0 [0062.801] lstrlenA (lpString="*.wmv") returned 5 [0062.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.divx") returned 0 [0062.801] lstrlenA (lpString="*.divx") returned 6 [0062.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.mkv") returned 0 [0062.801] lstrlenA (lpString="*.mkv") returned 5 [0062.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.mp3") returned 0 [0062.801] lstrlenA (lpString="*.mp3") returned 5 [0062.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.wav") returned 0 [0062.801] lstrlenA (lpString="*.wav") returned 5 [0062.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.flac") returned 0 [0062.801] lstrlenA (lpString="*.flac") returned 6 [0062.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.ape") returned 0 [0062.801] lstrlenA (lpString="*.ape") returned 5 [0062.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.wma") returned 0 [0062.801] lstrlenA (lpString="*.wma") returned 5 [0062.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.ac3") returned 0 [0062.801] lstrlenA (lpString="*.ac3") returned 5 [0062.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.mxf") returned 0 [0062.802] lstrlenA (lpString="*.mxf") returned 5 [0062.802] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="rtf_alignleft.gif", cAlternateFileName="RTF_AL~1.GIF")) returned 1 [0062.802] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.802] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_alignleft.gif") returned -1 [0062.802] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_alignleft.gif") returned -1 [0062.802] lstrcmpiA (lpString1="", lpString2="rtf_alignleft.gif") returned -1 [0062.802] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js") returned="PublicFunctions.js" [0062.802] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.802] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.802] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.802] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.802] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_alignleft.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" [0062.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.zip") returned 0 [0062.802] lstrlenA (lpString="*.zip") returned 5 [0062.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.rar") returned 0 [0062.802] lstrlenA (lpString="*.rar") returned 5 [0062.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.7z") returned 0 [0062.802] lstrlenA (lpString="*.7z") returned 4 [0062.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.tar") returned 0 [0062.802] lstrlenA (lpString="*.tar") returned 5 [0062.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.gzip") returned 0 [0062.802] lstrlenA (lpString="*.gzip") returned 6 [0062.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.jpg") returned 0 [0062.802] lstrlenA (lpString="*.jpg") returned 5 [0062.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.jpeg") returned 0 [0062.802] lstrlenA (lpString="*.jpeg") returned 6 [0062.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.psd") returned 0 [0062.803] lstrlenA (lpString="*.psd") returned 5 [0062.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.gif") returned 1 [0062.803] lstrlenA (lpString="*.gif") returned 5 [0062.803] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" [0062.803] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" [0062.803] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif." [0062.803] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif.wannacry" [0062.803] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.804] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x350 [0062.805] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea)) returned 1 [0062.805] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.805] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2d2, lpOverlapped=0x0) returned 1 [0062.806] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif") returned="rtf_alignleft.gif" [0062.806] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.806] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2d2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2d2, lpOverlapped=0x0) returned 1 [0062.806] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.807] CloseHandle (hObject=0x98) returned 1 [0062.807] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif.wannacry")) returned 1 [0062.808] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="rtf_alignright.gif", cAlternateFileName="RTF_AL~2.GIF")) returned 1 [0062.808] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.808] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_alignright.gif") returned -1 [0062.808] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_alignright.gif") returned -1 [0062.808] lstrcmpiA (lpString1="", lpString2="rtf_alignright.gif") returned -1 [0062.808] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif") returned="rtf_alignleft.gif" [0062.808] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.808] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.808] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.808] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.808] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_alignright.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" [0062.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.zip") returned 0 [0062.808] lstrlenA (lpString="*.zip") returned 5 [0062.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.rar") returned 0 [0062.808] lstrlenA (lpString="*.rar") returned 5 [0062.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.7z") returned 0 [0062.808] lstrlenA (lpString="*.7z") returned 4 [0062.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.tar") returned 0 [0062.808] lstrlenA (lpString="*.tar") returned 5 [0062.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.gzip") returned 0 [0062.809] lstrlenA (lpString="*.gzip") returned 6 [0062.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.jpg") returned 0 [0062.809] lstrlenA (lpString="*.jpg") returned 5 [0062.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.jpeg") returned 0 [0062.809] lstrlenA (lpString="*.jpeg") returned 6 [0062.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.psd") returned 0 [0062.809] lstrlenA (lpString="*.psd") returned 5 [0062.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.gif") returned 1 [0062.809] lstrlenA (lpString="*.gif") returned 5 [0062.809] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" [0062.809] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" [0062.809] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif." [0062.809] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif.wannacry" [0062.809] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.811] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34f [0062.812] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea)) returned 1 [0062.812] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.812] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2d1, lpOverlapped=0x0) returned 1 [0062.813] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif") returned="rtf_alignright.gif" [0062.813] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.813] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2d1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2d1, lpOverlapped=0x0) returned 1 [0062.813] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.814] CloseHandle (hObject=0x98) returned 1 [0062.814] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif.wannacry")) returned 1 [0062.815] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x366, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="RTF_BOLD.GIF", cAlternateFileName="")) returned 1 [0062.815] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.815] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RTF_BOLD.GIF") returned -1 [0062.815] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RTF_BOLD.GIF") returned -1 [0062.815] lstrcmpiA (lpString1="", lpString2="RTF_BOLD.GIF") returned -1 [0062.815] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif") returned="rtf_alignright.gif" [0062.815] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.815] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.815] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.815] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.815] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="RTF_BOLD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF" [0062.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.zip") returned 0 [0062.815] lstrlenA (lpString="*.zip") returned 5 [0062.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.rar") returned 0 [0062.815] lstrlenA (lpString="*.rar") returned 5 [0062.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.7z") returned 0 [0062.815] lstrlenA (lpString="*.7z") returned 4 [0062.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.tar") returned 0 [0062.816] lstrlenA (lpString="*.tar") returned 5 [0062.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.gzip") returned 0 [0062.816] lstrlenA (lpString="*.gzip") returned 6 [0062.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.jpg") returned 0 [0062.816] lstrlenA (lpString="*.jpg") returned 5 [0062.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.jpeg") returned 0 [0062.816] lstrlenA (lpString="*.jpeg") returned 6 [0062.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.psd") returned 0 [0062.816] lstrlenA (lpString="*.psd") returned 5 [0062.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.gif") returned 1 [0062.816] lstrlenA (lpString="*.gif") returned 5 [0062.816] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF" [0062.816] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF" [0062.816] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF." [0062.816] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF.wannacry" [0062.816] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bold.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.817] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x366 [0062.817] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea)) returned 1 [0062.817] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.817] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2e8, lpOverlapped=0x0) returned 1 [0062.818] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF") returned="RTF_BOLD.GIF" [0062.819] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.819] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2e8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2e8, lpOverlapped=0x0) returned 1 [0062.819] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.819] CloseHandle (hObject=0x98) returned 1 [0062.819] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bold.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bold.gif.wannacry")) returned 1 [0062.820] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x365, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="rtf_bullets.gif", cAlternateFileName="RTF_BU~1.GIF")) returned 1 [0062.820] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.820] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_bullets.gif") returned -1 [0062.820] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_bullets.gif") returned -1 [0062.820] lstrcmpiA (lpString1="", lpString2="rtf_bullets.gif") returned -1 [0062.820] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF") returned="RTF_BOLD.GIF" [0062.820] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.820] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.820] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.820] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.820] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_bullets.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" [0062.820] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.zip") returned 0 [0062.820] lstrlenA (lpString="*.zip") returned 5 [0062.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.rar") returned 0 [0062.821] lstrlenA (lpString="*.rar") returned 5 [0062.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.7z") returned 0 [0062.821] lstrlenA (lpString="*.7z") returned 4 [0062.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.tar") returned 0 [0062.821] lstrlenA (lpString="*.tar") returned 5 [0062.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.gzip") returned 0 [0062.821] lstrlenA (lpString="*.gzip") returned 6 [0062.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.jpg") returned 0 [0062.821] lstrlenA (lpString="*.jpg") returned 5 [0062.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.jpeg") returned 0 [0062.821] lstrlenA (lpString="*.jpeg") returned 6 [0062.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.psd") returned 0 [0062.821] lstrlenA (lpString="*.psd") returned 5 [0062.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.gif") returned 1 [0062.821] lstrlenA (lpString="*.gif") returned 5 [0062.821] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" [0062.821] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" [0062.821] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif." [0062.821] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif.wannacry" [0062.821] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.823] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x365 [0062.823] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea)) returned 1 [0062.823] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.823] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2e7, lpOverlapped=0x0) returned 1 [0062.832] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif") returned="rtf_bullets.gif" [0062.832] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.832] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2e7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2e7, lpOverlapped=0x0) returned 1 [0062.832] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.832] CloseHandle (hObject=0x98) returned 1 [0062.832] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif.wannacry")) returned 1 [0062.833] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="rtf_center.gif", cAlternateFileName="RTF_CE~1.GIF")) returned 1 [0062.833] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.833] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_center.gif") returned -1 [0062.834] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_center.gif") returned -1 [0062.834] lstrcmpiA (lpString1="", lpString2="rtf_center.gif") returned -1 [0062.834] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif") returned="rtf_bullets.gif" [0062.834] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.834] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.834] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.834] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.834] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_center.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" [0062.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.zip") returned 0 [0062.834] lstrlenA (lpString="*.zip") returned 5 [0062.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.rar") returned 0 [0062.834] lstrlenA (lpString="*.rar") returned 5 [0062.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.7z") returned 0 [0062.834] lstrlenA (lpString="*.7z") returned 4 [0062.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.tar") returned 0 [0062.834] lstrlenA (lpString="*.tar") returned 5 [0062.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.gzip") returned 0 [0062.834] lstrlenA (lpString="*.gzip") returned 6 [0062.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.jpg") returned 0 [0062.834] lstrlenA (lpString="*.jpg") returned 5 [0062.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.jpeg") returned 0 [0062.834] lstrlenA (lpString="*.jpeg") returned 6 [0062.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.psd") returned 0 [0062.834] lstrlenA (lpString="*.psd") returned 5 [0062.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.gif") returned 1 [0062.834] lstrlenA (lpString="*.gif") returned 5 [0062.834] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" [0062.834] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" [0062.834] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif." [0062.834] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif.wannacry" [0062.835] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.835] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34f [0062.835] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea)) returned 1 [0062.835] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.835] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2d1, lpOverlapped=0x0) returned 1 [0062.837] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif") returned="rtf_center.gif" [0062.837] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.837] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2d1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2d1, lpOverlapped=0x0) returned 1 [0062.837] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.837] CloseHandle (hObject=0x98) returned 1 [0062.837] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif.wannacry")) returned 1 [0062.839] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3031bc00, ftCreationTime.dwHighDateTime=0x1ca033b, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3031bc00, ftLastWriteTime.dwHighDateTime=0x1ca033b, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="rtf_choosecolor.gif", cAlternateFileName="RTF_CH~1.GIF")) returned 1 [0062.839] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.839] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_choosecolor.gif") returned -1 [0062.839] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_choosecolor.gif") returned -1 [0062.839] lstrcmpiA (lpString1="", lpString2="rtf_choosecolor.gif") returned -1 [0062.839] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif") returned="rtf_center.gif" [0062.839] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.839] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.839] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.839] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.839] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_choosecolor.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" [0062.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.zip") returned 0 [0062.840] lstrlenA (lpString="*.zip") returned 5 [0062.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.rar") returned 0 [0062.840] lstrlenA (lpString="*.rar") returned 5 [0062.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.7z") returned 0 [0062.840] lstrlenA (lpString="*.7z") returned 4 [0062.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.tar") returned 0 [0062.840] lstrlenA (lpString="*.tar") returned 5 [0062.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.gzip") returned 0 [0062.840] lstrlenA (lpString="*.gzip") returned 6 [0062.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.jpg") returned 0 [0062.840] lstrlenA (lpString="*.jpg") returned 5 [0062.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.jpeg") returned 0 [0062.840] lstrlenA (lpString="*.jpeg") returned 6 [0062.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.psd") returned 0 [0062.840] lstrlenA (lpString="*.psd") returned 5 [0062.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.gif") returned 1 [0062.840] lstrlenA (lpString="*.gif") returned 5 [0062.840] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" [0062.840] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" [0062.840] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif." [0062.840] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif.wannacry" [0062.840] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.842] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ee [0062.842] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3031bc00, dwHighDateTime=0x1ca033b), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3031bc00, dwHighDateTime=0x1ca033b)) returned 1 [0062.842] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.842] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x370, lpOverlapped=0x0) returned 1 [0062.843] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif") returned="rtf_choosecolor.gif" [0062.843] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.843] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x370, lpOverlapped=0x0) returned 1 [0062.843] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.843] CloseHandle (hObject=0x98) returned 1 [0062.844] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif.wannacry")) returned 1 [0062.844] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x37a, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="rtf_choosefont.gif", cAlternateFileName="RTF_CH~2.GIF")) returned 1 [0062.844] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.844] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_choosefont.gif") returned -1 [0062.844] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_choosefont.gif") returned -1 [0062.844] lstrcmpiA (lpString1="", lpString2="rtf_choosefont.gif") returned -1 [0062.845] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif") returned="rtf_choosecolor.gif" [0062.845] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.845] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.845] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.845] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.845] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_choosefont.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" [0062.845] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.zip") returned 0 [0062.845] lstrlenA (lpString="*.zip") returned 5 [0062.845] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.rar") returned 0 [0062.845] lstrlenA (lpString="*.rar") returned 5 [0062.845] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.7z") returned 0 [0062.845] lstrlenA (lpString="*.7z") returned 4 [0062.845] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.tar") returned 0 [0062.845] lstrlenA (lpString="*.tar") returned 5 [0062.845] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.gzip") returned 0 [0062.845] lstrlenA (lpString="*.gzip") returned 6 [0062.845] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.jpg") returned 0 [0062.845] lstrlenA (lpString="*.jpg") returned 5 [0062.845] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.jpeg") returned 0 [0062.845] lstrlenA (lpString="*.jpeg") returned 6 [0062.845] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.psd") returned 0 [0062.845] lstrlenA (lpString="*.psd") returned 5 [0062.845] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.gif") returned 1 [0062.845] lstrlenA (lpString="*.gif") returned 5 [0062.845] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" [0062.845] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" [0062.845] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif." [0062.845] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif.wannacry" [0062.845] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.846] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x37a [0062.846] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea)) returned 1 [0062.846] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.846] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2fc, lpOverlapped=0x0) returned 1 [0062.848] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif") returned="rtf_choosefont.gif" [0062.848] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.848] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2fc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2fc, lpOverlapped=0x0) returned 1 [0062.848] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.848] CloseHandle (hObject=0x98) returned 1 [0062.849] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif.wannacry")) returned 1 [0062.849] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ea9100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97ea9100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35f, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="rtf_decreaseindent.gif", cAlternateFileName="RTF_DE~1.GIF")) returned 1 [0062.849] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.849] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_decreaseindent.gif") returned -1 [0062.849] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_decreaseindent.gif") returned -1 [0062.849] lstrcmpiA (lpString1="", lpString2="rtf_decreaseindent.gif") returned -1 [0062.849] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif") returned="rtf_choosefont.gif" [0062.850] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.850] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.850] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.850] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.850] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_decreaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" [0062.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.zip") returned 0 [0062.850] lstrlenA (lpString="*.zip") returned 5 [0062.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.rar") returned 0 [0062.850] lstrlenA (lpString="*.rar") returned 5 [0062.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.7z") returned 0 [0062.850] lstrlenA (lpString="*.7z") returned 4 [0062.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.tar") returned 0 [0062.850] lstrlenA (lpString="*.tar") returned 5 [0062.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.gzip") returned 0 [0062.850] lstrlenA (lpString="*.gzip") returned 6 [0062.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.jpg") returned 0 [0062.850] lstrlenA (lpString="*.jpg") returned 5 [0062.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.jpeg") returned 0 [0062.850] lstrlenA (lpString="*.jpeg") returned 6 [0062.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.psd") returned 0 [0062.850] lstrlenA (lpString="*.psd") returned 5 [0062.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.gif") returned 1 [0062.850] lstrlenA (lpString="*.gif") returned 5 [0062.850] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" [0062.850] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" [0062.850] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif." [0062.850] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif.wannacry" [0062.850] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.851] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35f [0062.851] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea)) returned 1 [0062.851] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.851] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2e1, lpOverlapped=0x0) returned 1 [0062.853] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif") returned="rtf_decreaseindent.gif" [0062.853] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.853] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2e1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2e1, lpOverlapped=0x0) returned 1 [0062.853] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.853] CloseHandle (hObject=0x98) returned 1 [0062.854] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif.wannacry")) returned 1 [0062.854] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ea9100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97ea9100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35d, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="rtf_increaseindent.gif", cAlternateFileName="RTF_IN~1.GIF")) returned 1 [0062.854] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.854] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_increaseindent.gif") returned -1 [0062.854] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_increaseindent.gif") returned -1 [0062.854] lstrcmpiA (lpString1="", lpString2="rtf_increaseindent.gif") returned -1 [0062.854] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif") returned="rtf_decreaseindent.gif" [0062.855] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.855] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.855] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.855] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.855] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_increaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" [0062.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.zip") returned 0 [0062.855] lstrlenA (lpString="*.zip") returned 5 [0062.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.rar") returned 0 [0062.855] lstrlenA (lpString="*.rar") returned 5 [0062.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.7z") returned 0 [0062.855] lstrlenA (lpString="*.7z") returned 4 [0062.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.tar") returned 0 [0062.855] lstrlenA (lpString="*.tar") returned 5 [0062.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.gzip") returned 0 [0062.855] lstrlenA (lpString="*.gzip") returned 6 [0062.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.jpg") returned 0 [0062.855] lstrlenA (lpString="*.jpg") returned 5 [0062.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.jpeg") returned 0 [0062.855] lstrlenA (lpString="*.jpeg") returned 6 [0062.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.psd") returned 0 [0062.855] lstrlenA (lpString="*.psd") returned 5 [0062.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.gif") returned 1 [0062.855] lstrlenA (lpString="*.gif") returned 5 [0062.855] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" [0062.855] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" [0062.855] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif." [0062.855] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif.wannacry" [0062.855] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.857] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35d [0062.857] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d24dcb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea)) returned 1 [0062.857] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.857] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2df, lpOverlapped=0x0) returned 1 [0062.858] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif") returned="rtf_increaseindent.gif" [0062.858] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.858] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2df, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2df, lpOverlapped=0x0) returned 1 [0062.858] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.858] CloseHandle (hObject=0x98) returned 1 [0062.859] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif.wannacry")) returned 1 [0062.859] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ea9100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97ea9100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="rtf_italic.gif", cAlternateFileName="RTF_IT~1.GIF")) returned 1 [0062.859] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.859] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_italic.gif") returned -1 [0062.859] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_italic.gif") returned -1 [0062.859] lstrcmpiA (lpString1="", lpString2="rtf_italic.gif") returned -1 [0062.859] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif") returned="rtf_increaseindent.gif" [0062.859] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.859] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.860] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.860] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.860] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_italic.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" [0062.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.zip") returned 0 [0062.860] lstrlenA (lpString="*.zip") returned 5 [0062.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.rar") returned 0 [0062.860] lstrlenA (lpString="*.rar") returned 5 [0062.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.7z") returned 0 [0062.860] lstrlenA (lpString="*.7z") returned 4 [0062.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.tar") returned 0 [0062.860] lstrlenA (lpString="*.tar") returned 5 [0062.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.gzip") returned 0 [0062.860] lstrlenA (lpString="*.gzip") returned 6 [0062.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.jpg") returned 0 [0062.860] lstrlenA (lpString="*.jpg") returned 5 [0062.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.jpeg") returned 0 [0062.860] lstrlenA (lpString="*.jpeg") returned 6 [0062.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.psd") returned 0 [0062.860] lstrlenA (lpString="*.psd") returned 5 [0062.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.gif") returned 1 [0062.860] lstrlenA (lpString="*.gif") returned 5 [0062.860] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" [0062.860] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" [0062.860] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif." [0062.860] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif.wannacry" [0062.860] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.861] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x354 [0062.861] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea)) returned 1 [0062.861] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.862] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2d6, lpOverlapped=0x0) returned 1 [0062.863] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif") returned="rtf_italic.gif" [0062.863] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.863] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2d6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2d6, lpOverlapped=0x0) returned 1 [0062.863] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.863] CloseHandle (hObject=0x98) returned 1 [0062.864] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif.wannacry")) returned 1 [0062.865] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ea9100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97ea9100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="rtf_justify.gif", cAlternateFileName="RTF_JU~1.GIF")) returned 1 [0062.865] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.865] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_justify.gif") returned -1 [0062.865] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_justify.gif") returned -1 [0062.865] lstrcmpiA (lpString1="", lpString2="rtf_justify.gif") returned -1 [0062.865] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif") returned="rtf_italic.gif" [0062.865] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.865] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.865] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.865] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.865] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_justify.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" [0062.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.zip") returned 0 [0062.865] lstrlenA (lpString="*.zip") returned 5 [0062.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.rar") returned 0 [0062.865] lstrlenA (lpString="*.rar") returned 5 [0062.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.7z") returned 0 [0062.865] lstrlenA (lpString="*.7z") returned 4 [0062.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.tar") returned 0 [0062.865] lstrlenA (lpString="*.tar") returned 5 [0062.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.gzip") returned 0 [0062.865] lstrlenA (lpString="*.gzip") returned 6 [0062.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.jpg") returned 0 [0062.866] lstrlenA (lpString="*.jpg") returned 5 [0062.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.jpeg") returned 0 [0062.866] lstrlenA (lpString="*.jpeg") returned 6 [0062.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.psd") returned 0 [0062.866] lstrlenA (lpString="*.psd") returned 5 [0062.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.gif") returned 1 [0062.866] lstrlenA (lpString="*.gif") returned 5 [0062.866] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" [0062.866] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" [0062.866] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif." [0062.866] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif.wannacry" [0062.866] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.867] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x352 [0062.867] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d24dcb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea)) returned 1 [0062.867] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.867] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2d4, lpOverlapped=0x0) returned 1 [0062.869] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif") returned="rtf_justify.gif" [0062.869] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.869] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2d4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2d4, lpOverlapped=0x0) returned 1 [0062.869] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.869] CloseHandle (hObject=0x98) returned 1 [0062.869] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif.wannacry")) returned 1 [0062.870] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ea9100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97ea9100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x373, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="rtf_pressed.gif", cAlternateFileName="RTF_PR~1.GIF")) returned 1 [0062.870] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.871] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_pressed.gif") returned -1 [0062.871] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_pressed.gif") returned -1 [0062.871] lstrcmpiA (lpString1="", lpString2="rtf_pressed.gif") returned -1 [0062.871] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif") returned="rtf_justify.gif" [0062.871] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.871] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.871] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.871] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.871] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_pressed.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" [0062.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.zip") returned 0 [0062.871] lstrlenA (lpString="*.zip") returned 5 [0062.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.rar") returned 0 [0062.871] lstrlenA (lpString="*.rar") returned 5 [0062.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.7z") returned 0 [0062.871] lstrlenA (lpString="*.7z") returned 4 [0062.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.tar") returned 0 [0062.871] lstrlenA (lpString="*.tar") returned 5 [0062.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.gzip") returned 0 [0062.871] lstrlenA (lpString="*.gzip") returned 6 [0062.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.jpg") returned 0 [0062.871] lstrlenA (lpString="*.jpg") returned 5 [0062.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.jpeg") returned 0 [0062.871] lstrlenA (lpString="*.jpeg") returned 6 [0062.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.psd") returned 0 [0062.872] lstrlenA (lpString="*.psd") returned 5 [0062.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.gif") returned 1 [0062.872] lstrlenA (lpString="*.gif") returned 5 [0062.872] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" [0062.872] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" [0062.872] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif." [0062.872] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif.wannacry" [0062.872] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.873] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x373 [0062.873] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a90e170, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea)) returned 1 [0062.874] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.874] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2f5, lpOverlapped=0x0) returned 1 [0062.877] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif") returned="rtf_pressed.gif" [0062.877] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.877] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2f5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2f5, lpOverlapped=0x0) returned 1 [0062.877] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.877] CloseHandle (hObject=0x98) returned 1 [0062.878] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif.wannacry")) returned 1 [0062.879] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ea9100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97ea9100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35c, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="rtf_underline.gif", cAlternateFileName="RTF_UN~1.GIF")) returned 1 [0062.879] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.879] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_underline.gif") returned -1 [0062.879] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_underline.gif") returned -1 [0062.879] lstrcmpiA (lpString1="", lpString2="rtf_underline.gif") returned -1 [0062.879] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif") returned="rtf_pressed.gif" [0062.879] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.879] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.879] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.879] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.879] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_underline.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" [0062.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.zip") returned 0 [0062.879] lstrlenA (lpString="*.zip") returned 5 [0062.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.rar") returned 0 [0062.879] lstrlenA (lpString="*.rar") returned 5 [0062.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.7z") returned 0 [0062.880] lstrlenA (lpString="*.7z") returned 4 [0062.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.tar") returned 0 [0062.880] lstrlenA (lpString="*.tar") returned 5 [0062.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.gzip") returned 0 [0062.880] lstrlenA (lpString="*.gzip") returned 6 [0062.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.jpg") returned 0 [0062.880] lstrlenA (lpString="*.jpg") returned 5 [0062.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.jpeg") returned 0 [0062.880] lstrlenA (lpString="*.jpeg") returned 6 [0062.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.psd") returned 0 [0062.880] lstrlenA (lpString="*.psd") returned 5 [0062.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.gif") returned 1 [0062.880] lstrlenA (lpString="*.gif") returned 5 [0062.880] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" [0062.880] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" [0062.880] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif." [0062.880] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif.wannacry" [0062.880] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.882] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35c [0062.882] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a90e170, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea)) returned 1 [0062.882] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.882] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2de, lpOverlapped=0x0) returned 1 [0062.884] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif") returned="rtf_underline.gif" [0062.884] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.884] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2de, lpOverlapped=0x0) returned 1 [0062.884] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.884] CloseHandle (hObject=0x98) returned 1 [0062.885] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif.wannacry")) returned 1 [0062.886] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58b9b600, ftCreationTime.dwHighDateTime=0x1ca033b, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58b9b600, ftLastWriteTime.dwHighDateTime=0x1ca033b, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="SAVE.GIF", cAlternateFileName="")) returned 1 [0062.886] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.886] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SAVE.GIF") returned -1 [0062.886] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SAVE.GIF") returned -1 [0062.886] lstrcmpiA (lpString1="", lpString2="SAVE.GIF") returned -1 [0062.886] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif") returned="rtf_underline.gif" [0062.886] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.886] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.886] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.886] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.886] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="SAVE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF" [0062.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.zip") returned 0 [0062.886] lstrlenA (lpString="*.zip") returned 5 [0062.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.rar") returned 0 [0062.886] lstrlenA (lpString="*.rar") returned 5 [0062.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.7z") returned 0 [0062.887] lstrlenA (lpString="*.7z") returned 4 [0062.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.tar") returned 0 [0062.887] lstrlenA (lpString="*.tar") returned 5 [0062.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.gzip") returned 0 [0062.887] lstrlenA (lpString="*.gzip") returned 6 [0062.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.jpg") returned 0 [0062.887] lstrlenA (lpString="*.jpg") returned 5 [0062.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.jpeg") returned 0 [0062.887] lstrlenA (lpString="*.jpeg") returned 6 [0062.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.psd") returned 0 [0062.887] lstrlenA (lpString="*.psd") returned 5 [0062.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.gif") returned 1 [0062.887] lstrlenA (lpString="*.gif") returned 5 [0062.887] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF" [0062.887] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF" [0062.887] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF." [0062.887] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF.wannacry" [0062.887] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\save.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.888] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x26d [0062.888] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x58b9b600, dwHighDateTime=0x1ca033b), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a90e170, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x58b9b600, dwHighDateTime=0x1ca033b)) returned 1 [0062.888] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.888] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1ef, lpOverlapped=0x0) returned 1 [0062.889] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF") returned="SAVE.GIF" [0062.889] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.890] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1ef, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1ef, lpOverlapped=0x0) returned 1 [0062.890] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.890] CloseHandle (hObject=0x98) returned 1 [0062.890] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\save.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\save.gif.wannacry")) returned 1 [0062.892] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ea9100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97ea9100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x12b79, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName="SUBMIT.JS", cAlternateFileName="")) returned 1 [0062.892] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.893] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SUBMIT.JS") returned -1 [0062.893] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SUBMIT.JS") returned -1 [0062.893] lstrcmpiA (lpString1="", lpString2="SUBMIT.JS") returned -1 [0062.893] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF") returned="SAVE.GIF" [0062.893] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.893] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.893] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.893] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.893] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="SUBMIT.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS" [0062.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.zip") returned 0 [0062.893] lstrlenA (lpString="*.zip") returned 5 [0062.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.rar") returned 0 [0062.893] lstrlenA (lpString="*.rar") returned 5 [0062.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.7z") returned 0 [0062.893] lstrlenA (lpString="*.7z") returned 4 [0062.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.tar") returned 0 [0062.893] lstrlenA (lpString="*.tar") returned 5 [0062.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.gzip") returned 0 [0062.893] lstrlenA (lpString="*.gzip") returned 6 [0062.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.jpg") returned 0 [0062.894] lstrlenA (lpString="*.jpg") returned 5 [0062.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.jpeg") returned 0 [0062.894] lstrlenA (lpString="*.jpeg") returned 6 [0062.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.psd") returned 0 [0062.894] lstrlenA (lpString="*.psd") returned 5 [0062.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.gif") returned 0 [0062.894] lstrlenA (lpString="*.gif") returned 5 [0062.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.doc") returned 0 [0062.894] lstrlenA (lpString="*.doc") returned 5 [0062.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.docx") returned 0 [0062.894] lstrlenA (lpString="*.docx") returned 6 [0062.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.xls") returned 0 [0062.894] lstrlenA (lpString="*.xls") returned 5 [0062.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.xlsx") returned 0 [0062.894] lstrlenA (lpString="*.xlsx") returned 6 [0062.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.ppt") returned 0 [0062.894] lstrlenA (lpString="*.ppt") returned 5 [0062.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.pptx") returned 0 [0062.894] lstrlenA (lpString="*.pptx") returned 6 [0062.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.pdf") returned 0 [0062.894] lstrlenA (lpString="*.pdf") returned 5 [0062.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.mov") returned 0 [0062.895] lstrlenA (lpString="*.mov") returned 5 [0062.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.m2v") returned 0 [0062.895] lstrlenA (lpString="*.m2v") returned 5 [0062.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.3gp") returned 0 [0062.895] lstrlenA (lpString="*.3gp") returned 5 [0062.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.mpeg") returned 0 [0062.895] lstrlenA (lpString="*.mpeg") returned 6 [0062.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.mpg") returned 0 [0062.895] lstrlenA (lpString="*.mpg") returned 5 [0062.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.flv") returned 0 [0062.895] lstrlenA (lpString="*.flv") returned 5 [0062.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.avi") returned 0 [0062.895] lstrlenA (lpString="*.avi") returned 5 [0062.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.mp4") returned 0 [0062.895] lstrlenA (lpString="*.mp4") returned 5 [0062.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.wmv") returned 0 [0062.895] lstrlenA (lpString="*.wmv") returned 5 [0062.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.divx") returned 0 [0062.895] lstrlenA (lpString="*.divx") returned 6 [0062.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.mkv") returned 0 [0062.895] lstrlenA (lpString="*.mkv") returned 5 [0062.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.mp3") returned 0 [0062.895] lstrlenA (lpString="*.mp3") returned 5 [0062.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.wav") returned 0 [0062.895] lstrlenA (lpString="*.wav") returned 5 [0062.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.flac") returned 0 [0062.896] lstrlenA (lpString="*.flac") returned 6 [0062.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.ape") returned 0 [0062.896] lstrlenA (lpString="*.ape") returned 5 [0062.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.wma") returned 0 [0062.896] lstrlenA (lpString="*.wma") returned 5 [0062.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.ac3") returned 0 [0062.896] lstrlenA (lpString="*.ac3") returned 5 [0062.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.mxf") returned 0 [0062.896] lstrlenA (lpString="*.mxf") returned 5 [0062.896] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6e57, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="utilityfunctions.js", cAlternateFileName="UTILIT~1.JS")) returned 1 [0062.896] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.896] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="utilityfunctions.js") returned -1 [0062.896] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="utilityfunctions.js") returned -1 [0062.896] lstrcmpiA (lpString1="", lpString2="utilityfunctions.js") returned -1 [0062.896] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS") returned="SUBMIT.JS" [0062.896] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.896] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.896] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.896] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.896] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="utilityfunctions.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js" [0062.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.zip") returned 0 [0062.897] lstrlenA (lpString="*.zip") returned 5 [0062.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.rar") returned 0 [0062.897] lstrlenA (lpString="*.rar") returned 5 [0062.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.7z") returned 0 [0062.897] lstrlenA (lpString="*.7z") returned 4 [0062.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.tar") returned 0 [0062.897] lstrlenA (lpString="*.tar") returned 5 [0062.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.gzip") returned 0 [0062.897] lstrlenA (lpString="*.gzip") returned 6 [0062.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.jpg") returned 0 [0062.897] lstrlenA (lpString="*.jpg") returned 5 [0062.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.jpeg") returned 0 [0062.897] lstrlenA (lpString="*.jpeg") returned 6 [0062.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.psd") returned 0 [0062.897] lstrlenA (lpString="*.psd") returned 5 [0062.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.gif") returned 0 [0062.897] lstrlenA (lpString="*.gif") returned 5 [0062.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.doc") returned 0 [0062.897] lstrlenA (lpString="*.doc") returned 5 [0062.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.docx") returned 0 [0062.897] lstrlenA (lpString="*.docx") returned 6 [0062.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.xls") returned 0 [0062.898] lstrlenA (lpString="*.xls") returned 5 [0062.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.xlsx") returned 0 [0062.898] lstrlenA (lpString="*.xlsx") returned 6 [0062.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.ppt") returned 0 [0062.898] lstrlenA (lpString="*.ppt") returned 5 [0062.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.pptx") returned 0 [0062.898] lstrlenA (lpString="*.pptx") returned 6 [0062.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.pdf") returned 0 [0062.898] lstrlenA (lpString="*.pdf") returned 5 [0062.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.mov") returned 0 [0062.898] lstrlenA (lpString="*.mov") returned 5 [0062.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.m2v") returned 0 [0062.898] lstrlenA (lpString="*.m2v") returned 5 [0062.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.3gp") returned 0 [0062.898] lstrlenA (lpString="*.3gp") returned 5 [0062.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.mpeg") returned 0 [0062.898] lstrlenA (lpString="*.mpeg") returned 6 [0062.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.mpg") returned 0 [0062.898] lstrlenA (lpString="*.mpg") returned 5 [0062.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.flv") returned 0 [0062.898] lstrlenA (lpString="*.flv") returned 5 [0062.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.avi") returned 0 [0062.898] lstrlenA (lpString="*.avi") returned 5 [0062.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.mp4") returned 0 [0062.898] lstrlenA (lpString="*.mp4") returned 5 [0062.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.wmv") returned 0 [0062.899] lstrlenA (lpString="*.wmv") returned 5 [0062.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.divx") returned 0 [0062.899] lstrlenA (lpString="*.divx") returned 6 [0062.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.mkv") returned 0 [0062.899] lstrlenA (lpString="*.mkv") returned 5 [0062.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.mp3") returned 0 [0062.899] lstrlenA (lpString="*.mp3") returned 5 [0062.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.wav") returned 0 [0062.899] lstrlenA (lpString="*.wav") returned 5 [0062.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.flac") returned 0 [0062.899] lstrlenA (lpString="*.flac") returned 6 [0062.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.ape") returned 0 [0062.899] lstrlenA (lpString="*.ape") returned 5 [0062.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.wma") returned 0 [0062.899] lstrlenA (lpString="*.wma") returned 5 [0062.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.ac3") returned 0 [0062.899] lstrlenA (lpString="*.ac3") returned 5 [0062.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.mxf") returned 0 [0062.899] lstrlenA (lpString="*.mxf") returned 5 [0062.899] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e4444b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6427, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="validation.js", cAlternateFileName="VALIDA~1.JS")) returned 1 [0062.899] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.899] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="validation.js") returned -1 [0062.900] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="validation.js") returned -1 [0062.900] lstrcmpiA (lpString1="", lpString2="validation.js") returned -1 [0062.900] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js") returned="utilityfunctions.js" [0062.900] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.900] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.900] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.900] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.900] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="validation.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js" [0062.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.zip") returned 0 [0062.900] lstrlenA (lpString="*.zip") returned 5 [0062.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.rar") returned 0 [0062.900] lstrlenA (lpString="*.rar") returned 5 [0062.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.7z") returned 0 [0062.900] lstrlenA (lpString="*.7z") returned 4 [0062.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.tar") returned 0 [0062.900] lstrlenA (lpString="*.tar") returned 5 [0062.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.gzip") returned 0 [0062.900] lstrlenA (lpString="*.gzip") returned 6 [0062.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.jpg") returned 0 [0062.900] lstrlenA (lpString="*.jpg") returned 5 [0062.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.jpeg") returned 0 [0062.900] lstrlenA (lpString="*.jpeg") returned 6 [0062.900] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.psd") returned 0 [0062.900] lstrlenA (lpString="*.psd") returned 5 [0062.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.gif") returned 0 [0062.901] lstrlenA (lpString="*.gif") returned 5 [0062.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.doc") returned 0 [0062.901] lstrlenA (lpString="*.doc") returned 5 [0062.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.docx") returned 0 [0062.901] lstrlenA (lpString="*.docx") returned 6 [0062.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.xls") returned 0 [0062.901] lstrlenA (lpString="*.xls") returned 5 [0062.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.xlsx") returned 0 [0062.901] lstrlenA (lpString="*.xlsx") returned 6 [0062.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.ppt") returned 0 [0062.901] lstrlenA (lpString="*.ppt") returned 5 [0062.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.pptx") returned 0 [0062.901] lstrlenA (lpString="*.pptx") returned 6 [0062.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.pdf") returned 0 [0062.901] lstrlenA (lpString="*.pdf") returned 5 [0062.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.mov") returned 0 [0062.901] lstrlenA (lpString="*.mov") returned 5 [0062.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.m2v") returned 0 [0062.901] lstrlenA (lpString="*.m2v") returned 5 [0062.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.3gp") returned 0 [0062.901] lstrlenA (lpString="*.3gp") returned 5 [0062.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.mpeg") returned 0 [0062.901] lstrlenA (lpString="*.mpeg") returned 6 [0062.901] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.mpg") returned 0 [0062.902] lstrlenA (lpString="*.mpg") returned 5 [0062.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.flv") returned 0 [0062.902] lstrlenA (lpString="*.flv") returned 5 [0062.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.avi") returned 0 [0062.902] lstrlenA (lpString="*.avi") returned 5 [0062.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.mp4") returned 0 [0062.902] lstrlenA (lpString="*.mp4") returned 5 [0062.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.wmv") returned 0 [0062.902] lstrlenA (lpString="*.wmv") returned 5 [0062.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.divx") returned 0 [0062.902] lstrlenA (lpString="*.divx") returned 6 [0062.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.mkv") returned 0 [0062.902] lstrlenA (lpString="*.mkv") returned 5 [0062.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.mp3") returned 0 [0062.902] lstrlenA (lpString="*.mp3") returned 5 [0062.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.wav") returned 0 [0062.902] lstrlenA (lpString="*.wav") returned 5 [0062.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.flac") returned 0 [0062.902] lstrlenA (lpString="*.flac") returned 6 [0062.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.ape") returned 0 [0062.902] lstrlenA (lpString="*.ape") returned 5 [0062.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.wma") returned 0 [0062.902] lstrlenA (lpString="*.wma") returned 5 [0062.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.ac3") returned 0 [0062.903] lstrlenA (lpString="*.ac3") returned 5 [0062.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.mxf") returned 0 [0062.903] lstrlenA (lpString="*.mxf") returned 5 [0062.903] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="VIEW.ICO", cAlternateFileName="")) returned 1 [0062.903] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.903] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VIEW.ICO") returned -1 [0062.903] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VIEW.ICO") returned -1 [0062.903] lstrcmpiA (lpString1="", lpString2="VIEW.ICO") returned -1 [0062.903] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js") returned="validation.js" [0062.903] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.903] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.903] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="VIEW.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO" [0062.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.zip") returned 0 [0062.903] lstrlenA (lpString="*.zip") returned 5 [0062.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.rar") returned 0 [0062.903] lstrlenA (lpString="*.rar") returned 5 [0062.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.7z") returned 0 [0062.903] lstrlenA (lpString="*.7z") returned 4 [0062.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.tar") returned 0 [0062.904] lstrlenA (lpString="*.tar") returned 5 [0062.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.gzip") returned 0 [0062.904] lstrlenA (lpString="*.gzip") returned 6 [0062.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.jpg") returned 0 [0062.904] lstrlenA (lpString="*.jpg") returned 5 [0062.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.jpeg") returned 0 [0062.904] lstrlenA (lpString="*.jpeg") returned 6 [0062.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.psd") returned 0 [0062.904] lstrlenA (lpString="*.psd") returned 5 [0062.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.gif") returned 0 [0062.904] lstrlenA (lpString="*.gif") returned 5 [0062.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.doc") returned 0 [0062.904] lstrlenA (lpString="*.doc") returned 5 [0062.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.docx") returned 0 [0062.904] lstrlenA (lpString="*.docx") returned 6 [0062.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.xls") returned 0 [0062.904] lstrlenA (lpString="*.xls") returned 5 [0062.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.xlsx") returned 0 [0062.904] lstrlenA (lpString="*.xlsx") returned 6 [0062.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.ppt") returned 0 [0062.904] lstrlenA (lpString="*.ppt") returned 5 [0062.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.pptx") returned 0 [0062.905] lstrlenA (lpString="*.pptx") returned 6 [0062.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.pdf") returned 0 [0062.905] lstrlenA (lpString="*.pdf") returned 5 [0062.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.mov") returned 0 [0062.905] lstrlenA (lpString="*.mov") returned 5 [0062.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.m2v") returned 0 [0062.905] lstrlenA (lpString="*.m2v") returned 5 [0062.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.3gp") returned 0 [0062.905] lstrlenA (lpString="*.3gp") returned 5 [0062.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.mpeg") returned 0 [0062.905] lstrlenA (lpString="*.mpeg") returned 6 [0062.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.mpg") returned 0 [0062.905] lstrlenA (lpString="*.mpg") returned 5 [0062.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.flv") returned 0 [0062.905] lstrlenA (lpString="*.flv") returned 5 [0062.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.avi") returned 0 [0062.905] lstrlenA (lpString="*.avi") returned 5 [0062.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.mp4") returned 0 [0062.905] lstrlenA (lpString="*.mp4") returned 5 [0062.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.wmv") returned 0 [0062.905] lstrlenA (lpString="*.wmv") returned 5 [0062.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.divx") returned 0 [0062.905] lstrlenA (lpString="*.divx") returned 6 [0062.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.mkv") returned 0 [0062.905] lstrlenA (lpString="*.mkv") returned 5 [0062.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.mp3") returned 0 [0062.906] lstrlenA (lpString="*.mp3") returned 5 [0062.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.wav") returned 0 [0062.906] lstrlenA (lpString="*.wav") returned 5 [0062.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.flac") returned 0 [0062.906] lstrlenA (lpString="*.flac") returned 6 [0062.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.ape") returned 0 [0062.906] lstrlenA (lpString="*.ape") returned 5 [0062.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.wma") returned 0 [0062.906] lstrlenA (lpString="*.wma") returned 5 [0062.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.ac3") returned 0 [0062.906] lstrlenA (lpString="*.ac3") returned 5 [0062.906] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.mxf") returned 0 [0062.906] lstrlenA (lpString="*.mxf") returned 5 [0062.906] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1db1, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="VIEW.JS", cAlternateFileName="")) returned 1 [0062.906] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.906] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VIEW.JS") returned -1 [0062.906] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VIEW.JS") returned -1 [0062.906] lstrcmpiA (lpString1="", lpString2="VIEW.JS") returned -1 [0062.906] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO") returned="VIEW.ICO" [0062.906] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.906] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.906] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.907] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.907] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="VIEW.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS" [0062.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.zip") returned 0 [0062.907] lstrlenA (lpString="*.zip") returned 5 [0062.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.rar") returned 0 [0062.907] lstrlenA (lpString="*.rar") returned 5 [0062.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.7z") returned 0 [0062.907] lstrlenA (lpString="*.7z") returned 4 [0062.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.tar") returned 0 [0062.907] lstrlenA (lpString="*.tar") returned 5 [0062.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.gzip") returned 0 [0062.907] lstrlenA (lpString="*.gzip") returned 6 [0062.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.jpg") returned 0 [0062.907] lstrlenA (lpString="*.jpg") returned 5 [0062.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.jpeg") returned 0 [0062.907] lstrlenA (lpString="*.jpeg") returned 6 [0062.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.psd") returned 0 [0062.907] lstrlenA (lpString="*.psd") returned 5 [0062.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.gif") returned 0 [0062.907] lstrlenA (lpString="*.gif") returned 5 [0062.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.doc") returned 0 [0062.908] lstrlenA (lpString="*.doc") returned 5 [0062.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.docx") returned 0 [0062.908] lstrlenA (lpString="*.docx") returned 6 [0062.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.xls") returned 0 [0062.908] lstrlenA (lpString="*.xls") returned 5 [0062.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.xlsx") returned 0 [0062.908] lstrlenA (lpString="*.xlsx") returned 6 [0062.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.ppt") returned 0 [0062.908] lstrlenA (lpString="*.ppt") returned 5 [0062.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.pptx") returned 0 [0062.908] lstrlenA (lpString="*.pptx") returned 6 [0062.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.pdf") returned 0 [0062.908] lstrlenA (lpString="*.pdf") returned 5 [0062.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.mov") returned 0 [0062.908] lstrlenA (lpString="*.mov") returned 5 [0062.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.m2v") returned 0 [0062.908] lstrlenA (lpString="*.m2v") returned 5 [0062.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.3gp") returned 0 [0062.908] lstrlenA (lpString="*.3gp") returned 5 [0062.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.mpeg") returned 0 [0062.908] lstrlenA (lpString="*.mpeg") returned 6 [0062.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.mpg") returned 0 [0062.908] lstrlenA (lpString="*.mpg") returned 5 [0062.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.flv") returned 0 [0062.908] lstrlenA (lpString="*.flv") returned 5 [0062.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.avi") returned 0 [0062.909] lstrlenA (lpString="*.avi") returned 5 [0062.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.mp4") returned 0 [0062.909] lstrlenA (lpString="*.mp4") returned 5 [0062.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.wmv") returned 0 [0062.909] lstrlenA (lpString="*.wmv") returned 5 [0062.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.divx") returned 0 [0062.909] lstrlenA (lpString="*.divx") returned 6 [0062.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.mkv") returned 0 [0062.909] lstrlenA (lpString="*.mkv") returned 5 [0062.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.mp3") returned 0 [0062.909] lstrlenA (lpString="*.mp3") returned 5 [0062.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.wav") returned 0 [0062.909] lstrlenA (lpString="*.wav") returned 5 [0062.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.flac") returned 0 [0062.909] lstrlenA (lpString="*.flac") returned 6 [0062.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.ape") returned 0 [0062.909] lstrlenA (lpString="*.ape") returned 5 [0062.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.wma") returned 0 [0062.909] lstrlenA (lpString="*.wma") returned 5 [0062.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.ac3") returned 0 [0062.909] lstrlenA (lpString="*.ac3") returned 5 [0062.909] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.mxf") returned 0 [0062.909] lstrlenA (lpString="*.mxf") returned 5 [0062.909] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd78, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="ViewHeaderPreview.jpg", cAlternateFileName="VIEWHE~1.JPG")) returned 1 [0062.910] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.910] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ViewHeaderPreview.jpg") returned -1 [0062.910] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ViewHeaderPreview.jpg") returned -1 [0062.910] lstrcmpiA (lpString1="", lpString2="ViewHeaderPreview.jpg") returned -1 [0062.910] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS") returned="VIEW.JS" [0062.910] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" [0062.910] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned="" [0062.910] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" [0062.910] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\how to decrypt files.txt")) returned 0x20 [0062.910] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" [0062.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", pszSpec="*.zip") returned 0 [0062.910] lstrlenA (lpString="*.zip") returned 5 [0062.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", pszSpec="*.rar") returned 0 [0062.910] lstrlenA (lpString="*.rar") returned 5 [0062.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", pszSpec="*.7z") returned 0 [0062.910] lstrlenA (lpString="*.7z") returned 4 [0062.910] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", pszSpec="*.tar") returned 0 [0062.911] lstrlenA (lpString="*.tar") returned 5 [0062.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", pszSpec="*.gzip") returned 0 [0062.911] lstrlenA (lpString="*.gzip") returned 6 [0062.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", pszSpec="*.jpg") returned 1 [0062.911] lstrlenA (lpString="*.jpg") returned 5 [0062.911] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" [0062.911] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" [0062.911] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg." [0062.911] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg.wannacry" [0062.911] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.912] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd78 [0062.912] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x706f8370, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea)) returned 1 [0062.912] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.912] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xcfa, lpOverlapped=0x0) returned 1 [0062.930] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg") returned="ViewHeaderPreview.jpg" [0062.930] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.930] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xcfa, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xcfa, lpOverlapped=0x0) returned 1 [0062.931] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.931] CloseHandle (hObject=0x98) returned 1 [0062.931] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg.wannacry")) returned 1 [0062.932] FindNextFileA (in: hFindFile=0x2d80b0, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd78, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="ViewHeaderPreview.jpg", cAlternateFileName="VIEWHE~1.JPG")) returned 0 [0062.933] FindClose (in: hFindFile=0x2d80b0 | out: hFindFile=0x2d80b0) returned 1 [0062.933] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="GrooveForms4", cAlternateFileName="GROOVE~4")) returned 1 [0062.933] lstrcmpA (lpString1=".", lpString2="GrooveForms4") returned -1 [0062.933] lstrcmpA (lpString1="..", lpString2="GrooveForms4") returned -1 [0062.933] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*" [0062.933] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="GrooveForms4" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4" [0062.933] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4") returned 82 [0062.933] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d80f0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0062.936] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0062.936] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0062.941] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0062.941] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0062.941] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ADD.GIF", cAlternateFileName="")) returned 1 [0062.941] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.941] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ADD.GIF") returned 1 [0062.941] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADD.GIF") returned 1 [0062.941] lstrcmpiA (lpString1="", lpString2="ADD.GIF") returned -1 [0062.941] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\*.*") returned="*.*" [0062.941] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0062.941] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0062.942] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0062.942] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0xffffffff [0062.943] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.944] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0062.944] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0062.945] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0062.946] CloseHandle (hObject=0x98) returned 1 [0062.946] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="ADD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF" [0062.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.zip") returned 0 [0062.946] lstrlenA (lpString="*.zip") returned 5 [0062.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.rar") returned 0 [0062.946] lstrlenA (lpString="*.rar") returned 5 [0062.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.7z") returned 0 [0062.946] lstrlenA (lpString="*.7z") returned 4 [0062.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.tar") returned 0 [0062.946] lstrlenA (lpString="*.tar") returned 5 [0062.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.gzip") returned 0 [0062.946] lstrlenA (lpString="*.gzip") returned 6 [0062.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.jpg") returned 0 [0062.946] lstrlenA (lpString="*.jpg") returned 5 [0062.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.jpeg") returned 0 [0062.946] lstrlenA (lpString="*.jpeg") returned 6 [0062.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.psd") returned 0 [0062.946] lstrlenA (lpString="*.psd") returned 5 [0062.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.gif") returned 1 [0062.947] lstrlenA (lpString="*.gif") returned 5 [0062.947] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF" [0062.947] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF" [0062.947] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF." [0062.947] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF.wannacry" [0062.947] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\add.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.948] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x244 [0062.948] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eaf6290, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea)) returned 1 [0062.948] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.948] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1c6, lpOverlapped=0x0) returned 1 [0062.949] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF") returned="ADD.GIF" [0062.949] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.949] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1c6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1c6, lpOverlapped=0x0) returned 1 [0062.950] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.950] CloseHandle (hObject=0x98) returned 1 [0062.950] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\add.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\add.gif.wannacry")) returned 1 [0062.951] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe8, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="AddToViewArrow.jpg", cAlternateFileName="ADDTOV~1.JPG")) returned 1 [0062.951] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.951] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AddToViewArrow.jpg") returned 1 [0062.951] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddToViewArrow.jpg") returned 1 [0062.951] lstrcmpiA (lpString1="", lpString2="AddToViewArrow.jpg") returned -1 [0062.951] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF") returned="ADD.GIF" [0062.951] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0062.951] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0062.952] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0062.952] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0062.952] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="AddToViewArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" [0062.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", pszSpec="*.zip") returned 0 [0062.952] lstrlenA (lpString="*.zip") returned 5 [0062.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", pszSpec="*.rar") returned 0 [0062.952] lstrlenA (lpString="*.rar") returned 5 [0062.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", pszSpec="*.7z") returned 0 [0062.952] lstrlenA (lpString="*.7z") returned 4 [0062.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", pszSpec="*.tar") returned 0 [0062.952] lstrlenA (lpString="*.tar") returned 5 [0062.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", pszSpec="*.gzip") returned 0 [0062.952] lstrlenA (lpString="*.gzip") returned 6 [0062.952] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", pszSpec="*.jpg") returned 1 [0062.952] lstrlenA (lpString="*.jpg") returned 5 [0062.952] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" [0062.952] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" [0062.952] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg." [0062.952] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg.wannacry" [0062.952] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.953] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbe8 [0062.953] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5127f1f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea)) returned 1 [0062.953] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.954] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xb6a, lpOverlapped=0x0) returned 1 [0062.955] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg") returned="AddToViewArrow.jpg" [0062.956] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.956] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xb6a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xb6a, lpOverlapped=0x0) returned 1 [0062.956] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.956] CloseHandle (hObject=0x98) returned 1 [0062.956] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg.wannacry")) returned 1 [0062.958] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="AddToViewArrowMask.bmp", cAlternateFileName="ADDTOV~1.BMP")) returned 1 [0062.958] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.958] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AddToViewArrowMask.bmp") returned 1 [0062.958] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddToViewArrowMask.bmp") returned 1 [0062.958] lstrcmpiA (lpString1="", lpString2="AddToViewArrowMask.bmp") returned -1 [0062.958] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg") returned="AddToViewArrow.jpg" [0062.958] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0062.958] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0062.958] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0062.958] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0062.958] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="AddToViewArrowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp" [0062.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.zip") returned 0 [0062.958] lstrlenA (lpString="*.zip") returned 5 [0062.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.rar") returned 0 [0062.958] lstrlenA (lpString="*.rar") returned 5 [0062.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.7z") returned 0 [0062.958] lstrlenA (lpString="*.7z") returned 4 [0062.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.tar") returned 0 [0062.958] lstrlenA (lpString="*.tar") returned 5 [0062.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.gzip") returned 0 [0062.958] lstrlenA (lpString="*.gzip") returned 6 [0062.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.jpg") returned 0 [0062.959] lstrlenA (lpString="*.jpg") returned 5 [0062.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.jpeg") returned 0 [0062.959] lstrlenA (lpString="*.jpeg") returned 6 [0062.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.psd") returned 0 [0062.959] lstrlenA (lpString="*.psd") returned 5 [0062.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.gif") returned 0 [0062.959] lstrlenA (lpString="*.gif") returned 5 [0062.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.doc") returned 0 [0062.959] lstrlenA (lpString="*.doc") returned 5 [0062.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.docx") returned 0 [0062.959] lstrlenA (lpString="*.docx") returned 6 [0062.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.xls") returned 0 [0062.959] lstrlenA (lpString="*.xls") returned 5 [0062.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.xlsx") returned 0 [0062.959] lstrlenA (lpString="*.xlsx") returned 6 [0062.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.ppt") returned 0 [0062.959] lstrlenA (lpString="*.ppt") returned 5 [0062.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.pptx") returned 0 [0062.959] lstrlenA (lpString="*.pptx") returned 6 [0062.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.pdf") returned 0 [0062.959] lstrlenA (lpString="*.pdf") returned 5 [0062.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.mov") returned 0 [0062.959] lstrlenA (lpString="*.mov") returned 5 [0062.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.m2v") returned 0 [0062.959] lstrlenA (lpString="*.m2v") returned 5 [0062.959] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.3gp") returned 0 [0062.960] lstrlenA (lpString="*.3gp") returned 5 [0062.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.mpeg") returned 0 [0062.960] lstrlenA (lpString="*.mpeg") returned 6 [0062.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.mpg") returned 0 [0062.960] lstrlenA (lpString="*.mpg") returned 5 [0062.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.flv") returned 0 [0062.960] lstrlenA (lpString="*.flv") returned 5 [0062.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.avi") returned 0 [0062.960] lstrlenA (lpString="*.avi") returned 5 [0062.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.mp4") returned 0 [0062.960] lstrlenA (lpString="*.mp4") returned 5 [0062.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.wmv") returned 0 [0062.960] lstrlenA (lpString="*.wmv") returned 5 [0062.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.divx") returned 0 [0062.960] lstrlenA (lpString="*.divx") returned 6 [0062.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.mkv") returned 0 [0062.960] lstrlenA (lpString="*.mkv") returned 5 [0062.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.mp3") returned 0 [0062.960] lstrlenA (lpString="*.mp3") returned 5 [0062.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.wav") returned 0 [0062.960] lstrlenA (lpString="*.wav") returned 5 [0062.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.flac") returned 0 [0062.960] lstrlenA (lpString="*.flac") returned 6 [0062.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.ape") returned 0 [0062.960] lstrlenA (lpString="*.ape") returned 5 [0062.960] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.wma") returned 0 [0062.960] lstrlenA (lpString="*.wma") returned 5 [0062.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.ac3") returned 0 [0062.961] lstrlenA (lpString="*.ac3") returned 5 [0062.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.mxf") returned 0 [0062.961] lstrlenA (lpString="*.mxf") returned 5 [0062.961] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xae8, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="attention.gif", cAlternateFileName="ATTENT~1.GIF")) returned 1 [0062.961] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.961] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="attention.gif") returned 1 [0062.961] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="attention.gif") returned 1 [0062.961] lstrcmpiA (lpString1="", lpString2="attention.gif") returned -1 [0062.961] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp") returned="AddToViewArrowMask.bmp" [0062.961] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0062.961] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0062.961] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0062.961] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0062.961] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" [0062.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.zip") returned 0 [0062.961] lstrlenA (lpString="*.zip") returned 5 [0062.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.rar") returned 0 [0062.961] lstrlenA (lpString="*.rar") returned 5 [0062.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.7z") returned 0 [0062.961] lstrlenA (lpString="*.7z") returned 4 [0062.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.tar") returned 0 [0062.962] lstrlenA (lpString="*.tar") returned 5 [0062.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.gzip") returned 0 [0062.962] lstrlenA (lpString="*.gzip") returned 6 [0062.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.jpg") returned 0 [0062.962] lstrlenA (lpString="*.jpg") returned 5 [0062.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.jpeg") returned 0 [0062.962] lstrlenA (lpString="*.jpeg") returned 6 [0062.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.psd") returned 0 [0062.962] lstrlenA (lpString="*.psd") returned 5 [0062.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.gif") returned 1 [0062.962] lstrlenA (lpString="*.gif") returned 5 [0062.962] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" [0062.962] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" [0062.962] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif." [0062.962] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif.wannacry" [0062.962] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.963] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae8 [0062.963] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51767f50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea)) returned 1 [0062.963] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.964] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xa6a, lpOverlapped=0x0) returned 1 [0062.966] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif") returned="attention.gif" [0062.966] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.966] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xa6a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xa6a, lpOverlapped=0x0) returned 1 [0062.966] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.966] CloseHandle (hObject=0x98) returned 1 [0062.966] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif.wannacry")) returned 1 [0062.967] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x614e, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="BG_ADOBE.GIF", cAlternateFileName="")) returned 1 [0062.968] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.968] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BG_ADOBE.GIF") returned 1 [0062.968] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BG_ADOBE.GIF") returned 1 [0062.968] lstrcmpiA (lpString1="", lpString2="BG_ADOBE.GIF") returned -1 [0062.968] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif") returned="attention.gif" [0062.968] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0062.968] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0062.968] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0062.968] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0062.968] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="BG_ADOBE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF" [0062.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.zip") returned 0 [0062.968] lstrlenA (lpString="*.zip") returned 5 [0062.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.rar") returned 0 [0062.968] lstrlenA (lpString="*.rar") returned 5 [0062.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.7z") returned 0 [0062.968] lstrlenA (lpString="*.7z") returned 4 [0062.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.tar") returned 0 [0062.968] lstrlenA (lpString="*.tar") returned 5 [0062.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.gzip") returned 0 [0062.968] lstrlenA (lpString="*.gzip") returned 6 [0062.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.jpg") returned 0 [0062.969] lstrlenA (lpString="*.jpg") returned 5 [0062.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.jpeg") returned 0 [0062.969] lstrlenA (lpString="*.jpeg") returned 6 [0062.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.psd") returned 0 [0062.969] lstrlenA (lpString="*.psd") returned 5 [0062.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.gif") returned 1 [0062.969] lstrlenA (lpString="*.gif") returned 5 [0062.969] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF" [0062.969] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF" [0062.969] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF." [0062.969] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF.wannacry" [0062.969] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_adobe.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.970] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x614e [0062.970] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f61e9b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea)) returned 1 [0062.970] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.970] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60d0, lpOverlapped=0x0) returned 1 [0062.972] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF") returned="BG_ADOBE.GIF" [0062.972] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.973] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60d0, lpOverlapped=0x0) returned 1 [0062.973] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.976] CloseHandle (hObject=0x98) returned 1 [0062.976] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_adobe.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_adobe.gif.wannacry")) returned 1 [0062.978] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5197d290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x161d, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="bg_Casual.gif", cAlternateFileName="BG_CAS~1.GIF")) returned 1 [0062.978] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.978] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_Casual.gif") returned 1 [0062.978] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Casual.gif") returned 1 [0062.978] lstrcmpiA (lpString1="", lpString2="bg_Casual.gif") returned -1 [0062.978] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF") returned="BG_ADOBE.GIF" [0062.978] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0062.978] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0062.978] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0062.978] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0062.978] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" [0062.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.zip") returned 0 [0062.978] lstrlenA (lpString="*.zip") returned 5 [0062.978] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.rar") returned 0 [0062.979] lstrlenA (lpString="*.rar") returned 5 [0062.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.7z") returned 0 [0062.979] lstrlenA (lpString="*.7z") returned 4 [0062.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.tar") returned 0 [0062.979] lstrlenA (lpString="*.tar") returned 5 [0062.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.gzip") returned 0 [0062.979] lstrlenA (lpString="*.gzip") returned 6 [0062.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.jpg") returned 0 [0062.979] lstrlenA (lpString="*.jpg") returned 5 [0062.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.jpeg") returned 0 [0062.979] lstrlenA (lpString="*.jpeg") returned 6 [0062.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.psd") returned 0 [0062.979] lstrlenA (lpString="*.psd") returned 5 [0062.979] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.gif") returned 1 [0062.979] lstrlenA (lpString="*.gif") returned 5 [0062.979] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" [0062.979] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" [0062.979] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif." [0062.979] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif.wannacry" [0062.979] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.980] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x161d [0062.980] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5197d290, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea)) returned 1 [0062.980] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.981] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x159f, lpOverlapped=0x0) returned 1 [0062.983] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif") returned="bg_Casual.gif" [0062.983] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.983] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x159f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x159f, lpOverlapped=0x0) returned 1 [0062.983] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.983] CloseHandle (hObject=0x98) returned 1 [0062.983] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif.wannacry")) returned 1 [0062.985] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7dd3, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="bg_Country.gif", cAlternateFileName="BG_COU~1.GIF")) returned 1 [0062.985] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.985] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_Country.gif") returned 1 [0062.985] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Country.gif") returned 1 [0062.985] lstrcmpiA (lpString1="", lpString2="bg_Country.gif") returned -1 [0062.985] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif") returned="bg_Casual.gif" [0062.985] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0062.985] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0062.985] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0062.985] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0062.985] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" [0062.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.zip") returned 0 [0062.985] lstrlenA (lpString="*.zip") returned 5 [0062.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.rar") returned 0 [0062.985] lstrlenA (lpString="*.rar") returned 5 [0062.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.7z") returned 0 [0062.985] lstrlenA (lpString="*.7z") returned 4 [0062.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.tar") returned 0 [0062.986] lstrlenA (lpString="*.tar") returned 5 [0062.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.gzip") returned 0 [0062.986] lstrlenA (lpString="*.gzip") returned 6 [0062.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.jpg") returned 0 [0062.986] lstrlenA (lpString="*.jpg") returned 5 [0062.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.jpeg") returned 0 [0062.986] lstrlenA (lpString="*.jpeg") returned 6 [0062.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.psd") returned 0 [0062.986] lstrlenA (lpString="*.psd") returned 5 [0062.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.gif") returned 1 [0062.986] lstrlenA (lpString="*.gif") returned 5 [0062.986] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" [0062.986] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" [0062.986] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif." [0062.986] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif.wannacry" [0062.986] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.987] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7dd3 [0062.987] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea)) returned 1 [0062.987] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.987] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x7d55, lpOverlapped=0x0) returned 1 [0062.990] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif") returned="bg_Country.gif" [0062.990] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.990] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x7d55, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x7d55, lpOverlapped=0x0) returned 1 [0062.990] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.990] CloseHandle (hObject=0x98) returned 1 [0062.991] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif.wannacry")) returned 1 [0062.992] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x132a, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="bg_Earthy.gif", cAlternateFileName="BG_EAR~1.GIF")) returned 1 [0062.992] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.992] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_Earthy.gif") returned 1 [0062.992] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Earthy.gif") returned 1 [0062.992] lstrcmpiA (lpString1="", lpString2="bg_Earthy.gif") returned -1 [0062.992] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif") returned="bg_Country.gif" [0062.992] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0062.992] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0062.992] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0062.992] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0062.992] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" [0062.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.zip") returned 0 [0062.992] lstrlenA (lpString="*.zip") returned 5 [0062.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.rar") returned 0 [0062.992] lstrlenA (lpString="*.rar") returned 5 [0062.993] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.7z") returned 0 [0062.993] lstrlenA (lpString="*.7z") returned 4 [0062.993] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.tar") returned 0 [0062.993] lstrlenA (lpString="*.tar") returned 5 [0062.993] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.gzip") returned 0 [0062.993] lstrlenA (lpString="*.gzip") returned 6 [0062.993] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.jpg") returned 0 [0062.993] lstrlenA (lpString="*.jpg") returned 5 [0062.993] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.jpeg") returned 0 [0062.993] lstrlenA (lpString="*.jpeg") returned 6 [0062.993] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.psd") returned 0 [0062.993] lstrlenA (lpString="*.psd") returned 5 [0062.993] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.gif") returned 1 [0062.993] lstrlenA (lpString="*.gif") returned 5 [0062.993] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" [0062.993] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" [0062.993] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif." [0062.993] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif.wannacry" [0062.993] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0062.994] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x132a [0062.994] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1 [0062.994] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.994] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x12ac, lpOverlapped=0x0) returned 1 [0062.997] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif") returned="bg_Earthy.gif" [0062.997] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0062.997] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x12ac, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x12ac, lpOverlapped=0x0) returned 1 [0062.997] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0062.997] CloseHandle (hObject=0x98) returned 1 [0062.997] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif.wannacry")) returned 1 [0062.999] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x167bd, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="bg_FormsHomePage.gif", cAlternateFileName="BG_FOR~1.GIF")) returned 1 [0062.999] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0062.999] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_FormsHomePage.gif") returned 1 [0062.999] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_FormsHomePage.gif") returned 1 [0062.999] lstrcmpiA (lpString1="", lpString2="bg_FormsHomePage.gif") returned -1 [0062.999] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif") returned="bg_Earthy.gif" [0062.999] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0062.999] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0062.999] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0062.999] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0062.999] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_FormsHomePage.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" [0062.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.zip") returned 0 [0062.999] lstrlenA (lpString="*.zip") returned 5 [0062.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.rar") returned 0 [0062.999] lstrlenA (lpString="*.rar") returned 5 [0062.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.7z") returned 0 [0063.000] lstrlenA (lpString="*.7z") returned 4 [0063.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.tar") returned 0 [0063.000] lstrlenA (lpString="*.tar") returned 5 [0063.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.gzip") returned 0 [0063.000] lstrlenA (lpString="*.gzip") returned 6 [0063.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.jpg") returned 0 [0063.000] lstrlenA (lpString="*.jpg") returned 5 [0063.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.jpeg") returned 0 [0063.000] lstrlenA (lpString="*.jpeg") returned 6 [0063.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.psd") returned 0 [0063.000] lstrlenA (lpString="*.psd") returned 5 [0063.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.gif") returned 1 [0063.000] lstrlenA (lpString="*.gif") returned 5 [0063.000] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" [0063.000] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" [0063.000] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif." [0063.000] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif.wannacry" [0063.000] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0063.001] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x167bd [0063.001] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1 [0063.001] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.001] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1673f, lpOverlapped=0x0) returned 1 [0063.007] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif") returned="bg_FormsHomePage.gif" [0063.007] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.007] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1673f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1673f, lpOverlapped=0x0) returned 1 [0063.008] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.008] CloseHandle (hObject=0x98) returned 1 [0063.008] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif.wannacry")) returned 1 [0063.010] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4ebb, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="bg_FormsHomePageBlank.gif", cAlternateFileName="BG_FOR~2.GIF")) returned 1 [0063.010] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.010] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_FormsHomePageBlank.gif") returned 1 [0063.010] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_FormsHomePageBlank.gif") returned 1 [0063.010] lstrcmpiA (lpString1="", lpString2="bg_FormsHomePageBlank.gif") returned -1 [0063.010] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif") returned="bg_FormsHomePage.gif" [0063.010] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.010] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.010] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.010] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.010] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_FormsHomePageBlank.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" [0063.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.zip") returned 0 [0063.010] lstrlenA (lpString="*.zip") returned 5 [0063.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.rar") returned 0 [0063.010] lstrlenA (lpString="*.rar") returned 5 [0063.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.7z") returned 0 [0063.010] lstrlenA (lpString="*.7z") returned 4 [0063.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.tar") returned 0 [0063.010] lstrlenA (lpString="*.tar") returned 5 [0063.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.gzip") returned 0 [0063.011] lstrlenA (lpString="*.gzip") returned 6 [0063.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.jpg") returned 0 [0063.011] lstrlenA (lpString="*.jpg") returned 5 [0063.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.jpeg") returned 0 [0063.011] lstrlenA (lpString="*.jpeg") returned 6 [0063.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.psd") returned 0 [0063.011] lstrlenA (lpString="*.psd") returned 5 [0063.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.gif") returned 1 [0063.011] lstrlenA (lpString="*.gif") returned 5 [0063.011] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" [0063.011] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" [0063.011] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif." [0063.011] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif.wannacry" [0063.011] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0063.012] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ebb [0063.012] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1 [0063.012] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.012] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4e3d, lpOverlapped=0x0) returned 1 [0063.015] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif") returned="bg_FormsHomePageBlank.gif" [0063.015] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.015] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4e3d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4e3d, lpOverlapped=0x0) returned 1 [0063.015] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.015] CloseHandle (hObject=0x98) returned 1 [0063.015] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif.wannacry")) returned 1 [0063.017] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x40f, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="bg_FormsHomePageSlice.gif", cAlternateFileName="BG_FOR~3.GIF")) returned 1 [0063.017] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.017] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_FormsHomePageSlice.gif") returned 1 [0063.017] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_FormsHomePageSlice.gif") returned 1 [0063.017] lstrcmpiA (lpString1="", lpString2="bg_FormsHomePageSlice.gif") returned -1 [0063.017] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif") returned="bg_FormsHomePageBlank.gif" [0063.017] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.017] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.017] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.017] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.017] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_FormsHomePageSlice.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" [0063.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.zip") returned 0 [0063.017] lstrlenA (lpString="*.zip") returned 5 [0063.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.rar") returned 0 [0063.017] lstrlenA (lpString="*.rar") returned 5 [0063.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.7z") returned 0 [0063.017] lstrlenA (lpString="*.7z") returned 4 [0063.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.tar") returned 0 [0063.017] lstrlenA (lpString="*.tar") returned 5 [0063.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.gzip") returned 0 [0063.017] lstrlenA (lpString="*.gzip") returned 6 [0063.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.jpg") returned 0 [0063.017] lstrlenA (lpString="*.jpg") returned 5 [0063.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.jpeg") returned 0 [0063.017] lstrlenA (lpString="*.jpeg") returned 6 [0063.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.psd") returned 0 [0063.017] lstrlenA (lpString="*.psd") returned 5 [0063.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.gif") returned 1 [0063.018] lstrlenA (lpString="*.gif") returned 5 [0063.018] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" [0063.018] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" [0063.018] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif." [0063.018] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif.wannacry" [0063.018] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0063.019] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40f [0063.019] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1 [0063.019] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.019] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x391, lpOverlapped=0x0) returned 1 [0063.020] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif") returned="bg_FormsHomePageSlice.gif" [0063.020] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.020] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x391, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x391, lpOverlapped=0x0) returned 1 [0063.020] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.020] CloseHandle (hObject=0x98) returned 1 [0063.021] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif.wannacry")) returned 1 [0063.022] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5690, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="bg_GreenTea.gif", cAlternateFileName="BG_GRE~1.GIF")) returned 1 [0063.022] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.022] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_GreenTea.gif") returned 1 [0063.022] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_GreenTea.gif") returned 1 [0063.022] lstrcmpiA (lpString1="", lpString2="bg_GreenTea.gif") returned -1 [0063.022] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif") returned="bg_FormsHomePageSlice.gif" [0063.022] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.022] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.022] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.022] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.022] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" [0063.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.zip") returned 0 [0063.022] lstrlenA (lpString="*.zip") returned 5 [0063.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.rar") returned 0 [0063.022] lstrlenA (lpString="*.rar") returned 5 [0063.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.7z") returned 0 [0063.022] lstrlenA (lpString="*.7z") returned 4 [0063.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.tar") returned 0 [0063.022] lstrlenA (lpString="*.tar") returned 5 [0063.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.gzip") returned 0 [0063.022] lstrlenA (lpString="*.gzip") returned 6 [0063.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.jpg") returned 0 [0063.022] lstrlenA (lpString="*.jpg") returned 5 [0063.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.jpeg") returned 0 [0063.022] lstrlenA (lpString="*.jpeg") returned 6 [0063.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.psd") returned 0 [0063.022] lstrlenA (lpString="*.psd") returned 5 [0063.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.gif") returned 1 [0063.022] lstrlenA (lpString="*.gif") returned 5 [0063.022] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" [0063.023] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" [0063.023] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif." [0063.023] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif.wannacry" [0063.023] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0063.023] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5690 [0063.023] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1 [0063.023] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.024] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x5612, lpOverlapped=0x0) returned 1 [0063.026] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif") returned="bg_GreenTea.gif" [0063.026] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.026] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x5612, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x5612, lpOverlapped=0x0) returned 1 [0063.026] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.026] CloseHandle (hObject=0x98) returned 1 [0063.026] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif.wannacry")) returned 1 [0063.027] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6a, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="bg_Groove.gif", cAlternateFileName="BG_GRO~1.GIF")) returned 1 [0063.027] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.028] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_Groove.gif") returned 1 [0063.028] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Groove.gif") returned 1 [0063.028] lstrcmpiA (lpString1="", lpString2="bg_Groove.gif") returned -1 [0063.028] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif") returned="bg_GreenTea.gif" [0063.028] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.028] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.028] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" [0063.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.zip") returned 0 [0063.028] lstrlenA (lpString="*.zip") returned 5 [0063.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.rar") returned 0 [0063.028] lstrlenA (lpString="*.rar") returned 5 [0063.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.7z") returned 0 [0063.028] lstrlenA (lpString="*.7z") returned 4 [0063.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.tar") returned 0 [0063.028] lstrlenA (lpString="*.tar") returned 5 [0063.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.gzip") returned 0 [0063.028] lstrlenA (lpString="*.gzip") returned 6 [0063.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.jpg") returned 0 [0063.028] lstrlenA (lpString="*.jpg") returned 5 [0063.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.jpeg") returned 0 [0063.028] lstrlenA (lpString="*.jpeg") returned 6 [0063.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.psd") returned 0 [0063.028] lstrlenA (lpString="*.psd") returned 5 [0063.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.gif") returned 1 [0063.029] lstrlenA (lpString="*.gif") returned 5 [0063.029] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" [0063.029] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" [0063.029] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif." [0063.029] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif.wannacry" [0063.029] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0063.029] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6a [0063.030] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1 [0063.030] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.030] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0063.030] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.030] CloseHandle (hObject=0x98) returned 1 [0063.030] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif.wannacry")) returned 1 [0063.031] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x21a6, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="bg_LightSpirit.gif", cAlternateFileName="BG_LIG~1.GIF")) returned 1 [0063.031] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.031] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_LightSpirit.gif") returned 1 [0063.031] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_LightSpirit.gif") returned 1 [0063.031] lstrcmpiA (lpString1="", lpString2="bg_LightSpirit.gif") returned -1 [0063.031] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif") returned="bg_Groove.gif" [0063.031] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.031] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.031] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.031] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.031] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" [0063.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.zip") returned 0 [0063.031] lstrlenA (lpString="*.zip") returned 5 [0063.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.rar") returned 0 [0063.031] lstrlenA (lpString="*.rar") returned 5 [0063.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.7z") returned 0 [0063.031] lstrlenA (lpString="*.7z") returned 4 [0063.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.tar") returned 0 [0063.032] lstrlenA (lpString="*.tar") returned 5 [0063.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.gzip") returned 0 [0063.032] lstrlenA (lpString="*.gzip") returned 6 [0063.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.jpg") returned 0 [0063.032] lstrlenA (lpString="*.jpg") returned 5 [0063.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.jpeg") returned 0 [0063.032] lstrlenA (lpString="*.jpeg") returned 6 [0063.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.psd") returned 0 [0063.032] lstrlenA (lpString="*.psd") returned 5 [0063.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.gif") returned 1 [0063.032] lstrlenA (lpString="*.gif") returned 5 [0063.032] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" [0063.032] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" [0063.032] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif." [0063.032] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif.wannacry" [0063.032] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0063.033] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x21a6 [0063.033] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1 [0063.033] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.033] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2128, lpOverlapped=0x0) returned 1 [0063.035] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif") returned="bg_LightSpirit.gif" [0063.035] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.035] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2128, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2128, lpOverlapped=0x0) returned 1 [0063.035] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.035] CloseHandle (hObject=0x98) returned 1 [0063.035] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif.wannacry")) returned 1 [0063.036] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3d57, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="bg_OliveGreen.gif", cAlternateFileName="BG_OLI~1.GIF")) returned 1 [0063.036] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.036] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_OliveGreen.gif") returned 1 [0063.036] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_OliveGreen.gif") returned 1 [0063.037] lstrcmpiA (lpString1="", lpString2="bg_OliveGreen.gif") returned -1 [0063.037] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif") returned="bg_LightSpirit.gif" [0063.037] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.037] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.037] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.037] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.037] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" [0063.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.zip") returned 0 [0063.037] lstrlenA (lpString="*.zip") returned 5 [0063.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.rar") returned 0 [0063.037] lstrlenA (lpString="*.rar") returned 5 [0063.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.7z") returned 0 [0063.037] lstrlenA (lpString="*.7z") returned 4 [0063.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.tar") returned 0 [0063.037] lstrlenA (lpString="*.tar") returned 5 [0063.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.gzip") returned 0 [0063.037] lstrlenA (lpString="*.gzip") returned 6 [0063.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.jpg") returned 0 [0063.037] lstrlenA (lpString="*.jpg") returned 5 [0063.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.jpeg") returned 0 [0063.037] lstrlenA (lpString="*.jpeg") returned 6 [0063.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.psd") returned 0 [0063.037] lstrlenA (lpString="*.psd") returned 5 [0063.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.gif") returned 1 [0063.037] lstrlenA (lpString="*.gif") returned 5 [0063.037] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" [0063.037] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" [0063.037] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif." [0063.037] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif.wannacry" [0063.037] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0063.038] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d57 [0063.038] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1 [0063.038] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.038] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3cd9, lpOverlapped=0x0) returned 1 [0063.040] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif") returned="bg_OliveGreen.gif" [0063.040] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.040] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3cd9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3cd9, lpOverlapped=0x0) returned 1 [0063.040] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.040] CloseHandle (hObject=0x98) returned 1 [0063.041] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif.wannacry")) returned 1 [0063.041] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1845, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="bg_Premium.gif", cAlternateFileName="BG_PRE~1.GIF")) returned 1 [0063.041] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.041] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_Premium.gif") returned 1 [0063.041] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Premium.gif") returned 1 [0063.041] lstrcmpiA (lpString1="", lpString2="bg_Premium.gif") returned -1 [0063.041] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif") returned="bg_OliveGreen.gif" [0063.042] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.042] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.042] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.042] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.042] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" [0063.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.zip") returned 0 [0063.042] lstrlenA (lpString="*.zip") returned 5 [0063.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.rar") returned 0 [0063.042] lstrlenA (lpString="*.rar") returned 5 [0063.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.7z") returned 0 [0063.042] lstrlenA (lpString="*.7z") returned 4 [0063.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.tar") returned 0 [0063.042] lstrlenA (lpString="*.tar") returned 5 [0063.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.gzip") returned 0 [0063.042] lstrlenA (lpString="*.gzip") returned 6 [0063.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.jpg") returned 0 [0063.042] lstrlenA (lpString="*.jpg") returned 5 [0063.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.jpeg") returned 0 [0063.042] lstrlenA (lpString="*.jpeg") returned 6 [0063.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.psd") returned 0 [0063.042] lstrlenA (lpString="*.psd") returned 5 [0063.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.gif") returned 1 [0063.042] lstrlenA (lpString="*.gif") returned 5 [0063.042] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" [0063.042] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" [0063.042] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif." [0063.042] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif.wannacry" [0063.042] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0063.043] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1845 [0063.043] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1 [0063.043] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.043] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x17c7, lpOverlapped=0x0) returned 1 [0063.045] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif") returned="bg_Premium.gif" [0063.045] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.045] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x17c7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x17c7, lpOverlapped=0x0) returned 1 [0063.045] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.045] CloseHandle (hObject=0x98) returned 1 [0063.045] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif.wannacry")) returned 1 [0063.046] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5141, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="bg_SlateBlue.gif", cAlternateFileName="BG_SLA~1.GIF")) returned 1 [0063.046] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.046] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_SlateBlue.gif") returned 1 [0063.046] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_SlateBlue.gif") returned 1 [0063.046] lstrcmpiA (lpString1="", lpString2="bg_SlateBlue.gif") returned -1 [0063.046] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif") returned="bg_Premium.gif" [0063.046] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.046] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.046] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.046] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.046] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" [0063.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.zip") returned 0 [0063.046] lstrlenA (lpString="*.zip") returned 5 [0063.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.rar") returned 0 [0063.046] lstrlenA (lpString="*.rar") returned 5 [0063.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.7z") returned 0 [0063.046] lstrlenA (lpString="*.7z") returned 4 [0063.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.tar") returned 0 [0063.046] lstrlenA (lpString="*.tar") returned 5 [0063.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.gzip") returned 0 [0063.046] lstrlenA (lpString="*.gzip") returned 6 [0063.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.jpg") returned 0 [0063.046] lstrlenA (lpString="*.jpg") returned 5 [0063.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.jpeg") returned 0 [0063.046] lstrlenA (lpString="*.jpeg") returned 6 [0063.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.psd") returned 0 [0063.046] lstrlenA (lpString="*.psd") returned 5 [0063.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.gif") returned 1 [0063.047] lstrlenA (lpString="*.gif") returned 5 [0063.047] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" [0063.047] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" [0063.047] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif." [0063.047] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif.wannacry" [0063.047] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0063.047] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5141 [0063.047] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1 [0063.047] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.047] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x50c3, lpOverlapped=0x0) returned 1 [0063.049] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif") returned="bg_SlateBlue.gif" [0063.049] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.049] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x50c3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x50c3, lpOverlapped=0x0) returned 1 [0063.049] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.049] CloseHandle (hObject=0x98) returned 1 [0063.049] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif.wannacry")) returned 1 [0063.050] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x193c, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="bg_TexturedBlue.gif", cAlternateFileName="BG_TEX~1.GIF")) returned 1 [0063.050] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.050] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_TexturedBlue.gif") returned 1 [0063.051] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_TexturedBlue.gif") returned 1 [0063.051] lstrcmpiA (lpString1="", lpString2="bg_TexturedBlue.gif") returned -1 [0063.051] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif") returned="bg_SlateBlue.gif" [0063.051] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.051] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.051] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.052] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.052] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" [0063.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.zip") returned 0 [0063.052] lstrlenA (lpString="*.zip") returned 5 [0063.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.rar") returned 0 [0063.052] lstrlenA (lpString="*.rar") returned 5 [0063.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.7z") returned 0 [0063.052] lstrlenA (lpString="*.7z") returned 4 [0063.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.tar") returned 0 [0063.053] lstrlenA (lpString="*.tar") returned 5 [0063.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.gzip") returned 0 [0063.053] lstrlenA (lpString="*.gzip") returned 6 [0063.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.jpg") returned 0 [0063.053] lstrlenA (lpString="*.jpg") returned 5 [0063.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.jpeg") returned 0 [0063.053] lstrlenA (lpString="*.jpeg") returned 6 [0063.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.psd") returned 0 [0063.053] lstrlenA (lpString="*.psd") returned 5 [0063.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.gif") returned 1 [0063.053] lstrlenA (lpString="*.gif") returned 5 [0063.053] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" [0063.053] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" [0063.053] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif." [0063.053] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif.wannacry" [0063.053] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0063.054] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x193c [0063.054] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1 [0063.054] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.054] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x18be, lpOverlapped=0x0) returned 1 [0063.056] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif") returned="bg_TexturedBlue.gif" [0063.056] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.056] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x18be, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x18be, lpOverlapped=0x0) returned 1 [0063.056] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.056] CloseHandle (hObject=0x98) returned 1 [0063.056] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif.wannacry")) returned 1 [0063.057] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3c64, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="bg_VelvetRose.gif", cAlternateFileName="BG_VEL~1.GIF")) returned 1 [0063.057] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.057] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg_VelvetRose.gif") returned 1 [0063.057] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_VelvetRose.gif") returned 1 [0063.057] lstrcmpiA (lpString1="", lpString2="bg_VelvetRose.gif") returned -1 [0063.057] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif") returned="bg_TexturedBlue.gif" [0063.057] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.057] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.057] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" [0063.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.zip") returned 0 [0063.058] lstrlenA (lpString="*.zip") returned 5 [0063.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.rar") returned 0 [0063.058] lstrlenA (lpString="*.rar") returned 5 [0063.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.7z") returned 0 [0063.058] lstrlenA (lpString="*.7z") returned 4 [0063.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.tar") returned 0 [0063.058] lstrlenA (lpString="*.tar") returned 5 [0063.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.gzip") returned 0 [0063.058] lstrlenA (lpString="*.gzip") returned 6 [0063.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.jpg") returned 0 [0063.058] lstrlenA (lpString="*.jpg") returned 5 [0063.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.jpeg") returned 0 [0063.058] lstrlenA (lpString="*.jpeg") returned 6 [0063.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.psd") returned 0 [0063.058] lstrlenA (lpString="*.psd") returned 5 [0063.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.gif") returned 1 [0063.058] lstrlenA (lpString="*.gif") returned 5 [0063.058] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" [0063.058] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" [0063.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif." [0063.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif.wannacry" [0063.058] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0063.060] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c64 [0063.060] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1 [0063.060] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.060] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3be6, lpOverlapped=0x0) returned 1 [0063.062] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif") returned="bg_VelvetRose.gif" [0063.062] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.062] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3be6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3be6, lpOverlapped=0x0) returned 1 [0063.062] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.062] CloseHandle (hObject=0x98) returned 1 [0063.063] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif.wannacry")) returned 1 [0063.064] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="button_left.gif", cAlternateFileName="BUTTON~1.GIF")) returned 1 [0063.064] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.064] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="button_left.gif") returned 1 [0063.064] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_left.gif") returned 1 [0063.064] lstrcmpiA (lpString1="", lpString2="button_left.gif") returned -1 [0063.064] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif") returned="bg_VelvetRose.gif" [0063.064] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.064] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.064] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.064] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.064] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="button_left.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" [0063.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.zip") returned 0 [0063.064] lstrlenA (lpString="*.zip") returned 5 [0063.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.rar") returned 0 [0063.064] lstrlenA (lpString="*.rar") returned 5 [0063.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.7z") returned 0 [0063.064] lstrlenA (lpString="*.7z") returned 4 [0063.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.tar") returned 0 [0063.064] lstrlenA (lpString="*.tar") returned 5 [0063.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.gzip") returned 0 [0063.064] lstrlenA (lpString="*.gzip") returned 6 [0063.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.jpg") returned 0 [0063.064] lstrlenA (lpString="*.jpg") returned 5 [0063.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.jpeg") returned 0 [0063.065] lstrlenA (lpString="*.jpeg") returned 6 [0063.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.psd") returned 0 [0063.065] lstrlenA (lpString="*.psd") returned 5 [0063.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.gif") returned 1 [0063.065] lstrlenA (lpString="*.gif") returned 5 [0063.065] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" [0063.065] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" [0063.065] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif." [0063.065] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif.wannacry" [0063.065] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0063.065] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x171 [0063.065] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b6c470, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1 [0063.066] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.066] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xf3, lpOverlapped=0x0) returned 1 [0063.066] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif") returned="button_left.gif" [0063.066] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.067] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xf3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xf3, lpOverlapped=0x0) returned 1 [0063.067] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.067] CloseHandle (hObject=0x98) returned 1 [0063.067] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif.wannacry")) returned 1 [0063.068] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x176, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="button_left_over.gif", cAlternateFileName="BUTTON~2.GIF")) returned 1 [0063.068] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.068] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="button_left_over.gif") returned 1 [0063.068] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_left_over.gif") returned 1 [0063.068] lstrcmpiA (lpString1="", lpString2="button_left_over.gif") returned -1 [0063.068] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif") returned="button_left.gif" [0063.068] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.068] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.068] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.068] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.068] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="button_left_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" [0063.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.zip") returned 0 [0063.068] lstrlenA (lpString="*.zip") returned 5 [0063.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.rar") returned 0 [0063.068] lstrlenA (lpString="*.rar") returned 5 [0063.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.7z") returned 0 [0063.068] lstrlenA (lpString="*.7z") returned 4 [0063.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.tar") returned 0 [0063.068] lstrlenA (lpString="*.tar") returned 5 [0063.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.gzip") returned 0 [0063.068] lstrlenA (lpString="*.gzip") returned 6 [0063.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.jpg") returned 0 [0063.069] lstrlenA (lpString="*.jpg") returned 5 [0063.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.jpeg") returned 0 [0063.069] lstrlenA (lpString="*.jpeg") returned 6 [0063.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.psd") returned 0 [0063.069] lstrlenA (lpString="*.psd") returned 5 [0063.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.gif") returned 1 [0063.069] lstrlenA (lpString="*.gif") returned 5 [0063.069] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" [0063.069] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" [0063.069] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif." [0063.069] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif.wannacry" [0063.069] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0063.069] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x176 [0063.069] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b6c470, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea)) returned 1 [0063.069] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.070] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xf8, lpOverlapped=0x0) returned 1 [0063.070] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif") returned="button_left_over.gif" [0063.070] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.070] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xf8, lpOverlapped=0x0) returned 1 [0063.071] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.071] CloseHandle (hObject=0x98) returned 1 [0063.071] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif.wannacry")) returned 1 [0063.072] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb5, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="button_mid.gif", cAlternateFileName="BUTTON~3.GIF")) returned 1 [0063.072] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.072] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="button_mid.gif") returned 1 [0063.072] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_mid.gif") returned 1 [0063.072] lstrcmpiA (lpString1="", lpString2="button_mid.gif") returned -1 [0063.072] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif") returned="button_left_over.gif" [0063.072] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.072] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.072] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.072] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.072] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="button_mid.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" [0063.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.zip") returned 0 [0063.072] lstrlenA (lpString="*.zip") returned 5 [0063.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.rar") returned 0 [0063.072] lstrlenA (lpString="*.rar") returned 5 [0063.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.7z") returned 0 [0063.072] lstrlenA (lpString="*.7z") returned 4 [0063.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.tar") returned 0 [0063.072] lstrlenA (lpString="*.tar") returned 5 [0063.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.gzip") returned 0 [0063.072] lstrlenA (lpString="*.gzip") returned 6 [0063.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.jpg") returned 0 [0063.072] lstrlenA (lpString="*.jpg") returned 5 [0063.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.jpeg") returned 0 [0063.072] lstrlenA (lpString="*.jpeg") returned 6 [0063.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.psd") returned 0 [0063.072] lstrlenA (lpString="*.psd") returned 5 [0063.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.gif") returned 1 [0063.072] lstrlenA (lpString="*.gif") returned 5 [0063.072] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" [0063.073] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" [0063.073] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif." [0063.073] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif.wannacry" [0063.073] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0063.073] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb5 [0063.073] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b925d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea)) returned 1 [0063.073] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.073] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x37, lpOverlapped=0x0) returned 1 [0063.074] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif") returned="button_mid.gif" [0063.075] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.075] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x37, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x37, lpOverlapped=0x0) returned 1 [0063.075] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.075] CloseHandle (hObject=0x98) returned 1 [0063.075] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif.wannacry")) returned 1 [0063.076] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="button_mid_over.gif", cAlternateFileName="BU1E84~1.GIF")) returned 1 [0063.076] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.076] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="button_mid_over.gif") returned 1 [0063.076] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_mid_over.gif") returned 1 [0063.076] lstrcmpiA (lpString1="", lpString2="button_mid_over.gif") returned -1 [0063.076] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif") returned="button_mid.gif" [0063.076] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.076] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.076] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.076] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.076] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="button_mid_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" [0063.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.zip") returned 0 [0063.076] lstrlenA (lpString="*.zip") returned 5 [0063.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.rar") returned 0 [0063.076] lstrlenA (lpString="*.rar") returned 5 [0063.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.7z") returned 0 [0063.076] lstrlenA (lpString="*.7z") returned 4 [0063.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.tar") returned 0 [0063.076] lstrlenA (lpString="*.tar") returned 5 [0063.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.gzip") returned 0 [0063.076] lstrlenA (lpString="*.gzip") returned 6 [0063.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.jpg") returned 0 [0063.077] lstrlenA (lpString="*.jpg") returned 5 [0063.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.jpeg") returned 0 [0063.077] lstrlenA (lpString="*.jpeg") returned 6 [0063.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.psd") returned 0 [0063.077] lstrlenA (lpString="*.psd") returned 5 [0063.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.gif") returned 1 [0063.077] lstrlenA (lpString="*.gif") returned 5 [0063.077] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" [0063.077] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" [0063.077] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif." [0063.077] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif.wannacry" [0063.077] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0063.077] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb7 [0063.077] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60120f70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea)) returned 1 [0063.078] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.078] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x39, lpOverlapped=0x0) returned 1 [0063.079] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif") returned="button_mid_over.gif" [0063.079] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.079] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x39, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x39, lpOverlapped=0x0) returned 1 [0063.079] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.079] CloseHandle (hObject=0x98) returned 1 [0063.079] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif.wannacry")) returned 1 [0063.081] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="button_right.gif", cAlternateFileName="BUTTON~4.GIF")) returned 1 [0063.081] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.081] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="button_right.gif") returned 1 [0063.081] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_right.gif") returned 1 [0063.082] lstrcmpiA (lpString1="", lpString2="button_right.gif") returned -1 [0063.082] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif") returned="button_mid_over.gif" [0063.082] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.082] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.082] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.082] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.082] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="button_right.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" [0063.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.zip") returned 0 [0063.082] lstrlenA (lpString="*.zip") returned 5 [0063.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.rar") returned 0 [0063.082] lstrlenA (lpString="*.rar") returned 5 [0063.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.7z") returned 0 [0063.082] lstrlenA (lpString="*.7z") returned 4 [0063.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.tar") returned 0 [0063.082] lstrlenA (lpString="*.tar") returned 5 [0063.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.gzip") returned 0 [0063.083] lstrlenA (lpString="*.gzip") returned 6 [0063.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.jpg") returned 0 [0063.083] lstrlenA (lpString="*.jpg") returned 5 [0063.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.jpeg") returned 0 [0063.083] lstrlenA (lpString="*.jpeg") returned 6 [0063.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.psd") returned 0 [0063.083] lstrlenA (lpString="*.psd") returned 5 [0063.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.gif") returned 1 [0063.083] lstrlenA (lpString="*.gif") returned 5 [0063.083] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" [0063.083] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" [0063.083] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif." [0063.083] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif.wannacry" [0063.083] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0063.084] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x171 [0063.084] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b925d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea)) returned 1 [0063.084] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.084] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xf3, lpOverlapped=0x0) returned 1 [0063.085] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif") returned="button_right.gif" [0063.085] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.085] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xf3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xf3, lpOverlapped=0x0) returned 1 [0063.085] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.085] CloseHandle (hObject=0x98) returned 1 [0063.085] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif.wannacry")) returned 1 [0063.086] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="button_right_over.gif", cAlternateFileName="BU4B4E~1.GIF")) returned 1 [0063.086] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.086] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="button_right_over.gif") returned 1 [0063.086] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_right_over.gif") returned 1 [0063.086] lstrcmpiA (lpString1="", lpString2="button_right_over.gif") returned -1 [0063.086] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif") returned="button_right.gif" [0063.086] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.086] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.086] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.086] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.086] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="button_right_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" [0063.086] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.zip") returned 0 [0063.087] lstrlenA (lpString="*.zip") returned 5 [0063.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.rar") returned 0 [0063.087] lstrlenA (lpString="*.rar") returned 5 [0063.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.7z") returned 0 [0063.087] lstrlenA (lpString="*.7z") returned 4 [0063.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.tar") returned 0 [0063.087] lstrlenA (lpString="*.tar") returned 5 [0063.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.gzip") returned 0 [0063.087] lstrlenA (lpString="*.gzip") returned 6 [0063.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.jpg") returned 0 [0063.087] lstrlenA (lpString="*.jpg") returned 5 [0063.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.jpeg") returned 0 [0063.087] lstrlenA (lpString="*.jpeg") returned 6 [0063.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.psd") returned 0 [0063.087] lstrlenA (lpString="*.psd") returned 5 [0063.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.gif") returned 1 [0063.087] lstrlenA (lpString="*.gif") returned 5 [0063.087] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" [0063.087] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" [0063.087] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif." [0063.087] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif.wannacry" [0063.087] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0063.088] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x244 [0063.088] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b925d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea)) returned 1 [0063.088] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.088] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1c6, lpOverlapped=0x0) returned 1 [0063.089] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif") returned="button_right_over.gif" [0063.089] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.089] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1c6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1c6, lpOverlapped=0x0) returned 1 [0063.089] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.090] CloseHandle (hObject=0x98) returned 1 [0063.090] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif.wannacry")) returned 1 [0063.090] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="CALENDAR.GIF", cAlternateFileName="")) returned 1 [0063.090] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.090] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CALENDAR.GIF") returned 1 [0063.090] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CALENDAR.GIF") returned 1 [0063.090] lstrcmpiA (lpString1="", lpString2="CALENDAR.GIF") returned -1 [0063.090] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif") returned="button_right_over.gif" [0063.090] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.091] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.091] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.091] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.091] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="CALENDAR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF" [0063.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.zip") returned 0 [0063.091] lstrlenA (lpString="*.zip") returned 5 [0063.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.rar") returned 0 [0063.091] lstrlenA (lpString="*.rar") returned 5 [0063.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.7z") returned 0 [0063.091] lstrlenA (lpString="*.7z") returned 4 [0063.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.tar") returned 0 [0063.091] lstrlenA (lpString="*.tar") returned 5 [0063.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.gzip") returned 0 [0063.091] lstrlenA (lpString="*.gzip") returned 6 [0063.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.jpg") returned 0 [0063.091] lstrlenA (lpString="*.jpg") returned 5 [0063.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.jpeg") returned 0 [0063.091] lstrlenA (lpString="*.jpeg") returned 6 [0063.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.psd") returned 0 [0063.091] lstrlenA (lpString="*.psd") returned 5 [0063.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.gif") returned 1 [0063.091] lstrlenA (lpString="*.gif") returned 5 [0063.091] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF" [0063.091] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF" [0063.091] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF." [0063.091] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF.wannacry" [0063.091] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\calendar.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0063.092] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x383 [0063.092] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51bb8730, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea)) returned 1 [0063.092] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.092] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x305, lpOverlapped=0x0) returned 1 [0063.094] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF") returned="CALENDAR.GIF" [0063.094] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.094] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x305, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x305, lpOverlapped=0x0) returned 1 [0063.094] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.094] CloseHandle (hObject=0x98) returned 1 [0063.094] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\calendar.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\calendar.gif.wannacry")) returned 1 [0063.095] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="DELETE.GIF", cAlternateFileName="")) returned 1 [0063.095] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.095] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DELETE.GIF") returned 1 [0063.095] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DELETE.GIF") returned 1 [0063.095] lstrcmpiA (lpString1="", lpString2="DELETE.GIF") returned -1 [0063.095] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF") returned="CALENDAR.GIF" [0063.095] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.095] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.096] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.096] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.096] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="DELETE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF" [0063.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.zip") returned 0 [0063.096] lstrlenA (lpString="*.zip") returned 5 [0063.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.rar") returned 0 [0063.096] lstrlenA (lpString="*.rar") returned 5 [0063.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.7z") returned 0 [0063.096] lstrlenA (lpString="*.7z") returned 4 [0063.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.tar") returned 0 [0063.096] lstrlenA (lpString="*.tar") returned 5 [0063.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.gzip") returned 0 [0063.096] lstrlenA (lpString="*.gzip") returned 6 [0063.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.jpg") returned 0 [0063.096] lstrlenA (lpString="*.jpg") returned 5 [0063.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.jpeg") returned 0 [0063.096] lstrlenA (lpString="*.jpeg") returned 6 [0063.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.psd") returned 0 [0063.096] lstrlenA (lpString="*.psd") returned 5 [0063.096] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.gif") returned 1 [0063.096] lstrlenA (lpString="*.gif") returned 5 [0063.097] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF" [0063.097] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF" [0063.097] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF." [0063.097] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF.wannacry" [0063.097] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\delete.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0063.097] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x271 [0063.097] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60760930, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea)) returned 1 [0063.097] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.097] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1f3, lpOverlapped=0x0) returned 1 [0063.099] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF") returned="DELETE.GIF" [0063.099] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.099] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1f3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1f3, lpOverlapped=0x0) returned 1 [0063.099] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.099] CloseHandle (hObject=0x98) returned 1 [0063.099] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\delete.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\delete.gif.wannacry")) returned 1 [0063.101] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x369, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="ERROR.GIF", cAlternateFileName="")) returned 1 [0063.101] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.101] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ERROR.GIF") returned -1 [0063.101] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ERROR.GIF") returned 1 [0063.101] lstrcmpiA (lpString1="", lpString2="ERROR.GIF") returned -1 [0063.101] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF") returned="DELETE.GIF" [0063.101] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.101] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.101] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.101] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.101] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="ERROR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF" [0063.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.zip") returned 0 [0063.101] lstrlenA (lpString="*.zip") returned 5 [0063.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.rar") returned 0 [0063.102] lstrlenA (lpString="*.rar") returned 5 [0063.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.7z") returned 0 [0063.102] lstrlenA (lpString="*.7z") returned 4 [0063.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.tar") returned 0 [0063.102] lstrlenA (lpString="*.tar") returned 5 [0063.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.gzip") returned 0 [0063.102] lstrlenA (lpString="*.gzip") returned 6 [0063.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.jpg") returned 0 [0063.102] lstrlenA (lpString="*.jpg") returned 5 [0063.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.jpeg") returned 0 [0063.102] lstrlenA (lpString="*.jpeg") returned 6 [0063.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.psd") returned 0 [0063.102] lstrlenA (lpString="*.psd") returned 5 [0063.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.gif") returned 1 [0063.102] lstrlenA (lpString="*.gif") returned 5 [0063.102] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF" [0063.102] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF" [0063.102] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF." [0063.102] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF.wannacry" [0063.102] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\error.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0063.104] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x369 [0063.104] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51fe2db0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea)) returned 1 [0063.104] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.104] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2eb, lpOverlapped=0x0) returned 1 [0063.106] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF") returned="ERROR.GIF" [0063.106] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.106] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2eb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2eb, lpOverlapped=0x0) returned 1 [0063.106] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.106] CloseHandle (hObject=0x98) returned 1 [0063.106] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\error.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\error.gif.wannacry")) returned 1 [0063.107] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="FORM.ICO", cAlternateFileName="")) returned 1 [0063.107] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.108] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FORM.ICO") returned -1 [0063.108] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FORM.ICO") returned 1 [0063.108] lstrcmpiA (lpString1="", lpString2="FORM.ICO") returned -1 [0063.108] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF") returned="ERROR.GIF" [0063.108] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.108] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.108] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.108] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.108] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FORM.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO" [0063.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.zip") returned 0 [0063.108] lstrlenA (lpString="*.zip") returned 5 [0063.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.rar") returned 0 [0063.108] lstrlenA (lpString="*.rar") returned 5 [0063.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.7z") returned 0 [0063.108] lstrlenA (lpString="*.7z") returned 4 [0063.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.tar") returned 0 [0063.108] lstrlenA (lpString="*.tar") returned 5 [0063.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.gzip") returned 0 [0063.108] lstrlenA (lpString="*.gzip") returned 6 [0063.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.jpg") returned 0 [0063.108] lstrlenA (lpString="*.jpg") returned 5 [0063.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.jpeg") returned 0 [0063.108] lstrlenA (lpString="*.jpeg") returned 6 [0063.108] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.psd") returned 0 [0063.109] lstrlenA (lpString="*.psd") returned 5 [0063.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.gif") returned 0 [0063.109] lstrlenA (lpString="*.gif") returned 5 [0063.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.doc") returned 0 [0063.109] lstrlenA (lpString="*.doc") returned 5 [0063.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.docx") returned 0 [0063.109] lstrlenA (lpString="*.docx") returned 6 [0063.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.xls") returned 0 [0063.109] lstrlenA (lpString="*.xls") returned 5 [0063.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.xlsx") returned 0 [0063.109] lstrlenA (lpString="*.xlsx") returned 6 [0063.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.ppt") returned 0 [0063.109] lstrlenA (lpString="*.ppt") returned 5 [0063.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.pptx") returned 0 [0063.109] lstrlenA (lpString="*.pptx") returned 6 [0063.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.pdf") returned 0 [0063.109] lstrlenA (lpString="*.pdf") returned 5 [0063.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.mov") returned 0 [0063.109] lstrlenA (lpString="*.mov") returned 5 [0063.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.m2v") returned 0 [0063.109] lstrlenA (lpString="*.m2v") returned 5 [0063.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.3gp") returned 0 [0063.109] lstrlenA (lpString="*.3gp") returned 5 [0063.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.mpeg") returned 0 [0063.109] lstrlenA (lpString="*.mpeg") returned 6 [0063.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.mpg") returned 0 [0063.109] lstrlenA (lpString="*.mpg") returned 5 [0063.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.flv") returned 0 [0063.110] lstrlenA (lpString="*.flv") returned 5 [0063.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.avi") returned 0 [0063.110] lstrlenA (lpString="*.avi") returned 5 [0063.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.mp4") returned 0 [0063.110] lstrlenA (lpString="*.mp4") returned 5 [0063.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.wmv") returned 0 [0063.110] lstrlenA (lpString="*.wmv") returned 5 [0063.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.divx") returned 0 [0063.110] lstrlenA (lpString="*.divx") returned 6 [0063.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.mkv") returned 0 [0063.110] lstrlenA (lpString="*.mkv") returned 5 [0063.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.mp3") returned 0 [0063.110] lstrlenA (lpString="*.mp3") returned 5 [0063.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.wav") returned 0 [0063.110] lstrlenA (lpString="*.wav") returned 5 [0063.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.flac") returned 0 [0063.110] lstrlenA (lpString="*.flac") returned 6 [0063.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.ape") returned 0 [0063.110] lstrlenA (lpString="*.ape") returned 5 [0063.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.wma") returned 0 [0063.110] lstrlenA (lpString="*.wma") returned 5 [0063.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.ac3") returned 0 [0063.110] lstrlenA (lpString="*.ac3") returned 5 [0063.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.mxf") returned 0 [0063.110] lstrlenA (lpString="*.mxf") returned 5 [0063.110] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x135f4, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FORM.JS", cAlternateFileName="")) returned 1 [0063.111] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.111] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FORM.JS") returned -1 [0063.111] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FORM.JS") returned 1 [0063.111] lstrcmpiA (lpString1="", lpString2="FORM.JS") returned -1 [0063.111] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO") returned="FORM.ICO" [0063.111] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.111] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.111] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.111] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.111] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FORM.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS" [0063.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.zip") returned 0 [0063.111] lstrlenA (lpString="*.zip") returned 5 [0063.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.rar") returned 0 [0063.111] lstrlenA (lpString="*.rar") returned 5 [0063.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.7z") returned 0 [0063.111] lstrlenA (lpString="*.7z") returned 4 [0063.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.tar") returned 0 [0063.111] lstrlenA (lpString="*.tar") returned 5 [0063.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.gzip") returned 0 [0063.111] lstrlenA (lpString="*.gzip") returned 6 [0063.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.jpg") returned 0 [0063.111] lstrlenA (lpString="*.jpg") returned 5 [0063.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.jpeg") returned 0 [0063.112] lstrlenA (lpString="*.jpeg") returned 6 [0063.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.psd") returned 0 [0063.112] lstrlenA (lpString="*.psd") returned 5 [0063.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.gif") returned 0 [0063.112] lstrlenA (lpString="*.gif") returned 5 [0063.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.doc") returned 0 [0063.112] lstrlenA (lpString="*.doc") returned 5 [0063.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.docx") returned 0 [0063.112] lstrlenA (lpString="*.docx") returned 6 [0063.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.xls") returned 0 [0063.112] lstrlenA (lpString="*.xls") returned 5 [0063.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.xlsx") returned 0 [0063.112] lstrlenA (lpString="*.xlsx") returned 6 [0063.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.ppt") returned 0 [0063.112] lstrlenA (lpString="*.ppt") returned 5 [0063.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.pptx") returned 0 [0063.112] lstrlenA (lpString="*.pptx") returned 6 [0063.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.pdf") returned 0 [0063.112] lstrlenA (lpString="*.pdf") returned 5 [0063.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.mov") returned 0 [0063.113] lstrlenA (lpString="*.mov") returned 5 [0063.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.m2v") returned 0 [0063.113] lstrlenA (lpString="*.m2v") returned 5 [0063.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.3gp") returned 0 [0063.113] lstrlenA (lpString="*.3gp") returned 5 [0063.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.mpeg") returned 0 [0063.113] lstrlenA (lpString="*.mpeg") returned 6 [0063.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.mpg") returned 0 [0063.113] lstrlenA (lpString="*.mpg") returned 5 [0063.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.flv") returned 0 [0063.113] lstrlenA (lpString="*.flv") returned 5 [0063.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.avi") returned 0 [0063.113] lstrlenA (lpString="*.avi") returned 5 [0063.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.mp4") returned 0 [0063.113] lstrlenA (lpString="*.mp4") returned 5 [0063.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.wmv") returned 0 [0063.113] lstrlenA (lpString="*.wmv") returned 5 [0063.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.divx") returned 0 [0063.113] lstrlenA (lpString="*.divx") returned 6 [0063.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.mkv") returned 0 [0063.113] lstrlenA (lpString="*.mkv") returned 5 [0063.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.mp3") returned 0 [0063.113] lstrlenA (lpString="*.mp3") returned 5 [0063.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.wav") returned 0 [0063.113] lstrlenA (lpString="*.wav") returned 5 [0063.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.flac") returned 0 [0063.113] lstrlenA (lpString="*.flac") returned 6 [0063.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.ape") returned 0 [0063.114] lstrlenA (lpString="*.ape") returned 5 [0063.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.wma") returned 0 [0063.114] lstrlenA (lpString="*.wma") returned 5 [0063.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.ac3") returned 0 [0063.114] lstrlenA (lpString="*.ac3") returned 5 [0063.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.mxf") returned 0 [0063.114] lstrlenA (lpString="*.mxf") returned 5 [0063.114] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x45f, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsBlankPage.html", cAlternateFileName="FORMSB~1.HTM")) returned 1 [0063.114] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.114] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsBlankPage.html") returned -1 [0063.114] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsBlankPage.html") returned 1 [0063.114] lstrcmpiA (lpString1="", lpString2="FormsBlankPage.html") returned -1 [0063.114] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS") returned="FORM.JS" [0063.114] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.114] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.114] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.114] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.114] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html" [0063.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.zip") returned 0 [0063.114] lstrlenA (lpString="*.zip") returned 5 [0063.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.rar") returned 0 [0063.114] lstrlenA (lpString="*.rar") returned 5 [0063.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.7z") returned 0 [0063.115] lstrlenA (lpString="*.7z") returned 4 [0063.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.tar") returned 0 [0063.115] lstrlenA (lpString="*.tar") returned 5 [0063.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.gzip") returned 0 [0063.115] lstrlenA (lpString="*.gzip") returned 6 [0063.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.jpg") returned 0 [0063.115] lstrlenA (lpString="*.jpg") returned 5 [0063.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.jpeg") returned 0 [0063.115] lstrlenA (lpString="*.jpeg") returned 6 [0063.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.psd") returned 0 [0063.115] lstrlenA (lpString="*.psd") returned 5 [0063.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.gif") returned 0 [0063.115] lstrlenA (lpString="*.gif") returned 5 [0063.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.doc") returned 0 [0063.115] lstrlenA (lpString="*.doc") returned 5 [0063.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.docx") returned 0 [0063.115] lstrlenA (lpString="*.docx") returned 6 [0063.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.xls") returned 0 [0063.115] lstrlenA (lpString="*.xls") returned 5 [0063.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.xlsx") returned 0 [0063.115] lstrlenA (lpString="*.xlsx") returned 6 [0063.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.ppt") returned 0 [0063.115] lstrlenA (lpString="*.ppt") returned 5 [0063.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.pptx") returned 0 [0063.115] lstrlenA (lpString="*.pptx") returned 6 [0063.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.pdf") returned 0 [0063.115] lstrlenA (lpString="*.pdf") returned 5 [0063.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.mov") returned 0 [0063.115] lstrlenA (lpString="*.mov") returned 5 [0063.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.m2v") returned 0 [0063.115] lstrlenA (lpString="*.m2v") returned 5 [0063.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.3gp") returned 0 [0063.115] lstrlenA (lpString="*.3gp") returned 5 [0063.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.mpeg") returned 0 [0063.116] lstrlenA (lpString="*.mpeg") returned 6 [0063.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.mpg") returned 0 [0063.116] lstrlenA (lpString="*.mpg") returned 5 [0063.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.flv") returned 0 [0063.116] lstrlenA (lpString="*.flv") returned 5 [0063.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.avi") returned 0 [0063.116] lstrlenA (lpString="*.avi") returned 5 [0063.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.mp4") returned 0 [0063.116] lstrlenA (lpString="*.mp4") returned 5 [0063.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.wmv") returned 0 [0063.116] lstrlenA (lpString="*.wmv") returned 5 [0063.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.divx") returned 0 [0063.116] lstrlenA (lpString="*.divx") returned 6 [0063.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.mkv") returned 0 [0063.116] lstrlenA (lpString="*.mkv") returned 5 [0063.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.mp3") returned 0 [0063.116] lstrlenA (lpString="*.mp3") returned 5 [0063.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.wav") returned 0 [0063.116] lstrlenA (lpString="*.wav") returned 5 [0063.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.flac") returned 0 [0063.116] lstrlenA (lpString="*.flac") returned 6 [0063.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.ape") returned 0 [0063.116] lstrlenA (lpString="*.ape") returned 5 [0063.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.wma") returned 0 [0063.116] lstrlenA (lpString="*.wma") returned 5 [0063.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.ac3") returned 0 [0063.116] lstrlenA (lpString="*.ac3") returned 5 [0063.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.mxf") returned 0 [0063.116] lstrlenA (lpString="*.mxf") returned 5 [0063.116] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x852, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsBrowserUpgrade.html", cAlternateFileName="FORMSB~2.HTM")) returned 1 [0063.118] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.118] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsBrowserUpgrade.html") returned -1 [0063.118] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsBrowserUpgrade.html") returned 1 [0063.118] lstrcmpiA (lpString1="", lpString2="FormsBrowserUpgrade.html") returned -1 [0063.118] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html") returned="FormsBlankPage.html" [0063.118] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.118] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.118] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.118] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.118] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html" [0063.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.zip") returned 0 [0063.118] lstrlenA (lpString="*.zip") returned 5 [0063.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.rar") returned 0 [0063.118] lstrlenA (lpString="*.rar") returned 5 [0063.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.7z") returned 0 [0063.118] lstrlenA (lpString="*.7z") returned 4 [0063.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.tar") returned 0 [0063.119] lstrlenA (lpString="*.tar") returned 5 [0063.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.gzip") returned 0 [0063.119] lstrlenA (lpString="*.gzip") returned 6 [0063.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.jpg") returned 0 [0063.119] lstrlenA (lpString="*.jpg") returned 5 [0063.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.jpeg") returned 0 [0063.119] lstrlenA (lpString="*.jpeg") returned 6 [0063.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.psd") returned 0 [0063.119] lstrlenA (lpString="*.psd") returned 5 [0063.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.gif") returned 0 [0063.119] lstrlenA (lpString="*.gif") returned 5 [0063.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.doc") returned 0 [0063.119] lstrlenA (lpString="*.doc") returned 5 [0063.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.docx") returned 0 [0063.119] lstrlenA (lpString="*.docx") returned 6 [0063.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.xls") returned 0 [0063.119] lstrlenA (lpString="*.xls") returned 5 [0063.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.xlsx") returned 0 [0063.119] lstrlenA (lpString="*.xlsx") returned 6 [0063.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.ppt") returned 0 [0063.119] lstrlenA (lpString="*.ppt") returned 5 [0063.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.pptx") returned 0 [0063.119] lstrlenA (lpString="*.pptx") returned 6 [0063.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.pdf") returned 0 [0063.119] lstrlenA (lpString="*.pdf") returned 5 [0063.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.mov") returned 0 [0063.119] lstrlenA (lpString="*.mov") returned 5 [0063.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.m2v") returned 0 [0063.120] lstrlenA (lpString="*.m2v") returned 5 [0063.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.3gp") returned 0 [0063.120] lstrlenA (lpString="*.3gp") returned 5 [0063.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.mpeg") returned 0 [0063.120] lstrlenA (lpString="*.mpeg") returned 6 [0063.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.mpg") returned 0 [0063.120] lstrlenA (lpString="*.mpg") returned 5 [0063.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.flv") returned 0 [0063.120] lstrlenA (lpString="*.flv") returned 5 [0063.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.avi") returned 0 [0063.120] lstrlenA (lpString="*.avi") returned 5 [0063.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.mp4") returned 0 [0063.120] lstrlenA (lpString="*.mp4") returned 5 [0063.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.wmv") returned 0 [0063.120] lstrlenA (lpString="*.wmv") returned 5 [0063.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.divx") returned 0 [0063.120] lstrlenA (lpString="*.divx") returned 6 [0063.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.mkv") returned 0 [0063.120] lstrlenA (lpString="*.mkv") returned 5 [0063.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.mp3") returned 0 [0063.120] lstrlenA (lpString="*.mp3") returned 5 [0063.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.wav") returned 0 [0063.120] lstrlenA (lpString="*.wav") returned 5 [0063.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.flac") returned 0 [0063.120] lstrlenA (lpString="*.flac") returned 6 [0063.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.ape") returned 0 [0063.120] lstrlenA (lpString="*.ape") returned 5 [0063.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.wma") returned 0 [0063.121] lstrlenA (lpString="*.wma") returned 5 [0063.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.ac3") returned 0 [0063.121] lstrlenA (lpString="*.ac3") returned 5 [0063.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.mxf") returned 0 [0063.121] lstrlenA (lpString="*.mxf") returned 5 [0063.121] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2ef, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsColorChart.html", cAlternateFileName="FORMSC~1.HTM")) returned 1 [0063.121] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.121] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsColorChart.html") returned -1 [0063.121] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsColorChart.html") returned 1 [0063.121] lstrcmpiA (lpString1="", lpString2="FormsColorChart.html") returned -1 [0063.121] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html") returned="FormsBrowserUpgrade.html" [0063.121] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.121] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.121] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.121] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.121] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsColorChart.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html" [0063.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.zip") returned 0 [0063.121] lstrlenA (lpString="*.zip") returned 5 [0063.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.rar") returned 0 [0063.121] lstrlenA (lpString="*.rar") returned 5 [0063.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.7z") returned 0 [0063.122] lstrlenA (lpString="*.7z") returned 4 [0063.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.tar") returned 0 [0063.122] lstrlenA (lpString="*.tar") returned 5 [0063.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.gzip") returned 0 [0063.122] lstrlenA (lpString="*.gzip") returned 6 [0063.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.jpg") returned 0 [0063.122] lstrlenA (lpString="*.jpg") returned 5 [0063.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.jpeg") returned 0 [0063.122] lstrlenA (lpString="*.jpeg") returned 6 [0063.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.psd") returned 0 [0063.122] lstrlenA (lpString="*.psd") returned 5 [0063.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.gif") returned 0 [0063.122] lstrlenA (lpString="*.gif") returned 5 [0063.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.doc") returned 0 [0063.122] lstrlenA (lpString="*.doc") returned 5 [0063.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.docx") returned 0 [0063.122] lstrlenA (lpString="*.docx") returned 6 [0063.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.xls") returned 0 [0063.122] lstrlenA (lpString="*.xls") returned 5 [0063.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.xlsx") returned 0 [0063.122] lstrlenA (lpString="*.xlsx") returned 6 [0063.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.ppt") returned 0 [0063.122] lstrlenA (lpString="*.ppt") returned 5 [0063.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.pptx") returned 0 [0063.122] lstrlenA (lpString="*.pptx") returned 6 [0063.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.pdf") returned 0 [0063.122] lstrlenA (lpString="*.pdf") returned 5 [0063.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.mov") returned 0 [0063.123] lstrlenA (lpString="*.mov") returned 5 [0063.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.m2v") returned 0 [0063.123] lstrlenA (lpString="*.m2v") returned 5 [0063.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.3gp") returned 0 [0063.123] lstrlenA (lpString="*.3gp") returned 5 [0063.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.mpeg") returned 0 [0063.123] lstrlenA (lpString="*.mpeg") returned 6 [0063.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.mpg") returned 0 [0063.123] lstrlenA (lpString="*.mpg") returned 5 [0063.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.flv") returned 0 [0063.123] lstrlenA (lpString="*.flv") returned 5 [0063.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.avi") returned 0 [0063.123] lstrlenA (lpString="*.avi") returned 5 [0063.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.mp4") returned 0 [0063.123] lstrlenA (lpString="*.mp4") returned 5 [0063.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.wmv") returned 0 [0063.123] lstrlenA (lpString="*.wmv") returned 5 [0063.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.divx") returned 0 [0063.123] lstrlenA (lpString="*.divx") returned 6 [0063.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.mkv") returned 0 [0063.124] lstrlenA (lpString="*.mkv") returned 5 [0063.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.mp3") returned 0 [0063.124] lstrlenA (lpString="*.mp3") returned 5 [0063.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.wav") returned 0 [0063.124] lstrlenA (lpString="*.wav") returned 5 [0063.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.flac") returned 0 [0063.124] lstrlenA (lpString="*.flac") returned 6 [0063.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.ape") returned 0 [0063.124] lstrlenA (lpString="*.ape") returned 5 [0063.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.wma") returned 0 [0063.124] lstrlenA (lpString="*.wma") returned 5 [0063.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.ac3") returned 0 [0063.124] lstrlenA (lpString="*.ac3") returned 5 [0063.124] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.mxf") returned 0 [0063.124] lstrlenA (lpString="*.mxf") returned 5 [0063.124] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x115a, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsFormTemplate.html", cAlternateFileName="FORMSF~1.HTM")) returned 1 [0063.124] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.124] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsFormTemplate.html") returned -1 [0063.124] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsFormTemplate.html") returned 1 [0063.124] lstrcmpiA (lpString1="", lpString2="FormsFormTemplate.html") returned -1 [0063.124] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html") returned="FormsColorChart.html" [0063.124] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.124] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.124] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.125] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.125] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsFormTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html" [0063.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.zip") returned 0 [0063.125] lstrlenA (lpString="*.zip") returned 5 [0063.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.rar") returned 0 [0063.125] lstrlenA (lpString="*.rar") returned 5 [0063.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.7z") returned 0 [0063.125] lstrlenA (lpString="*.7z") returned 4 [0063.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.tar") returned 0 [0063.125] lstrlenA (lpString="*.tar") returned 5 [0063.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.gzip") returned 0 [0063.125] lstrlenA (lpString="*.gzip") returned 6 [0063.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.jpg") returned 0 [0063.125] lstrlenA (lpString="*.jpg") returned 5 [0063.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.jpeg") returned 0 [0063.125] lstrlenA (lpString="*.jpeg") returned 6 [0063.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.psd") returned 0 [0063.125] lstrlenA (lpString="*.psd") returned 5 [0063.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.gif") returned 0 [0063.125] lstrlenA (lpString="*.gif") returned 5 [0063.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.doc") returned 0 [0063.125] lstrlenA (lpString="*.doc") returned 5 [0063.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.docx") returned 0 [0063.125] lstrlenA (lpString="*.docx") returned 6 [0063.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.xls") returned 0 [0063.126] lstrlenA (lpString="*.xls") returned 5 [0063.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.xlsx") returned 0 [0063.126] lstrlenA (lpString="*.xlsx") returned 6 [0063.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.ppt") returned 0 [0063.126] lstrlenA (lpString="*.ppt") returned 5 [0063.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.pptx") returned 0 [0063.126] lstrlenA (lpString="*.pptx") returned 6 [0063.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.pdf") returned 0 [0063.126] lstrlenA (lpString="*.pdf") returned 5 [0063.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.mov") returned 0 [0063.126] lstrlenA (lpString="*.mov") returned 5 [0063.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.m2v") returned 0 [0063.126] lstrlenA (lpString="*.m2v") returned 5 [0063.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.3gp") returned 0 [0063.126] lstrlenA (lpString="*.3gp") returned 5 [0063.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.mpeg") returned 0 [0063.126] lstrlenA (lpString="*.mpeg") returned 6 [0063.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.mpg") returned 0 [0063.126] lstrlenA (lpString="*.mpg") returned 5 [0063.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.flv") returned 0 [0063.126] lstrlenA (lpString="*.flv") returned 5 [0063.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.avi") returned 0 [0063.126] lstrlenA (lpString="*.avi") returned 5 [0063.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.mp4") returned 0 [0063.126] lstrlenA (lpString="*.mp4") returned 5 [0063.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.wmv") returned 0 [0063.127] lstrlenA (lpString="*.wmv") returned 5 [0063.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.divx") returned 0 [0063.127] lstrlenA (lpString="*.divx") returned 6 [0063.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.mkv") returned 0 [0063.127] lstrlenA (lpString="*.mkv") returned 5 [0063.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.mp3") returned 0 [0063.127] lstrlenA (lpString="*.mp3") returned 5 [0063.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.wav") returned 0 [0063.127] lstrlenA (lpString="*.wav") returned 5 [0063.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.flac") returned 0 [0063.127] lstrlenA (lpString="*.flac") returned 6 [0063.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.ape") returned 0 [0063.127] lstrlenA (lpString="*.ape") returned 5 [0063.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.wma") returned 0 [0063.127] lstrlenA (lpString="*.wma") returned 5 [0063.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.ac3") returned 0 [0063.127] lstrlenA (lpString="*.ac3") returned 5 [0063.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.mxf") returned 0 [0063.127] lstrlenA (lpString="*.mxf") returned 5 [0063.127] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd9c, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsHomePage.html", cAlternateFileName="FORMSH~1.HTM")) returned 1 [0063.127] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.127] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsHomePage.html") returned -1 [0063.127] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsHomePage.html") returned 1 [0063.127] lstrcmpiA (lpString1="", lpString2="FormsHomePage.html") returned -1 [0063.127] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html") returned="FormsFormTemplate.html" [0063.127] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.128] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.128] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.128] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.128] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsHomePage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html" [0063.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.zip") returned 0 [0063.128] lstrlenA (lpString="*.zip") returned 5 [0063.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.rar") returned 0 [0063.128] lstrlenA (lpString="*.rar") returned 5 [0063.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.7z") returned 0 [0063.128] lstrlenA (lpString="*.7z") returned 4 [0063.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.tar") returned 0 [0063.128] lstrlenA (lpString="*.tar") returned 5 [0063.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.gzip") returned 0 [0063.128] lstrlenA (lpString="*.gzip") returned 6 [0063.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.jpg") returned 0 [0063.128] lstrlenA (lpString="*.jpg") returned 5 [0063.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.jpeg") returned 0 [0063.128] lstrlenA (lpString="*.jpeg") returned 6 [0063.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.psd") returned 0 [0063.128] lstrlenA (lpString="*.psd") returned 5 [0063.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.gif") returned 0 [0063.129] lstrlenA (lpString="*.gif") returned 5 [0063.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.doc") returned 0 [0063.129] lstrlenA (lpString="*.doc") returned 5 [0063.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.docx") returned 0 [0063.129] lstrlenA (lpString="*.docx") returned 6 [0063.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.xls") returned 0 [0063.129] lstrlenA (lpString="*.xls") returned 5 [0063.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.xlsx") returned 0 [0063.129] lstrlenA (lpString="*.xlsx") returned 6 [0063.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.ppt") returned 0 [0063.129] lstrlenA (lpString="*.ppt") returned 5 [0063.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.pptx") returned 0 [0063.129] lstrlenA (lpString="*.pptx") returned 6 [0063.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.pdf") returned 0 [0063.129] lstrlenA (lpString="*.pdf") returned 5 [0063.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.mov") returned 0 [0063.129] lstrlenA (lpString="*.mov") returned 5 [0063.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.m2v") returned 0 [0063.129] lstrlenA (lpString="*.m2v") returned 5 [0063.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.3gp") returned 0 [0063.129] lstrlenA (lpString="*.3gp") returned 5 [0063.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.mpeg") returned 0 [0063.129] lstrlenA (lpString="*.mpeg") returned 6 [0063.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.mpg") returned 0 [0063.129] lstrlenA (lpString="*.mpg") returned 5 [0063.129] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.flv") returned 0 [0063.129] lstrlenA (lpString="*.flv") returned 5 [0063.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.avi") returned 0 [0063.130] lstrlenA (lpString="*.avi") returned 5 [0063.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.mp4") returned 0 [0063.130] lstrlenA (lpString="*.mp4") returned 5 [0063.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.wmv") returned 0 [0063.130] lstrlenA (lpString="*.wmv") returned 5 [0063.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.divx") returned 0 [0063.130] lstrlenA (lpString="*.divx") returned 6 [0063.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.mkv") returned 0 [0063.130] lstrlenA (lpString="*.mkv") returned 5 [0063.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.mp3") returned 0 [0063.130] lstrlenA (lpString="*.mp3") returned 5 [0063.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.wav") returned 0 [0063.130] lstrlenA (lpString="*.wav") returned 5 [0063.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.flac") returned 0 [0063.130] lstrlenA (lpString="*.flac") returned 6 [0063.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.ape") returned 0 [0063.130] lstrlenA (lpString="*.ape") returned 5 [0063.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.wma") returned 0 [0063.130] lstrlenA (lpString="*.wma") returned 5 [0063.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.ac3") returned 0 [0063.130] lstrlenA (lpString="*.ac3") returned 5 [0063.130] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.mxf") returned 0 [0063.130] lstrlenA (lpString="*.mxf") returned 5 [0063.130] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e87, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsHomePageScript.js", cAlternateFileName="FORMSH~1.JS")) returned 1 [0063.130] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.130] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsHomePageScript.js") returned -1 [0063.131] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsHomePageScript.js") returned 1 [0063.131] lstrcmpiA (lpString1="", lpString2="FormsHomePageScript.js") returned -1 [0063.131] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html") returned="FormsHomePage.html" [0063.131] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.131] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.131] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.131] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.131] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsHomePageScript.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js" [0063.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.zip") returned 0 [0063.131] lstrlenA (lpString="*.zip") returned 5 [0063.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.rar") returned 0 [0063.131] lstrlenA (lpString="*.rar") returned 5 [0063.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.7z") returned 0 [0063.131] lstrlenA (lpString="*.7z") returned 4 [0063.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.tar") returned 0 [0063.131] lstrlenA (lpString="*.tar") returned 5 [0063.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.gzip") returned 0 [0063.131] lstrlenA (lpString="*.gzip") returned 6 [0063.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.jpg") returned 0 [0063.131] lstrlenA (lpString="*.jpg") returned 5 [0063.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.jpeg") returned 0 [0063.131] lstrlenA (lpString="*.jpeg") returned 6 [0063.131] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.psd") returned 0 [0063.131] lstrlenA (lpString="*.psd") returned 5 [0063.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.gif") returned 0 [0063.132] lstrlenA (lpString="*.gif") returned 5 [0063.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.doc") returned 0 [0063.132] lstrlenA (lpString="*.doc") returned 5 [0063.132] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.docx") returned 0 [0063.132] lstrlenA (lpString="*.docx") returned 6 [0063.132] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x314, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsHomePageStyle.css", cAlternateFileName="FORMSH~1.CSS")) returned 1 [0063.132] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.132] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsHomePageStyle.css") returned -1 [0063.132] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsHomePageStyle.css") returned 1 [0063.132] lstrcmpiA (lpString1="", lpString2="FormsHomePageStyle.css") returned -1 [0063.132] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js") returned="FormsHomePageScript.js" [0063.132] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.132] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.132] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.132] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.133] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsHomePageStyle.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css" [0063.133] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7f0, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsImageTemplate.html", cAlternateFileName="FORMSI~1.HTM")) returned 1 [0063.133] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.133] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsImageTemplate.html") returned -1 [0063.133] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsImageTemplate.html") returned 1 [0063.133] lstrcmpiA (lpString1="", lpString2="FormsImageTemplate.html") returned -1 [0063.133] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css") returned="FormsHomePageStyle.css" [0063.133] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.133] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.133] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.133] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.133] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsImageTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html" [0063.133] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x858, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsMacroTemplate.html", cAlternateFileName="FORMSM~1.HTM")) returned 1 [0063.133] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.133] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsMacroTemplate.html") returned -1 [0063.133] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsMacroTemplate.html") returned 1 [0063.133] lstrcmpiA (lpString1="", lpString2="FormsMacroTemplate.html") returned -1 [0063.133] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html") returned="FormsImageTemplate.html" [0063.133] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.134] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.134] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.134] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.134] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsMacroTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html" [0063.134] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x529685b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x46a3, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsPreviewTemplate.html", cAlternateFileName="FORMSP~1.HTM")) returned 1 [0063.134] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.134] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsPreviewTemplate.html") returned -1 [0063.134] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPreviewTemplate.html") returned 1 [0063.134] lstrcmpiA (lpString1="", lpString2="FormsPreviewTemplate.html") returned -1 [0063.134] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html") returned="FormsMacroTemplate.html" [0063.134] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.134] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.134] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.134] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.134] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html" [0063.134] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x612, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsPrintTemplate.html", cAlternateFileName="FORMSP~2.HTM")) returned 1 [0063.134] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.135] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsPrintTemplate.html") returned -1 [0063.135] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPrintTemplate.html") returned 1 [0063.135] lstrcmpiA (lpString1="", lpString2="FormsPrintTemplate.html") returned -1 [0063.135] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html") returned="FormsPreviewTemplate.html" [0063.135] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.135] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.135] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.135] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.135] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html" [0063.135] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsStyles", cAlternateFileName="FORMSS~1")) returned 1 [0063.135] lstrcmpA (lpString1=".", lpString2="FormsStyles") returned -1 [0063.135] lstrcmpA (lpString1="..", lpString2="FormsStyles") returned -1 [0063.135] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html") returned="FormsPrintTemplate.html" [0063.135] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsStyles" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles" [0063.135] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f220, dwReserved1=0x2d8266, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0063.139] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.139] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0063.140] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.140] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.140] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x75f, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Adobe.css", cAlternateFileName="")) returned 1 [0063.140] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0063.140] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe.css") returned 1 [0063.140] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe.css") returned 1 [0063.140] lstrcmpiA (lpString1="", lpString2="Adobe.css") returned -1 [0063.141] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0063.141] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0063.141] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0063.141] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0063.141] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0xffffffff [0063.141] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0063.145] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.145] CloseHandle (hObject=0x9c) returned 1 [0063.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Adobe.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css" [0063.145] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5eb8e810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Americana", cAlternateFileName="AMERIC~1")) returned 1 [0063.145] lstrcmpA (lpString1=".", lpString2="Americana") returned -1 [0063.145] lstrcmpA (lpString1="..", lpString2="Americana") returned -1 [0063.145] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css") returned="Adobe.css" [0063.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Americana" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana" [0063.146] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5eb8e810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d827e, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0063.147] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.147] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5eb8e810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0063.147] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.147] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.147] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0063.147] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.147] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0063.147] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0063.147] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0063.147] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\*.*") returned="*.*" [0063.147] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\" [0063.147] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\") returned="" [0063.147] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt" [0063.147] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\how to decrypt files.txt")) returned 0xffffffff [0063.147] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.150] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.150] CloseHandle (hObject=0xa0) returned 1 [0063.150] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF" [0063.150] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF" [0063.150] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF" [0063.152] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0063.153] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5133d8d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea)) returned 1 [0063.153] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.153] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd7, lpOverlapped=0x0) returned 1 [0063.154] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0063.154] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.154] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd7, lpOverlapped=0x0) returned 1 [0063.155] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.155] CloseHandle (hObject=0xa0) returned 1 [0063.155] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_off.gif.wannacry")) returned 1 [0063.159] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0063.159] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.159] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0063.159] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0063.159] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0063.159] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0063.159] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\" [0063.159] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\") returned="" [0063.160] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\how to decrypt files.txt")) returned 0x20 [0063.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0063.160] lstrlenA (lpString="*.zip") returned 5 [0063.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0063.160] lstrlenA (lpString="*.rar") returned 5 [0063.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0063.160] lstrlenA (lpString="*.7z") returned 4 [0063.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0063.160] lstrlenA (lpString="*.tar") returned 5 [0063.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0063.160] lstrlenA (lpString="*.gzip") returned 6 [0063.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0063.160] lstrlenA (lpString="*.jpg") returned 5 [0063.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0063.160] lstrlenA (lpString="*.jpeg") returned 6 [0063.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0063.160] lstrlenA (lpString="*.psd") returned 5 [0063.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0063.160] lstrlenA (lpString="*.gif") returned 5 [0063.160] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF" [0063.160] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF" [0063.160] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF." [0063.160] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF.wannacry" [0063.161] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.162] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0063.162] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb8e810, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea)) returned 1 [0063.162] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.162] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60, lpOverlapped=0x0) returned 1 [0063.163] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF") returned="TAB_ON.GIF" [0063.163] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.164] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60, lpOverlapped=0x0) returned 1 [0063.164] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.164] CloseHandle (hObject=0xa0) returned 1 [0063.164] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_on.gif.wannacry")) returned 1 [0063.165] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0063.165] FindClose (in: hFindFile=0x2e3478 | out: hFindFile=0x2e3478) returned 1 [0063.165] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xdf0, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="Americana.css", cAlternateFileName="AMERIC~1.CSS")) returned 1 [0063.165] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0063.165] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Americana.css") returned 1 [0063.165] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Americana.css") returned 1 [0063.165] lstrcmpiA (lpString1="", lpString2="Americana.css") returned -1 [0063.165] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0063.165] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0063.166] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0063.166] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0063.166] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0063.166] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Americana.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css" [0063.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.zip") returned 0 [0063.166] lstrlenA (lpString="*.zip") returned 5 [0063.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.rar") returned 0 [0063.166] lstrlenA (lpString="*.rar") returned 5 [0063.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.7z") returned 0 [0063.166] lstrlenA (lpString="*.7z") returned 4 [0063.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.tar") returned 0 [0063.166] lstrlenA (lpString="*.tar") returned 5 [0063.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.gzip") returned 0 [0063.166] lstrlenA (lpString="*.gzip") returned 6 [0063.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.jpg") returned 0 [0063.166] lstrlenA (lpString="*.jpg") returned 5 [0063.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.jpeg") returned 0 [0063.166] lstrlenA (lpString="*.jpeg") returned 6 [0063.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.psd") returned 0 [0063.166] lstrlenA (lpString="*.psd") returned 5 [0063.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.gif") returned 0 [0063.166] lstrlenA (lpString="*.gif") returned 5 [0063.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.doc") returned 0 [0063.166] lstrlenA (lpString="*.doc") returned 5 [0063.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.docx") returned 0 [0063.167] lstrlenA (lpString="*.docx") returned 6 [0063.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.xls") returned 0 [0063.167] lstrlenA (lpString="*.xls") returned 5 [0063.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.xlsx") returned 0 [0063.167] lstrlenA (lpString="*.xlsx") returned 6 [0063.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.ppt") returned 0 [0063.167] lstrlenA (lpString="*.ppt") returned 5 [0063.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.pptx") returned 0 [0063.167] lstrlenA (lpString="*.pptx") returned 6 [0063.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.pdf") returned 0 [0063.167] lstrlenA (lpString="*.pdf") returned 5 [0063.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.mov") returned 0 [0063.167] lstrlenA (lpString="*.mov") returned 5 [0063.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.m2v") returned 0 [0063.167] lstrlenA (lpString="*.m2v") returned 5 [0063.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.3gp") returned 0 [0063.167] lstrlenA (lpString="*.3gp") returned 5 [0063.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.mpeg") returned 0 [0063.167] lstrlenA (lpString="*.mpeg") returned 6 [0063.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.mpg") returned 0 [0063.167] lstrlenA (lpString="*.mpg") returned 5 [0063.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.flv") returned 0 [0063.167] lstrlenA (lpString="*.flv") returned 5 [0063.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.avi") returned 0 [0063.167] lstrlenA (lpString="*.avi") returned 5 [0063.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.mp4") returned 0 [0063.168] lstrlenA (lpString="*.mp4") returned 5 [0063.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.wmv") returned 0 [0063.168] lstrlenA (lpString="*.wmv") returned 5 [0063.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.divx") returned 0 [0063.168] lstrlenA (lpString="*.divx") returned 6 [0063.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.mkv") returned 0 [0063.168] lstrlenA (lpString="*.mkv") returned 5 [0063.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.mp3") returned 0 [0063.168] lstrlenA (lpString="*.mp3") returned 5 [0063.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.wav") returned 0 [0063.168] lstrlenA (lpString="*.wav") returned 5 [0063.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.flac") returned 0 [0063.168] lstrlenA (lpString="*.flac") returned 6 [0063.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.ape") returned 0 [0063.168] lstrlenA (lpString="*.ape") returned 5 [0063.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.wma") returned 0 [0063.168] lstrlenA (lpString="*.wma") returned 5 [0063.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.ac3") returned 0 [0063.168] lstrlenA (lpString="*.ac3") returned 5 [0063.168] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.mxf") returned 0 [0063.168] lstrlenA (lpString="*.mxf") returned 5 [0063.168] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="BabyBlue", cAlternateFileName="")) returned 1 [0063.168] lstrcmpA (lpString1=".", lpString2="BabyBlue") returned -1 [0063.168] lstrcmpA (lpString1="..", lpString2="BabyBlue") returned -1 [0063.168] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css") returned="Americana.css" [0063.168] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="BabyBlue" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue" [0063.168] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue") returned 103 [0063.169] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x2d827e, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0063.169] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.169] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0063.169] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.169] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.169] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0063.169] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.169] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BUTTON.GIF") returned 1 [0063.169] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BUTTON.GIF") returned 1 [0063.169] lstrcmpiA (lpString1="", lpString2="BUTTON.GIF") returned -1 [0063.169] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\*.*") returned="*.*" [0063.169] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\" [0063.169] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\") returned="" [0063.169] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" [0063.170] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\how to decrypt files.txt")) returned 0xffffffff [0063.170] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.171] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0063.171] WriteFile (in: hFile=0xa0, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0063.172] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.172] CloseHandle (hObject=0xa0) returned 1 [0063.172] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\", lpString2="BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF" [0063.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.zip") returned 0 [0063.172] lstrlenA (lpString="*.zip") returned 5 [0063.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.rar") returned 0 [0063.172] lstrlenA (lpString="*.rar") returned 5 [0063.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.7z") returned 0 [0063.172] lstrlenA (lpString="*.7z") returned 4 [0063.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.tar") returned 0 [0063.172] lstrlenA (lpString="*.tar") returned 5 [0063.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.gzip") returned 0 [0063.172] lstrlenA (lpString="*.gzip") returned 6 [0063.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.jpg") returned 0 [0063.172] lstrlenA (lpString="*.jpg") returned 5 [0063.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.jpeg") returned 0 [0063.173] lstrlenA (lpString="*.jpeg") returned 6 [0063.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.psd") returned 0 [0063.173] lstrlenA (lpString="*.psd") returned 5 [0063.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.gif") returned 1 [0063.173] lstrlenA (lpString="*.gif") returned 5 [0063.173] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF" [0063.173] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF" [0063.173] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF." [0063.173] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF.wannacry" [0063.173] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.175] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9 [0063.175] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f409670, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea)) returned 1 [0063.175] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.176] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3b, lpOverlapped=0x0) returned 1 [0063.177] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="BUTTON.GIF" [0063.177] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.177] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3b, lpOverlapped=0x0) returned 1 [0063.177] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.177] CloseHandle (hObject=0xa0) returned 1 [0063.177] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\button.gif.wannacry")) returned 1 [0063.180] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0063.180] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.181] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HEADER.GIF") returned -1 [0063.181] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0063.181] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0063.181] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="BUTTON.GIF" [0063.181] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\" [0063.181] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\") returned="" [0063.181] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" [0063.181] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\how to decrypt files.txt")) returned 0x20 [0063.181] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF" [0063.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.zip") returned 0 [0063.181] lstrlenA (lpString="*.zip") returned 5 [0063.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.rar") returned 0 [0063.181] lstrlenA (lpString="*.rar") returned 5 [0063.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.7z") returned 0 [0063.181] lstrlenA (lpString="*.7z") returned 4 [0063.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.tar") returned 0 [0063.181] lstrlenA (lpString="*.tar") returned 5 [0063.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0063.181] lstrlenA (lpString="*.gzip") returned 6 [0063.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0063.181] lstrlenA (lpString="*.jpg") returned 5 [0063.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0063.182] lstrlenA (lpString="*.jpeg") returned 6 [0063.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.psd") returned 0 [0063.182] lstrlenA (lpString="*.psd") returned 5 [0063.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.gif") returned 1 [0063.182] lstrlenA (lpString="*.gif") returned 5 [0063.182] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF" [0063.182] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF" [0063.182] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF." [0063.182] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF.wannacry" [0063.182] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.184] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xff [0063.184] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51767f50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea)) returned 1 [0063.184] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.184] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x81, lpOverlapped=0x0) returned 1 [0063.185] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="HEADER.GIF" [0063.185] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.185] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x81, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x81, lpOverlapped=0x0) returned 1 [0063.185] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.185] CloseHandle (hObject=0xa0) returned 1 [0063.185] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\header.gif.wannacry")) returned 1 [0063.187] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0063.187] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.187] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0063.187] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0063.187] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0063.187] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="HEADER.GIF" [0063.187] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\" [0063.187] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\") returned="" [0063.187] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" [0063.187] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\how to decrypt files.txt")) returned 0x20 [0063.187] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" [0063.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0063.187] lstrlenA (lpString="*.zip") returned 5 [0063.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0063.187] lstrlenA (lpString="*.rar") returned 5 [0063.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0063.187] lstrlenA (lpString="*.7z") returned 4 [0063.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0063.187] lstrlenA (lpString="*.tar") returned 5 [0063.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0063.187] lstrlenA (lpString="*.gzip") returned 6 [0063.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0063.188] lstrlenA (lpString="*.jpg") returned 5 [0063.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0063.188] lstrlenA (lpString="*.jpeg") returned 6 [0063.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0063.188] lstrlenA (lpString="*.psd") returned 5 [0063.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0063.188] lstrlenA (lpString="*.gif") returned 5 [0063.188] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" [0063.188] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" [0063.188] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF." [0063.188] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.wannacry" [0063.188] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.191] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0063.191] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f42f7d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea)) returned 1 [0063.191] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.191] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd7, lpOverlapped=0x0) returned 1 [0063.193] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0063.193] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.193] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd7, lpOverlapped=0x0) returned 1 [0063.193] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.193] CloseHandle (hObject=0xa0) returned 1 [0063.193] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_off.gif.wannacry")) returned 1 [0063.194] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0063.194] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.194] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0063.194] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0063.194] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0063.194] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0063.194] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\" [0063.195] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\") returned="" [0063.195] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" [0063.195] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\how to decrypt files.txt")) returned 0x20 [0063.195] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF" [0063.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0063.195] lstrlenA (lpString="*.zip") returned 5 [0063.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0063.195] lstrlenA (lpString="*.rar") returned 5 [0063.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0063.195] lstrlenA (lpString="*.7z") returned 4 [0063.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0063.195] lstrlenA (lpString="*.tar") returned 5 [0063.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0063.195] lstrlenA (lpString="*.gzip") returned 6 [0063.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0063.195] lstrlenA (lpString="*.jpg") returned 5 [0063.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0063.195] lstrlenA (lpString="*.jpeg") returned 6 [0063.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0063.195] lstrlenA (lpString="*.psd") returned 5 [0063.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0063.195] lstrlenA (lpString="*.gif") returned 5 [0063.195] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF" [0063.195] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF" [0063.195] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF." [0063.196] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF.wannacry" [0063.196] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.196] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0063.196] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5178e0b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea)) returned 1 [0063.196] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.196] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60, lpOverlapped=0x0) returned 1 [0063.197] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="TAB_ON.GIF" [0063.198] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.198] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60, lpOverlapped=0x0) returned 1 [0063.198] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.198] CloseHandle (hObject=0xa0) returned 1 [0063.198] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_on.gif.wannacry")) returned 1 [0063.199] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0063.199] FindClose (in: hFindFile=0x2e3478 | out: hFindFile=0x2e3478) returned 1 [0063.199] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x100d, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="BabyBlue.css", cAlternateFileName="")) returned 1 [0063.199] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0063.199] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BabyBlue.css") returned 1 [0063.199] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BabyBlue.css") returned 1 [0063.199] lstrcmpiA (lpString1="", lpString2="BabyBlue.css") returned -1 [0063.199] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0063.199] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0063.199] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0063.199] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0063.199] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0063.199] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="BabyBlue.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css" [0063.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.zip") returned 0 [0063.200] lstrlenA (lpString="*.zip") returned 5 [0063.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.rar") returned 0 [0063.200] lstrlenA (lpString="*.rar") returned 5 [0063.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.7z") returned 0 [0063.200] lstrlenA (lpString="*.7z") returned 4 [0063.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.tar") returned 0 [0063.200] lstrlenA (lpString="*.tar") returned 5 [0063.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.gzip") returned 0 [0063.200] lstrlenA (lpString="*.gzip") returned 6 [0063.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.jpg") returned 0 [0063.200] lstrlenA (lpString="*.jpg") returned 5 [0063.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.jpeg") returned 0 [0063.200] lstrlenA (lpString="*.jpeg") returned 6 [0063.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.psd") returned 0 [0063.200] lstrlenA (lpString="*.psd") returned 5 [0063.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.gif") returned 0 [0063.200] lstrlenA (lpString="*.gif") returned 5 [0063.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.doc") returned 0 [0063.200] lstrlenA (lpString="*.doc") returned 5 [0063.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.docx") returned 0 [0063.200] lstrlenA (lpString="*.docx") returned 6 [0063.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.xls") returned 0 [0063.200] lstrlenA (lpString="*.xls") returned 5 [0063.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.xlsx") returned 0 [0063.200] lstrlenA (lpString="*.xlsx") returned 6 [0063.200] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.ppt") returned 0 [0063.201] lstrlenA (lpString="*.ppt") returned 5 [0063.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.pptx") returned 0 [0063.201] lstrlenA (lpString="*.pptx") returned 6 [0063.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.pdf") returned 0 [0063.201] lstrlenA (lpString="*.pdf") returned 5 [0063.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.mov") returned 0 [0063.201] lstrlenA (lpString="*.mov") returned 5 [0063.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.m2v") returned 0 [0063.201] lstrlenA (lpString="*.m2v") returned 5 [0063.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.3gp") returned 0 [0063.201] lstrlenA (lpString="*.3gp") returned 5 [0063.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.mpeg") returned 0 [0063.201] lstrlenA (lpString="*.mpeg") returned 6 [0063.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.mpg") returned 0 [0063.201] lstrlenA (lpString="*.mpg") returned 5 [0063.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.flv") returned 0 [0063.201] lstrlenA (lpString="*.flv") returned 5 [0063.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.avi") returned 0 [0063.201] lstrlenA (lpString="*.avi") returned 5 [0063.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.mp4") returned 0 [0063.201] lstrlenA (lpString="*.mp4") returned 5 [0063.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.wmv") returned 0 [0063.201] lstrlenA (lpString="*.wmv") returned 5 [0063.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.divx") returned 0 [0063.201] lstrlenA (lpString="*.divx") returned 6 [0063.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.mkv") returned 0 [0063.201] lstrlenA (lpString="*.mkv") returned 5 [0063.201] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.mp3") returned 0 [0063.202] lstrlenA (lpString="*.mp3") returned 5 [0063.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.wav") returned 0 [0063.202] lstrlenA (lpString="*.wav") returned 5 [0063.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.flac") returned 0 [0063.202] lstrlenA (lpString="*.flac") returned 6 [0063.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.ape") returned 0 [0063.202] lstrlenA (lpString="*.ape") returned 5 [0063.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.wma") returned 0 [0063.202] lstrlenA (lpString="*.wma") returned 5 [0063.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.ac3") returned 0 [0063.202] lstrlenA (lpString="*.ac3") returned 5 [0063.202] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.mxf") returned 0 [0063.202] lstrlenA (lpString="*.mxf") returned 5 [0063.202] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x519a33f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f690dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f690dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="Biscay", cAlternateFileName="")) returned 1 [0063.202] lstrcmpA (lpString1=".", lpString2="Biscay") returned -1 [0063.202] lstrcmpA (lpString1="..", lpString2="Biscay") returned -1 [0063.202] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css") returned="BabyBlue.css" [0063.202] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Biscay" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay" [0063.202] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay") returned 101 [0063.202] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x519a33f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f690dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f690dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x2d827e, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0063.203] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.203] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x519a33f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f690dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f690dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0063.203] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.203] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.203] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f690dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0063.203] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.203] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0063.203] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0063.203] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0063.203] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\*.*") returned="*.*" [0063.203] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\" [0063.203] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\") returned="" [0063.203] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt" [0063.203] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\how to decrypt files.txt")) returned 0xffffffff [0063.203] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.204] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0063.204] WriteFile (in: hFile=0xa0, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0063.205] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.206] CloseHandle (hObject=0xa0) returned 1 [0063.206] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF" [0063.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0063.206] lstrlenA (lpString="*.zip") returned 5 [0063.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0063.206] lstrlenA (lpString="*.rar") returned 5 [0063.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0063.206] lstrlenA (lpString="*.7z") returned 4 [0063.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0063.206] lstrlenA (lpString="*.tar") returned 5 [0063.206] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0063.206] lstrlenA (lpString="*.gzip") returned 6 [0063.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0063.207] lstrlenA (lpString="*.jpg") returned 5 [0063.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0063.207] lstrlenA (lpString="*.jpeg") returned 6 [0063.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0063.207] lstrlenA (lpString="*.psd") returned 5 [0063.207] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0063.207] lstrlenA (lpString="*.gif") returned 5 [0063.207] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF" [0063.207] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF" [0063.207] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF." [0063.207] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF.wannacry" [0063.207] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.208] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0063.208] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f690dd0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea)) returned 1 [0063.208] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.208] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd7, lpOverlapped=0x0) returned 1 [0063.209] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0063.209] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.209] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd7, lpOverlapped=0x0) returned 1 [0063.209] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.210] CloseHandle (hObject=0xa0) returned 1 [0063.210] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_off.gif.wannacry")) returned 1 [0063.211] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0063.211] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.211] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0063.211] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0063.211] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0063.211] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0063.211] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\" [0063.211] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\") returned="" [0063.211] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt" [0063.211] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\how to decrypt files.txt")) returned 0x20 [0063.211] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF" [0063.211] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0063.211] lstrlenA (lpString="*.zip") returned 5 [0063.211] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0063.211] lstrlenA (lpString="*.rar") returned 5 [0063.211] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0063.212] lstrlenA (lpString="*.7z") returned 4 [0063.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0063.212] lstrlenA (lpString="*.tar") returned 5 [0063.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0063.212] lstrlenA (lpString="*.gzip") returned 6 [0063.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0063.212] lstrlenA (lpString="*.jpg") returned 5 [0063.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0063.212] lstrlenA (lpString="*.jpeg") returned 6 [0063.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0063.212] lstrlenA (lpString="*.psd") returned 5 [0063.212] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0063.212] lstrlenA (lpString="*.gif") returned 5 [0063.212] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF" [0063.212] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF" [0063.212] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF." [0063.212] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF.wannacry" [0063.212] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.213] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0063.213] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519c9550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea)) returned 1 [0063.213] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.213] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60, lpOverlapped=0x0) returned 1 [0063.214] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="TAB_ON.GIF" [0063.214] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.214] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60, lpOverlapped=0x0) returned 1 [0063.215] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.215] CloseHandle (hObject=0xa0) returned 1 [0063.215] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_on.gif.wannacry")) returned 1 [0063.218] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0063.218] FindClose (in: hFindFile=0x2e3478 | out: hFindFile=0x2e3478) returned 1 [0063.218] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1103, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="Biscay.css", cAlternateFileName="")) returned 1 [0063.218] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0063.218] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Biscay.css") returned 1 [0063.218] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Biscay.css") returned 1 [0063.218] lstrcmpiA (lpString1="", lpString2="Biscay.css") returned -1 [0063.218] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0063.219] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0063.219] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0063.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0063.219] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0063.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Biscay.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css" [0063.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.zip") returned 0 [0063.219] lstrlenA (lpString="*.zip") returned 5 [0063.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.rar") returned 0 [0063.219] lstrlenA (lpString="*.rar") returned 5 [0063.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.7z") returned 0 [0063.219] lstrlenA (lpString="*.7z") returned 4 [0063.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.tar") returned 0 [0063.219] lstrlenA (lpString="*.tar") returned 5 [0063.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.gzip") returned 0 [0063.219] lstrlenA (lpString="*.gzip") returned 6 [0063.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.jpg") returned 0 [0063.219] lstrlenA (lpString="*.jpg") returned 5 [0063.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.jpeg") returned 0 [0063.219] lstrlenA (lpString="*.jpeg") returned 6 [0063.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.psd") returned 0 [0063.219] lstrlenA (lpString="*.psd") returned 5 [0063.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.gif") returned 0 [0063.219] lstrlenA (lpString="*.gif") returned 5 [0063.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.doc") returned 0 [0063.220] lstrlenA (lpString="*.doc") returned 5 [0063.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.docx") returned 0 [0063.220] lstrlenA (lpString="*.docx") returned 6 [0063.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.xls") returned 0 [0063.220] lstrlenA (lpString="*.xls") returned 5 [0063.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.xlsx") returned 0 [0063.220] lstrlenA (lpString="*.xlsx") returned 6 [0063.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.ppt") returned 0 [0063.220] lstrlenA (lpString="*.ppt") returned 5 [0063.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.pptx") returned 0 [0063.220] lstrlenA (lpString="*.pptx") returned 6 [0063.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.pdf") returned 0 [0063.220] lstrlenA (lpString="*.pdf") returned 5 [0063.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.mov") returned 0 [0063.220] lstrlenA (lpString="*.mov") returned 5 [0063.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.m2v") returned 0 [0063.220] lstrlenA (lpString="*.m2v") returned 5 [0063.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.3gp") returned 0 [0063.220] lstrlenA (lpString="*.3gp") returned 5 [0063.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.mpeg") returned 0 [0063.220] lstrlenA (lpString="*.mpeg") returned 6 [0063.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.mpg") returned 0 [0063.220] lstrlenA (lpString="*.mpg") returned 5 [0063.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.flv") returned 0 [0063.220] lstrlenA (lpString="*.flv") returned 5 [0063.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.avi") returned 0 [0063.220] lstrlenA (lpString="*.avi") returned 5 [0063.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.mp4") returned 0 [0063.221] lstrlenA (lpString="*.mp4") returned 5 [0063.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.wmv") returned 0 [0063.221] lstrlenA (lpString="*.wmv") returned 5 [0063.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.divx") returned 0 [0063.221] lstrlenA (lpString="*.divx") returned 6 [0063.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.mkv") returned 0 [0063.221] lstrlenA (lpString="*.mkv") returned 5 [0063.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.mp3") returned 0 [0063.221] lstrlenA (lpString="*.mp3") returned 5 [0063.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.wav") returned 0 [0063.221] lstrlenA (lpString="*.wav") returned 5 [0063.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.flac") returned 0 [0063.221] lstrlenA (lpString="*.flac") returned 6 [0063.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.ape") returned 0 [0063.221] lstrlenA (lpString="*.ape") returned 5 [0063.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.wma") returned 0 [0063.221] lstrlenA (lpString="*.wma") returned 5 [0063.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.ac3") returned 0 [0063.221] lstrlenA (lpString="*.ac3") returned 5 [0063.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.mxf") returned 0 [0063.221] lstrlenA (lpString="*.mxf") returned 5 [0063.221] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a87c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60062890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="BrightOrange", cAlternateFileName="BRIGHT~1")) returned 1 [0063.221] lstrcmpA (lpString1=".", lpString2="BrightOrange") returned -1 [0063.222] lstrcmpA (lpString1="..", lpString2="BrightOrange") returned -1 [0063.222] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css") returned="Biscay.css" [0063.222] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="BrightOrange" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange" [0063.222] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange") returned 107 [0063.222] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a87c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60062890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x2d827e, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0063.223] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.223] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a87c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60062890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0063.224] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.224] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.224] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x143, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0063.224] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.224] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="background.gif") returned 1 [0063.224] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1 [0063.224] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1 [0063.224] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\*.*") returned="*.*" [0063.224] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\" [0063.224] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\") returned="" [0063.224] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" [0063.224] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\how to decrypt files.txt")) returned 0xffffffff [0063.224] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.230] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0063.230] WriteFile (in: hFile=0xa0, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0063.232] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.232] CloseHandle (hObject=0xa0) returned 1 [0063.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" [0063.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.zip") returned 0 [0063.232] lstrlenA (lpString="*.zip") returned 5 [0063.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.rar") returned 0 [0063.232] lstrlenA (lpString="*.rar") returned 5 [0063.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.7z") returned 0 [0063.232] lstrlenA (lpString="*.7z") returned 4 [0063.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.tar") returned 0 [0063.232] lstrlenA (lpString="*.tar") returned 5 [0063.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.gzip") returned 0 [0063.232] lstrlenA (lpString="*.gzip") returned 6 [0063.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.jpg") returned 0 [0063.232] lstrlenA (lpString="*.jpg") returned 5 [0063.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.jpeg") returned 0 [0063.232] lstrlenA (lpString="*.jpeg") returned 6 [0063.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.psd") returned 0 [0063.232] lstrlenA (lpString="*.psd") returned 5 [0063.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.gif") returned 1 [0063.232] lstrlenA (lpString="*.gif") returned 5 [0063.233] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" [0063.233] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" [0063.233] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif." [0063.233] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif.wannacry" [0063.233] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.234] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x143 [0063.234] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6003c730, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea)) returned 1 [0063.234] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.234] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xc5, lpOverlapped=0x0) returned 1 [0063.235] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif") returned="background.gif" [0063.235] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.235] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xc5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xc5, lpOverlapped=0x0) returned 1 [0063.235] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.236] CloseHandle (hObject=0xa0) returned 1 [0063.236] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif.wannacry")) returned 1 [0063.237] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0063.237] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.237] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BUTTON.GIF") returned 1 [0063.237] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BUTTON.GIF") returned 1 [0063.237] lstrcmpiA (lpString1="", lpString2="BUTTON.GIF") returned -1 [0063.237] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif") returned="background.gif" [0063.237] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\" [0063.237] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\") returned="" [0063.237] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" [0063.238] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\how to decrypt files.txt")) returned 0x20 [0063.238] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\", lpString2="BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF" [0063.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.zip") returned 0 [0063.238] lstrlenA (lpString="*.zip") returned 5 [0063.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.rar") returned 0 [0063.238] lstrlenA (lpString="*.rar") returned 5 [0063.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.7z") returned 0 [0063.238] lstrlenA (lpString="*.7z") returned 4 [0063.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.tar") returned 0 [0063.238] lstrlenA (lpString="*.tar") returned 5 [0063.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.gzip") returned 0 [0063.238] lstrlenA (lpString="*.gzip") returned 6 [0063.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.jpg") returned 0 [0063.238] lstrlenA (lpString="*.jpg") returned 5 [0063.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.jpeg") returned 0 [0063.238] lstrlenA (lpString="*.jpeg") returned 6 [0063.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.psd") returned 0 [0063.238] lstrlenA (lpString="*.psd") returned 5 [0063.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.gif") returned 1 [0063.238] lstrlenA (lpString="*.gif") returned 5 [0063.238] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF" [0063.238] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF" [0063.239] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF." [0063.239] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF.wannacry" [0063.239] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.240] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9 [0063.240] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51a87c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea)) returned 1 [0063.240] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.240] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3b, lpOverlapped=0x0) returned 1 [0063.241] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF") returned="BUTTON.GIF" [0063.241] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.241] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3b, lpOverlapped=0x0) returned 1 [0063.241] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.241] CloseHandle (hObject=0xa0) returned 1 [0063.241] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\button.gif.wannacry")) returned 1 [0063.243] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0063.243] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.243] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0063.243] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0063.243] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0063.243] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF") returned="BUTTON.GIF" [0063.243] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\" [0063.243] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\") returned="" [0063.243] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" [0063.243] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\how to decrypt files.txt")) returned 0x20 [0063.243] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" [0063.243] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0063.244] lstrlenA (lpString="*.zip") returned 5 [0063.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0063.244] lstrlenA (lpString="*.rar") returned 5 [0063.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0063.244] lstrlenA (lpString="*.7z") returned 4 [0063.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0063.244] lstrlenA (lpString="*.tar") returned 5 [0063.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0063.244] lstrlenA (lpString="*.gzip") returned 6 [0063.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0063.244] lstrlenA (lpString="*.jpg") returned 5 [0063.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0063.244] lstrlenA (lpString="*.jpeg") returned 6 [0063.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0063.244] lstrlenA (lpString="*.psd") returned 5 [0063.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0063.244] lstrlenA (lpString="*.gif") returned 5 [0063.244] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" [0063.244] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" [0063.244] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF." [0063.244] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.wannacry" [0063.244] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.247] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0063.247] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60062890, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea)) returned 1 [0063.247] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.247] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd7, lpOverlapped=0x0) returned 1 [0063.248] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0063.248] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.248] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd7, lpOverlapped=0x0) returned 1 [0063.248] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.249] CloseHandle (hObject=0xa0) returned 1 [0063.249] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_off.gif.wannacry")) returned 1 [0063.250] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0063.250] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.250] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0063.250] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0063.250] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0063.250] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0063.250] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\" [0063.250] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\") returned="" [0063.250] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" [0063.250] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\how to decrypt files.txt")) returned 0x20 [0063.251] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF" [0063.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0063.251] lstrlenA (lpString="*.zip") returned 5 [0063.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0063.251] lstrlenA (lpString="*.rar") returned 5 [0063.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0063.251] lstrlenA (lpString="*.7z") returned 4 [0063.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0063.251] lstrlenA (lpString="*.tar") returned 5 [0063.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0063.251] lstrlenA (lpString="*.gzip") returned 6 [0063.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0063.251] lstrlenA (lpString="*.jpg") returned 5 [0063.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0063.251] lstrlenA (lpString="*.jpeg") returned 6 [0063.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0063.251] lstrlenA (lpString="*.psd") returned 5 [0063.251] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0063.251] lstrlenA (lpString="*.gif") returned 5 [0063.251] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF" [0063.251] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF" [0063.251] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF." [0063.251] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF.wannacry" [0063.251] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.252] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0063.253] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51a87c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea)) returned 1 [0063.253] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.253] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60, lpOverlapped=0x0) returned 1 [0063.254] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF") returned="TAB_ON.GIF" [0063.254] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.254] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60, lpOverlapped=0x0) returned 1 [0063.254] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.254] CloseHandle (hObject=0xa0) returned 1 [0063.254] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_on.gif.wannacry")) returned 1 [0063.255] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0063.256] FindClose (in: hFindFile=0x2e3478 | out: hFindFile=0x2e3478) returned 1 [0063.256] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10f1, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="BrightOrange.css", cAlternateFileName="BRIGHT~1.CSS")) returned 1 [0063.256] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0063.256] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BrightOrange.css") returned 1 [0063.256] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BrightOrange.css") returned 1 [0063.256] lstrcmpiA (lpString1="", lpString2="BrightOrange.css") returned -1 [0063.256] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0063.256] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0063.256] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0063.256] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0063.256] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0063.256] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="BrightOrange.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css" [0063.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.zip") returned 0 [0063.256] lstrlenA (lpString="*.zip") returned 5 [0063.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.rar") returned 0 [0063.256] lstrlenA (lpString="*.rar") returned 5 [0063.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.7z") returned 0 [0063.256] lstrlenA (lpString="*.7z") returned 4 [0063.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.tar") returned 0 [0063.256] lstrlenA (lpString="*.tar") returned 5 [0063.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.gzip") returned 0 [0063.257] lstrlenA (lpString="*.gzip") returned 6 [0063.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.jpg") returned 0 [0063.257] lstrlenA (lpString="*.jpg") returned 5 [0063.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.jpeg") returned 0 [0063.257] lstrlenA (lpString="*.jpeg") returned 6 [0063.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.psd") returned 0 [0063.257] lstrlenA (lpString="*.psd") returned 5 [0063.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.gif") returned 0 [0063.257] lstrlenA (lpString="*.gif") returned 5 [0063.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.doc") returned 0 [0063.257] lstrlenA (lpString="*.doc") returned 5 [0063.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.docx") returned 0 [0063.257] lstrlenA (lpString="*.docx") returned 6 [0063.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.xls") returned 0 [0063.257] lstrlenA (lpString="*.xls") returned 5 [0063.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.xlsx") returned 0 [0063.257] lstrlenA (lpString="*.xlsx") returned 6 [0063.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.ppt") returned 0 [0063.257] lstrlenA (lpString="*.ppt") returned 5 [0063.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.pptx") returned 0 [0063.257] lstrlenA (lpString="*.pptx") returned 6 [0063.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.pdf") returned 0 [0063.257] lstrlenA (lpString="*.pdf") returned 5 [0063.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.mov") returned 0 [0063.257] lstrlenA (lpString="*.mov") returned 5 [0063.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.m2v") returned 0 [0063.257] lstrlenA (lpString="*.m2v") returned 5 [0063.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.3gp") returned 0 [0063.258] lstrlenA (lpString="*.3gp") returned 5 [0063.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.mpeg") returned 0 [0063.258] lstrlenA (lpString="*.mpeg") returned 6 [0063.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.mpg") returned 0 [0063.258] lstrlenA (lpString="*.mpg") returned 5 [0063.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.flv") returned 0 [0063.258] lstrlenA (lpString="*.flv") returned 5 [0063.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.avi") returned 0 [0063.258] lstrlenA (lpString="*.avi") returned 5 [0063.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.mp4") returned 0 [0063.258] lstrlenA (lpString="*.mp4") returned 5 [0063.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.wmv") returned 0 [0063.258] lstrlenA (lpString="*.wmv") returned 5 [0063.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.divx") returned 0 [0063.258] lstrlenA (lpString="*.divx") returned 6 [0063.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.mkv") returned 0 [0063.258] lstrlenA (lpString="*.mkv") returned 5 [0063.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.mp3") returned 0 [0063.258] lstrlenA (lpString="*.mp3") returned 5 [0063.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.wav") returned 0 [0063.258] lstrlenA (lpString="*.wav") returned 5 [0063.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.flac") returned 0 [0063.258] lstrlenA (lpString="*.flac") returned 6 [0063.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.ape") returned 0 [0063.258] lstrlenA (lpString="*.ape") returned 5 [0063.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.wma") returned 0 [0063.258] lstrlenA (lpString="*.wma") returned 5 [0063.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.ac3") returned 0 [0063.258] lstrlenA (lpString="*.ac3") returned 5 [0063.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.mxf") returned 0 [0063.259] lstrlenA (lpString="*.mxf") returned 5 [0063.259] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a87c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60062890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="BrightYellow", cAlternateFileName="BRIGHT~2")) returned 1 [0063.259] lstrcmpA (lpString1=".", lpString2="BrightYellow") returned -1 [0063.259] lstrcmpA (lpString1="..", lpString2="BrightYellow") returned -1 [0063.259] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css") returned="BrightOrange.css" [0063.259] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="BrightYellow" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow" [0063.259] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow") returned 107 [0063.259] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a87c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60062890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x2d827e, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0063.261] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.261] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a87c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60062890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0063.261] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.262] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.262] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16f, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0063.262] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.262] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HEADER.GIF") returned -1 [0063.262] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0063.262] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0063.262] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\*.*") returned="*.*" [0063.262] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\" [0063.262] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\") returned="" [0063.262] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt" [0063.262] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\how to decrypt files.txt")) returned 0xffffffff [0063.262] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.269] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0063.269] WriteFile (in: hFile=0xa0, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0063.270] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.270] CloseHandle (hObject=0xa0) returned 1 [0063.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF" [0063.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.zip") returned 0 [0063.270] lstrlenA (lpString="*.zip") returned 5 [0063.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.rar") returned 0 [0063.270] lstrlenA (lpString="*.rar") returned 5 [0063.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.7z") returned 0 [0063.270] lstrlenA (lpString="*.7z") returned 4 [0063.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.tar") returned 0 [0063.270] lstrlenA (lpString="*.tar") returned 5 [0063.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0063.271] lstrlenA (lpString="*.gzip") returned 6 [0063.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0063.271] lstrlenA (lpString="*.jpg") returned 5 [0063.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0063.271] lstrlenA (lpString="*.jpeg") returned 6 [0063.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.psd") returned 0 [0063.271] lstrlenA (lpString="*.psd") returned 5 [0063.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.gif") returned 1 [0063.271] lstrlenA (lpString="*.gif") returned 5 [0063.271] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF" [0063.271] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF" [0063.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF." [0063.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF.wannacry" [0063.271] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.272] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16f [0063.272] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60062890, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea)) returned 1 [0063.272] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.272] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xf1, lpOverlapped=0x0) returned 1 [0063.273] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="HEADER.GIF" [0063.273] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.274] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xf1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xf1, lpOverlapped=0x0) returned 1 [0063.274] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.274] CloseHandle (hObject=0xa0) returned 1 [0063.274] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\header.gif.wannacry")) returned 1 [0063.275] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0063.275] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.275] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0063.275] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0063.275] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0063.275] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="HEADER.GIF" [0063.275] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\" [0063.275] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\") returned="" [0063.275] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt" [0063.276] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\how to decrypt files.txt")) returned 0x20 [0063.276] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" [0063.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0063.276] lstrlenA (lpString="*.zip") returned 5 [0063.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0063.276] lstrlenA (lpString="*.rar") returned 5 [0063.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0063.276] lstrlenA (lpString="*.7z") returned 4 [0063.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0063.276] lstrlenA (lpString="*.tar") returned 5 [0063.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0063.276] lstrlenA (lpString="*.gzip") returned 6 [0063.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0063.276] lstrlenA (lpString="*.jpg") returned 5 [0063.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0063.276] lstrlenA (lpString="*.jpeg") returned 6 [0063.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0063.276] lstrlenA (lpString="*.psd") returned 5 [0063.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0063.276] lstrlenA (lpString="*.gif") returned 5 [0063.276] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" [0063.276] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" [0063.277] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF." [0063.277] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.wannacry" [0063.277] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.277] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0063.278] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51a87c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea)) returned 1 [0063.278] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.278] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd7, lpOverlapped=0x0) returned 1 [0063.279] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0063.279] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.279] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd7, lpOverlapped=0x0) returned 1 [0063.279] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.280] CloseHandle (hObject=0xa0) returned 1 [0063.280] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_off.gif.wannacry")) returned 1 [0063.281] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0063.281] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.281] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0063.281] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0063.281] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0063.281] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0063.281] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\" [0063.281] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\") returned="" [0063.281] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt" [0063.281] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\how to decrypt files.txt")) returned 0x20 [0063.281] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF" [0063.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0063.281] lstrlenA (lpString="*.zip") returned 5 [0063.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0063.281] lstrlenA (lpString="*.rar") returned 5 [0063.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0063.281] lstrlenA (lpString="*.7z") returned 4 [0063.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0063.281] lstrlenA (lpString="*.tar") returned 5 [0063.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0063.282] lstrlenA (lpString="*.gzip") returned 6 [0063.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0063.282] lstrlenA (lpString="*.jpg") returned 5 [0063.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0063.282] lstrlenA (lpString="*.jpeg") returned 6 [0063.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0063.282] lstrlenA (lpString="*.psd") returned 5 [0063.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0063.282] lstrlenA (lpString="*.gif") returned 5 [0063.282] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF" [0063.282] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF" [0063.282] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF." [0063.282] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF.wannacry" [0063.282] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.283] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0063.283] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60062890, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea)) returned 1 [0063.283] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.283] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60, lpOverlapped=0x0) returned 1 [0063.284] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned="TAB_ON.GIF" [0063.284] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.284] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60, lpOverlapped=0x0) returned 1 [0063.285] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.285] CloseHandle (hObject=0xa0) returned 1 [0063.285] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_on.gif.wannacry")) returned 1 [0063.286] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0063.286] FindClose (in: hFindFile=0x2e3478 | out: hFindFile=0x2e3478) returned 1 [0063.286] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1074, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="BrightYellow.css", cAlternateFileName="BRIGHT~2.CSS")) returned 1 [0063.286] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0063.286] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BrightYellow.css") returned 1 [0063.286] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BrightYellow.css") returned 1 [0063.286] lstrcmpiA (lpString1="", lpString2="BrightYellow.css") returned -1 [0063.286] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0063.286] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0063.286] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0063.286] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0063.286] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0063.286] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="BrightYellow.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css" [0063.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.zip") returned 0 [0063.288] lstrlenA (lpString="*.zip") returned 5 [0063.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.rar") returned 0 [0063.288] lstrlenA (lpString="*.rar") returned 5 [0063.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.7z") returned 0 [0063.288] lstrlenA (lpString="*.7z") returned 4 [0063.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.tar") returned 0 [0063.288] lstrlenA (lpString="*.tar") returned 5 [0063.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.gzip") returned 0 [0063.288] lstrlenA (lpString="*.gzip") returned 6 [0063.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.jpg") returned 0 [0063.288] lstrlenA (lpString="*.jpg") returned 5 [0063.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.jpeg") returned 0 [0063.288] lstrlenA (lpString="*.jpeg") returned 6 [0063.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.psd") returned 0 [0063.288] lstrlenA (lpString="*.psd") returned 5 [0063.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.gif") returned 0 [0063.288] lstrlenA (lpString="*.gif") returned 5 [0063.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.doc") returned 0 [0063.288] lstrlenA (lpString="*.doc") returned 5 [0063.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.docx") returned 0 [0063.288] lstrlenA (lpString="*.docx") returned 6 [0063.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.xls") returned 0 [0063.288] lstrlenA (lpString="*.xls") returned 5 [0063.288] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.xlsx") returned 0 [0063.288] lstrlenA (lpString="*.xlsx") returned 6 [0063.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.ppt") returned 0 [0063.289] lstrlenA (lpString="*.ppt") returned 5 [0063.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.pptx") returned 0 [0063.289] lstrlenA (lpString="*.pptx") returned 6 [0063.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.pdf") returned 0 [0063.289] lstrlenA (lpString="*.pdf") returned 5 [0063.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.mov") returned 0 [0063.289] lstrlenA (lpString="*.mov") returned 5 [0063.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.m2v") returned 0 [0063.289] lstrlenA (lpString="*.m2v") returned 5 [0063.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.3gp") returned 0 [0063.289] lstrlenA (lpString="*.3gp") returned 5 [0063.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.mpeg") returned 0 [0063.289] lstrlenA (lpString="*.mpeg") returned 6 [0063.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.mpg") returned 0 [0063.289] lstrlenA (lpString="*.mpg") returned 5 [0063.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.flv") returned 0 [0063.289] lstrlenA (lpString="*.flv") returned 5 [0063.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.avi") returned 0 [0063.289] lstrlenA (lpString="*.avi") returned 5 [0063.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.mp4") returned 0 [0063.289] lstrlenA (lpString="*.mp4") returned 5 [0063.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.wmv") returned 0 [0063.289] lstrlenA (lpString="*.wmv") returned 5 [0063.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.divx") returned 0 [0063.289] lstrlenA (lpString="*.divx") returned 6 [0063.289] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.mkv") returned 0 [0063.290] lstrlenA (lpString="*.mkv") returned 5 [0063.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.mp3") returned 0 [0063.290] lstrlenA (lpString="*.mp3") returned 5 [0063.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.wav") returned 0 [0063.290] lstrlenA (lpString="*.wav") returned 5 [0063.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.flac") returned 0 [0063.290] lstrlenA (lpString="*.flac") returned 6 [0063.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.ape") returned 0 [0063.290] lstrlenA (lpString="*.ape") returned 5 [0063.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.wma") returned 0 [0063.290] lstrlenA (lpString="*.wma") returned 5 [0063.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.ac3") returned 0 [0063.290] lstrlenA (lpString="*.ac3") returned 5 [0063.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.mxf") returned 0 [0063.290] lstrlenA (lpString="*.mxf") returned 5 [0063.290] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x760, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="Casual.css", cAlternateFileName="")) returned 1 [0063.290] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0063.290] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Casual.css") returned 1 [0063.290] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Casual.css") returned 1 [0063.290] lstrcmpiA (lpString1="", lpString2="Casual.css") returned -1 [0063.290] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css") returned="BrightYellow.css" [0063.290] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0063.290] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0063.290] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0063.291] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0063.291] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Casual.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css" [0063.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.zip") returned 0 [0063.291] lstrlenA (lpString="*.zip") returned 5 [0063.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.rar") returned 0 [0063.291] lstrlenA (lpString="*.rar") returned 5 [0063.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.7z") returned 0 [0063.291] lstrlenA (lpString="*.7z") returned 4 [0063.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.tar") returned 0 [0063.291] lstrlenA (lpString="*.tar") returned 5 [0063.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.gzip") returned 0 [0063.291] lstrlenA (lpString="*.gzip") returned 6 [0063.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.jpg") returned 0 [0063.291] lstrlenA (lpString="*.jpg") returned 5 [0063.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.jpeg") returned 0 [0063.291] lstrlenA (lpString="*.jpeg") returned 6 [0063.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.psd") returned 0 [0063.291] lstrlenA (lpString="*.psd") returned 5 [0063.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.gif") returned 0 [0063.291] lstrlenA (lpString="*.gif") returned 5 [0063.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.doc") returned 0 [0063.292] lstrlenA (lpString="*.doc") returned 5 [0063.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.docx") returned 0 [0063.292] lstrlenA (lpString="*.docx") returned 6 [0063.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.xls") returned 0 [0063.292] lstrlenA (lpString="*.xls") returned 5 [0063.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.xlsx") returned 0 [0063.292] lstrlenA (lpString="*.xlsx") returned 6 [0063.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.ppt") returned 0 [0063.292] lstrlenA (lpString="*.ppt") returned 5 [0063.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.pptx") returned 0 [0063.292] lstrlenA (lpString="*.pptx") returned 6 [0063.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.pdf") returned 0 [0063.292] lstrlenA (lpString="*.pdf") returned 5 [0063.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.mov") returned 0 [0063.292] lstrlenA (lpString="*.mov") returned 5 [0063.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.m2v") returned 0 [0063.292] lstrlenA (lpString="*.m2v") returned 5 [0063.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.3gp") returned 0 [0063.292] lstrlenA (lpString="*.3gp") returned 5 [0063.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.mpeg") returned 0 [0063.292] lstrlenA (lpString="*.mpeg") returned 6 [0063.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.mpg") returned 0 [0063.292] lstrlenA (lpString="*.mpg") returned 5 [0063.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.flv") returned 0 [0063.293] lstrlenA (lpString="*.flv") returned 5 [0063.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.avi") returned 0 [0063.293] lstrlenA (lpString="*.avi") returned 5 [0063.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.mp4") returned 0 [0063.293] lstrlenA (lpString="*.mp4") returned 5 [0063.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.wmv") returned 0 [0063.293] lstrlenA (lpString="*.wmv") returned 5 [0063.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.divx") returned 0 [0063.293] lstrlenA (lpString="*.divx") returned 6 [0063.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.mkv") returned 0 [0063.293] lstrlenA (lpString="*.mkv") returned 5 [0063.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.mp3") returned 0 [0063.293] lstrlenA (lpString="*.mp3") returned 5 [0063.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.wav") returned 0 [0063.293] lstrlenA (lpString="*.wav") returned 5 [0063.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.flac") returned 0 [0063.293] lstrlenA (lpString="*.flac") returned 6 [0063.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.ape") returned 0 [0063.293] lstrlenA (lpString="*.ape") returned 5 [0063.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.wma") returned 0 [0063.293] lstrlenA (lpString="*.wma") returned 5 [0063.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.ac3") returned 0 [0063.293] lstrlenA (lpString="*.ac3") returned 5 [0063.293] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.mxf") returned 0 [0063.293] lstrlenA (lpString="*.mxf") returned 5 [0063.294] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51ce9230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x731, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="Country.css", cAlternateFileName="")) returned 1 [0063.294] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0063.294] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Country.css") returned 1 [0063.294] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Country.css") returned 1 [0063.294] lstrcmpiA (lpString1="", lpString2="Country.css") returned -1 [0063.294] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css") returned="Casual.css" [0063.294] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0063.294] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0063.294] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0063.294] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0063.294] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Country.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css" [0063.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.zip") returned 0 [0063.294] lstrlenA (lpString="*.zip") returned 5 [0063.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.rar") returned 0 [0063.294] lstrlenA (lpString="*.rar") returned 5 [0063.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.7z") returned 0 [0063.294] lstrlenA (lpString="*.7z") returned 4 [0063.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.tar") returned 0 [0063.294] lstrlenA (lpString="*.tar") returned 5 [0063.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.gzip") returned 0 [0063.295] lstrlenA (lpString="*.gzip") returned 6 [0063.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.jpg") returned 0 [0063.295] lstrlenA (lpString="*.jpg") returned 5 [0063.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.jpeg") returned 0 [0063.295] lstrlenA (lpString="*.jpeg") returned 6 [0063.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.psd") returned 0 [0063.295] lstrlenA (lpString="*.psd") returned 5 [0063.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.gif") returned 0 [0063.295] lstrlenA (lpString="*.gif") returned 5 [0063.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.doc") returned 0 [0063.295] lstrlenA (lpString="*.doc") returned 5 [0063.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.docx") returned 0 [0063.295] lstrlenA (lpString="*.docx") returned 6 [0063.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.xls") returned 0 [0063.295] lstrlenA (lpString="*.xls") returned 5 [0063.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.xlsx") returned 0 [0063.295] lstrlenA (lpString="*.xlsx") returned 6 [0063.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.ppt") returned 0 [0063.295] lstrlenA (lpString="*.ppt") returned 5 [0063.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.pptx") returned 0 [0063.295] lstrlenA (lpString="*.pptx") returned 6 [0063.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.pdf") returned 0 [0063.295] lstrlenA (lpString="*.pdf") returned 5 [0063.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.mov") returned 0 [0063.296] lstrlenA (lpString="*.mov") returned 5 [0063.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.m2v") returned 0 [0063.296] lstrlenA (lpString="*.m2v") returned 5 [0063.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.3gp") returned 0 [0063.296] lstrlenA (lpString="*.3gp") returned 5 [0063.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.mpeg") returned 0 [0063.296] lstrlenA (lpString="*.mpeg") returned 6 [0063.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.mpg") returned 0 [0063.296] lstrlenA (lpString="*.mpg") returned 5 [0063.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.flv") returned 0 [0063.296] lstrlenA (lpString="*.flv") returned 5 [0063.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.avi") returned 0 [0063.296] lstrlenA (lpString="*.avi") returned 5 [0063.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.mp4") returned 0 [0063.296] lstrlenA (lpString="*.mp4") returned 5 [0063.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.wmv") returned 0 [0063.296] lstrlenA (lpString="*.wmv") returned 5 [0063.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.divx") returned 0 [0063.296] lstrlenA (lpString="*.divx") returned 6 [0063.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.mkv") returned 0 [0063.296] lstrlenA (lpString="*.mkv") returned 5 [0063.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.mp3") returned 0 [0063.296] lstrlenA (lpString="*.mp3") returned 5 [0063.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.wav") returned 0 [0063.296] lstrlenA (lpString="*.wav") returned 5 [0063.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.flac") returned 0 [0063.297] lstrlenA (lpString="*.flac") returned 6 [0063.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.ape") returned 0 [0063.297] lstrlenA (lpString="*.ape") returned 5 [0063.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.wma") returned 0 [0063.297] lstrlenA (lpString="*.wma") returned 5 [0063.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.ac3") returned 0 [0063.297] lstrlenA (lpString="*.ac3") returned 5 [0063.297] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.mxf") returned 0 [0063.297] lstrlenA (lpString="*.mxf") returned 5 [0063.297] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51da7910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60760930, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="Desert", cAlternateFileName="")) returned 1 [0063.297] lstrcmpA (lpString1=".", lpString2="Desert") returned -1 [0063.297] lstrcmpA (lpString1="..", lpString2="Desert") returned -1 [0063.297] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css") returned="Country.css" [0063.297] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Desert" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert" [0063.297] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert") returned 101 [0063.297] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51da7910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60760930, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x2d827e, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0063.298] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.299] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51da7910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60760930, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0063.299] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.299] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.299] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0063.299] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.299] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HEADER.GIF") returned -1 [0063.299] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0063.299] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0063.299] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\*.*") returned="*.*" [0063.299] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\" [0063.299] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\") returned="" [0063.299] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt" [0063.299] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\how to decrypt files.txt")) returned 0xffffffff [0063.299] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.301] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0063.301] WriteFile (in: hFile=0xa0, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0063.302] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.302] CloseHandle (hObject=0xa0) returned 1 [0063.302] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF" [0063.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.zip") returned 0 [0063.302] lstrlenA (lpString="*.zip") returned 5 [0063.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.rar") returned 0 [0063.302] lstrlenA (lpString="*.rar") returned 5 [0063.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.7z") returned 0 [0063.302] lstrlenA (lpString="*.7z") returned 4 [0063.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.tar") returned 0 [0063.302] lstrlenA (lpString="*.tar") returned 5 [0063.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0063.302] lstrlenA (lpString="*.gzip") returned 6 [0063.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0063.303] lstrlenA (lpString="*.jpg") returned 5 [0063.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0063.303] lstrlenA (lpString="*.jpeg") returned 6 [0063.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.psd") returned 0 [0063.303] lstrlenA (lpString="*.psd") returned 5 [0063.303] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.gif") returned 1 [0063.303] lstrlenA (lpString="*.gif") returned 5 [0063.303] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF" [0063.303] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF" [0063.303] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF." [0063.303] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF.wannacry" [0063.303] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.304] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x94 [0063.304] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51da7910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea)) returned 1 [0063.304] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.304] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x16, lpOverlapped=0x0) returned 1 [0063.305] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF") returned="HEADER.GIF" [0063.305] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.305] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x16, lpOverlapped=0x0) returned 1 [0063.305] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.306] CloseHandle (hObject=0xa0) returned 1 [0063.306] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\header.gif.wannacry")) returned 1 [0063.311] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1f0, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0063.311] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.311] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0063.311] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0063.311] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0063.311] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF") returned="HEADER.GIF" [0063.311] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\" [0063.311] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\") returned="" [0063.311] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt" [0063.311] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\how to decrypt files.txt")) returned 0x20 [0063.311] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF" [0063.311] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0063.311] lstrlenA (lpString="*.zip") returned 5 [0063.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0063.312] lstrlenA (lpString="*.rar") returned 5 [0063.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0063.312] lstrlenA (lpString="*.7z") returned 4 [0063.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0063.312] lstrlenA (lpString="*.tar") returned 5 [0063.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0063.312] lstrlenA (lpString="*.gzip") returned 6 [0063.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0063.312] lstrlenA (lpString="*.jpg") returned 5 [0063.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0063.312] lstrlenA (lpString="*.jpeg") returned 6 [0063.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0063.312] lstrlenA (lpString="*.psd") returned 5 [0063.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0063.312] lstrlenA (lpString="*.gif") returned 5 [0063.312] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF" [0063.312] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF" [0063.312] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF." [0063.312] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF.wannacry" [0063.312] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.313] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f0 [0063.313] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51da7910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea)) returned 1 [0063.313] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.313] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x172, lpOverlapped=0x0) returned 1 [0063.315] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0063.315] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.315] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x172, lpOverlapped=0x0) returned 1 [0063.316] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.316] CloseHandle (hObject=0xa0) returned 1 [0063.316] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_off.gif.wannacry")) returned 1 [0063.317] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0063.317] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.317] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0063.317] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0063.317] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0063.317] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0063.317] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\" [0063.317] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\") returned="" [0063.317] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt" [0063.317] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\how to decrypt files.txt")) returned 0x20 [0063.317] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF" [0063.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0063.317] lstrlenA (lpString="*.zip") returned 5 [0063.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0063.317] lstrlenA (lpString="*.rar") returned 5 [0063.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0063.318] lstrlenA (lpString="*.7z") returned 4 [0063.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0063.318] lstrlenA (lpString="*.tar") returned 5 [0063.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0063.318] lstrlenA (lpString="*.gzip") returned 6 [0063.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0063.318] lstrlenA (lpString="*.jpg") returned 5 [0063.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0063.318] lstrlenA (lpString="*.jpeg") returned 6 [0063.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0063.318] lstrlenA (lpString="*.psd") returned 5 [0063.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0063.318] lstrlenA (lpString="*.gif") returned 5 [0063.318] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF" [0063.318] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF" [0063.318] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF." [0063.318] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF.wannacry" [0063.318] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.344] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x401 [0063.344] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60760930, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea)) returned 1 [0063.344] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.344] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x383, lpOverlapped=0x0) returned 1 [0063.348] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF") returned="TAB_ON.GIF" [0063.348] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.349] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x383, lpOverlapped=0x0) returned 1 [0063.349] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.349] CloseHandle (hObject=0xa0) returned 1 [0063.349] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_on.gif.wannacry")) returned 1 [0063.350] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0063.350] FindClose (in: hFindFile=0x2e3478 | out: hFindFile=0x2e3478) returned 1 [0063.351] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd35, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="Desert.css", cAlternateFileName="")) returned 1 [0063.351] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0063.351] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Desert.css") returned 1 [0063.351] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Desert.css") returned 1 [0063.351] lstrcmpiA (lpString1="", lpString2="Desert.css") returned -1 [0063.351] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0063.351] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0063.351] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0063.351] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0063.351] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0063.351] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Desert.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css" [0063.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.zip") returned 0 [0063.351] lstrlenA (lpString="*.zip") returned 5 [0063.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.rar") returned 0 [0063.351] lstrlenA (lpString="*.rar") returned 5 [0063.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.7z") returned 0 [0063.351] lstrlenA (lpString="*.7z") returned 4 [0063.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.tar") returned 0 [0063.351] lstrlenA (lpString="*.tar") returned 5 [0063.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.gzip") returned 0 [0063.351] lstrlenA (lpString="*.gzip") returned 6 [0063.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.jpg") returned 0 [0063.352] lstrlenA (lpString="*.jpg") returned 5 [0063.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.jpeg") returned 0 [0063.352] lstrlenA (lpString="*.jpeg") returned 6 [0063.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.psd") returned 0 [0063.352] lstrlenA (lpString="*.psd") returned 5 [0063.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.gif") returned 0 [0063.352] lstrlenA (lpString="*.gif") returned 5 [0063.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.doc") returned 0 [0063.352] lstrlenA (lpString="*.doc") returned 5 [0063.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.docx") returned 0 [0063.352] lstrlenA (lpString="*.docx") returned 6 [0063.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.xls") returned 0 [0063.352] lstrlenA (lpString="*.xls") returned 5 [0063.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.xlsx") returned 0 [0063.352] lstrlenA (lpString="*.xlsx") returned 6 [0063.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.ppt") returned 0 [0063.352] lstrlenA (lpString="*.ppt") returned 5 [0063.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.pptx") returned 0 [0063.352] lstrlenA (lpString="*.pptx") returned 6 [0063.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.pdf") returned 0 [0063.352] lstrlenA (lpString="*.pdf") returned 5 [0063.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.mov") returned 0 [0063.352] lstrlenA (lpString="*.mov") returned 5 [0063.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.m2v") returned 0 [0063.352] lstrlenA (lpString="*.m2v") returned 5 [0063.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.3gp") returned 0 [0063.352] lstrlenA (lpString="*.3gp") returned 5 [0063.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.mpeg") returned 0 [0063.353] lstrlenA (lpString="*.mpeg") returned 6 [0063.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.mpg") returned 0 [0063.353] lstrlenA (lpString="*.mpg") returned 5 [0063.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.flv") returned 0 [0063.353] lstrlenA (lpString="*.flv") returned 5 [0063.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.avi") returned 0 [0063.353] lstrlenA (lpString="*.avi") returned 5 [0063.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.mp4") returned 0 [0063.353] lstrlenA (lpString="*.mp4") returned 5 [0063.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.wmv") returned 0 [0063.353] lstrlenA (lpString="*.wmv") returned 5 [0063.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.divx") returned 0 [0063.353] lstrlenA (lpString="*.divx") returned 6 [0063.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.mkv") returned 0 [0063.353] lstrlenA (lpString="*.mkv") returned 5 [0063.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.mp3") returned 0 [0063.353] lstrlenA (lpString="*.mp3") returned 5 [0063.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.wav") returned 0 [0063.353] lstrlenA (lpString="*.wav") returned 5 [0063.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.flac") returned 0 [0063.353] lstrlenA (lpString="*.flac") returned 6 [0063.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.ape") returned 0 [0063.353] lstrlenA (lpString="*.ape") returned 5 [0063.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.wma") returned 0 [0063.353] lstrlenA (lpString="*.wma") returned 5 [0063.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.ac3") returned 0 [0063.353] lstrlenA (lpString="*.ac3") returned 5 [0063.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.mxf") returned 0 [0063.354] lstrlenA (lpString="*.mxf") returned 5 [0063.354] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x72e, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="Earthy.css", cAlternateFileName="")) returned 1 [0063.354] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0063.354] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Earthy.css") returned -1 [0063.354] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Earthy.css") returned 1 [0063.354] lstrcmpiA (lpString1="", lpString2="Earthy.css") returned -1 [0063.354] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css") returned="Desert.css" [0063.354] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0063.354] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0063.354] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0063.354] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0063.354] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Earthy.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css" [0063.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.zip") returned 0 [0063.354] lstrlenA (lpString="*.zip") returned 5 [0063.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.rar") returned 0 [0063.354] lstrlenA (lpString="*.rar") returned 5 [0063.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.7z") returned 0 [0063.354] lstrlenA (lpString="*.7z") returned 4 [0063.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.tar") returned 0 [0063.354] lstrlenA (lpString="*.tar") returned 5 [0063.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.gzip") returned 0 [0063.355] lstrlenA (lpString="*.gzip") returned 6 [0063.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.jpg") returned 0 [0063.355] lstrlenA (lpString="*.jpg") returned 5 [0063.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.jpeg") returned 0 [0063.355] lstrlenA (lpString="*.jpeg") returned 6 [0063.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.psd") returned 0 [0063.355] lstrlenA (lpString="*.psd") returned 5 [0063.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.gif") returned 0 [0063.355] lstrlenA (lpString="*.gif") returned 5 [0063.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.doc") returned 0 [0063.355] lstrlenA (lpString="*.doc") returned 5 [0063.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.docx") returned 0 [0063.355] lstrlenA (lpString="*.docx") returned 6 [0063.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.xls") returned 0 [0063.355] lstrlenA (lpString="*.xls") returned 5 [0063.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.xlsx") returned 0 [0063.355] lstrlenA (lpString="*.xlsx") returned 6 [0063.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.ppt") returned 0 [0063.355] lstrlenA (lpString="*.ppt") returned 5 [0063.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.pptx") returned 0 [0063.355] lstrlenA (lpString="*.pptx") returned 6 [0063.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.pdf") returned 0 [0063.355] lstrlenA (lpString="*.pdf") returned 5 [0063.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.mov") returned 0 [0063.355] lstrlenA (lpString="*.mov") returned 5 [0063.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.m2v") returned 0 [0063.355] lstrlenA (lpString="*.m2v") returned 5 [0063.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.3gp") returned 0 [0063.356] lstrlenA (lpString="*.3gp") returned 5 [0063.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.mpeg") returned 0 [0063.356] lstrlenA (lpString="*.mpeg") returned 6 [0063.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.mpg") returned 0 [0063.356] lstrlenA (lpString="*.mpg") returned 5 [0063.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.flv") returned 0 [0063.356] lstrlenA (lpString="*.flv") returned 5 [0063.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.avi") returned 0 [0063.356] lstrlenA (lpString="*.avi") returned 5 [0063.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.mp4") returned 0 [0063.356] lstrlenA (lpString="*.mp4") returned 5 [0063.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.wmv") returned 0 [0063.356] lstrlenA (lpString="*.wmv") returned 5 [0063.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.divx") returned 0 [0063.356] lstrlenA (lpString="*.divx") returned 6 [0063.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.mkv") returned 0 [0063.356] lstrlenA (lpString="*.mkv") returned 5 [0063.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.mp3") returned 0 [0063.356] lstrlenA (lpString="*.mp3") returned 5 [0063.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.wav") returned 0 [0063.356] lstrlenA (lpString="*.wav") returned 5 [0063.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.flac") returned 0 [0063.356] lstrlenA (lpString="*.flac") returned 6 [0063.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.ape") returned 0 [0063.356] lstrlenA (lpString="*.ape") returned 5 [0063.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.wma") returned 0 [0063.356] lstrlenA (lpString="*.wma") returned 5 [0063.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.ac3") returned 0 [0063.357] lstrlenA (lpString="*.ac3") returned 5 [0063.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.mxf") returned 0 [0063.357] lstrlenA (lpString="*.mxf") returned 5 [0063.357] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52c3bfd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61ab7bf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="GrayCheck", cAlternateFileName="GRAYCH~1")) returned 1 [0063.357] lstrcmpA (lpString1=".", lpString2="GrayCheck") returned -1 [0063.357] lstrcmpA (lpString1="..", lpString2="GrayCheck") returned -1 [0063.357] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css") returned="Earthy.css" [0063.357] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="GrayCheck" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck" [0063.357] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck") returned 104 [0063.357] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52c3bfd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61ab7bf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x2d827e, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0063.358] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.358] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52c3bfd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61ab7bf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0063.358] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.358] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.358] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52c3bfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1b8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0063.358] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.358] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HEADER.GIF") returned -1 [0063.358] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0063.358] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0063.358] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\*.*") returned="*.*" [0063.358] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\" [0063.359] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\") returned="" [0063.359] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt" [0063.359] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\how to decrypt files.txt")) returned 0xffffffff [0063.359] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.360] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0063.360] WriteFile (in: hFile=0xa0, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0063.361] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.361] CloseHandle (hObject=0xa0) returned 1 [0063.361] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF" [0063.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.zip") returned 0 [0063.361] lstrlenA (lpString="*.zip") returned 5 [0063.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.rar") returned 0 [0063.361] lstrlenA (lpString="*.rar") returned 5 [0063.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.7z") returned 0 [0063.361] lstrlenA (lpString="*.7z") returned 4 [0063.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.tar") returned 0 [0063.361] lstrlenA (lpString="*.tar") returned 5 [0063.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0063.362] lstrlenA (lpString="*.gzip") returned 6 [0063.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0063.362] lstrlenA (lpString="*.jpg") returned 5 [0063.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0063.362] lstrlenA (lpString="*.jpeg") returned 6 [0063.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.psd") returned 0 [0063.362] lstrlenA (lpString="*.psd") returned 5 [0063.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.gif") returned 1 [0063.362] lstrlenA (lpString="*.gif") returned 5 [0063.362] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF" [0063.362] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF" [0063.362] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF." [0063.362] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF.wannacry" [0063.362] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.364] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b8 [0063.364] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x52c3bfd0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea)) returned 1 [0063.364] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.364] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x13a, lpOverlapped=0x0) returned 1 [0063.365] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="HEADER.GIF" [0063.365] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.365] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x13a, lpOverlapped=0x0) returned 1 [0063.366] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.366] CloseHandle (hObject=0xa0) returned 1 [0063.366] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\header.gif.wannacry")) returned 1 [0063.388] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0063.388] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.388] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0063.388] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0063.388] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0063.388] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="HEADER.GIF" [0063.388] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\" [0063.389] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\") returned="" [0063.389] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt" [0063.389] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\how to decrypt files.txt")) returned 0x20 [0063.389] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" [0063.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0063.389] lstrlenA (lpString="*.zip") returned 5 [0063.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0063.389] lstrlenA (lpString="*.rar") returned 5 [0063.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0063.389] lstrlenA (lpString="*.7z") returned 4 [0063.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0063.389] lstrlenA (lpString="*.tar") returned 5 [0063.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0063.389] lstrlenA (lpString="*.gzip") returned 6 [0063.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0063.389] lstrlenA (lpString="*.jpg") returned 5 [0063.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0063.389] lstrlenA (lpString="*.jpeg") returned 6 [0063.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0063.389] lstrlenA (lpString="*.psd") returned 5 [0063.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0063.389] lstrlenA (lpString="*.gif") returned 5 [0063.390] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" [0063.390] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" [0063.390] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF." [0063.390] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.wannacry" [0063.390] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.391] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0063.392] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61ab7bf0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea)) returned 1 [0063.392] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.392] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd7, lpOverlapped=0x0) returned 1 [0063.393] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0063.393] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.393] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd7, lpOverlapped=0x0) returned 1 [0063.393] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.393] CloseHandle (hObject=0xa0) returned 1 [0063.393] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_off.gif.wannacry")) returned 1 [0063.394] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0063.394] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.395] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0063.395] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0063.395] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0063.395] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0063.395] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\" [0063.395] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\") returned="" [0063.395] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt" [0063.395] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\how to decrypt files.txt")) returned 0x20 [0063.395] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF" [0063.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0063.395] lstrlenA (lpString="*.zip") returned 5 [0063.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0063.395] lstrlenA (lpString="*.rar") returned 5 [0063.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0063.395] lstrlenA (lpString="*.7z") returned 4 [0063.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0063.395] lstrlenA (lpString="*.tar") returned 5 [0063.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0063.395] lstrlenA (lpString="*.gzip") returned 6 [0063.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0063.395] lstrlenA (lpString="*.jpg") returned 5 [0063.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0063.395] lstrlenA (lpString="*.jpeg") returned 6 [0063.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0063.395] lstrlenA (lpString="*.psd") returned 5 [0063.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0063.395] lstrlenA (lpString="*.gif") returned 5 [0063.395] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF" [0063.395] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF" [0063.396] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF." [0063.396] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF.wannacry" [0063.396] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.396] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0063.396] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61ab7bf0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea)) returned 1 [0063.396] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.396] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60, lpOverlapped=0x0) returned 1 [0063.397] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned="TAB_ON.GIF" [0063.397] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.397] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60, lpOverlapped=0x0) returned 1 [0063.398] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.398] CloseHandle (hObject=0xa0) returned 1 [0063.398] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_on.gif.wannacry")) returned 1 [0063.399] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0063.399] FindClose (in: hFindFile=0x2e3478 | out: hFindFile=0x2e3478) returned 1 [0063.399] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61a91a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xeb0, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="GrayCheck.css", cAlternateFileName="GRAYCH~1.CSS")) returned 1 [0063.399] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0063.399] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GrayCheck.css") returned -1 [0063.399] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GrayCheck.css") returned 1 [0063.399] lstrcmpiA (lpString1="", lpString2="GrayCheck.css") returned -1 [0063.399] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0063.399] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0063.399] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0063.399] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0063.399] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0063.399] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="GrayCheck.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css" [0063.399] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.zip") returned 0 [0063.400] lstrlenA (lpString="*.zip") returned 5 [0063.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.rar") returned 0 [0063.400] lstrlenA (lpString="*.rar") returned 5 [0063.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.7z") returned 0 [0063.400] lstrlenA (lpString="*.7z") returned 4 [0063.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.tar") returned 0 [0063.400] lstrlenA (lpString="*.tar") returned 5 [0063.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.gzip") returned 0 [0063.400] lstrlenA (lpString="*.gzip") returned 6 [0063.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.jpg") returned 0 [0063.400] lstrlenA (lpString="*.jpg") returned 5 [0063.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.jpeg") returned 0 [0063.400] lstrlenA (lpString="*.jpeg") returned 6 [0063.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.psd") returned 0 [0063.400] lstrlenA (lpString="*.psd") returned 5 [0063.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.gif") returned 0 [0063.400] lstrlenA (lpString="*.gif") returned 5 [0063.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.doc") returned 0 [0063.400] lstrlenA (lpString="*.doc") returned 5 [0063.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.docx") returned 0 [0063.400] lstrlenA (lpString="*.docx") returned 6 [0063.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.xls") returned 0 [0063.400] lstrlenA (lpString="*.xls") returned 5 [0063.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.xlsx") returned 0 [0063.400] lstrlenA (lpString="*.xlsx") returned 6 [0063.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.ppt") returned 0 [0063.400] lstrlenA (lpString="*.ppt") returned 5 [0063.400] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.pptx") returned 0 [0063.400] lstrlenA (lpString="*.pptx") returned 6 [0063.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.pdf") returned 0 [0063.401] lstrlenA (lpString="*.pdf") returned 5 [0063.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.mov") returned 0 [0063.401] lstrlenA (lpString="*.mov") returned 5 [0063.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.m2v") returned 0 [0063.401] lstrlenA (lpString="*.m2v") returned 5 [0063.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.3gp") returned 0 [0063.401] lstrlenA (lpString="*.3gp") returned 5 [0063.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.mpeg") returned 0 [0063.401] lstrlenA (lpString="*.mpeg") returned 6 [0063.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.mpg") returned 0 [0063.401] lstrlenA (lpString="*.mpg") returned 5 [0063.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.flv") returned 0 [0063.402] lstrlenA (lpString="*.flv") returned 5 [0063.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.avi") returned 0 [0063.402] lstrlenA (lpString="*.avi") returned 5 [0063.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.mp4") returned 0 [0063.402] lstrlenA (lpString="*.mp4") returned 5 [0063.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.wmv") returned 0 [0063.402] lstrlenA (lpString="*.wmv") returned 5 [0063.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.divx") returned 0 [0063.402] lstrlenA (lpString="*.divx") returned 6 [0063.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.mkv") returned 0 [0063.402] lstrlenA (lpString="*.mkv") returned 5 [0063.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.mp3") returned 0 [0063.402] lstrlenA (lpString="*.mp3") returned 5 [0063.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.wav") returned 0 [0063.402] lstrlenA (lpString="*.wav") returned 5 [0063.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.flac") returned 0 [0063.402] lstrlenA (lpString="*.flac") returned 6 [0063.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.ape") returned 0 [0063.402] lstrlenA (lpString="*.ape") returned 5 [0063.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.wma") returned 0 [0063.402] lstrlenA (lpString="*.wma") returned 5 [0063.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.ac3") returned 0 [0063.402] lstrlenA (lpString="*.ac3") returned 5 [0063.402] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.mxf") returned 0 [0063.402] lstrlenA (lpString="*.mxf") returned 5 [0063.403] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52c3bfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x762, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="GreenTea.css", cAlternateFileName="")) returned 1 [0063.403] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0063.403] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GreenTea.css") returned -1 [0063.403] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GreenTea.css") returned 1 [0063.403] lstrcmpiA (lpString1="", lpString2="GreenTea.css") returned -1 [0063.403] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css") returned="GrayCheck.css" [0063.403] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0063.403] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0063.403] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0063.403] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0063.403] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="GreenTea.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css" [0063.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.zip") returned 0 [0063.403] lstrlenA (lpString="*.zip") returned 5 [0063.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.rar") returned 0 [0063.403] lstrlenA (lpString="*.rar") returned 5 [0063.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.7z") returned 0 [0063.403] lstrlenA (lpString="*.7z") returned 4 [0063.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.tar") returned 0 [0063.403] lstrlenA (lpString="*.tar") returned 5 [0063.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.gzip") returned 0 [0063.403] lstrlenA (lpString="*.gzip") returned 6 [0063.403] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.jpg") returned 0 [0063.403] lstrlenA (lpString="*.jpg") returned 5 [0063.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.jpeg") returned 0 [0063.404] lstrlenA (lpString="*.jpeg") returned 6 [0063.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.psd") returned 0 [0063.404] lstrlenA (lpString="*.psd") returned 5 [0063.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.gif") returned 0 [0063.404] lstrlenA (lpString="*.gif") returned 5 [0063.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.doc") returned 0 [0063.404] lstrlenA (lpString="*.doc") returned 5 [0063.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.docx") returned 0 [0063.404] lstrlenA (lpString="*.docx") returned 6 [0063.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.xls") returned 0 [0063.404] lstrlenA (lpString="*.xls") returned 5 [0063.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.xlsx") returned 0 [0063.404] lstrlenA (lpString="*.xlsx") returned 6 [0063.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.ppt") returned 0 [0063.404] lstrlenA (lpString="*.ppt") returned 5 [0063.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.pptx") returned 0 [0063.404] lstrlenA (lpString="*.pptx") returned 6 [0063.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.pdf") returned 0 [0063.404] lstrlenA (lpString="*.pdf") returned 5 [0063.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.mov") returned 0 [0063.404] lstrlenA (lpString="*.mov") returned 5 [0063.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.m2v") returned 0 [0063.404] lstrlenA (lpString="*.m2v") returned 5 [0063.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.3gp") returned 0 [0063.404] lstrlenA (lpString="*.3gp") returned 5 [0063.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.mpeg") returned 0 [0063.404] lstrlenA (lpString="*.mpeg") returned 6 [0063.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.mpg") returned 0 [0063.405] lstrlenA (lpString="*.mpg") returned 5 [0063.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.flv") returned 0 [0063.405] lstrlenA (lpString="*.flv") returned 5 [0063.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.avi") returned 0 [0063.405] lstrlenA (lpString="*.avi") returned 5 [0063.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.mp4") returned 0 [0063.405] lstrlenA (lpString="*.mp4") returned 5 [0063.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.wmv") returned 0 [0063.405] lstrlenA (lpString="*.wmv") returned 5 [0063.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.divx") returned 0 [0063.405] lstrlenA (lpString="*.divx") returned 6 [0063.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.mkv") returned 0 [0063.405] lstrlenA (lpString="*.mkv") returned 5 [0063.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.mp3") returned 0 [0063.405] lstrlenA (lpString="*.mp3") returned 5 [0063.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.wav") returned 0 [0063.405] lstrlenA (lpString="*.wav") returned 5 [0063.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.flac") returned 0 [0063.405] lstrlenA (lpString="*.flac") returned 6 [0063.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.ape") returned 0 [0063.405] lstrlenA (lpString="*.ape") returned 5 [0063.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.wma") returned 0 [0063.405] lstrlenA (lpString="*.wma") returned 5 [0063.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.ac3") returned 0 [0063.405] lstrlenA (lpString="*.ac3") returned 5 [0063.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.mxf") returned 0 [0063.405] lstrlenA (lpString="*.mxf") returned 5 [0063.405] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7cf, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="LightSpirit.css", cAlternateFileName="LIGHTS~1.CSS")) returned 1 [0063.406] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0063.406] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LightSpirit.css") returned -1 [0063.406] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LightSpirit.css") returned -1 [0063.406] lstrcmpiA (lpString1="", lpString2="LightSpirit.css") returned -1 [0063.406] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css") returned="GreenTea.css" [0063.406] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0063.406] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0063.406] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0063.406] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0063.406] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="LightSpirit.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css" [0063.406] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.zip") returned 0 [0063.406] lstrlenA (lpString="*.zip") returned 5 [0063.406] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.rar") returned 0 [0063.406] lstrlenA (lpString="*.rar") returned 5 [0063.406] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.7z") returned 0 [0063.406] lstrlenA (lpString="*.7z") returned 4 [0063.406] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.tar") returned 0 [0063.406] lstrlenA (lpString="*.tar") returned 5 [0063.406] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.gzip") returned 0 [0063.406] lstrlenA (lpString="*.gzip") returned 6 [0063.406] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.jpg") returned 0 [0063.406] lstrlenA (lpString="*.jpg") returned 5 [0063.406] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.jpeg") returned 0 [0063.407] lstrlenA (lpString="*.jpeg") returned 6 [0063.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.psd") returned 0 [0063.407] lstrlenA (lpString="*.psd") returned 5 [0063.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.gif") returned 0 [0063.407] lstrlenA (lpString="*.gif") returned 5 [0063.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.doc") returned 0 [0063.407] lstrlenA (lpString="*.doc") returned 5 [0063.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.docx") returned 0 [0063.407] lstrlenA (lpString="*.docx") returned 6 [0063.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.xls") returned 0 [0063.407] lstrlenA (lpString="*.xls") returned 5 [0063.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.xlsx") returned 0 [0063.407] lstrlenA (lpString="*.xlsx") returned 6 [0063.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.ppt") returned 0 [0063.407] lstrlenA (lpString="*.ppt") returned 5 [0063.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.pptx") returned 0 [0063.407] lstrlenA (lpString="*.pptx") returned 6 [0063.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.pdf") returned 0 [0063.407] lstrlenA (lpString="*.pdf") returned 5 [0063.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.mov") returned 0 [0063.407] lstrlenA (lpString="*.mov") returned 5 [0063.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.m2v") returned 0 [0063.407] lstrlenA (lpString="*.m2v") returned 5 [0063.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.3gp") returned 0 [0063.407] lstrlenA (lpString="*.3gp") returned 5 [0063.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.mpeg") returned 0 [0063.407] lstrlenA (lpString="*.mpeg") returned 6 [0063.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.mpg") returned 0 [0063.408] lstrlenA (lpString="*.mpg") returned 5 [0063.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.flv") returned 0 [0063.408] lstrlenA (lpString="*.flv") returned 5 [0063.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.avi") returned 0 [0063.408] lstrlenA (lpString="*.avi") returned 5 [0063.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.mp4") returned 0 [0063.408] lstrlenA (lpString="*.mp4") returned 5 [0063.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.wmv") returned 0 [0063.408] lstrlenA (lpString="*.wmv") returned 5 [0063.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.divx") returned 0 [0063.408] lstrlenA (lpString="*.divx") returned 6 [0063.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.mkv") returned 0 [0063.408] lstrlenA (lpString="*.mkv") returned 5 [0063.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.mp3") returned 0 [0063.408] lstrlenA (lpString="*.mp3") returned 5 [0063.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.wav") returned 0 [0063.408] lstrlenA (lpString="*.wav") returned 5 [0063.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.flac") returned 0 [0063.408] lstrlenA (lpString="*.flac") returned 6 [0063.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.ape") returned 0 [0063.408] lstrlenA (lpString="*.ape") returned 5 [0063.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.wma") returned 0 [0063.409] lstrlenA (lpString="*.wma") returned 5 [0063.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.ac3") returned 0 [0063.409] lstrlenA (lpString="*.ac3") returned 5 [0063.409] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.mxf") returned 0 [0063.409] lstrlenA (lpString="*.mxf") returned 5 [0063.409] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x568309f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66293410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="Lime", cAlternateFileName="")) returned 1 [0063.409] lstrcmpA (lpString1=".", lpString2="Lime") returned -1 [0063.409] lstrcmpA (lpString1="..", lpString2="Lime") returned -1 [0063.409] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css") returned="LightSpirit.css" [0063.409] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Lime" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime" [0063.409] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime") returned 99 [0063.409] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x568309f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66293410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x2d827e, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0063.410] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.410] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x568309f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66293410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0063.410] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.410] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.410] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0063.410] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.410] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0063.410] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0063.410] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0063.410] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\*.*") returned="*.*" [0063.410] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\" [0063.410] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\") returned="" [0063.410] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt" [0063.410] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\how to decrypt files.txt")) returned 0xffffffff [0063.410] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.411] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0063.411] WriteFile (in: hFile=0xa0, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0063.413] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.413] CloseHandle (hObject=0xa0) returned 1 [0063.413] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF" [0063.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0063.413] lstrlenA (lpString="*.zip") returned 5 [0063.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0063.413] lstrlenA (lpString="*.rar") returned 5 [0063.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0063.413] lstrlenA (lpString="*.7z") returned 4 [0063.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0063.413] lstrlenA (lpString="*.tar") returned 5 [0063.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0063.413] lstrlenA (lpString="*.gzip") returned 6 [0063.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0063.413] lstrlenA (lpString="*.jpg") returned 5 [0063.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0063.413] lstrlenA (lpString="*.jpeg") returned 6 [0063.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0063.413] lstrlenA (lpString="*.psd") returned 5 [0063.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0063.414] lstrlenA (lpString="*.gif") returned 5 [0063.414] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF" [0063.414] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF" [0063.414] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF." [0063.414] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF.wannacry" [0063.414] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.415] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ce [0063.415] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x66293410, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea)) returned 1 [0063.415] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.415] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x150, lpOverlapped=0x0) returned 1 [0063.416] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0063.416] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.416] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x150, lpOverlapped=0x0) returned 1 [0063.416] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.417] CloseHandle (hObject=0xa0) returned 1 [0063.417] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_off.gif.wannacry")) returned 1 [0063.418] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x568309f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0063.418] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.418] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0063.418] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0063.418] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0063.418] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0063.418] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\" [0063.418] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\") returned="" [0063.418] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt" [0063.418] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\how to decrypt files.txt")) returned 0x20 [0063.418] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF" [0063.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0063.418] lstrlenA (lpString="*.zip") returned 5 [0063.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0063.419] lstrlenA (lpString="*.rar") returned 5 [0063.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0063.419] lstrlenA (lpString="*.7z") returned 4 [0063.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0063.419] lstrlenA (lpString="*.tar") returned 5 [0063.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0063.419] lstrlenA (lpString="*.gzip") returned 6 [0063.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0063.419] lstrlenA (lpString="*.jpg") returned 5 [0063.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0063.419] lstrlenA (lpString="*.jpeg") returned 6 [0063.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0063.419] lstrlenA (lpString="*.psd") returned 5 [0063.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0063.419] lstrlenA (lpString="*.gif") returned 5 [0063.419] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF" [0063.419] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF" [0063.419] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF." [0063.419] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF.wannacry" [0063.419] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.420] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10b [0063.420] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x568309f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea)) returned 1 [0063.420] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.420] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x8d, lpOverlapped=0x0) returned 1 [0063.421] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF") returned="TAB_ON.GIF" [0063.421] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.422] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x8d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x8d, lpOverlapped=0x0) returned 1 [0063.422] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.422] CloseHandle (hObject=0xa0) returned 1 [0063.422] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_on.gif.wannacry")) returned 1 [0063.426] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x568309f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0063.426] FindClose (in: hFindFile=0x2e3478 | out: hFindFile=0x2e3478) returned 1 [0063.426] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1091, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="Lime.css", cAlternateFileName="")) returned 1 [0063.426] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0063.426] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Lime.css") returned -1 [0063.426] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Lime.css") returned -1 [0063.426] lstrcmpiA (lpString1="", lpString2="Lime.css") returned -1 [0063.426] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0063.426] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0063.426] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0063.426] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0063.426] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0063.426] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Lime.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css" [0063.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.zip") returned 0 [0063.426] lstrlenA (lpString="*.zip") returned 5 [0063.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.rar") returned 0 [0063.426] lstrlenA (lpString="*.rar") returned 5 [0063.426] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.7z") returned 0 [0063.427] lstrlenA (lpString="*.7z") returned 4 [0063.427] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.tar") returned 0 [0063.427] lstrlenA (lpString="*.tar") returned 5 [0063.427] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.gzip") returned 0 [0063.427] lstrlenA (lpString="*.gzip") returned 6 [0063.427] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.jpg") returned 0 [0063.427] lstrlenA (lpString="*.jpg") returned 5 [0063.427] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.jpeg") returned 0 [0063.427] lstrlenA (lpString="*.jpeg") returned 6 [0063.427] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.psd") returned 0 [0063.427] lstrlenA (lpString="*.psd") returned 5 [0063.427] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.gif") returned 0 [0063.427] lstrlenA (lpString="*.gif") returned 5 [0063.427] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.doc") returned 0 [0063.427] lstrlenA (lpString="*.doc") returned 5 [0063.427] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.docx") returned 0 [0063.427] lstrlenA (lpString="*.docx") returned 6 [0063.427] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.xls") returned 0 [0063.427] lstrlenA (lpString="*.xls") returned 5 [0063.427] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.xlsx") returned 0 [0063.427] lstrlenA (lpString="*.xlsx") returned 6 [0063.427] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.ppt") returned 0 [0063.427] lstrlenA (lpString="*.ppt") returned 5 [0063.427] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.pptx") returned 0 [0063.427] lstrlenA (lpString="*.pptx") returned 6 [0063.427] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.pdf") returned 0 [0063.428] lstrlenA (lpString="*.pdf") returned 5 [0063.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.mov") returned 0 [0063.428] lstrlenA (lpString="*.mov") returned 5 [0063.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.m2v") returned 0 [0063.428] lstrlenA (lpString="*.m2v") returned 5 [0063.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.3gp") returned 0 [0063.428] lstrlenA (lpString="*.3gp") returned 5 [0063.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.mpeg") returned 0 [0063.428] lstrlenA (lpString="*.mpeg") returned 6 [0063.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.mpg") returned 0 [0063.428] lstrlenA (lpString="*.mpg") returned 5 [0063.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.flv") returned 0 [0063.428] lstrlenA (lpString="*.flv") returned 5 [0063.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.avi") returned 0 [0063.428] lstrlenA (lpString="*.avi") returned 5 [0063.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.mp4") returned 0 [0063.428] lstrlenA (lpString="*.mp4") returned 5 [0063.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.wmv") returned 0 [0063.428] lstrlenA (lpString="*.wmv") returned 5 [0063.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.divx") returned 0 [0063.428] lstrlenA (lpString="*.divx") returned 6 [0063.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.mkv") returned 0 [0063.428] lstrlenA (lpString="*.mkv") returned 5 [0063.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.mp3") returned 0 [0063.428] lstrlenA (lpString="*.mp3") returned 5 [0063.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.wav") returned 0 [0063.428] lstrlenA (lpString="*.wav") returned 5 [0063.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.flac") returned 0 [0063.429] lstrlenA (lpString="*.flac") returned 6 [0063.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.ape") returned 0 [0063.429] lstrlenA (lpString="*.ape") returned 5 [0063.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.wma") returned 0 [0063.429] lstrlenA (lpString="*.wma") returned 5 [0063.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.ac3") returned 0 [0063.429] lstrlenA (lpString="*.ac3") returned 5 [0063.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.mxf") returned 0 [0063.429] lstrlenA (lpString="*.mxf") returned 5 [0063.429] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x720, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="Maroon.css", cAlternateFileName="")) returned 1 [0063.429] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0063.429] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Maroon.css") returned -1 [0063.429] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Maroon.css") returned -1 [0063.429] lstrcmpiA (lpString1="", lpString2="Maroon.css") returned -1 [0063.429] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css") returned="Lime.css" [0063.429] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0063.429] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0063.429] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0063.429] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0063.429] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Maroon.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css" [0063.429] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.zip") returned 0 [0063.429] lstrlenA (lpString="*.zip") returned 5 [0063.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.rar") returned 0 [0063.430] lstrlenA (lpString="*.rar") returned 5 [0063.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.7z") returned 0 [0063.430] lstrlenA (lpString="*.7z") returned 4 [0063.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.tar") returned 0 [0063.430] lstrlenA (lpString="*.tar") returned 5 [0063.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.gzip") returned 0 [0063.430] lstrlenA (lpString="*.gzip") returned 6 [0063.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.jpg") returned 0 [0063.430] lstrlenA (lpString="*.jpg") returned 5 [0063.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.jpeg") returned 0 [0063.430] lstrlenA (lpString="*.jpeg") returned 6 [0063.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.psd") returned 0 [0063.430] lstrlenA (lpString="*.psd") returned 5 [0063.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.gif") returned 0 [0063.430] lstrlenA (lpString="*.gif") returned 5 [0063.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.doc") returned 0 [0063.430] lstrlenA (lpString="*.doc") returned 5 [0063.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.docx") returned 0 [0063.430] lstrlenA (lpString="*.docx") returned 6 [0063.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.xls") returned 0 [0063.430] lstrlenA (lpString="*.xls") returned 5 [0063.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.xlsx") returned 0 [0063.430] lstrlenA (lpString="*.xlsx") returned 6 [0063.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.ppt") returned 0 [0063.430] lstrlenA (lpString="*.ppt") returned 5 [0063.431] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.pptx") returned 0 [0063.431] lstrlenA (lpString="*.pptx") returned 6 [0063.431] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.pdf") returned 0 [0063.431] lstrlenA (lpString="*.pdf") returned 5 [0063.431] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.mov") returned 0 [0063.431] lstrlenA (lpString="*.mov") returned 5 [0063.431] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.m2v") returned 0 [0063.431] lstrlenA (lpString="*.m2v") returned 5 [0063.431] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.3gp") returned 0 [0063.431] lstrlenA (lpString="*.3gp") returned 5 [0063.431] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.mpeg") returned 0 [0063.431] lstrlenA (lpString="*.mpeg") returned 6 [0063.431] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.mpg") returned 0 [0063.431] lstrlenA (lpString="*.mpg") returned 5 [0063.431] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.flv") returned 0 [0063.431] lstrlenA (lpString="*.flv") returned 5 [0063.431] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.avi") returned 0 [0063.431] lstrlenA (lpString="*.avi") returned 5 [0063.431] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.mp4") returned 0 [0063.431] lstrlenA (lpString="*.mp4") returned 5 [0063.431] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.wmv") returned 0 [0063.431] lstrlenA (lpString="*.wmv") returned 5 [0063.431] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.divx") returned 0 [0063.431] lstrlenA (lpString="*.divx") returned 6 [0063.431] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.mkv") returned 0 [0063.431] lstrlenA (lpString="*.mkv") returned 5 [0063.431] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.mp3") returned 0 [0063.432] lstrlenA (lpString="*.mp3") returned 5 [0063.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.wav") returned 0 [0063.432] lstrlenA (lpString="*.wav") returned 5 [0063.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.flac") returned 0 [0063.432] lstrlenA (lpString="*.flac") returned 6 [0063.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.ape") returned 0 [0063.432] lstrlenA (lpString="*.ape") returned 5 [0063.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.wma") returned 0 [0063.432] lstrlenA (lpString="*.wma") returned 5 [0063.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.ac3") returned 0 [0063.432] lstrlenA (lpString="*.ac3") returned 5 [0063.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.mxf") returned 0 [0063.432] lstrlenA (lpString="*.mxf") returned 5 [0063.432] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b22b3b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="Oasis", cAlternateFileName="")) returned 1 [0063.432] lstrcmpA (lpString1=".", lpString2="Oasis") returned -1 [0063.432] lstrcmpA (lpString1="..", lpString2="Oasis") returned -1 [0063.432] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css") returned="Maroon.css" [0063.432] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Oasis" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis" [0063.432] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis") returned 100 [0063.432] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b22b3b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x2d827e, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0063.434] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.434] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b22b3b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0063.434] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.434] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.434] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x86c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0063.434] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.434] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HEADER.GIF") returned -1 [0063.434] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0063.434] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0063.434] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\*.*") returned="*.*" [0063.434] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\" [0063.435] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\") returned="" [0063.435] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt" [0063.435] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\how to decrypt files.txt")) returned 0xffffffff [0063.435] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.436] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0063.436] WriteFile (in: hFile=0xa0, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0063.437] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.438] CloseHandle (hObject=0xa0) returned 1 [0063.438] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF" [0063.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.zip") returned 0 [0063.438] lstrlenA (lpString="*.zip") returned 5 [0063.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.rar") returned 0 [0063.438] lstrlenA (lpString="*.rar") returned 5 [0063.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.7z") returned 0 [0063.438] lstrlenA (lpString="*.7z") returned 4 [0063.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.tar") returned 0 [0063.438] lstrlenA (lpString="*.tar") returned 5 [0063.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0063.438] lstrlenA (lpString="*.gzip") returned 6 [0063.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0063.438] lstrlenA (lpString="*.jpg") returned 5 [0063.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0063.438] lstrlenA (lpString="*.jpeg") returned 6 [0063.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.psd") returned 0 [0063.438] lstrlenA (lpString="*.psd") returned 5 [0063.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.gif") returned 1 [0063.438] lstrlenA (lpString="*.gif") returned 5 [0063.438] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF" [0063.438] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF" [0063.439] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF." [0063.439] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF.wannacry" [0063.439] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.440] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x86c [0063.440] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5969b6f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea)) returned 1 [0063.440] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.440] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x7ee, lpOverlapped=0x0) returned 1 [0063.472] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF") returned="HEADER.GIF" [0063.472] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.472] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x7ee, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x7ee, lpOverlapped=0x0) returned 1 [0063.472] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.472] CloseHandle (hObject=0xa0) returned 1 [0063.473] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\header.gif.wannacry")) returned 1 [0063.477] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1f0, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0063.477] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.477] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0063.477] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0063.477] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0063.477] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF") returned="HEADER.GIF" [0063.477] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\" [0063.477] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\") returned="" [0063.477] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt" [0063.477] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\how to decrypt files.txt")) returned 0x20 [0063.477] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF" [0063.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0063.477] lstrlenA (lpString="*.zip") returned 5 [0063.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0063.478] lstrlenA (lpString="*.rar") returned 5 [0063.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0063.478] lstrlenA (lpString="*.7z") returned 4 [0063.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0063.478] lstrlenA (lpString="*.tar") returned 5 [0063.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0063.478] lstrlenA (lpString="*.gzip") returned 6 [0063.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0063.478] lstrlenA (lpString="*.jpg") returned 5 [0063.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0063.478] lstrlenA (lpString="*.jpeg") returned 6 [0063.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0063.478] lstrlenA (lpString="*.psd") returned 5 [0063.478] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0063.478] lstrlenA (lpString="*.gif") returned 5 [0063.478] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF" [0063.478] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF" [0063.478] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF." [0063.478] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF.wannacry" [0063.478] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.480] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f0 [0063.480] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6b22b3b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea)) returned 1 [0063.480] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.480] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x172, lpOverlapped=0x0) returned 1 [0063.481] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0063.481] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.481] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x172, lpOverlapped=0x0) returned 1 [0063.481] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.481] CloseHandle (hObject=0xa0) returned 1 [0063.481] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_off.gif.wannacry")) returned 1 [0063.482] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0063.482] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.482] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0063.482] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0063.482] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0063.482] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0063.482] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\" [0063.482] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\") returned="" [0063.482] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt" [0063.483] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\how to decrypt files.txt")) returned 0x20 [0063.483] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF" [0063.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0063.483] lstrlenA (lpString="*.zip") returned 5 [0063.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0063.483] lstrlenA (lpString="*.rar") returned 5 [0063.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0063.483] lstrlenA (lpString="*.7z") returned 4 [0063.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0063.483] lstrlenA (lpString="*.tar") returned 5 [0063.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0063.483] lstrlenA (lpString="*.gzip") returned 6 [0063.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0063.483] lstrlenA (lpString="*.jpg") returned 5 [0063.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0063.483] lstrlenA (lpString="*.jpeg") returned 6 [0063.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0063.483] lstrlenA (lpString="*.psd") returned 5 [0063.483] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0063.483] lstrlenA (lpString="*.gif") returned 5 [0063.483] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF" [0063.483] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF" [0063.483] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF." [0063.483] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF.wannacry" [0063.483] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.484] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x401 [0063.484] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5969b6f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea)) returned 1 [0063.484] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.484] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x383, lpOverlapped=0x0) returned 1 [0063.494] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF") returned="TAB_ON.GIF" [0063.494] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.494] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x383, lpOverlapped=0x0) returned 1 [0063.494] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.494] CloseHandle (hObject=0xa0) returned 1 [0063.494] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_on.gif.wannacry")) returned 1 [0063.495] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0063.495] FindClose (in: hFindFile=0x2e3478 | out: hFindFile=0x2e3478) returned 1 [0063.496] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xfb0, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="Oasis.css", cAlternateFileName="")) returned 1 [0063.496] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0063.496] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Oasis.css") returned -1 [0063.496] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Oasis.css") returned -1 [0063.496] lstrcmpiA (lpString1="", lpString2="Oasis.css") returned -1 [0063.496] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0063.496] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0063.496] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0063.496] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0063.496] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0063.496] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Oasis.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css" [0063.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.zip") returned 0 [0063.496] lstrlenA (lpString="*.zip") returned 5 [0063.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.rar") returned 0 [0063.496] lstrlenA (lpString="*.rar") returned 5 [0063.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.7z") returned 0 [0063.496] lstrlenA (lpString="*.7z") returned 4 [0063.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.tar") returned 0 [0063.496] lstrlenA (lpString="*.tar") returned 5 [0063.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.gzip") returned 0 [0063.496] lstrlenA (lpString="*.gzip") returned 6 [0063.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.jpg") returned 0 [0063.496] lstrlenA (lpString="*.jpg") returned 5 [0063.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.jpeg") returned 0 [0063.496] lstrlenA (lpString="*.jpeg") returned 6 [0063.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.psd") returned 0 [0063.496] lstrlenA (lpString="*.psd") returned 5 [0063.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.gif") returned 0 [0063.496] lstrlenA (lpString="*.gif") returned 5 [0063.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.doc") returned 0 [0063.497] lstrlenA (lpString="*.doc") returned 5 [0063.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.docx") returned 0 [0063.497] lstrlenA (lpString="*.docx") returned 6 [0063.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.xls") returned 0 [0063.497] lstrlenA (lpString="*.xls") returned 5 [0063.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.xlsx") returned 0 [0063.497] lstrlenA (lpString="*.xlsx") returned 6 [0063.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.ppt") returned 0 [0063.497] lstrlenA (lpString="*.ppt") returned 5 [0063.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.pptx") returned 0 [0063.497] lstrlenA (lpString="*.pptx") returned 6 [0063.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.pdf") returned 0 [0063.497] lstrlenA (lpString="*.pdf") returned 5 [0063.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.mov") returned 0 [0063.497] lstrlenA (lpString="*.mov") returned 5 [0063.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.m2v") returned 0 [0063.497] lstrlenA (lpString="*.m2v") returned 5 [0063.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.3gp") returned 0 [0063.497] lstrlenA (lpString="*.3gp") returned 5 [0063.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.mpeg") returned 0 [0063.497] lstrlenA (lpString="*.mpeg") returned 6 [0063.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.mpg") returned 0 [0063.497] lstrlenA (lpString="*.mpg") returned 5 [0063.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.flv") returned 0 [0063.497] lstrlenA (lpString="*.flv") returned 5 [0063.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.avi") returned 0 [0063.497] lstrlenA (lpString="*.avi") returned 5 [0063.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.mp4") returned 0 [0063.497] lstrlenA (lpString="*.mp4") returned 5 [0063.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.wmv") returned 0 [0063.497] lstrlenA (lpString="*.wmv") returned 5 [0063.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.divx") returned 0 [0063.497] lstrlenA (lpString="*.divx") returned 6 [0063.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.mkv") returned 0 [0063.497] lstrlenA (lpString="*.mkv") returned 5 [0063.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.mp3") returned 0 [0063.498] lstrlenA (lpString="*.mp3") returned 5 [0063.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.wav") returned 0 [0063.498] lstrlenA (lpString="*.wav") returned 5 [0063.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.flac") returned 0 [0063.498] lstrlenA (lpString="*.flac") returned 6 [0063.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.ape") returned 0 [0063.498] lstrlenA (lpString="*.ape") returned 5 [0063.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.wma") returned 0 [0063.498] lstrlenA (lpString="*.wma") returned 5 [0063.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.ac3") returned 0 [0063.498] lstrlenA (lpString="*.ac3") returned 5 [0063.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.mxf") returned 0 [0063.498] lstrlenA (lpString="*.mxf") returned 5 [0063.498] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x74b, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="OliveGreen.css", cAlternateFileName="OLIVEG~1.CSS")) returned 1 [0063.498] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0063.498] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OliveGreen.css") returned -1 [0063.498] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OliveGreen.css") returned -1 [0063.498] lstrcmpiA (lpString1="", lpString2="OliveGreen.css") returned -1 [0063.498] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css") returned="Oasis.css" [0063.498] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0063.498] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0063.498] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0063.498] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0063.498] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="OliveGreen.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css" [0063.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.zip") returned 0 [0063.498] lstrlenA (lpString="*.zip") returned 5 [0063.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.rar") returned 0 [0063.498] lstrlenA (lpString="*.rar") returned 5 [0063.498] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.7z") returned 0 [0063.498] lstrlenA (lpString="*.7z") returned 4 [0063.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.tar") returned 0 [0063.499] lstrlenA (lpString="*.tar") returned 5 [0063.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.gzip") returned 0 [0063.499] lstrlenA (lpString="*.gzip") returned 6 [0063.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.jpg") returned 0 [0063.499] lstrlenA (lpString="*.jpg") returned 5 [0063.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.jpeg") returned 0 [0063.499] lstrlenA (lpString="*.jpeg") returned 6 [0063.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.psd") returned 0 [0063.499] lstrlenA (lpString="*.psd") returned 5 [0063.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.gif") returned 0 [0063.499] lstrlenA (lpString="*.gif") returned 5 [0063.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.doc") returned 0 [0063.499] lstrlenA (lpString="*.doc") returned 5 [0063.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.docx") returned 0 [0063.499] lstrlenA (lpString="*.docx") returned 6 [0063.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.xls") returned 0 [0063.499] lstrlenA (lpString="*.xls") returned 5 [0063.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.xlsx") returned 0 [0063.499] lstrlenA (lpString="*.xlsx") returned 6 [0063.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.ppt") returned 0 [0063.499] lstrlenA (lpString="*.ppt") returned 5 [0063.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.pptx") returned 0 [0063.499] lstrlenA (lpString="*.pptx") returned 6 [0063.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.pdf") returned 0 [0063.499] lstrlenA (lpString="*.pdf") returned 5 [0063.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.mov") returned 0 [0063.499] lstrlenA (lpString="*.mov") returned 5 [0063.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.m2v") returned 0 [0063.499] lstrlenA (lpString="*.m2v") returned 5 [0063.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.3gp") returned 0 [0063.499] lstrlenA (lpString="*.3gp") returned 5 [0063.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.mpeg") returned 0 [0063.500] lstrlenA (lpString="*.mpeg") returned 6 [0063.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.mpg") returned 0 [0063.500] lstrlenA (lpString="*.mpg") returned 5 [0063.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.flv") returned 0 [0063.500] lstrlenA (lpString="*.flv") returned 5 [0063.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.avi") returned 0 [0063.500] lstrlenA (lpString="*.avi") returned 5 [0063.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.mp4") returned 0 [0063.500] lstrlenA (lpString="*.mp4") returned 5 [0063.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.wmv") returned 0 [0063.500] lstrlenA (lpString="*.wmv") returned 5 [0063.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.divx") returned 0 [0063.500] lstrlenA (lpString="*.divx") returned 6 [0063.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.mkv") returned 0 [0063.500] lstrlenA (lpString="*.mkv") returned 5 [0063.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.mp3") returned 0 [0063.500] lstrlenA (lpString="*.mp3") returned 5 [0063.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.wav") returned 0 [0063.500] lstrlenA (lpString="*.wav") returned 5 [0063.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.flac") returned 0 [0063.500] lstrlenA (lpString="*.flac") returned 6 [0063.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.ape") returned 0 [0063.500] lstrlenA (lpString="*.ape") returned 5 [0063.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.wma") returned 0 [0063.500] lstrlenA (lpString="*.wma") returned 5 [0063.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.ac3") returned 0 [0063.500] lstrlenA (lpString="*.ac3") returned 5 [0063.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.mxf") returned 0 [0063.501] lstrlenA (lpString="*.mxf") returned 5 [0063.501] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x706, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="Premium.css", cAlternateFileName="")) returned 1 [0063.501] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0063.501] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Premium.css") returned -1 [0063.501] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Premium.css") returned -1 [0063.501] lstrcmpiA (lpString1="", lpString2="Premium.css") returned -1 [0063.501] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css") returned="OliveGreen.css" [0063.501] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0063.501] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0063.501] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0063.501] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0063.501] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Premium.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css" [0063.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.zip") returned 0 [0063.501] lstrlenA (lpString="*.zip") returned 5 [0063.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.rar") returned 0 [0063.501] lstrlenA (lpString="*.rar") returned 5 [0063.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.7z") returned 0 [0063.501] lstrlenA (lpString="*.7z") returned 4 [0063.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.tar") returned 0 [0063.501] lstrlenA (lpString="*.tar") returned 5 [0063.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.gzip") returned 0 [0063.501] lstrlenA (lpString="*.gzip") returned 6 [0063.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.jpg") returned 0 [0063.501] lstrlenA (lpString="*.jpg") returned 5 [0063.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.jpeg") returned 0 [0063.501] lstrlenA (lpString="*.jpeg") returned 6 [0063.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.psd") returned 0 [0063.502] lstrlenA (lpString="*.psd") returned 5 [0063.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.gif") returned 0 [0063.502] lstrlenA (lpString="*.gif") returned 5 [0063.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.doc") returned 0 [0063.502] lstrlenA (lpString="*.doc") returned 5 [0063.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.docx") returned 0 [0063.502] lstrlenA (lpString="*.docx") returned 6 [0063.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.xls") returned 0 [0063.502] lstrlenA (lpString="*.xls") returned 5 [0063.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.xlsx") returned 0 [0063.502] lstrlenA (lpString="*.xlsx") returned 6 [0063.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.ppt") returned 0 [0063.502] lstrlenA (lpString="*.ppt") returned 5 [0063.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.pptx") returned 0 [0063.502] lstrlenA (lpString="*.pptx") returned 6 [0063.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.pdf") returned 0 [0063.503] lstrlenA (lpString="*.pdf") returned 5 [0063.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.mov") returned 0 [0063.503] lstrlenA (lpString="*.mov") returned 5 [0063.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.m2v") returned 0 [0063.503] lstrlenA (lpString="*.m2v") returned 5 [0063.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.3gp") returned 0 [0063.503] lstrlenA (lpString="*.3gp") returned 5 [0063.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.mpeg") returned 0 [0063.503] lstrlenA (lpString="*.mpeg") returned 6 [0063.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.mpg") returned 0 [0063.503] lstrlenA (lpString="*.mpg") returned 5 [0063.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.flv") returned 0 [0063.503] lstrlenA (lpString="*.flv") returned 5 [0063.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.avi") returned 0 [0063.503] lstrlenA (lpString="*.avi") returned 5 [0063.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.mp4") returned 0 [0063.503] lstrlenA (lpString="*.mp4") returned 5 [0063.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.wmv") returned 0 [0063.503] lstrlenA (lpString="*.wmv") returned 5 [0063.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.divx") returned 0 [0063.503] lstrlenA (lpString="*.divx") returned 6 [0063.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.mkv") returned 0 [0063.503] lstrlenA (lpString="*.mkv") returned 5 [0063.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.mp3") returned 0 [0063.503] lstrlenA (lpString="*.mp3") returned 5 [0063.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.wav") returned 0 [0063.503] lstrlenA (lpString="*.wav") returned 5 [0063.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.flac") returned 0 [0063.503] lstrlenA (lpString="*.flac") returned 6 [0063.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.ape") returned 0 [0063.504] lstrlenA (lpString="*.ape") returned 5 [0063.504] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.wma") returned 0 [0063.504] lstrlenA (lpString="*.wma") returned 5 [0063.504] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.ac3") returned 0 [0063.504] lstrlenA (lpString="*.ac3") returned 5 [0063.504] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.mxf") returned 0 [0063.504] lstrlenA (lpString="*.mxf") returned 5 [0063.504] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a9f29b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2e6230, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="Slate", cAlternateFileName="")) returned 1 [0063.504] lstrcmpA (lpString1=".", lpString2="Slate") returned -1 [0063.504] lstrcmpA (lpString1="..", lpString2="Slate") returned -1 [0063.504] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css") returned="Premium.css" [0063.504] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Slate" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate" [0063.504] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate") returned 100 [0063.504] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a9f29b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2e6230, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x2d827e, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0063.505] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.505] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a9f29b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2e6230, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0063.505] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.505] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.505] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0063.505] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.505] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0063.505] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0063.505] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0063.505] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\*.*") returned="*.*" [0063.505] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\" [0063.506] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\") returned="" [0063.506] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt" [0063.506] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\how to decrypt files.txt")) returned 0xffffffff [0063.506] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.507] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0063.507] WriteFile (in: hFile=0xa0, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0063.508] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.508] CloseHandle (hObject=0xa0) returned 1 [0063.508] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF" [0063.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0063.508] lstrlenA (lpString="*.zip") returned 5 [0063.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0063.508] lstrlenA (lpString="*.rar") returned 5 [0063.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0063.508] lstrlenA (lpString="*.7z") returned 4 [0063.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0063.508] lstrlenA (lpString="*.tar") returned 5 [0063.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0063.508] lstrlenA (lpString="*.gzip") returned 6 [0063.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0063.508] lstrlenA (lpString="*.jpg") returned 5 [0063.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0063.508] lstrlenA (lpString="*.jpeg") returned 6 [0063.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0063.508] lstrlenA (lpString="*.psd") returned 5 [0063.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0063.508] lstrlenA (lpString="*.gif") returned 5 [0063.508] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF" [0063.508] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF" [0063.508] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF." [0063.509] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF.wannacry" [0063.509] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.510] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16c [0063.510] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d2e6230, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea)) returned 1 [0063.510] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.510] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xee, lpOverlapped=0x0) returned 1 [0063.511] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0063.511] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.511] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xee, lpOverlapped=0x0) returned 1 [0063.511] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.511] CloseHandle (hObject=0xa0) returned 1 [0063.512] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_off.gif.wannacry")) returned 1 [0063.513] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0063.513] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.513] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0063.513] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0063.513] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0063.513] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0063.513] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\" [0063.513] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\") returned="" [0063.513] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt" [0063.513] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\how to decrypt files.txt")) returned 0x20 [0063.513] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF" [0063.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0063.513] lstrlenA (lpString="*.zip") returned 5 [0063.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0063.513] lstrlenA (lpString="*.rar") returned 5 [0063.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0063.513] lstrlenA (lpString="*.7z") returned 4 [0063.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0063.513] lstrlenA (lpString="*.tar") returned 5 [0063.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0063.513] lstrlenA (lpString="*.gzip") returned 6 [0063.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0063.513] lstrlenA (lpString="*.jpg") returned 5 [0063.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0063.513] lstrlenA (lpString="*.jpeg") returned 6 [0063.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0063.513] lstrlenA (lpString="*.psd") returned 5 [0063.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0063.514] lstrlenA (lpString="*.gif") returned 5 [0063.514] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF" [0063.514] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF" [0063.514] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF." [0063.514] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF.wannacry" [0063.514] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.514] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16c [0063.514] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a9f29b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea)) returned 1 [0063.515] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.515] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xee, lpOverlapped=0x0) returned 1 [0063.515] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF") returned="TAB_ON.GIF" [0063.516] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.516] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xee, lpOverlapped=0x0) returned 1 [0063.516] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.516] CloseHandle (hObject=0xa0) returned 1 [0063.516] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_on.gif.wannacry")) returned 1 [0063.541] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0063.541] FindClose (in: hFindFile=0x2e3478 | out: hFindFile=0x2e3478) returned 1 [0063.542] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10d7, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="Slate.css", cAlternateFileName="")) returned 1 [0063.542] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0063.542] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Slate.css") returned -1 [0063.542] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Slate.css") returned -1 [0063.542] lstrcmpiA (lpString1="", lpString2="Slate.css") returned -1 [0063.542] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0063.542] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0063.542] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0063.542] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0063.542] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0063.542] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Slate.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css" [0063.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.zip") returned 0 [0063.542] lstrlenA (lpString="*.zip") returned 5 [0063.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.rar") returned 0 [0063.542] lstrlenA (lpString="*.rar") returned 5 [0063.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.7z") returned 0 [0063.542] lstrlenA (lpString="*.7z") returned 4 [0063.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.tar") returned 0 [0063.542] lstrlenA (lpString="*.tar") returned 5 [0063.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.gzip") returned 0 [0063.542] lstrlenA (lpString="*.gzip") returned 6 [0063.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.jpg") returned 0 [0063.542] lstrlenA (lpString="*.jpg") returned 5 [0063.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.jpeg") returned 0 [0063.543] lstrlenA (lpString="*.jpeg") returned 6 [0063.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.psd") returned 0 [0063.543] lstrlenA (lpString="*.psd") returned 5 [0063.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.gif") returned 0 [0063.543] lstrlenA (lpString="*.gif") returned 5 [0063.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.doc") returned 0 [0063.543] lstrlenA (lpString="*.doc") returned 5 [0063.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.docx") returned 0 [0063.543] lstrlenA (lpString="*.docx") returned 6 [0063.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.xls") returned 0 [0063.543] lstrlenA (lpString="*.xls") returned 5 [0063.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.xlsx") returned 0 [0063.543] lstrlenA (lpString="*.xlsx") returned 6 [0063.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.ppt") returned 0 [0063.543] lstrlenA (lpString="*.ppt") returned 5 [0063.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.pptx") returned 0 [0063.543] lstrlenA (lpString="*.pptx") returned 6 [0063.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.pdf") returned 0 [0063.543] lstrlenA (lpString="*.pdf") returned 5 [0063.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.mov") returned 0 [0063.543] lstrlenA (lpString="*.mov") returned 5 [0063.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.m2v") returned 0 [0063.543] lstrlenA (lpString="*.m2v") returned 5 [0063.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.3gp") returned 0 [0063.543] lstrlenA (lpString="*.3gp") returned 5 [0063.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.mpeg") returned 0 [0063.543] lstrlenA (lpString="*.mpeg") returned 6 [0063.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.mpg") returned 0 [0063.544] lstrlenA (lpString="*.mpg") returned 5 [0063.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.flv") returned 0 [0063.544] lstrlenA (lpString="*.flv") returned 5 [0063.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.avi") returned 0 [0063.544] lstrlenA (lpString="*.avi") returned 5 [0063.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.mp4") returned 0 [0063.544] lstrlenA (lpString="*.mp4") returned 5 [0063.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.wmv") returned 0 [0063.544] lstrlenA (lpString="*.wmv") returned 5 [0063.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.divx") returned 0 [0063.544] lstrlenA (lpString="*.divx") returned 6 [0063.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.mkv") returned 0 [0063.544] lstrlenA (lpString="*.mkv") returned 5 [0063.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.mp3") returned 0 [0063.544] lstrlenA (lpString="*.mp3") returned 5 [0063.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.wav") returned 0 [0063.544] lstrlenA (lpString="*.wav") returned 5 [0063.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.flac") returned 0 [0063.544] lstrlenA (lpString="*.flac") returned 6 [0063.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.ape") returned 0 [0063.544] lstrlenA (lpString="*.ape") returned 5 [0063.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.wma") returned 0 [0063.544] lstrlenA (lpString="*.wma") returned 5 [0063.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.ac3") returned 0 [0063.544] lstrlenA (lpString="*.ac3") returned 5 [0063.544] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.mxf") returned 0 [0063.544] lstrlenA (lpString="*.mxf") returned 5 [0063.544] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x74a, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="SlateBlue.css", cAlternateFileName="SLATEB~1.CSS")) returned 1 [0063.545] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0063.545] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SlateBlue.css") returned -1 [0063.545] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SlateBlue.css") returned -1 [0063.545] lstrcmpiA (lpString1="", lpString2="SlateBlue.css") returned -1 [0063.545] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css") returned="Slate.css" [0063.545] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0063.545] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0063.545] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0063.545] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0063.545] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="SlateBlue.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css" [0063.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.zip") returned 0 [0063.545] lstrlenA (lpString="*.zip") returned 5 [0063.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.rar") returned 0 [0063.545] lstrlenA (lpString="*.rar") returned 5 [0063.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.7z") returned 0 [0063.545] lstrlenA (lpString="*.7z") returned 4 [0063.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.tar") returned 0 [0063.545] lstrlenA (lpString="*.tar") returned 5 [0063.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.gzip") returned 0 [0063.545] lstrlenA (lpString="*.gzip") returned 6 [0063.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.jpg") returned 0 [0063.545] lstrlenA (lpString="*.jpg") returned 5 [0063.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.jpeg") returned 0 [0063.545] lstrlenA (lpString="*.jpeg") returned 6 [0063.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.psd") returned 0 [0063.545] lstrlenA (lpString="*.psd") returned 5 [0063.545] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.gif") returned 0 [0063.546] lstrlenA (lpString="*.gif") returned 5 [0063.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.doc") returned 0 [0063.546] lstrlenA (lpString="*.doc") returned 5 [0063.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.docx") returned 0 [0063.546] lstrlenA (lpString="*.docx") returned 6 [0063.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.xls") returned 0 [0063.546] lstrlenA (lpString="*.xls") returned 5 [0063.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.xlsx") returned 0 [0063.546] lstrlenA (lpString="*.xlsx") returned 6 [0063.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.ppt") returned 0 [0063.546] lstrlenA (lpString="*.ppt") returned 5 [0063.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.pptx") returned 0 [0063.546] lstrlenA (lpString="*.pptx") returned 6 [0063.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.pdf") returned 0 [0063.546] lstrlenA (lpString="*.pdf") returned 5 [0063.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.mov") returned 0 [0063.546] lstrlenA (lpString="*.mov") returned 5 [0063.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.m2v") returned 0 [0063.546] lstrlenA (lpString="*.m2v") returned 5 [0063.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.3gp") returned 0 [0063.546] lstrlenA (lpString="*.3gp") returned 5 [0063.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.mpeg") returned 0 [0063.546] lstrlenA (lpString="*.mpeg") returned 6 [0063.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.mpg") returned 0 [0063.546] lstrlenA (lpString="*.mpg") returned 5 [0063.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.flv") returned 0 [0063.546] lstrlenA (lpString="*.flv") returned 5 [0063.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.avi") returned 0 [0063.546] lstrlenA (lpString="*.avi") returned 5 [0063.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.mp4") returned 0 [0063.547] lstrlenA (lpString="*.mp4") returned 5 [0063.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.wmv") returned 0 [0063.547] lstrlenA (lpString="*.wmv") returned 5 [0063.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.divx") returned 0 [0063.547] lstrlenA (lpString="*.divx") returned 6 [0063.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.mkv") returned 0 [0063.547] lstrlenA (lpString="*.mkv") returned 5 [0063.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.mp3") returned 0 [0063.547] lstrlenA (lpString="*.mp3") returned 5 [0063.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.wav") returned 0 [0063.547] lstrlenA (lpString="*.wav") returned 5 [0063.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.flac") returned 0 [0063.547] lstrlenA (lpString="*.flac") returned 6 [0063.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.ape") returned 0 [0063.547] lstrlenA (lpString="*.ape") returned 5 [0063.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.wma") returned 0 [0063.547] lstrlenA (lpString="*.wma") returned 5 [0063.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.ac3") returned 0 [0063.547] lstrlenA (lpString="*.ac3") returned 5 [0063.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.mxf") returned 0 [0063.547] lstrlenA (lpString="*.mxf") returned 5 [0063.547] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d37e7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="SoftBlue", cAlternateFileName="")) returned 1 [0063.547] lstrcmpA (lpString1=".", lpString2="SoftBlue") returned -1 [0063.547] lstrcmpA (lpString1="..", lpString2="SoftBlue") returned -1 [0063.547] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css") returned="SlateBlue.css" [0063.547] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="SoftBlue" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue" [0063.547] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue") returned 103 [0063.547] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d37e7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x2d827e, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0063.548] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.548] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d37e7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0063.548] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.548] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.548] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1afa, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0063.548] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.548] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="background.gif") returned 1 [0063.548] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1 [0063.548] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1 [0063.548] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\*.*") returned="*.*" [0063.548] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\" [0063.548] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\") returned="" [0063.548] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt" [0063.548] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\how to decrypt files.txt")) returned 0xffffffff [0063.549] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.551] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0063.551] WriteFile (in: hFile=0xa0, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0063.553] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.553] CloseHandle (hObject=0xa0) returned 1 [0063.553] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" [0063.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.zip") returned 0 [0063.553] lstrlenA (lpString="*.zip") returned 5 [0063.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.rar") returned 0 [0063.553] lstrlenA (lpString="*.rar") returned 5 [0063.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.7z") returned 0 [0063.553] lstrlenA (lpString="*.7z") returned 4 [0063.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.tar") returned 0 [0063.553] lstrlenA (lpString="*.tar") returned 5 [0063.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.gzip") returned 0 [0063.553] lstrlenA (lpString="*.gzip") returned 6 [0063.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.jpg") returned 0 [0063.553] lstrlenA (lpString="*.jpg") returned 5 [0063.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.jpeg") returned 0 [0063.553] lstrlenA (lpString="*.jpeg") returned 6 [0063.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.psd") returned 0 [0063.553] lstrlenA (lpString="*.psd") returned 5 [0063.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.gif") returned 1 [0063.553] lstrlenA (lpString="*.gif") returned 5 [0063.553] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" [0063.553] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" [0063.553] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif." [0063.553] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif.wannacry" [0063.553] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.555] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1afa [0063.555] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d37e7b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea)) returned 1 [0063.555] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.555] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1a7c, lpOverlapped=0x0) returned 1 [0063.557] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif") returned="background.gif" [0063.557] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.557] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1a7c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1a7c, lpOverlapped=0x0) returned 1 [0063.558] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.558] CloseHandle (hObject=0xa0) returned 1 [0063.558] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif.wannacry")) returned 1 [0063.559] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0063.559] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.559] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0063.559] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0063.559] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0063.559] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif") returned="background.gif" [0063.559] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\" [0063.559] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\") returned="" [0063.559] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt" [0063.559] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\how to decrypt files.txt")) returned 0x20 [0063.559] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" [0063.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0063.559] lstrlenA (lpString="*.zip") returned 5 [0063.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0063.559] lstrlenA (lpString="*.rar") returned 5 [0063.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0063.559] lstrlenA (lpString="*.7z") returned 4 [0063.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0063.559] lstrlenA (lpString="*.tar") returned 5 [0063.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0063.560] lstrlenA (lpString="*.gzip") returned 6 [0063.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0063.560] lstrlenA (lpString="*.jpg") returned 5 [0063.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0063.560] lstrlenA (lpString="*.jpeg") returned 6 [0063.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0063.560] lstrlenA (lpString="*.psd") returned 5 [0063.560] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0063.561] lstrlenA (lpString="*.gif") returned 5 [0063.561] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" [0063.561] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" [0063.562] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF." [0063.562] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.wannacry" [0063.562] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.562] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0063.562] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d3a4910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea)) returned 1 [0063.562] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.562] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd7, lpOverlapped=0x0) returned 1 [0063.563] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0063.563] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.563] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd7, lpOverlapped=0x0) returned 1 [0063.564] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.564] CloseHandle (hObject=0xa0) returned 1 [0063.564] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_off.gif.wannacry")) returned 1 [0063.565] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0063.565] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.565] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0063.565] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0063.565] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0063.565] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0063.565] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\" [0063.565] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\") returned="" [0063.565] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt" [0063.565] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\how to decrypt files.txt")) returned 0x20 [0063.565] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF" [0063.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0063.565] lstrlenA (lpString="*.zip") returned 5 [0063.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0063.565] lstrlenA (lpString="*.rar") returned 5 [0063.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0063.565] lstrlenA (lpString="*.7z") returned 4 [0063.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0063.565] lstrlenA (lpString="*.tar") returned 5 [0063.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0063.566] lstrlenA (lpString="*.gzip") returned 6 [0063.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0063.566] lstrlenA (lpString="*.jpg") returned 5 [0063.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0063.566] lstrlenA (lpString="*.jpeg") returned 6 [0063.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0063.566] lstrlenA (lpString="*.psd") returned 5 [0063.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0063.566] lstrlenA (lpString="*.gif") returned 5 [0063.566] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF" [0063.566] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF" [0063.566] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF." [0063.566] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF.wannacry" [0063.566] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.567] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0063.567] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5aad71f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea)) returned 1 [0063.567] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.567] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60, lpOverlapped=0x0) returned 1 [0063.568] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF") returned="TAB_ON.GIF" [0063.568] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.568] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60, lpOverlapped=0x0) returned 1 [0063.568] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.568] CloseHandle (hObject=0xa0) returned 1 [0063.568] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_on.gif.wannacry")) returned 1 [0063.569] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0063.569] FindClose (in: hFindFile=0x2e3478 | out: hFindFile=0x2e3478) returned 1 [0063.569] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x11ca, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="SoftBlue.css", cAlternateFileName="")) returned 1 [0063.569] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0063.569] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SoftBlue.css") returned -1 [0063.569] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SoftBlue.css") returned -1 [0063.569] lstrcmpiA (lpString1="", lpString2="SoftBlue.css") returned -1 [0063.569] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0063.569] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0063.569] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0063.569] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0063.569] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0063.569] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="SoftBlue.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css" [0063.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.zip") returned 0 [0063.570] lstrlenA (lpString="*.zip") returned 5 [0063.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.rar") returned 0 [0063.570] lstrlenA (lpString="*.rar") returned 5 [0063.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.7z") returned 0 [0063.570] lstrlenA (lpString="*.7z") returned 4 [0063.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.tar") returned 0 [0063.570] lstrlenA (lpString="*.tar") returned 5 [0063.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.gzip") returned 0 [0063.570] lstrlenA (lpString="*.gzip") returned 6 [0063.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.jpg") returned 0 [0063.570] lstrlenA (lpString="*.jpg") returned 5 [0063.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.jpeg") returned 0 [0063.570] lstrlenA (lpString="*.jpeg") returned 6 [0063.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.psd") returned 0 [0063.570] lstrlenA (lpString="*.psd") returned 5 [0063.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.gif") returned 0 [0063.570] lstrlenA (lpString="*.gif") returned 5 [0063.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.doc") returned 0 [0063.570] lstrlenA (lpString="*.doc") returned 5 [0063.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.docx") returned 0 [0063.570] lstrlenA (lpString="*.docx") returned 6 [0063.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.xls") returned 0 [0063.570] lstrlenA (lpString="*.xls") returned 5 [0063.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.xlsx") returned 0 [0063.570] lstrlenA (lpString="*.xlsx") returned 6 [0063.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.ppt") returned 0 [0063.570] lstrlenA (lpString="*.ppt") returned 5 [0063.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.pptx") returned 0 [0063.571] lstrlenA (lpString="*.pptx") returned 6 [0063.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.pdf") returned 0 [0063.571] lstrlenA (lpString="*.pdf") returned 5 [0063.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.mov") returned 0 [0063.571] lstrlenA (lpString="*.mov") returned 5 [0063.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.m2v") returned 0 [0063.571] lstrlenA (lpString="*.m2v") returned 5 [0063.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.3gp") returned 0 [0063.571] lstrlenA (lpString="*.3gp") returned 5 [0063.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.mpeg") returned 0 [0063.571] lstrlenA (lpString="*.mpeg") returned 6 [0063.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.mpg") returned 0 [0063.571] lstrlenA (lpString="*.mpg") returned 5 [0063.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.flv") returned 0 [0063.571] lstrlenA (lpString="*.flv") returned 5 [0063.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.avi") returned 0 [0063.571] lstrlenA (lpString="*.avi") returned 5 [0063.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.mp4") returned 0 [0063.571] lstrlenA (lpString="*.mp4") returned 5 [0063.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.wmv") returned 0 [0063.571] lstrlenA (lpString="*.wmv") returned 5 [0063.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.divx") returned 0 [0063.571] lstrlenA (lpString="*.divx") returned 6 [0063.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.mkv") returned 0 [0063.571] lstrlenA (lpString="*.mkv") returned 5 [0063.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.mp3") returned 0 [0063.571] lstrlenA (lpString="*.mp3") returned 5 [0063.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.wav") returned 0 [0063.572] lstrlenA (lpString="*.wav") returned 5 [0063.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.flac") returned 0 [0063.572] lstrlenA (lpString="*.flac") returned 6 [0063.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.ape") returned 0 [0063.572] lstrlenA (lpString="*.ape") returned 5 [0063.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.wma") returned 0 [0063.572] lstrlenA (lpString="*.wma") returned 5 [0063.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.ac3") returned 0 [0063.572] lstrlenA (lpString="*.ac3") returned 5 [0063.572] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.mxf") returned 0 [0063.572] lstrlenA (lpString="*.mxf") returned 5 [0063.572] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ab49610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="SpringGreen", cAlternateFileName="SPRING~1")) returned 1 [0063.572] lstrcmpA (lpString1=".", lpString2="SpringGreen") returned -1 [0063.572] lstrcmpA (lpString1="..", lpString2="SpringGreen") returned -1 [0063.572] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css") returned="SoftBlue.css" [0063.572] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="SpringGreen" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen" [0063.572] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen") returned 106 [0063.572] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ab49610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x2d827e, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0063.574] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.574] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ab49610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0063.574] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.574] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.574] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0063.574] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.574] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BUTTON.GIF") returned 1 [0063.574] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BUTTON.GIF") returned 1 [0063.575] lstrcmpiA (lpString1="", lpString2="BUTTON.GIF") returned -1 [0063.575] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\*.*") returned="*.*" [0063.575] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\" [0063.575] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\") returned="" [0063.575] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" [0063.575] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\how to decrypt files.txt")) returned 0xffffffff [0063.575] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.576] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0063.576] WriteFile (in: hFile=0xa0, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0063.577] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.577] CloseHandle (hObject=0xa0) returned 1 [0063.577] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\", lpString2="BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF" [0063.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.zip") returned 0 [0063.577] lstrlenA (lpString="*.zip") returned 5 [0063.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.rar") returned 0 [0063.577] lstrlenA (lpString="*.rar") returned 5 [0063.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.7z") returned 0 [0063.577] lstrlenA (lpString="*.7z") returned 4 [0063.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.tar") returned 0 [0063.577] lstrlenA (lpString="*.tar") returned 5 [0063.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.gzip") returned 0 [0063.577] lstrlenA (lpString="*.gzip") returned 6 [0063.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.jpg") returned 0 [0063.577] lstrlenA (lpString="*.jpg") returned 5 [0063.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.jpeg") returned 0 [0063.577] lstrlenA (lpString="*.jpeg") returned 6 [0063.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.psd") returned 0 [0063.577] lstrlenA (lpString="*.psd") returned 5 [0063.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.gif") returned 1 [0063.577] lstrlenA (lpString="*.gif") returned 5 [0063.577] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF" [0063.577] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF" [0063.578] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF." [0063.578] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF.wannacry" [0063.578] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.579] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ac [0063.579] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d3a4910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea)) returned 1 [0063.579] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.580] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x12e, lpOverlapped=0x0) returned 1 [0063.581] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="BUTTON.GIF" [0063.581] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.581] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x12e, lpOverlapped=0x0) returned 1 [0063.581] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.581] CloseHandle (hObject=0xa0) returned 1 [0063.581] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\button.gif.wannacry")) returned 1 [0063.593] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0063.593] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.593] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0063.593] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0063.593] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0063.593] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="BUTTON.GIF" [0063.593] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\" [0063.593] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\") returned="" [0063.593] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" [0063.593] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\how to decrypt files.txt")) returned 0x20 [0063.594] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" [0063.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0063.594] lstrlenA (lpString="*.zip") returned 5 [0063.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0063.594] lstrlenA (lpString="*.rar") returned 5 [0063.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0063.594] lstrlenA (lpString="*.7z") returned 4 [0063.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0063.594] lstrlenA (lpString="*.tar") returned 5 [0063.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0063.594] lstrlenA (lpString="*.gzip") returned 6 [0063.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0063.594] lstrlenA (lpString="*.jpg") returned 5 [0063.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0063.594] lstrlenA (lpString="*.jpeg") returned 6 [0063.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0063.594] lstrlenA (lpString="*.psd") returned 5 [0063.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0063.594] lstrlenA (lpString="*.gif") returned 5 [0063.594] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" [0063.594] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" [0063.594] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF." [0063.594] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.wannacry" [0063.594] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.595] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0063.595] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ab49610, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea)) returned 1 [0063.595] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.595] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd7, lpOverlapped=0x0) returned 1 [0063.596] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0063.596] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.596] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd7, lpOverlapped=0x0) returned 1 [0063.596] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.597] CloseHandle (hObject=0xa0) returned 1 [0063.597] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_off.gif.wannacry")) returned 1 [0063.598] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0063.598] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.598] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0063.598] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0063.598] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0063.598] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0063.598] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\" [0063.598] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\") returned="" [0063.598] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" [0063.598] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\how to decrypt files.txt")) returned 0x20 [0063.598] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF" [0063.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0063.598] lstrlenA (lpString="*.zip") returned 5 [0063.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0063.598] lstrlenA (lpString="*.rar") returned 5 [0063.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0063.598] lstrlenA (lpString="*.7z") returned 4 [0063.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0063.598] lstrlenA (lpString="*.tar") returned 5 [0063.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0063.598] lstrlenA (lpString="*.gzip") returned 6 [0063.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0063.598] lstrlenA (lpString="*.jpg") returned 5 [0063.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0063.598] lstrlenA (lpString="*.jpeg") returned 6 [0063.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0063.599] lstrlenA (lpString="*.psd") returned 5 [0063.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0063.599] lstrlenA (lpString="*.gif") returned 5 [0063.599] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF" [0063.599] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF" [0063.599] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF." [0063.599] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF.wannacry" [0063.599] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.600] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0063.600] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ab49610, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea)) returned 1 [0063.600] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.600] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60, lpOverlapped=0x0) returned 1 [0063.601] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned="TAB_ON.GIF" [0063.601] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.601] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60, lpOverlapped=0x0) returned 1 [0063.601] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.601] CloseHandle (hObject=0xa0) returned 1 [0063.601] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_on.gif.wannacry")) returned 1 [0063.602] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0063.602] FindClose (in: hFindFile=0x2e3478 | out: hFindFile=0x2e3478) returned 1 [0063.602] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xfd0, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="SpringGreen.css", cAlternateFileName="SPRING~1.CSS")) returned 1 [0063.602] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0063.602] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SpringGreen.css") returned -1 [0063.602] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SpringGreen.css") returned -1 [0063.602] lstrcmpiA (lpString1="", lpString2="SpringGreen.css") returned -1 [0063.602] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0063.602] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0063.602] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0063.602] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0063.602] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0063.602] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="SpringGreen.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css" [0063.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.zip") returned 0 [0063.602] lstrlenA (lpString="*.zip") returned 5 [0063.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.rar") returned 0 [0063.602] lstrlenA (lpString="*.rar") returned 5 [0063.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.7z") returned 0 [0063.602] lstrlenA (lpString="*.7z") returned 4 [0063.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.tar") returned 0 [0063.603] lstrlenA (lpString="*.tar") returned 5 [0063.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.gzip") returned 0 [0063.603] lstrlenA (lpString="*.gzip") returned 6 [0063.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.jpg") returned 0 [0063.603] lstrlenA (lpString="*.jpg") returned 5 [0063.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.jpeg") returned 0 [0063.603] lstrlenA (lpString="*.jpeg") returned 6 [0063.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.psd") returned 0 [0063.603] lstrlenA (lpString="*.psd") returned 5 [0063.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.gif") returned 0 [0063.603] lstrlenA (lpString="*.gif") returned 5 [0063.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.doc") returned 0 [0063.603] lstrlenA (lpString="*.doc") returned 5 [0063.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.docx") returned 0 [0063.603] lstrlenA (lpString="*.docx") returned 6 [0063.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.xls") returned 0 [0063.603] lstrlenA (lpString="*.xls") returned 5 [0063.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.xlsx") returned 0 [0063.603] lstrlenA (lpString="*.xlsx") returned 6 [0063.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.ppt") returned 0 [0063.603] lstrlenA (lpString="*.ppt") returned 5 [0063.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.pptx") returned 0 [0063.603] lstrlenA (lpString="*.pptx") returned 6 [0063.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.pdf") returned 0 [0063.603] lstrlenA (lpString="*.pdf") returned 5 [0063.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.mov") returned 0 [0063.603] lstrlenA (lpString="*.mov") returned 5 [0063.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.m2v") returned 0 [0063.603] lstrlenA (lpString="*.m2v") returned 5 [0063.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.3gp") returned 0 [0063.603] lstrlenA (lpString="*.3gp") returned 5 [0063.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.mpeg") returned 0 [0063.603] lstrlenA (lpString="*.mpeg") returned 6 [0063.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.mpg") returned 0 [0063.603] lstrlenA (lpString="*.mpg") returned 5 [0063.604] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.flv") returned 0 [0063.604] lstrlenA (lpString="*.flv") returned 5 [0063.604] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.avi") returned 0 [0063.604] lstrlenA (lpString="*.avi") returned 5 [0063.604] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.mp4") returned 0 [0063.604] lstrlenA (lpString="*.mp4") returned 5 [0063.604] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.wmv") returned 0 [0063.604] lstrlenA (lpString="*.wmv") returned 5 [0063.604] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.divx") returned 0 [0063.604] lstrlenA (lpString="*.divx") returned 6 [0063.604] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.mkv") returned 0 [0063.604] lstrlenA (lpString="*.mkv") returned 5 [0063.604] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.mp3") returned 0 [0063.604] lstrlenA (lpString="*.mp3") returned 5 [0063.604] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.wav") returned 0 [0063.604] lstrlenA (lpString="*.wav") returned 5 [0063.604] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.flac") returned 0 [0063.604] lstrlenA (lpString="*.flac") returned 6 [0063.604] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.ape") returned 0 [0063.604] lstrlenA (lpString="*.ape") returned 5 [0063.604] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.wma") returned 0 [0063.604] lstrlenA (lpString="*.wma") returned 5 [0063.604] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.ac3") returned 0 [0063.604] lstrlenA (lpString="*.ac3") returned 5 [0063.604] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.mxf") returned 0 [0063.604] lstrlenA (lpString="*.mxf") returned 5 [0063.604] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xadd, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="Sts.css", cAlternateFileName="")) returned 1 [0063.604] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0063.604] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Sts.css") returned -1 [0063.604] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Sts.css") returned -1 [0063.604] lstrcmpiA (lpString1="", lpString2="Sts.css") returned -1 [0063.604] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css") returned="SpringGreen.css" [0063.604] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0063.604] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0063.605] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0063.605] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0063.605] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Sts.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css" [0063.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.zip") returned 0 [0063.605] lstrlenA (lpString="*.zip") returned 5 [0063.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.rar") returned 0 [0063.605] lstrlenA (lpString="*.rar") returned 5 [0063.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.7z") returned 0 [0063.605] lstrlenA (lpString="*.7z") returned 4 [0063.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.tar") returned 0 [0063.605] lstrlenA (lpString="*.tar") returned 5 [0063.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.gzip") returned 0 [0063.605] lstrlenA (lpString="*.gzip") returned 6 [0063.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.jpg") returned 0 [0063.605] lstrlenA (lpString="*.jpg") returned 5 [0063.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.jpeg") returned 0 [0063.605] lstrlenA (lpString="*.jpeg") returned 6 [0063.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.psd") returned 0 [0063.605] lstrlenA (lpString="*.psd") returned 5 [0063.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.gif") returned 0 [0063.605] lstrlenA (lpString="*.gif") returned 5 [0063.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.doc") returned 0 [0063.605] lstrlenA (lpString="*.doc") returned 5 [0063.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.docx") returned 0 [0063.605] lstrlenA (lpString="*.docx") returned 6 [0063.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.xls") returned 0 [0063.605] lstrlenA (lpString="*.xls") returned 5 [0063.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.xlsx") returned 0 [0063.605] lstrlenA (lpString="*.xlsx") returned 6 [0063.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.ppt") returned 0 [0063.605] lstrlenA (lpString="*.ppt") returned 5 [0063.605] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.pptx") returned 0 [0063.605] lstrlenA (lpString="*.pptx") returned 6 [0063.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.pdf") returned 0 [0063.606] lstrlenA (lpString="*.pdf") returned 5 [0063.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.mov") returned 0 [0063.606] lstrlenA (lpString="*.mov") returned 5 [0063.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.m2v") returned 0 [0063.606] lstrlenA (lpString="*.m2v") returned 5 [0063.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.3gp") returned 0 [0063.606] lstrlenA (lpString="*.3gp") returned 5 [0063.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.mpeg") returned 0 [0063.606] lstrlenA (lpString="*.mpeg") returned 6 [0063.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.mpg") returned 0 [0063.606] lstrlenA (lpString="*.mpg") returned 5 [0063.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.flv") returned 0 [0063.606] lstrlenA (lpString="*.flv") returned 5 [0063.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.avi") returned 0 [0063.606] lstrlenA (lpString="*.avi") returned 5 [0063.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.mp4") returned 0 [0063.606] lstrlenA (lpString="*.mp4") returned 5 [0063.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.wmv") returned 0 [0063.606] lstrlenA (lpString="*.wmv") returned 5 [0063.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.divx") returned 0 [0063.606] lstrlenA (lpString="*.divx") returned 6 [0063.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.mkv") returned 0 [0063.606] lstrlenA (lpString="*.mkv") returned 5 [0063.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.mp3") returned 0 [0063.606] lstrlenA (lpString="*.mp3") returned 5 [0063.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.wav") returned 0 [0063.606] lstrlenA (lpString="*.wav") returned 5 [0063.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.flac") returned 0 [0063.606] lstrlenA (lpString="*.flac") returned 6 [0063.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.ape") returned 0 [0063.606] lstrlenA (lpString="*.ape") returned 5 [0063.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.wma") returned 0 [0063.606] lstrlenA (lpString="*.wma") returned 5 [0063.606] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.ac3") returned 0 [0063.607] lstrlenA (lpString="*.ac3") returned 5 [0063.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.mxf") returned 0 [0063.607] lstrlenA (lpString="*.mxf") returned 5 [0063.607] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="STS2", cAlternateFileName="")) returned 1 [0063.607] lstrcmpA (lpString1=".", lpString2="STS2") returned -1 [0063.607] lstrcmpA (lpString1="..", lpString2="STS2") returned -1 [0063.607] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css") returned="Sts.css" [0063.607] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="STS2" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2" [0063.607] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2") returned 99 [0063.607] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x2d827e, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0063.610] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.610] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0063.611] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.611] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.611] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0063.611] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.611] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="background.gif") returned 1 [0063.611] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1 [0063.611] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1 [0063.611] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\*.*") returned="*.*" [0063.611] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" [0063.611] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\") returned="" [0063.611] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" [0063.611] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\how to decrypt files.txt")) returned 0xffffffff [0063.611] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.613] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0063.613] WriteFile (in: hFile=0xa0, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0063.614] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.614] CloseHandle (hObject=0xa0) returned 1 [0063.614] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" [0063.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.zip") returned 0 [0063.615] lstrlenA (lpString="*.zip") returned 5 [0063.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.rar") returned 0 [0063.615] lstrlenA (lpString="*.rar") returned 5 [0063.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.7z") returned 0 [0063.615] lstrlenA (lpString="*.7z") returned 4 [0063.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.tar") returned 0 [0063.615] lstrlenA (lpString="*.tar") returned 5 [0063.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.gzip") returned 0 [0063.615] lstrlenA (lpString="*.gzip") returned 6 [0063.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.jpg") returned 0 [0063.615] lstrlenA (lpString="*.jpg") returned 5 [0063.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.jpeg") returned 0 [0063.615] lstrlenA (lpString="*.jpeg") returned 6 [0063.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.psd") returned 0 [0063.615] lstrlenA (lpString="*.psd") returned 5 [0063.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.gif") returned 1 [0063.615] lstrlenA (lpString="*.gif") returned 5 [0063.615] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" [0063.615] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" [0063.615] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif." [0063.615] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif.wannacry" [0063.615] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.616] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe9 [0063.616] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d416d30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea)) returned 1 [0063.617] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.617] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x6b, lpOverlapped=0x0) returned 1 [0063.617] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif") returned="background.gif" [0063.617] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.618] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x6b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x6b, lpOverlapped=0x0) returned 1 [0063.618] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.618] CloseHandle (hObject=0xa0) returned 1 [0063.618] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif.wannacry")) returned 1 [0063.619] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xcbd, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0063.619] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.619] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HEADER.GIF") returned -1 [0063.619] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0063.619] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0063.619] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif") returned="background.gif" [0063.619] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" [0063.619] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\") returned="" [0063.619] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" [0063.619] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\how to decrypt files.txt")) returned 0x20 [0063.619] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF" [0063.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.zip") returned 0 [0063.619] lstrlenA (lpString="*.zip") returned 5 [0063.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.rar") returned 0 [0063.619] lstrlenA (lpString="*.rar") returned 5 [0063.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.7z") returned 0 [0063.619] lstrlenA (lpString="*.7z") returned 4 [0063.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.tar") returned 0 [0063.619] lstrlenA (lpString="*.tar") returned 5 [0063.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0063.619] lstrlenA (lpString="*.gzip") returned 6 [0063.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0063.619] lstrlenA (lpString="*.jpg") returned 5 [0063.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0063.619] lstrlenA (lpString="*.jpeg") returned 6 [0063.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.psd") returned 0 [0063.619] lstrlenA (lpString="*.psd") returned 5 [0063.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.gif") returned 1 [0063.619] lstrlenA (lpString="*.gif") returned 5 [0063.619] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF" [0063.620] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF" [0063.620] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF." [0063.620] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF.wannacry" [0063.620] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.620] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcbd [0063.620] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d416d30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea)) returned 1 [0063.620] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.620] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xc3f, lpOverlapped=0x0) returned 1 [0063.660] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF") returned="HEADER.GIF" [0063.660] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.660] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xc3f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xc3f, lpOverlapped=0x0) returned 1 [0063.661] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.663] CloseHandle (hObject=0xa0) returned 1 [0063.663] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\header.gif.wannacry")) returned 1 [0063.665] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac07cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0063.665] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.665] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0063.665] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0063.665] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0063.665] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF") returned="HEADER.GIF" [0063.665] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" [0063.665] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\") returned="" [0063.665] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" [0063.665] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\how to decrypt files.txt")) returned 0x20 [0063.665] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF" [0063.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0063.665] lstrlenA (lpString="*.zip") returned 5 [0063.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0063.665] lstrlenA (lpString="*.rar") returned 5 [0063.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0063.665] lstrlenA (lpString="*.7z") returned 4 [0063.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0063.665] lstrlenA (lpString="*.tar") returned 5 [0063.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0063.665] lstrlenA (lpString="*.gzip") returned 6 [0063.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0063.665] lstrlenA (lpString="*.jpg") returned 5 [0063.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0063.665] lstrlenA (lpString="*.jpeg") returned 6 [0063.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0063.665] lstrlenA (lpString="*.psd") returned 5 [0063.666] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0063.666] lstrlenA (lpString="*.gif") returned 5 [0063.666] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF" [0063.666] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF" [0063.666] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF." [0063.666] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF.wannacry" [0063.666] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.668] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ce [0063.668] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ac07cf0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea)) returned 1 [0063.668] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.669] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x150, lpOverlapped=0x0) returned 1 [0063.669] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0063.669] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.670] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x150, lpOverlapped=0x0) returned 1 [0063.670] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.670] CloseHandle (hObject=0xa0) returned 1 [0063.670] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_off.gif.wannacry")) returned 1 [0063.675] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac07cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0063.675] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.675] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0063.675] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0063.675] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0063.675] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0063.675] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" [0063.675] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\") returned="" [0063.675] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" [0063.675] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\how to decrypt files.txt")) returned 0x20 [0063.676] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF" [0063.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0063.676] lstrlenA (lpString="*.zip") returned 5 [0063.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0063.676] lstrlenA (lpString="*.rar") returned 5 [0063.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0063.676] lstrlenA (lpString="*.7z") returned 4 [0063.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0063.676] lstrlenA (lpString="*.tar") returned 5 [0063.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0063.676] lstrlenA (lpString="*.gzip") returned 6 [0063.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0063.676] lstrlenA (lpString="*.jpg") returned 5 [0063.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0063.676] lstrlenA (lpString="*.jpeg") returned 6 [0063.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0063.676] lstrlenA (lpString="*.psd") returned 5 [0063.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0063.676] lstrlenA (lpString="*.gif") returned 5 [0063.676] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF" [0063.676] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF" [0063.676] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF." [0063.676] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF.wannacry" [0063.676] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.677] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x108 [0063.677] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ac07cf0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea)) returned 1 [0063.677] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.677] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x8a, lpOverlapped=0x0) returned 1 [0063.679] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF") returned="TAB_ON.GIF" [0063.679] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.679] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x8a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x8a, lpOverlapped=0x0) returned 1 [0063.680] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.680] CloseHandle (hObject=0xa0) returned 1 [0063.680] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_on.gif.wannacry")) returned 1 [0063.681] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac07cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0063.681] FindClose (in: hFindFile=0x2e3478 | out: hFindFile=0x2e3478) returned 1 [0063.681] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="Sts2.css", cAlternateFileName="")) returned 1 [0063.681] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0063.681] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Sts2.css") returned -1 [0063.681] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Sts2.css") returned -1 [0063.681] lstrcmpiA (lpString1="", lpString2="Sts2.css") returned -1 [0063.681] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0063.681] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0063.681] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0063.681] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0063.681] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0063.681] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Sts2.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css" [0063.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.zip") returned 0 [0063.681] lstrlenA (lpString="*.zip") returned 5 [0063.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.rar") returned 0 [0063.681] lstrlenA (lpString="*.rar") returned 5 [0063.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.7z") returned 0 [0063.681] lstrlenA (lpString="*.7z") returned 4 [0063.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.tar") returned 0 [0063.682] lstrlenA (lpString="*.tar") returned 5 [0063.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.gzip") returned 0 [0063.682] lstrlenA (lpString="*.gzip") returned 6 [0063.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.jpg") returned 0 [0063.682] lstrlenA (lpString="*.jpg") returned 5 [0063.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.jpeg") returned 0 [0063.682] lstrlenA (lpString="*.jpeg") returned 6 [0063.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.psd") returned 0 [0063.682] lstrlenA (lpString="*.psd") returned 5 [0063.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.gif") returned 0 [0063.682] lstrlenA (lpString="*.gif") returned 5 [0063.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.doc") returned 0 [0063.682] lstrlenA (lpString="*.doc") returned 5 [0063.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.docx") returned 0 [0063.682] lstrlenA (lpString="*.docx") returned 6 [0063.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.xls") returned 0 [0063.682] lstrlenA (lpString="*.xls") returned 5 [0063.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.xlsx") returned 0 [0063.682] lstrlenA (lpString="*.xlsx") returned 6 [0063.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.ppt") returned 0 [0063.682] lstrlenA (lpString="*.ppt") returned 5 [0063.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.pptx") returned 0 [0063.682] lstrlenA (lpString="*.pptx") returned 6 [0063.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.pdf") returned 0 [0063.682] lstrlenA (lpString="*.pdf") returned 5 [0063.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.mov") returned 0 [0063.682] lstrlenA (lpString="*.mov") returned 5 [0063.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.m2v") returned 0 [0063.682] lstrlenA (lpString="*.m2v") returned 5 [0063.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.3gp") returned 0 [0063.682] lstrlenA (lpString="*.3gp") returned 5 [0063.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.mpeg") returned 0 [0063.682] lstrlenA (lpString="*.mpeg") returned 6 [0063.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.mpg") returned 0 [0063.682] lstrlenA (lpString="*.mpg") returned 5 [0063.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.flv") returned 0 [0063.683] lstrlenA (lpString="*.flv") returned 5 [0063.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.avi") returned 0 [0063.683] lstrlenA (lpString="*.avi") returned 5 [0063.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.mp4") returned 0 [0063.683] lstrlenA (lpString="*.mp4") returned 5 [0063.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.wmv") returned 0 [0063.683] lstrlenA (lpString="*.wmv") returned 5 [0063.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.divx") returned 0 [0063.683] lstrlenA (lpString="*.divx") returned 6 [0063.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.mkv") returned 0 [0063.683] lstrlenA (lpString="*.mkv") returned 5 [0063.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.mp3") returned 0 [0063.683] lstrlenA (lpString="*.mp3") returned 5 [0063.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.wav") returned 0 [0063.683] lstrlenA (lpString="*.wav") returned 5 [0063.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.flac") returned 0 [0063.683] lstrlenA (lpString="*.flac") returned 6 [0063.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.ape") returned 0 [0063.683] lstrlenA (lpString="*.ape") returned 5 [0063.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.wma") returned 0 [0063.683] lstrlenA (lpString="*.wma") returned 5 [0063.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.ac3") returned 0 [0063.683] lstrlenA (lpString="*.ac3") returned 5 [0063.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.mxf") returned 0 [0063.683] lstrlenA (lpString="*.mxf") returned 5 [0063.683] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ac7a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d43ce90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="Swirl", cAlternateFileName="")) returned 1 [0063.683] lstrcmpA (lpString1=".", lpString2="Swirl") returned -1 [0063.683] lstrcmpA (lpString1="..", lpString2="Swirl") returned -1 [0063.683] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css") returned="Sts2.css" [0063.683] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Swirl" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl" [0063.683] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl") returned 100 [0063.683] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ac7a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d43ce90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x2d827e, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0063.699] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0063.699] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ac7a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d43ce90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0063.699] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0063.699] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0063.699] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x32f, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0063.700] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.700] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="background.gif") returned 1 [0063.700] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1 [0063.700] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1 [0063.700] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\*.*") returned="*.*" [0063.700] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" [0063.700] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\") returned="" [0063.700] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" [0063.700] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\how to decrypt files.txt")) returned 0xffffffff [0063.700] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.724] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0063.724] WriteFile (in: hFile=0xa0, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0063.725] SetFileTime (hFile=0xa0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0063.726] CloseHandle (hObject=0xa0) returned 1 [0063.726] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" [0063.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.zip") returned 0 [0063.726] lstrlenA (lpString="*.zip") returned 5 [0063.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.rar") returned 0 [0063.726] lstrlenA (lpString="*.rar") returned 5 [0063.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.7z") returned 0 [0063.726] lstrlenA (lpString="*.7z") returned 4 [0063.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.tar") returned 0 [0063.726] lstrlenA (lpString="*.tar") returned 5 [0063.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.gzip") returned 0 [0063.726] lstrlenA (lpString="*.gzip") returned 6 [0063.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.jpg") returned 0 [0063.726] lstrlenA (lpString="*.jpg") returned 5 [0063.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.jpeg") returned 0 [0063.726] lstrlenA (lpString="*.jpeg") returned 6 [0063.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.psd") returned 0 [0063.726] lstrlenA (lpString="*.psd") returned 5 [0063.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.gif") returned 1 [0063.726] lstrlenA (lpString="*.gif") returned 5 [0063.726] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" [0063.726] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" [0063.726] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif." [0063.726] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif.wannacry" [0063.727] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.728] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x32f [0063.728] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d43ce90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea)) returned 1 [0063.728] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.728] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2b1, lpOverlapped=0x0) returned 1 [0063.743] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif") returned="background.gif" [0063.743] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.743] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2b1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2b1, lpOverlapped=0x0) returned 1 [0063.743] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.743] CloseHandle (hObject=0xa0) returned 1 [0063.744] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif.wannacry")) returned 1 [0063.747] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6993, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0063.747] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.747] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HEADER.GIF") returned -1 [0063.747] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0063.747] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0063.747] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif") returned="background.gif" [0063.747] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" [0063.747] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\") returned="" [0063.747] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" [0063.747] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\how to decrypt files.txt")) returned 0x20 [0063.747] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF" [0063.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.zip") returned 0 [0063.748] lstrlenA (lpString="*.zip") returned 5 [0063.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.rar") returned 0 [0063.748] lstrlenA (lpString="*.rar") returned 5 [0063.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.7z") returned 0 [0063.748] lstrlenA (lpString="*.7z") returned 4 [0063.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.tar") returned 0 [0063.748] lstrlenA (lpString="*.tar") returned 5 [0063.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0063.748] lstrlenA (lpString="*.gzip") returned 6 [0063.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0063.748] lstrlenA (lpString="*.jpg") returned 5 [0063.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0063.748] lstrlenA (lpString="*.jpeg") returned 6 [0063.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.psd") returned 0 [0063.748] lstrlenA (lpString="*.psd") returned 5 [0063.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.gif") returned 1 [0063.748] lstrlenA (lpString="*.gif") returned 5 [0063.748] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF" [0063.748] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF" [0063.748] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF." [0063.748] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF.wannacry" [0063.748] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.749] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6993 [0063.749] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ac7a110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea)) returned 1 [0063.750] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.750] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x6915, lpOverlapped=0x0) returned 1 [0063.775] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF") returned="HEADER.GIF" [0063.775] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.775] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x6915, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x6915, lpOverlapped=0x0) returned 1 [0063.775] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.775] CloseHandle (hObject=0xa0) returned 1 [0063.776] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\header.gif.wannacry")) returned 1 [0063.777] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0063.777] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.777] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_OFF.GIF") returned -1 [0063.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0063.777] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0063.777] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF") returned="HEADER.GIF" [0063.777] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" [0063.777] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\") returned="" [0063.777] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" [0063.777] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\how to decrypt files.txt")) returned 0x20 [0063.804] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF" [0063.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0063.804] lstrlenA (lpString="*.zip") returned 5 [0063.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0063.804] lstrlenA (lpString="*.rar") returned 5 [0063.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0063.804] lstrlenA (lpString="*.7z") returned 4 [0063.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0063.804] lstrlenA (lpString="*.tar") returned 5 [0063.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0063.804] lstrlenA (lpString="*.gzip") returned 6 [0063.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0063.804] lstrlenA (lpString="*.jpg") returned 5 [0063.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0063.804] lstrlenA (lpString="*.jpeg") returned 6 [0063.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0063.804] lstrlenA (lpString="*.psd") returned 5 [0063.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0063.804] lstrlenA (lpString="*.gif") returned 5 [0063.804] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF" [0063.804] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF" [0063.804] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF." [0063.804] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF.wannacry" [0063.804] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.805] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0063.805] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ac7a110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1 [0063.806] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.806] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd7, lpOverlapped=0x0) returned 1 [0063.807] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0063.807] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.807] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd7, lpOverlapped=0x0) returned 1 [0063.807] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.807] CloseHandle (hObject=0xa0) returned 1 [0063.807] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_off.gif.wannacry")) returned 1 [0063.810] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0063.813] PeekMessageA (in: lpMsg=0x18f244, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f244) returned 0 [0063.813] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TAB_ON.GIF") returned -1 [0063.813] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0063.813] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0063.813] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0063.813] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" [0063.813] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\") returned="" [0063.813] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" [0063.813] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\how to decrypt files.txt")) returned 0x20 [0063.813] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF" [0063.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0063.813] lstrlenA (lpString="*.zip") returned 5 [0063.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0063.813] lstrlenA (lpString="*.rar") returned 5 [0063.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0063.813] lstrlenA (lpString="*.7z") returned 4 [0063.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0063.813] lstrlenA (lpString="*.tar") returned 5 [0063.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0063.813] lstrlenA (lpString="*.gzip") returned 6 [0063.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0063.814] lstrlenA (lpString="*.jpg") returned 5 [0063.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0063.814] lstrlenA (lpString="*.jpeg") returned 6 [0063.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0063.814] lstrlenA (lpString="*.psd") returned 5 [0063.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0063.814] lstrlenA (lpString="*.gif") returned 5 [0063.814] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF" [0063.814] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF" [0063.814] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF." [0063.814] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF.wannacry" [0063.814] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0063.817] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0063.817] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d43ce90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1 [0063.817] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.817] ReadFile (in: hFile=0xa0, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60, lpOverlapped=0x0) returned 1 [0063.818] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF") returned="TAB_ON.GIF" [0063.818] SetFilePointer (in: hFile=0xa0, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.818] WriteFile (in: hFile=0xa0, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60, lpOverlapped=0x0) returned 1 [0063.827] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.827] CloseHandle (hObject=0xa0) returned 1 [0063.827] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_on.gif.wannacry")) returned 1 [0063.829] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0063.829] FindClose (in: hFindFile=0x2e3478 | out: hFindFile=0x2e3478) returned 1 [0063.829] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xfb9, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="Swirl.css", cAlternateFileName="")) returned 1 [0063.829] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0063.829] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Swirl.css") returned -1 [0063.829] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Swirl.css") returned -1 [0063.829] lstrcmpiA (lpString1="", lpString2="Swirl.css") returned -1 [0063.829] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0063.829] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0063.829] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0063.829] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0063.829] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0063.829] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Swirl.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css" [0063.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.zip") returned 0 [0063.830] lstrlenA (lpString="*.zip") returned 5 [0063.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.rar") returned 0 [0063.830] lstrlenA (lpString="*.rar") returned 5 [0063.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.7z") returned 0 [0063.830] lstrlenA (lpString="*.7z") returned 4 [0063.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.tar") returned 0 [0063.830] lstrlenA (lpString="*.tar") returned 5 [0063.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.gzip") returned 0 [0063.830] lstrlenA (lpString="*.gzip") returned 6 [0063.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.jpg") returned 0 [0063.830] lstrlenA (lpString="*.jpg") returned 5 [0063.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.jpeg") returned 0 [0063.830] lstrlenA (lpString="*.jpeg") returned 6 [0063.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.psd") returned 0 [0063.830] lstrlenA (lpString="*.psd") returned 5 [0063.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.gif") returned 0 [0063.830] lstrlenA (lpString="*.gif") returned 5 [0063.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.doc") returned 0 [0063.830] lstrlenA (lpString="*.doc") returned 5 [0063.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.docx") returned 0 [0063.830] lstrlenA (lpString="*.docx") returned 6 [0063.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.xls") returned 0 [0063.831] lstrlenA (lpString="*.xls") returned 5 [0063.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.xlsx") returned 0 [0063.831] lstrlenA (lpString="*.xlsx") returned 6 [0063.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.ppt") returned 0 [0063.831] lstrlenA (lpString="*.ppt") returned 5 [0063.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.pptx") returned 0 [0063.831] lstrlenA (lpString="*.pptx") returned 6 [0063.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.pdf") returned 0 [0063.831] lstrlenA (lpString="*.pdf") returned 5 [0063.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.mov") returned 0 [0063.831] lstrlenA (lpString="*.mov") returned 5 [0063.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.m2v") returned 0 [0063.831] lstrlenA (lpString="*.m2v") returned 5 [0063.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.3gp") returned 0 [0063.831] lstrlenA (lpString="*.3gp") returned 5 [0063.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.mpeg") returned 0 [0063.831] lstrlenA (lpString="*.mpeg") returned 6 [0063.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.mpg") returned 0 [0063.831] lstrlenA (lpString="*.mpg") returned 5 [0063.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.flv") returned 0 [0063.831] lstrlenA (lpString="*.flv") returned 5 [0063.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.avi") returned 0 [0063.831] lstrlenA (lpString="*.avi") returned 5 [0063.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.mp4") returned 0 [0063.831] lstrlenA (lpString="*.mp4") returned 5 [0063.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.wmv") returned 0 [0063.832] lstrlenA (lpString="*.wmv") returned 5 [0063.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.divx") returned 0 [0063.832] lstrlenA (lpString="*.divx") returned 6 [0063.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.mkv") returned 0 [0063.832] lstrlenA (lpString="*.mkv") returned 5 [0063.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.mp3") returned 0 [0063.832] lstrlenA (lpString="*.mp3") returned 5 [0063.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.wav") returned 0 [0063.832] lstrlenA (lpString="*.wav") returned 5 [0063.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.flac") returned 0 [0063.832] lstrlenA (lpString="*.flac") returned 6 [0063.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.ape") returned 0 [0063.832] lstrlenA (lpString="*.ape") returned 5 [0063.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.wma") returned 0 [0063.832] lstrlenA (lpString="*.wma") returned 5 [0063.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.ac3") returned 0 [0063.832] lstrlenA (lpString="*.ac3") returned 5 [0063.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.mxf") returned 0 [0063.832] lstrlenA (lpString="*.mxf") returned 5 [0063.832] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5acc63d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="Teal.css", cAlternateFileName="")) returned 1 [0063.832] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0063.832] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Teal.css") returned -1 [0063.832] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Teal.css") returned -1 [0063.832] lstrcmpiA (lpString1="", lpString2="Teal.css") returned -1 [0063.832] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css") returned="Swirl.css" [0063.832] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0063.833] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0063.833] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0063.833] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0063.833] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Teal.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css" [0063.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.zip") returned 0 [0063.833] lstrlenA (lpString="*.zip") returned 5 [0063.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.rar") returned 0 [0063.833] lstrlenA (lpString="*.rar") returned 5 [0063.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.7z") returned 0 [0063.833] lstrlenA (lpString="*.7z") returned 4 [0063.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.tar") returned 0 [0063.833] lstrlenA (lpString="*.tar") returned 5 [0063.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.gzip") returned 0 [0063.833] lstrlenA (lpString="*.gzip") returned 6 [0063.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.jpg") returned 0 [0063.833] lstrlenA (lpString="*.jpg") returned 5 [0063.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.jpeg") returned 0 [0063.833] lstrlenA (lpString="*.jpeg") returned 6 [0063.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.psd") returned 0 [0063.833] lstrlenA (lpString="*.psd") returned 5 [0063.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.gif") returned 0 [0063.833] lstrlenA (lpString="*.gif") returned 5 [0063.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.doc") returned 0 [0063.834] lstrlenA (lpString="*.doc") returned 5 [0063.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.docx") returned 0 [0063.834] lstrlenA (lpString="*.docx") returned 6 [0063.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.xls") returned 0 [0063.834] lstrlenA (lpString="*.xls") returned 5 [0063.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.xlsx") returned 0 [0063.834] lstrlenA (lpString="*.xlsx") returned 6 [0063.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.ppt") returned 0 [0063.834] lstrlenA (lpString="*.ppt") returned 5 [0063.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.pptx") returned 0 [0063.834] lstrlenA (lpString="*.pptx") returned 6 [0063.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.pdf") returned 0 [0063.834] lstrlenA (lpString="*.pdf") returned 5 [0063.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.mov") returned 0 [0063.834] lstrlenA (lpString="*.mov") returned 5 [0063.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.m2v") returned 0 [0063.834] lstrlenA (lpString="*.m2v") returned 5 [0063.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.3gp") returned 0 [0063.834] lstrlenA (lpString="*.3gp") returned 5 [0063.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.mpeg") returned 0 [0063.834] lstrlenA (lpString="*.mpeg") returned 6 [0063.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.mpg") returned 0 [0063.834] lstrlenA (lpString="*.mpg") returned 5 [0063.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.flv") returned 0 [0063.834] lstrlenA (lpString="*.flv") returned 5 [0063.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.avi") returned 0 [0063.835] lstrlenA (lpString="*.avi") returned 5 [0063.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.mp4") returned 0 [0063.835] lstrlenA (lpString="*.mp4") returned 5 [0063.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.wmv") returned 0 [0063.835] lstrlenA (lpString="*.wmv") returned 5 [0063.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.divx") returned 0 [0063.835] lstrlenA (lpString="*.divx") returned 6 [0063.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.mkv") returned 0 [0063.835] lstrlenA (lpString="*.mkv") returned 5 [0063.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.mp3") returned 0 [0063.835] lstrlenA (lpString="*.mp3") returned 5 [0063.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.wav") returned 0 [0063.835] lstrlenA (lpString="*.wav") returned 5 [0063.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.flac") returned 0 [0063.835] lstrlenA (lpString="*.flac") returned 6 [0063.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.ape") returned 0 [0063.835] lstrlenA (lpString="*.ape") returned 5 [0063.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.wma") returned 0 [0063.835] lstrlenA (lpString="*.wma") returned 5 [0063.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.ac3") returned 0 [0063.835] lstrlenA (lpString="*.ac3") returned 5 [0063.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.mxf") returned 0 [0063.835] lstrlenA (lpString="*.mxf") returned 5 [0063.835] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x739, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="TexturedBlue.css", cAlternateFileName="TEXTUR~1.CSS")) returned 1 [0063.835] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0063.836] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TexturedBlue.css") returned -1 [0063.836] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TexturedBlue.css") returned -1 [0063.836] lstrcmpiA (lpString1="", lpString2="TexturedBlue.css") returned -1 [0063.836] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css") returned="Teal.css" [0063.836] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0063.836] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0063.836] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0063.836] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0063.836] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="TexturedBlue.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css" [0063.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.zip") returned 0 [0063.836] lstrlenA (lpString="*.zip") returned 5 [0063.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.rar") returned 0 [0063.836] lstrlenA (lpString="*.rar") returned 5 [0063.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.7z") returned 0 [0063.836] lstrlenA (lpString="*.7z") returned 4 [0063.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.tar") returned 0 [0063.836] lstrlenA (lpString="*.tar") returned 5 [0063.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.gzip") returned 0 [0063.836] lstrlenA (lpString="*.gzip") returned 6 [0063.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.jpg") returned 0 [0063.836] lstrlenA (lpString="*.jpg") returned 5 [0063.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.jpeg") returned 0 [0063.836] lstrlenA (lpString="*.jpeg") returned 6 [0063.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.psd") returned 0 [0063.837] lstrlenA (lpString="*.psd") returned 5 [0063.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.gif") returned 0 [0063.837] lstrlenA (lpString="*.gif") returned 5 [0063.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.doc") returned 0 [0063.837] lstrlenA (lpString="*.doc") returned 5 [0063.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.docx") returned 0 [0063.837] lstrlenA (lpString="*.docx") returned 6 [0063.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.xls") returned 0 [0063.837] lstrlenA (lpString="*.xls") returned 5 [0063.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.xlsx") returned 0 [0063.837] lstrlenA (lpString="*.xlsx") returned 6 [0063.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.ppt") returned 0 [0063.837] lstrlenA (lpString="*.ppt") returned 5 [0063.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.pptx") returned 0 [0063.837] lstrlenA (lpString="*.pptx") returned 6 [0063.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.pdf") returned 0 [0063.837] lstrlenA (lpString="*.pdf") returned 5 [0063.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.mov") returned 0 [0063.837] lstrlenA (lpString="*.mov") returned 5 [0063.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.m2v") returned 0 [0063.837] lstrlenA (lpString="*.m2v") returned 5 [0063.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.3gp") returned 0 [0063.837] lstrlenA (lpString="*.3gp") returned 5 [0063.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.mpeg") returned 0 [0063.837] lstrlenA (lpString="*.mpeg") returned 6 [0063.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.mpg") returned 0 [0063.838] lstrlenA (lpString="*.mpg") returned 5 [0063.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.flv") returned 0 [0063.838] lstrlenA (lpString="*.flv") returned 5 [0063.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.avi") returned 0 [0063.838] lstrlenA (lpString="*.avi") returned 5 [0063.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.mp4") returned 0 [0063.838] lstrlenA (lpString="*.mp4") returned 5 [0063.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.wmv") returned 0 [0063.838] lstrlenA (lpString="*.wmv") returned 5 [0063.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.divx") returned 0 [0063.838] lstrlenA (lpString="*.divx") returned 6 [0063.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.mkv") returned 0 [0063.838] lstrlenA (lpString="*.mkv") returned 5 [0063.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.mp3") returned 0 [0063.838] lstrlenA (lpString="*.mp3") returned 5 [0063.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.wav") returned 0 [0063.838] lstrlenA (lpString="*.wav") returned 5 [0063.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.flac") returned 0 [0063.838] lstrlenA (lpString="*.flac") returned 6 [0063.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.ape") returned 0 [0063.838] lstrlenA (lpString="*.ape") returned 5 [0063.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.wma") returned 0 [0063.838] lstrlenA (lpString="*.wma") returned 5 [0063.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.ac3") returned 0 [0063.838] lstrlenA (lpString="*.ac3") returned 5 [0063.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.mxf") returned 0 [0063.839] lstrlenA (lpString="*.mxf") returned 5 [0063.839] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x733, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="VelvetRose.css", cAlternateFileName="VELVET~1.CSS")) returned 1 [0063.839] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0063.839] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VelvetRose.css") returned -1 [0063.839] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VelvetRose.css") returned -1 [0063.839] lstrcmpiA (lpString1="", lpString2="VelvetRose.css") returned -1 [0063.839] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css") returned="TexturedBlue.css" [0063.839] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" [0063.839] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned="" [0063.839] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" [0063.839] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\how to decrypt files.txt")) returned 0x20 [0063.839] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="VelvetRose.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css" [0063.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.zip") returned 0 [0063.839] lstrlenA (lpString="*.zip") returned 5 [0063.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.rar") returned 0 [0063.839] lstrlenA (lpString="*.rar") returned 5 [0063.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.7z") returned 0 [0063.839] lstrlenA (lpString="*.7z") returned 4 [0063.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.tar") returned 0 [0063.839] lstrlenA (lpString="*.tar") returned 5 [0063.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.gzip") returned 0 [0063.839] lstrlenA (lpString="*.gzip") returned 6 [0063.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.jpg") returned 0 [0063.840] lstrlenA (lpString="*.jpg") returned 5 [0063.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.jpeg") returned 0 [0063.840] lstrlenA (lpString="*.jpeg") returned 6 [0063.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.psd") returned 0 [0063.840] lstrlenA (lpString="*.psd") returned 5 [0063.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.gif") returned 0 [0063.840] lstrlenA (lpString="*.gif") returned 5 [0063.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.doc") returned 0 [0063.840] lstrlenA (lpString="*.doc") returned 5 [0063.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.docx") returned 0 [0063.840] lstrlenA (lpString="*.docx") returned 6 [0063.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.xls") returned 0 [0063.840] lstrlenA (lpString="*.xls") returned 5 [0063.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.xlsx") returned 0 [0063.840] lstrlenA (lpString="*.xlsx") returned 6 [0063.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.ppt") returned 0 [0063.840] lstrlenA (lpString="*.ppt") returned 5 [0063.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.pptx") returned 0 [0063.840] lstrlenA (lpString="*.pptx") returned 6 [0063.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.pdf") returned 0 [0063.840] lstrlenA (lpString="*.pdf") returned 5 [0063.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.mov") returned 0 [0063.840] lstrlenA (lpString="*.mov") returned 5 [0063.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.m2v") returned 0 [0063.840] lstrlenA (lpString="*.m2v") returned 5 [0063.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.3gp") returned 0 [0063.841] lstrlenA (lpString="*.3gp") returned 5 [0063.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.mpeg") returned 0 [0063.841] lstrlenA (lpString="*.mpeg") returned 6 [0063.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.mpg") returned 0 [0063.841] lstrlenA (lpString="*.mpg") returned 5 [0063.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.flv") returned 0 [0063.841] lstrlenA (lpString="*.flv") returned 5 [0063.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.avi") returned 0 [0063.841] lstrlenA (lpString="*.avi") returned 5 [0063.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.mp4") returned 0 [0063.841] lstrlenA (lpString="*.mp4") returned 5 [0063.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.wmv") returned 0 [0063.841] lstrlenA (lpString="*.wmv") returned 5 [0063.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.divx") returned 0 [0063.841] lstrlenA (lpString="*.divx") returned 6 [0063.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.mkv") returned 0 [0063.841] lstrlenA (lpString="*.mkv") returned 5 [0063.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.mp3") returned 0 [0063.841] lstrlenA (lpString="*.mp3") returned 5 [0063.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.wav") returned 0 [0063.841] lstrlenA (lpString="*.wav") returned 5 [0063.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.flac") returned 0 [0063.841] lstrlenA (lpString="*.flac") returned 6 [0063.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.ape") returned 0 [0063.841] lstrlenA (lpString="*.ape") returned 5 [0063.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.wma") returned 0 [0063.841] lstrlenA (lpString="*.wma") returned 5 [0063.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.ac3") returned 0 [0063.842] lstrlenA (lpString="*.ac3") returned 5 [0063.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.mxf") returned 0 [0063.842] lstrlenA (lpString="*.mxf") returned 5 [0063.842] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x733, dwReserved0=0x72006f, dwReserved1=0x73006d, cFileName="VelvetRose.css", cAlternateFileName="VELVET~1.CSS")) returned 0 [0063.842] FindClose (in: hFindFile=0x2e3438 | out: hFindFile=0x2e3438) returned 1 [0063.842] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="FormsVersion1Warning.htm", cAlternateFileName="FORMSV~1.HTM")) returned 1 [0063.842] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.842] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsVersion1Warning.htm") returned -1 [0063.842] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsVersion1Warning.htm") returned 1 [0063.842] lstrcmpiA (lpString1="", lpString2="FormsVersion1Warning.htm") returned -1 [0063.842] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\*.*") returned="*.*" [0063.842] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.842] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.842] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.842] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.842] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsVersion1Warning.htm" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm" [0063.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.zip") returned 0 [0063.843] lstrlenA (lpString="*.zip") returned 5 [0063.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.rar") returned 0 [0063.843] lstrlenA (lpString="*.rar") returned 5 [0063.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.7z") returned 0 [0063.843] lstrlenA (lpString="*.7z") returned 4 [0063.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.tar") returned 0 [0063.843] lstrlenA (lpString="*.tar") returned 5 [0063.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.gzip") returned 0 [0063.843] lstrlenA (lpString="*.gzip") returned 6 [0063.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.jpg") returned 0 [0063.843] lstrlenA (lpString="*.jpg") returned 5 [0063.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.jpeg") returned 0 [0063.843] lstrlenA (lpString="*.jpeg") returned 6 [0063.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.psd") returned 0 [0063.843] lstrlenA (lpString="*.psd") returned 5 [0063.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.gif") returned 0 [0063.843] lstrlenA (lpString="*.gif") returned 5 [0063.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.doc") returned 0 [0063.843] lstrlenA (lpString="*.doc") returned 5 [0063.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.docx") returned 0 [0063.843] lstrlenA (lpString="*.docx") returned 6 [0063.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.xls") returned 0 [0063.843] lstrlenA (lpString="*.xls") returned 5 [0063.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.xlsx") returned 0 [0063.844] lstrlenA (lpString="*.xlsx") returned 6 [0063.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.ppt") returned 0 [0063.844] lstrlenA (lpString="*.ppt") returned 5 [0063.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.pptx") returned 0 [0063.844] lstrlenA (lpString="*.pptx") returned 6 [0063.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.pdf") returned 0 [0063.844] lstrlenA (lpString="*.pdf") returned 5 [0063.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.mov") returned 0 [0063.844] lstrlenA (lpString="*.mov") returned 5 [0063.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.m2v") returned 0 [0063.844] lstrlenA (lpString="*.m2v") returned 5 [0063.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.3gp") returned 0 [0063.844] lstrlenA (lpString="*.3gp") returned 5 [0063.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.mpeg") returned 0 [0063.844] lstrlenA (lpString="*.mpeg") returned 6 [0063.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.mpg") returned 0 [0063.844] lstrlenA (lpString="*.mpg") returned 5 [0063.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.flv") returned 0 [0063.844] lstrlenA (lpString="*.flv") returned 5 [0063.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.avi") returned 0 [0063.844] lstrlenA (lpString="*.avi") returned 5 [0063.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.mp4") returned 0 [0063.844] lstrlenA (lpString="*.mp4") returned 5 [0063.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.wmv") returned 0 [0063.844] lstrlenA (lpString="*.wmv") returned 5 [0063.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.divx") returned 0 [0063.844] lstrlenA (lpString="*.divx") returned 6 [0063.845] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.mkv") returned 0 [0063.845] lstrlenA (lpString="*.mkv") returned 5 [0063.845] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.mp3") returned 0 [0063.845] lstrlenA (lpString="*.mp3") returned 5 [0063.845] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.wav") returned 0 [0063.845] lstrlenA (lpString="*.wav") returned 5 [0063.845] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.flac") returned 0 [0063.845] lstrlenA (lpString="*.flac") returned 6 [0063.845] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.ape") returned 0 [0063.845] lstrlenA (lpString="*.ape") returned 5 [0063.845] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.wma") returned 0 [0063.845] lstrlenA (lpString="*.wma") returned 5 [0063.845] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.ac3") returned 0 [0063.845] lstrlenA (lpString="*.ac3") returned 5 [0063.845] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.mxf") returned 0 [0063.845] lstrlenA (lpString="*.mxf") returned 5 [0063.845] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1499, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsViewAttachmentIcons.jpg", cAlternateFileName="FORMSV~1.JPG")) returned 1 [0063.863] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.863] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsViewAttachmentIcons.jpg") returned -1 [0063.863] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewAttachmentIcons.jpg") returned 1 [0063.863] lstrcmpiA (lpString1="", lpString2="FormsViewAttachmentIcons.jpg") returned -1 [0063.863] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm") returned="FormsVersion1Warning.htm" [0063.863] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.864] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.864] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.864] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.864] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" [0063.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.zip") returned 0 [0063.864] lstrlenA (lpString="*.zip") returned 5 [0063.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.rar") returned 0 [0063.864] lstrlenA (lpString="*.rar") returned 5 [0063.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.7z") returned 0 [0063.864] lstrlenA (lpString="*.7z") returned 4 [0063.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.tar") returned 0 [0063.864] lstrlenA (lpString="*.tar") returned 5 [0063.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.gzip") returned 0 [0063.864] lstrlenA (lpString="*.gzip") returned 6 [0063.864] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", pszSpec="*.jpg") returned 1 [0063.864] lstrlenA (lpString="*.jpg") returned 5 [0063.864] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" [0063.864] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" [0063.864] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg." [0063.864] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg.wannacry" [0063.864] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0063.866] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1499 [0063.866] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1 [0063.866] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.866] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x141b, lpOverlapped=0x0) returned 1 [0063.881] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg") returned="FormsViewAttachmentIcons.jpg" [0063.881] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.881] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x141b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x141b, lpOverlapped=0x0) returned 1 [0063.882] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.882] CloseHandle (hObject=0x98) returned 1 [0063.882] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg.wannacry")) returned 1 [0063.884] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="FormsViewAttachmentIconsMask.bmp", cAlternateFileName="FORMSV~1.BMP")) returned 1 [0063.884] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.884] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsViewAttachmentIconsMask.bmp") returned -1 [0063.884] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewAttachmentIconsMask.bmp") returned 1 [0063.884] lstrcmpiA (lpString1="", lpString2="FormsViewAttachmentIconsMask.bmp") returned -1 [0063.884] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg") returned="FormsViewAttachmentIcons.jpg" [0063.884] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.884] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.884] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.884] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.884] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp" [0063.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.zip") returned 0 [0063.884] lstrlenA (lpString="*.zip") returned 5 [0063.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.rar") returned 0 [0063.884] lstrlenA (lpString="*.rar") returned 5 [0063.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.7z") returned 0 [0063.884] lstrlenA (lpString="*.7z") returned 4 [0063.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.tar") returned 0 [0063.884] lstrlenA (lpString="*.tar") returned 5 [0063.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.gzip") returned 0 [0063.885] lstrlenA (lpString="*.gzip") returned 6 [0063.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.jpg") returned 0 [0063.885] lstrlenA (lpString="*.jpg") returned 5 [0063.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.jpeg") returned 0 [0063.885] lstrlenA (lpString="*.jpeg") returned 6 [0063.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.psd") returned 0 [0063.885] lstrlenA (lpString="*.psd") returned 5 [0063.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.gif") returned 0 [0063.885] lstrlenA (lpString="*.gif") returned 5 [0063.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.doc") returned 0 [0063.885] lstrlenA (lpString="*.doc") returned 5 [0063.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.docx") returned 0 [0063.885] lstrlenA (lpString="*.docx") returned 6 [0063.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.xls") returned 0 [0063.885] lstrlenA (lpString="*.xls") returned 5 [0063.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.xlsx") returned 0 [0063.885] lstrlenA (lpString="*.xlsx") returned 6 [0063.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.ppt") returned 0 [0063.885] lstrlenA (lpString="*.ppt") returned 5 [0063.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.pptx") returned 0 [0063.885] lstrlenA (lpString="*.pptx") returned 6 [0063.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.pdf") returned 0 [0063.885] lstrlenA (lpString="*.pdf") returned 5 [0063.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mov") returned 0 [0063.885] lstrlenA (lpString="*.mov") returned 5 [0063.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.m2v") returned 0 [0063.886] lstrlenA (lpString="*.m2v") returned 5 [0063.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.3gp") returned 0 [0063.886] lstrlenA (lpString="*.3gp") returned 5 [0063.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mpeg") returned 0 [0063.886] lstrlenA (lpString="*.mpeg") returned 6 [0063.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mpg") returned 0 [0063.886] lstrlenA (lpString="*.mpg") returned 5 [0063.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.flv") returned 0 [0063.886] lstrlenA (lpString="*.flv") returned 5 [0063.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.avi") returned 0 [0063.886] lstrlenA (lpString="*.avi") returned 5 [0063.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mp4") returned 0 [0063.886] lstrlenA (lpString="*.mp4") returned 5 [0063.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.wmv") returned 0 [0063.886] lstrlenA (lpString="*.wmv") returned 5 [0063.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.divx") returned 0 [0063.886] lstrlenA (lpString="*.divx") returned 6 [0063.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mkv") returned 0 [0063.886] lstrlenA (lpString="*.mkv") returned 5 [0063.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mp3") returned 0 [0063.886] lstrlenA (lpString="*.mp3") returned 5 [0063.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.wav") returned 0 [0063.886] lstrlenA (lpString="*.wav") returned 5 [0063.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.flac") returned 0 [0063.886] lstrlenA (lpString="*.flac") returned 6 [0063.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.ape") returned 0 [0063.887] lstrlenA (lpString="*.ape") returned 5 [0063.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.wma") returned 0 [0063.887] lstrlenA (lpString="*.wma") returned 5 [0063.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.ac3") returned 0 [0063.887] lstrlenA (lpString="*.ac3") returned 5 [0063.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mxf") returned 0 [0063.887] lstrlenA (lpString="*.mxf") returned 5 [0063.887] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x529b4870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x164a, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsViewFrame.html", cAlternateFileName="FORMSV~2.HTM")) returned 1 [0063.887] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.887] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsViewFrame.html") returned -1 [0063.887] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewFrame.html") returned 1 [0063.887] lstrcmpiA (lpString1="", lpString2="FormsViewFrame.html") returned -1 [0063.887] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp") returned="FormsViewAttachmentIconsMask.bmp" [0063.887] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.887] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.887] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.887] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.887] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsViewFrame.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" [0063.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.zip") returned 0 [0063.887] lstrlenA (lpString="*.zip") returned 5 [0063.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.rar") returned 0 [0063.887] lstrlenA (lpString="*.rar") returned 5 [0063.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.7z") returned 0 [0063.887] lstrlenA (lpString="*.7z") returned 4 [0063.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.tar") returned 0 [0063.888] lstrlenA (lpString="*.tar") returned 5 [0063.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.gzip") returned 0 [0063.888] lstrlenA (lpString="*.gzip") returned 6 [0063.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.jpg") returned 0 [0063.888] lstrlenA (lpString="*.jpg") returned 5 [0063.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.jpeg") returned 0 [0063.888] lstrlenA (lpString="*.jpeg") returned 6 [0063.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.psd") returned 0 [0063.888] lstrlenA (lpString="*.psd") returned 5 [0063.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.gif") returned 0 [0063.888] lstrlenA (lpString="*.gif") returned 5 [0063.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.doc") returned 0 [0063.888] lstrlenA (lpString="*.doc") returned 5 [0063.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.docx") returned 0 [0063.888] lstrlenA (lpString="*.docx") returned 6 [0063.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.xls") returned 0 [0063.888] lstrlenA (lpString="*.xls") returned 5 [0063.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.xlsx") returned 0 [0063.888] lstrlenA (lpString="*.xlsx") returned 6 [0063.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.ppt") returned 0 [0063.888] lstrlenA (lpString="*.ppt") returned 5 [0063.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.pptx") returned 0 [0063.888] lstrlenA (lpString="*.pptx") returned 6 [0063.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.pdf") returned 0 [0063.888] lstrlenA (lpString="*.pdf") returned 5 [0063.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.mov") returned 0 [0063.888] lstrlenA (lpString="*.mov") returned 5 [0063.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.m2v") returned 0 [0063.888] lstrlenA (lpString="*.m2v") returned 5 [0063.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.3gp") returned 0 [0063.888] lstrlenA (lpString="*.3gp") returned 5 [0063.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.mpeg") returned 0 [0063.888] lstrlenA (lpString="*.mpeg") returned 6 [0063.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.mpg") returned 0 [0063.889] lstrlenA (lpString="*.mpg") returned 5 [0063.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.flv") returned 0 [0063.889] lstrlenA (lpString="*.flv") returned 5 [0063.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.avi") returned 0 [0063.889] lstrlenA (lpString="*.avi") returned 5 [0063.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.mp4") returned 0 [0063.889] lstrlenA (lpString="*.mp4") returned 5 [0063.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.wmv") returned 0 [0063.889] lstrlenA (lpString="*.wmv") returned 5 [0063.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.divx") returned 0 [0063.889] lstrlenA (lpString="*.divx") returned 6 [0063.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.mkv") returned 0 [0063.889] lstrlenA (lpString="*.mkv") returned 5 [0063.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.mp3") returned 0 [0063.889] lstrlenA (lpString="*.mp3") returned 5 [0063.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.wav") returned 0 [0063.889] lstrlenA (lpString="*.wav") returned 5 [0063.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.flac") returned 0 [0063.889] lstrlenA (lpString="*.flac") returned 6 [0063.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.ape") returned 0 [0063.889] lstrlenA (lpString="*.ape") returned 5 [0063.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.wma") returned 0 [0063.889] lstrlenA (lpString="*.wma") returned 5 [0063.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.ac3") returned 0 [0063.889] lstrlenA (lpString="*.ac3") returned 5 [0063.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", pszSpec="*.mxf") returned 0 [0063.889] lstrlenA (lpString="*.mxf") returned 5 [0063.889] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x529b4870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xadf, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsViewTemplate.html", cAlternateFileName="FORMSV~3.HTM")) returned 1 [0063.889] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.889] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsViewTemplate.html") returned -1 [0063.889] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewTemplate.html") returned 1 [0063.889] lstrcmpiA (lpString1="", lpString2="FormsViewTemplate.html") returned -1 [0063.890] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html") returned="FormsViewFrame.html" [0063.890] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.890] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.890] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.890] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.890] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsViewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" [0063.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.zip") returned 0 [0063.890] lstrlenA (lpString="*.zip") returned 5 [0063.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.rar") returned 0 [0063.890] lstrlenA (lpString="*.rar") returned 5 [0063.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.7z") returned 0 [0063.890] lstrlenA (lpString="*.7z") returned 4 [0063.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.tar") returned 0 [0063.890] lstrlenA (lpString="*.tar") returned 5 [0063.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.gzip") returned 0 [0063.890] lstrlenA (lpString="*.gzip") returned 6 [0063.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.jpg") returned 0 [0063.890] lstrlenA (lpString="*.jpg") returned 5 [0063.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.jpeg") returned 0 [0063.890] lstrlenA (lpString="*.jpeg") returned 6 [0063.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.psd") returned 0 [0063.890] lstrlenA (lpString="*.psd") returned 5 [0063.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.gif") returned 0 [0063.890] lstrlenA (lpString="*.gif") returned 5 [0063.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.doc") returned 0 [0063.891] lstrlenA (lpString="*.doc") returned 5 [0063.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.docx") returned 0 [0063.891] lstrlenA (lpString="*.docx") returned 6 [0063.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.xls") returned 0 [0063.891] lstrlenA (lpString="*.xls") returned 5 [0063.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.xlsx") returned 0 [0063.891] lstrlenA (lpString="*.xlsx") returned 6 [0063.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.ppt") returned 0 [0063.891] lstrlenA (lpString="*.ppt") returned 5 [0063.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.pptx") returned 0 [0063.891] lstrlenA (lpString="*.pptx") returned 6 [0063.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.pdf") returned 0 [0063.891] lstrlenA (lpString="*.pdf") returned 5 [0063.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.mov") returned 0 [0063.891] lstrlenA (lpString="*.mov") returned 5 [0063.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.m2v") returned 0 [0063.891] lstrlenA (lpString="*.m2v") returned 5 [0063.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.3gp") returned 0 [0063.891] lstrlenA (lpString="*.3gp") returned 5 [0063.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.mpeg") returned 0 [0063.891] lstrlenA (lpString="*.mpeg") returned 6 [0063.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.mpg") returned 0 [0063.891] lstrlenA (lpString="*.mpg") returned 5 [0063.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.flv") returned 0 [0063.891] lstrlenA (lpString="*.flv") returned 5 [0063.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.avi") returned 0 [0063.892] lstrlenA (lpString="*.avi") returned 5 [0063.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.mp4") returned 0 [0063.892] lstrlenA (lpString="*.mp4") returned 5 [0063.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.wmv") returned 0 [0063.892] lstrlenA (lpString="*.wmv") returned 5 [0063.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.divx") returned 0 [0063.892] lstrlenA (lpString="*.divx") returned 6 [0063.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.mkv") returned 0 [0063.892] lstrlenA (lpString="*.mkv") returned 5 [0063.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.mp3") returned 0 [0063.892] lstrlenA (lpString="*.mp3") returned 5 [0063.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.wav") returned 0 [0063.892] lstrlenA (lpString="*.wav") returned 5 [0063.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.flac") returned 0 [0063.892] lstrlenA (lpString="*.flac") returned 6 [0063.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.ape") returned 0 [0063.892] lstrlenA (lpString="*.ape") returned 5 [0063.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.wma") returned 0 [0063.892] lstrlenA (lpString="*.wma") returned 5 [0063.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.ac3") returned 0 [0063.893] lstrlenA (lpString="*.ac3") returned 5 [0063.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", pszSpec="*.mxf") returned 0 [0063.893] lstrlenA (lpString="*.mxf") returned 5 [0063.893] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1bfb, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormToolImages.jpg", cAlternateFileName="FORMTO~1.JPG")) returned 1 [0063.893] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.893] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormToolImages.jpg") returned -1 [0063.893] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormToolImages.jpg") returned 1 [0063.893] lstrcmpiA (lpString1="", lpString2="FormToolImages.jpg") returned -1 [0063.893] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html") returned="FormsViewTemplate.html" [0063.893] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.893] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.893] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.893] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.893] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" [0063.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.zip") returned 0 [0063.893] lstrlenA (lpString="*.zip") returned 5 [0063.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.rar") returned 0 [0063.893] lstrlenA (lpString="*.rar") returned 5 [0063.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.7z") returned 0 [0063.893] lstrlenA (lpString="*.7z") returned 4 [0063.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.tar") returned 0 [0063.893] lstrlenA (lpString="*.tar") returned 5 [0063.893] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.gzip") returned 0 [0063.893] lstrlenA (lpString="*.gzip") returned 6 [0063.894] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", pszSpec="*.jpg") returned 1 [0063.894] lstrlenA (lpString="*.jpg") returned 5 [0063.894] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" [0063.894] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" [0063.894] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg." [0063.894] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg.wannacry" [0063.894] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0063.896] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1bfb [0063.896] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1 [0063.896] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.896] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1b7d, lpOverlapped=0x0) returned 1 [0063.898] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg") returned="FormToolImages.jpg" [0063.898] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.898] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1b7d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1b7d, lpOverlapped=0x0) returned 1 [0063.899] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.899] CloseHandle (hObject=0x98) returned 1 [0063.899] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg.wannacry")) returned 1 [0063.902] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2577, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="form_edit.js", cAlternateFileName="FORM_E~1.JS")) returned 1 [0063.902] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.902] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="form_edit.js") returned -1 [0063.902] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="form_edit.js") returned 1 [0063.902] lstrcmpiA (lpString1="", lpString2="form_edit.js") returned -1 [0063.902] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg") returned="FormToolImages.jpg" [0063.902] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.902] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.902] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.902] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.902] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="form_edit.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js" [0063.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.zip") returned 0 [0063.902] lstrlenA (lpString="*.zip") returned 5 [0063.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.rar") returned 0 [0063.902] lstrlenA (lpString="*.rar") returned 5 [0063.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.7z") returned 0 [0063.902] lstrlenA (lpString="*.7z") returned 4 [0063.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.tar") returned 0 [0063.903] lstrlenA (lpString="*.tar") returned 5 [0063.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.gzip") returned 0 [0063.903] lstrlenA (lpString="*.gzip") returned 6 [0063.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.jpg") returned 0 [0063.903] lstrlenA (lpString="*.jpg") returned 5 [0063.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.jpeg") returned 0 [0063.903] lstrlenA (lpString="*.jpeg") returned 6 [0063.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.psd") returned 0 [0063.903] lstrlenA (lpString="*.psd") returned 5 [0063.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.gif") returned 0 [0063.903] lstrlenA (lpString="*.gif") returned 5 [0063.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.doc") returned 0 [0063.903] lstrlenA (lpString="*.doc") returned 5 [0063.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.docx") returned 0 [0063.903] lstrlenA (lpString="*.docx") returned 6 [0063.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.xls") returned 0 [0063.903] lstrlenA (lpString="*.xls") returned 5 [0063.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.xlsx") returned 0 [0063.903] lstrlenA (lpString="*.xlsx") returned 6 [0063.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.ppt") returned 0 [0063.903] lstrlenA (lpString="*.ppt") returned 5 [0063.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.pptx") returned 0 [0063.903] lstrlenA (lpString="*.pptx") returned 6 [0063.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.pdf") returned 0 [0063.903] lstrlenA (lpString="*.pdf") returned 5 [0063.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.mov") returned 0 [0063.903] lstrlenA (lpString="*.mov") returned 5 [0063.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.m2v") returned 0 [0063.904] lstrlenA (lpString="*.m2v") returned 5 [0063.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.3gp") returned 0 [0063.904] lstrlenA (lpString="*.3gp") returned 5 [0063.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.mpeg") returned 0 [0063.904] lstrlenA (lpString="*.mpeg") returned 6 [0063.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.mpg") returned 0 [0063.904] lstrlenA (lpString="*.mpg") returned 5 [0063.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.flv") returned 0 [0063.904] lstrlenA (lpString="*.flv") returned 5 [0063.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.avi") returned 0 [0063.904] lstrlenA (lpString="*.avi") returned 5 [0063.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.mp4") returned 0 [0063.904] lstrlenA (lpString="*.mp4") returned 5 [0063.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.wmv") returned 0 [0063.904] lstrlenA (lpString="*.wmv") returned 5 [0063.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.divx") returned 0 [0063.904] lstrlenA (lpString="*.divx") returned 6 [0063.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.mkv") returned 0 [0063.904] lstrlenA (lpString="*.mkv") returned 5 [0063.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.mp3") returned 0 [0063.904] lstrlenA (lpString="*.mp3") returned 5 [0063.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.wav") returned 0 [0063.904] lstrlenA (lpString="*.wav") returned 5 [0063.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.flac") returned 0 [0063.904] lstrlenA (lpString="*.flac") returned 6 [0063.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.ape") returned 0 [0063.904] lstrlenA (lpString="*.ape") returned 5 [0063.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.wma") returned 0 [0063.904] lstrlenA (lpString="*.wma") returned 5 [0063.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.ac3") returned 0 [0063.904] lstrlenA (lpString="*.ac3") returned 5 [0063.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", pszSpec="*.mxf") returned 0 [0063.904] lstrlenA (lpString="*.mxf") returned 5 [0063.904] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x360, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0063.904] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.905] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0063.905] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0063.905] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x18f3cc, dwReserved1=0x4f0048, cFileName="LAUNCH.GIF", cAlternateFileName="")) returned 1 [0063.905] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.905] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LAUNCH.GIF") returned -1 [0063.905] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LAUNCH.GIF") returned -1 [0063.905] lstrcmpiA (lpString1="", lpString2="LAUNCH.GIF") returned -1 [0063.905] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js") returned="form_edit.js" [0063.905] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.905] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.905] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="LAUNCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF" [0063.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.zip") returned 0 [0063.905] lstrlenA (lpString="*.zip") returned 5 [0063.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.rar") returned 0 [0063.905] lstrlenA (lpString="*.rar") returned 5 [0063.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.7z") returned 0 [0063.905] lstrlenA (lpString="*.7z") returned 4 [0063.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.tar") returned 0 [0063.905] lstrlenA (lpString="*.tar") returned 5 [0063.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.gzip") returned 0 [0063.905] lstrlenA (lpString="*.gzip") returned 6 [0063.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.jpg") returned 0 [0063.905] lstrlenA (lpString="*.jpg") returned 5 [0063.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.jpeg") returned 0 [0063.905] lstrlenA (lpString="*.jpeg") returned 6 [0063.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.psd") returned 0 [0063.905] lstrlenA (lpString="*.psd") returned 5 [0063.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", pszSpec="*.gif") returned 1 [0063.906] lstrlenA (lpString="*.gif") returned 5 [0063.906] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF" [0063.906] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF" [0063.906] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF." [0063.906] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF.wannacry" [0063.906] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\launch.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0063.908] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x267 [0063.908] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x567e4730, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1 [0063.908] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.909] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1e9, lpOverlapped=0x0) returned 1 [0063.910] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF") returned="LAUNCH.GIF" [0063.910] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.910] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1e9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1e9, lpOverlapped=0x0) returned 1 [0063.910] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.910] CloseHandle (hObject=0x98) returned 1 [0063.910] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\launch.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\launch.gif.wannacry")) returned 1 [0063.935] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x58285d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa52f, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="macroprogress.gif", cAlternateFileName="MACROP~1.GIF")) returned 1 [0063.935] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.935] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="macroprogress.gif") returned -1 [0063.935] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="macroprogress.gif") returned -1 [0063.935] lstrcmpiA (lpString1="", lpString2="macroprogress.gif") returned -1 [0063.935] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF") returned="LAUNCH.GIF" [0063.935] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.935] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.935] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.935] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.935] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="macroprogress.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" [0063.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.zip") returned 0 [0063.936] lstrlenA (lpString="*.zip") returned 5 [0063.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.rar") returned 0 [0063.936] lstrlenA (lpString="*.rar") returned 5 [0063.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.7z") returned 0 [0063.936] lstrlenA (lpString="*.7z") returned 4 [0063.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.tar") returned 0 [0063.936] lstrlenA (lpString="*.tar") returned 5 [0063.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.gzip") returned 0 [0063.936] lstrlenA (lpString="*.gzip") returned 6 [0063.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.jpg") returned 0 [0063.936] lstrlenA (lpString="*.jpg") returned 5 [0063.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.jpeg") returned 0 [0063.936] lstrlenA (lpString="*.jpeg") returned 6 [0063.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.psd") returned 0 [0063.936] lstrlenA (lpString="*.psd") returned 5 [0063.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", pszSpec="*.gif") returned 1 [0063.936] lstrlenA (lpString="*.gif") returned 5 [0063.936] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" [0063.936] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" [0063.936] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif." [0063.936] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif.wannacry" [0063.936] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0063.937] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa52f [0063.942] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x58285d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1 [0063.950] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.950] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xa4b1, lpOverlapped=0x0) returned 1 [0063.969] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif") returned="macroprogress.gif" [0063.969] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.970] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xa4b1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xa4b1, lpOverlapped=0x0) returned 1 [0063.970] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.970] CloseHandle (hObject=0x98) returned 1 [0063.970] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif.wannacry")) returned 1 [0063.972] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a76b250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x21e5, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="PublicFunctions.js", cAlternateFileName="PUBLIC~1.JS")) returned 1 [0063.972] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.972] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PublicFunctions.js") returned -1 [0063.972] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PublicFunctions.js") returned -1 [0063.972] lstrcmpiA (lpString1="", lpString2="PublicFunctions.js") returned -1 [0063.972] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif") returned="macroprogress.gif" [0063.972] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.972] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.972] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.973] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.973] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="PublicFunctions.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js" [0063.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.zip") returned 0 [0063.973] lstrlenA (lpString="*.zip") returned 5 [0063.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.rar") returned 0 [0063.973] lstrlenA (lpString="*.rar") returned 5 [0063.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.7z") returned 0 [0063.973] lstrlenA (lpString="*.7z") returned 4 [0063.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.tar") returned 0 [0063.973] lstrlenA (lpString="*.tar") returned 5 [0063.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.gzip") returned 0 [0063.973] lstrlenA (lpString="*.gzip") returned 6 [0063.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.jpg") returned 0 [0063.973] lstrlenA (lpString="*.jpg") returned 5 [0063.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.jpeg") returned 0 [0063.973] lstrlenA (lpString="*.jpeg") returned 6 [0063.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.psd") returned 0 [0063.973] lstrlenA (lpString="*.psd") returned 5 [0063.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.gif") returned 0 [0063.973] lstrlenA (lpString="*.gif") returned 5 [0063.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.doc") returned 0 [0063.973] lstrlenA (lpString="*.doc") returned 5 [0063.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.docx") returned 0 [0063.973] lstrlenA (lpString="*.docx") returned 6 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.xls") returned 0 [0063.974] lstrlenA (lpString="*.xls") returned 5 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.xlsx") returned 0 [0063.974] lstrlenA (lpString="*.xlsx") returned 6 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.ppt") returned 0 [0063.974] lstrlenA (lpString="*.ppt") returned 5 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.pptx") returned 0 [0063.974] lstrlenA (lpString="*.pptx") returned 6 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.pdf") returned 0 [0063.974] lstrlenA (lpString="*.pdf") returned 5 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.mov") returned 0 [0063.974] lstrlenA (lpString="*.mov") returned 5 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.m2v") returned 0 [0063.974] lstrlenA (lpString="*.m2v") returned 5 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.3gp") returned 0 [0063.974] lstrlenA (lpString="*.3gp") returned 5 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.mpeg") returned 0 [0063.974] lstrlenA (lpString="*.mpeg") returned 6 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.mpg") returned 0 [0063.974] lstrlenA (lpString="*.mpg") returned 5 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.flv") returned 0 [0063.974] lstrlenA (lpString="*.flv") returned 5 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.avi") returned 0 [0063.974] lstrlenA (lpString="*.avi") returned 5 [0063.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.mp4") returned 0 [0063.974] lstrlenA (lpString="*.mp4") returned 5 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.wmv") returned 0 [0063.975] lstrlenA (lpString="*.wmv") returned 5 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.divx") returned 0 [0063.975] lstrlenA (lpString="*.divx") returned 6 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.mkv") returned 0 [0063.975] lstrlenA (lpString="*.mkv") returned 5 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.mp3") returned 0 [0063.975] lstrlenA (lpString="*.mp3") returned 5 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.wav") returned 0 [0063.975] lstrlenA (lpString="*.wav") returned 5 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.flac") returned 0 [0063.975] lstrlenA (lpString="*.flac") returned 6 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.ape") returned 0 [0063.975] lstrlenA (lpString="*.ape") returned 5 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.wma") returned 0 [0063.975] lstrlenA (lpString="*.wma") returned 5 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.ac3") returned 0 [0063.975] lstrlenA (lpString="*.ac3") returned 5 [0063.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", pszSpec="*.mxf") returned 0 [0063.975] lstrlenA (lpString="*.mxf") returned 5 [0063.975] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="rtf_alignleft.gif", cAlternateFileName="RTF_AL~1.GIF")) returned 1 [0063.975] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.975] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_alignleft.gif") returned -1 [0063.975] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_alignleft.gif") returned -1 [0063.975] lstrcmpiA (lpString1="", lpString2="rtf_alignleft.gif") returned -1 [0063.975] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js") returned="PublicFunctions.js" [0063.975] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.976] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.976] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.976] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.976] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_alignleft.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" [0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", pszSpec="*.zip") returned 0 [0063.976] lstrlenA (lpString="*.zip") returned 5 [0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", pszSpec="*.rar") returned 0 [0063.976] lstrlenA (lpString="*.rar") returned 5 [0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", pszSpec="*.7z") returned 0 [0063.976] lstrlenA (lpString="*.7z") returned 4 [0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", pszSpec="*.tar") returned 0 [0063.976] lstrlenA (lpString="*.tar") returned 5 [0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", pszSpec="*.gzip") returned 0 [0063.976] lstrlenA (lpString="*.gzip") returned 6 [0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", pszSpec="*.jpg") returned 0 [0063.976] lstrlenA (lpString="*.jpg") returned 5 [0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", pszSpec="*.jpeg") returned 0 [0063.976] lstrlenA (lpString="*.jpeg") returned 6 [0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", pszSpec="*.psd") returned 0 [0063.976] lstrlenA (lpString="*.psd") returned 5 [0063.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", pszSpec="*.gif") returned 1 [0063.976] lstrlenA (lpString="*.gif") returned 5 [0063.976] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" [0063.977] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" [0063.977] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif." [0063.977] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif.wannacry" [0063.977] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0063.978] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x350 [0063.978] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1 [0063.978] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.978] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2d2, lpOverlapped=0x0) returned 1 [0063.984] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif") returned="rtf_alignleft.gif" [0063.985] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.985] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2d2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2d2, lpOverlapped=0x0) returned 1 [0063.985] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0063.985] CloseHandle (hObject=0x98) returned 1 [0063.985] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif.wannacry")) returned 1 [0063.987] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="rtf_alignright.gif", cAlternateFileName="RTF_AL~2.GIF")) returned 1 [0063.987] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0063.987] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_alignright.gif") returned -1 [0063.987] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_alignright.gif") returned -1 [0063.987] lstrcmpiA (lpString1="", lpString2="rtf_alignright.gif") returned -1 [0063.987] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif") returned="rtf_alignleft.gif" [0063.987] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0063.987] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0063.987] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0063.987] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0063.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_alignright.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" [0063.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", pszSpec="*.zip") returned 0 [0063.988] lstrlenA (lpString="*.zip") returned 5 [0063.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", pszSpec="*.rar") returned 0 [0063.988] lstrlenA (lpString="*.rar") returned 5 [0063.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", pszSpec="*.7z") returned 0 [0063.988] lstrlenA (lpString="*.7z") returned 4 [0063.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", pszSpec="*.tar") returned 0 [0063.988] lstrlenA (lpString="*.tar") returned 5 [0063.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", pszSpec="*.gzip") returned 0 [0063.988] lstrlenA (lpString="*.gzip") returned 6 [0063.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", pszSpec="*.jpg") returned 0 [0063.988] lstrlenA (lpString="*.jpg") returned 5 [0063.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", pszSpec="*.jpeg") returned 0 [0063.988] lstrlenA (lpString="*.jpeg") returned 6 [0063.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", pszSpec="*.psd") returned 0 [0063.989] lstrlenA (lpString="*.psd") returned 5 [0063.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", pszSpec="*.gif") returned 1 [0063.989] lstrlenA (lpString="*.gif") returned 5 [0063.989] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" [0063.989] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" [0063.989] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif." [0063.989] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif.wannacry" [0063.989] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0063.990] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34f [0063.990] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1 [0063.990] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0063.990] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2d1, lpOverlapped=0x0) returned 1 [0063.993] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif") returned="rtf_alignright.gif" [0063.993] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.027] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2d1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2d1, lpOverlapped=0x0) returned 1 [0064.028] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.028] CloseHandle (hObject=0x98) returned 1 [0064.029] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif.wannacry")) returned 1 [0064.066] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x366, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="RTF_BOLD.GIF", cAlternateFileName="")) returned 1 [0064.066] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.066] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RTF_BOLD.GIF") returned -1 [0064.067] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RTF_BOLD.GIF") returned -1 [0064.067] lstrcmpiA (lpString1="", lpString2="RTF_BOLD.GIF") returned -1 [0064.067] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif") returned="rtf_alignright.gif" [0064.067] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.067] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.067] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.067] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.067] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="RTF_BOLD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF" [0064.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", pszSpec="*.zip") returned 0 [0064.067] lstrlenA (lpString="*.zip") returned 5 [0064.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", pszSpec="*.rar") returned 0 [0064.067] lstrlenA (lpString="*.rar") returned 5 [0064.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", pszSpec="*.7z") returned 0 [0064.067] lstrlenA (lpString="*.7z") returned 4 [0064.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", pszSpec="*.tar") returned 0 [0064.068] lstrlenA (lpString="*.tar") returned 5 [0064.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", pszSpec="*.gzip") returned 0 [0064.068] lstrlenA (lpString="*.gzip") returned 6 [0064.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", pszSpec="*.jpg") returned 0 [0064.070] lstrlenA (lpString="*.jpg") returned 5 [0064.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", pszSpec="*.jpeg") returned 0 [0064.070] lstrlenA (lpString="*.jpeg") returned 6 [0064.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", pszSpec="*.psd") returned 0 [0064.070] lstrlenA (lpString="*.psd") returned 5 [0064.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", pszSpec="*.gif") returned 1 [0064.070] lstrlenA (lpString="*.gif") returned 5 [0064.070] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF" [0064.070] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF" [0064.071] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF." [0064.072] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF.wannacry" [0064.072] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bold.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.077] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x366 [0064.077] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1 [0064.077] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.077] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2e8, lpOverlapped=0x0) returned 1 [0064.088] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF") returned="RTF_BOLD.GIF" [0064.088] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.089] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2e8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2e8, lpOverlapped=0x0) returned 1 [0064.089] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.090] CloseHandle (hObject=0x98) returned 1 [0064.090] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bold.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bold.gif.wannacry")) returned 1 [0064.098] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x365, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="rtf_bullets.gif", cAlternateFileName="RTF_BU~1.GIF")) returned 1 [0064.098] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.098] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_bullets.gif") returned -1 [0064.098] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_bullets.gif") returned -1 [0064.098] lstrcmpiA (lpString1="", lpString2="rtf_bullets.gif") returned -1 [0064.099] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF") returned="RTF_BOLD.GIF" [0064.099] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.099] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.100] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.100] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.100] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_bullets.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" [0064.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", pszSpec="*.zip") returned 0 [0064.100] lstrlenA (lpString="*.zip") returned 5 [0064.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", pszSpec="*.rar") returned 0 [0064.101] lstrlenA (lpString="*.rar") returned 5 [0064.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", pszSpec="*.7z") returned 0 [0064.102] lstrlenA (lpString="*.7z") returned 4 [0064.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", pszSpec="*.tar") returned 0 [0064.102] lstrlenA (lpString="*.tar") returned 5 [0064.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", pszSpec="*.gzip") returned 0 [0064.102] lstrlenA (lpString="*.gzip") returned 6 [0064.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", pszSpec="*.jpg") returned 0 [0064.102] lstrlenA (lpString="*.jpg") returned 5 [0064.102] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", pszSpec="*.jpeg") returned 0 [0064.102] lstrlenA (lpString="*.jpeg") returned 6 [0064.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", pszSpec="*.psd") returned 0 [0064.103] lstrlenA (lpString="*.psd") returned 5 [0064.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", pszSpec="*.gif") returned 1 [0064.104] lstrlenA (lpString="*.gif") returned 5 [0064.104] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" [0064.105] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" [0064.105] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif." [0064.110] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif.wannacry" [0064.110] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.111] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x365 [0064.111] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1 [0064.111] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.111] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2e7, lpOverlapped=0x0) returned 1 [0064.118] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif") returned="rtf_bullets.gif" [0064.118] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.118] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2e7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2e7, lpOverlapped=0x0) returned 1 [0064.121] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.121] CloseHandle (hObject=0x98) returned 1 [0064.121] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif.wannacry")) returned 1 [0064.135] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="rtf_center.gif", cAlternateFileName="RTF_CE~1.GIF")) returned 1 [0064.135] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.135] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_center.gif") returned -1 [0064.135] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_center.gif") returned -1 [0064.135] lstrcmpiA (lpString1="", lpString2="rtf_center.gif") returned -1 [0064.135] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif") returned="rtf_bullets.gif" [0064.135] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.135] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.135] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.135] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.136] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_center.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" [0064.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", pszSpec="*.zip") returned 0 [0064.136] lstrlenA (lpString="*.zip") returned 5 [0064.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", pszSpec="*.rar") returned 0 [0064.136] lstrlenA (lpString="*.rar") returned 5 [0064.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", pszSpec="*.7z") returned 0 [0064.136] lstrlenA (lpString="*.7z") returned 4 [0064.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", pszSpec="*.tar") returned 0 [0064.137] lstrlenA (lpString="*.tar") returned 5 [0064.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", pszSpec="*.gzip") returned 0 [0064.137] lstrlenA (lpString="*.gzip") returned 6 [0064.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", pszSpec="*.jpg") returned 0 [0064.137] lstrlenA (lpString="*.jpg") returned 5 [0064.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", pszSpec="*.jpeg") returned 0 [0064.138] lstrlenA (lpString="*.jpeg") returned 6 [0064.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", pszSpec="*.psd") returned 0 [0064.138] lstrlenA (lpString="*.psd") returned 5 [0064.138] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", pszSpec="*.gif") returned 1 [0064.138] lstrlenA (lpString="*.gif") returned 5 [0064.138] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" [0064.138] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" [0064.138] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif." [0064.138] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif.wannacry" [0064.138] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.142] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34f [0064.144] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1 [0064.190] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.190] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2d1, lpOverlapped=0x0) returned 1 [0064.257] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif") returned="rtf_center.gif" [0064.257] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.257] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2d1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2d1, lpOverlapped=0x0) returned 1 [0064.257] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.258] CloseHandle (hObject=0x98) returned 1 [0064.258] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif.wannacry")) returned 1 [0064.259] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3ec, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="rtf_choosecolor.gif", cAlternateFileName="RTF_CH~1.GIF")) returned 1 [0064.259] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.259] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_choosecolor.gif") returned -1 [0064.259] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_choosecolor.gif") returned -1 [0064.259] lstrcmpiA (lpString1="", lpString2="rtf_choosecolor.gif") returned -1 [0064.259] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif") returned="rtf_center.gif" [0064.259] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.259] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.259] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.259] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.260] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_choosecolor.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" [0064.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", pszSpec="*.zip") returned 0 [0064.260] lstrlenA (lpString="*.zip") returned 5 [0064.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", pszSpec="*.rar") returned 0 [0064.260] lstrlenA (lpString="*.rar") returned 5 [0064.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", pszSpec="*.7z") returned 0 [0064.260] lstrlenA (lpString="*.7z") returned 4 [0064.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", pszSpec="*.tar") returned 0 [0064.260] lstrlenA (lpString="*.tar") returned 5 [0064.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", pszSpec="*.gzip") returned 0 [0064.260] lstrlenA (lpString="*.gzip") returned 6 [0064.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", pszSpec="*.jpg") returned 0 [0064.260] lstrlenA (lpString="*.jpg") returned 5 [0064.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", pszSpec="*.jpeg") returned 0 [0064.260] lstrlenA (lpString="*.jpeg") returned 6 [0064.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", pszSpec="*.psd") returned 0 [0064.260] lstrlenA (lpString="*.psd") returned 5 [0064.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", pszSpec="*.gif") returned 1 [0064.260] lstrlenA (lpString="*.gif") returned 5 [0064.260] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" [0064.260] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" [0064.260] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif." [0064.260] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif.wannacry" [0064.261] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.261] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ec [0064.261] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1 [0064.262] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.262] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x36e, lpOverlapped=0x0) returned 1 [0064.265] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif") returned="rtf_choosecolor.gif" [0064.265] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.265] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x36e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x36e, lpOverlapped=0x0) returned 1 [0064.265] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.266] CloseHandle (hObject=0x98) returned 1 [0064.266] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif.wannacry")) returned 1 [0064.267] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x37a, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="rtf_choosefont.gif", cAlternateFileName="RTF_CH~2.GIF")) returned 1 [0064.267] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.267] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_choosefont.gif") returned -1 [0064.267] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_choosefont.gif") returned -1 [0064.267] lstrcmpiA (lpString1="", lpString2="rtf_choosefont.gif") returned -1 [0064.267] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif") returned="rtf_choosecolor.gif" [0064.267] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.267] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.267] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.267] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_choosefont.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" [0064.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", pszSpec="*.zip") returned 0 [0064.268] lstrlenA (lpString="*.zip") returned 5 [0064.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", pszSpec="*.rar") returned 0 [0064.268] lstrlenA (lpString="*.rar") returned 5 [0064.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", pszSpec="*.7z") returned 0 [0064.268] lstrlenA (lpString="*.7z") returned 4 [0064.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", pszSpec="*.tar") returned 0 [0064.268] lstrlenA (lpString="*.tar") returned 5 [0064.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", pszSpec="*.gzip") returned 0 [0064.268] lstrlenA (lpString="*.gzip") returned 6 [0064.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", pszSpec="*.jpg") returned 0 [0064.268] lstrlenA (lpString="*.jpg") returned 5 [0064.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", pszSpec="*.jpeg") returned 0 [0064.268] lstrlenA (lpString="*.jpeg") returned 6 [0064.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", pszSpec="*.psd") returned 0 [0064.268] lstrlenA (lpString="*.psd") returned 5 [0064.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", pszSpec="*.gif") returned 1 [0064.268] lstrlenA (lpString="*.gif") returned 5 [0064.268] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" [0064.268] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" [0064.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif." [0064.269] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif.wannacry" [0064.269] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.269] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x37a [0064.269] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1 [0064.270] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.270] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2fc, lpOverlapped=0x0) returned 1 [0064.271] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif") returned="rtf_choosefont.gif" [0064.271] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.272] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2fc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2fc, lpOverlapped=0x0) returned 1 [0064.272] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.272] CloseHandle (hObject=0x98) returned 1 [0064.272] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif.wannacry")) returned 1 [0064.273] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35f, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="rtf_decreaseindent.gif", cAlternateFileName="RTF_DE~1.GIF")) returned 1 [0064.274] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.274] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_decreaseindent.gif") returned -1 [0064.275] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_decreaseindent.gif") returned -1 [0064.275] lstrcmpiA (lpString1="", lpString2="rtf_decreaseindent.gif") returned -1 [0064.275] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif") returned="rtf_choosefont.gif" [0064.275] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.275] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.275] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.275] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.275] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_decreaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" [0064.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", pszSpec="*.zip") returned 0 [0064.275] lstrlenA (lpString="*.zip") returned 5 [0064.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", pszSpec="*.rar") returned 0 [0064.275] lstrlenA (lpString="*.rar") returned 5 [0064.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", pszSpec="*.7z") returned 0 [0064.275] lstrlenA (lpString="*.7z") returned 4 [0064.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", pszSpec="*.tar") returned 0 [0064.275] lstrlenA (lpString="*.tar") returned 5 [0064.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", pszSpec="*.gzip") returned 0 [0064.275] lstrlenA (lpString="*.gzip") returned 6 [0064.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", pszSpec="*.jpg") returned 0 [0064.275] lstrlenA (lpString="*.jpg") returned 5 [0064.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", pszSpec="*.jpeg") returned 0 [0064.275] lstrlenA (lpString="*.jpeg") returned 6 [0064.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", pszSpec="*.psd") returned 0 [0064.276] lstrlenA (lpString="*.psd") returned 5 [0064.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", pszSpec="*.gif") returned 1 [0064.276] lstrlenA (lpString="*.gif") returned 5 [0064.276] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" [0064.276] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" [0064.276] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif." [0064.276] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif.wannacry" [0064.276] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.277] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35f [0064.277] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1 [0064.277] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.277] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2e1, lpOverlapped=0x0) returned 1 [0064.279] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif") returned="rtf_decreaseindent.gif" [0064.279] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.279] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2e1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2e1, lpOverlapped=0x0) returned 1 [0064.279] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.279] CloseHandle (hObject=0x98) returned 1 [0064.279] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif.wannacry")) returned 1 [0064.281] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="rtf_hyperlink.gif", cAlternateFileName="RTF_HY~1.GIF")) returned 1 [0064.281] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.281] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_hyperlink.gif") returned -1 [0064.281] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_hyperlink.gif") returned -1 [0064.281] lstrcmpiA (lpString1="", lpString2="rtf_hyperlink.gif") returned -1 [0064.281] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif") returned="rtf_decreaseindent.gif" [0064.281] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.281] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.281] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.281] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.281] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_hyperlink.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" [0064.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", pszSpec="*.zip") returned 0 [0064.281] lstrlenA (lpString="*.zip") returned 5 [0064.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", pszSpec="*.rar") returned 0 [0064.281] lstrlenA (lpString="*.rar") returned 5 [0064.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", pszSpec="*.7z") returned 0 [0064.282] lstrlenA (lpString="*.7z") returned 4 [0064.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", pszSpec="*.tar") returned 0 [0064.282] lstrlenA (lpString="*.tar") returned 5 [0064.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", pszSpec="*.gzip") returned 0 [0064.282] lstrlenA (lpString="*.gzip") returned 6 [0064.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", pszSpec="*.jpg") returned 0 [0064.282] lstrlenA (lpString="*.jpg") returned 5 [0064.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", pszSpec="*.jpeg") returned 0 [0064.282] lstrlenA (lpString="*.jpeg") returned 6 [0064.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", pszSpec="*.psd") returned 0 [0064.282] lstrlenA (lpString="*.psd") returned 5 [0064.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", pszSpec="*.gif") returned 1 [0064.282] lstrlenA (lpString="*.gif") returned 5 [0064.282] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" [0064.282] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" [0064.282] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif." [0064.282] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif.wannacry" [0064.282] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.283] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf1 [0064.283] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1 [0064.283] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.283] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x73, lpOverlapped=0x0) returned 1 [0064.284] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif") returned="rtf_hyperlink.gif" [0064.285] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.285] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x73, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x73, lpOverlapped=0x0) returned 1 [0064.285] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.285] CloseHandle (hObject=0x98) returned 1 [0064.285] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif.wannacry")) returned 1 [0064.286] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35d, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="rtf_increaseindent.gif", cAlternateFileName="RTF_IN~1.GIF")) returned 1 [0064.286] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.286] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_increaseindent.gif") returned -1 [0064.286] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_increaseindent.gif") returned -1 [0064.286] lstrcmpiA (lpString1="", lpString2="rtf_increaseindent.gif") returned -1 [0064.286] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif") returned="rtf_hyperlink.gif" [0064.286] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.286] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.286] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.287] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.287] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_increaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" [0064.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", pszSpec="*.zip") returned 0 [0064.287] lstrlenA (lpString="*.zip") returned 5 [0064.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", pszSpec="*.rar") returned 0 [0064.287] lstrlenA (lpString="*.rar") returned 5 [0064.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", pszSpec="*.7z") returned 0 [0064.287] lstrlenA (lpString="*.7z") returned 4 [0064.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", pszSpec="*.tar") returned 0 [0064.287] lstrlenA (lpString="*.tar") returned 5 [0064.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", pszSpec="*.gzip") returned 0 [0064.287] lstrlenA (lpString="*.gzip") returned 6 [0064.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", pszSpec="*.jpg") returned 0 [0064.287] lstrlenA (lpString="*.jpg") returned 5 [0064.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", pszSpec="*.jpeg") returned 0 [0064.287] lstrlenA (lpString="*.jpeg") returned 6 [0064.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", pszSpec="*.psd") returned 0 [0064.287] lstrlenA (lpString="*.psd") returned 5 [0064.287] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", pszSpec="*.gif") returned 1 [0064.287] lstrlenA (lpString="*.gif") returned 5 [0064.287] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" [0064.287] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" [0064.287] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif." [0064.288] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif.wannacry" [0064.288] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.288] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35d [0064.288] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1 [0064.288] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.288] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2df, lpOverlapped=0x0) returned 1 [0064.292] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif") returned="rtf_increaseindent.gif" [0064.292] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.293] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2df, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2df, lpOverlapped=0x0) returned 1 [0064.293] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.293] CloseHandle (hObject=0x98) returned 1 [0064.293] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif.wannacry")) returned 1 [0064.294] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="rtf_italic.gif", cAlternateFileName="RTF_IT~1.GIF")) returned 1 [0064.294] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.294] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_italic.gif") returned -1 [0064.294] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_italic.gif") returned -1 [0064.294] lstrcmpiA (lpString1="", lpString2="rtf_italic.gif") returned -1 [0064.294] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif") returned="rtf_increaseindent.gif" [0064.294] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.294] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.294] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.295] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.295] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_italic.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" [0064.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", pszSpec="*.zip") returned 0 [0064.295] lstrlenA (lpString="*.zip") returned 5 [0064.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", pszSpec="*.rar") returned 0 [0064.295] lstrlenA (lpString="*.rar") returned 5 [0064.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", pszSpec="*.7z") returned 0 [0064.295] lstrlenA (lpString="*.7z") returned 4 [0064.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", pszSpec="*.tar") returned 0 [0064.295] lstrlenA (lpString="*.tar") returned 5 [0064.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", pszSpec="*.gzip") returned 0 [0064.295] lstrlenA (lpString="*.gzip") returned 6 [0064.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", pszSpec="*.jpg") returned 0 [0064.295] lstrlenA (lpString="*.jpg") returned 5 [0064.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", pszSpec="*.jpeg") returned 0 [0064.295] lstrlenA (lpString="*.jpeg") returned 6 [0064.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", pszSpec="*.psd") returned 0 [0064.295] lstrlenA (lpString="*.psd") returned 5 [0064.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", pszSpec="*.gif") returned 1 [0064.295] lstrlenA (lpString="*.gif") returned 5 [0064.295] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" [0064.295] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" [0064.295] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif." [0064.296] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif.wannacry" [0064.296] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.296] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x354 [0064.296] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a90e170, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1 [0064.296] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.297] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2d6, lpOverlapped=0x0) returned 1 [0064.299] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif") returned="rtf_italic.gif" [0064.299] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.299] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2d6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2d6, lpOverlapped=0x0) returned 1 [0064.299] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.299] CloseHandle (hObject=0x98) returned 1 [0064.299] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif.wannacry")) returned 1 [0064.300] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="rtf_justify.gif", cAlternateFileName="RTF_JU~1.GIF")) returned 1 [0064.301] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.301] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_justify.gif") returned -1 [0064.301] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_justify.gif") returned -1 [0064.301] lstrcmpiA (lpString1="", lpString2="rtf_justify.gif") returned -1 [0064.301] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif") returned="rtf_italic.gif" [0064.301] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.301] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.301] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.301] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.301] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_justify.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" [0064.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", pszSpec="*.zip") returned 0 [0064.301] lstrlenA (lpString="*.zip") returned 5 [0064.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", pszSpec="*.rar") returned 0 [0064.301] lstrlenA (lpString="*.rar") returned 5 [0064.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", pszSpec="*.7z") returned 0 [0064.301] lstrlenA (lpString="*.7z") returned 4 [0064.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", pszSpec="*.tar") returned 0 [0064.301] lstrlenA (lpString="*.tar") returned 5 [0064.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", pszSpec="*.gzip") returned 0 [0064.301] lstrlenA (lpString="*.gzip") returned 6 [0064.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", pszSpec="*.jpg") returned 0 [0064.301] lstrlenA (lpString="*.jpg") returned 5 [0064.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", pszSpec="*.jpeg") returned 0 [0064.302] lstrlenA (lpString="*.jpeg") returned 6 [0064.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", pszSpec="*.psd") returned 0 [0064.302] lstrlenA (lpString="*.psd") returned 5 [0064.302] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", pszSpec="*.gif") returned 1 [0064.302] lstrlenA (lpString="*.gif") returned 5 [0064.302] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" [0064.302] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" [0064.302] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif." [0064.302] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif.wannacry" [0064.302] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.303] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x352 [0064.303] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a90e170, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea)) returned 1 [0064.303] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.303] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2d4, lpOverlapped=0x0) returned 1 [0064.309] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif") returned="rtf_justify.gif" [0064.309] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.309] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2d4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2d4, lpOverlapped=0x0) returned 1 [0064.310] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.310] CloseHandle (hObject=0x98) returned 1 [0064.310] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif.wannacry")) returned 1 [0064.311] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x373, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="rtf_pressed.gif", cAlternateFileName="RTF_PR~1.GIF")) returned 1 [0064.311] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.311] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_pressed.gif") returned -1 [0064.311] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_pressed.gif") returned -1 [0064.311] lstrcmpiA (lpString1="", lpString2="rtf_pressed.gif") returned -1 [0064.311] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif") returned="rtf_justify.gif" [0064.311] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.311] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.312] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.312] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.312] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_pressed.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" [0064.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", pszSpec="*.zip") returned 0 [0064.312] lstrlenA (lpString="*.zip") returned 5 [0064.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", pszSpec="*.rar") returned 0 [0064.312] lstrlenA (lpString="*.rar") returned 5 [0064.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", pszSpec="*.7z") returned 0 [0064.312] lstrlenA (lpString="*.7z") returned 4 [0064.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", pszSpec="*.tar") returned 0 [0064.312] lstrlenA (lpString="*.tar") returned 5 [0064.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", pszSpec="*.gzip") returned 0 [0064.312] lstrlenA (lpString="*.gzip") returned 6 [0064.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", pszSpec="*.jpg") returned 0 [0064.312] lstrlenA (lpString="*.jpg") returned 5 [0064.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", pszSpec="*.jpeg") returned 0 [0064.312] lstrlenA (lpString="*.jpeg") returned 6 [0064.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", pszSpec="*.psd") returned 0 [0064.312] lstrlenA (lpString="*.psd") returned 5 [0064.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", pszSpec="*.gif") returned 1 [0064.312] lstrlenA (lpString="*.gif") returned 5 [0064.312] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" [0064.312] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" [0064.313] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif." [0064.313] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif.wannacry" [0064.313] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.314] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x373 [0064.314] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a90e170, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea)) returned 1 [0064.314] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.314] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2f5, lpOverlapped=0x0) returned 1 [0064.316] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif") returned="rtf_pressed.gif" [0064.316] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.316] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2f5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2f5, lpOverlapped=0x0) returned 1 [0064.316] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.316] CloseHandle (hObject=0x98) returned 1 [0064.316] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif.wannacry")) returned 1 [0064.317] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="rtf_spellcheck.gif", cAlternateFileName="RTF_SP~1.GIF")) returned 1 [0064.318] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.318] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_spellcheck.gif") returned -1 [0064.318] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_spellcheck.gif") returned -1 [0064.318] lstrcmpiA (lpString1="", lpString2="rtf_spellcheck.gif") returned -1 [0064.318] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif") returned="rtf_pressed.gif" [0064.318] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.318] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.318] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.318] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.318] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_spellcheck.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" [0064.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", pszSpec="*.zip") returned 0 [0064.318] lstrlenA (lpString="*.zip") returned 5 [0064.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", pszSpec="*.rar") returned 0 [0064.318] lstrlenA (lpString="*.rar") returned 5 [0064.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", pszSpec="*.7z") returned 0 [0064.318] lstrlenA (lpString="*.7z") returned 4 [0064.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", pszSpec="*.tar") returned 0 [0064.318] lstrlenA (lpString="*.tar") returned 5 [0064.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", pszSpec="*.gzip") returned 0 [0064.318] lstrlenA (lpString="*.gzip") returned 6 [0064.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", pszSpec="*.jpg") returned 0 [0064.319] lstrlenA (lpString="*.jpg") returned 5 [0064.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", pszSpec="*.jpeg") returned 0 [0064.319] lstrlenA (lpString="*.jpeg") returned 6 [0064.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", pszSpec="*.psd") returned 0 [0064.319] lstrlenA (lpString="*.psd") returned 5 [0064.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", pszSpec="*.gif") returned 1 [0064.319] lstrlenA (lpString="*.gif") returned 5 [0064.319] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" [0064.319] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" [0064.319] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif." [0064.319] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif.wannacry" [0064.319] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.320] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa0 [0064.320] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a90e170, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea)) returned 1 [0064.320] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.320] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x22, lpOverlapped=0x0) returned 1 [0064.321] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif") returned="rtf_spellcheck.gif" [0064.321] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.321] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x22, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x22, lpOverlapped=0x0) returned 1 [0064.321] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.321] CloseHandle (hObject=0x98) returned 1 [0064.322] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif.wannacry")) returned 1 [0064.323] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35c, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="rtf_underline.gif", cAlternateFileName="RTF_UN~1.GIF")) returned 1 [0064.323] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.323] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_underline.gif") returned -1 [0064.323] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_underline.gif") returned -1 [0064.323] lstrcmpiA (lpString1="", lpString2="rtf_underline.gif") returned -1 [0064.323] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif") returned="rtf_spellcheck.gif" [0064.323] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.323] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.323] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.323] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.323] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_underline.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" [0064.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", pszSpec="*.zip") returned 0 [0064.323] lstrlenA (lpString="*.zip") returned 5 [0064.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", pszSpec="*.rar") returned 0 [0064.323] lstrlenA (lpString="*.rar") returned 5 [0064.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", pszSpec="*.7z") returned 0 [0064.323] lstrlenA (lpString="*.7z") returned 4 [0064.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", pszSpec="*.tar") returned 0 [0064.324] lstrlenA (lpString="*.tar") returned 5 [0064.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", pszSpec="*.gzip") returned 0 [0064.324] lstrlenA (lpString="*.gzip") returned 6 [0064.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", pszSpec="*.jpg") returned 0 [0064.324] lstrlenA (lpString="*.jpg") returned 5 [0064.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", pszSpec="*.jpeg") returned 0 [0064.324] lstrlenA (lpString="*.jpeg") returned 6 [0064.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", pszSpec="*.psd") returned 0 [0064.324] lstrlenA (lpString="*.psd") returned 5 [0064.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", pszSpec="*.gif") returned 1 [0064.324] lstrlenA (lpString="*.gif") returned 5 [0064.324] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" [0064.324] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" [0064.324] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif." [0064.324] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif.wannacry" [0064.324] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.326] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35c [0064.326] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d24dcb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea)) returned 1 [0064.326] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.326] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2de, lpOverlapped=0x0) returned 1 [0064.330] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif") returned="rtf_underline.gif" [0064.330] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.330] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2de, lpOverlapped=0x0) returned 1 [0064.331] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.331] CloseHandle (hObject=0x98) returned 1 [0064.331] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif.wannacry")) returned 1 [0064.332] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="SAVE.GIF", cAlternateFileName="")) returned 1 [0064.332] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.332] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SAVE.GIF") returned -1 [0064.332] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SAVE.GIF") returned -1 [0064.332] lstrcmpiA (lpString1="", lpString2="SAVE.GIF") returned -1 [0064.332] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif") returned="rtf_underline.gif" [0064.332] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.333] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.333] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.333] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.333] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="SAVE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF" [0064.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", pszSpec="*.zip") returned 0 [0064.333] lstrlenA (lpString="*.zip") returned 5 [0064.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", pszSpec="*.rar") returned 0 [0064.333] lstrlenA (lpString="*.rar") returned 5 [0064.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", pszSpec="*.7z") returned 0 [0064.333] lstrlenA (lpString="*.7z") returned 4 [0064.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", pszSpec="*.tar") returned 0 [0064.333] lstrlenA (lpString="*.tar") returned 5 [0064.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", pszSpec="*.gzip") returned 0 [0064.333] lstrlenA (lpString="*.gzip") returned 6 [0064.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", pszSpec="*.jpg") returned 0 [0064.333] lstrlenA (lpString="*.jpg") returned 5 [0064.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", pszSpec="*.jpeg") returned 0 [0064.333] lstrlenA (lpString="*.jpeg") returned 6 [0064.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", pszSpec="*.psd") returned 0 [0064.333] lstrlenA (lpString="*.psd") returned 5 [0064.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", pszSpec="*.gif") returned 1 [0064.334] lstrlenA (lpString="*.gif") returned 5 [0064.334] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF" [0064.334] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF" [0064.334] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF." [0064.334] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF.wannacry" [0064.334] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\save.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.335] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x267 [0064.335] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d24dcb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea)) returned 1 [0064.336] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.336] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1e9, lpOverlapped=0x0) returned 1 [0064.337] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF") returned="SAVE.GIF" [0064.337] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.337] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1e9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1e9, lpOverlapped=0x0) returned 1 [0064.337] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.337] CloseHandle (hObject=0x98) returned 1 [0064.337] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\save.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\save.gif.wannacry")) returned 1 [0064.348] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x14307, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="SUBMIT.JS", cAlternateFileName="")) returned 1 [0064.348] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.348] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SUBMIT.JS") returned -1 [0064.348] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SUBMIT.JS") returned -1 [0064.348] lstrcmpiA (lpString1="", lpString2="SUBMIT.JS") returned -1 [0064.348] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF") returned="SAVE.GIF" [0064.348] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.348] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.348] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.348] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.349] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="SUBMIT.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS" [0064.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.zip") returned 0 [0064.349] lstrlenA (lpString="*.zip") returned 5 [0064.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.rar") returned 0 [0064.349] lstrlenA (lpString="*.rar") returned 5 [0064.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.7z") returned 0 [0064.349] lstrlenA (lpString="*.7z") returned 4 [0064.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.tar") returned 0 [0064.349] lstrlenA (lpString="*.tar") returned 5 [0064.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.gzip") returned 0 [0064.349] lstrlenA (lpString="*.gzip") returned 6 [0064.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.jpg") returned 0 [0064.349] lstrlenA (lpString="*.jpg") returned 5 [0064.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.jpeg") returned 0 [0064.349] lstrlenA (lpString="*.jpeg") returned 6 [0064.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.psd") returned 0 [0064.349] lstrlenA (lpString="*.psd") returned 5 [0064.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.gif") returned 0 [0064.349] lstrlenA (lpString="*.gif") returned 5 [0064.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.doc") returned 0 [0064.349] lstrlenA (lpString="*.doc") returned 5 [0064.349] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.docx") returned 0 [0064.349] lstrlenA (lpString="*.docx") returned 6 [0064.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.xls") returned 0 [0064.350] lstrlenA (lpString="*.xls") returned 5 [0064.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.xlsx") returned 0 [0064.350] lstrlenA (lpString="*.xlsx") returned 6 [0064.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.ppt") returned 0 [0064.350] lstrlenA (lpString="*.ppt") returned 5 [0064.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.pptx") returned 0 [0064.350] lstrlenA (lpString="*.pptx") returned 6 [0064.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.pdf") returned 0 [0064.350] lstrlenA (lpString="*.pdf") returned 5 [0064.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.mov") returned 0 [0064.350] lstrlenA (lpString="*.mov") returned 5 [0064.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.m2v") returned 0 [0064.350] lstrlenA (lpString="*.m2v") returned 5 [0064.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.3gp") returned 0 [0064.350] lstrlenA (lpString="*.3gp") returned 5 [0064.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.mpeg") returned 0 [0064.350] lstrlenA (lpString="*.mpeg") returned 6 [0064.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.mpg") returned 0 [0064.350] lstrlenA (lpString="*.mpg") returned 5 [0064.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.flv") returned 0 [0064.350] lstrlenA (lpString="*.flv") returned 5 [0064.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.avi") returned 0 [0064.350] lstrlenA (lpString="*.avi") returned 5 [0064.350] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.mp4") returned 0 [0064.350] lstrlenA (lpString="*.mp4") returned 5 [0064.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.wmv") returned 0 [0064.351] lstrlenA (lpString="*.wmv") returned 5 [0064.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.divx") returned 0 [0064.351] lstrlenA (lpString="*.divx") returned 6 [0064.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.mkv") returned 0 [0064.351] lstrlenA (lpString="*.mkv") returned 5 [0064.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.mp3") returned 0 [0064.351] lstrlenA (lpString="*.mp3") returned 5 [0064.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.wav") returned 0 [0064.351] lstrlenA (lpString="*.wav") returned 5 [0064.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.flac") returned 0 [0064.351] lstrlenA (lpString="*.flac") returned 6 [0064.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.ape") returned 0 [0064.351] lstrlenA (lpString="*.ape") returned 5 [0064.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.wma") returned 0 [0064.351] lstrlenA (lpString="*.wma") returned 5 [0064.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.ac3") returned 0 [0064.351] lstrlenA (lpString="*.ac3") returned 5 [0064.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", pszSpec="*.mxf") returned 0 [0064.351] lstrlenA (lpString="*.mxf") returned 5 [0064.351] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xca5a, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="utilityfunctions.js", cAlternateFileName="UTILIT~1.JS")) returned 1 [0064.351] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.351] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="utilityfunctions.js") returned -1 [0064.351] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="utilityfunctions.js") returned -1 [0064.351] lstrcmpiA (lpString1="", lpString2="utilityfunctions.js") returned -1 [0064.352] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS") returned="SUBMIT.JS" [0064.352] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.352] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.352] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.352] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.352] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="utilityfunctions.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js" [0064.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.zip") returned 0 [0064.352] lstrlenA (lpString="*.zip") returned 5 [0064.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.rar") returned 0 [0064.352] lstrlenA (lpString="*.rar") returned 5 [0064.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.7z") returned 0 [0064.352] lstrlenA (lpString="*.7z") returned 4 [0064.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.tar") returned 0 [0064.352] lstrlenA (lpString="*.tar") returned 5 [0064.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.gzip") returned 0 [0064.352] lstrlenA (lpString="*.gzip") returned 6 [0064.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.jpg") returned 0 [0064.352] lstrlenA (lpString="*.jpg") returned 5 [0064.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.jpeg") returned 0 [0064.352] lstrlenA (lpString="*.jpeg") returned 6 [0064.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.psd") returned 0 [0064.352] lstrlenA (lpString="*.psd") returned 5 [0064.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.gif") returned 0 [0064.353] lstrlenA (lpString="*.gif") returned 5 [0064.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.doc") returned 0 [0064.353] lstrlenA (lpString="*.doc") returned 5 [0064.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.docx") returned 0 [0064.353] lstrlenA (lpString="*.docx") returned 6 [0064.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.xls") returned 0 [0064.353] lstrlenA (lpString="*.xls") returned 5 [0064.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.xlsx") returned 0 [0064.353] lstrlenA (lpString="*.xlsx") returned 6 [0064.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.ppt") returned 0 [0064.353] lstrlenA (lpString="*.ppt") returned 5 [0064.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.pptx") returned 0 [0064.353] lstrlenA (lpString="*.pptx") returned 6 [0064.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.pdf") returned 0 [0064.353] lstrlenA (lpString="*.pdf") returned 5 [0064.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.mov") returned 0 [0064.353] lstrlenA (lpString="*.mov") returned 5 [0064.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.m2v") returned 0 [0064.353] lstrlenA (lpString="*.m2v") returned 5 [0064.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.3gp") returned 0 [0064.353] lstrlenA (lpString="*.3gp") returned 5 [0064.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.mpeg") returned 0 [0064.353] lstrlenA (lpString="*.mpeg") returned 6 [0064.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.mpg") returned 0 [0064.353] lstrlenA (lpString="*.mpg") returned 5 [0064.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.flv") returned 0 [0064.354] lstrlenA (lpString="*.flv") returned 5 [0064.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.avi") returned 0 [0064.354] lstrlenA (lpString="*.avi") returned 5 [0064.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.mp4") returned 0 [0064.354] lstrlenA (lpString="*.mp4") returned 5 [0064.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.wmv") returned 0 [0064.354] lstrlenA (lpString="*.wmv") returned 5 [0064.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.divx") returned 0 [0064.354] lstrlenA (lpString="*.divx") returned 6 [0064.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.mkv") returned 0 [0064.354] lstrlenA (lpString="*.mkv") returned 5 [0064.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.mp3") returned 0 [0064.354] lstrlenA (lpString="*.mp3") returned 5 [0064.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.wav") returned 0 [0064.354] lstrlenA (lpString="*.wav") returned 5 [0064.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.flac") returned 0 [0064.354] lstrlenA (lpString="*.flac") returned 6 [0064.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.ape") returned 0 [0064.354] lstrlenA (lpString="*.ape") returned 5 [0064.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.wma") returned 0 [0064.354] lstrlenA (lpString="*.wma") returned 5 [0064.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.ac3") returned 0 [0064.354] lstrlenA (lpString="*.ac3") returned 5 [0064.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", pszSpec="*.mxf") returned 0 [0064.355] lstrlenA (lpString="*.mxf") returned 5 [0064.355] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x64b3, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="validation.js", cAlternateFileName="VALIDA~1.JS")) returned 1 [0064.355] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.355] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="validation.js") returned -1 [0064.355] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="validation.js") returned -1 [0064.355] lstrcmpiA (lpString1="", lpString2="validation.js") returned -1 [0064.355] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js") returned="utilityfunctions.js" [0064.355] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.355] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.355] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.355] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.355] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="validation.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js" [0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.zip") returned 0 [0064.355] lstrlenA (lpString="*.zip") returned 5 [0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.rar") returned 0 [0064.355] lstrlenA (lpString="*.rar") returned 5 [0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.7z") returned 0 [0064.355] lstrlenA (lpString="*.7z") returned 4 [0064.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.tar") returned 0 [0064.355] lstrlenA (lpString="*.tar") returned 5 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.gzip") returned 0 [0064.356] lstrlenA (lpString="*.gzip") returned 6 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.jpg") returned 0 [0064.356] lstrlenA (lpString="*.jpg") returned 5 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.jpeg") returned 0 [0064.356] lstrlenA (lpString="*.jpeg") returned 6 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.psd") returned 0 [0064.356] lstrlenA (lpString="*.psd") returned 5 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.gif") returned 0 [0064.356] lstrlenA (lpString="*.gif") returned 5 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.doc") returned 0 [0064.356] lstrlenA (lpString="*.doc") returned 5 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.docx") returned 0 [0064.356] lstrlenA (lpString="*.docx") returned 6 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.xls") returned 0 [0064.356] lstrlenA (lpString="*.xls") returned 5 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.xlsx") returned 0 [0064.356] lstrlenA (lpString="*.xlsx") returned 6 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.ppt") returned 0 [0064.356] lstrlenA (lpString="*.ppt") returned 5 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.pptx") returned 0 [0064.356] lstrlenA (lpString="*.pptx") returned 6 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.pdf") returned 0 [0064.356] lstrlenA (lpString="*.pdf") returned 5 [0064.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.mov") returned 0 [0064.357] lstrlenA (lpString="*.mov") returned 5 [0064.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.m2v") returned 0 [0064.357] lstrlenA (lpString="*.m2v") returned 5 [0064.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.3gp") returned 0 [0064.357] lstrlenA (lpString="*.3gp") returned 5 [0064.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.mpeg") returned 0 [0064.357] lstrlenA (lpString="*.mpeg") returned 6 [0064.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.mpg") returned 0 [0064.357] lstrlenA (lpString="*.mpg") returned 5 [0064.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.flv") returned 0 [0064.357] lstrlenA (lpString="*.flv") returned 5 [0064.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.avi") returned 0 [0064.357] lstrlenA (lpString="*.avi") returned 5 [0064.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.mp4") returned 0 [0064.357] lstrlenA (lpString="*.mp4") returned 5 [0064.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.wmv") returned 0 [0064.357] lstrlenA (lpString="*.wmv") returned 5 [0064.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.divx") returned 0 [0064.357] lstrlenA (lpString="*.divx") returned 6 [0064.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.mkv") returned 0 [0064.357] lstrlenA (lpString="*.mkv") returned 5 [0064.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.mp3") returned 0 [0064.357] lstrlenA (lpString="*.mp3") returned 5 [0064.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.wav") returned 0 [0064.357] lstrlenA (lpString="*.wav") returned 5 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.flac") returned 0 [0064.358] lstrlenA (lpString="*.flac") returned 6 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.ape") returned 0 [0064.358] lstrlenA (lpString="*.ape") returned 5 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.wma") returned 0 [0064.358] lstrlenA (lpString="*.wma") returned 5 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.ac3") returned 0 [0064.358] lstrlenA (lpString="*.ac3") returned 5 [0064.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", pszSpec="*.mxf") returned 0 [0064.358] lstrlenA (lpString="*.mxf") returned 5 [0064.358] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="VIEW.ICO", cAlternateFileName="")) returned 1 [0064.358] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.358] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VIEW.ICO") returned -1 [0064.358] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VIEW.ICO") returned -1 [0064.358] lstrcmpiA (lpString1="", lpString2="VIEW.ICO") returned -1 [0064.358] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js") returned="validation.js" [0064.358] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.358] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.358] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.358] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.358] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="VIEW.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO" [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.zip") returned 0 [0064.359] lstrlenA (lpString="*.zip") returned 5 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.rar") returned 0 [0064.359] lstrlenA (lpString="*.rar") returned 5 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.7z") returned 0 [0064.359] lstrlenA (lpString="*.7z") returned 4 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.tar") returned 0 [0064.359] lstrlenA (lpString="*.tar") returned 5 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.gzip") returned 0 [0064.359] lstrlenA (lpString="*.gzip") returned 6 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.jpg") returned 0 [0064.359] lstrlenA (lpString="*.jpg") returned 5 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.jpeg") returned 0 [0064.359] lstrlenA (lpString="*.jpeg") returned 6 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.psd") returned 0 [0064.359] lstrlenA (lpString="*.psd") returned 5 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.gif") returned 0 [0064.359] lstrlenA (lpString="*.gif") returned 5 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.doc") returned 0 [0064.359] lstrlenA (lpString="*.doc") returned 5 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.docx") returned 0 [0064.359] lstrlenA (lpString="*.docx") returned 6 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.xls") returned 0 [0064.359] lstrlenA (lpString="*.xls") returned 5 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.xlsx") returned 0 [0064.359] lstrlenA (lpString="*.xlsx") returned 6 [0064.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.ppt") returned 0 [0064.360] lstrlenA (lpString="*.ppt") returned 5 [0064.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.pptx") returned 0 [0064.360] lstrlenA (lpString="*.pptx") returned 6 [0064.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.pdf") returned 0 [0064.360] lstrlenA (lpString="*.pdf") returned 5 [0064.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.mov") returned 0 [0064.360] lstrlenA (lpString="*.mov") returned 5 [0064.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.m2v") returned 0 [0064.360] lstrlenA (lpString="*.m2v") returned 5 [0064.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.3gp") returned 0 [0064.360] lstrlenA (lpString="*.3gp") returned 5 [0064.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.mpeg") returned 0 [0064.360] lstrlenA (lpString="*.mpeg") returned 6 [0064.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.mpg") returned 0 [0064.360] lstrlenA (lpString="*.mpg") returned 5 [0064.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.flv") returned 0 [0064.360] lstrlenA (lpString="*.flv") returned 5 [0064.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.avi") returned 0 [0064.360] lstrlenA (lpString="*.avi") returned 5 [0064.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.mp4") returned 0 [0064.361] lstrlenA (lpString="*.mp4") returned 5 [0064.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.wmv") returned 0 [0064.361] lstrlenA (lpString="*.wmv") returned 5 [0064.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.divx") returned 0 [0064.361] lstrlenA (lpString="*.divx") returned 6 [0064.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.mkv") returned 0 [0064.361] lstrlenA (lpString="*.mkv") returned 5 [0064.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.mp3") returned 0 [0064.361] lstrlenA (lpString="*.mp3") returned 5 [0064.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.wav") returned 0 [0064.361] lstrlenA (lpString="*.wav") returned 5 [0064.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.flac") returned 0 [0064.361] lstrlenA (lpString="*.flac") returned 6 [0064.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.ape") returned 0 [0064.361] lstrlenA (lpString="*.ape") returned 5 [0064.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.wma") returned 0 [0064.361] lstrlenA (lpString="*.wma") returned 5 [0064.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.ac3") returned 0 [0064.361] lstrlenA (lpString="*.ac3") returned 5 [0064.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", pszSpec="*.mxf") returned 0 [0064.361] lstrlenA (lpString="*.mxf") returned 5 [0064.361] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2095, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="VIEW.JS", cAlternateFileName="")) returned 1 [0064.361] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.361] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VIEW.JS") returned -1 [0064.361] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VIEW.JS") returned -1 [0064.361] lstrcmpiA (lpString1="", lpString2="VIEW.JS") returned -1 [0064.361] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO") returned="VIEW.ICO" [0064.362] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.362] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.362] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.362] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.362] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="VIEW.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS" [0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.zip") returned 0 [0064.362] lstrlenA (lpString="*.zip") returned 5 [0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.rar") returned 0 [0064.362] lstrlenA (lpString="*.rar") returned 5 [0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.7z") returned 0 [0064.362] lstrlenA (lpString="*.7z") returned 4 [0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.tar") returned 0 [0064.362] lstrlenA (lpString="*.tar") returned 5 [0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.gzip") returned 0 [0064.362] lstrlenA (lpString="*.gzip") returned 6 [0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.jpg") returned 0 [0064.362] lstrlenA (lpString="*.jpg") returned 5 [0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.jpeg") returned 0 [0064.362] lstrlenA (lpString="*.jpeg") returned 6 [0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.psd") returned 0 [0064.362] lstrlenA (lpString="*.psd") returned 5 [0064.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.gif") returned 0 [0064.363] lstrlenA (lpString="*.gif") returned 5 [0064.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.doc") returned 0 [0064.363] lstrlenA (lpString="*.doc") returned 5 [0064.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.docx") returned 0 [0064.363] lstrlenA (lpString="*.docx") returned 6 [0064.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.xls") returned 0 [0064.363] lstrlenA (lpString="*.xls") returned 5 [0064.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.xlsx") returned 0 [0064.363] lstrlenA (lpString="*.xlsx") returned 6 [0064.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.ppt") returned 0 [0064.363] lstrlenA (lpString="*.ppt") returned 5 [0064.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.pptx") returned 0 [0064.363] lstrlenA (lpString="*.pptx") returned 6 [0064.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.pdf") returned 0 [0064.363] lstrlenA (lpString="*.pdf") returned 5 [0064.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.mov") returned 0 [0064.363] lstrlenA (lpString="*.mov") returned 5 [0064.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.m2v") returned 0 [0064.363] lstrlenA (lpString="*.m2v") returned 5 [0064.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.3gp") returned 0 [0064.363] lstrlenA (lpString="*.3gp") returned 5 [0064.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.mpeg") returned 0 [0064.363] lstrlenA (lpString="*.mpeg") returned 6 [0064.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.mpg") returned 0 [0064.363] lstrlenA (lpString="*.mpg") returned 5 [0064.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.flv") returned 0 [0064.363] lstrlenA (lpString="*.flv") returned 5 [0064.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.avi") returned 0 [0064.364] lstrlenA (lpString="*.avi") returned 5 [0064.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.mp4") returned 0 [0064.364] lstrlenA (lpString="*.mp4") returned 5 [0064.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.wmv") returned 0 [0064.364] lstrlenA (lpString="*.wmv") returned 5 [0064.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.divx") returned 0 [0064.364] lstrlenA (lpString="*.divx") returned 6 [0064.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.mkv") returned 0 [0064.364] lstrlenA (lpString="*.mkv") returned 5 [0064.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.mp3") returned 0 [0064.364] lstrlenA (lpString="*.mp3") returned 5 [0064.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.wav") returned 0 [0064.364] lstrlenA (lpString="*.wav") returned 5 [0064.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.flac") returned 0 [0064.364] lstrlenA (lpString="*.flac") returned 6 [0064.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.ape") returned 0 [0064.364] lstrlenA (lpString="*.ape") returned 5 [0064.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.wma") returned 0 [0064.364] lstrlenA (lpString="*.wma") returned 5 [0064.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.ac3") returned 0 [0064.364] lstrlenA (lpString="*.ac3") returned 5 [0064.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", pszSpec="*.mxf") returned 0 [0064.364] lstrlenA (lpString="*.mxf") returned 5 [0064.364] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd78, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="ViewHeaderPreview.jpg", cAlternateFileName="VIEWHE~1.JPG")) returned 1 [0064.364] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.365] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ViewHeaderPreview.jpg") returned -1 [0064.365] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ViewHeaderPreview.jpg") returned -1 [0064.365] lstrcmpiA (lpString1="", lpString2="ViewHeaderPreview.jpg") returned -1 [0064.365] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS") returned="VIEW.JS" [0064.365] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" [0064.365] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned="" [0064.365] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" [0064.365] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\how to decrypt files.txt")) returned 0x20 [0064.365] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" [0064.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", pszSpec="*.zip") returned 0 [0064.365] lstrlenA (lpString="*.zip") returned 5 [0064.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", pszSpec="*.rar") returned 0 [0064.365] lstrlenA (lpString="*.rar") returned 5 [0064.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", pszSpec="*.7z") returned 0 [0064.365] lstrlenA (lpString="*.7z") returned 4 [0064.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", pszSpec="*.tar") returned 0 [0064.365] lstrlenA (lpString="*.tar") returned 5 [0064.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", pszSpec="*.gzip") returned 0 [0064.365] lstrlenA (lpString="*.gzip") returned 6 [0064.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", pszSpec="*.jpg") returned 1 [0064.365] lstrlenA (lpString="*.jpg") returned 5 [0064.365] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" [0064.365] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" [0064.366] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg." [0064.366] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg.wannacry" [0064.366] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.367] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd78 [0064.367] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x706f8370, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea)) returned 1 [0064.367] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.367] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xcfa, lpOverlapped=0x0) returned 1 [0064.369] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg") returned="ViewHeaderPreview.jpg" [0064.369] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.369] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xcfa, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xcfa, lpOverlapped=0x0) returned 1 [0064.369] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.369] CloseHandle (hObject=0x98) returned 1 [0064.369] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg.wannacry")) returned 1 [0064.371] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd78, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="ViewHeaderPreview.jpg", cAlternateFileName="VIEWHE~1.JPG")) returned 0 [0064.371] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0064.371] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70685f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d8190, dwReserved1=0x3, cFileName="GrooveForms5", cAlternateFileName="GROOVE~2")) returned 1 [0064.371] lstrcmpA (lpString1=".", lpString2="GrooveForms5") returned -1 [0064.371] lstrcmpA (lpString1="..", lpString2="GrooveForms5") returned -1 [0064.371] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*" [0064.371] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="GrooveForms5" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5" [0064.371] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5") returned 82 [0064.371] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70685f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0064.387] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.387] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70685f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0064.394] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.394] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.394] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ADD.GIF", cAlternateFileName="")) returned 1 [0064.394] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.394] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ADD.GIF") returned 1 [0064.394] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADD.GIF") returned 1 [0064.394] lstrcmpiA (lpString1="", lpString2="ADD.GIF") returned -1 [0064.394] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\*.*") returned="*.*" [0064.394] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.395] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.395] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.395] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0xffffffff [0064.395] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.396] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0064.396] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0064.398] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.398] CloseHandle (hObject=0x98) returned 1 [0064.398] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="ADD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF" [0064.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.zip") returned 0 [0064.398] lstrlenA (lpString="*.zip") returned 5 [0064.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.rar") returned 0 [0064.398] lstrlenA (lpString="*.rar") returned 5 [0064.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.7z") returned 0 [0064.398] lstrlenA (lpString="*.7z") returned 4 [0064.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.tar") returned 0 [0064.398] lstrlenA (lpString="*.tar") returned 5 [0064.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.gzip") returned 0 [0064.398] lstrlenA (lpString="*.gzip") returned 6 [0064.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.jpg") returned 0 [0064.398] lstrlenA (lpString="*.jpg") returned 5 [0064.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.jpeg") returned 0 [0064.398] lstrlenA (lpString="*.jpeg") returned 6 [0064.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.psd") returned 0 [0064.398] lstrlenA (lpString="*.psd") returned 5 [0064.398] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.gif") returned 1 [0064.399] lstrlenA (lpString="*.gif") returned 5 [0064.399] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF" [0064.399] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF" [0064.399] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF." [0064.399] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF.wannacry" [0064.399] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\add.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.400] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x244 [0064.400] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5127f1f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea)) returned 1 [0064.400] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.400] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1c6, lpOverlapped=0x0) returned 1 [0064.401] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF") returned="ADD.GIF" [0064.401] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.401] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1c6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1c6, lpOverlapped=0x0) returned 1 [0064.401] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.401] CloseHandle (hObject=0x98) returned 1 [0064.401] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\add.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\add.gif.wannacry")) returned 1 [0064.403] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xae8, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="attention.gif", cAlternateFileName="ATTENT~1.GIF")) returned 1 [0064.403] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.403] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="attention.gif") returned 1 [0064.404] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="attention.gif") returned 1 [0064.404] lstrcmpiA (lpString1="", lpString2="attention.gif") returned -1 [0064.404] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF") returned="ADD.GIF" [0064.404] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.404] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.404] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.404] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.405] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" [0064.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.zip") returned 0 [0064.405] lstrlenA (lpString="*.zip") returned 5 [0064.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.rar") returned 0 [0064.405] lstrlenA (lpString="*.rar") returned 5 [0064.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.7z") returned 0 [0064.405] lstrlenA (lpString="*.7z") returned 4 [0064.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.tar") returned 0 [0064.405] lstrlenA (lpString="*.tar") returned 5 [0064.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.gzip") returned 0 [0064.405] lstrlenA (lpString="*.gzip") returned 6 [0064.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.jpg") returned 0 [0064.405] lstrlenA (lpString="*.jpg") returned 5 [0064.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.jpeg") returned 0 [0064.405] lstrlenA (lpString="*.jpeg") returned 6 [0064.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.psd") returned 0 [0064.405] lstrlenA (lpString="*.psd") returned 5 [0064.405] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.gif") returned 1 [0064.405] lstrlenA (lpString="*.gif") returned 5 [0064.405] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" [0064.405] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" [0064.405] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif." [0064.405] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif.wannacry" [0064.405] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.406] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae8 [0064.406] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51767f50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea)) returned 1 [0064.406] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.407] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xa6a, lpOverlapped=0x0) returned 1 [0064.433] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif") returned="attention.gif" [0064.434] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.434] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xa6a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xa6a, lpOverlapped=0x0) returned 1 [0064.434] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.434] CloseHandle (hObject=0x98) returned 1 [0064.434] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif.wannacry")) returned 1 [0064.438] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa769da00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa769da00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="CALENDAR.GIF", cAlternateFileName="")) returned 1 [0064.438] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.438] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CALENDAR.GIF") returned 1 [0064.438] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CALENDAR.GIF") returned 1 [0064.438] lstrcmpiA (lpString1="", lpString2="CALENDAR.GIF") returned -1 [0064.438] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif") returned="attention.gif" [0064.439] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.439] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.439] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.439] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.439] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="CALENDAR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF" [0064.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.zip") returned 0 [0064.439] lstrlenA (lpString="*.zip") returned 5 [0064.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.rar") returned 0 [0064.439] lstrlenA (lpString="*.rar") returned 5 [0064.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.7z") returned 0 [0064.439] lstrlenA (lpString="*.7z") returned 4 [0064.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.tar") returned 0 [0064.439] lstrlenA (lpString="*.tar") returned 5 [0064.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.gzip") returned 0 [0064.439] lstrlenA (lpString="*.gzip") returned 6 [0064.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.jpg") returned 0 [0064.439] lstrlenA (lpString="*.jpg") returned 5 [0064.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.jpeg") returned 0 [0064.439] lstrlenA (lpString="*.jpeg") returned 6 [0064.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.psd") returned 0 [0064.439] lstrlenA (lpString="*.psd") returned 5 [0064.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.gif") returned 1 [0064.439] lstrlenA (lpString="*.gif") returned 5 [0064.439] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF" [0064.440] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF" [0064.440] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF." [0064.440] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF.wannacry" [0064.440] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\calendar.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.441] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x383 [0064.441] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa769da00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60120f70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa769da00, dwHighDateTime=0x1c747ea)) returned 1 [0064.442] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.442] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x305, lpOverlapped=0x0) returned 1 [0064.458] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF") returned="CALENDAR.GIF" [0064.458] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.458] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x305, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x305, lpOverlapped=0x0) returned 1 [0064.458] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.458] CloseHandle (hObject=0x98) returned 1 [0064.459] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\calendar.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\calendar.gif.wannacry")) returned 1 [0064.460] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa769da00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa769da00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="DELETE.GIF", cAlternateFileName="")) returned 1 [0064.460] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.460] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DELETE.GIF") returned 1 [0064.460] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DELETE.GIF") returned 1 [0064.460] lstrcmpiA (lpString1="", lpString2="DELETE.GIF") returned -1 [0064.460] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF") returned="CALENDAR.GIF" [0064.460] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.460] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.460] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.460] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.460] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="DELETE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF" [0064.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.zip") returned 0 [0064.460] lstrlenA (lpString="*.zip") returned 5 [0064.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.rar") returned 0 [0064.461] lstrlenA (lpString="*.rar") returned 5 [0064.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.7z") returned 0 [0064.461] lstrlenA (lpString="*.7z") returned 4 [0064.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.tar") returned 0 [0064.461] lstrlenA (lpString="*.tar") returned 5 [0064.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.gzip") returned 0 [0064.461] lstrlenA (lpString="*.gzip") returned 6 [0064.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.jpg") returned 0 [0064.461] lstrlenA (lpString="*.jpg") returned 5 [0064.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.jpeg") returned 0 [0064.461] lstrlenA (lpString="*.jpeg") returned 6 [0064.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.psd") returned 0 [0064.461] lstrlenA (lpString="*.psd") returned 5 [0064.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.gif") returned 1 [0064.461] lstrlenA (lpString="*.gif") returned 5 [0064.461] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF" [0064.461] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF" [0064.461] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF." [0064.461] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF.wannacry" [0064.461] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\delete.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.470] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x271 [0064.470] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa769da00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51da7910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa769da00, dwHighDateTime=0x1c747ea)) returned 1 [0064.470] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.470] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1f3, lpOverlapped=0x0) returned 1 [0064.473] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF") returned="DELETE.GIF" [0064.473] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.473] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1f3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1f3, lpOverlapped=0x0) returned 1 [0064.474] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.474] CloseHandle (hObject=0x98) returned 1 [0064.474] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\delete.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\delete.gif.wannacry")) returned 1 [0064.484] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x369, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="ERROR.GIF", cAlternateFileName="")) returned 1 [0064.484] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.484] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ERROR.GIF") returned -1 [0064.487] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ERROR.GIF") returned 1 [0064.487] lstrcmpiA (lpString1="", lpString2="ERROR.GIF") returned -1 [0064.487] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF") returned="DELETE.GIF" [0064.487] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.487] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.487] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.488] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.488] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="ERROR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF" [0064.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.zip") returned 0 [0064.488] lstrlenA (lpString="*.zip") returned 5 [0064.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.rar") returned 0 [0064.491] lstrlenA (lpString="*.rar") returned 5 [0064.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.7z") returned 0 [0064.491] lstrlenA (lpString="*.7z") returned 4 [0064.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.tar") returned 0 [0064.491] lstrlenA (lpString="*.tar") returned 5 [0064.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.gzip") returned 0 [0064.491] lstrlenA (lpString="*.gzip") returned 6 [0064.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.jpg") returned 0 [0064.492] lstrlenA (lpString="*.jpg") returned 5 [0064.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.jpeg") returned 0 [0064.492] lstrlenA (lpString="*.jpeg") returned 6 [0064.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.psd") returned 0 [0064.492] lstrlenA (lpString="*.psd") returned 5 [0064.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.gif") returned 1 [0064.492] lstrlenA (lpString="*.gif") returned 5 [0064.492] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF" [0064.492] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF" [0064.492] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF." [0064.494] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF.wannacry" [0064.494] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\error.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.498] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x369 [0064.498] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6099bdd0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea)) returned 1 [0064.498] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.498] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2eb, lpOverlapped=0x0) returned 1 [0064.505] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF") returned="ERROR.GIF" [0064.506] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.506] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2eb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2eb, lpOverlapped=0x0) returned 1 [0064.507] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.507] CloseHandle (hObject=0x98) returned 1 [0064.507] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\error.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\error.gif.wannacry")) returned 1 [0064.509] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77e3c400, ftCreationTime.dwHighDateTime=0x1ca5dc0, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77e3c400, ftLastWriteTime.dwHighDateTime=0x1ca5dc0, nFileSizeHigh=0x0, nFileSizeLow=0x14484, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="FORM.JS", cAlternateFileName="")) returned 1 [0064.509] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.509] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FORM.JS") returned -1 [0064.509] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FORM.JS") returned 1 [0064.509] lstrcmpiA (lpString1="", lpString2="FORM.JS") returned -1 [0064.509] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF") returned="ERROR.GIF" [0064.509] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.509] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.509] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.509] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.509] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FORM.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS" [0064.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.zip") returned 0 [0064.509] lstrlenA (lpString="*.zip") returned 5 [0064.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.rar") returned 0 [0064.509] lstrlenA (lpString="*.rar") returned 5 [0064.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.7z") returned 0 [0064.509] lstrlenA (lpString="*.7z") returned 4 [0064.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.tar") returned 0 [0064.510] lstrlenA (lpString="*.tar") returned 5 [0064.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.gzip") returned 0 [0064.510] lstrlenA (lpString="*.gzip") returned 6 [0064.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.jpg") returned 0 [0064.510] lstrlenA (lpString="*.jpg") returned 5 [0064.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.jpeg") returned 0 [0064.510] lstrlenA (lpString="*.jpeg") returned 6 [0064.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.psd") returned 0 [0064.510] lstrlenA (lpString="*.psd") returned 5 [0064.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.gif") returned 0 [0064.510] lstrlenA (lpString="*.gif") returned 5 [0064.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.doc") returned 0 [0064.510] lstrlenA (lpString="*.doc") returned 5 [0064.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.docx") returned 0 [0064.510] lstrlenA (lpString="*.docx") returned 6 [0064.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.xls") returned 0 [0064.510] lstrlenA (lpString="*.xls") returned 5 [0064.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.xlsx") returned 0 [0064.510] lstrlenA (lpString="*.xlsx") returned 6 [0064.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.ppt") returned 0 [0064.510] lstrlenA (lpString="*.ppt") returned 5 [0064.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.pptx") returned 0 [0064.510] lstrlenA (lpString="*.pptx") returned 6 [0064.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.pdf") returned 0 [0064.511] lstrlenA (lpString="*.pdf") returned 5 [0064.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.mov") returned 0 [0064.511] lstrlenA (lpString="*.mov") returned 5 [0064.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.m2v") returned 0 [0064.511] lstrlenA (lpString="*.m2v") returned 5 [0064.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.3gp") returned 0 [0064.511] lstrlenA (lpString="*.3gp") returned 5 [0064.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.mpeg") returned 0 [0064.511] lstrlenA (lpString="*.mpeg") returned 6 [0064.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.mpg") returned 0 [0064.511] lstrlenA (lpString="*.mpg") returned 5 [0064.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.flv") returned 0 [0064.511] lstrlenA (lpString="*.flv") returned 5 [0064.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.avi") returned 0 [0064.511] lstrlenA (lpString="*.avi") returned 5 [0064.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.mp4") returned 0 [0064.511] lstrlenA (lpString="*.mp4") returned 5 [0064.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.wmv") returned 0 [0064.511] lstrlenA (lpString="*.wmv") returned 5 [0064.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.divx") returned 0 [0064.511] lstrlenA (lpString="*.divx") returned 6 [0064.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.mkv") returned 0 [0064.511] lstrlenA (lpString="*.mkv") returned 5 [0064.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.mp3") returned 0 [0064.511] lstrlenA (lpString="*.mp3") returned 5 [0064.511] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.wav") returned 0 [0064.512] lstrlenA (lpString="*.wav") returned 5 [0064.512] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.flac") returned 0 [0064.512] lstrlenA (lpString="*.flac") returned 6 [0064.512] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.ape") returned 0 [0064.512] lstrlenA (lpString="*.ape") returned 5 [0064.512] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.wma") returned 0 [0064.512] lstrlenA (lpString="*.wma") returned 5 [0064.512] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.ac3") returned 0 [0064.512] lstrlenA (lpString="*.ac3") returned 5 [0064.512] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.mxf") returned 0 [0064.512] lstrlenA (lpString="*.mxf") returned 5 [0064.512] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x43a, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsBlankPage.html", cAlternateFileName="FORMSB~1.HTM")) returned 1 [0064.512] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.512] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsBlankPage.html") returned -1 [0064.512] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsBlankPage.html") returned 1 [0064.512] lstrcmpiA (lpString1="", lpString2="FormsBlankPage.html") returned -1 [0064.512] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS") returned="FORM.JS" [0064.512] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.512] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.512] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.512] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.513] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" [0064.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.zip") returned 0 [0064.513] lstrlenA (lpString="*.zip") returned 5 [0064.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.rar") returned 0 [0064.513] lstrlenA (lpString="*.rar") returned 5 [0064.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.7z") returned 0 [0064.513] lstrlenA (lpString="*.7z") returned 4 [0064.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.tar") returned 0 [0064.513] lstrlenA (lpString="*.tar") returned 5 [0064.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.gzip") returned 0 [0064.513] lstrlenA (lpString="*.gzip") returned 6 [0064.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.jpg") returned 0 [0064.513] lstrlenA (lpString="*.jpg") returned 5 [0064.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.jpeg") returned 0 [0064.513] lstrlenA (lpString="*.jpeg") returned 6 [0064.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.psd") returned 0 [0064.513] lstrlenA (lpString="*.psd") returned 5 [0064.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.gif") returned 0 [0064.513] lstrlenA (lpString="*.gif") returned 5 [0064.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.doc") returned 0 [0064.513] lstrlenA (lpString="*.doc") returned 5 [0064.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.docx") returned 0 [0064.513] lstrlenA (lpString="*.docx") returned 6 [0064.513] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.xls") returned 0 [0064.514] lstrlenA (lpString="*.xls") returned 5 [0064.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.xlsx") returned 0 [0064.514] lstrlenA (lpString="*.xlsx") returned 6 [0064.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.ppt") returned 0 [0064.514] lstrlenA (lpString="*.ppt") returned 5 [0064.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.pptx") returned 0 [0064.514] lstrlenA (lpString="*.pptx") returned 6 [0064.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.pdf") returned 0 [0064.514] lstrlenA (lpString="*.pdf") returned 5 [0064.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.mov") returned 0 [0064.514] lstrlenA (lpString="*.mov") returned 5 [0064.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.m2v") returned 0 [0064.514] lstrlenA (lpString="*.m2v") returned 5 [0064.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.3gp") returned 0 [0064.514] lstrlenA (lpString="*.3gp") returned 5 [0064.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.mpeg") returned 0 [0064.514] lstrlenA (lpString="*.mpeg") returned 6 [0064.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.mpg") returned 0 [0064.514] lstrlenA (lpString="*.mpg") returned 5 [0064.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.flv") returned 0 [0064.514] lstrlenA (lpString="*.flv") returned 5 [0064.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.avi") returned 0 [0064.514] lstrlenA (lpString="*.avi") returned 5 [0064.514] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.mp4") returned 0 [0064.514] lstrlenA (lpString="*.mp4") returned 5 [0064.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.wmv") returned 0 [0064.515] lstrlenA (lpString="*.wmv") returned 5 [0064.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.divx") returned 0 [0064.515] lstrlenA (lpString="*.divx") returned 6 [0064.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.mkv") returned 0 [0064.515] lstrlenA (lpString="*.mkv") returned 5 [0064.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.mp3") returned 0 [0064.515] lstrlenA (lpString="*.mp3") returned 5 [0064.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.wav") returned 0 [0064.515] lstrlenA (lpString="*.wav") returned 5 [0064.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.flac") returned 0 [0064.515] lstrlenA (lpString="*.flac") returned 6 [0064.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.ape") returned 0 [0064.515] lstrlenA (lpString="*.ape") returned 5 [0064.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.wma") returned 0 [0064.515] lstrlenA (lpString="*.wma") returned 5 [0064.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.ac3") returned 0 [0064.515] lstrlenA (lpString="*.ac3") returned 5 [0064.515] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.mxf") returned 0 [0064.515] lstrlenA (lpString="*.mxf") returned 5 [0064.515] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x829, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsBrowserUpgrade.html", cAlternateFileName="FORMSB~2.HTM")) returned 1 [0064.515] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.515] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsBrowserUpgrade.html") returned -1 [0064.515] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsBrowserUpgrade.html") returned 1 [0064.515] lstrcmpiA (lpString1="", lpString2="FormsBrowserUpgrade.html") returned -1 [0064.515] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html") returned="FormsBlankPage.html" [0064.516] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.516] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.516] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.516] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.516] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" [0064.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.zip") returned 0 [0064.516] lstrlenA (lpString="*.zip") returned 5 [0064.516] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.rar") returned 0 [0064.518] lstrlenA (lpString="*.rar") returned 5 [0064.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.7z") returned 0 [0064.518] lstrlenA (lpString="*.7z") returned 4 [0064.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.tar") returned 0 [0064.518] lstrlenA (lpString="*.tar") returned 5 [0064.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.gzip") returned 0 [0064.518] lstrlenA (lpString="*.gzip") returned 6 [0064.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.jpg") returned 0 [0064.518] lstrlenA (lpString="*.jpg") returned 5 [0064.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.jpeg") returned 0 [0064.518] lstrlenA (lpString="*.jpeg") returned 6 [0064.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.psd") returned 0 [0064.518] lstrlenA (lpString="*.psd") returned 5 [0064.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.gif") returned 0 [0064.518] lstrlenA (lpString="*.gif") returned 5 [0064.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.doc") returned 0 [0064.518] lstrlenA (lpString="*.doc") returned 5 [0064.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.docx") returned 0 [0064.518] lstrlenA (lpString="*.docx") returned 6 [0064.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.xls") returned 0 [0064.518] lstrlenA (lpString="*.xls") returned 5 [0064.518] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.xlsx") returned 0 [0064.518] lstrlenA (lpString="*.xlsx") returned 6 [0064.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.ppt") returned 0 [0064.519] lstrlenA (lpString="*.ppt") returned 5 [0064.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.pptx") returned 0 [0064.519] lstrlenA (lpString="*.pptx") returned 6 [0064.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.pdf") returned 0 [0064.519] lstrlenA (lpString="*.pdf") returned 5 [0064.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.mov") returned 0 [0064.519] lstrlenA (lpString="*.mov") returned 5 [0064.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.m2v") returned 0 [0064.519] lstrlenA (lpString="*.m2v") returned 5 [0064.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.3gp") returned 0 [0064.519] lstrlenA (lpString="*.3gp") returned 5 [0064.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.mpeg") returned 0 [0064.519] lstrlenA (lpString="*.mpeg") returned 6 [0064.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.mpg") returned 0 [0064.519] lstrlenA (lpString="*.mpg") returned 5 [0064.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.flv") returned 0 [0064.519] lstrlenA (lpString="*.flv") returned 5 [0064.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.avi") returned 0 [0064.519] lstrlenA (lpString="*.avi") returned 5 [0064.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.mp4") returned 0 [0064.519] lstrlenA (lpString="*.mp4") returned 5 [0064.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.wmv") returned 0 [0064.519] lstrlenA (lpString="*.wmv") returned 5 [0064.519] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.divx") returned 0 [0064.519] lstrlenA (lpString="*.divx") returned 6 [0064.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.mkv") returned 0 [0064.520] lstrlenA (lpString="*.mkv") returned 5 [0064.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.mp3") returned 0 [0064.520] lstrlenA (lpString="*.mp3") returned 5 [0064.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.wav") returned 0 [0064.520] lstrlenA (lpString="*.wav") returned 5 [0064.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.flac") returned 0 [0064.520] lstrlenA (lpString="*.flac") returned 6 [0064.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.ape") returned 0 [0064.520] lstrlenA (lpString="*.ape") returned 5 [0064.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.wma") returned 0 [0064.520] lstrlenA (lpString="*.wma") returned 5 [0064.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.ac3") returned 0 [0064.520] lstrlenA (lpString="*.ac3") returned 5 [0064.520] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.mxf") returned 0 [0064.520] lstrlenA (lpString="*.mxf") returned 5 [0064.520] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2ef, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsColorChart.html", cAlternateFileName="FORMSC~1.HTM")) returned 1 [0064.520] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.520] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsColorChart.html") returned -1 [0064.520] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsColorChart.html") returned 1 [0064.520] lstrcmpiA (lpString1="", lpString2="FormsColorChart.html") returned -1 [0064.520] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html") returned="FormsBrowserUpgrade.html" [0064.520] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.520] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.520] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.521] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.521] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsColorChart.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" [0064.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.zip") returned 0 [0064.521] lstrlenA (lpString="*.zip") returned 5 [0064.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.rar") returned 0 [0064.521] lstrlenA (lpString="*.rar") returned 5 [0064.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.7z") returned 0 [0064.521] lstrlenA (lpString="*.7z") returned 4 [0064.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.tar") returned 0 [0064.521] lstrlenA (lpString="*.tar") returned 5 [0064.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.gzip") returned 0 [0064.521] lstrlenA (lpString="*.gzip") returned 6 [0064.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.jpg") returned 0 [0064.521] lstrlenA (lpString="*.jpg") returned 5 [0064.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.jpeg") returned 0 [0064.521] lstrlenA (lpString="*.jpeg") returned 6 [0064.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.psd") returned 0 [0064.521] lstrlenA (lpString="*.psd") returned 5 [0064.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.gif") returned 0 [0064.521] lstrlenA (lpString="*.gif") returned 5 [0064.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.doc") returned 0 [0064.521] lstrlenA (lpString="*.doc") returned 5 [0064.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.docx") returned 0 [0064.522] lstrlenA (lpString="*.docx") returned 6 [0064.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.xls") returned 0 [0064.522] lstrlenA (lpString="*.xls") returned 5 [0064.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.xlsx") returned 0 [0064.522] lstrlenA (lpString="*.xlsx") returned 6 [0064.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.ppt") returned 0 [0064.522] lstrlenA (lpString="*.ppt") returned 5 [0064.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.pptx") returned 0 [0064.522] lstrlenA (lpString="*.pptx") returned 6 [0064.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.pdf") returned 0 [0064.522] lstrlenA (lpString="*.pdf") returned 5 [0064.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.mov") returned 0 [0064.522] lstrlenA (lpString="*.mov") returned 5 [0064.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.m2v") returned 0 [0064.522] lstrlenA (lpString="*.m2v") returned 5 [0064.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.3gp") returned 0 [0064.522] lstrlenA (lpString="*.3gp") returned 5 [0064.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.mpeg") returned 0 [0064.522] lstrlenA (lpString="*.mpeg") returned 6 [0064.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.mpg") returned 0 [0064.522] lstrlenA (lpString="*.mpg") returned 5 [0064.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.flv") returned 0 [0064.522] lstrlenA (lpString="*.flv") returned 5 [0064.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.avi") returned 0 [0064.523] lstrlenA (lpString="*.avi") returned 5 [0064.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.mp4") returned 0 [0064.523] lstrlenA (lpString="*.mp4") returned 5 [0064.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.wmv") returned 0 [0064.523] lstrlenA (lpString="*.wmv") returned 5 [0064.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.divx") returned 0 [0064.523] lstrlenA (lpString="*.divx") returned 6 [0064.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.mkv") returned 0 [0064.523] lstrlenA (lpString="*.mkv") returned 5 [0064.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.mp3") returned 0 [0064.523] lstrlenA (lpString="*.mp3") returned 5 [0064.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.wav") returned 0 [0064.523] lstrlenA (lpString="*.wav") returned 5 [0064.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.flac") returned 0 [0064.523] lstrlenA (lpString="*.flac") returned 6 [0064.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.ape") returned 0 [0064.523] lstrlenA (lpString="*.ape") returned 5 [0064.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.wma") returned 0 [0064.523] lstrlenA (lpString="*.wma") returned 5 [0064.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.ac3") returned 0 [0064.523] lstrlenA (lpString="*.ac3") returned 5 [0064.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.mxf") returned 0 [0064.523] lstrlenA (lpString="*.mxf") returned 5 [0064.523] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13bb, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsFormTemplate.html", cAlternateFileName="FORMSF~1.HTM")) returned 1 [0064.523] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.524] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsFormTemplate.html") returned -1 [0064.524] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsFormTemplate.html") returned 1 [0064.524] lstrcmpiA (lpString1="", lpString2="FormsFormTemplate.html") returned -1 [0064.524] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html") returned="FormsColorChart.html" [0064.524] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.524] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.524] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.524] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.524] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsFormTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" [0064.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.zip") returned 0 [0064.524] lstrlenA (lpString="*.zip") returned 5 [0064.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.rar") returned 0 [0064.524] lstrlenA (lpString="*.rar") returned 5 [0064.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.7z") returned 0 [0064.524] lstrlenA (lpString="*.7z") returned 4 [0064.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.tar") returned 0 [0064.524] lstrlenA (lpString="*.tar") returned 5 [0064.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.gzip") returned 0 [0064.524] lstrlenA (lpString="*.gzip") returned 6 [0064.524] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.jpg") returned 0 [0064.524] lstrlenA (lpString="*.jpg") returned 5 [0064.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.jpeg") returned 0 [0064.525] lstrlenA (lpString="*.jpeg") returned 6 [0064.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.psd") returned 0 [0064.525] lstrlenA (lpString="*.psd") returned 5 [0064.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.gif") returned 0 [0064.525] lstrlenA (lpString="*.gif") returned 5 [0064.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.doc") returned 0 [0064.525] lstrlenA (lpString="*.doc") returned 5 [0064.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.docx") returned 0 [0064.525] lstrlenA (lpString="*.docx") returned 6 [0064.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.xls") returned 0 [0064.525] lstrlenA (lpString="*.xls") returned 5 [0064.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.xlsx") returned 0 [0064.525] lstrlenA (lpString="*.xlsx") returned 6 [0064.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.ppt") returned 0 [0064.525] lstrlenA (lpString="*.ppt") returned 5 [0064.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.pptx") returned 0 [0064.525] lstrlenA (lpString="*.pptx") returned 6 [0064.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.pdf") returned 0 [0064.525] lstrlenA (lpString="*.pdf") returned 5 [0064.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.mov") returned 0 [0064.525] lstrlenA (lpString="*.mov") returned 5 [0064.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.m2v") returned 0 [0064.525] lstrlenA (lpString="*.m2v") returned 5 [0064.525] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.3gp") returned 0 [0064.526] lstrlenA (lpString="*.3gp") returned 5 [0064.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.mpeg") returned 0 [0064.526] lstrlenA (lpString="*.mpeg") returned 6 [0064.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.mpg") returned 0 [0064.526] lstrlenA (lpString="*.mpg") returned 5 [0064.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.flv") returned 0 [0064.526] lstrlenA (lpString="*.flv") returned 5 [0064.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.avi") returned 0 [0064.526] lstrlenA (lpString="*.avi") returned 5 [0064.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.mp4") returned 0 [0064.526] lstrlenA (lpString="*.mp4") returned 5 [0064.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.wmv") returned 0 [0064.526] lstrlenA (lpString="*.wmv") returned 5 [0064.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.divx") returned 0 [0064.526] lstrlenA (lpString="*.divx") returned 6 [0064.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.mkv") returned 0 [0064.526] lstrlenA (lpString="*.mkv") returned 5 [0064.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.mp3") returned 0 [0064.526] lstrlenA (lpString="*.mp3") returned 5 [0064.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.wav") returned 0 [0064.526] lstrlenA (lpString="*.wav") returned 5 [0064.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.flac") returned 0 [0064.526] lstrlenA (lpString="*.flac") returned 6 [0064.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.ape") returned 0 [0064.526] lstrlenA (lpString="*.ape") returned 5 [0064.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.wma") returned 0 [0064.527] lstrlenA (lpString="*.wma") returned 5 [0064.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.ac3") returned 0 [0064.527] lstrlenA (lpString="*.ac3") returned 5 [0064.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.mxf") returned 0 [0064.527] lstrlenA (lpString="*.mxf") returned 5 [0064.527] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69fe8900, ftCreationTime.dwHighDateTime=0x1c7d303, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69fe8900, ftLastWriteTime.dwHighDateTime=0x1c7d303, nFileSizeHigh=0x0, nFileSizeLow=0x13c5, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsFormTemplateRTL.html", cAlternateFileName="FORMSF~2.HTM")) returned 1 [0064.527] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.527] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsFormTemplateRTL.html") returned -1 [0064.527] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsFormTemplateRTL.html") returned 1 [0064.527] lstrcmpiA (lpString1="", lpString2="FormsFormTemplateRTL.html") returned -1 [0064.527] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html") returned="FormsFormTemplate.html" [0064.527] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.527] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.527] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.527] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.527] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsFormTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" [0064.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.zip") returned 0 [0064.527] lstrlenA (lpString="*.zip") returned 5 [0064.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.rar") returned 0 [0064.527] lstrlenA (lpString="*.rar") returned 5 [0064.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.7z") returned 0 [0064.527] lstrlenA (lpString="*.7z") returned 4 [0064.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.tar") returned 0 [0064.528] lstrlenA (lpString="*.tar") returned 5 [0064.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.gzip") returned 0 [0064.528] lstrlenA (lpString="*.gzip") returned 6 [0064.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.jpg") returned 0 [0064.528] lstrlenA (lpString="*.jpg") returned 5 [0064.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.jpeg") returned 0 [0064.528] lstrlenA (lpString="*.jpeg") returned 6 [0064.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.psd") returned 0 [0064.528] lstrlenA (lpString="*.psd") returned 5 [0064.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.gif") returned 0 [0064.528] lstrlenA (lpString="*.gif") returned 5 [0064.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.doc") returned 0 [0064.528] lstrlenA (lpString="*.doc") returned 5 [0064.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.docx") returned 0 [0064.528] lstrlenA (lpString="*.docx") returned 6 [0064.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.xls") returned 0 [0064.528] lstrlenA (lpString="*.xls") returned 5 [0064.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.xlsx") returned 0 [0064.528] lstrlenA (lpString="*.xlsx") returned 6 [0064.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.ppt") returned 0 [0064.528] lstrlenA (lpString="*.ppt") returned 5 [0064.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.pptx") returned 0 [0064.528] lstrlenA (lpString="*.pptx") returned 6 [0064.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.pdf") returned 0 [0064.528] lstrlenA (lpString="*.pdf") returned 5 [0064.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.mov") returned 0 [0064.529] lstrlenA (lpString="*.mov") returned 5 [0064.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.m2v") returned 0 [0064.529] lstrlenA (lpString="*.m2v") returned 5 [0064.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.3gp") returned 0 [0064.529] lstrlenA (lpString="*.3gp") returned 5 [0064.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.mpeg") returned 0 [0064.529] lstrlenA (lpString="*.mpeg") returned 6 [0064.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.mpg") returned 0 [0064.529] lstrlenA (lpString="*.mpg") returned 5 [0064.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.flv") returned 0 [0064.529] lstrlenA (lpString="*.flv") returned 5 [0064.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.avi") returned 0 [0064.529] lstrlenA (lpString="*.avi") returned 5 [0064.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.mp4") returned 0 [0064.529] lstrlenA (lpString="*.mp4") returned 5 [0064.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.wmv") returned 0 [0064.529] lstrlenA (lpString="*.wmv") returned 5 [0064.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.divx") returned 0 [0064.529] lstrlenA (lpString="*.divx") returned 6 [0064.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.mkv") returned 0 [0064.529] lstrlenA (lpString="*.mkv") returned 5 [0064.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.mp3") returned 0 [0064.529] lstrlenA (lpString="*.mp3") returned 5 [0064.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.wav") returned 0 [0064.529] lstrlenA (lpString="*.wav") returned 5 [0064.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.flac") returned 0 [0064.529] lstrlenA (lpString="*.flac") returned 6 [0064.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.ape") returned 0 [0064.530] lstrlenA (lpString="*.ape") returned 5 [0064.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.wma") returned 0 [0064.530] lstrlenA (lpString="*.wma") returned 5 [0064.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.ac3") returned 0 [0064.530] lstrlenA (lpString="*.ac3") returned 5 [0064.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.mxf") returned 0 [0064.530] lstrlenA (lpString="*.mxf") returned 5 [0064.530] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x8ab, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsImageTemplate.html", cAlternateFileName="FORMSI~1.HTM")) returned 1 [0064.530] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.530] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsImageTemplate.html") returned -1 [0064.530] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsImageTemplate.html") returned 1 [0064.530] lstrcmpiA (lpString1="", lpString2="FormsImageTemplate.html") returned -1 [0064.530] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html") returned="FormsFormTemplateRTL.html" [0064.530] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.530] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.530] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.530] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.530] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsImageTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" [0064.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.zip") returned 0 [0064.531] lstrlenA (lpString="*.zip") returned 5 [0064.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.rar") returned 0 [0064.531] lstrlenA (lpString="*.rar") returned 5 [0064.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.7z") returned 0 [0064.532] lstrlenA (lpString="*.7z") returned 4 [0064.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.tar") returned 0 [0064.532] lstrlenA (lpString="*.tar") returned 5 [0064.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.gzip") returned 0 [0064.533] lstrlenA (lpString="*.gzip") returned 6 [0064.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.jpg") returned 0 [0064.533] lstrlenA (lpString="*.jpg") returned 5 [0064.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.jpeg") returned 0 [0064.533] lstrlenA (lpString="*.jpeg") returned 6 [0064.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.psd") returned 0 [0064.533] lstrlenA (lpString="*.psd") returned 5 [0064.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.gif") returned 0 [0064.533] lstrlenA (lpString="*.gif") returned 5 [0064.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.doc") returned 0 [0064.533] lstrlenA (lpString="*.doc") returned 5 [0064.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.docx") returned 0 [0064.533] lstrlenA (lpString="*.docx") returned 6 [0064.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.xls") returned 0 [0064.533] lstrlenA (lpString="*.xls") returned 5 [0064.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.xlsx") returned 0 [0064.533] lstrlenA (lpString="*.xlsx") returned 6 [0064.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.ppt") returned 0 [0064.533] lstrlenA (lpString="*.ppt") returned 5 [0064.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.pptx") returned 0 [0064.533] lstrlenA (lpString="*.pptx") returned 6 [0064.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.pdf") returned 0 [0064.533] lstrlenA (lpString="*.pdf") returned 5 [0064.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.mov") returned 0 [0064.533] lstrlenA (lpString="*.mov") returned 5 [0064.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.m2v") returned 0 [0064.534] lstrlenA (lpString="*.m2v") returned 5 [0064.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.3gp") returned 0 [0064.534] lstrlenA (lpString="*.3gp") returned 5 [0064.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.mpeg") returned 0 [0064.534] lstrlenA (lpString="*.mpeg") returned 6 [0064.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.mpg") returned 0 [0064.534] lstrlenA (lpString="*.mpg") returned 5 [0064.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.flv") returned 0 [0064.534] lstrlenA (lpString="*.flv") returned 5 [0064.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.avi") returned 0 [0064.534] lstrlenA (lpString="*.avi") returned 5 [0064.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.mp4") returned 0 [0064.534] lstrlenA (lpString="*.mp4") returned 5 [0064.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.wmv") returned 0 [0064.534] lstrlenA (lpString="*.wmv") returned 5 [0064.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.divx") returned 0 [0064.534] lstrlenA (lpString="*.divx") returned 6 [0064.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.mkv") returned 0 [0064.534] lstrlenA (lpString="*.mkv") returned 5 [0064.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.mp3") returned 0 [0064.534] lstrlenA (lpString="*.mp3") returned 5 [0064.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.wav") returned 0 [0064.534] lstrlenA (lpString="*.wav") returned 5 [0064.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.flac") returned 0 [0064.534] lstrlenA (lpString="*.flac") returned 6 [0064.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.ape") returned 0 [0064.535] lstrlenA (lpString="*.ape") returned 5 [0064.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.wma") returned 0 [0064.535] lstrlenA (lpString="*.wma") returned 5 [0064.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.ac3") returned 0 [0064.535] lstrlenA (lpString="*.ac3") returned 5 [0064.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.mxf") returned 0 [0064.535] lstrlenA (lpString="*.mxf") returned 5 [0064.535] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52942450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x858, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsMacroTemplate.html", cAlternateFileName="FORMSM~1.HTM")) returned 1 [0064.535] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.535] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsMacroTemplate.html") returned -1 [0064.535] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsMacroTemplate.html") returned 1 [0064.535] lstrcmpiA (lpString1="", lpString2="FormsMacroTemplate.html") returned -1 [0064.535] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html") returned="FormsImageTemplate.html" [0064.535] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.535] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.535] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.535] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.535] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsMacroTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" [0064.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.zip") returned 0 [0064.535] lstrlenA (lpString="*.zip") returned 5 [0064.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.rar") returned 0 [0064.535] lstrlenA (lpString="*.rar") returned 5 [0064.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.7z") returned 0 [0064.536] lstrlenA (lpString="*.7z") returned 4 [0064.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.tar") returned 0 [0064.536] lstrlenA (lpString="*.tar") returned 5 [0064.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.gzip") returned 0 [0064.536] lstrlenA (lpString="*.gzip") returned 6 [0064.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.jpg") returned 0 [0064.536] lstrlenA (lpString="*.jpg") returned 5 [0064.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.jpeg") returned 0 [0064.536] lstrlenA (lpString="*.jpeg") returned 6 [0064.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.psd") returned 0 [0064.536] lstrlenA (lpString="*.psd") returned 5 [0064.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.gif") returned 0 [0064.536] lstrlenA (lpString="*.gif") returned 5 [0064.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.doc") returned 0 [0064.536] lstrlenA (lpString="*.doc") returned 5 [0064.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.docx") returned 0 [0064.536] lstrlenA (lpString="*.docx") returned 6 [0064.537] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x46ff, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsPreviewTemplate.html", cAlternateFileName="FORMSP~1.HTM")) returned 1 [0064.537] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.537] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsPreviewTemplate.html") returned -1 [0064.537] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPreviewTemplate.html") returned 1 [0064.537] lstrcmpiA (lpString1="", lpString2="FormsPreviewTemplate.html") returned -1 [0064.537] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html") returned="FormsMacroTemplate.html" [0064.537] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.537] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.537] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.537] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.537] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" [0064.537] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x797dd200, ftCreationTime.dwHighDateTime=0x1c7d303, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x797dd200, ftLastWriteTime.dwHighDateTime=0x1c7d303, nFileSizeHigh=0x0, nFileSizeLow=0x4709, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsPreviewTemplateRTL.html", cAlternateFileName="FORMSP~3.HTM")) returned 1 [0064.537] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.537] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsPreviewTemplateRTL.html") returned -1 [0064.537] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPreviewTemplateRTL.html") returned 1 [0064.537] lstrcmpiA (lpString1="", lpString2="FormsPreviewTemplateRTL.html") returned -1 [0064.537] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html") returned="FormsPreviewTemplate.html" [0064.537] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.537] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.537] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.538] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.538] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsPreviewTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" [0064.538] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5bf, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsPrintTemplate.html", cAlternateFileName="FORMSP~2.HTM")) returned 1 [0064.538] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.538] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsPrintTemplate.html") returned -1 [0064.538] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPrintTemplate.html") returned 1 [0064.538] lstrcmpiA (lpString1="", lpString2="FormsPrintTemplate.html") returned -1 [0064.538] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html") returned="FormsPreviewTemplateRTL.html" [0064.538] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.538] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.538] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.538] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.538] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" [0064.538] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2e4800, ftCreationTime.dwHighDateTime=0x1c7d303, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a2e4800, ftLastWriteTime.dwHighDateTime=0x1c7d303, nFileSizeHigh=0x0, nFileSizeLow=0x5c9, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsPrintTemplateRTL.html", cAlternateFileName="FORMSP~4.HTM")) returned 1 [0064.538] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.538] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsPrintTemplateRTL.html") returned -1 [0064.538] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPrintTemplateRTL.html") returned 1 [0064.538] lstrcmpiA (lpString1="", lpString2="FormsPrintTemplateRTL.html") returned -1 [0064.539] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html") returned="FormsPrintTemplate.html" [0064.539] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.539] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.539] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.539] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.539] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsPrintTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" [0064.539] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0f34200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0f34200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1499, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="FormsViewAttachmentIcons.jpg", cAlternateFileName="FORMSV~1.JPG")) returned 1 [0064.539] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.539] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsViewAttachmentIcons.jpg") returned -1 [0064.539] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewAttachmentIcons.jpg") returned 1 [0064.539] lstrcmpiA (lpString1="", lpString2="FormsViewAttachmentIcons.jpg") returned -1 [0064.539] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html") returned="FormsPrintTemplateRTL.html" [0064.539] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.539] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.539] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.539] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.539] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" [0064.539] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" [0064.539] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" [0064.540] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg." [0064.540] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg.wannacry" [0064.540] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.543] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1499 [0064.543] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb0f34200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5298e710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb0f34200, dwHighDateTime=0x1c747ea)) returned 1 [0064.543] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.543] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x141b, lpOverlapped=0x0) returned 1 [0064.546] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg") returned="FormsViewAttachmentIcons.jpg" [0064.546] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.546] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x141b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x141b, lpOverlapped=0x0) returned 1 [0064.546] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.546] CloseHandle (hObject=0x98) returned 1 [0064.546] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg.wannacry")) returned 1 [0064.548] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="FormsViewAttachmentIconsMask.bmp", cAlternateFileName="FORMSV~1.BMP")) returned 1 [0064.548] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.548] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FormsViewAttachmentIconsMask.bmp") returned -1 [0064.548] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewAttachmentIconsMask.bmp") returned 1 [0064.548] lstrcmpiA (lpString1="", lpString2="FormsViewAttachmentIconsMask.bmp") returned -1 [0064.548] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg") returned="FormsViewAttachmentIcons.jpg" [0064.548] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.548] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.548] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.548] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.548] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp" [0064.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.zip") returned 0 [0064.548] lstrlenA (lpString="*.zip") returned 5 [0064.548] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.rar") returned 0 [0064.549] lstrlenA (lpString="*.rar") returned 5 [0064.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.7z") returned 0 [0064.549] lstrlenA (lpString="*.7z") returned 4 [0064.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.tar") returned 0 [0064.549] lstrlenA (lpString="*.tar") returned 5 [0064.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.gzip") returned 0 [0064.549] lstrlenA (lpString="*.gzip") returned 6 [0064.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.jpg") returned 0 [0064.549] lstrlenA (lpString="*.jpg") returned 5 [0064.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.jpeg") returned 0 [0064.549] lstrlenA (lpString="*.jpeg") returned 6 [0064.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.psd") returned 0 [0064.549] lstrlenA (lpString="*.psd") returned 5 [0064.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.gif") returned 0 [0064.549] lstrlenA (lpString="*.gif") returned 5 [0064.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.doc") returned 0 [0064.549] lstrlenA (lpString="*.doc") returned 5 [0064.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.docx") returned 0 [0064.549] lstrlenA (lpString="*.docx") returned 6 [0064.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.xls") returned 0 [0064.549] lstrlenA (lpString="*.xls") returned 5 [0064.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.xlsx") returned 0 [0064.549] lstrlenA (lpString="*.xlsx") returned 6 [0064.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.ppt") returned 0 [0064.549] lstrlenA (lpString="*.ppt") returned 5 [0064.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.pptx") returned 0 [0064.550] lstrlenA (lpString="*.pptx") returned 6 [0064.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.pdf") returned 0 [0064.550] lstrlenA (lpString="*.pdf") returned 5 [0064.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mov") returned 0 [0064.550] lstrlenA (lpString="*.mov") returned 5 [0064.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.m2v") returned 0 [0064.550] lstrlenA (lpString="*.m2v") returned 5 [0064.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.3gp") returned 0 [0064.550] lstrlenA (lpString="*.3gp") returned 5 [0064.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mpeg") returned 0 [0064.550] lstrlenA (lpString="*.mpeg") returned 6 [0064.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mpg") returned 0 [0064.550] lstrlenA (lpString="*.mpg") returned 5 [0064.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.flv") returned 0 [0064.550] lstrlenA (lpString="*.flv") returned 5 [0064.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.avi") returned 0 [0064.550] lstrlenA (lpString="*.avi") returned 5 [0064.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mp4") returned 0 [0064.550] lstrlenA (lpString="*.mp4") returned 5 [0064.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.wmv") returned 0 [0064.550] lstrlenA (lpString="*.wmv") returned 5 [0064.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.divx") returned 0 [0064.550] lstrlenA (lpString="*.divx") returned 6 [0064.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mkv") returned 0 [0064.550] lstrlenA (lpString="*.mkv") returned 5 [0064.550] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mp3") returned 0 [0064.551] lstrlenA (lpString="*.mp3") returned 5 [0064.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.wav") returned 0 [0064.551] lstrlenA (lpString="*.wav") returned 5 [0064.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.flac") returned 0 [0064.551] lstrlenA (lpString="*.flac") returned 6 [0064.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.ape") returned 0 [0064.551] lstrlenA (lpString="*.ape") returned 5 [0064.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.wma") returned 0 [0064.551] lstrlenA (lpString="*.wma") returned 5 [0064.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.ac3") returned 0 [0064.551] lstrlenA (lpString="*.ac3") returned 5 [0064.551] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.mxf") returned 0 [0064.551] lstrlenA (lpString="*.mxf") returned 5 [0064.551] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x26b4, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="form_edit.js", cAlternateFileName="FORM_E~1.JS")) returned 1 [0064.551] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.551] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="form_edit.js") returned -1 [0064.551] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="form_edit.js") returned 1 [0064.551] lstrcmpiA (lpString1="", lpString2="form_edit.js") returned -1 [0064.551] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp") returned="FormsViewAttachmentIconsMask.bmp" [0064.551] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.551] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.551] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.551] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.552] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="form_edit.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js" [0064.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.zip") returned 0 [0064.552] lstrlenA (lpString="*.zip") returned 5 [0064.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.rar") returned 0 [0064.552] lstrlenA (lpString="*.rar") returned 5 [0064.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.7z") returned 0 [0064.552] lstrlenA (lpString="*.7z") returned 4 [0064.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.tar") returned 0 [0064.552] lstrlenA (lpString="*.tar") returned 5 [0064.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.gzip") returned 0 [0064.552] lstrlenA (lpString="*.gzip") returned 6 [0064.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.jpg") returned 0 [0064.552] lstrlenA (lpString="*.jpg") returned 5 [0064.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.jpeg") returned 0 [0064.552] lstrlenA (lpString="*.jpeg") returned 6 [0064.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.psd") returned 0 [0064.552] lstrlenA (lpString="*.psd") returned 5 [0064.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.gif") returned 0 [0064.552] lstrlenA (lpString="*.gif") returned 5 [0064.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.doc") returned 0 [0064.552] lstrlenA (lpString="*.doc") returned 5 [0064.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.docx") returned 0 [0064.552] lstrlenA (lpString="*.docx") returned 6 [0064.552] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.xls") returned 0 [0064.552] lstrlenA (lpString="*.xls") returned 5 [0064.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.xlsx") returned 0 [0064.553] lstrlenA (lpString="*.xlsx") returned 6 [0064.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.ppt") returned 0 [0064.553] lstrlenA (lpString="*.ppt") returned 5 [0064.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.pptx") returned 0 [0064.553] lstrlenA (lpString="*.pptx") returned 6 [0064.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.pdf") returned 0 [0064.553] lstrlenA (lpString="*.pdf") returned 5 [0064.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mov") returned 0 [0064.553] lstrlenA (lpString="*.mov") returned 5 [0064.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.m2v") returned 0 [0064.553] lstrlenA (lpString="*.m2v") returned 5 [0064.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.3gp") returned 0 [0064.553] lstrlenA (lpString="*.3gp") returned 5 [0064.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mpeg") returned 0 [0064.553] lstrlenA (lpString="*.mpeg") returned 6 [0064.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mpg") returned 0 [0064.553] lstrlenA (lpString="*.mpg") returned 5 [0064.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.flv") returned 0 [0064.553] lstrlenA (lpString="*.flv") returned 5 [0064.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.avi") returned 0 [0064.553] lstrlenA (lpString="*.avi") returned 5 [0064.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mp4") returned 0 [0064.553] lstrlenA (lpString="*.mp4") returned 5 [0064.553] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.wmv") returned 0 [0064.553] lstrlenA (lpString="*.wmv") returned 5 [0064.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.divx") returned 0 [0064.554] lstrlenA (lpString="*.divx") returned 6 [0064.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mkv") returned 0 [0064.554] lstrlenA (lpString="*.mkv") returned 5 [0064.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mp3") returned 0 [0064.554] lstrlenA (lpString="*.mp3") returned 5 [0064.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.wav") returned 0 [0064.554] lstrlenA (lpString="*.wav") returned 5 [0064.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.flac") returned 0 [0064.554] lstrlenA (lpString="*.flac") returned 6 [0064.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.ape") returned 0 [0064.554] lstrlenA (lpString="*.ape") returned 5 [0064.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.wma") returned 0 [0064.554] lstrlenA (lpString="*.wma") returned 5 [0064.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.ac3") returned 0 [0064.554] lstrlenA (lpString="*.ac3") returned 5 [0064.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mxf") returned 0 [0064.554] lstrlenA (lpString="*.mxf") returned 5 [0064.554] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x14316, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="InfoPathWelcomeImage.jpg", cAlternateFileName="INFOPA~1.JPG")) returned 1 [0064.554] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.554] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="InfoPathWelcomeImage.jpg") returned -1 [0064.554] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InfoPathWelcomeImage.jpg") returned -1 [0064.554] lstrcmpiA (lpString1="", lpString2="InfoPathWelcomeImage.jpg") returned -1 [0064.554] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js") returned="form_edit.js" [0064.554] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.554] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.555] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.555] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.555] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="InfoPathWelcomeImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" [0064.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.zip") returned 0 [0064.555] lstrlenA (lpString="*.zip") returned 5 [0064.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.rar") returned 0 [0064.555] lstrlenA (lpString="*.rar") returned 5 [0064.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.7z") returned 0 [0064.555] lstrlenA (lpString="*.7z") returned 4 [0064.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.tar") returned 0 [0064.555] lstrlenA (lpString="*.tar") returned 5 [0064.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.gzip") returned 0 [0064.555] lstrlenA (lpString="*.gzip") returned 6 [0064.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.jpg") returned 1 [0064.555] lstrlenA (lpString="*.jpg") returned 5 [0064.555] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" [0064.555] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" [0064.555] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg." [0064.555] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg.wannacry" [0064.555] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.556] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14316 [0064.556] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61cf3090, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea)) returned 1 [0064.556] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.556] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x14298, lpOverlapped=0x0) returned 1 [0064.561] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg") returned="InfoPathWelcomeImage.jpg" [0064.561] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.561] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x14298, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x14298, lpOverlapped=0x0) returned 1 [0064.572] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.572] CloseHandle (hObject=0x98) returned 1 [0064.572] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg.wannacry")) returned 1 [0064.573] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="LAUNCH.GIF", cAlternateFileName="")) returned 1 [0064.574] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.574] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LAUNCH.GIF") returned -1 [0064.574] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LAUNCH.GIF") returned -1 [0064.574] lstrcmpiA (lpString1="", lpString2="LAUNCH.GIF") returned -1 [0064.574] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg") returned="InfoPathWelcomeImage.jpg" [0064.574] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.574] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.574] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.574] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.574] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="LAUNCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF" [0064.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.zip") returned 0 [0064.574] lstrlenA (lpString="*.zip") returned 5 [0064.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.rar") returned 0 [0064.574] lstrlenA (lpString="*.rar") returned 5 [0064.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.7z") returned 0 [0064.574] lstrlenA (lpString="*.7z") returned 4 [0064.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.tar") returned 0 [0064.574] lstrlenA (lpString="*.tar") returned 5 [0064.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.gzip") returned 0 [0064.574] lstrlenA (lpString="*.gzip") returned 6 [0064.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.jpg") returned 0 [0064.574] lstrlenA (lpString="*.jpg") returned 5 [0064.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.jpeg") returned 0 [0064.575] lstrlenA (lpString="*.jpeg") returned 6 [0064.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.psd") returned 0 [0064.575] lstrlenA (lpString="*.psd") returned 5 [0064.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.gif") returned 1 [0064.575] lstrlenA (lpString="*.gif") returned 5 [0064.575] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF" [0064.575] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF" [0064.575] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF." [0064.575] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF.wannacry" [0064.575] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\launch.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.576] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x267 [0064.576] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x567e4730, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea)) returned 1 [0064.576] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.576] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1e9, lpOverlapped=0x0) returned 1 [0064.577] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF") returned="LAUNCH.GIF" [0064.577] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.577] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1e9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1e9, lpOverlapped=0x0) returned 1 [0064.578] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.578] CloseHandle (hObject=0x98) returned 1 [0064.578] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\launch.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\launch.gif.wannacry")) returned 1 [0064.581] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x418f4a00, ftCreationTime.dwHighDateTime=0x1c9fe9d, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x418f4a00, ftLastWriteTime.dwHighDateTime=0x1c9fe9d, nFileSizeHigh=0x0, nFileSizeLow=0x30074, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="macroprogress.gif", cAlternateFileName="MACROP~1.GIF")) returned 1 [0064.581] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.581] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="macroprogress.gif") returned -1 [0064.581] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="macroprogress.gif") returned -1 [0064.581] lstrcmpiA (lpString1="", lpString2="macroprogress.gif") returned -1 [0064.581] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF") returned="LAUNCH.GIF" [0064.581] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.581] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.581] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.581] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.581] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="macroprogress.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" [0064.582] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.zip") returned 0 [0064.582] lstrlenA (lpString="*.zip") returned 5 [0064.582] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.rar") returned 0 [0064.582] lstrlenA (lpString="*.rar") returned 5 [0064.582] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.7z") returned 0 [0064.582] lstrlenA (lpString="*.7z") returned 4 [0064.582] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.tar") returned 0 [0064.582] lstrlenA (lpString="*.tar") returned 5 [0064.582] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.gzip") returned 0 [0064.582] lstrlenA (lpString="*.gzip") returned 6 [0064.582] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.jpg") returned 0 [0064.582] lstrlenA (lpString="*.jpg") returned 5 [0064.582] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.jpeg") returned 0 [0064.582] lstrlenA (lpString="*.jpeg") returned 6 [0064.582] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.psd") returned 0 [0064.582] lstrlenA (lpString="*.psd") returned 5 [0064.582] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.gif") returned 1 [0064.582] lstrlenA (lpString="*.gif") returned 5 [0064.582] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" [0064.582] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" [0064.582] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif." [0064.582] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif.wannacry" [0064.582] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.583] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x30074 [0064.583] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x418f4a00, dwHighDateTime=0x1c9fe9d), lpLastAccessTime=0x407536*(dwLowDateTime=0x582abeb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x418f4a00, dwHighDateTime=0x1c9fe9d)) returned 1 [0064.583] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.584] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2fff6, lpOverlapped=0x0) returned 1 [0064.647] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif") returned="macroprogress.gif" [0064.647] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.647] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2fff6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2fff6, lpOverlapped=0x0) returned 1 [0064.648] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.648] CloseHandle (hObject=0x98) returned 1 [0064.648] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif.wannacry")) returned 1 [0064.661] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a76b250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x275e, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="PublicFunctions.js", cAlternateFileName="PUBLIC~1.JS")) returned 1 [0064.661] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.661] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PublicFunctions.js") returned -1 [0064.661] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PublicFunctions.js") returned -1 [0064.661] lstrcmpiA (lpString1="", lpString2="PublicFunctions.js") returned -1 [0064.661] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif") returned="macroprogress.gif" [0064.661] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.661] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.661] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.661] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.661] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="PublicFunctions.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js" [0064.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.zip") returned 0 [0064.662] lstrlenA (lpString="*.zip") returned 5 [0064.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.rar") returned 0 [0064.662] lstrlenA (lpString="*.rar") returned 5 [0064.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.7z") returned 0 [0064.662] lstrlenA (lpString="*.7z") returned 4 [0064.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.tar") returned 0 [0064.662] lstrlenA (lpString="*.tar") returned 5 [0064.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.gzip") returned 0 [0064.662] lstrlenA (lpString="*.gzip") returned 6 [0064.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.jpg") returned 0 [0064.662] lstrlenA (lpString="*.jpg") returned 5 [0064.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.jpeg") returned 0 [0064.662] lstrlenA (lpString="*.jpeg") returned 6 [0064.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.psd") returned 0 [0064.662] lstrlenA (lpString="*.psd") returned 5 [0064.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.gif") returned 0 [0064.662] lstrlenA (lpString="*.gif") returned 5 [0064.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.doc") returned 0 [0064.662] lstrlenA (lpString="*.doc") returned 5 [0064.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.docx") returned 0 [0064.662] lstrlenA (lpString="*.docx") returned 6 [0064.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.xls") returned 0 [0064.662] lstrlenA (lpString="*.xls") returned 5 [0064.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.xlsx") returned 0 [0064.662] lstrlenA (lpString="*.xlsx") returned 6 [0064.662] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.ppt") returned 0 [0064.662] lstrlenA (lpString="*.ppt") returned 5 [0064.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.pptx") returned 0 [0064.663] lstrlenA (lpString="*.pptx") returned 6 [0064.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.pdf") returned 0 [0064.663] lstrlenA (lpString="*.pdf") returned 5 [0064.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.mov") returned 0 [0064.663] lstrlenA (lpString="*.mov") returned 5 [0064.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.m2v") returned 0 [0064.663] lstrlenA (lpString="*.m2v") returned 5 [0064.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.3gp") returned 0 [0064.663] lstrlenA (lpString="*.3gp") returned 5 [0064.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.mpeg") returned 0 [0064.663] lstrlenA (lpString="*.mpeg") returned 6 [0064.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.mpg") returned 0 [0064.663] lstrlenA (lpString="*.mpg") returned 5 [0064.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.flv") returned 0 [0064.663] lstrlenA (lpString="*.flv") returned 5 [0064.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.avi") returned 0 [0064.663] lstrlenA (lpString="*.avi") returned 5 [0064.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.mp4") returned 0 [0064.663] lstrlenA (lpString="*.mp4") returned 5 [0064.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.wmv") returned 0 [0064.663] lstrlenA (lpString="*.wmv") returned 5 [0064.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.divx") returned 0 [0064.663] lstrlenA (lpString="*.divx") returned 6 [0064.663] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.mkv") returned 0 [0064.663] lstrlenA (lpString="*.mkv") returned 5 [0064.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.mp3") returned 0 [0064.664] lstrlenA (lpString="*.mp3") returned 5 [0064.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.wav") returned 0 [0064.664] lstrlenA (lpString="*.wav") returned 5 [0064.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.flac") returned 0 [0064.664] lstrlenA (lpString="*.flac") returned 6 [0064.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.ape") returned 0 [0064.664] lstrlenA (lpString="*.ape") returned 5 [0064.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.wma") returned 0 [0064.664] lstrlenA (lpString="*.wma") returned 5 [0064.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.ac3") returned 0 [0064.664] lstrlenA (lpString="*.ac3") returned 5 [0064.664] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.mxf") returned 0 [0064.664] lstrlenA (lpString="*.mxf") returned 5 [0064.664] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="rtf_alignleft.gif", cAlternateFileName="RTF_AL~1.GIF")) returned 1 [0064.664] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.664] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_alignleft.gif") returned -1 [0064.664] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_alignleft.gif") returned -1 [0064.664] lstrcmpiA (lpString1="", lpString2="rtf_alignleft.gif") returned -1 [0064.664] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js") returned="PublicFunctions.js" [0064.664] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.664] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.664] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.664] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.665] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_alignleft.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" [0064.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.zip") returned 0 [0064.665] lstrlenA (lpString="*.zip") returned 5 [0064.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.rar") returned 0 [0064.665] lstrlenA (lpString="*.rar") returned 5 [0064.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.7z") returned 0 [0064.665] lstrlenA (lpString="*.7z") returned 4 [0064.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.tar") returned 0 [0064.665] lstrlenA (lpString="*.tar") returned 5 [0064.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.gzip") returned 0 [0064.665] lstrlenA (lpString="*.gzip") returned 6 [0064.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.jpg") returned 0 [0064.665] lstrlenA (lpString="*.jpg") returned 5 [0064.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.jpeg") returned 0 [0064.665] lstrlenA (lpString="*.jpeg") returned 6 [0064.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.psd") returned 0 [0064.665] lstrlenA (lpString="*.psd") returned 5 [0064.665] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.gif") returned 1 [0064.665] lstrlenA (lpString="*.gif") returned 5 [0064.665] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" [0064.665] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" [0064.665] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif." [0064.665] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif.wannacry" [0064.665] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.668] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x350 [0064.668] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea)) returned 1 [0064.668] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.668] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2d2, lpOverlapped=0x0) returned 1 [0064.670] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif") returned="rtf_alignleft.gif" [0064.670] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.670] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2d2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2d2, lpOverlapped=0x0) returned 1 [0064.671] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.671] CloseHandle (hObject=0x98) returned 1 [0064.671] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif.wannacry")) returned 1 [0064.672] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="rtf_alignright.gif", cAlternateFileName="RTF_AL~2.GIF")) returned 1 [0064.673] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.673] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_alignright.gif") returned -1 [0064.673] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_alignright.gif") returned -1 [0064.673] lstrcmpiA (lpString1="", lpString2="rtf_alignright.gif") returned -1 [0064.673] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif") returned="rtf_alignleft.gif" [0064.673] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.673] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.673] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.673] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.673] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_alignright.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" [0064.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.zip") returned 0 [0064.673] lstrlenA (lpString="*.zip") returned 5 [0064.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.rar") returned 0 [0064.673] lstrlenA (lpString="*.rar") returned 5 [0064.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.7z") returned 0 [0064.673] lstrlenA (lpString="*.7z") returned 4 [0064.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.tar") returned 0 [0064.673] lstrlenA (lpString="*.tar") returned 5 [0064.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.gzip") returned 0 [0064.673] lstrlenA (lpString="*.gzip") returned 6 [0064.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.jpg") returned 0 [0064.674] lstrlenA (lpString="*.jpg") returned 5 [0064.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.jpeg") returned 0 [0064.674] lstrlenA (lpString="*.jpeg") returned 6 [0064.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.psd") returned 0 [0064.674] lstrlenA (lpString="*.psd") returned 5 [0064.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.gif") returned 1 [0064.674] lstrlenA (lpString="*.gif") returned 5 [0064.674] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" [0064.674] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" [0064.674] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif." [0064.674] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif.wannacry" [0064.674] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.675] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34f [0064.675] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea)) returned 1 [0064.675] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.675] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2d1, lpOverlapped=0x0) returned 1 [0064.677] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif") returned="rtf_alignright.gif" [0064.677] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.677] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2d1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2d1, lpOverlapped=0x0) returned 1 [0064.678] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.678] CloseHandle (hObject=0x98) returned 1 [0064.679] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif.wannacry")) returned 1 [0064.680] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x365, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="rtf_bullets.gif", cAlternateFileName="RTF_BU~1.GIF")) returned 1 [0064.680] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.680] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_bullets.gif") returned -1 [0064.680] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_bullets.gif") returned -1 [0064.680] lstrcmpiA (lpString1="", lpString2="rtf_bullets.gif") returned -1 [0064.680] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif") returned="rtf_alignright.gif" [0064.680] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.680] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.680] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.680] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.680] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_bullets.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" [0064.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.zip") returned 0 [0064.681] lstrlenA (lpString="*.zip") returned 5 [0064.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.rar") returned 0 [0064.681] lstrlenA (lpString="*.rar") returned 5 [0064.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.7z") returned 0 [0064.681] lstrlenA (lpString="*.7z") returned 4 [0064.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.tar") returned 0 [0064.681] lstrlenA (lpString="*.tar") returned 5 [0064.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.gzip") returned 0 [0064.681] lstrlenA (lpString="*.gzip") returned 6 [0064.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.jpg") returned 0 [0064.681] lstrlenA (lpString="*.jpg") returned 5 [0064.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.jpeg") returned 0 [0064.681] lstrlenA (lpString="*.jpeg") returned 6 [0064.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.psd") returned 0 [0064.681] lstrlenA (lpString="*.psd") returned 5 [0064.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.gif") returned 1 [0064.681] lstrlenA (lpString="*.gif") returned 5 [0064.681] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" [0064.681] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" [0064.681] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif." [0064.681] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif.wannacry" [0064.681] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.682] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x365 [0064.682] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea)) returned 1 [0064.683] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.683] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2e7, lpOverlapped=0x0) returned 1 [0064.685] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif") returned="rtf_bullets.gif" [0064.685] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.686] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2e7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2e7, lpOverlapped=0x0) returned 1 [0064.687] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.687] CloseHandle (hObject=0x98) returned 1 [0064.687] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif.wannacry")) returned 1 [0064.689] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="rtf_center.gif", cAlternateFileName="RTF_CE~1.GIF")) returned 1 [0064.689] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.689] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_center.gif") returned -1 [0064.689] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_center.gif") returned -1 [0064.689] lstrcmpiA (lpString1="", lpString2="rtf_center.gif") returned -1 [0064.689] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif") returned="rtf_bullets.gif" [0064.690] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.690] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.690] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.690] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.690] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_center.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" [0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.zip") returned 0 [0064.690] lstrlenA (lpString="*.zip") returned 5 [0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.rar") returned 0 [0064.690] lstrlenA (lpString="*.rar") returned 5 [0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.7z") returned 0 [0064.690] lstrlenA (lpString="*.7z") returned 4 [0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.tar") returned 0 [0064.690] lstrlenA (lpString="*.tar") returned 5 [0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.gzip") returned 0 [0064.690] lstrlenA (lpString="*.gzip") returned 6 [0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.jpg") returned 0 [0064.690] lstrlenA (lpString="*.jpg") returned 5 [0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.jpeg") returned 0 [0064.690] lstrlenA (lpString="*.jpeg") returned 6 [0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.psd") returned 0 [0064.690] lstrlenA (lpString="*.psd") returned 5 [0064.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.gif") returned 1 [0064.690] lstrlenA (lpString="*.gif") returned 5 [0064.690] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" [0064.691] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" [0064.691] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif." [0064.691] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif.wannacry" [0064.691] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.692] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34f [0064.692] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea)) returned 1 [0064.692] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.692] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2d1, lpOverlapped=0x0) returned 1 [0064.698] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif") returned="rtf_center.gif" [0064.698] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.698] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2d1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2d1, lpOverlapped=0x0) returned 1 [0064.698] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.698] CloseHandle (hObject=0x98) returned 1 [0064.698] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif.wannacry")) returned 1 [0064.700] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3031bc00, ftCreationTime.dwHighDateTime=0x1ca033b, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3031bc00, ftLastWriteTime.dwHighDateTime=0x1ca033b, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="rtf_choosecolor.gif", cAlternateFileName="RTF_CH~1.GIF")) returned 1 [0064.700] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.700] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_choosecolor.gif") returned -1 [0064.700] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_choosecolor.gif") returned -1 [0064.700] lstrcmpiA (lpString1="", lpString2="rtf_choosecolor.gif") returned -1 [0064.700] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif") returned="rtf_center.gif" [0064.700] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.700] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.700] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.700] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.700] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_choosecolor.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" [0064.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.zip") returned 0 [0064.700] lstrlenA (lpString="*.zip") returned 5 [0064.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.rar") returned 0 [0064.700] lstrlenA (lpString="*.rar") returned 5 [0064.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.7z") returned 0 [0064.700] lstrlenA (lpString="*.7z") returned 4 [0064.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.tar") returned 0 [0064.700] lstrlenA (lpString="*.tar") returned 5 [0064.700] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.gzip") returned 0 [0064.700] lstrlenA (lpString="*.gzip") returned 6 [0064.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.jpg") returned 0 [0064.701] lstrlenA (lpString="*.jpg") returned 5 [0064.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.jpeg") returned 0 [0064.701] lstrlenA (lpString="*.jpeg") returned 6 [0064.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.psd") returned 0 [0064.701] lstrlenA (lpString="*.psd") returned 5 [0064.701] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.gif") returned 1 [0064.701] lstrlenA (lpString="*.gif") returned 5 [0064.701] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" [0064.701] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" [0064.701] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif." [0064.701] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif.wannacry" [0064.701] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.702] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ee [0064.702] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3031bc00, dwHighDateTime=0x1ca033b), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3031bc00, dwHighDateTime=0x1ca033b)) returned 1 [0064.702] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.702] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x370, lpOverlapped=0x0) returned 1 [0064.731] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif") returned="rtf_choosecolor.gif" [0064.731] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.732] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x370, lpOverlapped=0x0) returned 1 [0064.733] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.733] CloseHandle (hObject=0x98) returned 1 [0064.733] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif.wannacry")) returned 1 [0064.735] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35f, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="rtf_decreaseindent.gif", cAlternateFileName="RTF_DE~1.GIF")) returned 1 [0064.735] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.735] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_decreaseindent.gif") returned -1 [0064.735] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_decreaseindent.gif") returned -1 [0064.735] lstrcmpiA (lpString1="", lpString2="rtf_decreaseindent.gif") returned -1 [0064.735] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif") returned="rtf_choosecolor.gif" [0064.735] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.735] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.735] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.735] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.736] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_decreaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" [0064.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.zip") returned 0 [0064.736] lstrlenA (lpString="*.zip") returned 5 [0064.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.rar") returned 0 [0064.736] lstrlenA (lpString="*.rar") returned 5 [0064.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.7z") returned 0 [0064.736] lstrlenA (lpString="*.7z") returned 4 [0064.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.tar") returned 0 [0064.736] lstrlenA (lpString="*.tar") returned 5 [0064.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.gzip") returned 0 [0064.736] lstrlenA (lpString="*.gzip") returned 6 [0064.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.jpg") returned 0 [0064.736] lstrlenA (lpString="*.jpg") returned 5 [0064.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.jpeg") returned 0 [0064.736] lstrlenA (lpString="*.jpeg") returned 6 [0064.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.psd") returned 0 [0064.736] lstrlenA (lpString="*.psd") returned 5 [0064.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.gif") returned 1 [0064.736] lstrlenA (lpString="*.gif") returned 5 [0064.736] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" [0064.736] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" [0064.737] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif." [0064.737] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif.wannacry" [0064.737] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.738] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35f [0064.738] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea)) returned 1 [0064.738] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.738] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2e1, lpOverlapped=0x0) returned 1 [0064.740] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif") returned="rtf_decreaseindent.gif" [0064.740] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.740] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2e1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2e1, lpOverlapped=0x0) returned 1 [0064.740] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.740] CloseHandle (hObject=0x98) returned 1 [0064.740] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif.wannacry")) returned 1 [0064.741] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="rtf_hyperlink.gif", cAlternateFileName="RTF_HY~1.GIF")) returned 1 [0064.741] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.741] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_hyperlink.gif") returned -1 [0064.741] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_hyperlink.gif") returned -1 [0064.741] lstrcmpiA (lpString1="", lpString2="rtf_hyperlink.gif") returned -1 [0064.741] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif") returned="rtf_decreaseindent.gif" [0064.742] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.742] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.742] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.742] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.742] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_hyperlink.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" [0064.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.zip") returned 0 [0064.742] lstrlenA (lpString="*.zip") returned 5 [0064.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.rar") returned 0 [0064.742] lstrlenA (lpString="*.rar") returned 5 [0064.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.7z") returned 0 [0064.742] lstrlenA (lpString="*.7z") returned 4 [0064.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.tar") returned 0 [0064.742] lstrlenA (lpString="*.tar") returned 5 [0064.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.gzip") returned 0 [0064.742] lstrlenA (lpString="*.gzip") returned 6 [0064.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.jpg") returned 0 [0064.742] lstrlenA (lpString="*.jpg") returned 5 [0064.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.jpeg") returned 0 [0064.742] lstrlenA (lpString="*.jpeg") returned 6 [0064.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.psd") returned 0 [0064.742] lstrlenA (lpString="*.psd") returned 5 [0064.742] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.gif") returned 1 [0064.742] lstrlenA (lpString="*.gif") returned 5 [0064.743] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" [0064.743] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" [0064.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif." [0064.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif.wannacry" [0064.743] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.744] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf1 [0064.744] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d24dcb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea)) returned 1 [0064.744] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.744] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x73, lpOverlapped=0x0) returned 1 [0064.745] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif") returned="rtf_hyperlink.gif" [0064.745] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.745] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x73, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x73, lpOverlapped=0x0) returned 1 [0064.745] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.746] CloseHandle (hObject=0x98) returned 1 [0064.746] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif.wannacry")) returned 1 [0064.747] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35d, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="rtf_increaseindent.gif", cAlternateFileName="RTF_IN~1.GIF")) returned 1 [0064.747] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.747] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_increaseindent.gif") returned -1 [0064.747] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_increaseindent.gif") returned -1 [0064.747] lstrcmpiA (lpString1="", lpString2="rtf_increaseindent.gif") returned -1 [0064.747] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif") returned="rtf_hyperlink.gif" [0064.747] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.747] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.747] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.747] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.747] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_increaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" [0064.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.zip") returned 0 [0064.747] lstrlenA (lpString="*.zip") returned 5 [0064.747] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.rar") returned 0 [0064.747] lstrlenA (lpString="*.rar") returned 5 [0064.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.7z") returned 0 [0064.748] lstrlenA (lpString="*.7z") returned 4 [0064.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.tar") returned 0 [0064.748] lstrlenA (lpString="*.tar") returned 5 [0064.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.gzip") returned 0 [0064.748] lstrlenA (lpString="*.gzip") returned 6 [0064.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.jpg") returned 0 [0064.748] lstrlenA (lpString="*.jpg") returned 5 [0064.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.jpeg") returned 0 [0064.748] lstrlenA (lpString="*.jpeg") returned 6 [0064.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.psd") returned 0 [0064.748] lstrlenA (lpString="*.psd") returned 5 [0064.748] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.gif") returned 1 [0064.748] lstrlenA (lpString="*.gif") returned 5 [0064.748] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" [0064.748] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" [0064.748] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif." [0064.748] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif.wannacry" [0064.748] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.749] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35d [0064.749] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea)) returned 1 [0064.749] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.749] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2df, lpOverlapped=0x0) returned 1 [0064.751] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif") returned="rtf_increaseindent.gif" [0064.751] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.751] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2df, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2df, lpOverlapped=0x0) returned 1 [0064.751] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.751] CloseHandle (hObject=0x98) returned 1 [0064.752] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif.wannacry")) returned 1 [0064.753] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="rtf_justify.gif", cAlternateFileName="RTF_JU~1.GIF")) returned 1 [0064.753] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.753] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_justify.gif") returned -1 [0064.753] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_justify.gif") returned -1 [0064.753] lstrcmpiA (lpString1="", lpString2="rtf_justify.gif") returned -1 [0064.753] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif") returned="rtf_increaseindent.gif" [0064.753] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.753] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.753] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.753] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.753] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_justify.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" [0064.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.zip") returned 0 [0064.753] lstrlenA (lpString="*.zip") returned 5 [0064.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.rar") returned 0 [0064.753] lstrlenA (lpString="*.rar") returned 5 [0064.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.7z") returned 0 [0064.753] lstrlenA (lpString="*.7z") returned 4 [0064.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.tar") returned 0 [0064.753] lstrlenA (lpString="*.tar") returned 5 [0064.753] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.gzip") returned 0 [0064.753] lstrlenA (lpString="*.gzip") returned 6 [0064.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.jpg") returned 0 [0064.754] lstrlenA (lpString="*.jpg") returned 5 [0064.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.jpeg") returned 0 [0064.754] lstrlenA (lpString="*.jpeg") returned 6 [0064.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.psd") returned 0 [0064.754] lstrlenA (lpString="*.psd") returned 5 [0064.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.gif") returned 1 [0064.754] lstrlenA (lpString="*.gif") returned 5 [0064.754] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" [0064.754] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" [0064.754] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif." [0064.754] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif.wannacry" [0064.754] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.755] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x352 [0064.755] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a90e170, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea)) returned 1 [0064.755] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.755] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2d4, lpOverlapped=0x0) returned 1 [0064.757] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif") returned="rtf_justify.gif" [0064.757] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.757] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2d4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2d4, lpOverlapped=0x0) returned 1 [0064.757] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.757] CloseHandle (hObject=0x98) returned 1 [0064.757] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif.wannacry")) returned 1 [0064.758] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x373, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="rtf_pressed.gif", cAlternateFileName="RTF_PR~1.GIF")) returned 1 [0064.758] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.758] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rtf_pressed.gif") returned -1 [0064.758] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_pressed.gif") returned -1 [0064.758] lstrcmpiA (lpString1="", lpString2="rtf_pressed.gif") returned -1 [0064.758] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif") returned="rtf_justify.gif" [0064.758] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.758] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.758] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.758] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.759] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_pressed.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" [0064.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.zip") returned 0 [0064.759] lstrlenA (lpString="*.zip") returned 5 [0064.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.rar") returned 0 [0064.759] lstrlenA (lpString="*.rar") returned 5 [0064.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.7z") returned 0 [0064.759] lstrlenA (lpString="*.7z") returned 4 [0064.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.tar") returned 0 [0064.759] lstrlenA (lpString="*.tar") returned 5 [0064.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.gzip") returned 0 [0064.759] lstrlenA (lpString="*.gzip") returned 6 [0064.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.jpg") returned 0 [0064.759] lstrlenA (lpString="*.jpg") returned 5 [0064.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.jpeg") returned 0 [0064.759] lstrlenA (lpString="*.jpeg") returned 6 [0064.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.psd") returned 0 [0064.759] lstrlenA (lpString="*.psd") returned 5 [0064.759] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.gif") returned 1 [0064.759] lstrlenA (lpString="*.gif") returned 5 [0064.759] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" [0064.759] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" [0064.759] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif." [0064.759] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif.wannacry" [0064.760] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.760] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x373 [0064.760] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d24dcb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea)) returned 1 [0064.760] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.760] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2f5, lpOverlapped=0x0) returned 1 [0064.763] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif") returned="rtf_pressed.gif" [0064.763] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.763] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2f5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2f5, lpOverlapped=0x0) returned 1 [0064.764] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.764] CloseHandle (hObject=0x98) returned 1 [0064.764] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif.wannacry")) returned 1 [0064.765] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58b9b600, ftCreationTime.dwHighDateTime=0x1ca033b, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58b9b600, ftLastWriteTime.dwHighDateTime=0x1ca033b, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="SAVE.GIF", cAlternateFileName="")) returned 1 [0064.765] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.765] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SAVE.GIF") returned -1 [0064.765] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SAVE.GIF") returned -1 [0064.765] lstrcmpiA (lpString1="", lpString2="SAVE.GIF") returned -1 [0064.765] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif") returned="rtf_pressed.gif" [0064.765] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.765] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.765] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.765] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.765] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="SAVE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF" [0064.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.zip") returned 0 [0064.765] lstrlenA (lpString="*.zip") returned 5 [0064.765] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.rar") returned 0 [0064.767] lstrlenA (lpString="*.rar") returned 5 [0064.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.7z") returned 0 [0064.767] lstrlenA (lpString="*.7z") returned 4 [0064.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.tar") returned 0 [0064.767] lstrlenA (lpString="*.tar") returned 5 [0064.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.gzip") returned 0 [0064.767] lstrlenA (lpString="*.gzip") returned 6 [0064.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.jpg") returned 0 [0064.767] lstrlenA (lpString="*.jpg") returned 5 [0064.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.jpeg") returned 0 [0064.767] lstrlenA (lpString="*.jpeg") returned 6 [0064.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.psd") returned 0 [0064.767] lstrlenA (lpString="*.psd") returned 5 [0064.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.gif") returned 1 [0064.767] lstrlenA (lpString="*.gif") returned 5 [0064.767] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF" [0064.767] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF" [0064.767] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF." [0064.767] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF.wannacry" [0064.767] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\save.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.768] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x26d [0064.768] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x58b9b600, dwHighDateTime=0x1ca033b), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d24dcb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x58b9b600, dwHighDateTime=0x1ca033b)) returned 1 [0064.768] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.768] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1ef, lpOverlapped=0x0) returned 1 [0064.770] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF") returned="SAVE.GIF" [0064.770] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.770] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1ef, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1ef, lpOverlapped=0x0) returned 1 [0064.770] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.770] CloseHandle (hObject=0x98) returned 1 [0064.770] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\save.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\save.gif.wannacry")) returned 1 [0064.774] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27739b00, ftCreationTime.dwHighDateTime=0x1ca408b, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27739b00, ftLastWriteTime.dwHighDateTime=0x1ca408b, nFileSizeHigh=0x0, nFileSizeLow=0x15162, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="SUBMIT.JS", cAlternateFileName="")) returned 1 [0064.774] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.774] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SUBMIT.JS") returned -1 [0064.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SUBMIT.JS") returned -1 [0064.774] lstrcmpiA (lpString1="", lpString2="SUBMIT.JS") returned -1 [0064.774] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF") returned="SAVE.GIF" [0064.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.774] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.774] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.774] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.774] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="SUBMIT.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS" [0064.774] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.zip") returned 0 [0064.774] lstrlenA (lpString="*.zip") returned 5 [0064.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.rar") returned 0 [0064.775] lstrlenA (lpString="*.rar") returned 5 [0064.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.7z") returned 0 [0064.775] lstrlenA (lpString="*.7z") returned 4 [0064.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.tar") returned 0 [0064.775] lstrlenA (lpString="*.tar") returned 5 [0064.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.gzip") returned 0 [0064.775] lstrlenA (lpString="*.gzip") returned 6 [0064.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.jpg") returned 0 [0064.775] lstrlenA (lpString="*.jpg") returned 5 [0064.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.jpeg") returned 0 [0064.775] lstrlenA (lpString="*.jpeg") returned 6 [0064.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.psd") returned 0 [0064.775] lstrlenA (lpString="*.psd") returned 5 [0064.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.gif") returned 0 [0064.775] lstrlenA (lpString="*.gif") returned 5 [0064.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.doc") returned 0 [0064.775] lstrlenA (lpString="*.doc") returned 5 [0064.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.docx") returned 0 [0064.775] lstrlenA (lpString="*.docx") returned 6 [0064.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.xls") returned 0 [0064.775] lstrlenA (lpString="*.xls") returned 5 [0064.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.xlsx") returned 0 [0064.776] lstrlenA (lpString="*.xlsx") returned 6 [0064.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.ppt") returned 0 [0064.776] lstrlenA (lpString="*.ppt") returned 5 [0064.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.pptx") returned 0 [0064.776] lstrlenA (lpString="*.pptx") returned 6 [0064.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.pdf") returned 0 [0064.776] lstrlenA (lpString="*.pdf") returned 5 [0064.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.mov") returned 0 [0064.776] lstrlenA (lpString="*.mov") returned 5 [0064.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.m2v") returned 0 [0064.776] lstrlenA (lpString="*.m2v") returned 5 [0064.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.3gp") returned 0 [0064.776] lstrlenA (lpString="*.3gp") returned 5 [0064.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.mpeg") returned 0 [0064.776] lstrlenA (lpString="*.mpeg") returned 6 [0064.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.mpg") returned 0 [0064.776] lstrlenA (lpString="*.mpg") returned 5 [0064.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.flv") returned 0 [0064.776] lstrlenA (lpString="*.flv") returned 5 [0064.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.avi") returned 0 [0064.776] lstrlenA (lpString="*.avi") returned 5 [0064.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.mp4") returned 0 [0064.776] lstrlenA (lpString="*.mp4") returned 5 [0064.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.wmv") returned 0 [0064.777] lstrlenA (lpString="*.wmv") returned 5 [0064.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.divx") returned 0 [0064.777] lstrlenA (lpString="*.divx") returned 6 [0064.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.mkv") returned 0 [0064.777] lstrlenA (lpString="*.mkv") returned 5 [0064.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.mp3") returned 0 [0064.777] lstrlenA (lpString="*.mp3") returned 5 [0064.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.wav") returned 0 [0064.777] lstrlenA (lpString="*.wav") returned 5 [0064.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.flac") returned 0 [0064.777] lstrlenA (lpString="*.flac") returned 6 [0064.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.ape") returned 0 [0064.777] lstrlenA (lpString="*.ape") returned 5 [0064.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.wma") returned 0 [0064.777] lstrlenA (lpString="*.wma") returned 5 [0064.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.ac3") returned 0 [0064.777] lstrlenA (lpString="*.ac3") returned 5 [0064.777] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.mxf") returned 0 [0064.777] lstrlenA (lpString="*.mxf") returned 5 [0064.777] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xefe7, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="utilityfunctions.js", cAlternateFileName="UTILIT~1.JS")) returned 1 [0064.777] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.777] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="utilityfunctions.js") returned -1 [0064.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="utilityfunctions.js") returned -1 [0064.777] lstrcmpiA (lpString1="", lpString2="utilityfunctions.js") returned -1 [0064.777] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS") returned="SUBMIT.JS" [0064.778] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.778] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.778] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.778] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.778] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="utilityfunctions.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js" [0064.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.zip") returned 0 [0064.778] lstrlenA (lpString="*.zip") returned 5 [0064.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.rar") returned 0 [0064.778] lstrlenA (lpString="*.rar") returned 5 [0064.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.7z") returned 0 [0064.778] lstrlenA (lpString="*.7z") returned 4 [0064.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.tar") returned 0 [0064.778] lstrlenA (lpString="*.tar") returned 5 [0064.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.gzip") returned 0 [0064.778] lstrlenA (lpString="*.gzip") returned 6 [0064.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.jpg") returned 0 [0064.778] lstrlenA (lpString="*.jpg") returned 5 [0064.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.jpeg") returned 0 [0064.778] lstrlenA (lpString="*.jpeg") returned 6 [0064.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.psd") returned 0 [0064.778] lstrlenA (lpString="*.psd") returned 5 [0064.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.gif") returned 0 [0064.778] lstrlenA (lpString="*.gif") returned 5 [0064.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.doc") returned 0 [0064.778] lstrlenA (lpString="*.doc") returned 5 [0064.778] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.docx") returned 0 [0064.779] lstrlenA (lpString="*.docx") returned 6 [0064.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.xls") returned 0 [0064.779] lstrlenA (lpString="*.xls") returned 5 [0064.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.xlsx") returned 0 [0064.779] lstrlenA (lpString="*.xlsx") returned 6 [0064.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.ppt") returned 0 [0064.779] lstrlenA (lpString="*.ppt") returned 5 [0064.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.pptx") returned 0 [0064.779] lstrlenA (lpString="*.pptx") returned 6 [0064.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.pdf") returned 0 [0064.779] lstrlenA (lpString="*.pdf") returned 5 [0064.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.mov") returned 0 [0064.779] lstrlenA (lpString="*.mov") returned 5 [0064.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.m2v") returned 0 [0064.779] lstrlenA (lpString="*.m2v") returned 5 [0064.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.3gp") returned 0 [0064.779] lstrlenA (lpString="*.3gp") returned 5 [0064.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.mpeg") returned 0 [0064.779] lstrlenA (lpString="*.mpeg") returned 6 [0064.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.mpg") returned 0 [0064.779] lstrlenA (lpString="*.mpg") returned 5 [0064.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.flv") returned 0 [0064.779] lstrlenA (lpString="*.flv") returned 5 [0064.779] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.avi") returned 0 [0064.779] lstrlenA (lpString="*.avi") returned 5 [0064.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.mp4") returned 0 [0064.780] lstrlenA (lpString="*.mp4") returned 5 [0064.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.wmv") returned 0 [0064.780] lstrlenA (lpString="*.wmv") returned 5 [0064.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.divx") returned 0 [0064.780] lstrlenA (lpString="*.divx") returned 6 [0064.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.mkv") returned 0 [0064.780] lstrlenA (lpString="*.mkv") returned 5 [0064.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.mp3") returned 0 [0064.780] lstrlenA (lpString="*.mp3") returned 5 [0064.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.wav") returned 0 [0064.780] lstrlenA (lpString="*.wav") returned 5 [0064.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.flac") returned 0 [0064.780] lstrlenA (lpString="*.flac") returned 6 [0064.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.ape") returned 0 [0064.780] lstrlenA (lpString="*.ape") returned 5 [0064.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.wma") returned 0 [0064.780] lstrlenA (lpString="*.wma") returned 5 [0064.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.ac3") returned 0 [0064.780] lstrlenA (lpString="*.ac3") returned 5 [0064.780] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.mxf") returned 0 [0064.780] lstrlenA (lpString="*.mxf") returned 5 [0064.780] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b43100, ftCreationTime.dwHighDateTime=0x1ca0352, ftLastAccessTime.dwLowDateTime=0x5e4444b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x53b43100, ftLastWriteTime.dwHighDateTime=0x1ca0352, nFileSizeHigh=0x0, nFileSizeLow=0x75aa, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="validation.js", cAlternateFileName="VALIDA~1.JS")) returned 1 [0064.780] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.780] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="validation.js") returned -1 [0064.781] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="validation.js") returned -1 [0064.781] lstrcmpiA (lpString1="", lpString2="validation.js") returned -1 [0064.781] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js") returned="utilityfunctions.js" [0064.781] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" [0064.781] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned="" [0064.781] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" [0064.781] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\how to decrypt files.txt")) returned 0x20 [0064.781] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="validation.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js" [0064.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.zip") returned 0 [0064.781] lstrlenA (lpString="*.zip") returned 5 [0064.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.rar") returned 0 [0064.781] lstrlenA (lpString="*.rar") returned 5 [0064.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.7z") returned 0 [0064.781] lstrlenA (lpString="*.7z") returned 4 [0064.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.tar") returned 0 [0064.781] lstrlenA (lpString="*.tar") returned 5 [0064.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.gzip") returned 0 [0064.781] lstrlenA (lpString="*.gzip") returned 6 [0064.781] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.jpg") returned 0 [0064.781] lstrlenA (lpString="*.jpg") returned 5 [0064.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.jpeg") returned 0 [0064.782] lstrlenA (lpString="*.jpeg") returned 6 [0064.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.psd") returned 0 [0064.782] lstrlenA (lpString="*.psd") returned 5 [0064.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.gif") returned 0 [0064.782] lstrlenA (lpString="*.gif") returned 5 [0064.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.doc") returned 0 [0064.782] lstrlenA (lpString="*.doc") returned 5 [0064.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.docx") returned 0 [0064.782] lstrlenA (lpString="*.docx") returned 6 [0064.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.xls") returned 0 [0064.782] lstrlenA (lpString="*.xls") returned 5 [0064.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.xlsx") returned 0 [0064.782] lstrlenA (lpString="*.xlsx") returned 6 [0064.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.ppt") returned 0 [0064.782] lstrlenA (lpString="*.ppt") returned 5 [0064.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.pptx") returned 0 [0064.782] lstrlenA (lpString="*.pptx") returned 6 [0064.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.pdf") returned 0 [0064.782] lstrlenA (lpString="*.pdf") returned 5 [0064.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.mov") returned 0 [0064.782] lstrlenA (lpString="*.mov") returned 5 [0064.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.m2v") returned 0 [0064.782] lstrlenA (lpString="*.m2v") returned 5 [0064.782] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.3gp") returned 0 [0064.782] lstrlenA (lpString="*.3gp") returned 5 [0064.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.mpeg") returned 0 [0064.783] lstrlenA (lpString="*.mpeg") returned 6 [0064.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.mpg") returned 0 [0064.783] lstrlenA (lpString="*.mpg") returned 5 [0064.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.flv") returned 0 [0064.783] lstrlenA (lpString="*.flv") returned 5 [0064.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.avi") returned 0 [0064.783] lstrlenA (lpString="*.avi") returned 5 [0064.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.mp4") returned 0 [0064.783] lstrlenA (lpString="*.mp4") returned 5 [0064.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.wmv") returned 0 [0064.783] lstrlenA (lpString="*.wmv") returned 5 [0064.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.divx") returned 0 [0064.783] lstrlenA (lpString="*.divx") returned 6 [0064.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.mkv") returned 0 [0064.783] lstrlenA (lpString="*.mkv") returned 5 [0064.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.mp3") returned 0 [0064.783] lstrlenA (lpString="*.mp3") returned 5 [0064.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.wav") returned 0 [0064.783] lstrlenA (lpString="*.wav") returned 5 [0064.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.flac") returned 0 [0064.783] lstrlenA (lpString="*.flac") returned 6 [0064.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.ape") returned 0 [0064.783] lstrlenA (lpString="*.ape") returned 5 [0064.783] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.wma") returned 0 [0064.784] lstrlenA (lpString="*.wma") returned 5 [0064.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.ac3") returned 0 [0064.784] lstrlenA (lpString="*.ac3") returned 5 [0064.784] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.mxf") returned 0 [0064.784] lstrlenA (lpString="*.mxf") returned 5 [0064.784] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b43100, ftCreationTime.dwHighDateTime=0x1ca0352, ftLastAccessTime.dwLowDateTime=0x5e4444b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x53b43100, ftLastWriteTime.dwHighDateTime=0x1ca0352, nFileSizeHigh=0x0, nFileSizeLow=0x75aa, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName="validation.js", cAlternateFileName="VALIDA~1.JS")) returned 0 [0064.784] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0064.784] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="GrooveProjectToolset", cAlternateFileName="GRA998~1")) returned 1 [0064.784] lstrcmpA (lpString1=".", lpString2="GrooveProjectToolset") returned -1 [0064.784] lstrcmpA (lpString1="..", lpString2="GrooveProjectToolset") returned -1 [0064.784] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*" [0064.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="GrooveProjectToolset" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset" [0064.784] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset") returned 90 [0064.784] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0064.787] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.787] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x540000, cFileName="..", cAlternateFileName="")) returned 1 [0064.790] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.791] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.791] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x140b, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="BriefcaseIcon.jpg", cAlternateFileName="BRIEFC~1.JPG")) returned 1 [0064.791] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.791] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BriefcaseIcon.jpg") returned 1 [0064.791] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BriefcaseIcon.jpg") returned 1 [0064.791] lstrcmpiA (lpString1="", lpString2="BriefcaseIcon.jpg") returned -1 [0064.791] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\*.*") returned="*.*" [0064.791] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0064.791] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0064.791] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0064.791] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0xffffffff [0064.791] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.793] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0064.793] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0064.794] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.794] CloseHandle (hObject=0x98) returned 1 [0064.794] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="BriefcaseIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" [0064.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.zip") returned 0 [0064.794] lstrlenA (lpString="*.zip") returned 5 [0064.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.rar") returned 0 [0064.794] lstrlenA (lpString="*.rar") returned 5 [0064.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.7z") returned 0 [0064.794] lstrlenA (lpString="*.7z") returned 4 [0064.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.tar") returned 0 [0064.794] lstrlenA (lpString="*.tar") returned 5 [0064.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.gzip") returned 0 [0064.795] lstrlenA (lpString="*.gzip") returned 6 [0064.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.jpg") returned 1 [0064.795] lstrlenA (lpString="*.jpg") returned 5 [0064.795] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" [0064.795] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" [0064.795] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg." [0064.795] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg.wannacry" [0064.795] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.796] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x140b [0064.796] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51a61ad0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea)) returned 1 [0064.796] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.796] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x138d, lpOverlapped=0x0) returned 1 [0064.800] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg") returned="BriefcaseIcon.jpg" [0064.800] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.800] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x138d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x138d, lpOverlapped=0x0) returned 1 [0064.800] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.800] CloseHandle (hObject=0x98) returned 1 [0064.800] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg.wannacry")) returned 1 [0064.801] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf76, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="BriefcaseIconMask.bmp", cAlternateFileName="BRIEFC~1.BMP")) returned 1 [0064.801] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.801] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BriefcaseIconMask.bmp") returned 1 [0064.801] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BriefcaseIconMask.bmp") returned 1 [0064.802] lstrcmpiA (lpString1="", lpString2="BriefcaseIconMask.bmp") returned -1 [0064.802] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg") returned="BriefcaseIcon.jpg" [0064.802] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0064.802] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0064.802] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0064.802] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0064.802] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="BriefcaseIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp" [0064.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.zip") returned 0 [0064.802] lstrlenA (lpString="*.zip") returned 5 [0064.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.rar") returned 0 [0064.802] lstrlenA (lpString="*.rar") returned 5 [0064.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.7z") returned 0 [0064.802] lstrlenA (lpString="*.7z") returned 4 [0064.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.tar") returned 0 [0064.802] lstrlenA (lpString="*.tar") returned 5 [0064.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.gzip") returned 0 [0064.802] lstrlenA (lpString="*.gzip") returned 6 [0064.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.jpg") returned 0 [0064.802] lstrlenA (lpString="*.jpg") returned 5 [0064.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.jpeg") returned 0 [0064.802] lstrlenA (lpString="*.jpeg") returned 6 [0064.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.psd") returned 0 [0064.803] lstrlenA (lpString="*.psd") returned 5 [0064.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.gif") returned 0 [0064.803] lstrlenA (lpString="*.gif") returned 5 [0064.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.doc") returned 0 [0064.803] lstrlenA (lpString="*.doc") returned 5 [0064.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.docx") returned 0 [0064.803] lstrlenA (lpString="*.docx") returned 6 [0064.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.xls") returned 0 [0064.803] lstrlenA (lpString="*.xls") returned 5 [0064.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.xlsx") returned 0 [0064.803] lstrlenA (lpString="*.xlsx") returned 6 [0064.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.ppt") returned 0 [0064.803] lstrlenA (lpString="*.ppt") returned 5 [0064.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.pptx") returned 0 [0064.803] lstrlenA (lpString="*.pptx") returned 6 [0064.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.pdf") returned 0 [0064.803] lstrlenA (lpString="*.pdf") returned 5 [0064.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.mov") returned 0 [0064.803] lstrlenA (lpString="*.mov") returned 5 [0064.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.m2v") returned 0 [0064.803] lstrlenA (lpString="*.m2v") returned 5 [0064.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.3gp") returned 0 [0064.803] lstrlenA (lpString="*.3gp") returned 5 [0064.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.mpeg") returned 0 [0064.803] lstrlenA (lpString="*.mpeg") returned 6 [0064.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.mpg") returned 0 [0064.803] lstrlenA (lpString="*.mpg") returned 5 [0064.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.flv") returned 0 [0064.804] lstrlenA (lpString="*.flv") returned 5 [0064.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.avi") returned 0 [0064.804] lstrlenA (lpString="*.avi") returned 5 [0064.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.mp4") returned 0 [0064.804] lstrlenA (lpString="*.mp4") returned 5 [0064.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.wmv") returned 0 [0064.804] lstrlenA (lpString="*.wmv") returned 5 [0064.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.divx") returned 0 [0064.804] lstrlenA (lpString="*.divx") returned 6 [0064.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.mkv") returned 0 [0064.804] lstrlenA (lpString="*.mkv") returned 5 [0064.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.mp3") returned 0 [0064.804] lstrlenA (lpString="*.mp3") returned 5 [0064.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.wav") returned 0 [0064.804] lstrlenA (lpString="*.wav") returned 5 [0064.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.flac") returned 0 [0064.804] lstrlenA (lpString="*.flac") returned 6 [0064.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.ape") returned 0 [0064.804] lstrlenA (lpString="*.ape") returned 5 [0064.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.wma") returned 0 [0064.804] lstrlenA (lpString="*.wma") returned 5 [0064.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.ac3") returned 0 [0064.804] lstrlenA (lpString="*.ac3") returned 5 [0064.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.mxf") returned 0 [0064.804] lstrlenA (lpString="*.mxf") returned 5 [0064.804] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x32cd, dwReserved0=0x6f006f, dwReserved1=0x73006c, cFileName="CircleIcons.jpg", cAlternateFileName="CIRCLE~1.JPG")) returned 1 [0064.805] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.805] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CircleIcons.jpg") returned 1 [0064.805] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CircleIcons.jpg") returned 1 [0064.805] lstrcmpiA (lpString1="", lpString2="CircleIcons.jpg") returned -1 [0064.805] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp") returned="BriefcaseIconMask.bmp" [0064.805] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0064.805] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0064.805] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0064.805] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0064.805] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="CircleIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" [0064.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.zip") returned 0 [0064.805] lstrlenA (lpString="*.zip") returned 5 [0064.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.rar") returned 0 [0064.805] lstrlenA (lpString="*.rar") returned 5 [0064.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.7z") returned 0 [0064.805] lstrlenA (lpString="*.7z") returned 4 [0064.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.tar") returned 0 [0064.805] lstrlenA (lpString="*.tar") returned 5 [0064.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.gzip") returned 0 [0064.805] lstrlenA (lpString="*.gzip") returned 6 [0064.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.jpg") returned 1 [0064.805] lstrlenA (lpString="*.jpg") returned 5 [0064.806] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" [0064.806] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" [0064.806] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg." [0064.806] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg.wannacry" [0064.806] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.810] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x32cd [0064.810] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60382570, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea)) returned 1 [0064.810] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.810] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x324f, lpOverlapped=0x0) returned 1 [0064.815] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg") returned="CircleIcons.jpg" [0064.815] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.815] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x324f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x324f, lpOverlapped=0x0) returned 1 [0064.816] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.816] CloseHandle (hObject=0x98) returned 1 [0064.816] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg.wannacry")) returned 1 [0064.822] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x114c, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="CircleIconsMask.bmp", cAlternateFileName="CIRCLE~1.BMP")) returned 1 [0064.822] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.822] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CircleIconsMask.bmp") returned 1 [0064.822] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CircleIconsMask.bmp") returned 1 [0064.824] lstrcmpiA (lpString1="", lpString2="CircleIconsMask.bmp") returned -1 [0064.824] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg") returned="CircleIcons.jpg" [0064.824] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0064.824] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0064.825] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0064.825] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0064.830] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="CircleIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp" [0064.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.zip") returned 0 [0064.830] lstrlenA (lpString="*.zip") returned 5 [0064.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.rar") returned 0 [0064.830] lstrlenA (lpString="*.rar") returned 5 [0064.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.7z") returned 0 [0064.830] lstrlenA (lpString="*.7z") returned 4 [0064.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.tar") returned 0 [0064.832] lstrlenA (lpString="*.tar") returned 5 [0064.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.gzip") returned 0 [0064.832] lstrlenA (lpString="*.gzip") returned 6 [0064.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.jpg") returned 0 [0064.832] lstrlenA (lpString="*.jpg") returned 5 [0064.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.jpeg") returned 0 [0064.832] lstrlenA (lpString="*.jpeg") returned 6 [0064.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.psd") returned 0 [0064.842] lstrlenA (lpString="*.psd") returned 5 [0064.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.gif") returned 0 [0064.842] lstrlenA (lpString="*.gif") returned 5 [0064.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.doc") returned 0 [0064.848] lstrlenA (lpString="*.doc") returned 5 [0064.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.docx") returned 0 [0064.848] lstrlenA (lpString="*.docx") returned 6 [0064.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.xls") returned 0 [0064.848] lstrlenA (lpString="*.xls") returned 5 [0064.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.xlsx") returned 0 [0064.848] lstrlenA (lpString="*.xlsx") returned 6 [0064.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.ppt") returned 0 [0064.848] lstrlenA (lpString="*.ppt") returned 5 [0064.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.pptx") returned 0 [0064.848] lstrlenA (lpString="*.pptx") returned 6 [0064.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.pdf") returned 0 [0064.848] lstrlenA (lpString="*.pdf") returned 5 [0064.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.mov") returned 0 [0064.848] lstrlenA (lpString="*.mov") returned 5 [0064.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.m2v") returned 0 [0064.848] lstrlenA (lpString="*.m2v") returned 5 [0064.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.3gp") returned 0 [0064.849] lstrlenA (lpString="*.3gp") returned 5 [0064.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.mpeg") returned 0 [0064.849] lstrlenA (lpString="*.mpeg") returned 6 [0064.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.mpg") returned 0 [0064.849] lstrlenA (lpString="*.mpg") returned 5 [0064.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.flv") returned 0 [0064.849] lstrlenA (lpString="*.flv") returned 5 [0064.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.avi") returned 0 [0064.849] lstrlenA (lpString="*.avi") returned 5 [0064.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.mp4") returned 0 [0064.849] lstrlenA (lpString="*.mp4") returned 5 [0064.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.wmv") returned 0 [0064.849] lstrlenA (lpString="*.wmv") returned 5 [0064.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.divx") returned 0 [0064.849] lstrlenA (lpString="*.divx") returned 6 [0064.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.mkv") returned 0 [0064.849] lstrlenA (lpString="*.mkv") returned 5 [0064.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.mp3") returned 0 [0064.849] lstrlenA (lpString="*.mp3") returned 5 [0064.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.wav") returned 0 [0064.849] lstrlenA (lpString="*.wav") returned 5 [0064.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.flac") returned 0 [0064.849] lstrlenA (lpString="*.flac") returned 6 [0064.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.ape") returned 0 [0064.849] lstrlenA (lpString="*.ape") returned 5 [0064.849] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.wma") returned 0 [0064.850] lstrlenA (lpString="*.wma") returned 5 [0064.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.ac3") returned 0 [0064.850] lstrlenA (lpString="*.ac3") returned 5 [0064.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.mxf") returned 0 [0064.850] lstrlenA (lpString="*.mxf") returned 5 [0064.850] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x26ba, dwReserved0=0x6f006f, dwReserved1=0x73006c, cFileName="MeetingIcon.jpg", cAlternateFileName="MEETIN~1.JPG")) returned 1 [0064.850] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.850] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MeetingIcon.jpg") returned -1 [0064.850] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MeetingIcon.jpg") returned -1 [0064.850] lstrcmpiA (lpString1="", lpString2="MeetingIcon.jpg") returned -1 [0064.850] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp") returned="CircleIconsMask.bmp" [0064.850] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0064.850] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0064.850] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0064.850] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0064.850] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="MeetingIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" [0064.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.zip") returned 0 [0064.850] lstrlenA (lpString="*.zip") returned 5 [0064.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.rar") returned 0 [0064.851] lstrlenA (lpString="*.rar") returned 5 [0064.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.7z") returned 0 [0064.851] lstrlenA (lpString="*.7z") returned 4 [0064.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.tar") returned 0 [0064.851] lstrlenA (lpString="*.tar") returned 5 [0064.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.gzip") returned 0 [0064.851] lstrlenA (lpString="*.gzip") returned 6 [0064.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.jpg") returned 1 [0064.851] lstrlenA (lpString="*.jpg") returned 5 [0064.851] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" [0064.851] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" [0064.851] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg." [0064.851] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg.wannacry" [0064.851] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.852] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x26ba [0064.852] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x582d2010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea)) returned 1 [0064.852] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.852] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x263c, lpOverlapped=0x0) returned 1 [0064.854] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg") returned="MeetingIcon.jpg" [0064.854] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.854] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x263c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x263c, lpOverlapped=0x0) returned 1 [0064.855] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.855] CloseHandle (hObject=0x98) returned 1 [0064.855] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg.wannacry")) returned 1 [0064.856] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6b8, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="MeetingIconMask.bmp", cAlternateFileName="MEETIN~1.BMP")) returned 1 [0064.856] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.856] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MeetingIconMask.bmp") returned -1 [0064.856] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MeetingIconMask.bmp") returned -1 [0064.856] lstrcmpiA (lpString1="", lpString2="MeetingIconMask.bmp") returned -1 [0064.856] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg") returned="MeetingIcon.jpg" [0064.856] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0064.856] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0064.856] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0064.856] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0064.857] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="MeetingIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp" [0064.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.zip") returned 0 [0064.857] lstrlenA (lpString="*.zip") returned 5 [0064.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.rar") returned 0 [0064.857] lstrlenA (lpString="*.rar") returned 5 [0064.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.7z") returned 0 [0064.857] lstrlenA (lpString="*.7z") returned 4 [0064.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.tar") returned 0 [0064.857] lstrlenA (lpString="*.tar") returned 5 [0064.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.gzip") returned 0 [0064.857] lstrlenA (lpString="*.gzip") returned 6 [0064.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.jpg") returned 0 [0064.857] lstrlenA (lpString="*.jpg") returned 5 [0064.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.jpeg") returned 0 [0064.857] lstrlenA (lpString="*.jpeg") returned 6 [0064.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.psd") returned 0 [0064.857] lstrlenA (lpString="*.psd") returned 5 [0064.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.gif") returned 0 [0064.857] lstrlenA (lpString="*.gif") returned 5 [0064.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.doc") returned 0 [0064.857] lstrlenA (lpString="*.doc") returned 5 [0064.857] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.docx") returned 0 [0064.858] lstrlenA (lpString="*.docx") returned 6 [0064.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.xls") returned 0 [0064.858] lstrlenA (lpString="*.xls") returned 5 [0064.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.xlsx") returned 0 [0064.858] lstrlenA (lpString="*.xlsx") returned 6 [0064.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.ppt") returned 0 [0064.858] lstrlenA (lpString="*.ppt") returned 5 [0064.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.pptx") returned 0 [0064.858] lstrlenA (lpString="*.pptx") returned 6 [0064.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.pdf") returned 0 [0064.858] lstrlenA (lpString="*.pdf") returned 5 [0064.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.mov") returned 0 [0064.858] lstrlenA (lpString="*.mov") returned 5 [0064.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.m2v") returned 0 [0064.858] lstrlenA (lpString="*.m2v") returned 5 [0064.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.3gp") returned 0 [0064.858] lstrlenA (lpString="*.3gp") returned 5 [0064.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.mpeg") returned 0 [0064.858] lstrlenA (lpString="*.mpeg") returned 6 [0064.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.mpg") returned 0 [0064.858] lstrlenA (lpString="*.mpg") returned 5 [0064.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.flv") returned 0 [0064.858] lstrlenA (lpString="*.flv") returned 5 [0064.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.avi") returned 0 [0064.858] lstrlenA (lpString="*.avi") returned 5 [0064.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.mp4") returned 0 [0064.859] lstrlenA (lpString="*.mp4") returned 5 [0064.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.wmv") returned 0 [0064.859] lstrlenA (lpString="*.wmv") returned 5 [0064.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.divx") returned 0 [0064.859] lstrlenA (lpString="*.divx") returned 6 [0064.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.mkv") returned 0 [0064.859] lstrlenA (lpString="*.mkv") returned 5 [0064.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.mp3") returned 0 [0064.859] lstrlenA (lpString="*.mp3") returned 5 [0064.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.wav") returned 0 [0064.859] lstrlenA (lpString="*.wav") returned 5 [0064.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.flac") returned 0 [0064.859] lstrlenA (lpString="*.flac") returned 6 [0064.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.ape") returned 0 [0064.859] lstrlenA (lpString="*.ape") returned 5 [0064.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.wma") returned 0 [0064.859] lstrlenA (lpString="*.wma") returned 5 [0064.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.ac3") returned 0 [0064.859] lstrlenA (lpString="*.ac3") returned 5 [0064.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.mxf") returned 0 [0064.859] lstrlenA (lpString="*.mxf") returned 5 [0064.860] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x19e9, dwReserved0=0x6f006f, dwReserved1=0x73006c, cFileName="ProjectStatusIcons.jpg", cAlternateFileName="PROJEC~1.JPG")) returned 1 [0064.860] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.860] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProjectStatusIcons.jpg") returned -1 [0064.860] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectStatusIcons.jpg") returned -1 [0064.860] lstrcmpiA (lpString1="", lpString2="ProjectStatusIcons.jpg") returned -1 [0064.860] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp") returned="MeetingIconMask.bmp" [0064.860] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0064.860] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0064.860] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0064.860] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0064.860] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ProjectStatusIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" [0064.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.zip") returned 0 [0064.860] lstrlenA (lpString="*.zip") returned 5 [0064.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.rar") returned 0 [0064.860] lstrlenA (lpString="*.rar") returned 5 [0064.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.7z") returned 0 [0064.860] lstrlenA (lpString="*.7z") returned 4 [0064.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.tar") returned 0 [0064.860] lstrlenA (lpString="*.tar") returned 5 [0064.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.gzip") returned 0 [0064.860] lstrlenA (lpString="*.gzip") returned 6 [0064.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.jpg") returned 1 [0064.861] lstrlenA (lpString="*.jpg") returned 5 [0064.861] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" [0064.861] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" [0064.861] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg." [0064.861] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg.wannacry" [0064.861] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.862] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19e9 [0064.862] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d084c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea)) returned 1 [0064.863] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.863] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x196b, lpOverlapped=0x0) returned 1 [0064.865] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg") returned="ProjectStatusIcons.jpg" [0064.865] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.865] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x196b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x196b, lpOverlapped=0x0) returned 1 [0064.865] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.865] CloseHandle (hObject=0x98) returned 1 [0064.865] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg.wannacry")) returned 1 [0064.866] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa10, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="ProjectStatusIconsMask.bmp", cAlternateFileName="PROJEC~1.BMP")) returned 1 [0064.866] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.866] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProjectStatusIconsMask.bmp") returned -1 [0064.866] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectStatusIconsMask.bmp") returned -1 [0064.866] lstrcmpiA (lpString1="", lpString2="ProjectStatusIconsMask.bmp") returned -1 [0064.866] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg") returned="ProjectStatusIcons.jpg" [0064.867] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0064.867] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0064.867] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0064.867] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0064.867] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ProjectStatusIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp" [0064.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.zip") returned 0 [0064.867] lstrlenA (lpString="*.zip") returned 5 [0064.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.rar") returned 0 [0064.867] lstrlenA (lpString="*.rar") returned 5 [0064.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.7z") returned 0 [0064.867] lstrlenA (lpString="*.7z") returned 4 [0064.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.tar") returned 0 [0064.867] lstrlenA (lpString="*.tar") returned 5 [0064.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.gzip") returned 0 [0064.867] lstrlenA (lpString="*.gzip") returned 6 [0064.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.jpg") returned 0 [0064.867] lstrlenA (lpString="*.jpg") returned 5 [0064.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.jpeg") returned 0 [0064.867] lstrlenA (lpString="*.jpeg") returned 6 [0064.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.psd") returned 0 [0064.867] lstrlenA (lpString="*.psd") returned 5 [0064.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.gif") returned 0 [0064.868] lstrlenA (lpString="*.gif") returned 5 [0064.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.doc") returned 0 [0064.868] lstrlenA (lpString="*.doc") returned 5 [0064.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.docx") returned 0 [0064.868] lstrlenA (lpString="*.docx") returned 6 [0064.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.xls") returned 0 [0064.868] lstrlenA (lpString="*.xls") returned 5 [0064.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.xlsx") returned 0 [0064.868] lstrlenA (lpString="*.xlsx") returned 6 [0064.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.ppt") returned 0 [0064.868] lstrlenA (lpString="*.ppt") returned 5 [0064.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.pptx") returned 0 [0064.868] lstrlenA (lpString="*.pptx") returned 6 [0064.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.pdf") returned 0 [0064.868] lstrlenA (lpString="*.pdf") returned 5 [0064.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.mov") returned 0 [0064.868] lstrlenA (lpString="*.mov") returned 5 [0064.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.m2v") returned 0 [0064.868] lstrlenA (lpString="*.m2v") returned 5 [0064.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.3gp") returned 0 [0064.868] lstrlenA (lpString="*.3gp") returned 5 [0064.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.mpeg") returned 0 [0064.868] lstrlenA (lpString="*.mpeg") returned 6 [0064.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.mpg") returned 0 [0064.868] lstrlenA (lpString="*.mpg") returned 5 [0064.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.flv") returned 0 [0064.869] lstrlenA (lpString="*.flv") returned 5 [0064.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.avi") returned 0 [0064.869] lstrlenA (lpString="*.avi") returned 5 [0064.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.mp4") returned 0 [0064.869] lstrlenA (lpString="*.mp4") returned 5 [0064.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.wmv") returned 0 [0064.869] lstrlenA (lpString="*.wmv") returned 5 [0064.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.divx") returned 0 [0064.869] lstrlenA (lpString="*.divx") returned 6 [0064.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.mkv") returned 0 [0064.869] lstrlenA (lpString="*.mkv") returned 5 [0064.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.mp3") returned 0 [0064.869] lstrlenA (lpString="*.mp3") returned 5 [0064.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.wav") returned 0 [0064.869] lstrlenA (lpString="*.wav") returned 5 [0064.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.flac") returned 0 [0064.869] lstrlenA (lpString="*.flac") returned 6 [0064.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.ape") returned 0 [0064.869] lstrlenA (lpString="*.ape") returned 5 [0064.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.wma") returned 0 [0064.869] lstrlenA (lpString="*.wma") returned 5 [0064.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.ac3") returned 0 [0064.869] lstrlenA (lpString="*.ac3") returned 5 [0064.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.mxf") returned 0 [0064.870] lstrlenA (lpString="*.mxf") returned 5 [0064.870] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x200e, dwReserved0=0x6f006f, dwReserved1=0x73006c, cFileName="ProjectTaskIcon.jpg", cAlternateFileName="PROJEC~2.JPG")) returned 1 [0064.870] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.870] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProjectTaskIcon.jpg") returned -1 [0064.870] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectTaskIcon.jpg") returned -1 [0064.870] lstrcmpiA (lpString1="", lpString2="ProjectTaskIcon.jpg") returned -1 [0064.870] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp") returned="ProjectStatusIconsMask.bmp" [0064.870] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0064.870] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0064.870] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0064.870] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0064.870] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ProjectTaskIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" [0064.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.zip") returned 0 [0064.870] lstrlenA (lpString="*.zip") returned 5 [0064.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.rar") returned 0 [0064.870] lstrlenA (lpString="*.rar") returned 5 [0064.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.7z") returned 0 [0064.870] lstrlenA (lpString="*.7z") returned 4 [0064.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.tar") returned 0 [0064.870] lstrlenA (lpString="*.tar") returned 5 [0064.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.gzip") returned 0 [0064.871] lstrlenA (lpString="*.gzip") returned 6 [0064.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.jpg") returned 1 [0064.871] lstrlenA (lpString="*.jpg") returned 5 [0064.871] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" [0064.871] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" [0064.871] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg." [0064.871] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg.wannacry" [0064.871] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.872] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x200e [0064.872] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d084c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea)) returned 1 [0064.872] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.872] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1f90, lpOverlapped=0x0) returned 1 [0064.877] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg") returned="ProjectTaskIcon.jpg" [0064.877] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.877] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1f90, lpOverlapped=0x0) returned 1 [0064.877] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.877] CloseHandle (hObject=0x98) returned 1 [0064.877] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg.wannacry")) returned 1 [0064.878] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x79c, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="ProjectTaskIconMask.bmp", cAlternateFileName="PROJEC~2.BMP")) returned 1 [0064.879] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.879] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProjectTaskIconMask.bmp") returned -1 [0064.879] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectTaskIconMask.bmp") returned -1 [0064.879] lstrcmpiA (lpString1="", lpString2="ProjectTaskIconMask.bmp") returned -1 [0064.879] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg") returned="ProjectTaskIcon.jpg" [0064.879] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0064.879] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0064.879] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0064.879] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0064.879] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ProjectTaskIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp" [0064.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.zip") returned 0 [0064.879] lstrlenA (lpString="*.zip") returned 5 [0064.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.rar") returned 0 [0064.879] lstrlenA (lpString="*.rar") returned 5 [0064.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.7z") returned 0 [0064.879] lstrlenA (lpString="*.7z") returned 4 [0064.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.tar") returned 0 [0064.879] lstrlenA (lpString="*.tar") returned 5 [0064.879] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.gzip") returned 0 [0064.880] lstrlenA (lpString="*.gzip") returned 6 [0064.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.jpg") returned 0 [0064.880] lstrlenA (lpString="*.jpg") returned 5 [0064.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.jpeg") returned 0 [0064.880] lstrlenA (lpString="*.jpeg") returned 6 [0064.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.psd") returned 0 [0064.880] lstrlenA (lpString="*.psd") returned 5 [0064.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.gif") returned 0 [0064.880] lstrlenA (lpString="*.gif") returned 5 [0064.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.doc") returned 0 [0064.880] lstrlenA (lpString="*.doc") returned 5 [0064.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.docx") returned 0 [0064.880] lstrlenA (lpString="*.docx") returned 6 [0064.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.xls") returned 0 [0064.880] lstrlenA (lpString="*.xls") returned 5 [0064.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.xlsx") returned 0 [0064.880] lstrlenA (lpString="*.xlsx") returned 6 [0064.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.ppt") returned 0 [0064.880] lstrlenA (lpString="*.ppt") returned 5 [0064.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.pptx") returned 0 [0064.880] lstrlenA (lpString="*.pptx") returned 6 [0064.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.pdf") returned 0 [0064.880] lstrlenA (lpString="*.pdf") returned 5 [0064.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.mov") returned 0 [0064.881] lstrlenA (lpString="*.mov") returned 5 [0064.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.m2v") returned 0 [0064.881] lstrlenA (lpString="*.m2v") returned 5 [0064.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.3gp") returned 0 [0064.881] lstrlenA (lpString="*.3gp") returned 5 [0064.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.mpeg") returned 0 [0064.881] lstrlenA (lpString="*.mpeg") returned 6 [0064.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.mpg") returned 0 [0064.881] lstrlenA (lpString="*.mpg") returned 5 [0064.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.flv") returned 0 [0064.881] lstrlenA (lpString="*.flv") returned 5 [0064.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.avi") returned 0 [0064.881] lstrlenA (lpString="*.avi") returned 5 [0064.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.mp4") returned 0 [0064.881] lstrlenA (lpString="*.mp4") returned 5 [0064.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.wmv") returned 0 [0064.881] lstrlenA (lpString="*.wmv") returned 5 [0064.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.divx") returned 0 [0064.881] lstrlenA (lpString="*.divx") returned 6 [0064.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.mkv") returned 0 [0064.881] lstrlenA (lpString="*.mkv") returned 5 [0064.881] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.mp3") returned 0 [0064.882] lstrlenA (lpString="*.mp3") returned 5 [0064.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.wav") returned 0 [0064.882] lstrlenA (lpString="*.wav") returned 5 [0064.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.flac") returned 0 [0064.882] lstrlenA (lpString="*.flac") returned 6 [0064.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.ape") returned 0 [0064.882] lstrlenA (lpString="*.ape") returned 5 [0064.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.wma") returned 0 [0064.882] lstrlenA (lpString="*.wma") returned 5 [0064.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.ac3") returned 0 [0064.882] lstrlenA (lpString="*.ac3") returned 5 [0064.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.mxf") returned 0 [0064.882] lstrlenA (lpString="*.mxf") returned 5 [0064.882] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x538bb350, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f006f, dwReserved1=0x73006c, cFileName="ProjectTool", cAlternateFileName="PROJEC~1")) returned 1 [0064.882] lstrcmpA (lpString1=".", lpString2="ProjectTool") returned -1 [0064.882] lstrcmpA (lpString1="..", lpString2="ProjectTool") returned -1 [0064.882] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp") returned="ProjectTaskIconMask.bmp" [0064.882] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ProjectTool" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool" [0064.882] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool") returned 102 [0064.882] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x538bb350, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f220, dwReserved1=0x2d8276, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0064.884] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.884] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x538bb350, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0064.884] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.884] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.884] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Project Report Type", cAlternateFileName="PROJEC~1")) returned 1 [0064.884] lstrcmpA (lpString1=".", lpString2="Project Report Type") returned -1 [0064.884] lstrcmpA (lpString1="..", lpString2="Project Report Type") returned -1 [0064.884] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\*.*") returned="*.*" [0064.884] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\", lpString2="Project Report Type" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type" [0064.884] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type") returned 122 [0064.884] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23d8, dwReserved1=0x2e23d3, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0064.884] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.884] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0064.884] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.884] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.884] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6073a7d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Basic", cAlternateFileName="")) returned 1 [0064.885] lstrcmpA (lpString1=".", lpString2="Basic") returned -1 [0064.885] lstrcmpA (lpString1="..", lpString2="Basic") returned -1 [0064.885] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\*.*") returned="*.*" [0064.885] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\", lpString2="Basic" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic" [0064.885] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic") returned 128 [0064.885] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6073a7d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e43e0, dwReserved1=0x2e43db, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0064.886] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.886] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6073a7d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0064.886] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.886] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.886] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xced, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DEFAULT.XSL", cAlternateFileName="")) returned 1 [0064.886] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0064.908] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DEFAULT.XSL") returned 1 [0064.908] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DEFAULT.XSL") returned 1 [0064.908] lstrcmpiA (lpString1="", lpString2="DEFAULT.XSL") returned -1 [0064.908] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\*.*") returned="*.*" [0064.908] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\" [0064.908] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\") returned="" [0064.908] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\HOW TO DECRYPT FILES.txt" [0064.908] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\basic\\how to decrypt files.txt")) returned 0xffffffff [0064.908] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\basic\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0064.909] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0064.909] WriteFile (in: hFile=0xa4, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0064.911] SetFileTime (hFile=0xa4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.911] CloseHandle (hObject=0xa4) returned 1 [0064.912] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\", lpString2="DEFAULT.XSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL" [0064.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.zip") returned 0 [0064.912] lstrlenA (lpString="*.zip") returned 5 [0064.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.rar") returned 0 [0064.912] lstrlenA (lpString="*.rar") returned 5 [0064.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.7z") returned 0 [0064.912] lstrlenA (lpString="*.7z") returned 4 [0064.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.tar") returned 0 [0064.912] lstrlenA (lpString="*.tar") returned 5 [0064.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.gzip") returned 0 [0064.912] lstrlenA (lpString="*.gzip") returned 6 [0064.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.jpg") returned 0 [0064.912] lstrlenA (lpString="*.jpg") returned 5 [0064.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.jpeg") returned 0 [0064.912] lstrlenA (lpString="*.jpeg") returned 6 [0064.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.psd") returned 0 [0064.912] lstrlenA (lpString="*.psd") returned 5 [0064.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.gif") returned 0 [0064.912] lstrlenA (lpString="*.gif") returned 5 [0064.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.doc") returned 0 [0064.912] lstrlenA (lpString="*.doc") returned 5 [0064.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.docx") returned 0 [0064.912] lstrlenA (lpString="*.docx") returned 6 [0064.912] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.xls") returned 0 [0064.913] lstrlenA (lpString="*.xls") returned 5 [0064.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.xlsx") returned 0 [0064.913] lstrlenA (lpString="*.xlsx") returned 6 [0064.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.ppt") returned 0 [0064.913] lstrlenA (lpString="*.ppt") returned 5 [0064.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.pptx") returned 0 [0064.913] lstrlenA (lpString="*.pptx") returned 6 [0064.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.pdf") returned 0 [0064.913] lstrlenA (lpString="*.pdf") returned 5 [0064.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mov") returned 0 [0064.913] lstrlenA (lpString="*.mov") returned 5 [0064.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.m2v") returned 0 [0064.913] lstrlenA (lpString="*.m2v") returned 5 [0064.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.3gp") returned 0 [0064.913] lstrlenA (lpString="*.3gp") returned 5 [0064.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mpeg") returned 0 [0064.913] lstrlenA (lpString="*.mpeg") returned 6 [0064.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mpg") returned 0 [0064.913] lstrlenA (lpString="*.mpg") returned 5 [0064.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.flv") returned 0 [0064.913] lstrlenA (lpString="*.flv") returned 5 [0064.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.avi") returned 0 [0064.913] lstrlenA (lpString="*.avi") returned 5 [0064.913] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mp4") returned 0 [0064.913] lstrlenA (lpString="*.mp4") returned 5 [0064.914] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.wmv") returned 0 [0064.914] lstrlenA (lpString="*.wmv") returned 5 [0064.914] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.divx") returned 0 [0064.914] lstrlenA (lpString="*.divx") returned 6 [0064.914] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mkv") returned 0 [0064.914] lstrlenA (lpString="*.mkv") returned 5 [0064.914] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mp3") returned 0 [0064.914] lstrlenA (lpString="*.mp3") returned 5 [0064.914] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.wav") returned 0 [0064.914] lstrlenA (lpString="*.wav") returned 5 [0064.914] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.flac") returned 0 [0064.914] lstrlenA (lpString="*.flac") returned 6 [0064.914] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.ape") returned 0 [0064.914] lstrlenA (lpString="*.ape") returned 5 [0064.914] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.wma") returned 0 [0064.914] lstrlenA (lpString="*.wma") returned 5 [0064.914] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.ac3") returned 0 [0064.914] lstrlenA (lpString="*.ac3") returned 5 [0064.914] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mxf") returned 0 [0064.914] lstrlenA (lpString="*.mxf") returned 5 [0064.914] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xced, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DEFAULT.XSL", cAlternateFileName="")) returned 0 [0064.914] FindClose (in: hFindFile=0x2e34b8 | out: hFindFile=0x2e34b8) returned 1 [0064.915] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Fancy", cAlternateFileName="")) returned 1 [0064.915] lstrcmpA (lpString1=".", lpString2="Fancy") returned -1 [0064.915] lstrcmpA (lpString1="..", lpString2="Fancy") returned -1 [0064.915] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\*.*") returned="*.*" [0064.915] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\", lpString2="Fancy" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy" [0064.915] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy") returned 128 [0064.915] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0064.938] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0064.938] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0064.938] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0064.938] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0064.938] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c5, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Hierarchy.js", cAlternateFileName="HIERAR~1.JS")) returned 1 [0064.938] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0064.938] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Hierarchy.js") returned -1 [0064.938] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Hierarchy.js") returned 1 [0064.938] lstrcmpiA (lpString1="", lpString2="Hierarchy.js") returned -1 [0064.938] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\*.*") returned="*.*" [0064.938] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" [0064.938] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned="" [0064.938] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt" [0064.938] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\how to decrypt files.txt")) returned 0xffffffff [0064.939] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0064.940] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0064.940] WriteFile (in: hFile=0xa4, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0064.941] SetFileTime (hFile=0xa4, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0064.941] CloseHandle (hObject=0xa4) returned 1 [0064.941] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="Hierarchy.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js" [0064.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.zip") returned 0 [0064.941] lstrlenA (lpString="*.zip") returned 5 [0064.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.rar") returned 0 [0064.941] lstrlenA (lpString="*.rar") returned 5 [0064.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.7z") returned 0 [0064.941] lstrlenA (lpString="*.7z") returned 4 [0064.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.tar") returned 0 [0064.942] lstrlenA (lpString="*.tar") returned 5 [0064.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.gzip") returned 0 [0064.942] lstrlenA (lpString="*.gzip") returned 6 [0064.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.jpg") returned 0 [0064.942] lstrlenA (lpString="*.jpg") returned 5 [0064.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.jpeg") returned 0 [0064.942] lstrlenA (lpString="*.jpeg") returned 6 [0064.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.psd") returned 0 [0064.942] lstrlenA (lpString="*.psd") returned 5 [0064.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.gif") returned 0 [0064.942] lstrlenA (lpString="*.gif") returned 5 [0064.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.doc") returned 0 [0064.942] lstrlenA (lpString="*.doc") returned 5 [0064.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.docx") returned 0 [0064.942] lstrlenA (lpString="*.docx") returned 6 [0064.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.xls") returned 0 [0064.942] lstrlenA (lpString="*.xls") returned 5 [0064.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.xlsx") returned 0 [0064.942] lstrlenA (lpString="*.xlsx") returned 6 [0064.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.ppt") returned 0 [0064.942] lstrlenA (lpString="*.ppt") returned 5 [0064.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.pptx") returned 0 [0064.942] lstrlenA (lpString="*.pptx") returned 6 [0064.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.pdf") returned 0 [0064.943] lstrlenA (lpString="*.pdf") returned 5 [0064.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.mov") returned 0 [0064.943] lstrlenA (lpString="*.mov") returned 5 [0064.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.m2v") returned 0 [0064.943] lstrlenA (lpString="*.m2v") returned 5 [0064.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.3gp") returned 0 [0064.943] lstrlenA (lpString="*.3gp") returned 5 [0064.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.mpeg") returned 0 [0064.943] lstrlenA (lpString="*.mpeg") returned 6 [0064.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.mpg") returned 0 [0064.943] lstrlenA (lpString="*.mpg") returned 5 [0064.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.flv") returned 0 [0064.943] lstrlenA (lpString="*.flv") returned 5 [0064.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.avi") returned 0 [0064.943] lstrlenA (lpString="*.avi") returned 5 [0064.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.mp4") returned 0 [0064.943] lstrlenA (lpString="*.mp4") returned 5 [0064.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.wmv") returned 0 [0064.943] lstrlenA (lpString="*.wmv") returned 5 [0064.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.divx") returned 0 [0064.943] lstrlenA (lpString="*.divx") returned 6 [0064.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.mkv") returned 0 [0064.943] lstrlenA (lpString="*.mkv") returned 5 [0064.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.mp3") returned 0 [0064.943] lstrlenA (lpString="*.mp3") returned 5 [0064.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.wav") returned 0 [0064.944] lstrlenA (lpString="*.wav") returned 5 [0064.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.flac") returned 0 [0064.944] lstrlenA (lpString="*.flac") returned 6 [0064.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.ape") returned 0 [0064.944] lstrlenA (lpString="*.ape") returned 5 [0064.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.wma") returned 0 [0064.944] lstrlenA (lpString="*.wma") returned 5 [0064.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.ac3") returned 0 [0064.944] lstrlenA (lpString="*.ac3") returned 5 [0064.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.mxf") returned 0 [0064.944] lstrlenA (lpString="*.mxf") returned 5 [0064.944] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x157e, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName="Hierarchy.xsl", cAlternateFileName="HIERAR~1.XSL")) returned 1 [0064.944] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0064.944] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Hierarchy.xsl") returned -1 [0064.944] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Hierarchy.xsl") returned 1 [0064.944] lstrcmpiA (lpString1="", lpString2="Hierarchy.xsl") returned -1 [0064.944] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js") returned="Hierarchy.js" [0064.944] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" [0064.944] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned="" [0064.944] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt" [0064.944] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\how to decrypt files.txt")) returned 0x20 [0064.945] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="Hierarchy.xsl" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl" [0064.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.zip") returned 0 [0064.945] lstrlenA (lpString="*.zip") returned 5 [0064.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.rar") returned 0 [0064.945] lstrlenA (lpString="*.rar") returned 5 [0064.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.7z") returned 0 [0064.945] lstrlenA (lpString="*.7z") returned 4 [0064.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.tar") returned 0 [0064.945] lstrlenA (lpString="*.tar") returned 5 [0064.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.gzip") returned 0 [0064.945] lstrlenA (lpString="*.gzip") returned 6 [0064.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.jpg") returned 0 [0064.945] lstrlenA (lpString="*.jpg") returned 5 [0064.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.jpeg") returned 0 [0064.945] lstrlenA (lpString="*.jpeg") returned 6 [0064.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.psd") returned 0 [0064.945] lstrlenA (lpString="*.psd") returned 5 [0064.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.gif") returned 0 [0064.945] lstrlenA (lpString="*.gif") returned 5 [0064.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.doc") returned 0 [0064.945] lstrlenA (lpString="*.doc") returned 5 [0064.945] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.docx") returned 0 [0064.946] lstrlenA (lpString="*.docx") returned 6 [0064.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.xls") returned 0 [0064.946] lstrlenA (lpString="*.xls") returned 5 [0064.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.xlsx") returned 0 [0064.946] lstrlenA (lpString="*.xlsx") returned 6 [0064.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.ppt") returned 0 [0064.946] lstrlenA (lpString="*.ppt") returned 5 [0064.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.pptx") returned 0 [0064.946] lstrlenA (lpString="*.pptx") returned 6 [0064.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.pdf") returned 0 [0064.946] lstrlenA (lpString="*.pdf") returned 5 [0064.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.mov") returned 0 [0064.946] lstrlenA (lpString="*.mov") returned 5 [0064.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.m2v") returned 0 [0064.946] lstrlenA (lpString="*.m2v") returned 5 [0064.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.3gp") returned 0 [0064.946] lstrlenA (lpString="*.3gp") returned 5 [0064.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.mpeg") returned 0 [0064.946] lstrlenA (lpString="*.mpeg") returned 6 [0064.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.mpg") returned 0 [0064.946] lstrlenA (lpString="*.mpg") returned 5 [0064.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.flv") returned 0 [0064.946] lstrlenA (lpString="*.flv") returned 5 [0064.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.avi") returned 0 [0064.946] lstrlenA (lpString="*.avi") returned 5 [0064.946] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.mp4") returned 0 [0064.947] lstrlenA (lpString="*.mp4") returned 5 [0064.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.wmv") returned 0 [0064.947] lstrlenA (lpString="*.wmv") returned 5 [0064.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.divx") returned 0 [0064.947] lstrlenA (lpString="*.divx") returned 6 [0064.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.mkv") returned 0 [0064.947] lstrlenA (lpString="*.mkv") returned 5 [0064.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.mp3") returned 0 [0064.947] lstrlenA (lpString="*.mp3") returned 5 [0064.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.wav") returned 0 [0064.947] lstrlenA (lpString="*.wav") returned 5 [0064.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.flac") returned 0 [0064.947] lstrlenA (lpString="*.flac") returned 6 [0064.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.ape") returned 0 [0064.947] lstrlenA (lpString="*.ape") returned 5 [0064.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.wma") returned 0 [0064.947] lstrlenA (lpString="*.wma") returned 5 [0064.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.ac3") returned 0 [0064.947] lstrlenA (lpString="*.ac3") returned 5 [0064.947] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.mxf") returned 0 [0064.947] lstrlenA (lpString="*.mxf") returned 5 [0064.947] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x345, dwReserved0=0x6f006f, dwReserved1=0x73006c, cFileName="MINUS.GIF", cAlternateFileName="")) returned 1 [0064.947] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0064.947] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MINUS.GIF") returned -1 [0064.947] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MINUS.GIF") returned -1 [0064.948] lstrcmpiA (lpString1="", lpString2="MINUS.GIF") returned -1 [0064.948] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl") returned="Hierarchy.xsl" [0064.948] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" [0064.948] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned="" [0064.948] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt" [0064.948] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\how to decrypt files.txt")) returned 0x20 [0064.948] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="MINUS.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF" [0064.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.zip") returned 0 [0064.948] lstrlenA (lpString="*.zip") returned 5 [0064.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.rar") returned 0 [0064.948] lstrlenA (lpString="*.rar") returned 5 [0064.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.7z") returned 0 [0064.948] lstrlenA (lpString="*.7z") returned 4 [0064.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.tar") returned 0 [0064.948] lstrlenA (lpString="*.tar") returned 5 [0064.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.gzip") returned 0 [0064.948] lstrlenA (lpString="*.gzip") returned 6 [0064.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.jpg") returned 0 [0064.948] lstrlenA (lpString="*.jpg") returned 5 [0064.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.jpeg") returned 0 [0064.948] lstrlenA (lpString="*.jpeg") returned 6 [0064.948] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.psd") returned 0 [0064.948] lstrlenA (lpString="*.psd") returned 5 [0064.949] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.gif") returned 1 [0064.949] lstrlenA (lpString="*.gif") returned 5 [0064.949] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF" [0064.949] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF" [0064.949] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF." [0064.949] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF.wannacry" [0064.949] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\minus.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0064.951] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x345 [0064.951] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x69c4c990, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1 [0064.951] SetFilePointer (in: hFile=0xa4, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.951] ReadFile (in: hFile=0xa4, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2c7, lpOverlapped=0x0) returned 1 [0064.953] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF") returned="MINUS.GIF" [0064.953] SetFilePointer (in: hFile=0xa4, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.953] WriteFile (in: hFile=0xa4, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2c7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2c7, lpOverlapped=0x0) returned 1 [0064.953] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.953] CloseHandle (hObject=0xa4) returned 1 [0064.953] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\minus.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\minus.gif.wannacry")) returned 1 [0064.955] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a497830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x349, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="PLUS.GIF", cAlternateFileName="")) returned 1 [0064.955] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0064.955] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PLUS.GIF") returned -1 [0064.955] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PLUS.GIF") returned -1 [0064.955] lstrcmpiA (lpString1="", lpString2="PLUS.GIF") returned -1 [0064.955] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF") returned="MINUS.GIF" [0064.955] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" [0064.955] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned="" [0064.955] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt" [0064.955] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\how to decrypt files.txt")) returned 0x20 [0064.955] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="PLUS.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF" [0064.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.zip") returned 0 [0064.955] lstrlenA (lpString="*.zip") returned 5 [0064.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.rar") returned 0 [0064.955] lstrlenA (lpString="*.rar") returned 5 [0064.955] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.7z") returned 0 [0064.955] lstrlenA (lpString="*.7z") returned 4 [0064.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.tar") returned 0 [0064.956] lstrlenA (lpString="*.tar") returned 5 [0064.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.gzip") returned 0 [0064.956] lstrlenA (lpString="*.gzip") returned 6 [0064.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.jpg") returned 0 [0064.956] lstrlenA (lpString="*.jpg") returned 5 [0064.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.jpeg") returned 0 [0064.956] lstrlenA (lpString="*.jpeg") returned 6 [0064.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.psd") returned 0 [0064.956] lstrlenA (lpString="*.psd") returned 5 [0064.956] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.gif") returned 1 [0064.956] lstrlenA (lpString="*.gif") returned 5 [0064.956] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF" [0064.956] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF" [0064.956] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF." [0064.956] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF.wannacry" [0064.956] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\plus.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0064.960] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x349 [0064.960] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a497830, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1 [0064.960] SetFilePointer (in: hFile=0xa4, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.961] ReadFile (in: hFile=0xa4, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2cb, lpOverlapped=0x0) returned 1 [0064.962] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF") returned="PLUS.GIF" [0064.962] SetFilePointer (in: hFile=0xa4, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.963] WriteFile (in: hFile=0xa4, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2cb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2cb, lpOverlapped=0x0) returned 1 [0064.963] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.963] CloseHandle (hObject=0xa4) returned 1 [0064.963] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\plus.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\plus.gif.wannacry")) returned 1 [0064.964] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="SPACER.GIF", cAlternateFileName="")) returned 1 [0064.964] PeekMessageA (in: lpMsg=0x18f0f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f0f4) returned 0 [0064.964] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SPACER.GIF") returned -1 [0064.965] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SPACER.GIF") returned -1 [0064.965] lstrcmpiA (lpString1="", lpString2="SPACER.GIF") returned -1 [0064.965] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF") returned="PLUS.GIF" [0064.965] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" [0064.965] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned="" [0064.965] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt" [0064.965] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\how to decrypt files.txt")) returned 0x20 [0064.965] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="SPACER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF" [0064.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.zip") returned 0 [0064.965] lstrlenA (lpString="*.zip") returned 5 [0064.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.rar") returned 0 [0064.965] lstrlenA (lpString="*.rar") returned 5 [0064.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.7z") returned 0 [0064.965] lstrlenA (lpString="*.7z") returned 4 [0064.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.tar") returned 0 [0064.965] lstrlenA (lpString="*.tar") returned 5 [0064.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.gzip") returned 0 [0064.965] lstrlenA (lpString="*.gzip") returned 6 [0064.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.jpg") returned 0 [0064.965] lstrlenA (lpString="*.jpg") returned 5 [0064.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.jpeg") returned 0 [0064.965] lstrlenA (lpString="*.jpeg") returned 6 [0064.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.psd") returned 0 [0064.966] lstrlenA (lpString="*.psd") returned 5 [0064.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.gif") returned 1 [0064.966] lstrlenA (lpString="*.gif") returned 5 [0064.966] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF" [0064.966] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF" [0064.966] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF." [0064.966] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF.wannacry" [0064.966] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\spacer.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0064.967] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x327 [0064.967] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5aad71f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1 [0064.967] SetFilePointer (in: hFile=0xa4, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.967] ReadFile (in: hFile=0xa4, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2a9, lpOverlapped=0x0) returned 1 [0064.969] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF") returned="SPACER.GIF" [0064.969] SetFilePointer (in: hFile=0xa4, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.969] WriteFile (in: hFile=0xa4, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2a9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2a9, lpOverlapped=0x0) returned 1 [0064.969] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.969] CloseHandle (hObject=0xa4) returned 1 [0064.969] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\spacer.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\spacer.gif.wannacry")) returned 1 [0064.970] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="SPACER.GIF", cAlternateFileName="")) returned 0 [0064.971] FindClose (in: hFindFile=0x2e34b8 | out: hFindFile=0x2e34b8) returned 1 [0064.971] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Fancy", cAlternateFileName="")) returned 0 [0064.971] FindClose (in: hFindFile=0x2e3478 | out: hFindFile=0x2e3478) returned 1 [0064.971] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Project Report Type", cAlternateFileName="PROJEC~1")) returned 0 [0064.971] FindClose (in: hFindFile=0x2e3438 | out: hFindFile=0x2e3438) returned 1 [0064.971] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4f0a, dwReserved0=0x720050, dwReserved1=0x3, cFileName="ProjectToolsetIconImages.jpg", cAlternateFileName="PROJEC~3.JPG")) returned 1 [0064.971] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.971] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProjectToolsetIconImages.jpg") returned -1 [0064.971] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectToolsetIconImages.jpg") returned -1 [0064.971] lstrcmpiA (lpString1="", lpString2="ProjectToolsetIconImages.jpg") returned -1 [0064.971] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\*.*") returned="*.*" [0064.971] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0064.971] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0064.971] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0064.971] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0064.971] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ProjectToolsetIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" [0064.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", pszSpec="*.zip") returned 0 [0064.971] lstrlenA (lpString="*.zip") returned 5 [0064.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", pszSpec="*.rar") returned 0 [0064.972] lstrlenA (lpString="*.rar") returned 5 [0064.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", pszSpec="*.7z") returned 0 [0064.972] lstrlenA (lpString="*.7z") returned 4 [0064.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", pszSpec="*.tar") returned 0 [0064.972] lstrlenA (lpString="*.tar") returned 5 [0064.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", pszSpec="*.gzip") returned 0 [0064.972] lstrlenA (lpString="*.gzip") returned 6 [0064.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", pszSpec="*.jpg") returned 1 [0064.972] lstrlenA (lpString="*.jpg") returned 5 [0064.972] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" [0064.972] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" [0064.972] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg." [0064.972] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg.wannacry" [0064.972] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.973] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f0a [0064.973] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d084c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1 [0064.973] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.973] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4e8c, lpOverlapped=0x0) returned 1 [0064.975] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg") returned="ProjectToolsetIconImages.jpg" [0064.975] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.975] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4e8c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4e8c, lpOverlapped=0x0) returned 1 [0064.979] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.979] CloseHandle (hObject=0x98) returned 1 [0064.979] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg.wannacry")) returned 1 [0064.980] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2338, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="ProjectToolsetIconImagesMask.bmp", cAlternateFileName="PROJEC~3.BMP")) returned 1 [0064.980] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.980] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProjectToolsetIconImagesMask.bmp") returned -1 [0064.980] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectToolsetIconImagesMask.bmp") returned -1 [0064.980] lstrcmpiA (lpString1="", lpString2="ProjectToolsetIconImagesMask.bmp") returned -1 [0064.980] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg") returned="ProjectToolsetIconImages.jpg" [0064.980] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0064.980] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0064.980] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0064.980] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0064.980] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ProjectToolsetIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp" [0064.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0064.980] lstrlenA (lpString="*.zip") returned 5 [0064.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0064.980] lstrlenA (lpString="*.rar") returned 5 [0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0064.981] lstrlenA (lpString="*.7z") returned 4 [0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0064.981] lstrlenA (lpString="*.tar") returned 5 [0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0064.981] lstrlenA (lpString="*.gzip") returned 6 [0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0064.981] lstrlenA (lpString="*.jpg") returned 5 [0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0064.981] lstrlenA (lpString="*.jpeg") returned 6 [0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0064.981] lstrlenA (lpString="*.psd") returned 5 [0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.gif") returned 0 [0064.981] lstrlenA (lpString="*.gif") returned 5 [0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.doc") returned 0 [0064.981] lstrlenA (lpString="*.doc") returned 5 [0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.docx") returned 0 [0064.981] lstrlenA (lpString="*.docx") returned 6 [0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.xls") returned 0 [0064.981] lstrlenA (lpString="*.xls") returned 5 [0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.xlsx") returned 0 [0064.981] lstrlenA (lpString="*.xlsx") returned 6 [0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.ppt") returned 0 [0064.981] lstrlenA (lpString="*.ppt") returned 5 [0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.pptx") returned 0 [0064.981] lstrlenA (lpString="*.pptx") returned 6 [0064.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.pdf") returned 0 [0064.982] lstrlenA (lpString="*.pdf") returned 5 [0064.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.mov") returned 0 [0064.982] lstrlenA (lpString="*.mov") returned 5 [0064.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.m2v") returned 0 [0064.982] lstrlenA (lpString="*.m2v") returned 5 [0064.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.3gp") returned 0 [0064.982] lstrlenA (lpString="*.3gp") returned 5 [0064.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.mpeg") returned 0 [0064.982] lstrlenA (lpString="*.mpeg") returned 6 [0064.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.mpg") returned 0 [0064.982] lstrlenA (lpString="*.mpg") returned 5 [0064.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.flv") returned 0 [0064.982] lstrlenA (lpString="*.flv") returned 5 [0064.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.avi") returned 0 [0064.982] lstrlenA (lpString="*.avi") returned 5 [0064.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.mp4") returned 0 [0064.982] lstrlenA (lpString="*.mp4") returned 5 [0064.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.wmv") returned 0 [0064.982] lstrlenA (lpString="*.wmv") returned 5 [0064.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.divx") returned 0 [0064.982] lstrlenA (lpString="*.divx") returned 6 [0064.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.mkv") returned 0 [0064.982] lstrlenA (lpString="*.mkv") returned 5 [0064.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.mp3") returned 0 [0064.982] lstrlenA (lpString="*.mp3") returned 5 [0064.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.wav") returned 0 [0064.982] lstrlenA (lpString="*.wav") returned 5 [0064.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.flac") returned 0 [0064.983] lstrlenA (lpString="*.flac") returned 6 [0064.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.ape") returned 0 [0064.983] lstrlenA (lpString="*.ape") returned 5 [0064.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.wma") returned 0 [0064.983] lstrlenA (lpString="*.wma") returned 5 [0064.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.ac3") returned 0 [0064.983] lstrlenA (lpString="*.ac3") returned 5 [0064.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.mxf") returned 0 [0064.983] lstrlenA (lpString="*.mxf") returned 5 [0064.983] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5f00, dwReserved0=0x6f006f, dwReserved1=0x73006c, cFileName="SplashImage.jpg", cAlternateFileName="SPLASH~1.JPG")) returned 1 [0064.983] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.983] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SplashImage.jpg") returned -1 [0064.983] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SplashImage.jpg") returned -1 [0064.983] lstrcmpiA (lpString1="", lpString2="SplashImage.jpg") returned -1 [0064.983] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp") returned="ProjectToolsetIconImagesMask.bmp" [0064.983] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0064.983] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0064.983] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0064.983] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0064.983] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="SplashImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" [0064.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.zip") returned 0 [0064.983] lstrlenA (lpString="*.zip") returned 5 [0064.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.rar") returned 0 [0064.984] lstrlenA (lpString="*.rar") returned 5 [0064.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.7z") returned 0 [0064.984] lstrlenA (lpString="*.7z") returned 4 [0064.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.tar") returned 0 [0064.984] lstrlenA (lpString="*.tar") returned 5 [0064.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.gzip") returned 0 [0064.984] lstrlenA (lpString="*.gzip") returned 6 [0064.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.jpg") returned 1 [0064.984] lstrlenA (lpString="*.jpg") returned 5 [0064.984] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" [0064.984] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" [0064.984] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg." [0064.984] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg.wannacry" [0064.984] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.985] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5f00 [0064.985] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d3a4910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1 [0064.985] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.985] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x5e82, lpOverlapped=0x0) returned 1 [0064.988] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg") returned="SplashImage.jpg" [0064.988] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.988] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x5e82, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x5e82, lpOverlapped=0x0) returned 1 [0064.988] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0064.988] CloseHandle (hObject=0x98) returned 1 [0064.989] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg.wannacry")) returned 1 [0064.990] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x14078, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="SplashImageMask.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0064.990] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.990] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SplashImageMask.bmp") returned -1 [0064.990] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SplashImageMask.bmp") returned -1 [0064.990] lstrcmpiA (lpString1="", lpString2="SplashImageMask.bmp") returned -1 [0064.990] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg") returned="SplashImage.jpg" [0064.990] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0064.990] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0064.990] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0064.990] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0064.990] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="SplashImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp" [0064.990] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.zip") returned 0 [0064.990] lstrlenA (lpString="*.zip") returned 5 [0064.990] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.rar") returned 0 [0064.990] lstrlenA (lpString="*.rar") returned 5 [0064.990] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.7z") returned 0 [0064.990] lstrlenA (lpString="*.7z") returned 4 [0064.990] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.tar") returned 0 [0064.990] lstrlenA (lpString="*.tar") returned 5 [0064.991] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.gzip") returned 0 [0064.991] lstrlenA (lpString="*.gzip") returned 6 [0064.991] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.jpg") returned 0 [0064.991] lstrlenA (lpString="*.jpg") returned 5 [0064.991] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.jpeg") returned 0 [0064.991] lstrlenA (lpString="*.jpeg") returned 6 [0064.991] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.psd") returned 0 [0064.991] lstrlenA (lpString="*.psd") returned 5 [0064.991] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.gif") returned 0 [0064.991] lstrlenA (lpString="*.gif") returned 5 [0064.991] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.doc") returned 0 [0064.991] lstrlenA (lpString="*.doc") returned 5 [0064.991] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.docx") returned 0 [0064.991] lstrlenA (lpString="*.docx") returned 6 [0064.991] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.xls") returned 0 [0064.991] lstrlenA (lpString="*.xls") returned 5 [0064.991] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.xlsx") returned 0 [0064.991] lstrlenA (lpString="*.xlsx") returned 6 [0064.991] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.ppt") returned 0 [0064.991] lstrlenA (lpString="*.ppt") returned 5 [0064.991] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.pptx") returned 0 [0064.991] lstrlenA (lpString="*.pptx") returned 6 [0064.991] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.pdf") returned 0 [0064.991] lstrlenA (lpString="*.pdf") returned 5 [0064.991] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.mov") returned 0 [0064.991] lstrlenA (lpString="*.mov") returned 5 [0064.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.m2v") returned 0 [0064.992] lstrlenA (lpString="*.m2v") returned 5 [0064.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.3gp") returned 0 [0064.992] lstrlenA (lpString="*.3gp") returned 5 [0064.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.mpeg") returned 0 [0064.992] lstrlenA (lpString="*.mpeg") returned 6 [0064.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.mpg") returned 0 [0064.992] lstrlenA (lpString="*.mpg") returned 5 [0064.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.flv") returned 0 [0064.992] lstrlenA (lpString="*.flv") returned 5 [0064.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.avi") returned 0 [0064.992] lstrlenA (lpString="*.avi") returned 5 [0064.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.mp4") returned 0 [0064.992] lstrlenA (lpString="*.mp4") returned 5 [0064.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.wmv") returned 0 [0064.992] lstrlenA (lpString="*.wmv") returned 5 [0064.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.divx") returned 0 [0064.992] lstrlenA (lpString="*.divx") returned 6 [0064.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.mkv") returned 0 [0064.992] lstrlenA (lpString="*.mkv") returned 5 [0064.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.mp3") returned 0 [0064.992] lstrlenA (lpString="*.mp3") returned 5 [0064.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.wav") returned 0 [0064.992] lstrlenA (lpString="*.wav") returned 5 [0064.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.flac") returned 0 [0064.992] lstrlenA (lpString="*.flac") returned 6 [0064.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.ape") returned 0 [0064.993] lstrlenA (lpString="*.ape") returned 5 [0064.993] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.wma") returned 0 [0064.993] lstrlenA (lpString="*.wma") returned 5 [0064.993] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.ac3") returned 0 [0064.993] lstrlenA (lpString="*.ac3") returned 5 [0064.993] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.mxf") returned 0 [0064.993] lstrlenA (lpString="*.mxf") returned 5 [0064.993] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x6f006f, dwReserved1=0x73006c, cFileName="TABMASK.BMP", cAlternateFileName="")) returned 1 [0064.993] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.993] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TABMASK.BMP") returned -1 [0064.993] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TABMASK.BMP") returned -1 [0064.993] lstrcmpiA (lpString1="", lpString2="TABMASK.BMP") returned -1 [0064.993] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp") returned="SplashImageMask.bmp" [0064.993] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0064.993] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0064.993] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0064.993] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0064.993] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="TABMASK.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP" [0064.993] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.zip") returned 0 [0064.993] lstrlenA (lpString="*.zip") returned 5 [0064.993] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.rar") returned 0 [0064.993] lstrlenA (lpString="*.rar") returned 5 [0064.994] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.7z") returned 0 [0064.994] lstrlenA (lpString="*.7z") returned 4 [0064.994] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.tar") returned 0 [0064.994] lstrlenA (lpString="*.tar") returned 5 [0064.994] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.gzip") returned 0 [0064.994] lstrlenA (lpString="*.gzip") returned 6 [0064.994] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.jpg") returned 0 [0064.994] lstrlenA (lpString="*.jpg") returned 5 [0064.994] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.jpeg") returned 0 [0064.994] lstrlenA (lpString="*.jpeg") returned 6 [0064.994] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.psd") returned 0 [0064.994] lstrlenA (lpString="*.psd") returned 5 [0064.994] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.gif") returned 0 [0064.994] lstrlenA (lpString="*.gif") returned 5 [0064.994] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.doc") returned 0 [0064.994] lstrlenA (lpString="*.doc") returned 5 [0064.994] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.docx") returned 0 [0064.994] lstrlenA (lpString="*.docx") returned 6 [0064.994] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.xls") returned 0 [0064.994] lstrlenA (lpString="*.xls") returned 5 [0064.994] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.xlsx") returned 0 [0064.994] lstrlenA (lpString="*.xlsx") returned 6 [0064.994] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.ppt") returned 0 [0064.994] lstrlenA (lpString="*.ppt") returned 5 [0064.994] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.pptx") returned 0 [0064.995] lstrlenA (lpString="*.pptx") returned 6 [0064.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.pdf") returned 0 [0064.995] lstrlenA (lpString="*.pdf") returned 5 [0064.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.mov") returned 0 [0064.995] lstrlenA (lpString="*.mov") returned 5 [0064.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.m2v") returned 0 [0064.995] lstrlenA (lpString="*.m2v") returned 5 [0064.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.3gp") returned 0 [0064.995] lstrlenA (lpString="*.3gp") returned 5 [0064.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.mpeg") returned 0 [0064.995] lstrlenA (lpString="*.mpeg") returned 6 [0064.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.mpg") returned 0 [0064.995] lstrlenA (lpString="*.mpg") returned 5 [0064.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.flv") returned 0 [0064.995] lstrlenA (lpString="*.flv") returned 5 [0064.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.avi") returned 0 [0064.995] lstrlenA (lpString="*.avi") returned 5 [0064.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.mp4") returned 0 [0064.995] lstrlenA (lpString="*.mp4") returned 5 [0064.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.wmv") returned 0 [0064.995] lstrlenA (lpString="*.wmv") returned 5 [0064.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.divx") returned 0 [0064.995] lstrlenA (lpString="*.divx") returned 6 [0064.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.mkv") returned 0 [0064.995] lstrlenA (lpString="*.mkv") returned 5 [0064.995] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.mp3") returned 0 [0064.995] lstrlenA (lpString="*.mp3") returned 5 [0064.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.wav") returned 0 [0064.996] lstrlenA (lpString="*.wav") returned 5 [0064.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.flac") returned 0 [0064.996] lstrlenA (lpString="*.flac") returned 6 [0064.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.ape") returned 0 [0064.996] lstrlenA (lpString="*.ape") returned 5 [0064.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.wma") returned 0 [0064.996] lstrlenA (lpString="*.wma") returned 5 [0064.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.ac3") returned 0 [0064.996] lstrlenA (lpString="*.ac3") returned 5 [0064.996] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.mxf") returned 0 [0064.996] lstrlenA (lpString="*.mxf") returned 5 [0064.996] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9b6, dwReserved0=0x6f006f, dwReserved1=0x73006c, cFileName="TABOFF.JPG", cAlternateFileName="")) returned 1 [0064.996] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0064.996] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TABOFF.JPG") returned -1 [0064.996] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TABOFF.JPG") returned -1 [0064.996] lstrcmpiA (lpString1="", lpString2="TABOFF.JPG") returned -1 [0064.996] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP") returned="TABMASK.BMP" [0064.996] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0064.996] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0064.996] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0064.996] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0064.996] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="TABOFF.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" [0064.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.zip") returned 0 [0064.997] lstrlenA (lpString="*.zip") returned 5 [0064.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.rar") returned 0 [0064.997] lstrlenA (lpString="*.rar") returned 5 [0064.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.7z") returned 0 [0064.997] lstrlenA (lpString="*.7z") returned 4 [0064.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.tar") returned 0 [0064.997] lstrlenA (lpString="*.tar") returned 5 [0064.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.gzip") returned 0 [0064.997] lstrlenA (lpString="*.gzip") returned 6 [0064.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.jpg") returned 1 [0064.997] lstrlenA (lpString="*.jpg") returned 5 [0064.997] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" [0064.997] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" [0064.997] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG." [0064.997] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG.wannacry" [0064.997] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0064.999] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9b6 [0064.999] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5aca0270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1 [0064.999] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0064.999] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x938, lpOverlapped=0x0) returned 1 [0065.001] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG") returned="TABOFF.JPG" [0065.001] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.001] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x938, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x938, lpOverlapped=0x0) returned 1 [0065.002] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.002] CloseHandle (hObject=0x98) returned 1 [0065.002] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg.wannacry")) returned 1 [0065.003] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9ef, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="TABON.JPG", cAlternateFileName="")) returned 1 [0065.003] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.003] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TABON.JPG") returned -1 [0065.003] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TABON.JPG") returned -1 [0065.003] lstrcmpiA (lpString1="", lpString2="TABON.JPG") returned -1 [0065.003] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG") returned="TABOFF.JPG" [0065.003] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0065.003] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0065.003] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0065.003] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0065.004] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="TABON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" [0065.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.zip") returned 0 [0065.004] lstrlenA (lpString="*.zip") returned 5 [0065.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.rar") returned 0 [0065.004] lstrlenA (lpString="*.rar") returned 5 [0065.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.7z") returned 0 [0065.004] lstrlenA (lpString="*.7z") returned 4 [0065.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.tar") returned 0 [0065.004] lstrlenA (lpString="*.tar") returned 5 [0065.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.gzip") returned 0 [0065.004] lstrlenA (lpString="*.gzip") returned 6 [0065.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.jpg") returned 1 [0065.004] lstrlenA (lpString="*.jpg") returned 5 [0065.004] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" [0065.004] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" [0065.004] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG." [0065.004] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG.wannacry" [0065.004] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0065.006] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9ef [0065.006] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d43ce90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1 [0065.006] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.006] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x971, lpOverlapped=0x0) returned 1 [0065.008] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG") returned="TABON.JPG" [0065.008] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.009] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x971, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x971, lpOverlapped=0x0) returned 1 [0065.009] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.009] CloseHandle (hObject=0x98) returned 1 [0065.009] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg.wannacry")) returned 1 [0065.010] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xdff, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="WHITEBOX.JPG", cAlternateFileName="")) returned 1 [0065.010] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.010] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WHITEBOX.JPG") returned -1 [0065.010] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WHITEBOX.JPG") returned -1 [0065.010] lstrcmpiA (lpString1="", lpString2="WHITEBOX.JPG") returned -1 [0065.010] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG") returned="TABON.JPG" [0065.010] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0065.010] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0065.010] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0065.011] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0065.011] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="WHITEBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" [0065.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.zip") returned 0 [0065.011] lstrlenA (lpString="*.zip") returned 5 [0065.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.rar") returned 0 [0065.011] lstrlenA (lpString="*.rar") returned 5 [0065.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.7z") returned 0 [0065.011] lstrlenA (lpString="*.7z") returned 4 [0065.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.tar") returned 0 [0065.011] lstrlenA (lpString="*.tar") returned 5 [0065.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.gzip") returned 0 [0065.011] lstrlenA (lpString="*.gzip") returned 6 [0065.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.jpg") returned 1 [0065.011] lstrlenA (lpString="*.jpg") returned 5 [0065.011] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" [0065.011] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" [0065.011] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG." [0065.011] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG.wannacry" [0065.011] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0065.013] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdff [0065.013] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e5c1270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1 [0065.013] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.013] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xd81, lpOverlapped=0x0) returned 1 [0065.015] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG") returned="WHITEBOX.JPG" [0065.015] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.015] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xd81, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xd81, lpOverlapped=0x0) returned 1 [0065.015] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.016] CloseHandle (hObject=0x98) returned 1 [0065.016] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg.wannacry")) returned 1 [0065.017] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4d72, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="WhiteboxMask.bmp", cAlternateFileName="WHITEB~1.BMP")) returned 1 [0065.017] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.017] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WhiteboxMask.bmp") returned -1 [0065.017] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WhiteboxMask.bmp") returned -1 [0065.017] lstrcmpiA (lpString1="", lpString2="WhiteboxMask.bmp") returned -1 [0065.017] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG") returned="WHITEBOX.JPG" [0065.017] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0065.017] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0065.017] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0065.017] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0065.017] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="WhiteboxMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp" [0065.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.zip") returned 0 [0065.017] lstrlenA (lpString="*.zip") returned 5 [0065.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.rar") returned 0 [0065.017] lstrlenA (lpString="*.rar") returned 5 [0065.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.7z") returned 0 [0065.017] lstrlenA (lpString="*.7z") returned 4 [0065.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.tar") returned 0 [0065.018] lstrlenA (lpString="*.tar") returned 5 [0065.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.gzip") returned 0 [0065.018] lstrlenA (lpString="*.gzip") returned 6 [0065.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.jpg") returned 0 [0065.018] lstrlenA (lpString="*.jpg") returned 5 [0065.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.jpeg") returned 0 [0065.018] lstrlenA (lpString="*.jpeg") returned 6 [0065.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.psd") returned 0 [0065.018] lstrlenA (lpString="*.psd") returned 5 [0065.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.gif") returned 0 [0065.018] lstrlenA (lpString="*.gif") returned 5 [0065.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.doc") returned 0 [0065.018] lstrlenA (lpString="*.doc") returned 5 [0065.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.docx") returned 0 [0065.018] lstrlenA (lpString="*.docx") returned 6 [0065.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.xls") returned 0 [0065.018] lstrlenA (lpString="*.xls") returned 5 [0065.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.xlsx") returned 0 [0065.018] lstrlenA (lpString="*.xlsx") returned 6 [0065.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.ppt") returned 0 [0065.018] lstrlenA (lpString="*.ppt") returned 5 [0065.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.pptx") returned 0 [0065.018] lstrlenA (lpString="*.pptx") returned 6 [0065.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.pdf") returned 0 [0065.018] lstrlenA (lpString="*.pdf") returned 5 [0065.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.mov") returned 0 [0065.019] lstrlenA (lpString="*.mov") returned 5 [0065.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.m2v") returned 0 [0065.019] lstrlenA (lpString="*.m2v") returned 5 [0065.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.3gp") returned 0 [0065.019] lstrlenA (lpString="*.3gp") returned 5 [0065.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.mpeg") returned 0 [0065.019] lstrlenA (lpString="*.mpeg") returned 6 [0065.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.mpg") returned 0 [0065.019] lstrlenA (lpString="*.mpg") returned 5 [0065.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.flv") returned 0 [0065.019] lstrlenA (lpString="*.flv") returned 5 [0065.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.avi") returned 0 [0065.019] lstrlenA (lpString="*.avi") returned 5 [0065.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.mp4") returned 0 [0065.019] lstrlenA (lpString="*.mp4") returned 5 [0065.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.wmv") returned 0 [0065.019] lstrlenA (lpString="*.wmv") returned 5 [0065.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.divx") returned 0 [0065.019] lstrlenA (lpString="*.divx") returned 6 [0065.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.mkv") returned 0 [0065.019] lstrlenA (lpString="*.mkv") returned 5 [0065.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.mp3") returned 0 [0065.019] lstrlenA (lpString="*.mp3") returned 5 [0065.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.wav") returned 0 [0065.020] lstrlenA (lpString="*.wav") returned 5 [0065.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.flac") returned 0 [0065.020] lstrlenA (lpString="*.flac") returned 6 [0065.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.ape") returned 0 [0065.020] lstrlenA (lpString="*.ape") returned 5 [0065.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.wma") returned 0 [0065.020] lstrlenA (lpString="*.wma") returned 5 [0065.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.ac3") returned 0 [0065.020] lstrlenA (lpString="*.ac3") returned 5 [0065.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.mxf") returned 0 [0065.020] lstrlenA (lpString="*.mxf") returned 5 [0065.020] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6e92300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6e92300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x6f006f, dwReserved1=0x73006c, cFileName="ZoomIcons.jpg", cAlternateFileName="ZOOMIC~1.JPG")) returned 1 [0065.020] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.020] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZoomIcons.jpg") returned -1 [0065.020] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZoomIcons.jpg") returned -1 [0065.020] lstrcmpiA (lpString1="", lpString2="ZoomIcons.jpg") returned -1 [0065.020] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp") returned="WhiteboxMask.bmp" [0065.020] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0065.020] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0065.020] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0065.020] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0065.020] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ZoomIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" [0065.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.zip") returned 0 [0065.021] lstrlenA (lpString="*.zip") returned 5 [0065.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.rar") returned 0 [0065.021] lstrlenA (lpString="*.rar") returned 5 [0065.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.7z") returned 0 [0065.021] lstrlenA (lpString="*.7z") returned 4 [0065.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.tar") returned 0 [0065.021] lstrlenA (lpString="*.tar") returned 5 [0065.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.gzip") returned 0 [0065.021] lstrlenA (lpString="*.gzip") returned 6 [0065.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.jpg") returned 1 [0065.021] lstrlenA (lpString="*.jpg") returned 5 [0065.021] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" [0065.021] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" [0065.021] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg." [0065.021] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg.wannacry" [0065.021] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0065.026] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc59 [0065.026] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb6e92300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x70c9f7b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb6e92300, dwHighDateTime=0x1c747ea)) returned 1 [0065.026] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.026] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xbdb, lpOverlapped=0x0) returned 1 [0065.028] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg") returned="ZoomIcons.jpg" [0065.028] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.028] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xbdb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xbdb, lpOverlapped=0x0) returned 1 [0065.028] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.028] CloseHandle (hObject=0x98) returned 1 [0065.029] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg.wannacry")) returned 1 [0065.030] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6e92300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6e92300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="ZoomIconsMask.bmp", cAlternateFileName="ZOOMIC~1.BMP")) returned 1 [0065.030] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.030] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZoomIconsMask.bmp") returned -1 [0065.030] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZoomIconsMask.bmp") returned -1 [0065.030] lstrcmpiA (lpString1="", lpString2="ZoomIconsMask.bmp") returned -1 [0065.030] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg") returned="ZoomIcons.jpg" [0065.030] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" [0065.030] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned="" [0065.030] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" [0065.031] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\how to decrypt files.txt")) returned 0x20 [0065.031] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ZoomIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp" [0065.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.zip") returned 0 [0065.031] lstrlenA (lpString="*.zip") returned 5 [0065.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.rar") returned 0 [0065.031] lstrlenA (lpString="*.rar") returned 5 [0065.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.7z") returned 0 [0065.031] lstrlenA (lpString="*.7z") returned 4 [0065.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.tar") returned 0 [0065.032] lstrlenA (lpString="*.tar") returned 5 [0065.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.gzip") returned 0 [0065.032] lstrlenA (lpString="*.gzip") returned 6 [0065.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.jpg") returned 0 [0065.032] lstrlenA (lpString="*.jpg") returned 5 [0065.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.jpeg") returned 0 [0065.032] lstrlenA (lpString="*.jpeg") returned 6 [0065.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.psd") returned 0 [0065.032] lstrlenA (lpString="*.psd") returned 5 [0065.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.gif") returned 0 [0065.032] lstrlenA (lpString="*.gif") returned 5 [0065.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.doc") returned 0 [0065.032] lstrlenA (lpString="*.doc") returned 5 [0065.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.docx") returned 0 [0065.032] lstrlenA (lpString="*.docx") returned 6 [0065.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.xls") returned 0 [0065.032] lstrlenA (lpString="*.xls") returned 5 [0065.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.xlsx") returned 0 [0065.032] lstrlenA (lpString="*.xlsx") returned 6 [0065.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.ppt") returned 0 [0065.032] lstrlenA (lpString="*.ppt") returned 5 [0065.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.pptx") returned 0 [0065.033] lstrlenA (lpString="*.pptx") returned 6 [0065.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.pdf") returned 0 [0065.033] lstrlenA (lpString="*.pdf") returned 5 [0065.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.mov") returned 0 [0065.033] lstrlenA (lpString="*.mov") returned 5 [0065.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.m2v") returned 0 [0065.033] lstrlenA (lpString="*.m2v") returned 5 [0065.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.3gp") returned 0 [0065.033] lstrlenA (lpString="*.3gp") returned 5 [0065.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.mpeg") returned 0 [0065.033] lstrlenA (lpString="*.mpeg") returned 6 [0065.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.mpg") returned 0 [0065.033] lstrlenA (lpString="*.mpg") returned 5 [0065.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.flv") returned 0 [0065.033] lstrlenA (lpString="*.flv") returned 5 [0065.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.avi") returned 0 [0065.033] lstrlenA (lpString="*.avi") returned 5 [0065.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.mp4") returned 0 [0065.033] lstrlenA (lpString="*.mp4") returned 5 [0065.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.wmv") returned 0 [0065.033] lstrlenA (lpString="*.wmv") returned 5 [0065.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.divx") returned 0 [0065.033] lstrlenA (lpString="*.divx") returned 6 [0065.033] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.mkv") returned 0 [0065.034] lstrlenA (lpString="*.mkv") returned 5 [0065.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.mp3") returned 0 [0065.034] lstrlenA (lpString="*.mp3") returned 5 [0065.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.wav") returned 0 [0065.034] lstrlenA (lpString="*.wav") returned 5 [0065.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.flac") returned 0 [0065.034] lstrlenA (lpString="*.flac") returned 6 [0065.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.ape") returned 0 [0065.034] lstrlenA (lpString="*.ape") returned 5 [0065.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.wma") returned 0 [0065.034] lstrlenA (lpString="*.wma") returned 5 [0065.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.ac3") returned 0 [0065.034] lstrlenA (lpString="*.ac3") returned 5 [0065.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.mxf") returned 0 [0065.034] lstrlenA (lpString="*.mxf") returned 5 [0065.034] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6e92300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6e92300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="ZoomIconsMask.bmp", cAlternateFileName="ZOOMIC~1.BMP")) returned 0 [0065.034] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0065.034] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53907610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Welcome Tool", cAlternateFileName="WELCOM~1")) returned 1 [0065.034] lstrcmpA (lpString1=".", lpString2="Welcome Tool") returned -1 [0065.034] lstrcmpA (lpString1="..", lpString2="Welcome Tool") returned -1 [0065.034] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*" [0065.035] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="Welcome Tool" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool" [0065.035] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool") returned 82 [0065.035] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53907610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f006f, dwReserved1=0x73006c, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0065.036] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.036] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53907610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x730000, cFileName="..", cAlternateFileName="")) returned 1 [0065.036] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.036] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.036] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbadd700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbadd700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10f3, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="IconImages.jpg", cAlternateFileName="ICONIM~1.JPG")) returned 1 [0065.036] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.036] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IconImages.jpg") returned -1 [0065.036] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IconImages.jpg") returned -1 [0065.036] lstrcmpiA (lpString1="", lpString2="IconImages.jpg") returned -1 [0065.036] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\*.*") returned="*.*" [0065.036] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\" [0065.036] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\") returned="" [0065.036] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\HOW TO DECRYPT FILES.txt" [0065.036] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\how to decrypt files.txt")) returned 0xffffffff [0065.037] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0065.040] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0065.040] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0065.041] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.041] CloseHandle (hObject=0x98) returned 1 [0065.041] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\", lpString2="IconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" [0065.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.zip") returned 0 [0065.042] lstrlenA (lpString="*.zip") returned 5 [0065.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.rar") returned 0 [0065.042] lstrlenA (lpString="*.rar") returned 5 [0065.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.7z") returned 0 [0065.042] lstrlenA (lpString="*.7z") returned 4 [0065.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.tar") returned 0 [0065.042] lstrlenA (lpString="*.tar") returned 5 [0065.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.gzip") returned 0 [0065.042] lstrlenA (lpString="*.gzip") returned 6 [0065.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.jpg") returned 1 [0065.042] lstrlenA (lpString="*.jpg") returned 5 [0065.042] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" [0065.042] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" [0065.042] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg." [0065.042] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg.wannacry" [0065.042] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0065.044] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10f3 [0065.044] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbbadd700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61cccf30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbbadd700, dwHighDateTime=0x1c747ea)) returned 1 [0065.044] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.044] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1075, lpOverlapped=0x0) returned 1 [0065.046] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg") returned="IconImages.jpg" [0065.046] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.046] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1075, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1075, lpOverlapped=0x0) returned 1 [0065.047] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.047] CloseHandle (hObject=0x98) returned 1 [0065.047] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg.wannacry")) returned 1 [0065.048] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="IconImagesMask.bmp", cAlternateFileName="ICONIM~1.BMP")) returned 1 [0065.048] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0065.048] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IconImagesMask.bmp") returned -1 [0065.048] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IconImagesMask.bmp") returned -1 [0065.048] lstrcmpiA (lpString1="", lpString2="IconImagesMask.bmp") returned -1 [0065.048] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg") returned="IconImages.jpg" [0065.048] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\" [0065.048] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\") returned="" [0065.048] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\HOW TO DECRYPT FILES.txt" [0065.048] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\how to decrypt files.txt")) returned 0x20 [0065.048] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\", lpString2="IconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp" [0065.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.zip") returned 0 [0065.049] lstrlenA (lpString="*.zip") returned 5 [0065.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.rar") returned 0 [0065.049] lstrlenA (lpString="*.rar") returned 5 [0065.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.7z") returned 0 [0065.049] lstrlenA (lpString="*.7z") returned 4 [0065.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.tar") returned 0 [0065.049] lstrlenA (lpString="*.tar") returned 5 [0065.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0065.049] lstrlenA (lpString="*.gzip") returned 6 [0065.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0065.049] lstrlenA (lpString="*.jpg") returned 5 [0065.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0065.049] lstrlenA (lpString="*.jpeg") returned 6 [0065.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.psd") returned 0 [0065.049] lstrlenA (lpString="*.psd") returned 5 [0065.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.gif") returned 0 [0065.049] lstrlenA (lpString="*.gif") returned 5 [0065.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.doc") returned 0 [0065.049] lstrlenA (lpString="*.doc") returned 5 [0065.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.docx") returned 0 [0065.049] lstrlenA (lpString="*.docx") returned 6 [0065.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.xls") returned 0 [0065.049] lstrlenA (lpString="*.xls") returned 5 [0065.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.xlsx") returned 0 [0065.049] lstrlenA (lpString="*.xlsx") returned 6 [0065.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.ppt") returned 0 [0065.050] lstrlenA (lpString="*.ppt") returned 5 [0065.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.pptx") returned 0 [0065.050] lstrlenA (lpString="*.pptx") returned 6 [0065.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.pdf") returned 0 [0065.050] lstrlenA (lpString="*.pdf") returned 5 [0065.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.mov") returned 0 [0065.050] lstrlenA (lpString="*.mov") returned 5 [0065.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.m2v") returned 0 [0065.050] lstrlenA (lpString="*.m2v") returned 5 [0065.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.3gp") returned 0 [0065.050] lstrlenA (lpString="*.3gp") returned 5 [0065.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.mpeg") returned 0 [0065.050] lstrlenA (lpString="*.mpeg") returned 6 [0065.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.mpg") returned 0 [0065.050] lstrlenA (lpString="*.mpg") returned 5 [0065.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.flv") returned 0 [0065.050] lstrlenA (lpString="*.flv") returned 5 [0065.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.avi") returned 0 [0065.050] lstrlenA (lpString="*.avi") returned 5 [0065.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.mp4") returned 0 [0065.050] lstrlenA (lpString="*.mp4") returned 5 [0065.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.wmv") returned 0 [0065.050] lstrlenA (lpString="*.wmv") returned 5 [0065.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.divx") returned 0 [0065.050] lstrlenA (lpString="*.divx") returned 6 [0065.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.mkv") returned 0 [0065.051] lstrlenA (lpString="*.mkv") returned 5 [0065.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.mp3") returned 0 [0065.051] lstrlenA (lpString="*.mp3") returned 5 [0065.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.wav") returned 0 [0065.051] lstrlenA (lpString="*.wav") returned 5 [0065.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.flac") returned 0 [0065.051] lstrlenA (lpString="*.flac") returned 6 [0065.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.ape") returned 0 [0065.051] lstrlenA (lpString="*.ape") returned 5 [0065.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.wma") returned 0 [0065.051] lstrlenA (lpString="*.wma") returned 5 [0065.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.ac3") returned 0 [0065.051] lstrlenA (lpString="*.ac3") returned 5 [0065.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.mxf") returned 0 [0065.051] lstrlenA (lpString="*.mxf") returned 5 [0065.051] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x3000003, dwReserved1=0x2d80b0, cFileName="IconImagesMask.bmp", cAlternateFileName="ICONIM~1.BMP")) returned 0 [0065.051] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0065.051] FindNextFileA (in: hFindFile=0x2d8150, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53907610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Welcome Tool", cAlternateFileName="WELCOM~1")) returned 0 [0065.051] FindClose (in: hFindFile=0x2d8150 | out: hFindFile=0x2d8150) returned 1 [0065.051] FindNextFileA (in: hFindFile=0x2d7ff8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 0 [0065.052] FindClose (in: hFindFile=0x2d7ff8 | out: hFindFile=0x2d7ff8) returned 1 [0065.053] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a4cdf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0054, dwReserved1=0x3, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 1 [0065.053] lstrcmpA (lpString1=".", lpString2="ToolIcons") returned -1 [0065.053] lstrcmpA (lpString1="..", lpString2="ToolIcons") returned -1 [0065.053] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*.*") returned="*.*" [0065.053] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\", lpString2="ToolIcons" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons" [0065.053] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons") returned 59 [0065.053] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a4cdf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720067, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0065.056] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.056] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a4cdf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.057] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.057] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.057] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ALERT.ICO", cAlternateFileName="")) returned 1 [0065.058] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.058] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ALERT.ICO") returned 1 [0065.058] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ALERT.ICO") returned 1 [0065.058] lstrcmpiA (lpString1="", lpString2="ALERT.ICO") returned -1 [0065.058] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\*.*") returned="*.*" [0065.058] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.058] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.058] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0xffffffff [0065.058] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0065.059] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0065.059] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0065.060] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.060] CloseHandle (hObject=0x90) returned 1 [0065.061] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="ALERT.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO" [0065.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.zip") returned 0 [0065.061] lstrlenA (lpString="*.zip") returned 5 [0065.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.rar") returned 0 [0065.061] lstrlenA (lpString="*.rar") returned 5 [0065.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.7z") returned 0 [0065.061] lstrlenA (lpString="*.7z") returned 4 [0065.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.tar") returned 0 [0065.061] lstrlenA (lpString="*.tar") returned 5 [0065.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.gzip") returned 0 [0065.061] lstrlenA (lpString="*.gzip") returned 6 [0065.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.jpg") returned 0 [0065.061] lstrlenA (lpString="*.jpg") returned 5 [0065.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.jpeg") returned 0 [0065.061] lstrlenA (lpString="*.jpeg") returned 6 [0065.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.psd") returned 0 [0065.061] lstrlenA (lpString="*.psd") returned 5 [0065.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.gif") returned 0 [0065.061] lstrlenA (lpString="*.gif") returned 5 [0065.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.doc") returned 0 [0065.061] lstrlenA (lpString="*.doc") returned 5 [0065.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.docx") returned 0 [0065.061] lstrlenA (lpString="*.docx") returned 6 [0065.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.xls") returned 0 [0065.061] lstrlenA (lpString="*.xls") returned 5 [0065.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.xlsx") returned 0 [0065.062] lstrlenA (lpString="*.xlsx") returned 6 [0065.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.ppt") returned 0 [0065.062] lstrlenA (lpString="*.ppt") returned 5 [0065.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.pptx") returned 0 [0065.062] lstrlenA (lpString="*.pptx") returned 6 [0065.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.pdf") returned 0 [0065.062] lstrlenA (lpString="*.pdf") returned 5 [0065.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mov") returned 0 [0065.062] lstrlenA (lpString="*.mov") returned 5 [0065.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.m2v") returned 0 [0065.062] lstrlenA (lpString="*.m2v") returned 5 [0065.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.3gp") returned 0 [0065.062] lstrlenA (lpString="*.3gp") returned 5 [0065.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mpeg") returned 0 [0065.062] lstrlenA (lpString="*.mpeg") returned 6 [0065.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mpg") returned 0 [0065.062] lstrlenA (lpString="*.mpg") returned 5 [0065.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.flv") returned 0 [0065.062] lstrlenA (lpString="*.flv") returned 5 [0065.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.avi") returned 0 [0065.063] lstrlenA (lpString="*.avi") returned 5 [0065.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mp4") returned 0 [0065.063] lstrlenA (lpString="*.mp4") returned 5 [0065.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.wmv") returned 0 [0065.063] lstrlenA (lpString="*.wmv") returned 5 [0065.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.divx") returned 0 [0065.063] lstrlenA (lpString="*.divx") returned 6 [0065.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mkv") returned 0 [0065.063] lstrlenA (lpString="*.mkv") returned 5 [0065.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mp3") returned 0 [0065.063] lstrlenA (lpString="*.mp3") returned 5 [0065.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.wav") returned 0 [0065.063] lstrlenA (lpString="*.wav") returned 5 [0065.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.flac") returned 0 [0065.063] lstrlenA (lpString="*.flac") returned 6 [0065.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.ape") returned 0 [0065.063] lstrlenA (lpString="*.ape") returned 5 [0065.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.wma") returned 0 [0065.063] lstrlenA (lpString="*.wma") returned 5 [0065.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.ac3") returned 0 [0065.063] lstrlenA (lpString="*.ac3") returned 5 [0065.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mxf") returned 0 [0065.063] lstrlenA (lpString="*.mxf") returned 5 [0065.063] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHEVRON.ICO", cAlternateFileName="")) returned 1 [0065.064] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.064] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CHEVRON.ICO") returned 1 [0065.064] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CHEVRON.ICO") returned 1 [0065.064] lstrcmpiA (lpString1="", lpString2="CHEVRON.ICO") returned -1 [0065.064] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO") returned="ALERT.ICO" [0065.064] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.064] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.064] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.064] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.064] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="CHEVRON.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO" [0065.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.zip") returned 0 [0065.064] lstrlenA (lpString="*.zip") returned 5 [0065.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.rar") returned 0 [0065.064] lstrlenA (lpString="*.rar") returned 5 [0065.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.7z") returned 0 [0065.064] lstrlenA (lpString="*.7z") returned 4 [0065.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.tar") returned 0 [0065.064] lstrlenA (lpString="*.tar") returned 5 [0065.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.gzip") returned 0 [0065.064] lstrlenA (lpString="*.gzip") returned 6 [0065.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.jpg") returned 0 [0065.064] lstrlenA (lpString="*.jpg") returned 5 [0065.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.jpeg") returned 0 [0065.065] lstrlenA (lpString="*.jpeg") returned 6 [0065.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.psd") returned 0 [0065.065] lstrlenA (lpString="*.psd") returned 5 [0065.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.gif") returned 0 [0065.065] lstrlenA (lpString="*.gif") returned 5 [0065.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.doc") returned 0 [0065.065] lstrlenA (lpString="*.doc") returned 5 [0065.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.docx") returned 0 [0065.065] lstrlenA (lpString="*.docx") returned 6 [0065.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.xls") returned 0 [0065.065] lstrlenA (lpString="*.xls") returned 5 [0065.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.xlsx") returned 0 [0065.065] lstrlenA (lpString="*.xlsx") returned 6 [0065.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.ppt") returned 0 [0065.065] lstrlenA (lpString="*.ppt") returned 5 [0065.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.pptx") returned 0 [0065.065] lstrlenA (lpString="*.pptx") returned 6 [0065.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.pdf") returned 0 [0065.065] lstrlenA (lpString="*.pdf") returned 5 [0065.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.mov") returned 0 [0065.065] lstrlenA (lpString="*.mov") returned 5 [0065.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.m2v") returned 0 [0065.065] lstrlenA (lpString="*.m2v") returned 5 [0065.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.3gp") returned 0 [0065.066] lstrlenA (lpString="*.3gp") returned 5 [0065.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.mpeg") returned 0 [0065.066] lstrlenA (lpString="*.mpeg") returned 6 [0065.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.mpg") returned 0 [0065.066] lstrlenA (lpString="*.mpg") returned 5 [0065.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.flv") returned 0 [0065.066] lstrlenA (lpString="*.flv") returned 5 [0065.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.avi") returned 0 [0065.066] lstrlenA (lpString="*.avi") returned 5 [0065.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.mp4") returned 0 [0065.066] lstrlenA (lpString="*.mp4") returned 5 [0065.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.wmv") returned 0 [0065.066] lstrlenA (lpString="*.wmv") returned 5 [0065.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.divx") returned 0 [0065.066] lstrlenA (lpString="*.divx") returned 6 [0065.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.mkv") returned 0 [0065.066] lstrlenA (lpString="*.mkv") returned 5 [0065.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.mp3") returned 0 [0065.066] lstrlenA (lpString="*.mp3") returned 5 [0065.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.wav") returned 0 [0065.066] lstrlenA (lpString="*.wav") returned 5 [0065.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.flac") returned 0 [0065.066] lstrlenA (lpString="*.flac") returned 6 [0065.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.ape") returned 0 [0065.066] lstrlenA (lpString="*.ape") returned 5 [0065.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.wma") returned 0 [0065.066] lstrlenA (lpString="*.wma") returned 5 [0065.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.ac3") returned 0 [0065.067] lstrlenA (lpString="*.ac3") returned 5 [0065.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.mxf") returned 0 [0065.067] lstrlenA (lpString="*.mxf") returned 5 [0065.067] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPUTER.ICO", cAlternateFileName="")) returned 1 [0065.067] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.067] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="COMPUTER.ICO") returned 1 [0065.067] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="COMPUTER.ICO") returned 1 [0065.067] lstrcmpiA (lpString1="", lpString2="COMPUTER.ICO") returned -1 [0065.067] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO") returned="CHEVRON.ICO" [0065.067] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.067] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.067] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.067] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.067] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="COMPUTER.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO" [0065.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.zip") returned 0 [0065.067] lstrlenA (lpString="*.zip") returned 5 [0065.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.rar") returned 0 [0065.067] lstrlenA (lpString="*.rar") returned 5 [0065.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.7z") returned 0 [0065.067] lstrlenA (lpString="*.7z") returned 4 [0065.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.tar") returned 0 [0065.068] lstrlenA (lpString="*.tar") returned 5 [0065.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.gzip") returned 0 [0065.068] lstrlenA (lpString="*.gzip") returned 6 [0065.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.jpg") returned 0 [0065.068] lstrlenA (lpString="*.jpg") returned 5 [0065.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.jpeg") returned 0 [0065.068] lstrlenA (lpString="*.jpeg") returned 6 [0065.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.psd") returned 0 [0065.068] lstrlenA (lpString="*.psd") returned 5 [0065.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.gif") returned 0 [0065.068] lstrlenA (lpString="*.gif") returned 5 [0065.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.doc") returned 0 [0065.068] lstrlenA (lpString="*.doc") returned 5 [0065.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.docx") returned 0 [0065.068] lstrlenA (lpString="*.docx") returned 6 [0065.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.xls") returned 0 [0065.068] lstrlenA (lpString="*.xls") returned 5 [0065.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.xlsx") returned 0 [0065.068] lstrlenA (lpString="*.xlsx") returned 6 [0065.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.ppt") returned 0 [0065.068] lstrlenA (lpString="*.ppt") returned 5 [0065.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.pptx") returned 0 [0065.068] lstrlenA (lpString="*.pptx") returned 6 [0065.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.pdf") returned 0 [0065.068] lstrlenA (lpString="*.pdf") returned 5 [0065.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.mov") returned 0 [0065.069] lstrlenA (lpString="*.mov") returned 5 [0065.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.m2v") returned 0 [0065.069] lstrlenA (lpString="*.m2v") returned 5 [0065.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.3gp") returned 0 [0065.069] lstrlenA (lpString="*.3gp") returned 5 [0065.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.mpeg") returned 0 [0065.069] lstrlenA (lpString="*.mpeg") returned 6 [0065.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.mpg") returned 0 [0065.069] lstrlenA (lpString="*.mpg") returned 5 [0065.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.flv") returned 0 [0065.069] lstrlenA (lpString="*.flv") returned 5 [0065.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.avi") returned 0 [0065.069] lstrlenA (lpString="*.avi") returned 5 [0065.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.mp4") returned 0 [0065.069] lstrlenA (lpString="*.mp4") returned 5 [0065.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.wmv") returned 0 [0065.069] lstrlenA (lpString="*.wmv") returned 5 [0065.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.divx") returned 0 [0065.069] lstrlenA (lpString="*.divx") returned 6 [0065.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.mkv") returned 0 [0065.069] lstrlenA (lpString="*.mkv") returned 5 [0065.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.mp3") returned 0 [0065.069] lstrlenA (lpString="*.mp3") returned 5 [0065.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.wav") returned 0 [0065.069] lstrlenA (lpString="*.wav") returned 5 [0065.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.flac") returned 0 [0065.070] lstrlenA (lpString="*.flac") returned 6 [0065.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.ape") returned 0 [0065.070] lstrlenA (lpString="*.ape") returned 5 [0065.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.wma") returned 0 [0065.070] lstrlenA (lpString="*.wma") returned 5 [0065.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.ac3") returned 0 [0065.070] lstrlenA (lpString="*.ac3") returned 5 [0065.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.mxf") returned 0 [0065.070] lstrlenA (lpString="*.mxf") returned 5 [0065.070] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x604b3070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xea6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContactSelector.ico", cAlternateFileName="CONTAC~1.ICO")) returned 1 [0065.070] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.070] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ContactSelector.ico") returned 1 [0065.070] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ContactSelector.ico") returned 1 [0065.070] lstrcmpiA (lpString1="", lpString2="ContactSelector.ico") returned -1 [0065.070] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO") returned="COMPUTER.ICO" [0065.070] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.070] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.070] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.070] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.070] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="ContactSelector.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico" [0065.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.zip") returned 0 [0065.070] lstrlenA (lpString="*.zip") returned 5 [0065.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.rar") returned 0 [0065.071] lstrlenA (lpString="*.rar") returned 5 [0065.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.7z") returned 0 [0065.071] lstrlenA (lpString="*.7z") returned 4 [0065.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.tar") returned 0 [0065.071] lstrlenA (lpString="*.tar") returned 5 [0065.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.gzip") returned 0 [0065.071] lstrlenA (lpString="*.gzip") returned 6 [0065.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.jpg") returned 0 [0065.071] lstrlenA (lpString="*.jpg") returned 5 [0065.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.jpeg") returned 0 [0065.071] lstrlenA (lpString="*.jpeg") returned 6 [0065.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.psd") returned 0 [0065.071] lstrlenA (lpString="*.psd") returned 5 [0065.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.gif") returned 0 [0065.071] lstrlenA (lpString="*.gif") returned 5 [0065.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.doc") returned 0 [0065.071] lstrlenA (lpString="*.doc") returned 5 [0065.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.docx") returned 0 [0065.071] lstrlenA (lpString="*.docx") returned 6 [0065.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.xls") returned 0 [0065.071] lstrlenA (lpString="*.xls") returned 5 [0065.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.xlsx") returned 0 [0065.071] lstrlenA (lpString="*.xlsx") returned 6 [0065.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.ppt") returned 0 [0065.072] lstrlenA (lpString="*.ppt") returned 5 [0065.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.pptx") returned 0 [0065.072] lstrlenA (lpString="*.pptx") returned 6 [0065.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.pdf") returned 0 [0065.072] lstrlenA (lpString="*.pdf") returned 5 [0065.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.mov") returned 0 [0065.072] lstrlenA (lpString="*.mov") returned 5 [0065.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.m2v") returned 0 [0065.072] lstrlenA (lpString="*.m2v") returned 5 [0065.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.3gp") returned 0 [0065.072] lstrlenA (lpString="*.3gp") returned 5 [0065.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.mpeg") returned 0 [0065.072] lstrlenA (lpString="*.mpeg") returned 6 [0065.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.mpg") returned 0 [0065.072] lstrlenA (lpString="*.mpg") returned 5 [0065.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.flv") returned 0 [0065.072] lstrlenA (lpString="*.flv") returned 5 [0065.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.avi") returned 0 [0065.072] lstrlenA (lpString="*.avi") returned 5 [0065.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.mp4") returned 0 [0065.072] lstrlenA (lpString="*.mp4") returned 5 [0065.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.wmv") returned 0 [0065.072] lstrlenA (lpString="*.wmv") returned 5 [0065.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.divx") returned 0 [0065.072] lstrlenA (lpString="*.divx") returned 6 [0065.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.mkv") returned 0 [0065.073] lstrlenA (lpString="*.mkv") returned 5 [0065.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.mp3") returned 0 [0065.073] lstrlenA (lpString="*.mp3") returned 5 [0065.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.wav") returned 0 [0065.073] lstrlenA (lpString="*.wav") returned 5 [0065.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.flac") returned 0 [0065.073] lstrlenA (lpString="*.flac") returned 6 [0065.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.ape") returned 0 [0065.073] lstrlenA (lpString="*.ape") returned 5 [0065.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.wma") returned 0 [0065.073] lstrlenA (lpString="*.wma") returned 5 [0065.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.ac3") returned 0 [0065.073] lstrlenA (lpString="*.ac3") returned 5 [0065.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.mxf") returned 0 [0065.073] lstrlenA (lpString="*.mxf") returned 5 [0065.073] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e764200, ftCreationTime.dwHighDateTime=0x1c9ff6c, ftLastAccessTime.dwLowDateTime=0x52a4cdf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e764200, ftLastWriteTime.dwHighDateTime=0x1c9ff6c, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="gfserrorfromgroove.ico", cAlternateFileName="GFSERR~1.ICO")) returned 1 [0065.073] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.073] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="gfserrorfromgroove.ico") returned -1 [0065.073] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="gfserrorfromgroove.ico") returned 1 [0065.073] lstrcmpiA (lpString1="", lpString2="gfserrorfromgroove.ico") returned -1 [0065.073] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico") returned="ContactSelector.ico" [0065.073] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.073] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.073] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.073] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.074] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="gfserrorfromgroove.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico" [0065.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.zip") returned 0 [0065.074] lstrlenA (lpString="*.zip") returned 5 [0065.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.rar") returned 0 [0065.074] lstrlenA (lpString="*.rar") returned 5 [0065.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.7z") returned 0 [0065.074] lstrlenA (lpString="*.7z") returned 4 [0065.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.tar") returned 0 [0065.074] lstrlenA (lpString="*.tar") returned 5 [0065.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.gzip") returned 0 [0065.074] lstrlenA (lpString="*.gzip") returned 6 [0065.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.jpg") returned 0 [0065.074] lstrlenA (lpString="*.jpg") returned 5 [0065.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.jpeg") returned 0 [0065.074] lstrlenA (lpString="*.jpeg") returned 6 [0065.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.psd") returned 0 [0065.074] lstrlenA (lpString="*.psd") returned 5 [0065.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.gif") returned 0 [0065.074] lstrlenA (lpString="*.gif") returned 5 [0065.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.doc") returned 0 [0065.074] lstrlenA (lpString="*.doc") returned 5 [0065.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.docx") returned 0 [0065.074] lstrlenA (lpString="*.docx") returned 6 [0065.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.xls") returned 0 [0065.075] lstrlenA (lpString="*.xls") returned 5 [0065.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.xlsx") returned 0 [0065.075] lstrlenA (lpString="*.xlsx") returned 6 [0065.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.ppt") returned 0 [0065.075] lstrlenA (lpString="*.ppt") returned 5 [0065.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.pptx") returned 0 [0065.075] lstrlenA (lpString="*.pptx") returned 6 [0065.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.pdf") returned 0 [0065.075] lstrlenA (lpString="*.pdf") returned 5 [0065.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.mov") returned 0 [0065.075] lstrlenA (lpString="*.mov") returned 5 [0065.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.m2v") returned 0 [0065.075] lstrlenA (lpString="*.m2v") returned 5 [0065.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.3gp") returned 0 [0065.075] lstrlenA (lpString="*.3gp") returned 5 [0065.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.mpeg") returned 0 [0065.075] lstrlenA (lpString="*.mpeg") returned 6 [0065.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.mpg") returned 0 [0065.075] lstrlenA (lpString="*.mpg") returned 5 [0065.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.flv") returned 0 [0065.075] lstrlenA (lpString="*.flv") returned 5 [0065.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.avi") returned 0 [0065.075] lstrlenA (lpString="*.avi") returned 5 [0065.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.mp4") returned 0 [0065.075] lstrlenA (lpString="*.mp4") returned 5 [0065.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.wmv") returned 0 [0065.076] lstrlenA (lpString="*.wmv") returned 5 [0065.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.divx") returned 0 [0065.076] lstrlenA (lpString="*.divx") returned 6 [0065.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.mkv") returned 0 [0065.076] lstrlenA (lpString="*.mkv") returned 5 [0065.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.mp3") returned 0 [0065.076] lstrlenA (lpString="*.mp3") returned 5 [0065.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.wav") returned 0 [0065.076] lstrlenA (lpString="*.wav") returned 5 [0065.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.flac") returned 0 [0065.076] lstrlenA (lpString="*.flac") returned 6 [0065.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.ape") returned 0 [0065.076] lstrlenA (lpString="*.ape") returned 5 [0065.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.wma") returned 0 [0065.076] lstrlenA (lpString="*.wma") returned 5 [0065.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.ac3") returned 0 [0065.076] lstrlenA (lpString="*.ac3") returned 5 [0065.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.mxf") returned 0 [0065.076] lstrlenA (lpString="*.mxf") returned 5 [0065.076] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78806100, ftCreationTime.dwHighDateTime=0x1c9ff6c, ftLastAccessTime.dwLowDateTime=0x52a4cdf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78806100, ftLastWriteTime.dwHighDateTime=0x1c9ff6c, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="gfserrortogroove.ico", cAlternateFileName="GFSERR~2.ICO")) returned 1 [0065.076] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.076] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="gfserrortogroove.ico") returned -1 [0065.076] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="gfserrortogroove.ico") returned 1 [0065.076] lstrcmpiA (lpString1="", lpString2="gfserrortogroove.ico") returned -1 [0065.076] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico") returned="gfserrorfromgroove.ico" [0065.076] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.077] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.077] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.077] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.077] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="gfserrortogroove.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico" [0065.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.zip") returned 0 [0065.077] lstrlenA (lpString="*.zip") returned 5 [0065.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.rar") returned 0 [0065.077] lstrlenA (lpString="*.rar") returned 5 [0065.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.7z") returned 0 [0065.077] lstrlenA (lpString="*.7z") returned 4 [0065.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.tar") returned 0 [0065.077] lstrlenA (lpString="*.tar") returned 5 [0065.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.gzip") returned 0 [0065.077] lstrlenA (lpString="*.gzip") returned 6 [0065.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.jpg") returned 0 [0065.077] lstrlenA (lpString="*.jpg") returned 5 [0065.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.jpeg") returned 0 [0065.077] lstrlenA (lpString="*.jpeg") returned 6 [0065.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.psd") returned 0 [0065.077] lstrlenA (lpString="*.psd") returned 5 [0065.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.gif") returned 0 [0065.077] lstrlenA (lpString="*.gif") returned 5 [0065.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.doc") returned 0 [0065.077] lstrlenA (lpString="*.doc") returned 5 [0065.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.docx") returned 0 [0065.078] lstrlenA (lpString="*.docx") returned 6 [0065.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.xls") returned 0 [0065.078] lstrlenA (lpString="*.xls") returned 5 [0065.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.xlsx") returned 0 [0065.078] lstrlenA (lpString="*.xlsx") returned 6 [0065.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.ppt") returned 0 [0065.078] lstrlenA (lpString="*.ppt") returned 5 [0065.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.pptx") returned 0 [0065.078] lstrlenA (lpString="*.pptx") returned 6 [0065.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.pdf") returned 0 [0065.078] lstrlenA (lpString="*.pdf") returned 5 [0065.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.mov") returned 0 [0065.078] lstrlenA (lpString="*.mov") returned 5 [0065.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.m2v") returned 0 [0065.078] lstrlenA (lpString="*.m2v") returned 5 [0065.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.3gp") returned 0 [0065.078] lstrlenA (lpString="*.3gp") returned 5 [0065.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.mpeg") returned 0 [0065.078] lstrlenA (lpString="*.mpeg") returned 6 [0065.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.mpg") returned 0 [0065.078] lstrlenA (lpString="*.mpg") returned 5 [0065.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.flv") returned 0 [0065.078] lstrlenA (lpString="*.flv") returned 5 [0065.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.avi") returned 0 [0065.078] lstrlenA (lpString="*.avi") returned 5 [0065.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.mp4") returned 0 [0065.079] lstrlenA (lpString="*.mp4") returned 5 [0065.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.wmv") returned 0 [0065.079] lstrlenA (lpString="*.wmv") returned 5 [0065.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.divx") returned 0 [0065.079] lstrlenA (lpString="*.divx") returned 6 [0065.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.mkv") returned 0 [0065.079] lstrlenA (lpString="*.mkv") returned 5 [0065.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.mp3") returned 0 [0065.079] lstrlenA (lpString="*.mp3") returned 5 [0065.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.wav") returned 0 [0065.079] lstrlenA (lpString="*.wav") returned 5 [0065.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.flac") returned 0 [0065.079] lstrlenA (lpString="*.flac") returned 6 [0065.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.ape") returned 0 [0065.079] lstrlenA (lpString="*.ape") returned 5 [0065.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.wma") returned 0 [0065.079] lstrlenA (lpString="*.wma") returned 5 [0065.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.ac3") returned 0 [0065.079] lstrlenA (lpString="*.ac3") returned 5 [0065.079] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", pszSpec="*.mxf") returned 0 [0065.079] lstrlenA (lpString="*.mxf") returned 5 [0065.079] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddee4300, ftCreationTime.dwHighDateTime=0x1c9dff9, ftLastAccessTime.dwLowDateTime=0x537fcc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xddee4300, ftLastWriteTime.dwHighDateTime=0x1c9dff9, nFileSizeHigh=0x0, nFileSizeLow=0x294dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="GWE.ICO", cAlternateFileName="")) returned 1 [0065.079] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.079] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GWE.ICO") returned -1 [0065.079] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GWE.ICO") returned 1 [0065.079] lstrcmpiA (lpString1="", lpString2="GWE.ICO") returned -1 [0065.080] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico") returned="gfserrortogroove.ico" [0065.080] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.080] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.080] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.080] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.080] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="GWE.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO" [0065.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.zip") returned 0 [0065.080] lstrlenA (lpString="*.zip") returned 5 [0065.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.rar") returned 0 [0065.080] lstrlenA (lpString="*.rar") returned 5 [0065.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.7z") returned 0 [0065.080] lstrlenA (lpString="*.7z") returned 4 [0065.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.tar") returned 0 [0065.080] lstrlenA (lpString="*.tar") returned 5 [0065.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.gzip") returned 0 [0065.080] lstrlenA (lpString="*.gzip") returned 6 [0065.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.jpg") returned 0 [0065.080] lstrlenA (lpString="*.jpg") returned 5 [0065.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.jpeg") returned 0 [0065.080] lstrlenA (lpString="*.jpeg") returned 6 [0065.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.psd") returned 0 [0065.080] lstrlenA (lpString="*.psd") returned 5 [0065.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.gif") returned 0 [0065.080] lstrlenA (lpString="*.gif") returned 5 [0065.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.doc") returned 0 [0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.docx") returned 0 [0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.xls") returned 0 [0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.xlsx") returned 0 [0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.ppt") returned 0 [0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.pptx") returned 0 [0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.pdf") returned 0 [0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.mov") returned 0 [0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.m2v") returned 0 [0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.3gp") returned 0 [0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.mpeg") returned 0 [0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.mpg") returned 0 [0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.flv") returned 0 [0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.avi") returned 0 [0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.mp4") returned 0 [0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.wmv") returned 0 [0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.divx") returned 0 [0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.mkv") returned 0 [0065.081] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.mp3") returned 0 [0065.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.wav") returned 0 [0065.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.flac") returned 0 [0065.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.ape") returned 0 [0065.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.wma") returned 0 [0065.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.ac3") returned 0 [0065.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", pszSpec="*.mxf") returned 0 [0065.082] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe103100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe103100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="INCOMING.ICO", cAlternateFileName="")) returned 1 [0065.082] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.082] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="INCOMING.ICO") returned -1 [0065.082] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INCOMING.ICO") returned -1 [0065.082] lstrcmpiA (lpString1="", lpString2="INCOMING.ICO") returned -1 [0065.082] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO") returned="GWE.ICO" [0065.082] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.082] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.082] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.082] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.082] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="INCOMING.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO" [0065.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", pszSpec="*.zip") returned 0 [0065.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", pszSpec="*.rar") returned 0 [0065.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", pszSpec="*.7z") returned 0 [0065.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", pszSpec="*.tar") returned 0 [0065.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", pszSpec="*.gzip") returned 0 [0065.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", pszSpec="*.jpg") returned 0 [0065.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", pszSpec="*.jpeg") returned 0 [0065.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", pszSpec="*.psd") returned 0 [0065.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", pszSpec="*.gif") returned 0 [0065.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", pszSpec="*.doc") returned 0 [0065.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", pszSpec="*.docx") returned 0 [0065.083] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe103100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe103100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDOMAIN.ICO", cAlternateFileName="")) returned 1 [0065.083] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.083] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="INDOMAIN.ICO") returned -1 [0065.083] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INDOMAIN.ICO") returned -1 [0065.083] lstrcmpiA (lpString1="", lpString2="INDOMAIN.ICO") returned -1 [0065.083] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO") returned="INCOMING.ICO" [0065.084] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.084] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.084] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.084] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.084] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="INDOMAIN.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO" [0065.084] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAIL.ICO", cAlternateFileName="")) returned 1 [0065.084] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.084] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MAIL.ICO") returned -1 [0065.084] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MAIL.ICO") returned -1 [0065.084] lstrcmpiA (lpString1="", lpString2="MAIL.ICO") returned -1 [0065.084] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO") returned="INDOMAIN.ICO" [0065.084] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.084] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.084] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.084] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.084] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="MAIL.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO" [0065.084] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANUAL.ICO", cAlternateFileName="")) returned 1 [0065.084] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.084] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MANUAL.ICO") returned -1 [0065.084] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MANUAL.ICO") returned -1 [0065.085] lstrcmpiA (lpString1="", lpString2="MANUAL.ICO") returned -1 [0065.085] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO") returned="MAIL.ICO" [0065.085] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.085] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.085] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.085] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.085] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="MANUAL.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO" [0065.085] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messageboxalert.ico", cAlternateFileName="MESSAG~2.ICO")) returned 1 [0065.085] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.085] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="messageboxalert.ico") returned -1 [0065.085] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="messageboxalert.ico") returned -1 [0065.085] lstrcmpiA (lpString1="", lpString2="messageboxalert.ico") returned -1 [0065.085] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO") returned="MANUAL.ICO" [0065.085] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.085] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.085] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.085] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.085] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="messageboxalert.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico" [0065.085] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messageboxerror.ico", cAlternateFileName="MESSAG~1.ICO")) returned 1 [0065.086] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.086] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="messageboxerror.ico") returned -1 [0065.086] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="messageboxerror.ico") returned -1 [0065.086] lstrcmpiA (lpString1="", lpString2="messageboxerror.ico") returned -1 [0065.086] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico") returned="messageboxalert.ico" [0065.086] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.086] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.086] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.086] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.086] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="messageboxerror.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico" [0065.086] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messageboxinfo.ico", cAlternateFileName="MESSAG~3.ICO")) returned 1 [0065.086] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.086] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="messageboxinfo.ico") returned -1 [0065.086] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="messageboxinfo.ico") returned -1 [0065.086] lstrcmpiA (lpString1="", lpString2="messageboxinfo.ico") returned -1 [0065.086] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico") returned="messageboxerror.ico" [0065.086] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.086] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.086] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.086] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.087] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="messageboxinfo.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico" [0065.087] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1608e400, ftCreationTime.dwHighDateTime=0x1ca03f6, ftLastAccessTime.dwLowDateTime=0x58b00bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1608e400, ftLastWriteTime.dwHighDateTime=0x1ca03f6, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ModifiedTelespace.ico", cAlternateFileName="MODIFI~1.ICO")) returned 1 [0065.087] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.087] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ModifiedTelespace.ico") returned -1 [0065.087] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ModifiedTelespace.ico") returned -1 [0065.087] lstrcmpiA (lpString1="", lpString2="ModifiedTelespace.ico") returned -1 [0065.087] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico") returned="messageboxinfo.ico" [0065.087] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.087] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.087] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.087] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.087] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="ModifiedTelespace.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico" [0065.087] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x596e79b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFLINE.ICO", cAlternateFileName="")) returned 1 [0065.087] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.087] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OFFLINE.ICO") returned -1 [0065.087] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OFFLINE.ICO") returned -1 [0065.087] lstrcmpiA (lpString1="", lpString2="OFFLINE.ICO") returned -1 [0065.087] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico") returned="ModifiedTelespace.ico" [0065.087] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.087] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.087] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.088] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.088] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="OFFLINE.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO" [0065.088] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONLINE.ICO", cAlternateFileName="")) returned 1 [0065.088] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.088] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ONLINE.ICO") returned -1 [0065.088] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONLINE.ICO") returned -1 [0065.088] lstrcmpiA (lpString1="", lpString2="ONLINE.ICO") returned -1 [0065.088] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO") returned="OFFLINE.ICO" [0065.088] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.088] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.088] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.088] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.088] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="ONLINE.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO" [0065.088] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6bf68e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnLineBusy.ico", cAlternateFileName="ONLINE~2.ICO")) returned 1 [0065.088] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.088] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OnLineBusy.ico") returned -1 [0065.088] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OnLineBusy.ico") returned -1 [0065.088] lstrcmpiA (lpString1="", lpString2="OnLineBusy.ico") returned -1 [0065.088] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO") returned="ONLINE.ICO" [0065.089] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.089] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.089] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.089] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.089] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="OnLineBusy.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico" [0065.089] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnLineIdle.ico", cAlternateFileName="ONLINE~1.ICO")) returned 1 [0065.089] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.089] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OnLineIdle.ico") returned -1 [0065.089] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OnLineIdle.ico") returned -1 [0065.089] lstrcmpiA (lpString1="", lpString2="OnLineIdle.ico") returned -1 [0065.089] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico") returned="OnLineBusy.ico" [0065.089] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.089] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.089] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.089] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.089] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="OnLineIdle.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico" [0065.089] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutDomain.ico", cAlternateFileName="OUTDOM~1.ICO")) returned 1 [0065.089] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.089] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OutDomain.ico") returned -1 [0065.090] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutDomain.ico") returned -1 [0065.090] lstrcmpiA (lpString1="", lpString2="OutDomain.ico") returned -1 [0065.090] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico") returned="OnLineIdle.ico" [0065.090] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.090] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.090] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.090] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.090] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="OutDomain.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico" [0065.090] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTGOING.ICO", cAlternateFileName="")) returned 1 [0065.090] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.090] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OUTGOING.ICO") returned -1 [0065.090] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTGOING.ICO") returned -1 [0065.090] lstrcmpiA (lpString1="", lpString2="OUTGOING.ICO") returned -1 [0065.090] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico") returned="OutDomain.ico" [0065.090] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.090] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.090] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.090] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.090] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="OUTGOING.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO" [0065.091] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6cd3edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutSyncPC.ico", cAlternateFileName="OUTSYN~1.ICO")) returned 1 [0065.091] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.091] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OutSyncPC.ico") returned -1 [0065.091] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutSyncPC.ico") returned -1 [0065.091] lstrcmpiA (lpString1="", lpString2="OutSyncPC.ico") returned -1 [0065.091] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO") returned="OUTGOING.ICO" [0065.091] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.091] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.091] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.091] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.091] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="OutSyncPC.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico" [0065.091] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6cdd7370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PersonalContact.ico", cAlternateFileName="PERSON~1.ICO")) returned 1 [0065.091] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.091] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PersonalContact.ico") returned -1 [0065.091] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PersonalContact.ico") returned -1 [0065.091] lstrcmpiA (lpString1="", lpString2="PersonalContact.ico") returned -1 [0065.091] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico") returned="OutSyncPC.ico" [0065.091] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.091] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.091] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.091] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.092] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="PersonalContact.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico" [0065.092] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SessionMember.ico", cAlternateFileName="SESSIO~1.ICO")) returned 1 [0065.092] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.092] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SessionMember.ico") returned -1 [0065.092] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SessionMember.ico") returned -1 [0065.092] lstrcmpiA (lpString1="", lpString2="SessionMember.ico") returned -1 [0065.092] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico") returned="PersonalContact.ico" [0065.092] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.092] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.092] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.092] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.092] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="SessionMember.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico" [0065.092] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SessionOwner.ico", cAlternateFileName="SESSIO~2.ICO")) returned 1 [0065.092] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.092] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SessionOwner.ico") returned -1 [0065.092] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SessionOwner.ico") returned -1 [0065.092] lstrcmpiA (lpString1="", lpString2="SessionOwner.ico") returned -1 [0065.092] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico") returned="SessionMember.ico" [0065.092] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.092] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.093] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.093] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.093] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="SessionOwner.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico" [0065.093] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpaceSelector.ico", cAlternateFileName="SPACES~1.ICO")) returned 1 [0065.093] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.093] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SpaceSelector.ico") returned -1 [0065.093] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SpaceSelector.ico") returned -1 [0065.093] lstrcmpiA (lpString1="", lpString2="SpaceSelector.ico") returned -1 [0065.093] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico") returned="SessionOwner.ico" [0065.093] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.093] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.093] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.093] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.093] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="SpaceSelector.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico" [0065.093] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="StatusAway.ico", cAlternateFileName="STATUS~1.ICO")) returned 1 [0065.093] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.093] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StatusAway.ico") returned -1 [0065.093] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StatusAway.ico") returned -1 [0065.093] lstrcmpiA (lpString1="", lpString2="StatusAway.ico") returned -1 [0065.094] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico") returned="SpaceSelector.ico" [0065.094] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.094] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.094] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.094] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.094] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="StatusAway.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico" [0065.094] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="StatusDoNotDisturb.ico", cAlternateFileName="STATUS~2.ICO")) returned 1 [0065.094] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.094] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StatusDoNotDisturb.ico") returned -1 [0065.094] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StatusDoNotDisturb.ico") returned -1 [0065.094] lstrcmpiA (lpString1="", lpString2="StatusDoNotDisturb.ico") returned -1 [0065.094] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico") returned="StatusAway.ico" [0065.094] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.094] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.094] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.094] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.094] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="StatusDoNotDisturb.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico" [0065.094] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="StatusOnline.ico", cAlternateFileName="STATUS~3.ICO")) returned 1 [0065.095] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.095] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StatusOnline.ico") returned -1 [0065.095] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StatusOnline.ico") returned -1 [0065.095] lstrcmpiA (lpString1="", lpString2="StatusOnline.ico") returned -1 [0065.095] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico") returned="StatusDoNotDisturb.ico" [0065.095] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.095] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.095] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.095] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.095] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="StatusOnline.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico" [0065.095] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="TOOLICON.ICO", cAlternateFileName="")) returned 1 [0065.095] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.095] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TOOLICON.ICO") returned -1 [0065.095] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TOOLICON.ICO") returned -1 [0065.095] lstrcmpiA (lpString1="", lpString2="TOOLICON.ICO") returned -1 [0065.095] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico") returned="StatusOnline.ico" [0065.095] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.095] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.095] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.095] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.095] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="TOOLICON.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO" [0065.096] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d4e500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e633690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc2d4e500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2366, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS.ICO", cAlternateFileName="")) returned 1 [0065.096] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.096] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WSS.ICO") returned -1 [0065.096] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WSS.ICO") returned -1 [0065.096] lstrcmpiA (lpString1="", lpString2="WSS.ICO") returned -1 [0065.096] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO") returned="TOOLICON.ICO" [0065.096] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.096] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.096] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.096] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.096] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="WSS.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO" [0065.096] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x430b200, ftCreationTime.dwHighDateTime=0x1c9d442, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x430b200, ftLastWriteTime.dwHighDateTime=0x1c9d442, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS_DocLib.ico", cAlternateFileName="WSS_DO~1.ICO")) returned 1 [0065.096] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.096] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WSS_DocLib.ico") returned -1 [0065.096] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WSS_DocLib.ico") returned -1 [0065.096] lstrcmpiA (lpString1="", lpString2="WSS_DocLib.ico") returned -1 [0065.096] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO") returned="WSS.ICO" [0065.096] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" [0065.096] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned="" [0065.096] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" [0065.097] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\how to decrypt files.txt")) returned 0x20 [0065.097] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="WSS_DocLib.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico" [0065.097] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x430b200, ftCreationTime.dwHighDateTime=0x1c9d442, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x430b200, ftLastWriteTime.dwHighDateTime=0x1c9d442, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS_DocLib.ico", cAlternateFileName="WSS_DO~1.ICO")) returned 0 [0065.097] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0065.097] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3caa70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="XML Files", cAlternateFileName="XMLFIL~1")) returned 1 [0065.097] lstrcmpA (lpString1=".", lpString2="XML Files") returned -1 [0065.097] lstrcmpA (lpString1="..", lpString2="XML Files") returned -1 [0065.097] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*.*") returned="*.*" [0065.097] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\", lpString2="XML Files" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files" [0065.097] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3caa70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0065.099] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.099] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3caa70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.099] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.099] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.099] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd279da00, ftCreationTime.dwHighDateTime=0x1c8a0cd, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd279da00, ftLastWriteTime.dwHighDateTime=0x1c8a0cd, nFileSizeHigh=0x0, nFileSizeLow=0x487, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="builtincontrolsschema.xsd", cAlternateFileName="BUILTI~1.XSD")) returned 1 [0065.099] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.099] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="builtincontrolsschema.xsd") returned 1 [0065.099] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="builtincontrolsschema.xsd") returned 1 [0065.099] lstrcmpiA (lpString1="", lpString2="builtincontrolsschema.xsd") returned -1 [0065.099] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\*.*") returned="*.*" [0065.100] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" [0065.100] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="" [0065.100] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" [0065.100] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\how to decrypt files.txt")) returned 0xffffffff [0065.100] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0065.104] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.104] CloseHandle (hObject=0x90) returned 1 [0065.104] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="builtincontrolsschema.xsd" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd" [0065.104] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd279da00, ftCreationTime.dwHighDateTime=0x1c8a0cd, ftLastAccessTime.dwLowDateTime=0x537646f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd279da00, ftLastWriteTime.dwHighDateTime=0x1c8a0cd, nFileSizeHigh=0x0, nFileSizeLow=0x5d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="grvschema.xsd", cAlternateFileName="GRVSCH~1.XSD")) returned 1 [0065.104] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.104] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="grvschema.xsd") returned -1 [0065.104] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="grvschema.xsd") returned 1 [0065.104] lstrcmpiA (lpString1="", lpString2="grvschema.xsd") returned -1 [0065.104] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd") returned="builtincontrolsschema.xsd" [0065.104] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" [0065.104] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="" [0065.104] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" [0065.104] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\how to decrypt files.txt")) returned 0x20 [0065.104] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="grvschema.xsd" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd" [0065.105] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d4e500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc2d4e500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x14a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Messenger.xml", cAlternateFileName="MESSEN~1.XML")) returned 1 [0065.105] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.105] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Messenger.xml") returned -1 [0065.105] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Messenger.xml") returned -1 [0065.105] lstrcmpiA (lpString1="", lpString2="Messenger.xml") returned -1 [0065.105] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd") returned="grvschema.xsd" [0065.105] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" [0065.105] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="" [0065.105] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" [0065.105] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\how to decrypt files.txt")) returned 0x20 [0065.105] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="Messenger.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml" [0065.105] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Space Templates", cAlternateFileName="SPACET~1")) returned 1 [0065.105] lstrcmpA (lpString1=".", lpString2="Space Templates") returned -1 [0065.105] lstrcmpA (lpString1="..", lpString2="Space Templates") returned -1 [0065.105] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml") returned="Messenger.xml" [0065.105] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="Space Templates" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates" [0065.105] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d8158, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0065.106] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.106] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0065.106] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.106] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.106] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 0 [0065.106] FindClose (in: hFindFile=0x2e3438 | out: hFindFile=0x2e3438) returned 1 [0065.106] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a42b900, ftCreationTime.dwHighDateTime=0x1c9d747, ftLastAccessTime.dwLowDateTime=0x5abbba30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a42b900, ftLastWriteTime.dwHighDateTime=0x1c9d747, nFileSizeHigh=0x0, nFileSizeLow=0x17e2d, dwReserved0=0x700053, dwReserved1=0x3, cFileName="StarterApplicationDescriptors.xml", cAlternateFileName="STARTE~1.XML")) returned 1 [0065.106] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.106] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StarterApplicationDescriptors.xml") returned -1 [0065.106] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StarterApplicationDescriptors.xml") returned -1 [0065.106] lstrcmpiA (lpString1="", lpString2="StarterApplicationDescriptors.xml") returned -1 [0065.106] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\*.*") returned="*.*" [0065.106] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" [0065.106] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="" [0065.106] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" [0065.106] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\how to decrypt files.txt")) returned 0x20 [0065.106] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="StarterApplicationDescriptors.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml" [0065.106] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4061200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4061200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1b875, dwReserved0=0x0, dwReserved1=0x0, cFileName="StarterNotificationDescriptors.xml", cAlternateFileName="STARTE~3.XML")) returned 1 [0065.106] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.106] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StarterNotificationDescriptors.xml") returned -1 [0065.107] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StarterNotificationDescriptors.xml") returned -1 [0065.107] lstrcmpiA (lpString1="", lpString2="StarterNotificationDescriptors.xml") returned -1 [0065.107] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml") returned="StarterApplicationDescriptors.xml" [0065.107] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" [0065.107] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="" [0065.107] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" [0065.107] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\how to decrypt files.txt")) returned 0x20 [0065.107] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="StarterNotificationDescriptors.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml" [0065.107] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22545300, ftCreationTime.dwHighDateTime=0x1c9a48f, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22545300, ftLastWriteTime.dwHighDateTime=0x1c9a48f, nFileSizeHigh=0x0, nFileSizeLow=0x1a553, dwReserved0=0x0, dwReserved1=0x0, cFileName="StarterToolTemplates.xml", cAlternateFileName="STARTE~2.XML")) returned 1 [0065.107] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.107] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StarterToolTemplates.xml") returned -1 [0065.107] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StarterToolTemplates.xml") returned -1 [0065.107] lstrcmpiA (lpString1="", lpString2="StarterToolTemplates.xml") returned -1 [0065.107] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml") returned="StarterNotificationDescriptors.xml" [0065.107] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" [0065.107] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned="" [0065.107] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" [0065.107] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\how to decrypt files.txt")) returned 0x20 [0065.107] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="StarterToolTemplates.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml" [0065.107] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22545300, ftCreationTime.dwHighDateTime=0x1c9a48f, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22545300, ftLastWriteTime.dwHighDateTime=0x1c9a48f, nFileSizeHigh=0x0, nFileSizeLow=0x1a553, dwReserved0=0x0, dwReserved1=0x0, cFileName="StarterToolTemplates.xml", cAlternateFileName="STARTE~2.XML")) returned 0 [0065.108] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0065.108] FindNextFileA (in: hFindFile=0x2d8070, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3caa70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="XML Files", cAlternateFileName="XMLFIL~1")) returned 0 [0065.108] FindClose (in: hFindFile=0x2d8070 | out: hFindFile=0x2d8070) returned 1 [0065.108] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fd7600, ftCreationTime.dwHighDateTime=0x1cacbb3, ftLastAccessTime.dwLowDateTime=0x52fce0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fd7600, ftLastWriteTime.dwHighDateTime=0x1cacbb3, nFileSizeHigh=0x0, nFileSizeLow=0x3112b78, dwReserved0=0x720047, dwReserved1=0x3, cFileName="GROOVE.EXE", cAlternateFileName="")) returned 1 [0065.108] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.108] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GROOVE.EXE") returned -1 [0065.108] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GROOVE.EXE") returned 1 [0065.108] lstrcmpiA (lpString1="", lpString2="GROOVE.EXE") returned -1 [0065.108] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*" [0065.108] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.108] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.108] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.108] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.108] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="GROOVE.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" [0065.108] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fd7600, ftCreationTime.dwHighDateTime=0x1cacbb3, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fd7600, ftLastWriteTime.dwHighDateTime=0x1cacbb3, nFileSizeHigh=0x0, nFileSizeLow=0x669390, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVEEX.DLL", cAlternateFileName="")) returned 1 [0065.108] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.108] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GROOVEEX.DLL") returned -1 [0065.108] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GROOVEEX.DLL") returned 1 [0065.108] lstrcmpiA (lpString1="", lpString2="GROOVEEX.DLL") returned -1 [0065.108] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned="GROOVE.EXE" [0065.108] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.108] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.109] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.109] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.109] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="GROOVEEX.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL" [0065.110] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c91e000, ftCreationTime.dwHighDateTime=0x1cacb46, ftLastAccessTime.dwLowDateTime=0x52fce0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c91e000, ftLastWriteTime.dwHighDateTime=0x1cacb46, nFileSizeHigh=0x0, nFileSizeLow=0x14ed88, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVEMN.EXE", cAlternateFileName="")) returned 1 [0065.110] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.110] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="GROOVEMN.EXE") returned -1 [0065.110] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GROOVEMN.EXE") returned 1 [0065.110] lstrcmpiA (lpString1="", lpString2="GROOVEMN.EXE") returned -1 [0065.110] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL") returned="GROOVEEX.DLL" [0065.110] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.110] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.110] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.110] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.110] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="GROOVEMN.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE" [0065.110] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x360, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0065.110] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.110] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0065.110] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0065.110] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd0360920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x91b68, dwReserved0=0x18f90c, dwReserved1=0x4f0048, cFileName="HVAC.DLL", cAlternateFileName="")) returned 1 [0065.110] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.111] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HVAC.DLL") returned -1 [0065.111] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HVAC.DLL") returned -1 [0065.111] lstrcmpiA (lpString1="", lpString2="HVAC.DLL") returned -1 [0065.111] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned="GROOVEMN.EXE" [0065.111] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.111] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.111] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.111] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.111] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HVAC.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL" [0065.111] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50eeca00, ftCreationTime.dwHighDateTime=0x1cbceff, ftLastAccessTime.dwLowDateTime=0xcf0a1be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50eeca00, ftLastWriteTime.dwHighDateTime=0x1cbceff, nFileSizeHigh=0x0, nFileSizeLow=0x3b360, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEAWSDC.DLL", cAlternateFileName="")) returned 1 [0065.111] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.111] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IEAWSDC.DLL") returned -1 [0065.111] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IEAWSDC.DLL") returned -1 [0065.111] lstrcmpiA (lpString1="", lpString2="IEAWSDC.DLL") returned -1 [0065.111] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL") returned="HVAC.DLL" [0065.111] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.111] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.111] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.111] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.111] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IEAWSDC.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL" [0065.111] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82531f00, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82531f00, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0xb13a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEContentService.exe", cAlternateFileName="IECONT~1.EXE")) returned 1 [0065.112] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.112] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IEContentService.exe") returned -1 [0065.112] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IEContentService.exe") returned -1 [0065.112] lstrcmpiA (lpString1="", lpString2="IEContentService.exe") returned -1 [0065.112] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL") returned="IEAWSDC.DLL" [0065.112] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.112] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.112] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.112] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.112] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IEContentService.exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe") returned="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe" [0065.112] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd58c5e60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xa6190, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMCOMMON.DLL", cAlternateFileName="")) returned 1 [0065.112] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.112] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IMCOMMON.DLL") returned -1 [0065.112] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMCOMMON.DLL") returned -1 [0065.112] lstrcmpiA (lpString1="", lpString2="IMCOMMON.DLL") returned -1 [0065.112] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe") returned="IEContentService.exe" [0065.112] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.112] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.112] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.112] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.112] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IMCOMMON.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL" [0065.113] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5dc7c00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb5dc7c00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x73c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMDIMP.ADD", cAlternateFileName="")) returned 1 [0065.113] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.113] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IMDIMP.ADD") returned -1 [0065.113] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMDIMP.ADD") returned -1 [0065.113] lstrcmpiA (lpString1="", lpString2="IMDIMP.ADD") returned -1 [0065.113] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL") returned="IMCOMMON.DLL" [0065.113] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.113] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.113] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.113] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.113] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IMDIMP.ADD" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD" [0065.113] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x2d168, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMPMAIL.DLL", cAlternateFileName="")) returned 1 [0065.113] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.113] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IMPMAIL.DLL") returned -1 [0065.113] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMPMAIL.DLL") returned -1 [0065.113] lstrcmpiA (lpString1="", lpString2="IMPMAIL.DLL") returned -1 [0065.113] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned="IMDIMP.ADD" [0065.113] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.113] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.113] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.113] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.114] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IMPMAIL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL" [0065.114] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd58ebfc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x2f180, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMUTIL.DLL", cAlternateFileName="")) returned 1 [0065.114] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.114] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IMUTIL.DLL") returned -1 [0065.114] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMUTIL.DLL") returned -1 [0065.114] lstrcmpiA (lpString1="", lpString2="IMUTIL.DLL") returned -1 [0065.114] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL") returned="IMPMAIL.DLL" [0065.114] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.114] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.114] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.114] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.114] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IMUTIL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL" [0065.114] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1db63000, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd58ebfc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1db63000, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x38388, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMWDD.DLL", cAlternateFileName="")) returned 1 [0065.114] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.114] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IMWDD.DLL") returned -1 [0065.114] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMWDD.DLL") returned -1 [0065.114] lstrcmpiA (lpString1="", lpString2="IMWDD.DLL") returned -1 [0065.114] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL") returned="IMUTIL.DLL" [0065.115] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.115] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.115] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.115] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.115] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IMWDD.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL" [0065.115] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5912120, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x3f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMWIZ.DLL", cAlternateFileName="")) returned 1 [0065.115] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.115] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IMWIZ.DLL") returned -1 [0065.115] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMWIZ.DLL") returned -1 [0065.115] lstrcmpiA (lpString1="", lpString2="IMWIZ.DLL") returned -1 [0065.115] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL") returned="IMWDD.DLL" [0065.115] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.115] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.115] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.115] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.115] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IMWIZ.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL" [0065.115] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3501d300, ftCreationTime.dwHighDateTime=0x1cacf91, ftLastAccessTime.dwLowDateTime=0x53979a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3501d300, ftLastWriteTime.dwHighDateTime=0x1cacf91, nFileSizeHigh=0x0, nFileSizeLow=0x275770, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATH.EXE", cAlternateFileName="")) returned 1 [0065.115] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.115] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="INFOPATH.EXE") returned -1 [0065.115] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INFOPATH.EXE") returned -1 [0065.116] lstrcmpiA (lpString1="", lpString2="INFOPATH.EXE") returned -1 [0065.116] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL") returned="IMWIZ.DLL" [0065.116] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.116] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.116] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.116] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.116] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="INFOPATH.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE" [0065.116] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOM", cAlternateFileName="INFOPA~1")) returned 1 [0065.116] lstrcmpA (lpString1=".", lpString2="InfoPathOM") returned -1 [0065.116] lstrcmpA (lpString1="..", lpString2="InfoPathOM") returned -1 [0065.116] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned="INFOPATH.EXE" [0065.116] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="InfoPathOM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM" [0065.116] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2d807e, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0065.119] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.119] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0065.119] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.119] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.119] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="InfoPathOMFormServices", cAlternateFileName="INFOPA~2")) returned 1 [0065.119] lstrcmpA (lpString1=".", lpString2="InfoPathOMFormServices") returned -1 [0065.119] lstrcmpA (lpString1="..", lpString2="InfoPathOMFormServices") returned -1 [0065.119] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*.*") returned="*.*" [0065.119] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\", lpString2="InfoPathOMFormServices" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices" [0065.120] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0065.123] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.123] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0065.123] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.123] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.123] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="InfoPathOMFormServicesV12", cAlternateFileName="INFOPA~1")) returned 1 [0065.123] lstrcmpA (lpString1=".", lpString2="InfoPathOMFormServicesV12") returned -1 [0065.123] lstrcmpA (lpString1="..", lpString2="InfoPathOMFormServicesV12") returned -1 [0065.123] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*.*") returned="*.*" [0065.123] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\", lpString2="InfoPathOMFormServicesV12" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12" [0065.123] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df3c0, dwReserved1=0x2df3bb, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0065.124] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.124] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0065.125] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.125] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.125] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae85c00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x553a8c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ae85c00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xa770, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0065.125] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0065.125] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0065.125] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0065.125] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0065.125] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\*.*") returned="*.*" [0065.125] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\" [0065.125] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\") returned="" [0065.125] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\HOW TO DECRYPT FILES.txt" [0065.125] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\how to decrypt files.txt")) returned 0xffffffff [0065.125] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0065.130] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.130] CloseHandle (hObject=0x94) returned 1 [0065.130] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\", lpString2="Microsoft.Office.Infopath.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll" [0065.130] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x65c9fd10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0065.130] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0065.130] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0065.130] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0065.130] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0065.130] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll") returned="Microsoft.Office.Infopath.dll" [0065.130] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\" [0065.130] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\") returned="" [0065.130] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\HOW TO DECRYPT FILES.txt" [0065.131] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\how to decrypt files.txt")) returned 0x20 [0065.131] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\", lpString2="Microsoft.Office.InfoPath.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml" [0065.131] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x65c9fd10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 0 [0065.131] FindClose (in: hFindFile=0x2e3478 | out: hFindFile=0x2e3478) returned 1 [0065.131] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae85c00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ae85c00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xb770, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0065.131] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.131] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0065.131] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0065.131] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0065.131] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*.*") returned="*.*" [0065.131] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\" [0065.131] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\") returned="" [0065.131] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\HOW TO DECRYPT FILES.txt" [0065.131] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\how to decrypt files.txt")) returned 0xffffffff [0065.132] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0065.134] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.134] CloseHandle (hObject=0x90) returned 1 [0065.134] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\", lpString2="Microsoft.Office.Infopath.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll" [0065.134] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x55382ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0065.135] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.135] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0065.135] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0065.135] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0065.135] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll") returned="Microsoft.Office.Infopath.dll" [0065.135] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\" [0065.135] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\") returned="" [0065.135] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\HOW TO DECRYPT FILES.txt" [0065.135] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\how to decrypt files.txt")) returned 0x20 [0065.135] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\", lpString2="Microsoft.Office.InfoPath.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml" [0065.135] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x55382ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 0 [0065.135] FindClose (in: hFindFile=0x2e3438 | out: hFindFile=0x2e3438) returned 1 [0065.135] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="InfoPathOMV12", cAlternateFileName="INFOPA~1")) returned 1 [0065.135] lstrcmpA (lpString1=".", lpString2="InfoPathOMV12") returned -1 [0065.135] lstrcmpA (lpString1="..", lpString2="InfoPathOMV12") returned -1 [0065.135] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*.*") returned="*.*" [0065.135] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\", lpString2="InfoPathOMV12" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12" [0065.135] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0065.136] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.136] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x520000, cFileName="..", cAlternateFileName="")) returned 1 [0065.136] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.136] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.136] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c198900, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x544ee410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c198900, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xd770, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0065.136] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.136] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0065.136] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0065.136] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0065.136] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\*.*") returned="*.*" [0065.136] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\" [0065.136] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\") returned="" [0065.136] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\HOW TO DECRYPT FILES.txt" [0065.136] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\how to decrypt files.txt")) returned 0xffffffff [0065.136] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0065.147] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.147] CloseHandle (hObject=0x90) returned 1 [0065.147] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\", lpString2="Microsoft.Office.Infopath.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll" [0065.147] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0065.148] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.148] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0065.148] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0065.148] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0065.148] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll") returned="Microsoft.Office.Infopath.dll" [0065.148] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\" [0065.148] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\") returned="" [0065.148] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\HOW TO DECRYPT FILES.txt" [0065.148] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\how to decrypt files.txt")) returned 0x20 [0065.148] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\", lpString2="Microsoft.Office.InfoPath.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml" [0065.148] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 0 [0065.148] FindClose (in: hFindFile=0x2e3438 | out: hFindFile=0x2e3438) returned 1 [0065.148] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c198900, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c198900, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xe770, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0065.148] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.148] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0065.148] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0065.148] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0065.148] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*.*") returned="*.*" [0065.149] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\" [0065.149] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\") returned="" [0065.149] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\HOW TO DECRYPT FILES.txt" [0065.149] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\how to decrypt files.txt")) returned 0xffffffff [0065.149] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0065.151] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.151] CloseHandle (hObject=0x8c) returned 1 [0065.151] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\", lpString2="Microsoft.Office.Infopath.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll" [0065.151] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x544ee410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0065.151] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.151] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0065.151] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0065.151] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0065.151] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll") returned="Microsoft.Office.Infopath.dll" [0065.151] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\" [0065.152] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\") returned="" [0065.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\HOW TO DECRYPT FILES.txt" [0065.152] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\how to decrypt files.txt")) returned 0x20 [0065.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\", lpString2="Microsoft.Office.InfoPath.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml" [0065.152] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x544ee410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 0 [0065.152] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0065.152] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x61d191f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x7bb78, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="INLAUNCH.DLL", cAlternateFileName="")) returned 1 [0065.152] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.152] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="INLAUNCH.DLL") returned -1 [0065.152] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INLAUNCH.DLL") returned -1 [0065.152] lstrcmpiA (lpString1="", lpString2="INLAUNCH.DLL") returned -1 [0065.152] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*" [0065.152] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.152] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.152] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.153] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="INLAUNCH.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL" [0065.153] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb562a700, ftCreationTime.dwHighDateTime=0x1cacb3f, ftLastAccessTime.dwLowDateTime=0x61e23b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb562a700, ftLastWriteTime.dwHighDateTime=0x1cacb3f, nFileSizeHigh=0x0, nFileSizeLow=0x1bac000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Installed_resources14.xss", cAlternateFileName="INSTAL~1.XSS")) returned 1 [0065.153] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.153] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Installed_resources14.xss") returned -1 [0065.153] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Installed_resources14.xss") returned -1 [0065.153] lstrcmpiA (lpString1="", lpString2="Installed_resources14.xss") returned -1 [0065.153] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL") returned="INLAUNCH.DLL" [0065.153] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.153] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.153] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.153] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.153] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Installed_resources14.xss" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss") returned="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss" [0065.153] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb562a700, ftCreationTime.dwHighDateTime=0x1cacb3f, ftLastAccessTime.dwLowDateTime=0x61e23b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb562a700, ftLastWriteTime.dwHighDateTime=0x1cacb3f, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Installed_schemas14.xss", cAlternateFileName="INSTAL~2.XSS")) returned 1 [0065.153] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.153] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Installed_schemas14.xss") returned -1 [0065.153] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Installed_schemas14.xss") returned -1 [0065.153] lstrcmpiA (lpString1="", lpString2="Installed_schemas14.xss") returned -1 [0065.153] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss") returned="Installed_resources14.xss" [0065.153] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.153] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.154] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.154] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.154] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Installed_schemas14.xss" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss") returned="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss" [0065.154] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf65300, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xd5938280, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2bf65300, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x17380, dwReserved0=0x0, dwReserved1=0x0, cFileName="INTLDATE.DLL", cAlternateFileName="")) returned 1 [0065.154] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.154] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="INTLDATE.DLL") returned -1 [0065.154] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INTLDATE.DLL") returned -1 [0065.154] lstrcmpiA (lpString1="", lpString2="INTLDATE.DLL") returned -1 [0065.154] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss") returned="Installed_schemas14.xss" [0065.154] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.154] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.154] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.154] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.154] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="INTLDATE.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL" [0065.154] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36330000, ftCreationTime.dwHighDateTime=0x1cacf91, ftLastAccessTime.dwLowDateTime=0x64a2d290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36330000, ftLastWriteTime.dwHighDateTime=0x1cacf91, nFileSizeHigh=0x0, nFileSizeLow=0x98b578, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPDESIGN.DLL", cAlternateFileName="")) returned 1 [0065.154] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.154] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IPDESIGN.DLL") returned -1 [0065.155] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPDESIGN.DLL") returned -1 [0065.155] lstrcmpiA (lpString1="", lpString2="IPDESIGN.DLL") returned -1 [0065.155] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL") returned="INTLDATE.DLL" [0065.155] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.155] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.155] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.155] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.155] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IPDESIGN.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL" [0065.155] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3501d300, ftCreationTime.dwHighDateTime=0x1cacf91, ftLastAccessTime.dwLowDateTime=0x64cdab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3501d300, ftLastWriteTime.dwHighDateTime=0x1cacf91, nFileSizeHigh=0x0, nFileSizeLow=0x8a4d70, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPEDITOR.DLL", cAlternateFileName="")) returned 1 [0065.155] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.155] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IPEDITOR.DLL") returned -1 [0065.155] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPEDITOR.DLL") returned -1 [0065.155] lstrcmpiA (lpString1="", lpString2="IPEDITOR.DLL") returned -1 [0065.155] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL") returned="IPDESIGN.DLL" [0065.155] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.155] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.155] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.155] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.155] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IPEDITOR.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL" [0065.156] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x543977b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x1375c, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPIRM.XML", cAlternateFileName="")) returned 1 [0065.156] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.156] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IPIRM.XML") returned -1 [0065.156] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPIRM.XML") returned -1 [0065.156] lstrcmpiA (lpString1="", lpString2="IPIRM.XML") returned -1 [0065.156] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL") returned="IPEDITOR.DLL" [0065.156] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.156] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.156] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.156] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.156] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IPIRM.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML" [0065.156] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x64d730d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x135a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPIRMV.XML", cAlternateFileName="")) returned 1 [0065.156] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.156] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IPIRMV.XML") returned -1 [0065.156] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPIRMV.XML") returned -1 [0065.156] lstrcmpiA (lpString1="", lpString2="IPIRMV.XML") returned -1 [0065.157] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML") returned="IPIRM.XML" [0065.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.157] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.157] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IPIRMV.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML" [0065.157] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53500, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x64d730d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1f53500, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x39988, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPOLK.DLL", cAlternateFileName="")) returned 1 [0065.157] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.157] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IPOLK.DLL") returned -1 [0065.157] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPOLK.DLL") returned -1 [0065.157] lstrcmpiA (lpString1="", lpString2="IPOLK.DLL") returned -1 [0065.157] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML") returned="IPIRMV.XML" [0065.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.157] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.157] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IPOLK.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL" [0065.158] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x551a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXACS.PDL", cAlternateFileName="")) returned 1 [0065.158] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.158] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IXACS.PDL") returned -1 [0065.158] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IXACS.PDL") returned -1 [0065.158] lstrcmpiA (lpString1="", lpString2="IXACS.PDL") returned -1 [0065.158] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL") returned="IPOLK.DLL" [0065.158] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.158] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.158] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.158] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.158] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IXACS.PDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL" [0065.158] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x34188, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXDB2.PDL", cAlternateFileName="")) returned 1 [0065.158] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.158] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IXDB2.PDL") returned -1 [0065.158] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IXDB2.PDL") returned -1 [0065.158] lstrcmpiA (lpString1="", lpString2="IXDB2.PDL") returned -1 [0065.158] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL") returned="IXACS.PDL" [0065.159] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.159] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.159] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.159] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.159] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IXDB2.PDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL" [0065.159] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x16db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXGENERC.PDL", cAlternateFileName="")) returned 1 [0065.159] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.159] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IXGENERC.PDL") returned -1 [0065.159] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IXGENERC.PDL") returned -1 [0065.159] lstrcmpiA (lpString1="", lpString2="IXGENERC.PDL") returned -1 [0065.160] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL") returned="IXDB2.PDL" [0065.160] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.160] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.160] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.160] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.160] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IXGENERC.PDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL" [0065.160] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x2ada0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXOLEDB.PDL", cAlternateFileName="")) returned 1 [0065.160] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.160] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IXOLEDB.PDL") returned -1 [0065.160] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IXOLEDB.PDL") returned -1 [0065.160] lstrcmpiA (lpString1="", lpString2="IXOLEDB.PDL") returned -1 [0065.160] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL") returned="IXGENERC.PDL" [0065.160] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.160] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.160] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.160] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.160] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IXOLEDB.PDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL" [0065.160] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x63fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXORACLE.PDL", cAlternateFileName="")) returned 1 [0065.160] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.161] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IXORACLE.PDL") returned -1 [0065.161] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IXORACLE.PDL") returned -1 [0065.161] lstrcmpiA (lpString1="", lpString2="IXORACLE.PDL") returned -1 [0065.161] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL") returned="IXOLEDB.PDL" [0065.161] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.161] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.161] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.161] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.161] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IXORACLE.PDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL" [0065.161] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x2fda8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXSSRV.PDL", cAlternateFileName="")) returned 1 [0065.161] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.161] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IXSSRV.PDL") returned -1 [0065.161] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IXSSRV.PDL") returned -1 [0065.161] lstrcmpiA (lpString1="", lpString2="IXSSRV.PDL") returned -1 [0065.161] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL") returned="IXORACLE.PDL" [0065.161] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.161] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.161] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.161] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.161] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IXSSRV.PDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL" [0065.162] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5adb1a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x4db80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXUTIL.DLL", cAlternateFileName="")) returned 1 [0065.162] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.162] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IXUTIL.DLL") returned -1 [0065.162] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IXUTIL.DLL") returned -1 [0065.162] lstrcmpiA (lpString1="", lpString2="IXUTIL.DLL") returned -1 [0065.162] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL") returned="IXSSRV.PDL" [0065.162] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.162] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.162] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.162] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.162] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IXUTIL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL" [0065.162] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7e2cf00, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7e2cf00, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x499c, dwReserved0=0x0, dwReserved1=0x0, cFileName="JFONT.DAT", cAlternateFileName="")) returned 1 [0065.162] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.162] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="JFONT.DAT") returned -1 [0065.162] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="JFONT.DAT") returned -1 [0065.162] lstrcmpiA (lpString1="", lpString2="JFONT.DAT") returned -1 [0065.162] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL") returned="IXUTIL.DLL" [0065.162] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.162] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.162] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.162] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.162] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="JFONT.DAT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT" [0065.163] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x89e6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LATIN1.SHP", cAlternateFileName="")) returned 1 [0065.163] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.163] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LATIN1.SHP") returned -1 [0065.163] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LATIN1.SHP") returned -1 [0065.163] lstrcmpiA (lpString1="", lpString2="LATIN1.SHP") returned -1 [0065.163] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT") returned="JFONT.DAT" [0065.163] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.163] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.163] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.163] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.163] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="LATIN1.SHP" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP") returned="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP" [0065.163] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5d88a60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xaa570, dwReserved0=0x0, dwReserved1=0x0, cFileName="LGND.DLL", cAlternateFileName="")) returned 1 [0065.163] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.163] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LGND.DLL") returned -1 [0065.163] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LGND.DLL") returned -1 [0065.163] lstrcmpiA (lpString1="", lpString2="LGND.DLL") returned -1 [0065.163] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP") returned="LATIN1.SHP" [0065.163] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.163] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.163] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.163] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.163] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="LGND.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL" [0065.164] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51fe2db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Library", cAlternateFileName="")) returned 1 [0065.164] lstrcmpA (lpString1=".", lpString2="Library") returned -1 [0065.164] lstrcmpA (lpString1="..", lpString2="Library") returned -1 [0065.164] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL") returned="LGND.DLL" [0065.164] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Library" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library" [0065.164] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Library") returned 50 [0065.164] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51fe2db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2d807e, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0065.164] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.164] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51fe2db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0065.165] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.165] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.165] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Analysis", cAlternateFileName="")) returned 1 [0065.165] lstrcmpA (lpString1=".", lpString2="Analysis") returned -1 [0065.165] lstrcmpA (lpString1="..", lpString2="Analysis") returned -1 [0065.165] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\*.*") returned="*.*" [0065.165] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\", lpString2="Analysis" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis" [0065.165] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis") returned 59 [0065.165] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0065.167] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.167] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0065.167] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.167] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.167] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x3bb60, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ANALYS32.XLL", cAlternateFileName="")) returned 1 [0065.167] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.167] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ANALYS32.XLL") returned 1 [0065.167] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ANALYS32.XLL") returned 1 [0065.167] lstrcmpiA (lpString1="", lpString2="ANALYS32.XLL") returned -1 [0065.167] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\*.*") returned="*.*" [0065.167] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" [0065.167] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="" [0065.167] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt" [0065.168] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\how to decrypt files.txt")) returned 0xffffffff [0065.168] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0065.169] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0065.169] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0065.170] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.170] CloseHandle (hObject=0x90) returned 1 [0065.170] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpString2="ANALYS32.XLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL" [0065.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.zip") returned 0 [0065.170] lstrlenA (lpString="*.zip") returned 5 [0065.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.rar") returned 0 [0065.171] lstrlenA (lpString="*.rar") returned 5 [0065.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.7z") returned 0 [0065.171] lstrlenA (lpString="*.7z") returned 4 [0065.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.tar") returned 0 [0065.171] lstrlenA (lpString="*.tar") returned 5 [0065.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.gzip") returned 0 [0065.171] lstrlenA (lpString="*.gzip") returned 6 [0065.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.jpg") returned 0 [0065.171] lstrlenA (lpString="*.jpg") returned 5 [0065.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.jpeg") returned 0 [0065.171] lstrlenA (lpString="*.jpeg") returned 6 [0065.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.psd") returned 0 [0065.171] lstrlenA (lpString="*.psd") returned 5 [0065.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.gif") returned 0 [0065.171] lstrlenA (lpString="*.gif") returned 5 [0065.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.doc") returned 0 [0065.171] lstrlenA (lpString="*.doc") returned 5 [0065.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.docx") returned 0 [0065.171] lstrlenA (lpString="*.docx") returned 6 [0065.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.xls") returned 0 [0065.171] lstrlenA (lpString="*.xls") returned 5 [0065.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.xlsx") returned 0 [0065.171] lstrlenA (lpString="*.xlsx") returned 6 [0065.171] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.ppt") returned 0 [0065.172] lstrlenA (lpString="*.ppt") returned 5 [0065.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.pptx") returned 0 [0065.172] lstrlenA (lpString="*.pptx") returned 6 [0065.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.pdf") returned 0 [0065.172] lstrlenA (lpString="*.pdf") returned 5 [0065.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.mov") returned 0 [0065.172] lstrlenA (lpString="*.mov") returned 5 [0065.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.m2v") returned 0 [0065.172] lstrlenA (lpString="*.m2v") returned 5 [0065.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.3gp") returned 0 [0065.172] lstrlenA (lpString="*.3gp") returned 5 [0065.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.mpeg") returned 0 [0065.172] lstrlenA (lpString="*.mpeg") returned 6 [0065.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.mpg") returned 0 [0065.172] lstrlenA (lpString="*.mpg") returned 5 [0065.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.flv") returned 0 [0065.172] lstrlenA (lpString="*.flv") returned 5 [0065.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.avi") returned 0 [0065.172] lstrlenA (lpString="*.avi") returned 5 [0065.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.mp4") returned 0 [0065.172] lstrlenA (lpString="*.mp4") returned 5 [0065.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.wmv") returned 0 [0065.172] lstrlenA (lpString="*.wmv") returned 5 [0065.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.divx") returned 0 [0065.172] lstrlenA (lpString="*.divx") returned 6 [0065.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.mkv") returned 0 [0065.172] lstrlenA (lpString="*.mkv") returned 5 [0065.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.mp3") returned 0 [0065.172] lstrlenA (lpString="*.mp3") returned 5 [0065.172] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.wav") returned 0 [0065.173] lstrlenA (lpString="*.wav") returned 5 [0065.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.flac") returned 0 [0065.173] lstrlenA (lpString="*.flac") returned 6 [0065.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.ape") returned 0 [0065.173] lstrlenA (lpString="*.ape") returned 5 [0065.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.wma") returned 0 [0065.173] lstrlenA (lpString="*.wma") returned 5 [0065.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.ac3") returned 0 [0065.173] lstrlenA (lpString="*.ac3") returned 5 [0065.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", pszSpec="*.mxf") returned 0 [0065.173] lstrlenA (lpString="*.mxf") returned 5 [0065.173] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa1fabf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0xe0c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ATPVBAEN.XLAM", cAlternateFileName="ATPVBA~1.XLA")) returned 1 [0065.173] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.173] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ATPVBAEN.XLAM") returned 1 [0065.173] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ATPVBAEN.XLAM") returned 1 [0065.173] lstrcmpiA (lpString1="", lpString2="ATPVBAEN.XLAM") returned -1 [0065.173] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL") returned="ANALYS32.XLL" [0065.173] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" [0065.173] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="" [0065.173] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt" [0065.173] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\how to decrypt files.txt")) returned 0x20 [0065.173] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpString2="ATPVBAEN.XLAM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM" [0065.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.zip") returned 0 [0065.173] lstrlenA (lpString="*.zip") returned 5 [0065.173] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.rar") returned 0 [0065.174] lstrlenA (lpString="*.rar") returned 5 [0065.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.7z") returned 0 [0065.174] lstrlenA (lpString="*.7z") returned 4 [0065.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.tar") returned 0 [0065.174] lstrlenA (lpString="*.tar") returned 5 [0065.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.gzip") returned 0 [0065.174] lstrlenA (lpString="*.gzip") returned 6 [0065.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.jpg") returned 0 [0065.174] lstrlenA (lpString="*.jpg") returned 5 [0065.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.jpeg") returned 0 [0065.174] lstrlenA (lpString="*.jpeg") returned 6 [0065.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.psd") returned 0 [0065.174] lstrlenA (lpString="*.psd") returned 5 [0065.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.gif") returned 0 [0065.174] lstrlenA (lpString="*.gif") returned 5 [0065.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.doc") returned 0 [0065.174] lstrlenA (lpString="*.doc") returned 5 [0065.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.docx") returned 0 [0065.174] lstrlenA (lpString="*.docx") returned 6 [0065.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.xls") returned 0 [0065.174] lstrlenA (lpString="*.xls") returned 5 [0065.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.xlsx") returned 0 [0065.174] lstrlenA (lpString="*.xlsx") returned 6 [0065.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.ppt") returned 0 [0065.174] lstrlenA (lpString="*.ppt") returned 5 [0065.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.pptx") returned 0 [0065.174] lstrlenA (lpString="*.pptx") returned 6 [0065.174] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.pdf") returned 0 [0065.175] lstrlenA (lpString="*.pdf") returned 5 [0065.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.mov") returned 0 [0065.175] lstrlenA (lpString="*.mov") returned 5 [0065.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.m2v") returned 0 [0065.175] lstrlenA (lpString="*.m2v") returned 5 [0065.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.3gp") returned 0 [0065.175] lstrlenA (lpString="*.3gp") returned 5 [0065.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.mpeg") returned 0 [0065.175] lstrlenA (lpString="*.mpeg") returned 6 [0065.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.mpg") returned 0 [0065.175] lstrlenA (lpString="*.mpg") returned 5 [0065.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.flv") returned 0 [0065.175] lstrlenA (lpString="*.flv") returned 5 [0065.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.avi") returned 0 [0065.175] lstrlenA (lpString="*.avi") returned 5 [0065.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.mp4") returned 0 [0065.175] lstrlenA (lpString="*.mp4") returned 5 [0065.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.wmv") returned 0 [0065.175] lstrlenA (lpString="*.wmv") returned 5 [0065.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.divx") returned 0 [0065.175] lstrlenA (lpString="*.divx") returned 6 [0065.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.mkv") returned 0 [0065.175] lstrlenA (lpString="*.mkv") returned 5 [0065.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.mp3") returned 0 [0065.175] lstrlenA (lpString="*.mp3") returned 5 [0065.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.wav") returned 0 [0065.175] lstrlenA (lpString="*.wav") returned 5 [0065.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.flac") returned 0 [0065.175] lstrlenA (lpString="*.flac") returned 6 [0065.175] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.ape") returned 0 [0065.176] lstrlenA (lpString="*.ape") returned 5 [0065.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.wma") returned 0 [0065.176] lstrlenA (lpString="*.wma") returned 5 [0065.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.ac3") returned 0 [0065.176] lstrlenA (lpString="*.ac3") returned 5 [0065.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", pszSpec="*.mxf") returned 0 [0065.176] lstrlenA (lpString="*.mxf") returned 5 [0065.176] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa5ff110, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x6b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="FUNCRES.XLAM", cAlternateFileName="FUNCRE~1.XLA")) returned 1 [0065.176] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.176] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FUNCRES.XLAM") returned -1 [0065.176] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FUNCRES.XLAM") returned 1 [0065.176] lstrcmpiA (lpString1="", lpString2="FUNCRES.XLAM") returned -1 [0065.176] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM") returned="ATPVBAEN.XLAM" [0065.176] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" [0065.176] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="" [0065.176] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt" [0065.176] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\how to decrypt files.txt")) returned 0x20 [0065.177] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpString2="FUNCRES.XLAM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM" [0065.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.zip") returned 0 [0065.177] lstrlenA (lpString="*.zip") returned 5 [0065.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.rar") returned 0 [0065.177] lstrlenA (lpString="*.rar") returned 5 [0065.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.7z") returned 0 [0065.177] lstrlenA (lpString="*.7z") returned 4 [0065.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.tar") returned 0 [0065.177] lstrlenA (lpString="*.tar") returned 5 [0065.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.gzip") returned 0 [0065.177] lstrlenA (lpString="*.gzip") returned 6 [0065.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.jpg") returned 0 [0065.177] lstrlenA (lpString="*.jpg") returned 5 [0065.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.jpeg") returned 0 [0065.177] lstrlenA (lpString="*.jpeg") returned 6 [0065.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.psd") returned 0 [0065.177] lstrlenA (lpString="*.psd") returned 5 [0065.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.gif") returned 0 [0065.177] lstrlenA (lpString="*.gif") returned 5 [0065.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.doc") returned 0 [0065.177] lstrlenA (lpString="*.doc") returned 5 [0065.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.docx") returned 0 [0065.177] lstrlenA (lpString="*.docx") returned 6 [0065.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.xls") returned 0 [0065.177] lstrlenA (lpString="*.xls") returned 5 [0065.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.xlsx") returned 0 [0065.177] lstrlenA (lpString="*.xlsx") returned 6 [0065.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.ppt") returned 0 [0065.177] lstrlenA (lpString="*.ppt") returned 5 [0065.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.pptx") returned 0 [0065.178] lstrlenA (lpString="*.pptx") returned 6 [0065.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.pdf") returned 0 [0065.178] lstrlenA (lpString="*.pdf") returned 5 [0065.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.mov") returned 0 [0065.178] lstrlenA (lpString="*.mov") returned 5 [0065.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.m2v") returned 0 [0065.178] lstrlenA (lpString="*.m2v") returned 5 [0065.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.3gp") returned 0 [0065.178] lstrlenA (lpString="*.3gp") returned 5 [0065.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.mpeg") returned 0 [0065.178] lstrlenA (lpString="*.mpeg") returned 6 [0065.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.mpg") returned 0 [0065.178] lstrlenA (lpString="*.mpg") returned 5 [0065.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.flv") returned 0 [0065.178] lstrlenA (lpString="*.flv") returned 5 [0065.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.avi") returned 0 [0065.178] lstrlenA (lpString="*.avi") returned 5 [0065.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.mp4") returned 0 [0065.178] lstrlenA (lpString="*.mp4") returned 5 [0065.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.wmv") returned 0 [0065.178] lstrlenA (lpString="*.wmv") returned 5 [0065.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.divx") returned 0 [0065.178] lstrlenA (lpString="*.divx") returned 6 [0065.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.mkv") returned 0 [0065.178] lstrlenA (lpString="*.mkv") returned 5 [0065.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.mp3") returned 0 [0065.178] lstrlenA (lpString="*.mp3") returned 5 [0065.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.wav") returned 0 [0065.178] lstrlenA (lpString="*.wav") returned 5 [0065.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.flac") returned 0 [0065.178] lstrlenA (lpString="*.flac") returned 6 [0065.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.ape") returned 0 [0065.179] lstrlenA (lpString="*.ape") returned 5 [0065.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.wma") returned 0 [0065.179] lstrlenA (lpString="*.wma") returned 5 [0065.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.ac3") returned 0 [0065.179] lstrlenA (lpString="*.ac3") returned 5 [0065.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", pszSpec="*.mxf") returned 0 [0065.179] lstrlenA (lpString="*.mxf") returned 5 [0065.179] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0xcf2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROCDB.XLAM", cAlternateFileName="PROCDB~1.XLA")) returned 1 [0065.179] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.179] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PROCDB.XLAM") returned -1 [0065.179] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM") returned="FUNCRES.XLAM" [0065.179] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" [0065.179] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="" [0065.179] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt" [0065.179] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\how to decrypt files.txt")) returned 0x20 [0065.179] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpString2="PROCDB.XLAM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM" [0065.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.zip") returned 0 [0065.179] lstrlenA (lpString="*.zip") returned 5 [0065.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.rar") returned 0 [0065.180] lstrlenA (lpString="*.rar") returned 5 [0065.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.7z") returned 0 [0065.180] lstrlenA (lpString="*.7z") returned 4 [0065.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.tar") returned 0 [0065.180] lstrlenA (lpString="*.tar") returned 5 [0065.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.gzip") returned 0 [0065.180] lstrlenA (lpString="*.gzip") returned 6 [0065.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.jpg") returned 0 [0065.180] lstrlenA (lpString="*.jpg") returned 5 [0065.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.jpeg") returned 0 [0065.180] lstrlenA (lpString="*.jpeg") returned 6 [0065.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.psd") returned 0 [0065.180] lstrlenA (lpString="*.psd") returned 5 [0065.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.gif") returned 0 [0065.180] lstrlenA (lpString="*.gif") returned 5 [0065.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.doc") returned 0 [0065.180] lstrlenA (lpString="*.doc") returned 5 [0065.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.docx") returned 0 [0065.180] lstrlenA (lpString="*.docx") returned 6 [0065.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.xls") returned 0 [0065.180] lstrlenA (lpString="*.xls") returned 5 [0065.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.xlsx") returned 0 [0065.180] lstrlenA (lpString="*.xlsx") returned 6 [0065.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.ppt") returned 0 [0065.180] lstrlenA (lpString="*.ppt") returned 5 [0065.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.pptx") returned 0 [0065.180] lstrlenA (lpString="*.pptx") returned 6 [0065.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.pdf") returned 0 [0065.180] lstrlenA (lpString="*.pdf") returned 5 [0065.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.mov") returned 0 [0065.181] lstrlenA (lpString="*.mov") returned 5 [0065.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.m2v") returned 0 [0065.181] lstrlenA (lpString="*.m2v") returned 5 [0065.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.3gp") returned 0 [0065.181] lstrlenA (lpString="*.3gp") returned 5 [0065.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.mpeg") returned 0 [0065.181] lstrlenA (lpString="*.mpeg") returned 6 [0065.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.mpg") returned 0 [0065.181] lstrlenA (lpString="*.mpg") returned 5 [0065.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.flv") returned 0 [0065.181] lstrlenA (lpString="*.flv") returned 5 [0065.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.avi") returned 0 [0065.181] lstrlenA (lpString="*.avi") returned 5 [0065.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.mp4") returned 0 [0065.181] lstrlenA (lpString="*.mp4") returned 5 [0065.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.wmv") returned 0 [0065.181] lstrlenA (lpString="*.wmv") returned 5 [0065.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.divx") returned 0 [0065.181] lstrlenA (lpString="*.divx") returned 6 [0065.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.mkv") returned 0 [0065.181] lstrlenA (lpString="*.mkv") returned 5 [0065.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.mp3") returned 0 [0065.181] lstrlenA (lpString="*.mp3") returned 5 [0065.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.wav") returned 0 [0065.181] lstrlenA (lpString="*.wav") returned 5 [0065.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.flac") returned 0 [0065.181] lstrlenA (lpString="*.flac") returned 6 [0065.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.ape") returned 0 [0065.181] lstrlenA (lpString="*.ape") returned 5 [0065.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.wma") returned 0 [0065.182] lstrlenA (lpString="*.wma") returned 5 [0065.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.ac3") returned 0 [0065.182] lstrlenA (lpString="*.ac3") returned 5 [0065.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", pszSpec="*.mxf") returned 0 [0065.182] lstrlenA (lpString="*.mxf") returned 5 [0065.182] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0xcf2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROCDB.XLAM", cAlternateFileName="PROCDB~1.XLA")) returned 0 [0065.182] FindClose (in: hFindFile=0x2e3438 | out: hFindFile=0x2e3438) returned 1 [0065.182] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x62688, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="EUROTOOL.XLAM", cAlternateFileName="EUROTO~1.XLA")) returned 1 [0065.182] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.182] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\*.*") returned="*.*" [0065.182] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Library\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\" [0065.182] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\") returned="" [0065.182] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\HOW TO DECRYPT FILES.txt" [0065.182] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\how to decrypt files.txt")) returned 0xffffffff [0065.182] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0065.183] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0065.184] WriteFile (in: hFile=0x8c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0065.185] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.185] CloseHandle (hObject=0x8c) returned 1 [0065.185] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\", lpString2="EUROTOOL.XLAM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM" [0065.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.zip") returned 0 [0065.185] lstrlenA (lpString="*.zip") returned 5 [0065.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.rar") returned 0 [0065.185] lstrlenA (lpString="*.rar") returned 5 [0065.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.7z") returned 0 [0065.185] lstrlenA (lpString="*.7z") returned 4 [0065.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.tar") returned 0 [0065.185] lstrlenA (lpString="*.tar") returned 5 [0065.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.gzip") returned 0 [0065.185] lstrlenA (lpString="*.gzip") returned 6 [0065.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.jpg") returned 0 [0065.185] lstrlenA (lpString="*.jpg") returned 5 [0065.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.jpeg") returned 0 [0065.185] lstrlenA (lpString="*.jpeg") returned 6 [0065.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.psd") returned 0 [0065.185] lstrlenA (lpString="*.psd") returned 5 [0065.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.gif") returned 0 [0065.185] lstrlenA (lpString="*.gif") returned 5 [0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.doc") returned 0 [0065.186] lstrlenA (lpString="*.doc") returned 5 [0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.docx") returned 0 [0065.186] lstrlenA (lpString="*.docx") returned 6 [0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.xls") returned 0 [0065.186] lstrlenA (lpString="*.xls") returned 5 [0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.xlsx") returned 0 [0065.186] lstrlenA (lpString="*.xlsx") returned 6 [0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.ppt") returned 0 [0065.186] lstrlenA (lpString="*.ppt") returned 5 [0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.pptx") returned 0 [0065.186] lstrlenA (lpString="*.pptx") returned 6 [0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.pdf") returned 0 [0065.186] lstrlenA (lpString="*.pdf") returned 5 [0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.mov") returned 0 [0065.186] lstrlenA (lpString="*.mov") returned 5 [0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.m2v") returned 0 [0065.186] lstrlenA (lpString="*.m2v") returned 5 [0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.3gp") returned 0 [0065.186] lstrlenA (lpString="*.3gp") returned 5 [0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.mpeg") returned 0 [0065.186] lstrlenA (lpString="*.mpeg") returned 6 [0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.mpg") returned 0 [0065.186] lstrlenA (lpString="*.mpg") returned 5 [0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.flv") returned 0 [0065.186] lstrlenA (lpString="*.flv") returned 5 [0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.avi") returned 0 [0065.186] lstrlenA (lpString="*.avi") returned 5 [0065.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.mp4") returned 0 [0065.187] lstrlenA (lpString="*.mp4") returned 5 [0065.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.wmv") returned 0 [0065.187] lstrlenA (lpString="*.wmv") returned 5 [0065.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.divx") returned 0 [0065.187] lstrlenA (lpString="*.divx") returned 6 [0065.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.mkv") returned 0 [0065.187] lstrlenA (lpString="*.mkv") returned 5 [0065.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.mp3") returned 0 [0065.187] lstrlenA (lpString="*.mp3") returned 5 [0065.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.wav") returned 0 [0065.187] lstrlenA (lpString="*.wav") returned 5 [0065.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.flac") returned 0 [0065.187] lstrlenA (lpString="*.flac") returned 6 [0065.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.ape") returned 0 [0065.187] lstrlenA (lpString="*.ape") returned 5 [0065.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.wma") returned 0 [0065.187] lstrlenA (lpString="*.wma") returned 5 [0065.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.ac3") returned 0 [0065.187] lstrlenA (lpString="*.ac3") returned 5 [0065.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", pszSpec="*.mxf") returned 0 [0065.187] lstrlenA (lpString="*.mxf") returned 5 [0065.187] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER", cAlternateFileName="")) returned 1 [0065.187] lstrcmpA (lpString1=".", lpString2="SOLVER") returned -1 [0065.187] lstrcmpA (lpString1="..", lpString2="SOLVER") returned -1 [0065.187] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM") returned="EUROTOOL.XLAM" [0065.187] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\", lpString2="SOLVER" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER" [0065.187] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER") returned 57 [0065.188] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d808e, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0065.188] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.188] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0065.188] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.188] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.188] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x6c340, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SOLVER.XLAM", cAlternateFileName="SOLVER~1.XLA")) returned 1 [0065.188] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.188] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SOLVER.XLAM") returned -1 [0065.188] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SOLVER.XLAM") returned -1 [0065.188] lstrcmpiA (lpString1="", lpString2="SOLVER.XLAM") returned -1 [0065.188] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\*.*") returned="*.*" [0065.188] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\" [0065.188] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\") returned="" [0065.188] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\HOW TO DECRYPT FILES.txt" [0065.188] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\how to decrypt files.txt")) returned 0xffffffff [0065.189] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0065.190] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0065.190] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0065.191] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.191] CloseHandle (hObject=0x90) returned 1 [0065.191] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\", lpString2="SOLVER.XLAM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM" [0065.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.zip") returned 0 [0065.191] lstrlenA (lpString="*.zip") returned 5 [0065.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.rar") returned 0 [0065.191] lstrlenA (lpString="*.rar") returned 5 [0065.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.7z") returned 0 [0065.191] lstrlenA (lpString="*.7z") returned 4 [0065.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.tar") returned 0 [0065.191] lstrlenA (lpString="*.tar") returned 5 [0065.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.gzip") returned 0 [0065.191] lstrlenA (lpString="*.gzip") returned 6 [0065.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.jpg") returned 0 [0065.191] lstrlenA (lpString="*.jpg") returned 5 [0065.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.jpeg") returned 0 [0065.191] lstrlenA (lpString="*.jpeg") returned 6 [0065.191] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.psd") returned 0 [0065.191] lstrlenA (lpString="*.psd") returned 5 [0065.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.gif") returned 0 [0065.192] lstrlenA (lpString="*.gif") returned 5 [0065.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.doc") returned 0 [0065.192] lstrlenA (lpString="*.doc") returned 5 [0065.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.docx") returned 0 [0065.192] lstrlenA (lpString="*.docx") returned 6 [0065.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.xls") returned 0 [0065.192] lstrlenA (lpString="*.xls") returned 5 [0065.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.xlsx") returned 0 [0065.192] lstrlenA (lpString="*.xlsx") returned 6 [0065.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.ppt") returned 0 [0065.192] lstrlenA (lpString="*.ppt") returned 5 [0065.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.pptx") returned 0 [0065.192] lstrlenA (lpString="*.pptx") returned 6 [0065.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.pdf") returned 0 [0065.192] lstrlenA (lpString="*.pdf") returned 5 [0065.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.mov") returned 0 [0065.192] lstrlenA (lpString="*.mov") returned 5 [0065.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.m2v") returned 0 [0065.192] lstrlenA (lpString="*.m2v") returned 5 [0065.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.3gp") returned 0 [0065.192] lstrlenA (lpString="*.3gp") returned 5 [0065.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.mpeg") returned 0 [0065.192] lstrlenA (lpString="*.mpeg") returned 6 [0065.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.mpg") returned 0 [0065.192] lstrlenA (lpString="*.mpg") returned 5 [0065.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.flv") returned 0 [0065.192] lstrlenA (lpString="*.flv") returned 5 [0065.192] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.avi") returned 0 [0065.193] lstrlenA (lpString="*.avi") returned 5 [0065.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.mp4") returned 0 [0065.193] lstrlenA (lpString="*.mp4") returned 5 [0065.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.wmv") returned 0 [0065.193] lstrlenA (lpString="*.wmv") returned 5 [0065.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.divx") returned 0 [0065.193] lstrlenA (lpString="*.divx") returned 6 [0065.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.mkv") returned 0 [0065.193] lstrlenA (lpString="*.mkv") returned 5 [0065.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.mp3") returned 0 [0065.193] lstrlenA (lpString="*.mp3") returned 5 [0065.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.wav") returned 0 [0065.193] lstrlenA (lpString="*.wav") returned 5 [0065.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.flac") returned 0 [0065.193] lstrlenA (lpString="*.flac") returned 6 [0065.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.ape") returned 0 [0065.193] lstrlenA (lpString="*.ape") returned 5 [0065.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.wma") returned 0 [0065.193] lstrlenA (lpString="*.wma") returned 5 [0065.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.ac3") returned 0 [0065.193] lstrlenA (lpString="*.ac3") returned 5 [0065.193] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", pszSpec="*.mxf") returned 0 [0065.193] lstrlenA (lpString="*.mxf") returned 5 [0065.193] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x36158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER32.DLL", cAlternateFileName="")) returned 1 [0065.193] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0065.193] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SOLVER32.DLL") returned -1 [0065.193] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SOLVER32.DLL") returned -1 [0065.193] lstrcmpiA (lpString1="", lpString2="SOLVER32.DLL") returned -1 [0065.194] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM") returned="SOLVER.XLAM" [0065.194] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\" [0065.194] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\") returned="" [0065.194] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\HOW TO DECRYPT FILES.txt" [0065.194] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\how to decrypt files.txt")) returned 0x20 [0065.194] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\", lpString2="SOLVER32.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL" [0065.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.zip") returned 0 [0065.194] lstrlenA (lpString="*.zip") returned 5 [0065.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.rar") returned 0 [0065.194] lstrlenA (lpString="*.rar") returned 5 [0065.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.7z") returned 0 [0065.194] lstrlenA (lpString="*.7z") returned 4 [0065.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.tar") returned 0 [0065.194] lstrlenA (lpString="*.tar") returned 5 [0065.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.gzip") returned 0 [0065.194] lstrlenA (lpString="*.gzip") returned 6 [0065.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.jpg") returned 0 [0065.194] lstrlenA (lpString="*.jpg") returned 5 [0065.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.jpeg") returned 0 [0065.194] lstrlenA (lpString="*.jpeg") returned 6 [0065.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.psd") returned 0 [0065.194] lstrlenA (lpString="*.psd") returned 5 [0065.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.gif") returned 0 [0065.194] lstrlenA (lpString="*.gif") returned 5 [0065.194] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.doc") returned 0 [0065.195] lstrlenA (lpString="*.doc") returned 5 [0065.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.docx") returned 0 [0065.195] lstrlenA (lpString="*.docx") returned 6 [0065.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.xls") returned 0 [0065.195] lstrlenA (lpString="*.xls") returned 5 [0065.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.xlsx") returned 0 [0065.195] lstrlenA (lpString="*.xlsx") returned 6 [0065.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.ppt") returned 0 [0065.195] lstrlenA (lpString="*.ppt") returned 5 [0065.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.pptx") returned 0 [0065.195] lstrlenA (lpString="*.pptx") returned 6 [0065.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.pdf") returned 0 [0065.195] lstrlenA (lpString="*.pdf") returned 5 [0065.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.mov") returned 0 [0065.195] lstrlenA (lpString="*.mov") returned 5 [0065.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.m2v") returned 0 [0065.195] lstrlenA (lpString="*.m2v") returned 5 [0065.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.3gp") returned 0 [0065.195] lstrlenA (lpString="*.3gp") returned 5 [0065.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.mpeg") returned 0 [0065.195] lstrlenA (lpString="*.mpeg") returned 6 [0065.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.mpg") returned 0 [0065.195] lstrlenA (lpString="*.mpg") returned 5 [0065.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.flv") returned 0 [0065.195] lstrlenA (lpString="*.flv") returned 5 [0065.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.avi") returned 0 [0065.195] lstrlenA (lpString="*.avi") returned 5 [0065.195] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.mp4") returned 0 [0065.195] lstrlenA (lpString="*.mp4") returned 5 [0065.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.wmv") returned 0 [0065.196] lstrlenA (lpString="*.wmv") returned 5 [0065.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.divx") returned 0 [0065.196] lstrlenA (lpString="*.divx") returned 6 [0065.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.mkv") returned 0 [0065.196] lstrlenA (lpString="*.mkv") returned 5 [0065.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.mp3") returned 0 [0065.196] lstrlenA (lpString="*.mp3") returned 5 [0065.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.wav") returned 0 [0065.196] lstrlenA (lpString="*.wav") returned 5 [0065.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.flac") returned 0 [0065.196] lstrlenA (lpString="*.flac") returned 6 [0065.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.ape") returned 0 [0065.196] lstrlenA (lpString="*.ape") returned 5 [0065.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.wma") returned 0 [0065.196] lstrlenA (lpString="*.wma") returned 5 [0065.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.ac3") returned 0 [0065.196] lstrlenA (lpString="*.ac3") returned 5 [0065.196] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", pszSpec="*.mxf") returned 0 [0065.196] lstrlenA (lpString="*.mxf") returned 5 [0065.196] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x36158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER32.DLL", cAlternateFileName="")) returned 0 [0065.196] FindClose (in: hFindFile=0x2e3438 | out: hFindFile=0x2e3438) returned 1 [0065.196] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER", cAlternateFileName="")) returned 0 [0065.196] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0065.196] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5dfae80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xfafa0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="LOGELEMS.DLL", cAlternateFileName="")) returned 1 [0065.196] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.197] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LOGELEMS.DLL") returned -1 [0065.197] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LOGELEMS.DLL") returned -1 [0065.197] lstrcmpiA (lpString1="", lpString2="LOGELEMS.DLL") returned -1 [0065.197] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*" [0065.197] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.197] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.197] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.197] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.197] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="LOGELEMS.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL" [0065.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.zip") returned 0 [0065.197] lstrlenA (lpString="*.zip") returned 5 [0065.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.rar") returned 0 [0065.197] lstrlenA (lpString="*.rar") returned 5 [0065.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.7z") returned 0 [0065.197] lstrlenA (lpString="*.7z") returned 4 [0065.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.tar") returned 0 [0065.197] lstrlenA (lpString="*.tar") returned 5 [0065.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.gzip") returned 0 [0065.197] lstrlenA (lpString="*.gzip") returned 6 [0065.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.jpg") returned 0 [0065.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.jpeg") returned 0 [0065.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.psd") returned 0 [0065.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.gif") returned 0 [0065.197] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.doc") returned 0 [0065.198] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", pszSpec="*.docx") returned 0 [0065.198] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ab4f00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x82482540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb4ab4f00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xb590, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOGMODEL.MDL", cAlternateFileName="")) returned 1 [0065.206] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.207] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LOGMODEL.MDL") returned -1 [0065.207] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LOGMODEL.MDL") returned -1 [0065.207] lstrcmpiA (lpString1="", lpString2="LOGMODEL.MDL") returned -1 [0065.207] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL") returned="LOGELEMS.DLL" [0065.207] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.207] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.207] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.207] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.207] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="LOGMODEL.MDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL" [0065.207] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c850300, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5e93400, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1c850300, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x77da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOGVIEW.DLL", cAlternateFileName="")) returned 1 [0065.207] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.207] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LOGVIEW.DLL") returned -1 [0065.207] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LOGVIEW.DLL") returned -1 [0065.207] lstrcmpiA (lpString1="", lpString2="LOGVIEW.DLL") returned -1 [0065.207] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL") returned="LOGMODEL.MDL" [0065.207] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.207] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.207] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.208] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.208] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="LOGVIEW.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL" [0065.208] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x6960cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOOKUP.DAT", cAlternateFileName="")) returned 1 [0065.208] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.208] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LOOKUP.DAT") returned -1 [0065.208] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LOOKUP.DAT") returned -1 [0065.208] lstrcmpiA (lpString1="", lpString2="LOOKUP.DAT") returned -1 [0065.208] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL") returned="LOGVIEW.DLL" [0065.208] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.208] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.208] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.208] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.208] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="LOOKUP.DAT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT" [0065.208] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ae6c00, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6ae6c00, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x65da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIPH.DLL", cAlternateFileName="")) returned 1 [0065.208] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.208] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MAPIPH.DLL") returned -1 [0065.208] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MAPIPH.DLL") returned -1 [0065.208] lstrcmpiA (lpString1="", lpString2="MAPIPH.DLL") returned -1 [0065.208] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT") returned="LOOKUP.DAT" [0065.208] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.208] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.209] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.209] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.209] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MAPIPH.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL" [0065.209] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x473d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPISHELL.DLL", cAlternateFileName="MAPISH~1.DLL")) returned 1 [0065.209] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.209] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MAPISHELL.DLL") returned -1 [0065.209] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MAPISHELL.DLL") returned -1 [0065.209] lstrcmpiA (lpString1="", lpString2="MAPISHELL.DLL") returned -1 [0065.209] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL") returned="MAPIPH.DLL" [0065.209] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.209] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.209] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.209] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.209] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MAPISHELL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL" [0065.209] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8c44700, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8c44700, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x23570, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCPS.DLL", cAlternateFileName="")) returned 1 [0065.209] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.209] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MCPS.DLL") returned -1 [0065.209] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MCPS.DLL") returned -1 [0065.209] lstrcmpiA (lpString1="", lpString2="MCPS.DLL") returned -1 [0065.209] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL") returned="MAPISHELL.DLL" [0065.209] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.210] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.210] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.210] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.210] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MCPS.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL" [0065.210] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40dec00, ftCreationTime.dwHighDateTime=0x1cb7010, ftLastAccessTime.dwLowDateTime=0xcf009660, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x40dec00, ftLastWriteTime.dwHighDateTime=0x1cb7010, nFileSizeHigh=0x0, nFileSizeLow=0xfdb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="MEDCAT.DLL", cAlternateFileName="")) returned 1 [0065.210] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.210] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MEDCAT.DLL") returned -1 [0065.210] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MEDCAT.DLL") returned -1 [0065.210] lstrcmpiA (lpString1="", lpString2="MEDCAT.DLL") returned -1 [0065.210] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL") returned="MCPS.DLL" [0065.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.210] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.210] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.210] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.210] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MEDCAT.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL" [0065.210] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MEDIA", cAlternateFileName="")) returned 1 [0065.210] lstrcmpA (lpString1=".", lpString2="MEDIA") returned -1 [0065.210] lstrcmpA (lpString1="..", lpString2="MEDIA") returned -1 [0065.210] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL") returned="MEDCAT.DLL" [0065.210] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MEDIA" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" [0065.211] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2d807e, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0065.215] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.215] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0065.215] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.215] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.215] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796bf00, ftCreationTime.dwHighDateTime=0x1bd8ab7, ftLastAccessTime.dwLowDateTime=0x5ebdaad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb796bf00, ftLastWriteTime.dwHighDateTime=0x1bd8ab7, nFileSizeHigh=0x0, nFileSizeLow=0x6daa, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="APPLAUSE.WAV", cAlternateFileName="")) returned 1 [0065.215] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.215] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="APPLAUSE.WAV") returned 1 [0065.215] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="APPLAUSE.WAV") returned 1 [0065.215] lstrcmpiA (lpString1="", lpString2="APPLAUSE.WAV") returned -1 [0065.215] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\*.*") returned="*.*" [0065.215] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0065.215] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0065.215] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" [0065.215] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0xffffffff [0065.215] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0065.220] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.220] CloseHandle (hObject=0x8c) returned 1 [0065.220] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="APPLAUSE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" [0065.220] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" [0065.220] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" [0065.220] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV." [0065.220] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV.wannacry" [0065.220] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\applause.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0065.222] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6daa [0065.222] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb796bf00, dwHighDateTime=0x1bd8ab7), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ebdaad0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb796bf00, dwHighDateTime=0x1bd8ab7)) returned 1 [0065.223] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.223] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x6d2c, lpOverlapped=0x0) returned 1 [0065.224] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV") returned="APPLAUSE.WAV" [0065.224] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.224] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x6d2c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x6d2c, lpOverlapped=0x0) returned 1 [0065.225] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.225] CloseHandle (hObject=0x8c) returned 1 [0065.225] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\applause.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\media\\applause.wav.wannacry")) returned 1 [0065.226] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb46b000, ftCreationTime.dwHighDateTime=0x1bfbeee, ftLastAccessTime.dwLowDateTime=0x5ed57890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb46b000, ftLastWriteTime.dwHighDateTime=0x1bfbeee, nFileSizeHigh=0x0, nFileSizeLow=0x59f6, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="ARROW.WAV", cAlternateFileName="")) returned 1 [0065.226] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.226] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ARROW.WAV") returned 1 [0065.226] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ARROW.WAV") returned 1 [0065.226] lstrcmpiA (lpString1="", lpString2="ARROW.WAV") returned -1 [0065.226] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV") returned="APPLAUSE.WAV" [0065.226] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0065.227] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0065.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" [0065.227] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20 [0065.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="ARROW.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" [0065.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.zip") returned 0 [0065.227] lstrlenA (lpString="*.zip") returned 5 [0065.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.rar") returned 0 [0065.227] lstrlenA (lpString="*.rar") returned 5 [0065.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.7z") returned 0 [0065.227] lstrlenA (lpString="*.7z") returned 4 [0065.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.tar") returned 0 [0065.227] lstrlenA (lpString="*.tar") returned 5 [0065.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.gzip") returned 0 [0065.227] lstrlenA (lpString="*.gzip") returned 6 [0065.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.jpg") returned 0 [0065.227] lstrlenA (lpString="*.jpg") returned 5 [0065.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.jpeg") returned 0 [0065.227] lstrlenA (lpString="*.jpeg") returned 6 [0065.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.psd") returned 0 [0065.227] lstrlenA (lpString="*.psd") returned 5 [0065.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.gif") returned 0 [0065.227] lstrlenA (lpString="*.gif") returned 5 [0065.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.doc") returned 0 [0065.227] lstrlenA (lpString="*.doc") returned 5 [0065.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.docx") returned 0 [0065.227] lstrlenA (lpString="*.docx") returned 6 [0065.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.xls") returned 0 [0065.228] lstrlenA (lpString="*.xls") returned 5 [0065.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.xlsx") returned 0 [0065.228] lstrlenA (lpString="*.xlsx") returned 6 [0065.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.ppt") returned 0 [0065.228] lstrlenA (lpString="*.ppt") returned 5 [0065.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.pptx") returned 0 [0065.228] lstrlenA (lpString="*.pptx") returned 6 [0065.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.pdf") returned 0 [0065.228] lstrlenA (lpString="*.pdf") returned 5 [0065.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.mov") returned 0 [0065.228] lstrlenA (lpString="*.mov") returned 5 [0065.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.m2v") returned 0 [0065.228] lstrlenA (lpString="*.m2v") returned 5 [0065.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.3gp") returned 0 [0065.228] lstrlenA (lpString="*.3gp") returned 5 [0065.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.mpeg") returned 0 [0065.228] lstrlenA (lpString="*.mpeg") returned 6 [0065.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.mpg") returned 0 [0065.228] lstrlenA (lpString="*.mpg") returned 5 [0065.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.flv") returned 0 [0065.228] lstrlenA (lpString="*.flv") returned 5 [0065.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.avi") returned 0 [0065.228] lstrlenA (lpString="*.avi") returned 5 [0065.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.mp4") returned 0 [0065.228] lstrlenA (lpString="*.mp4") returned 5 [0065.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.wmv") returned 0 [0065.228] lstrlenA (lpString="*.wmv") returned 5 [0065.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.divx") returned 0 [0065.229] lstrlenA (lpString="*.divx") returned 6 [0065.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.mkv") returned 0 [0065.229] lstrlenA (lpString="*.mkv") returned 5 [0065.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.mp3") returned 0 [0065.229] lstrlenA (lpString="*.mp3") returned 5 [0065.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.wav") returned 1 [0065.229] lstrlenA (lpString="*.wav") returned 5 [0065.229] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" [0065.229] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" [0065.229] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV." [0065.229] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV.wannacry" [0065.229] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\arrow.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0065.230] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x59f6 [0065.230] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xdb46b000, dwHighDateTime=0x1bfbeee), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ed57890, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xdb46b000, dwHighDateTime=0x1bfbeee)) returned 1 [0065.230] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.230] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x5978, lpOverlapped=0x0) returned 1 [0065.232] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV") returned="ARROW.WAV" [0065.232] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.232] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x5978, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x5978, lpOverlapped=0x0) returned 1 [0065.233] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.233] CloseHandle (hObject=0x8c) returned 1 [0065.233] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\arrow.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\media\\arrow.wav.wannacry")) returned 1 [0065.234] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90776900, ftCreationTime.dwHighDateTime=0x1bfbeeb, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90776900, ftLastWriteTime.dwHighDateTime=0x1bfbeeb, nFileSizeHigh=0x0, nFileSizeLow=0x2f676, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BOMB.WAV", cAlternateFileName="")) returned 1 [0065.234] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.234] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BOMB.WAV") returned 1 [0065.234] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BOMB.WAV") returned 1 [0065.234] lstrcmpiA (lpString1="", lpString2="BOMB.WAV") returned -1 [0065.235] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV") returned="ARROW.WAV" [0065.235] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0065.235] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0065.235] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" [0065.235] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20 [0065.235] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="BOMB.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" [0065.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.zip") returned 0 [0065.235] lstrlenA (lpString="*.zip") returned 5 [0065.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.rar") returned 0 [0065.235] lstrlenA (lpString="*.rar") returned 5 [0065.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.7z") returned 0 [0065.235] lstrlenA (lpString="*.7z") returned 4 [0065.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.tar") returned 0 [0065.235] lstrlenA (lpString="*.tar") returned 5 [0065.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.gzip") returned 0 [0065.235] lstrlenA (lpString="*.gzip") returned 6 [0065.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.jpg") returned 0 [0065.235] lstrlenA (lpString="*.jpg") returned 5 [0065.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.jpeg") returned 0 [0065.235] lstrlenA (lpString="*.jpeg") returned 6 [0065.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.psd") returned 0 [0065.235] lstrlenA (lpString="*.psd") returned 5 [0065.235] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.gif") returned 0 [0065.236] lstrlenA (lpString="*.gif") returned 5 [0065.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.doc") returned 0 [0065.236] lstrlenA (lpString="*.doc") returned 5 [0065.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.docx") returned 0 [0065.236] lstrlenA (lpString="*.docx") returned 6 [0065.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.xls") returned 0 [0065.236] lstrlenA (lpString="*.xls") returned 5 [0065.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.xlsx") returned 0 [0065.236] lstrlenA (lpString="*.xlsx") returned 6 [0065.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.ppt") returned 0 [0065.236] lstrlenA (lpString="*.ppt") returned 5 [0065.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.pptx") returned 0 [0065.236] lstrlenA (lpString="*.pptx") returned 6 [0065.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.pdf") returned 0 [0065.236] lstrlenA (lpString="*.pdf") returned 5 [0065.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.mov") returned 0 [0065.236] lstrlenA (lpString="*.mov") returned 5 [0065.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.m2v") returned 0 [0065.236] lstrlenA (lpString="*.m2v") returned 5 [0065.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.3gp") returned 0 [0065.236] lstrlenA (lpString="*.3gp") returned 5 [0065.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.mpeg") returned 0 [0065.236] lstrlenA (lpString="*.mpeg") returned 6 [0065.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.mpg") returned 0 [0065.236] lstrlenA (lpString="*.mpg") returned 5 [0065.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.flv") returned 0 [0065.236] lstrlenA (lpString="*.flv") returned 5 [0065.236] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.avi") returned 0 [0065.237] lstrlenA (lpString="*.avi") returned 5 [0065.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.mp4") returned 0 [0065.237] lstrlenA (lpString="*.mp4") returned 5 [0065.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.wmv") returned 0 [0065.237] lstrlenA (lpString="*.wmv") returned 5 [0065.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.divx") returned 0 [0065.237] lstrlenA (lpString="*.divx") returned 6 [0065.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.mkv") returned 0 [0065.237] lstrlenA (lpString="*.mkv") returned 5 [0065.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.mp3") returned 0 [0065.237] lstrlenA (lpString="*.mp3") returned 5 [0065.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.wav") returned 1 [0065.237] lstrlenA (lpString="*.wav") returned 5 [0065.237] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" [0065.237] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" [0065.237] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV." [0065.237] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\bomb.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0065.238] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f676 [0065.238] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90776900, dwHighDateTime=0x1bfbeeb), lpLastAccessTime=0x407536*(dwLowDateTime=0x51a15810, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90776900, dwHighDateTime=0x1bfbeeb)) returned 1 [0065.238] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.238] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2f5f8, lpOverlapped=0x0) returned 1 [0065.242] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV") returned="BOMB.WAV" [0065.242] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.243] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2f5f8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2f5f8, lpOverlapped=0x0) returned 1 [0065.243] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.244] CloseHandle (hObject=0x8c) returned 1 [0065.244] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\bomb.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\media\\bomb.wav.wannacry")) returned 1 [0065.245] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106db200, ftCreationTime.dwHighDateTime=0x1bfc6e8, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x106db200, ftLastWriteTime.dwHighDateTime=0x1bfc6e8, nFileSizeHigh=0x0, nFileSizeLow=0x10c2, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="BREEZE.WAV", cAlternateFileName="")) returned 1 [0065.245] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.245] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BREEZE.WAV") returned 1 [0065.245] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BREEZE.WAV") returned 1 [0065.245] lstrcmpiA (lpString1="", lpString2="BREEZE.WAV") returned -1 [0065.245] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV") returned="BOMB.WAV" [0065.245] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0065.245] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0065.245] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20 [0065.245] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="BREEZE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" [0065.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.zip") returned 0 [0065.246] lstrlenA (lpString="*.zip") returned 5 [0065.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.rar") returned 0 [0065.246] lstrlenA (lpString="*.rar") returned 5 [0065.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.7z") returned 0 [0065.246] lstrlenA (lpString="*.7z") returned 4 [0065.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.tar") returned 0 [0065.246] lstrlenA (lpString="*.tar") returned 5 [0065.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.gzip") returned 0 [0065.246] lstrlenA (lpString="*.gzip") returned 6 [0065.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.jpg") returned 0 [0065.246] lstrlenA (lpString="*.jpg") returned 5 [0065.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.jpeg") returned 0 [0065.246] lstrlenA (lpString="*.jpeg") returned 6 [0065.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.psd") returned 0 [0065.246] lstrlenA (lpString="*.psd") returned 5 [0065.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.gif") returned 0 [0065.246] lstrlenA (lpString="*.gif") returned 5 [0065.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.doc") returned 0 [0065.246] lstrlenA (lpString="*.doc") returned 5 [0065.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.docx") returned 0 [0065.246] lstrlenA (lpString="*.docx") returned 6 [0065.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.xls") returned 0 [0065.246] lstrlenA (lpString="*.xls") returned 5 [0065.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.xlsx") returned 0 [0065.246] lstrlenA (lpString="*.xlsx") returned 6 [0065.246] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.ppt") returned 0 [0065.247] lstrlenA (lpString="*.ppt") returned 5 [0065.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.pptx") returned 0 [0065.247] lstrlenA (lpString="*.pptx") returned 6 [0065.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.pdf") returned 0 [0065.247] lstrlenA (lpString="*.pdf") returned 5 [0065.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.mov") returned 0 [0065.247] lstrlenA (lpString="*.mov") returned 5 [0065.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.m2v") returned 0 [0065.247] lstrlenA (lpString="*.m2v") returned 5 [0065.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.3gp") returned 0 [0065.247] lstrlenA (lpString="*.3gp") returned 5 [0065.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.mpeg") returned 0 [0065.247] lstrlenA (lpString="*.mpeg") returned 6 [0065.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.mpg") returned 0 [0065.247] lstrlenA (lpString="*.mpg") returned 5 [0065.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.flv") returned 0 [0065.247] lstrlenA (lpString="*.flv") returned 5 [0065.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.avi") returned 0 [0065.247] lstrlenA (lpString="*.avi") returned 5 [0065.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.mp4") returned 0 [0065.247] lstrlenA (lpString="*.mp4") returned 5 [0065.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.wmv") returned 0 [0065.247] lstrlenA (lpString="*.wmv") returned 5 [0065.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.divx") returned 0 [0065.247] lstrlenA (lpString="*.divx") returned 6 [0065.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.mkv") returned 0 [0065.247] lstrlenA (lpString="*.mkv") returned 5 [0065.247] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.mp3") returned 0 [0065.248] lstrlenA (lpString="*.mp3") returned 5 [0065.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.wav") returned 1 [0065.248] lstrlenA (lpString="*.wav") returned 5 [0065.248] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" [0065.248] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" [0065.248] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV." [0065.248] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV.wannacry" [0065.248] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\breeze.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0065.249] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10c2 [0065.249] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x106db200, dwHighDateTime=0x1bfc6e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x6003c730, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x106db200, dwHighDateTime=0x1bfc6e8)) returned 1 [0065.249] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.249] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1044, lpOverlapped=0x0) returned 1 [0065.251] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV") returned="BREEZE.WAV" [0065.251] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.251] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1044, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1044, lpOverlapped=0x0) returned 1 [0065.252] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.252] CloseHandle (hObject=0x8c) returned 1 [0065.252] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\breeze.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\media\\breeze.wav.wannacry")) returned 1 [0065.253] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="CAMERA.WAV", cAlternateFileName="")) returned 1 [0065.253] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.253] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CAMERA.WAV") returned 1 [0065.253] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CAMERA.WAV") returned 1 [0065.253] lstrcmpiA (lpString1="", lpString2="CAMERA.WAV") returned -1 [0065.253] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV") returned="BREEZE.WAV" [0065.253] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0065.253] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0065.253] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" [0065.253] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20 [0065.253] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="CAMERA.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" [0065.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.zip") returned 0 [0065.254] lstrlenA (lpString="*.zip") returned 5 [0065.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.rar") returned 0 [0065.254] lstrlenA (lpString="*.rar") returned 5 [0065.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.7z") returned 0 [0065.254] lstrlenA (lpString="*.7z") returned 4 [0065.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.tar") returned 0 [0065.254] lstrlenA (lpString="*.tar") returned 5 [0065.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.gzip") returned 0 [0065.254] lstrlenA (lpString="*.gzip") returned 6 [0065.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.jpg") returned 0 [0065.254] lstrlenA (lpString="*.jpg") returned 5 [0065.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.jpeg") returned 0 [0065.254] lstrlenA (lpString="*.jpeg") returned 6 [0065.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.psd") returned 0 [0065.254] lstrlenA (lpString="*.psd") returned 5 [0065.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.gif") returned 0 [0065.254] lstrlenA (lpString="*.gif") returned 5 [0065.254] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.doc") returned 0 [0065.254] lstrlenA (lpString="*.doc") returned 5 [0065.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.docx") returned 0 [0065.255] lstrlenA (lpString="*.docx") returned 6 [0065.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.xls") returned 0 [0065.255] lstrlenA (lpString="*.xls") returned 5 [0065.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.xlsx") returned 0 [0065.255] lstrlenA (lpString="*.xlsx") returned 6 [0065.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.ppt") returned 0 [0065.255] lstrlenA (lpString="*.ppt") returned 5 [0065.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.pptx") returned 0 [0065.255] lstrlenA (lpString="*.pptx") returned 6 [0065.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.pdf") returned 0 [0065.255] lstrlenA (lpString="*.pdf") returned 5 [0065.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.mov") returned 0 [0065.255] lstrlenA (lpString="*.mov") returned 5 [0065.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.m2v") returned 0 [0065.255] lstrlenA (lpString="*.m2v") returned 5 [0065.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.3gp") returned 0 [0065.255] lstrlenA (lpString="*.3gp") returned 5 [0065.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.mpeg") returned 0 [0065.255] lstrlenA (lpString="*.mpeg") returned 6 [0065.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.mpg") returned 0 [0065.255] lstrlenA (lpString="*.mpg") returned 5 [0065.255] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.flv") returned 0 [0065.256] lstrlenA (lpString="*.flv") returned 5 [0065.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.avi") returned 0 [0065.256] lstrlenA (lpString="*.avi") returned 5 [0065.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.mp4") returned 0 [0065.256] lstrlenA (lpString="*.mp4") returned 5 [0065.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.wmv") returned 0 [0065.256] lstrlenA (lpString="*.wmv") returned 5 [0065.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.divx") returned 0 [0065.256] lstrlenA (lpString="*.divx") returned 6 [0065.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.mkv") returned 0 [0065.256] lstrlenA (lpString="*.mkv") returned 5 [0065.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.mp3") returned 0 [0065.256] lstrlenA (lpString="*.mp3") returned 5 [0065.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.wav") returned 1 [0065.256] lstrlenA (lpString="*.wav") returned 5 [0065.256] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" [0065.256] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" [0065.256] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV." [0065.256] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV.wannacry" [0065.256] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\camera.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0065.257] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1594 [0065.257] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47), lpLastAccessTime=0x407536*(dwLowDateTime=0x51c2ab50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47)) returned 1 [0065.257] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.258] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1516, lpOverlapped=0x0) returned 1 [0065.259] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV") returned="CAMERA.WAV" [0065.259] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.260] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1516, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1516, lpOverlapped=0x0) returned 1 [0065.260] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.260] CloseHandle (hObject=0x8c) returned 1 [0065.260] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\camera.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\media\\camera.wav.wannacry")) returned 1 [0065.261] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x1d7f, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="CASHREG.WAV", cAlternateFileName="")) returned 1 [0065.261] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.261] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CASHREG.WAV") returned 1 [0065.261] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CASHREG.WAV") returned 1 [0065.261] lstrcmpiA (lpString1="", lpString2="CASHREG.WAV") returned -1 [0065.262] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV") returned="CAMERA.WAV" [0065.262] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0065.262] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0065.262] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" [0065.262] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20 [0065.262] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="CASHREG.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" [0065.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.zip") returned 0 [0065.262] lstrlenA (lpString="*.zip") returned 5 [0065.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.rar") returned 0 [0065.262] lstrlenA (lpString="*.rar") returned 5 [0065.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.7z") returned 0 [0065.262] lstrlenA (lpString="*.7z") returned 4 [0065.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.tar") returned 0 [0065.262] lstrlenA (lpString="*.tar") returned 5 [0065.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.gzip") returned 0 [0065.262] lstrlenA (lpString="*.gzip") returned 6 [0065.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.jpg") returned 0 [0065.262] lstrlenA (lpString="*.jpg") returned 5 [0065.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.jpeg") returned 0 [0065.262] lstrlenA (lpString="*.jpeg") returned 6 [0065.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.psd") returned 0 [0065.263] lstrlenA (lpString="*.psd") returned 5 [0065.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.gif") returned 0 [0065.263] lstrlenA (lpString="*.gif") returned 5 [0065.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.doc") returned 0 [0065.263] lstrlenA (lpString="*.doc") returned 5 [0065.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.docx") returned 0 [0065.263] lstrlenA (lpString="*.docx") returned 6 [0065.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.xls") returned 0 [0065.263] lstrlenA (lpString="*.xls") returned 5 [0065.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.xlsx") returned 0 [0065.263] lstrlenA (lpString="*.xlsx") returned 6 [0065.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.ppt") returned 0 [0065.263] lstrlenA (lpString="*.ppt") returned 5 [0065.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.pptx") returned 0 [0065.263] lstrlenA (lpString="*.pptx") returned 6 [0065.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.pdf") returned 0 [0065.263] lstrlenA (lpString="*.pdf") returned 5 [0065.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.mov") returned 0 [0065.263] lstrlenA (lpString="*.mov") returned 5 [0065.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.m2v") returned 0 [0065.263] lstrlenA (lpString="*.m2v") returned 5 [0065.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.3gp") returned 0 [0065.263] lstrlenA (lpString="*.3gp") returned 5 [0065.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.mpeg") returned 0 [0065.264] lstrlenA (lpString="*.mpeg") returned 6 [0065.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.mpg") returned 0 [0065.264] lstrlenA (lpString="*.mpg") returned 5 [0065.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.flv") returned 0 [0065.264] lstrlenA (lpString="*.flv") returned 5 [0065.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.avi") returned 0 [0065.264] lstrlenA (lpString="*.avi") returned 5 [0065.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.mp4") returned 0 [0065.264] lstrlenA (lpString="*.mp4") returned 5 [0065.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.wmv") returned 0 [0065.264] lstrlenA (lpString="*.wmv") returned 5 [0065.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.divx") returned 0 [0065.264] lstrlenA (lpString="*.divx") returned 6 [0065.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.mkv") returned 0 [0065.264] lstrlenA (lpString="*.mkv") returned 5 [0065.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.mp3") returned 0 [0065.264] lstrlenA (lpString="*.mp3") returned 5 [0065.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.wav") returned 1 [0065.264] lstrlenA (lpString="*.wav") returned 5 [0065.264] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" [0065.264] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" [0065.264] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV." [0065.264] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV.wannacry" [0065.265] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\cashreg.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0065.265] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d7f [0065.265] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47), lpLastAccessTime=0x407536*(dwLowDateTime=0x51c50cb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47)) returned 1 [0065.266] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.266] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1d01, lpOverlapped=0x0) returned 1 [0065.268] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV") returned="CASHREG.WAV" [0065.268] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.268] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1d01, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1d01, lpOverlapped=0x0) returned 1 [0065.268] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.268] CloseHandle (hObject=0x8c) returned 1 [0065.268] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\cashreg.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\media\\cashreg.wav.wannacry")) returned 1 [0065.269] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796bf00, ftCreationTime.dwHighDateTime=0x1bd8ab7, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb796bf00, ftLastWriteTime.dwHighDateTime=0x1bd8ab7, nFileSizeHigh=0x0, nFileSizeLow=0x91be, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="CHIMES.WAV", cAlternateFileName="")) returned 1 [0065.269] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.269] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CHIMES.WAV") returned 1 [0065.269] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CHIMES.WAV") returned 1 [0065.269] lstrcmpiA (lpString1="", lpString2="CHIMES.WAV") returned -1 [0065.269] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV") returned="CASHREG.WAV" [0065.269] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0065.270] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0065.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" [0065.270] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20 [0065.270] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="CHIMES.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" [0065.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.zip") returned 0 [0065.270] lstrlenA (lpString="*.zip") returned 5 [0065.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.rar") returned 0 [0065.270] lstrlenA (lpString="*.rar") returned 5 [0065.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.7z") returned 0 [0065.270] lstrlenA (lpString="*.7z") returned 4 [0065.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.tar") returned 0 [0065.270] lstrlenA (lpString="*.tar") returned 5 [0065.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.gzip") returned 0 [0065.270] lstrlenA (lpString="*.gzip") returned 6 [0065.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.jpg") returned 0 [0065.270] lstrlenA (lpString="*.jpg") returned 5 [0065.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.jpeg") returned 0 [0065.270] lstrlenA (lpString="*.jpeg") returned 6 [0065.270] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.psd") returned 0 [0065.270] lstrlenA (lpString="*.psd") returned 5 [0065.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.gif") returned 0 [0065.271] lstrlenA (lpString="*.gif") returned 5 [0065.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.doc") returned 0 [0065.271] lstrlenA (lpString="*.doc") returned 5 [0065.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.docx") returned 0 [0065.271] lstrlenA (lpString="*.docx") returned 6 [0065.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.xls") returned 0 [0065.271] lstrlenA (lpString="*.xls") returned 5 [0065.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.xlsx") returned 0 [0065.271] lstrlenA (lpString="*.xlsx") returned 6 [0065.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.ppt") returned 0 [0065.271] lstrlenA (lpString="*.ppt") returned 5 [0065.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.pptx") returned 0 [0065.271] lstrlenA (lpString="*.pptx") returned 6 [0065.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.pdf") returned 0 [0065.271] lstrlenA (lpString="*.pdf") returned 5 [0065.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.mov") returned 0 [0065.271] lstrlenA (lpString="*.mov") returned 5 [0065.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.m2v") returned 0 [0065.271] lstrlenA (lpString="*.m2v") returned 5 [0065.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.3gp") returned 0 [0065.271] lstrlenA (lpString="*.3gp") returned 5 [0065.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.mpeg") returned 0 [0065.271] lstrlenA (lpString="*.mpeg") returned 6 [0065.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.mpg") returned 0 [0065.272] lstrlenA (lpString="*.mpg") returned 5 [0065.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.flv") returned 0 [0065.272] lstrlenA (lpString="*.flv") returned 5 [0065.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.avi") returned 0 [0065.272] lstrlenA (lpString="*.avi") returned 5 [0065.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.mp4") returned 0 [0065.272] lstrlenA (lpString="*.mp4") returned 5 [0065.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.wmv") returned 0 [0065.272] lstrlenA (lpString="*.wmv") returned 5 [0065.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.divx") returned 0 [0065.272] lstrlenA (lpString="*.divx") returned 6 [0065.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.mkv") returned 0 [0065.272] lstrlenA (lpString="*.mkv") returned 5 [0065.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.mp3") returned 0 [0065.272] lstrlenA (lpString="*.mp3") returned 5 [0065.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.wav") returned 1 [0065.272] lstrlenA (lpString="*.wav") returned 5 [0065.272] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" [0065.272] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" [0065.272] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV." [0065.272] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV.wannacry" [0065.272] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\chimes.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0065.274] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x91be [0065.274] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb796bf00, dwHighDateTime=0x1bd8ab7), lpLastAccessTime=0x407536*(dwLowDateTime=0x51c76e10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb796bf00, dwHighDateTime=0x1bd8ab7)) returned 1 [0065.274] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.274] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x9140, lpOverlapped=0x0) returned 1 [0065.277] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV") returned="CHIMES.WAV" [0065.277] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.277] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x9140, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x9140, lpOverlapped=0x0) returned 1 [0065.277] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.278] CloseHandle (hObject=0x8c) returned 1 [0065.278] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\chimes.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\media\\chimes.wav.wannacry")) returned 1 [0065.279] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffbd3c00, ftCreationTime.dwHighDateTime=0x1bfc6e7, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffbd3c00, ftLastWriteTime.dwHighDateTime=0x1bfc6e7, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="CLICK.WAV", cAlternateFileName="")) returned 1 [0065.279] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.279] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CLICK.WAV") returned 1 [0065.279] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CLICK.WAV") returned 1 [0065.279] lstrcmpiA (lpString1="", lpString2="CLICK.WAV") returned -1 [0065.279] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV") returned="CHIMES.WAV" [0065.279] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0065.279] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0065.279] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" [0065.279] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20 [0065.279] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="CLICK.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" [0065.279] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.zip") returned 0 [0065.280] lstrlenA (lpString="*.zip") returned 5 [0065.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.rar") returned 0 [0065.280] lstrlenA (lpString="*.rar") returned 5 [0065.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.7z") returned 0 [0065.280] lstrlenA (lpString="*.7z") returned 4 [0065.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.tar") returned 0 [0065.280] lstrlenA (lpString="*.tar") returned 5 [0065.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.gzip") returned 0 [0065.280] lstrlenA (lpString="*.gzip") returned 6 [0065.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.jpg") returned 0 [0065.280] lstrlenA (lpString="*.jpg") returned 5 [0065.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.jpeg") returned 0 [0065.280] lstrlenA (lpString="*.jpeg") returned 6 [0065.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.psd") returned 0 [0065.280] lstrlenA (lpString="*.psd") returned 5 [0065.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.gif") returned 0 [0065.280] lstrlenA (lpString="*.gif") returned 5 [0065.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.doc") returned 0 [0065.280] lstrlenA (lpString="*.doc") returned 5 [0065.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.docx") returned 0 [0065.280] lstrlenA (lpString="*.docx") returned 6 [0065.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.xls") returned 0 [0065.280] lstrlenA (lpString="*.xls") returned 5 [0065.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.xlsx") returned 0 [0065.281] lstrlenA (lpString="*.xlsx") returned 6 [0065.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.ppt") returned 0 [0065.281] lstrlenA (lpString="*.ppt") returned 5 [0065.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.pptx") returned 0 [0065.281] lstrlenA (lpString="*.pptx") returned 6 [0065.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.pdf") returned 0 [0065.281] lstrlenA (lpString="*.pdf") returned 5 [0065.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.mov") returned 0 [0065.281] lstrlenA (lpString="*.mov") returned 5 [0065.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.m2v") returned 0 [0065.281] lstrlenA (lpString="*.m2v") returned 5 [0065.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.3gp") returned 0 [0065.281] lstrlenA (lpString="*.3gp") returned 5 [0065.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.mpeg") returned 0 [0065.281] lstrlenA (lpString="*.mpeg") returned 6 [0065.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.mpg") returned 0 [0065.281] lstrlenA (lpString="*.mpg") returned 5 [0065.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.flv") returned 0 [0065.281] lstrlenA (lpString="*.flv") returned 5 [0065.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.avi") returned 0 [0065.281] lstrlenA (lpString="*.avi") returned 5 [0065.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.mp4") returned 0 [0065.281] lstrlenA (lpString="*.mp4") returned 5 [0065.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.wmv") returned 0 [0065.282] lstrlenA (lpString="*.wmv") returned 5 [0065.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.divx") returned 0 [0065.282] lstrlenA (lpString="*.divx") returned 6 [0065.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.mkv") returned 0 [0065.282] lstrlenA (lpString="*.mkv") returned 5 [0065.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.mp3") returned 0 [0065.282] lstrlenA (lpString="*.mp3") returned 5 [0065.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.wav") returned 1 [0065.282] lstrlenA (lpString="*.wav") returned 5 [0065.282] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" [0065.282] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" [0065.282] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV." [0065.282] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV.wannacry" [0065.282] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\click.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0065.285] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x268 [0065.285] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xffbd3c00, dwHighDateTime=0x1bfc6e7), lpLastAccessTime=0x407536*(dwLowDateTime=0x51c76e10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xffbd3c00, dwHighDateTime=0x1bfc6e7)) returned 1 [0065.286] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.286] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1ea, lpOverlapped=0x0) returned 1 [0065.287] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV") returned="CLICK.WAV" [0065.287] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.287] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1ea, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1ea, lpOverlapped=0x0) returned 1 [0065.287] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.287] CloseHandle (hObject=0x8c) returned 1 [0065.287] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\click.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\media\\click.wav.wannacry")) returned 1 [0065.289] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef0cc600, ftCreationTime.dwHighDateTime=0x1bfc6e7, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xef0cc600, ftLastWriteTime.dwHighDateTime=0x1bfc6e7, nFileSizeHigh=0x0, nFileSizeLow=0x15bc, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="COIN.WAV", cAlternateFileName="")) returned 1 [0065.290] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.290] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="COIN.WAV") returned 1 [0065.290] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="COIN.WAV") returned 1 [0065.290] lstrcmpiA (lpString1="", lpString2="COIN.WAV") returned -1 [0065.290] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV") returned="CLICK.WAV" [0065.290] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0065.290] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0065.290] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" [0065.290] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20 [0065.290] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="COIN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" [0065.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.zip") returned 0 [0065.290] lstrlenA (lpString="*.zip") returned 5 [0065.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.rar") returned 0 [0065.290] lstrlenA (lpString="*.rar") returned 5 [0065.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.7z") returned 0 [0065.290] lstrlenA (lpString="*.7z") returned 4 [0065.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.tar") returned 0 [0065.290] lstrlenA (lpString="*.tar") returned 5 [0065.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.gzip") returned 0 [0065.290] lstrlenA (lpString="*.gzip") returned 6 [0065.290] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.jpg") returned 0 [0065.290] lstrlenA (lpString="*.jpg") returned 5 [0065.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.jpeg") returned 0 [0065.291] lstrlenA (lpString="*.jpeg") returned 6 [0065.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.psd") returned 0 [0065.291] lstrlenA (lpString="*.psd") returned 5 [0065.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.gif") returned 0 [0065.291] lstrlenA (lpString="*.gif") returned 5 [0065.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.doc") returned 0 [0065.291] lstrlenA (lpString="*.doc") returned 5 [0065.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.docx") returned 0 [0065.291] lstrlenA (lpString="*.docx") returned 6 [0065.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.xls") returned 0 [0065.291] lstrlenA (lpString="*.xls") returned 5 [0065.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.xlsx") returned 0 [0065.291] lstrlenA (lpString="*.xlsx") returned 6 [0065.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.ppt") returned 0 [0065.291] lstrlenA (lpString="*.ppt") returned 5 [0065.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.pptx") returned 0 [0065.291] lstrlenA (lpString="*.pptx") returned 6 [0065.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.pdf") returned 0 [0065.291] lstrlenA (lpString="*.pdf") returned 5 [0065.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.mov") returned 0 [0065.291] lstrlenA (lpString="*.mov") returned 5 [0065.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.m2v") returned 0 [0065.291] lstrlenA (lpString="*.m2v") returned 5 [0065.291] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.3gp") returned 0 [0065.292] lstrlenA (lpString="*.3gp") returned 5 [0065.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.mpeg") returned 0 [0065.292] lstrlenA (lpString="*.mpeg") returned 6 [0065.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.mpg") returned 0 [0065.292] lstrlenA (lpString="*.mpg") returned 5 [0065.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.flv") returned 0 [0065.292] lstrlenA (lpString="*.flv") returned 5 [0065.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.avi") returned 0 [0065.292] lstrlenA (lpString="*.avi") returned 5 [0065.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.mp4") returned 0 [0065.292] lstrlenA (lpString="*.mp4") returned 5 [0065.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.wmv") returned 0 [0065.292] lstrlenA (lpString="*.wmv") returned 5 [0065.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.divx") returned 0 [0065.292] lstrlenA (lpString="*.divx") returned 6 [0065.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.mkv") returned 0 [0065.292] lstrlenA (lpString="*.mkv") returned 5 [0065.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.mp3") returned 0 [0065.292] lstrlenA (lpString="*.mp3") returned 5 [0065.292] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.wav") returned 1 [0065.292] lstrlenA (lpString="*.wav") returned 5 [0065.292] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" [0065.292] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" [0065.292] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV." [0065.292] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV.wannacry" [0065.293] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\coin.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0065.293] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15bc [0065.293] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xef0cc600, dwHighDateTime=0x1bfc6e7), lpLastAccessTime=0x407536*(dwLowDateTime=0x51c76e10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xef0cc600, dwHighDateTime=0x1bfc6e7)) returned 1 [0065.294] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.294] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x153e, lpOverlapped=0x0) returned 1 [0065.296] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV") returned="COIN.WAV" [0065.296] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.296] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x153e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x153e, lpOverlapped=0x0) returned 1 [0065.296] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.296] CloseHandle (hObject=0x8c) returned 1 [0065.296] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\coin.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\media\\coin.wav.wannacry")) returned 1 [0065.297] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x4be2, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="DRUMROLL.WAV", cAlternateFileName="")) returned 1 [0065.297] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.298] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DRUMROLL.WAV") returned 1 [0065.298] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DRUMROLL.WAV") returned 1 [0065.298] lstrcmpiA (lpString1="", lpString2="DRUMROLL.WAV") returned -1 [0065.298] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV") returned="COIN.WAV" [0065.298] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0065.298] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0065.298] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" [0065.298] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20 [0065.298] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="DRUMROLL.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" [0065.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.zip") returned 0 [0065.298] lstrlenA (lpString="*.zip") returned 5 [0065.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.rar") returned 0 [0065.298] lstrlenA (lpString="*.rar") returned 5 [0065.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.7z") returned 0 [0065.298] lstrlenA (lpString="*.7z") returned 4 [0065.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.tar") returned 0 [0065.298] lstrlenA (lpString="*.tar") returned 5 [0065.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.gzip") returned 0 [0065.298] lstrlenA (lpString="*.gzip") returned 6 [0065.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.jpg") returned 0 [0065.298] lstrlenA (lpString="*.jpg") returned 5 [0065.298] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.jpeg") returned 0 [0065.298] lstrlenA (lpString="*.jpeg") returned 6 [0065.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.psd") returned 0 [0065.299] lstrlenA (lpString="*.psd") returned 5 [0065.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.gif") returned 0 [0065.299] lstrlenA (lpString="*.gif") returned 5 [0065.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.doc") returned 0 [0065.299] lstrlenA (lpString="*.doc") returned 5 [0065.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.docx") returned 0 [0065.299] lstrlenA (lpString="*.docx") returned 6 [0065.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.xls") returned 0 [0065.299] lstrlenA (lpString="*.xls") returned 5 [0065.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.xlsx") returned 0 [0065.299] lstrlenA (lpString="*.xlsx") returned 6 [0065.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.ppt") returned 0 [0065.299] lstrlenA (lpString="*.ppt") returned 5 [0065.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.pptx") returned 0 [0065.299] lstrlenA (lpString="*.pptx") returned 6 [0065.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.pdf") returned 0 [0065.299] lstrlenA (lpString="*.pdf") returned 5 [0065.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.mov") returned 0 [0065.299] lstrlenA (lpString="*.mov") returned 5 [0065.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.m2v") returned 0 [0065.299] lstrlenA (lpString="*.m2v") returned 5 [0065.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.3gp") returned 0 [0065.299] lstrlenA (lpString="*.3gp") returned 5 [0065.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.mpeg") returned 0 [0065.299] lstrlenA (lpString="*.mpeg") returned 6 [0065.299] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.mpg") returned 0 [0065.300] lstrlenA (lpString="*.mpg") returned 5 [0065.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.flv") returned 0 [0065.300] lstrlenA (lpString="*.flv") returned 5 [0065.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.avi") returned 0 [0065.300] lstrlenA (lpString="*.avi") returned 5 [0065.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.mp4") returned 0 [0065.300] lstrlenA (lpString="*.mp4") returned 5 [0065.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.wmv") returned 0 [0065.300] lstrlenA (lpString="*.wmv") returned 5 [0065.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.divx") returned 0 [0065.300] lstrlenA (lpString="*.divx") returned 6 [0065.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.mkv") returned 0 [0065.300] lstrlenA (lpString="*.mkv") returned 5 [0065.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.mp3") returned 0 [0065.300] lstrlenA (lpString="*.mp3") returned 5 [0065.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.wav") returned 1 [0065.300] lstrlenA (lpString="*.wav") returned 5 [0065.300] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" [0065.300] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" [0065.300] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV." [0065.300] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV.wannacry" [0065.300] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\drumroll.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0065.302] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4be2 [0065.302] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47), lpLastAccessTime=0x407536*(dwLowDateTime=0x607d2d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47)) returned 1 [0065.302] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.302] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4b64, lpOverlapped=0x0) returned 1 [0065.304] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV") returned="DRUMROLL.WAV" [0065.304] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.304] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4b64, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4b64, lpOverlapped=0x0) returned 1 [0065.305] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.305] CloseHandle (hObject=0x8c) returned 1 [0065.305] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\drumroll.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\media\\drumroll.wav.wannacry")) returned 1 [0065.306] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x5c20, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="EXPLODE.WAV", cAlternateFileName="")) returned 1 [0065.306] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.306] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EXPLODE.WAV") returned -1 [0065.306] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXPLODE.WAV") returned 1 [0065.306] lstrcmpiA (lpString1="", lpString2="EXPLODE.WAV") returned -1 [0065.306] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV") returned="DRUMROLL.WAV" [0065.306] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0065.306] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0065.306] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" [0065.306] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20 [0065.306] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="EXPLODE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV" [0065.306] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.zip") returned 0 [0065.306] lstrlenA (lpString="*.zip") returned 5 [0065.306] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.rar") returned 0 [0065.307] lstrlenA (lpString="*.rar") returned 5 [0065.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.7z") returned 0 [0065.307] lstrlenA (lpString="*.7z") returned 4 [0065.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.tar") returned 0 [0065.307] lstrlenA (lpString="*.tar") returned 5 [0065.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.gzip") returned 0 [0065.307] lstrlenA (lpString="*.gzip") returned 6 [0065.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.jpg") returned 0 [0065.307] lstrlenA (lpString="*.jpg") returned 5 [0065.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.jpeg") returned 0 [0065.307] lstrlenA (lpString="*.jpeg") returned 6 [0065.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.psd") returned 0 [0065.307] lstrlenA (lpString="*.psd") returned 5 [0065.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.gif") returned 0 [0065.307] lstrlenA (lpString="*.gif") returned 5 [0065.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.doc") returned 0 [0065.307] lstrlenA (lpString="*.doc") returned 5 [0065.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.docx") returned 0 [0065.307] lstrlenA (lpString="*.docx") returned 6 [0065.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.xls") returned 0 [0065.307] lstrlenA (lpString="*.xls") returned 5 [0065.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.xlsx") returned 0 [0065.307] lstrlenA (lpString="*.xlsx") returned 6 [0065.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.ppt") returned 0 [0065.307] lstrlenA (lpString="*.ppt") returned 5 [0065.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.pptx") returned 0 [0065.307] lstrlenA (lpString="*.pptx") returned 6 [0065.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.pdf") returned 0 [0065.308] lstrlenA (lpString="*.pdf") returned 5 [0065.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.mov") returned 0 [0065.308] lstrlenA (lpString="*.mov") returned 5 [0065.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.m2v") returned 0 [0065.308] lstrlenA (lpString="*.m2v") returned 5 [0065.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.3gp") returned 0 [0065.308] lstrlenA (lpString="*.3gp") returned 5 [0065.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.mpeg") returned 0 [0065.308] lstrlenA (lpString="*.mpeg") returned 6 [0065.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.mpg") returned 0 [0065.308] lstrlenA (lpString="*.mpg") returned 5 [0065.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.flv") returned 0 [0065.308] lstrlenA (lpString="*.flv") returned 5 [0065.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.avi") returned 0 [0065.308] lstrlenA (lpString="*.avi") returned 5 [0065.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.mp4") returned 0 [0065.308] lstrlenA (lpString="*.mp4") returned 5 [0065.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.wmv") returned 0 [0065.308] lstrlenA (lpString="*.wmv") returned 5 [0065.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.divx") returned 0 [0065.308] lstrlenA (lpString="*.divx") returned 6 [0065.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.mkv") returned 0 [0065.308] lstrlenA (lpString="*.mkv") returned 5 [0065.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.mp3") returned 0 [0065.308] lstrlenA (lpString="*.mp3") returned 5 [0065.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.wav") returned 1 [0065.308] lstrlenA (lpString="*.wav") returned 5 [0065.308] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV" [0065.309] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV" [0065.309] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV." [0065.309] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV.wannacry" [0065.309] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\explode.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0065.310] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5c20 [0065.310] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47), lpLastAccessTime=0x407536*(dwLowDateTime=0x60af2a30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47)) returned 1 [0065.310] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.310] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x5ba2, lpOverlapped=0x0) returned 1 [0065.313] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV") returned="EXPLODE.WAV" [0065.313] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.313] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x5ba2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x5ba2, lpOverlapped=0x0) returned 1 [0065.313] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.313] CloseHandle (hObject=0x8c) returned 1 [0065.314] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\explode.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\media\\explode.wav.wannacry")) returned 1 [0065.315] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb836b000, ftCreationTime.dwHighDateTime=0x1bfc6e7, ftLastAccessTime.dwLowDateTime=0x53822dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb836b000, ftLastWriteTime.dwHighDateTime=0x1bfc6e7, nFileSizeHigh=0x0, nFileSizeLow=0xfbc, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="HAMMER.WAV", cAlternateFileName="")) returned 1 [0065.315] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.315] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HAMMER.WAV") returned -1 [0065.315] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HAMMER.WAV") returned 1 [0065.315] lstrcmpiA (lpString1="", lpString2="HAMMER.WAV") returned -1 [0065.315] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV") returned="EXPLODE.WAV" [0065.315] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0065.315] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0065.315] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" [0065.315] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20 [0065.315] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HAMMER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV" [0065.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.zip") returned 0 [0065.315] lstrlenA (lpString="*.zip") returned 5 [0065.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.rar") returned 0 [0065.315] lstrlenA (lpString="*.rar") returned 5 [0065.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.7z") returned 0 [0065.315] lstrlenA (lpString="*.7z") returned 4 [0065.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.tar") returned 0 [0065.315] lstrlenA (lpString="*.tar") returned 5 [0065.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.gzip") returned 0 [0065.316] lstrlenA (lpString="*.gzip") returned 6 [0065.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.jpg") returned 0 [0065.316] lstrlenA (lpString="*.jpg") returned 5 [0065.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.jpeg") returned 0 [0065.316] lstrlenA (lpString="*.jpeg") returned 6 [0065.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.psd") returned 0 [0065.316] lstrlenA (lpString="*.psd") returned 5 [0065.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.gif") returned 0 [0065.316] lstrlenA (lpString="*.gif") returned 5 [0065.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.doc") returned 0 [0065.316] lstrlenA (lpString="*.doc") returned 5 [0065.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.docx") returned 0 [0065.316] lstrlenA (lpString="*.docx") returned 6 [0065.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.xls") returned 0 [0065.316] lstrlenA (lpString="*.xls") returned 5 [0065.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.xlsx") returned 0 [0065.316] lstrlenA (lpString="*.xlsx") returned 6 [0065.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.ppt") returned 0 [0065.316] lstrlenA (lpString="*.ppt") returned 5 [0065.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.pptx") returned 0 [0065.316] lstrlenA (lpString="*.pptx") returned 6 [0065.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.pdf") returned 0 [0065.316] lstrlenA (lpString="*.pdf") returned 5 [0065.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.mov") returned 0 [0065.316] lstrlenA (lpString="*.mov") returned 5 [0065.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.m2v") returned 0 [0065.316] lstrlenA (lpString="*.m2v") returned 5 [0065.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.3gp") returned 0 [0065.317] lstrlenA (lpString="*.3gp") returned 5 [0065.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.mpeg") returned 0 [0065.317] lstrlenA (lpString="*.mpeg") returned 6 [0065.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.mpg") returned 0 [0065.317] lstrlenA (lpString="*.mpg") returned 5 [0065.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.flv") returned 0 [0065.317] lstrlenA (lpString="*.flv") returned 5 [0065.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.avi") returned 0 [0065.317] lstrlenA (lpString="*.avi") returned 5 [0065.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.mp4") returned 0 [0065.317] lstrlenA (lpString="*.mp4") returned 5 [0065.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.wmv") returned 0 [0065.317] lstrlenA (lpString="*.wmv") returned 5 [0065.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.divx") returned 0 [0065.317] lstrlenA (lpString="*.divx") returned 6 [0065.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.mkv") returned 0 [0065.317] lstrlenA (lpString="*.mkv") returned 5 [0065.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.mp3") returned 0 [0065.317] lstrlenA (lpString="*.mp3") returned 5 [0065.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.wav") returned 1 [0065.317] lstrlenA (lpString="*.wav") returned 5 [0065.317] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV" [0065.317] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV" [0065.317] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV." [0065.317] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV.wannacry" [0065.317] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\hammer.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0065.318] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfbc [0065.318] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb836b000, dwHighDateTime=0x1bfc6e7), lpLastAccessTime=0x407536*(dwLowDateTime=0x53822dd0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb836b000, dwHighDateTime=0x1bfc6e7)) returned 1 [0065.318] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.318] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xf3e, lpOverlapped=0x0) returned 1 [0065.320] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV") returned="HAMMER.WAV" [0065.320] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.320] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xf3e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xf3e, lpOverlapped=0x0) returned 1 [0065.321] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.321] CloseHandle (hObject=0x8c) returned 1 [0065.321] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\hammer.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\media\\hammer.wav.wannacry")) returned 1 [0065.322] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x72d, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="LASER.WAV", cAlternateFileName="")) returned 1 [0065.322] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.322] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LASER.WAV") returned -1 [0065.322] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LASER.WAV") returned -1 [0065.322] lstrcmpiA (lpString1="", lpString2="LASER.WAV") returned -1 [0065.322] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV") returned="HAMMER.WAV" [0065.322] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0065.322] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0065.322] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" [0065.322] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20 [0065.322] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="LASER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV" [0065.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.zip") returned 0 [0065.322] lstrlenA (lpString="*.zip") returned 5 [0065.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.rar") returned 0 [0065.323] lstrlenA (lpString="*.rar") returned 5 [0065.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.7z") returned 0 [0065.323] lstrlenA (lpString="*.7z") returned 4 [0065.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.tar") returned 0 [0065.323] lstrlenA (lpString="*.tar") returned 5 [0065.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.gzip") returned 0 [0065.323] lstrlenA (lpString="*.gzip") returned 6 [0065.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.jpg") returned 0 [0065.323] lstrlenA (lpString="*.jpg") returned 5 [0065.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.jpeg") returned 0 [0065.323] lstrlenA (lpString="*.jpeg") returned 6 [0065.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.psd") returned 0 [0065.323] lstrlenA (lpString="*.psd") returned 5 [0065.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.gif") returned 0 [0065.323] lstrlenA (lpString="*.gif") returned 5 [0065.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.doc") returned 0 [0065.323] lstrlenA (lpString="*.doc") returned 5 [0065.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.docx") returned 0 [0065.323] lstrlenA (lpString="*.docx") returned 6 [0065.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.xls") returned 0 [0065.323] lstrlenA (lpString="*.xls") returned 5 [0065.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.xlsx") returned 0 [0065.323] lstrlenA (lpString="*.xlsx") returned 6 [0065.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.ppt") returned 0 [0065.323] lstrlenA (lpString="*.ppt") returned 5 [0065.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.pptx") returned 0 [0065.323] lstrlenA (lpString="*.pptx") returned 6 [0065.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.pdf") returned 0 [0065.324] lstrlenA (lpString="*.pdf") returned 5 [0065.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.mov") returned 0 [0065.324] lstrlenA (lpString="*.mov") returned 5 [0065.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.m2v") returned 0 [0065.324] lstrlenA (lpString="*.m2v") returned 5 [0065.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.3gp") returned 0 [0065.324] lstrlenA (lpString="*.3gp") returned 5 [0065.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.mpeg") returned 0 [0065.324] lstrlenA (lpString="*.mpeg") returned 6 [0065.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.mpg") returned 0 [0065.324] lstrlenA (lpString="*.mpg") returned 5 [0065.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.flv") returned 0 [0065.324] lstrlenA (lpString="*.flv") returned 5 [0065.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.avi") returned 0 [0065.324] lstrlenA (lpString="*.avi") returned 5 [0065.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.mp4") returned 0 [0065.324] lstrlenA (lpString="*.mp4") returned 5 [0065.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.wmv") returned 0 [0065.324] lstrlenA (lpString="*.wmv") returned 5 [0065.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.divx") returned 0 [0065.324] lstrlenA (lpString="*.divx") returned 6 [0065.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.mkv") returned 0 [0065.324] lstrlenA (lpString="*.mkv") returned 5 [0065.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.mp3") returned 0 [0065.324] lstrlenA (lpString="*.mp3") returned 5 [0065.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.wav") returned 1 [0065.325] lstrlenA (lpString="*.wav") returned 5 [0065.325] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV" [0065.325] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV" [0065.325] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV." [0065.325] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV.wannacry" [0065.325] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\laser.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0065.325] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x72d [0065.325] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47), lpLastAccessTime=0x407536*(dwLowDateTime=0x66220ff0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47)) returned 1 [0065.326] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.326] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x6af, lpOverlapped=0x0) returned 1 [0065.327] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV") returned="LASER.WAV" [0065.327] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.327] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x6af, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x6af, lpOverlapped=0x0) returned 1 [0065.328] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.328] CloseHandle (hObject=0x8c) returned 1 [0065.328] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\laser.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\media\\laser.wav.wannacry")) returned 1 [0065.329] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4b5dc00, ftCreationTime.dwHighDateTime=0x1bfc6e6, ftLastAccessTime.dwLowDateTime=0x5a7913b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4b5dc00, ftLastWriteTime.dwHighDateTime=0x1bfc6e6, nFileSizeHigh=0x0, nFileSizeLow=0x3d84, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="PUSH.WAV", cAlternateFileName="")) returned 1 [0065.329] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.329] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PUSH.WAV") returned -1 [0065.329] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PUSH.WAV") returned -1 [0065.329] lstrcmpiA (lpString1="", lpString2="PUSH.WAV") returned -1 [0065.329] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV") returned="LASER.WAV" [0065.329] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0065.329] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0065.329] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" [0065.329] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20 [0065.329] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="PUSH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV" [0065.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.zip") returned 0 [0065.329] lstrlenA (lpString="*.zip") returned 5 [0065.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.rar") returned 0 [0065.330] lstrlenA (lpString="*.rar") returned 5 [0065.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.7z") returned 0 [0065.330] lstrlenA (lpString="*.7z") returned 4 [0065.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.tar") returned 0 [0065.330] lstrlenA (lpString="*.tar") returned 5 [0065.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.gzip") returned 0 [0065.330] lstrlenA (lpString="*.gzip") returned 6 [0065.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.jpg") returned 0 [0065.330] lstrlenA (lpString="*.jpg") returned 5 [0065.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.jpeg") returned 0 [0065.330] lstrlenA (lpString="*.jpeg") returned 6 [0065.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.psd") returned 0 [0065.330] lstrlenA (lpString="*.psd") returned 5 [0065.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.gif") returned 0 [0065.330] lstrlenA (lpString="*.gif") returned 5 [0065.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.doc") returned 0 [0065.330] lstrlenA (lpString="*.doc") returned 5 [0065.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.docx") returned 0 [0065.330] lstrlenA (lpString="*.docx") returned 6 [0065.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.xls") returned 0 [0065.330] lstrlenA (lpString="*.xls") returned 5 [0065.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.xlsx") returned 0 [0065.330] lstrlenA (lpString="*.xlsx") returned 6 [0065.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.ppt") returned 0 [0065.330] lstrlenA (lpString="*.ppt") returned 5 [0065.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.pptx") returned 0 [0065.331] lstrlenA (lpString="*.pptx") returned 6 [0065.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.pdf") returned 0 [0065.331] lstrlenA (lpString="*.pdf") returned 5 [0065.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.mov") returned 0 [0065.331] lstrlenA (lpString="*.mov") returned 5 [0065.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.m2v") returned 0 [0065.331] lstrlenA (lpString="*.m2v") returned 5 [0065.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.3gp") returned 0 [0065.331] lstrlenA (lpString="*.3gp") returned 5 [0065.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.mpeg") returned 0 [0065.331] lstrlenA (lpString="*.mpeg") returned 6 [0065.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.mpg") returned 0 [0065.331] lstrlenA (lpString="*.mpg") returned 5 [0065.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.flv") returned 0 [0065.331] lstrlenA (lpString="*.flv") returned 5 [0065.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.avi") returned 0 [0065.331] lstrlenA (lpString="*.avi") returned 5 [0065.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.mp4") returned 0 [0065.331] lstrlenA (lpString="*.mp4") returned 5 [0065.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.wmv") returned 0 [0065.331] lstrlenA (lpString="*.wmv") returned 5 [0065.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.divx") returned 0 [0065.331] lstrlenA (lpString="*.divx") returned 6 [0065.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.mkv") returned 0 [0065.331] lstrlenA (lpString="*.mkv") returned 5 [0065.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.mp3") returned 0 [0065.331] lstrlenA (lpString="*.mp3") returned 5 [0065.331] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.wav") returned 1 [0065.331] lstrlenA (lpString="*.wav") returned 5 [0065.332] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV" [0065.332] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV" [0065.332] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV." [0065.332] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV.wannacry" [0065.332] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\push.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0065.333] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d84 [0065.333] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4b5dc00, dwHighDateTime=0x1bfc6e6), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a7913b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4b5dc00, dwHighDateTime=0x1bfc6e6)) returned 1 [0065.333] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.333] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3d06, lpOverlapped=0x0) returned 1 [0065.335] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV") returned="PUSH.WAV" [0065.335] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.336] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3d06, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3d06, lpOverlapped=0x0) returned 1 [0065.336] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.336] CloseHandle (hObject=0x8c) returned 1 [0065.336] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\push.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\media\\push.wav.wannacry")) returned 1 [0065.338] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3eba3e00, ftCreationTime.dwHighDateTime=0x1bfa2b0, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3eba3e00, ftLastWriteTime.dwHighDateTime=0x1bfa2b0, nFileSizeHigh=0x0, nFileSizeLow=0x1664, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="SUCTION.WAV", cAlternateFileName="")) returned 1 [0065.338] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.338] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SUCTION.WAV") returned -1 [0065.338] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SUCTION.WAV") returned -1 [0065.338] lstrcmpiA (lpString1="", lpString2="SUCTION.WAV") returned -1 [0065.338] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV") returned="PUSH.WAV" [0065.338] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0065.338] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0065.338] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" [0065.338] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20 [0065.338] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="SUCTION.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV" [0065.338] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.zip") returned 0 [0065.338] lstrlenA (lpString="*.zip") returned 5 [0065.338] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.rar") returned 0 [0065.338] lstrlenA (lpString="*.rar") returned 5 [0065.338] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.7z") returned 0 [0065.338] lstrlenA (lpString="*.7z") returned 4 [0065.338] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.tar") returned 0 [0065.339] lstrlenA (lpString="*.tar") returned 5 [0065.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.gzip") returned 0 [0065.339] lstrlenA (lpString="*.gzip") returned 6 [0065.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.jpg") returned 0 [0065.339] lstrlenA (lpString="*.jpg") returned 5 [0065.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.jpeg") returned 0 [0065.339] lstrlenA (lpString="*.jpeg") returned 6 [0065.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.psd") returned 0 [0065.339] lstrlenA (lpString="*.psd") returned 5 [0065.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.gif") returned 0 [0065.339] lstrlenA (lpString="*.gif") returned 5 [0065.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.doc") returned 0 [0065.339] lstrlenA (lpString="*.doc") returned 5 [0065.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.docx") returned 0 [0065.339] lstrlenA (lpString="*.docx") returned 6 [0065.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.xls") returned 0 [0065.339] lstrlenA (lpString="*.xls") returned 5 [0065.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.xlsx") returned 0 [0065.339] lstrlenA (lpString="*.xlsx") returned 6 [0065.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.ppt") returned 0 [0065.339] lstrlenA (lpString="*.ppt") returned 5 [0065.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.pptx") returned 0 [0065.339] lstrlenA (lpString="*.pptx") returned 6 [0065.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.pdf") returned 0 [0065.339] lstrlenA (lpString="*.pdf") returned 5 [0065.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.mov") returned 0 [0065.339] lstrlenA (lpString="*.mov") returned 5 [0065.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.m2v") returned 0 [0065.340] lstrlenA (lpString="*.m2v") returned 5 [0065.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.3gp") returned 0 [0065.340] lstrlenA (lpString="*.3gp") returned 5 [0065.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.mpeg") returned 0 [0065.340] lstrlenA (lpString="*.mpeg") returned 6 [0065.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.mpg") returned 0 [0065.340] lstrlenA (lpString="*.mpg") returned 5 [0065.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.flv") returned 0 [0065.340] lstrlenA (lpString="*.flv") returned 5 [0065.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.avi") returned 0 [0065.340] lstrlenA (lpString="*.avi") returned 5 [0065.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.mp4") returned 0 [0065.340] lstrlenA (lpString="*.mp4") returned 5 [0065.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.wmv") returned 0 [0065.340] lstrlenA (lpString="*.wmv") returned 5 [0065.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.divx") returned 0 [0065.340] lstrlenA (lpString="*.divx") returned 6 [0065.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.mkv") returned 0 [0065.340] lstrlenA (lpString="*.mkv") returned 5 [0065.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.mp3") returned 0 [0065.340] lstrlenA (lpString="*.mp3") returned 5 [0065.340] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.wav") returned 1 [0065.340] lstrlenA (lpString="*.wav") returned 5 [0065.340] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV" [0065.341] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV" [0065.341] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV." [0065.341] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV.wannacry" [0065.341] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\suction.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0065.341] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1664 [0065.341] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3eba3e00, dwHighDateTime=0x1bfa2b0), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ac7a110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3eba3e00, dwHighDateTime=0x1bfa2b0)) returned 1 [0065.342] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.342] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x15e6, lpOverlapped=0x0) returned 1 [0065.344] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV") returned="SUCTION.WAV" [0065.344] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.344] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x15e6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x15e6, lpOverlapped=0x0) returned 1 [0065.344] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.344] CloseHandle (hObject=0x8c) returned 1 [0065.344] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\suction.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\media\\suction.wav.wannacry")) returned 1 [0065.345] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796bf00, ftCreationTime.dwHighDateTime=0x1bd8ab7, ftLastAccessTime.dwLowDateTime=0x6d56d990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb796bf00, ftLastWriteTime.dwHighDateTime=0x1bd8ab7, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="TYPE.WAV", cAlternateFileName="")) returned 1 [0065.346] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.346] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TYPE.WAV") returned -1 [0065.346] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TYPE.WAV") returned -1 [0065.346] lstrcmpiA (lpString1="", lpString2="TYPE.WAV") returned -1 [0065.346] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV") returned="SUCTION.WAV" [0065.346] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0065.346] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0065.346] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" [0065.346] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20 [0065.346] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="TYPE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV" [0065.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.zip") returned 0 [0065.346] lstrlenA (lpString="*.zip") returned 5 [0065.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.rar") returned 0 [0065.346] lstrlenA (lpString="*.rar") returned 5 [0065.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.7z") returned 0 [0065.346] lstrlenA (lpString="*.7z") returned 4 [0065.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.tar") returned 0 [0065.346] lstrlenA (lpString="*.tar") returned 5 [0065.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.gzip") returned 0 [0065.346] lstrlenA (lpString="*.gzip") returned 6 [0065.346] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.jpg") returned 0 [0065.347] lstrlenA (lpString="*.jpg") returned 5 [0065.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.jpeg") returned 0 [0065.347] lstrlenA (lpString="*.jpeg") returned 6 [0065.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.psd") returned 0 [0065.347] lstrlenA (lpString="*.psd") returned 5 [0065.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.gif") returned 0 [0065.347] lstrlenA (lpString="*.gif") returned 5 [0065.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.doc") returned 0 [0065.347] lstrlenA (lpString="*.doc") returned 5 [0065.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.docx") returned 0 [0065.347] lstrlenA (lpString="*.docx") returned 6 [0065.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.xls") returned 0 [0065.347] lstrlenA (lpString="*.xls") returned 5 [0065.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.xlsx") returned 0 [0065.347] lstrlenA (lpString="*.xlsx") returned 6 [0065.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.ppt") returned 0 [0065.347] lstrlenA (lpString="*.ppt") returned 5 [0065.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.pptx") returned 0 [0065.347] lstrlenA (lpString="*.pptx") returned 6 [0065.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.pdf") returned 0 [0065.347] lstrlenA (lpString="*.pdf") returned 5 [0065.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.mov") returned 0 [0065.347] lstrlenA (lpString="*.mov") returned 5 [0065.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.m2v") returned 0 [0065.347] lstrlenA (lpString="*.m2v") returned 5 [0065.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.3gp") returned 0 [0065.348] lstrlenA (lpString="*.3gp") returned 5 [0065.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.mpeg") returned 0 [0065.348] lstrlenA (lpString="*.mpeg") returned 6 [0065.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.mpg") returned 0 [0065.348] lstrlenA (lpString="*.mpg") returned 5 [0065.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.flv") returned 0 [0065.348] lstrlenA (lpString="*.flv") returned 5 [0065.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.avi") returned 0 [0065.348] lstrlenA (lpString="*.avi") returned 5 [0065.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.mp4") returned 0 [0065.348] lstrlenA (lpString="*.mp4") returned 5 [0065.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.wmv") returned 0 [0065.348] lstrlenA (lpString="*.wmv") returned 5 [0065.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.divx") returned 0 [0065.348] lstrlenA (lpString="*.divx") returned 6 [0065.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.mkv") returned 0 [0065.348] lstrlenA (lpString="*.mkv") returned 5 [0065.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.mp3") returned 0 [0065.348] lstrlenA (lpString="*.mp3") returned 5 [0065.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.wav") returned 1 [0065.348] lstrlenA (lpString="*.wav") returned 5 [0065.348] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV" [0065.348] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV" [0065.348] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV." [0065.348] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV.wannacry" [0065.349] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\type.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0065.350] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x121c [0065.350] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb796bf00, dwHighDateTime=0x1bd8ab7), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d56d990, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb796bf00, dwHighDateTime=0x1bd8ab7)) returned 1 [0065.350] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.350] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x119e, lpOverlapped=0x0) returned 1 [0065.352] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV") returned="TYPE.WAV" [0065.352] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.352] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x119e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x119e, lpOverlapped=0x0) returned 1 [0065.352] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.353] CloseHandle (hObject=0x8c) returned 1 [0065.353] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\type.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\media\\type.wav.wannacry")) returned 1 [0065.354] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdb8800, ftCreationTime.dwHighDateTime=0x1bfbeed, ftLastAccessTime.dwLowDateTime=0x7071e4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecdb8800, ftLastWriteTime.dwHighDateTime=0x1bfbeed, nFileSizeHigh=0x0, nFileSizeLow=0x35c6, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="VOLTAGE.WAV", cAlternateFileName="")) returned 1 [0065.354] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.354] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="VOLTAGE.WAV") returned -1 [0065.354] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VOLTAGE.WAV") returned -1 [0065.354] lstrcmpiA (lpString1="", lpString2="VOLTAGE.WAV") returned -1 [0065.354] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV") returned="TYPE.WAV" [0065.354] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0065.354] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0065.354] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" [0065.354] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20 [0065.354] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="VOLTAGE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV" [0065.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.zip") returned 0 [0065.354] lstrlenA (lpString="*.zip") returned 5 [0065.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.rar") returned 0 [0065.354] lstrlenA (lpString="*.rar") returned 5 [0065.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.7z") returned 0 [0065.354] lstrlenA (lpString="*.7z") returned 4 [0065.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.tar") returned 0 [0065.354] lstrlenA (lpString="*.tar") returned 5 [0065.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.gzip") returned 0 [0065.354] lstrlenA (lpString="*.gzip") returned 6 [0065.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.jpg") returned 0 [0065.355] lstrlenA (lpString="*.jpg") returned 5 [0065.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.jpeg") returned 0 [0065.355] lstrlenA (lpString="*.jpeg") returned 6 [0065.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.psd") returned 0 [0065.355] lstrlenA (lpString="*.psd") returned 5 [0065.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.gif") returned 0 [0065.355] lstrlenA (lpString="*.gif") returned 5 [0065.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.doc") returned 0 [0065.355] lstrlenA (lpString="*.doc") returned 5 [0065.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.docx") returned 0 [0065.355] lstrlenA (lpString="*.docx") returned 6 [0065.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.xls") returned 0 [0065.355] lstrlenA (lpString="*.xls") returned 5 [0065.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.xlsx") returned 0 [0065.355] lstrlenA (lpString="*.xlsx") returned 6 [0065.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.ppt") returned 0 [0065.355] lstrlenA (lpString="*.ppt") returned 5 [0065.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.pptx") returned 0 [0065.355] lstrlenA (lpString="*.pptx") returned 6 [0065.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.pdf") returned 0 [0065.355] lstrlenA (lpString="*.pdf") returned 5 [0065.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.mov") returned 0 [0065.355] lstrlenA (lpString="*.mov") returned 5 [0065.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.m2v") returned 0 [0065.356] lstrlenA (lpString="*.m2v") returned 5 [0065.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.3gp") returned 0 [0065.356] lstrlenA (lpString="*.3gp") returned 5 [0065.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.mpeg") returned 0 [0065.356] lstrlenA (lpString="*.mpeg") returned 6 [0065.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.mpg") returned 0 [0065.356] lstrlenA (lpString="*.mpg") returned 5 [0065.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.flv") returned 0 [0065.356] lstrlenA (lpString="*.flv") returned 5 [0065.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.avi") returned 0 [0065.356] lstrlenA (lpString="*.avi") returned 5 [0065.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.mp4") returned 0 [0065.356] lstrlenA (lpString="*.mp4") returned 5 [0065.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.wmv") returned 0 [0065.356] lstrlenA (lpString="*.wmv") returned 5 [0065.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.divx") returned 0 [0065.356] lstrlenA (lpString="*.divx") returned 6 [0065.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.mkv") returned 0 [0065.356] lstrlenA (lpString="*.mkv") returned 5 [0065.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.mp3") returned 0 [0065.356] lstrlenA (lpString="*.mp3") returned 5 [0065.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.wav") returned 1 [0065.356] lstrlenA (lpString="*.wav") returned 5 [0065.356] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV" [0065.356] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV" [0065.356] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV." [0065.357] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV.wannacry" [0065.357] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\voltage.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0065.357] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35c6 [0065.357] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xecdb8800, dwHighDateTime=0x1bfbeed), lpLastAccessTime=0x407536*(dwLowDateTime=0x7071e4d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xecdb8800, dwHighDateTime=0x1bfbeed)) returned 1 [0065.358] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.358] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3548, lpOverlapped=0x0) returned 1 [0065.360] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV") returned="VOLTAGE.WAV" [0065.360] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.360] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3548, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3548, lpOverlapped=0x0) returned 1 [0065.360] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.360] CloseHandle (hObject=0x8c) returned 1 [0065.360] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\voltage.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\media\\voltage.wav.wannacry")) returned 1 [0065.361] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x6de, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="WHOOSH.WAV", cAlternateFileName="")) returned 1 [0065.361] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.361] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WHOOSH.WAV") returned -1 [0065.361] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WHOOSH.WAV") returned -1 [0065.361] lstrcmpiA (lpString1="", lpString2="WHOOSH.WAV") returned -1 [0065.361] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV") returned="VOLTAGE.WAV" [0065.361] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0065.361] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0065.361] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" [0065.361] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20 [0065.361] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="WHOOSH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV" [0065.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.zip") returned 0 [0065.361] lstrlenA (lpString="*.zip") returned 5 [0065.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.rar") returned 0 [0065.362] lstrlenA (lpString="*.rar") returned 5 [0065.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.7z") returned 0 [0065.362] lstrlenA (lpString="*.7z") returned 4 [0065.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.tar") returned 0 [0065.362] lstrlenA (lpString="*.tar") returned 5 [0065.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.gzip") returned 0 [0065.362] lstrlenA (lpString="*.gzip") returned 6 [0065.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.jpg") returned 0 [0065.362] lstrlenA (lpString="*.jpg") returned 5 [0065.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.jpeg") returned 0 [0065.362] lstrlenA (lpString="*.jpeg") returned 6 [0065.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.psd") returned 0 [0065.362] lstrlenA (lpString="*.psd") returned 5 [0065.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.gif") returned 0 [0065.362] lstrlenA (lpString="*.gif") returned 5 [0065.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.doc") returned 0 [0065.362] lstrlenA (lpString="*.doc") returned 5 [0065.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.docx") returned 0 [0065.362] lstrlenA (lpString="*.docx") returned 6 [0065.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.xls") returned 0 [0065.362] lstrlenA (lpString="*.xls") returned 5 [0065.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.xlsx") returned 0 [0065.362] lstrlenA (lpString="*.xlsx") returned 6 [0065.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.ppt") returned 0 [0065.362] lstrlenA (lpString="*.ppt") returned 5 [0065.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.pptx") returned 0 [0065.362] lstrlenA (lpString="*.pptx") returned 6 [0065.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.pdf") returned 0 [0065.362] lstrlenA (lpString="*.pdf") returned 5 [0065.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.mov") returned 0 [0065.362] lstrlenA (lpString="*.mov") returned 5 [0065.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.m2v") returned 0 [0065.363] lstrlenA (lpString="*.m2v") returned 5 [0065.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.3gp") returned 0 [0065.363] lstrlenA (lpString="*.3gp") returned 5 [0065.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.mpeg") returned 0 [0065.363] lstrlenA (lpString="*.mpeg") returned 6 [0065.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.mpg") returned 0 [0065.363] lstrlenA (lpString="*.mpg") returned 5 [0065.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.flv") returned 0 [0065.363] lstrlenA (lpString="*.flv") returned 5 [0065.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.avi") returned 0 [0065.363] lstrlenA (lpString="*.avi") returned 5 [0065.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.mp4") returned 0 [0065.363] lstrlenA (lpString="*.mp4") returned 5 [0065.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.wmv") returned 0 [0065.363] lstrlenA (lpString="*.wmv") returned 5 [0065.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.divx") returned 0 [0065.363] lstrlenA (lpString="*.divx") returned 6 [0065.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.mkv") returned 0 [0065.363] lstrlenA (lpString="*.mkv") returned 5 [0065.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.mp3") returned 0 [0065.363] lstrlenA (lpString="*.mp3") returned 5 [0065.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.wav") returned 1 [0065.363] lstrlenA (lpString="*.wav") returned 5 [0065.363] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV" [0065.363] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV" [0065.363] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV." [0065.363] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV.wannacry" [0065.363] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\whoosh.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0065.364] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6de [0065.364] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e5c1270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47)) returned 1 [0065.364] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.364] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x660, lpOverlapped=0x0) returned 1 [0065.366] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV") returned="WHOOSH.WAV" [0065.366] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.366] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x660, lpOverlapped=0x0) returned 1 [0065.366] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.366] CloseHandle (hObject=0x8c) returned 1 [0065.366] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\whoosh.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\media\\whoosh.wav.wannacry")) returned 1 [0065.367] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcde5800, ftCreationTime.dwHighDateTime=0x1bfc6e6, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcde5800, ftLastWriteTime.dwHighDateTime=0x1bfc6e6, nFileSizeHigh=0x0, nFileSizeLow=0x2b84, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="WIND.WAV", cAlternateFileName="")) returned 1 [0065.367] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.367] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WIND.WAV") returned -1 [0065.367] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WIND.WAV") returned -1 [0065.367] lstrcmpiA (lpString1="", lpString2="WIND.WAV") returned -1 [0065.367] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV") returned="WHOOSH.WAV" [0065.367] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" [0065.367] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned="" [0065.368] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" [0065.368] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\how to decrypt files.txt")) returned 0x20 [0065.368] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="WIND.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" [0065.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.zip") returned 0 [0065.368] lstrlenA (lpString="*.zip") returned 5 [0065.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.rar") returned 0 [0065.368] lstrlenA (lpString="*.rar") returned 5 [0065.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.7z") returned 0 [0065.368] lstrlenA (lpString="*.7z") returned 4 [0065.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.tar") returned 0 [0065.368] lstrlenA (lpString="*.tar") returned 5 [0065.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.gzip") returned 0 [0065.368] lstrlenA (lpString="*.gzip") returned 6 [0065.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.jpg") returned 0 [0065.368] lstrlenA (lpString="*.jpg") returned 5 [0065.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.jpeg") returned 0 [0065.368] lstrlenA (lpString="*.jpeg") returned 6 [0065.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.psd") returned 0 [0065.368] lstrlenA (lpString="*.psd") returned 5 [0065.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.gif") returned 0 [0065.368] lstrlenA (lpString="*.gif") returned 5 [0065.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.doc") returned 0 [0065.368] lstrlenA (lpString="*.doc") returned 5 [0065.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.docx") returned 0 [0065.368] lstrlenA (lpString="*.docx") returned 6 [0065.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.xls") returned 0 [0065.368] lstrlenA (lpString="*.xls") returned 5 [0065.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.xlsx") returned 0 [0065.368] lstrlenA (lpString="*.xlsx") returned 6 [0065.368] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.ppt") returned 0 [0065.368] lstrlenA (lpString="*.ppt") returned 5 [0065.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.pptx") returned 0 [0065.369] lstrlenA (lpString="*.pptx") returned 6 [0065.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.pdf") returned 0 [0065.369] lstrlenA (lpString="*.pdf") returned 5 [0065.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.mov") returned 0 [0065.369] lstrlenA (lpString="*.mov") returned 5 [0065.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.m2v") returned 0 [0065.369] lstrlenA (lpString="*.m2v") returned 5 [0065.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.3gp") returned 0 [0065.369] lstrlenA (lpString="*.3gp") returned 5 [0065.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.mpeg") returned 0 [0065.369] lstrlenA (lpString="*.mpeg") returned 6 [0065.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.mpg") returned 0 [0065.369] lstrlenA (lpString="*.mpg") returned 5 [0065.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.flv") returned 0 [0065.369] lstrlenA (lpString="*.flv") returned 5 [0065.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.avi") returned 0 [0065.369] lstrlenA (lpString="*.avi") returned 5 [0065.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.mp4") returned 0 [0065.369] lstrlenA (lpString="*.mp4") returned 5 [0065.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.wmv") returned 0 [0065.369] lstrlenA (lpString="*.wmv") returned 5 [0065.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.divx") returned 0 [0065.369] lstrlenA (lpString="*.divx") returned 6 [0065.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.mkv") returned 0 [0065.369] lstrlenA (lpString="*.mkv") returned 5 [0065.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.mp3") returned 0 [0065.369] lstrlenA (lpString="*.mp3") returned 5 [0065.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.wav") returned 1 [0065.369] lstrlenA (lpString="*.wav") returned 5 [0065.369] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" [0065.370] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" [0065.370] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV." [0065.370] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV.", lpString2="wannacry" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV.wannacry") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV.wannacry" [0065.370] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\wind.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0065.371] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b84 [0065.371] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xdcde5800, dwHighDateTime=0x1bfc6e6), lpLastAccessTime=0x407536*(dwLowDateTime=0x708e7550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xdcde5800, dwHighDateTime=0x1bfc6e6)) returned 1 [0065.371] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.371] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2b06, lpOverlapped=0x0) returned 1 [0065.373] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV") returned="WIND.WAV" [0065.373] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0065.373] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2b06, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2b06, lpOverlapped=0x0) returned 1 [0065.373] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.373] CloseHandle (hObject=0x8c) returned 1 [0065.374] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\wind.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\media\\wind.wav.wannacry")) returned 1 [0065.374] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcde5800, ftCreationTime.dwHighDateTime=0x1bfc6e6, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcde5800, ftLastWriteTime.dwHighDateTime=0x1bfc6e6, nFileSizeHigh=0x0, nFileSizeLow=0x2b84, dwReserved0=0x3000003, dwReserved1=0x2d5ed8, cFileName="WIND.WAV", cAlternateFileName="")) returned 0 [0065.375] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0065.375] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4f5000, ftCreationTime.dwHighDateTime=0x1cac037, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4f5000, ftLastWriteTime.dwHighDateTime=0x1cac037, nFileSizeHigh=0x0, nFileSizeLow=0x1c798, dwReserved0=0x2d7ff8, dwReserved1=0x3, cFileName="Microsoft.BusinessData.dll", cAlternateFileName="MI5659~1.DLL")) returned 1 [0065.375] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.375] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.BusinessData.dll") returned -1 [0065.375] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.BusinessData.dll") returned -1 [0065.375] lstrcmpiA (lpString1="", lpString2="Microsoft.BusinessData.dll") returned -1 [0065.375] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*" [0065.375] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.375] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.375] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.375] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.375] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.BusinessData.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll" [0065.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.zip") returned 0 [0065.375] lstrlenA (lpString="*.zip") returned 5 [0065.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.rar") returned 0 [0065.375] lstrlenA (lpString="*.rar") returned 5 [0065.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.7z") returned 0 [0065.375] lstrlenA (lpString="*.7z") returned 4 [0065.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.tar") returned 0 [0065.375] lstrlenA (lpString="*.tar") returned 5 [0065.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.gzip") returned 0 [0065.375] lstrlenA (lpString="*.gzip") returned 6 [0065.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.jpg") returned 0 [0065.375] lstrlenA (lpString="*.jpg") returned 5 [0065.375] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.jpeg") returned 0 [0065.375] lstrlenA (lpString="*.jpeg") returned 6 [0065.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.psd") returned 0 [0065.376] lstrlenA (lpString="*.psd") returned 5 [0065.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.gif") returned 0 [0065.376] lstrlenA (lpString="*.gif") returned 5 [0065.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.doc") returned 0 [0065.376] lstrlenA (lpString="*.doc") returned 5 [0065.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.docx") returned 0 [0065.376] lstrlenA (lpString="*.docx") returned 6 [0065.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.xls") returned 0 [0065.376] lstrlenA (lpString="*.xls") returned 5 [0065.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.xlsx") returned 0 [0065.376] lstrlenA (lpString="*.xlsx") returned 6 [0065.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.ppt") returned 0 [0065.376] lstrlenA (lpString="*.ppt") returned 5 [0065.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.pptx") returned 0 [0065.376] lstrlenA (lpString="*.pptx") returned 6 [0065.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.pdf") returned 0 [0065.376] lstrlenA (lpString="*.pdf") returned 5 [0065.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.mov") returned 0 [0065.376] lstrlenA (lpString="*.mov") returned 5 [0065.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.m2v") returned 0 [0065.376] lstrlenA (lpString="*.m2v") returned 5 [0065.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.3gp") returned 0 [0065.376] lstrlenA (lpString="*.3gp") returned 5 [0065.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.mpeg") returned 0 [0065.376] lstrlenA (lpString="*.mpeg") returned 6 [0065.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.mpg") returned 0 [0065.376] lstrlenA (lpString="*.mpg") returned 5 [0065.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.flv") returned 0 [0065.376] lstrlenA (lpString="*.flv") returned 5 [0065.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.avi") returned 0 [0065.376] lstrlenA (lpString="*.avi") returned 5 [0065.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.mp4") returned 0 [0065.377] lstrlenA (lpString="*.mp4") returned 5 [0065.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.wmv") returned 0 [0065.377] lstrlenA (lpString="*.wmv") returned 5 [0065.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.divx") returned 0 [0065.377] lstrlenA (lpString="*.divx") returned 6 [0065.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.mkv") returned 0 [0065.377] lstrlenA (lpString="*.mkv") returned 5 [0065.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.mp3") returned 0 [0065.377] lstrlenA (lpString="*.mp3") returned 5 [0065.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.wav") returned 0 [0065.377] lstrlenA (lpString="*.wav") returned 5 [0065.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.flac") returned 0 [0065.377] lstrlenA (lpString="*.flac") returned 6 [0065.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.ape") returned 0 [0065.377] lstrlenA (lpString="*.ape") returned 5 [0065.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.wma") returned 0 [0065.377] lstrlenA (lpString="*.wma") returned 5 [0065.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.ac3") returned 0 [0065.377] lstrlenA (lpString="*.ac3") returned 5 [0065.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.mxf") returned 0 [0065.377] lstrlenA (lpString="*.mxf") returned 5 [0065.377] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36c06100, ftCreationTime.dwHighDateTime=0x1ca24ad, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36c06100, ftLastWriteTime.dwHighDateTime=0x1ca24ad, nFileSizeHigh=0x0, nFileSizeLow=0x5a768, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BusinessData.xml", cAlternateFileName="MI1B7D~1.XML")) returned 1 [0065.377] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.377] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.BusinessData.xml") returned -1 [0065.377] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.BusinessData.xml") returned -1 [0065.377] lstrcmpiA (lpString1="", lpString2="Microsoft.BusinessData.xml") returned -1 [0065.377] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll") returned="Microsoft.BusinessData.dll" [0065.377] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.377] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.377] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.377] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.378] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.BusinessData.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml" [0065.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.zip") returned 0 [0065.378] lstrlenA (lpString="*.zip") returned 5 [0065.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.rar") returned 0 [0065.378] lstrlenA (lpString="*.rar") returned 5 [0065.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.7z") returned 0 [0065.378] lstrlenA (lpString="*.7z") returned 4 [0065.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.tar") returned 0 [0065.378] lstrlenA (lpString="*.tar") returned 5 [0065.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.gzip") returned 0 [0065.378] lstrlenA (lpString="*.gzip") returned 6 [0065.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.jpg") returned 0 [0065.378] lstrlenA (lpString="*.jpg") returned 5 [0065.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.jpeg") returned 0 [0065.378] lstrlenA (lpString="*.jpeg") returned 6 [0065.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.psd") returned 0 [0065.378] lstrlenA (lpString="*.psd") returned 5 [0065.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.gif") returned 0 [0065.378] lstrlenA (lpString="*.gif") returned 5 [0065.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.doc") returned 0 [0065.378] lstrlenA (lpString="*.doc") returned 5 [0065.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.docx") returned 0 [0065.378] lstrlenA (lpString="*.docx") returned 6 [0065.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.xls") returned 0 [0065.378] lstrlenA (lpString="*.xls") returned 5 [0065.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.xlsx") returned 0 [0065.378] lstrlenA (lpString="*.xlsx") returned 6 [0065.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.ppt") returned 0 [0065.378] lstrlenA (lpString="*.ppt") returned 5 [0065.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.pptx") returned 0 [0065.378] lstrlenA (lpString="*.pptx") returned 6 [0065.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.pdf") returned 0 [0065.379] lstrlenA (lpString="*.pdf") returned 5 [0065.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.mov") returned 0 [0065.379] lstrlenA (lpString="*.mov") returned 5 [0065.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.m2v") returned 0 [0065.379] lstrlenA (lpString="*.m2v") returned 5 [0065.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.3gp") returned 0 [0065.379] lstrlenA (lpString="*.3gp") returned 5 [0065.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.mpeg") returned 0 [0065.379] lstrlenA (lpString="*.mpeg") returned 6 [0065.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.mpg") returned 0 [0065.379] lstrlenA (lpString="*.mpg") returned 5 [0065.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.flv") returned 0 [0065.379] lstrlenA (lpString="*.flv") returned 5 [0065.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.avi") returned 0 [0065.379] lstrlenA (lpString="*.avi") returned 5 [0065.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.mp4") returned 0 [0065.379] lstrlenA (lpString="*.mp4") returned 5 [0065.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.wmv") returned 0 [0065.379] lstrlenA (lpString="*.wmv") returned 5 [0065.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.divx") returned 0 [0065.379] lstrlenA (lpString="*.divx") returned 6 [0065.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.mkv") returned 0 [0065.379] lstrlenA (lpString="*.mkv") returned 5 [0065.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.mp3") returned 0 [0065.379] lstrlenA (lpString="*.mp3") returned 5 [0065.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.wav") returned 0 [0065.379] lstrlenA (lpString="*.wav") returned 5 [0065.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.flac") returned 0 [0065.380] lstrlenA (lpString="*.flac") returned 6 [0065.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.ape") returned 0 [0065.380] lstrlenA (lpString="*.ape") returned 5 [0065.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.wma") returned 0 [0065.380] lstrlenA (lpString="*.wma") returned 5 [0065.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.ac3") returned 0 [0065.380] lstrlenA (lpString="*.ac3") returned 5 [0065.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.mxf") returned 0 [0065.380] lstrlenA (lpString="*.mxf") returned 5 [0065.380] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17441800, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x662b9570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17441800, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x8a780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.Runtime.dll", cAlternateFileName="MI2E5E~1.DLL")) returned 1 [0065.380] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.380] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.BusinessApplications.Runtime.dll") returned -1 [0065.380] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.BusinessApplications.Runtime.dll") returned -1 [0065.380] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.BusinessApplications.Runtime.dll") returned -1 [0065.380] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml") returned="Microsoft.BusinessData.xml" [0065.380] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.380] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.380] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.380] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.380] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.BusinessApplications.Runtime.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll" [0065.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.zip") returned 0 [0065.380] lstrlenA (lpString="*.zip") returned 5 [0065.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.rar") returned 0 [0065.380] lstrlenA (lpString="*.rar") returned 5 [0065.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.7z") returned 0 [0065.380] lstrlenA (lpString="*.7z") returned 4 [0065.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.tar") returned 0 [0065.381] lstrlenA (lpString="*.tar") returned 5 [0065.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.gzip") returned 0 [0065.381] lstrlenA (lpString="*.gzip") returned 6 [0065.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.jpg") returned 0 [0065.381] lstrlenA (lpString="*.jpg") returned 5 [0065.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.jpeg") returned 0 [0065.381] lstrlenA (lpString="*.jpeg") returned 6 [0065.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.psd") returned 0 [0065.381] lstrlenA (lpString="*.psd") returned 5 [0065.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.gif") returned 0 [0065.381] lstrlenA (lpString="*.gif") returned 5 [0065.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.doc") returned 0 [0065.381] lstrlenA (lpString="*.doc") returned 5 [0065.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.docx") returned 0 [0065.381] lstrlenA (lpString="*.docx") returned 6 [0065.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.xls") returned 0 [0065.381] lstrlenA (lpString="*.xls") returned 5 [0065.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.xlsx") returned 0 [0065.381] lstrlenA (lpString="*.xlsx") returned 6 [0065.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.ppt") returned 0 [0065.381] lstrlenA (lpString="*.ppt") returned 5 [0065.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.pptx") returned 0 [0065.381] lstrlenA (lpString="*.pptx") returned 6 [0065.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.pdf") returned 0 [0065.381] lstrlenA (lpString="*.pdf") returned 5 [0065.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.mov") returned 0 [0065.381] lstrlenA (lpString="*.mov") returned 5 [0065.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.m2v") returned 0 [0065.381] lstrlenA (lpString="*.m2v") returned 5 [0065.381] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.3gp") returned 0 [0065.382] lstrlenA (lpString="*.3gp") returned 5 [0065.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.mpeg") returned 0 [0065.382] lstrlenA (lpString="*.mpeg") returned 6 [0065.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.mpg") returned 0 [0065.382] lstrlenA (lpString="*.mpg") returned 5 [0065.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.flv") returned 0 [0065.382] lstrlenA (lpString="*.flv") returned 5 [0065.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.avi") returned 0 [0065.382] lstrlenA (lpString="*.avi") returned 5 [0065.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.mp4") returned 0 [0065.382] lstrlenA (lpString="*.mp4") returned 5 [0065.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.wmv") returned 0 [0065.382] lstrlenA (lpString="*.wmv") returned 5 [0065.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.divx") returned 0 [0065.382] lstrlenA (lpString="*.divx") returned 6 [0065.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.mkv") returned 0 [0065.382] lstrlenA (lpString="*.mkv") returned 5 [0065.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.mp3") returned 0 [0065.382] lstrlenA (lpString="*.mp3") returned 5 [0065.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.wav") returned 0 [0065.382] lstrlenA (lpString="*.wav") returned 5 [0065.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.flac") returned 0 [0065.382] lstrlenA (lpString="*.flac") returned 6 [0065.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.ape") returned 0 [0065.382] lstrlenA (lpString="*.ape") returned 5 [0065.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.wma") returned 0 [0065.382] lstrlenA (lpString="*.wma") returned 5 [0065.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.ac3") returned 0 [0065.382] lstrlenA (lpString="*.ac3") returned 5 [0065.382] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.mxf") returned 0 [0065.382] lstrlenA (lpString="*.mxf") returned 5 [0065.382] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe853200, ftCreationTime.dwHighDateTime=0x1ca24ae, ftLastAccessTime.dwLowDateTime=0x568a2e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe853200, ftLastWriteTime.dwHighDateTime=0x1ca24ae, nFileSizeHigh=0x0, nFileSizeLow=0x295c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.Runtime.xml", cAlternateFileName="MICROS~3.XML")) returned 1 [0065.383] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.383] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.BusinessApplications.Runtime.xml") returned -1 [0065.383] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.BusinessApplications.Runtime.xml") returned -1 [0065.383] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.BusinessApplications.Runtime.xml") returned -1 [0065.383] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll") returned="Microsoft.Office.BusinessApplications.Runtime.dll" [0065.383] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.383] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.383] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.383] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.383] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.BusinessApplications.Runtime.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml" [0065.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.zip") returned 0 [0065.383] lstrlenA (lpString="*.zip") returned 5 [0065.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.rar") returned 0 [0065.383] lstrlenA (lpString="*.rar") returned 5 [0065.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.7z") returned 0 [0065.383] lstrlenA (lpString="*.7z") returned 4 [0065.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.tar") returned 0 [0065.383] lstrlenA (lpString="*.tar") returned 5 [0065.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.gzip") returned 0 [0065.383] lstrlenA (lpString="*.gzip") returned 6 [0065.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.jpg") returned 0 [0065.383] lstrlenA (lpString="*.jpg") returned 5 [0065.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.jpeg") returned 0 [0065.383] lstrlenA (lpString="*.jpeg") returned 6 [0065.383] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.psd") returned 0 [0065.383] lstrlenA (lpString="*.psd") returned 5 [0065.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.gif") returned 0 [0065.384] lstrlenA (lpString="*.gif") returned 5 [0065.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.doc") returned 0 [0065.384] lstrlenA (lpString="*.doc") returned 5 [0065.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.docx") returned 0 [0065.384] lstrlenA (lpString="*.docx") returned 6 [0065.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.xls") returned 0 [0065.384] lstrlenA (lpString="*.xls") returned 5 [0065.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.xlsx") returned 0 [0065.384] lstrlenA (lpString="*.xlsx") returned 6 [0065.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.ppt") returned 0 [0065.384] lstrlenA (lpString="*.ppt") returned 5 [0065.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.pptx") returned 0 [0065.384] lstrlenA (lpString="*.pptx") returned 6 [0065.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.pdf") returned 0 [0065.384] lstrlenA (lpString="*.pdf") returned 5 [0065.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.mov") returned 0 [0065.384] lstrlenA (lpString="*.mov") returned 5 [0065.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.m2v") returned 0 [0065.384] lstrlenA (lpString="*.m2v") returned 5 [0065.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.3gp") returned 0 [0065.384] lstrlenA (lpString="*.3gp") returned 5 [0065.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.mpeg") returned 0 [0065.384] lstrlenA (lpString="*.mpeg") returned 6 [0065.384] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.mpg") returned 0 [0065.384] lstrlenA (lpString="*.mpg") returned 5 [0065.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.flv") returned 0 [0065.385] lstrlenA (lpString="*.flv") returned 5 [0065.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.avi") returned 0 [0065.385] lstrlenA (lpString="*.avi") returned 5 [0065.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.mp4") returned 0 [0065.385] lstrlenA (lpString="*.mp4") returned 5 [0065.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.wmv") returned 0 [0065.385] lstrlenA (lpString="*.wmv") returned 5 [0065.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.divx") returned 0 [0065.385] lstrlenA (lpString="*.divx") returned 6 [0065.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.mkv") returned 0 [0065.385] lstrlenA (lpString="*.mkv") returned 5 [0065.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.mp3") returned 0 [0065.385] lstrlenA (lpString="*.mp3") returned 5 [0065.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.wav") returned 0 [0065.385] lstrlenA (lpString="*.wav") returned 5 [0065.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.flac") returned 0 [0065.385] lstrlenA (lpString="*.flac") returned 6 [0065.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.ape") returned 0 [0065.385] lstrlenA (lpString="*.ape") returned 5 [0065.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.wma") returned 0 [0065.385] lstrlenA (lpString="*.wma") returned 5 [0065.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.ac3") returned 0 [0065.385] lstrlenA (lpString="*.ac3") returned 5 [0065.385] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.mxf") returned 0 [0065.385] lstrlenA (lpString="*.mxf") returned 5 [0065.385] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ad79f00, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x67a61010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ad79f00, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0xa2780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.RuntimeUi.dll", cAlternateFileName="MIBA26~1.DLL")) returned 1 [0065.386] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.386] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned -1 [0065.386] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned -1 [0065.386] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned -1 [0065.386] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml") returned="Microsoft.Office.BusinessApplications.Runtime.xml" [0065.386] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.386] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.386] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.386] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.386] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll" [0065.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.zip") returned 0 [0065.386] lstrlenA (lpString="*.zip") returned 5 [0065.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.rar") returned 0 [0065.386] lstrlenA (lpString="*.rar") returned 5 [0065.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.7z") returned 0 [0065.386] lstrlenA (lpString="*.7z") returned 4 [0065.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.tar") returned 0 [0065.386] lstrlenA (lpString="*.tar") returned 5 [0065.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.gzip") returned 0 [0065.386] lstrlenA (lpString="*.gzip") returned 6 [0065.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.jpg") returned 0 [0065.386] lstrlenA (lpString="*.jpg") returned 5 [0065.386] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.jpeg") returned 0 [0065.386] lstrlenA (lpString="*.jpeg") returned 6 [0065.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.psd") returned 0 [0065.387] lstrlenA (lpString="*.psd") returned 5 [0065.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.gif") returned 0 [0065.387] lstrlenA (lpString="*.gif") returned 5 [0065.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.doc") returned 0 [0065.387] lstrlenA (lpString="*.doc") returned 5 [0065.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.docx") returned 0 [0065.387] lstrlenA (lpString="*.docx") returned 6 [0065.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.xls") returned 0 [0065.387] lstrlenA (lpString="*.xls") returned 5 [0065.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.xlsx") returned 0 [0065.387] lstrlenA (lpString="*.xlsx") returned 6 [0065.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.ppt") returned 0 [0065.387] lstrlenA (lpString="*.ppt") returned 5 [0065.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.pptx") returned 0 [0065.387] lstrlenA (lpString="*.pptx") returned 6 [0065.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.pdf") returned 0 [0065.387] lstrlenA (lpString="*.pdf") returned 5 [0065.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.mov") returned 0 [0065.387] lstrlenA (lpString="*.mov") returned 5 [0065.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.m2v") returned 0 [0065.387] lstrlenA (lpString="*.m2v") returned 5 [0065.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.3gp") returned 0 [0065.387] lstrlenA (lpString="*.3gp") returned 5 [0065.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.mpeg") returned 0 [0065.387] lstrlenA (lpString="*.mpeg") returned 6 [0065.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.mpg") returned 0 [0065.387] lstrlenA (lpString="*.mpg") returned 5 [0065.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.flv") returned 0 [0065.387] lstrlenA (lpString="*.flv") returned 5 [0065.387] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.avi") returned 0 [0065.388] lstrlenA (lpString="*.avi") returned 5 [0065.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.mp4") returned 0 [0065.388] lstrlenA (lpString="*.mp4") returned 5 [0065.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.wmv") returned 0 [0065.388] lstrlenA (lpString="*.wmv") returned 5 [0065.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.divx") returned 0 [0065.388] lstrlenA (lpString="*.divx") returned 6 [0065.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.mkv") returned 0 [0065.388] lstrlenA (lpString="*.mkv") returned 5 [0065.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.mp3") returned 0 [0065.388] lstrlenA (lpString="*.mp3") returned 5 [0065.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.wav") returned 0 [0065.388] lstrlenA (lpString="*.wav") returned 5 [0065.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.flac") returned 0 [0065.388] lstrlenA (lpString="*.flac") returned 6 [0065.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.ape") returned 0 [0065.388] lstrlenA (lpString="*.ape") returned 5 [0065.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.wma") returned 0 [0065.388] lstrlenA (lpString="*.wma") returned 5 [0065.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.ac3") returned 0 [0065.388] lstrlenA (lpString="*.ac3") returned 5 [0065.388] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.mxf") returned 0 [0065.388] lstrlenA (lpString="*.mxf") returned 5 [0065.388] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd33c3f00, ftCreationTime.dwHighDateTime=0x1ca2551, ftLastAccessTime.dwLowDateTime=0x67a61010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd33c3f00, ftLastWriteTime.dwHighDateTime=0x1ca2551, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.RuntimeUi.xml", cAlternateFileName="MI8366~1.XML")) returned 1 [0065.388] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.388] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.xml") returned -1 [0065.388] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.xml") returned -1 [0065.388] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.xml") returned -1 [0065.388] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned="Microsoft.Office.BusinessApplications.RuntimeUi.dll" [0065.388] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.388] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.389] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.389] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.389] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml" [0065.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.zip") returned 0 [0065.389] lstrlenA (lpString="*.zip") returned 5 [0065.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.rar") returned 0 [0065.389] lstrlenA (lpString="*.rar") returned 5 [0065.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.7z") returned 0 [0065.389] lstrlenA (lpString="*.7z") returned 4 [0065.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.tar") returned 0 [0065.389] lstrlenA (lpString="*.tar") returned 5 [0065.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.gzip") returned 0 [0065.389] lstrlenA (lpString="*.gzip") returned 6 [0065.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.jpg") returned 0 [0065.389] lstrlenA (lpString="*.jpg") returned 5 [0065.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.jpeg") returned 0 [0065.389] lstrlenA (lpString="*.jpeg") returned 6 [0065.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.psd") returned 0 [0065.389] lstrlenA (lpString="*.psd") returned 5 [0065.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.gif") returned 0 [0065.389] lstrlenA (lpString="*.gif") returned 5 [0065.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.doc") returned 0 [0065.389] lstrlenA (lpString="*.doc") returned 5 [0065.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.docx") returned 0 [0065.389] lstrlenA (lpString="*.docx") returned 6 [0065.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.xls") returned 0 [0065.389] lstrlenA (lpString="*.xls") returned 5 [0065.389] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.xlsx") returned 0 [0065.390] lstrlenA (lpString="*.xlsx") returned 6 [0065.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.ppt") returned 0 [0065.390] lstrlenA (lpString="*.ppt") returned 5 [0065.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.pptx") returned 0 [0065.390] lstrlenA (lpString="*.pptx") returned 6 [0065.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.pdf") returned 0 [0065.390] lstrlenA (lpString="*.pdf") returned 5 [0065.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.mov") returned 0 [0065.390] lstrlenA (lpString="*.mov") returned 5 [0065.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.m2v") returned 0 [0065.390] lstrlenA (lpString="*.m2v") returned 5 [0065.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.3gp") returned 0 [0065.390] lstrlenA (lpString="*.3gp") returned 5 [0065.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.mpeg") returned 0 [0065.390] lstrlenA (lpString="*.mpeg") returned 6 [0065.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.mpg") returned 0 [0065.390] lstrlenA (lpString="*.mpg") returned 5 [0065.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.flv") returned 0 [0065.390] lstrlenA (lpString="*.flv") returned 5 [0065.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.avi") returned 0 [0065.390] lstrlenA (lpString="*.avi") returned 5 [0065.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.mp4") returned 0 [0065.390] lstrlenA (lpString="*.mp4") returned 5 [0065.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.wmv") returned 0 [0065.390] lstrlenA (lpString="*.wmv") returned 5 [0065.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.divx") returned 0 [0065.390] lstrlenA (lpString="*.divx") returned 6 [0065.390] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.mkv") returned 0 [0065.391] lstrlenA (lpString="*.mkv") returned 5 [0065.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.mp3") returned 0 [0065.391] lstrlenA (lpString="*.mp3") returned 5 [0065.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.wav") returned 0 [0065.391] lstrlenA (lpString="*.wav") returned 5 [0065.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.flac") returned 0 [0065.391] lstrlenA (lpString="*.flac") returned 6 [0065.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.ape") returned 0 [0065.391] lstrlenA (lpString="*.ape") returned 5 [0065.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.wma") returned 0 [0065.391] lstrlenA (lpString="*.wma") returned 5 [0065.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.ac3") returned 0 [0065.391] lstrlenA (lpString="*.ac3") returned 5 [0065.391] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", pszSpec="*.mxf") returned 0 [0065.391] lstrlenA (lpString="*.mxf") returned 5 [0065.391] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ad79f00, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x575e0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ad79f00, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0xe9780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessData.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0065.391] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.391] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.BusinessData.dll") returned -1 [0065.391] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.BusinessData.dll") returned -1 [0065.391] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.BusinessData.dll") returned -1 [0065.391] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml") returned="Microsoft.Office.BusinessApplications.RuntimeUi.xml" [0065.391] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.391] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.391] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.391] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.392] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.BusinessData.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll" [0065.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.zip") returned 0 [0065.392] lstrlenA (lpString="*.zip") returned 5 [0065.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.rar") returned 0 [0065.392] lstrlenA (lpString="*.rar") returned 5 [0065.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.7z") returned 0 [0065.392] lstrlenA (lpString="*.7z") returned 4 [0065.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.tar") returned 0 [0065.392] lstrlenA (lpString="*.tar") returned 5 [0065.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.gzip") returned 0 [0065.392] lstrlenA (lpString="*.gzip") returned 6 [0065.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.jpg") returned 0 [0065.392] lstrlenA (lpString="*.jpg") returned 5 [0065.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.jpeg") returned 0 [0065.392] lstrlenA (lpString="*.jpeg") returned 6 [0065.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.psd") returned 0 [0065.392] lstrlenA (lpString="*.psd") returned 5 [0065.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.gif") returned 0 [0065.392] lstrlenA (lpString="*.gif") returned 5 [0065.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.doc") returned 0 [0065.392] lstrlenA (lpString="*.doc") returned 5 [0065.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.docx") returned 0 [0065.392] lstrlenA (lpString="*.docx") returned 6 [0065.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.xls") returned 0 [0065.392] lstrlenA (lpString="*.xls") returned 5 [0065.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.xlsx") returned 0 [0065.392] lstrlenA (lpString="*.xlsx") returned 6 [0065.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.ppt") returned 0 [0065.393] lstrlenA (lpString="*.ppt") returned 5 [0065.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.pptx") returned 0 [0065.393] lstrlenA (lpString="*.pptx") returned 6 [0065.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.pdf") returned 0 [0065.393] lstrlenA (lpString="*.pdf") returned 5 [0065.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.mov") returned 0 [0065.393] lstrlenA (lpString="*.mov") returned 5 [0065.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.m2v") returned 0 [0065.393] lstrlenA (lpString="*.m2v") returned 5 [0065.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.3gp") returned 0 [0065.393] lstrlenA (lpString="*.3gp") returned 5 [0065.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.mpeg") returned 0 [0065.393] lstrlenA (lpString="*.mpeg") returned 6 [0065.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.mpg") returned 0 [0065.393] lstrlenA (lpString="*.mpg") returned 5 [0065.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.flv") returned 0 [0065.393] lstrlenA (lpString="*.flv") returned 5 [0065.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.avi") returned 0 [0065.393] lstrlenA (lpString="*.avi") returned 5 [0065.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.mp4") returned 0 [0065.393] lstrlenA (lpString="*.mp4") returned 5 [0065.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.wmv") returned 0 [0065.393] lstrlenA (lpString="*.wmv") returned 5 [0065.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.divx") returned 0 [0065.393] lstrlenA (lpString="*.divx") returned 6 [0065.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.mkv") returned 0 [0065.393] lstrlenA (lpString="*.mkv") returned 5 [0065.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.mp3") returned 0 [0065.393] lstrlenA (lpString="*.mp3") returned 5 [0065.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.wav") returned 0 [0065.393] lstrlenA (lpString="*.wav") returned 5 [0065.393] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.flac") returned 0 [0065.393] lstrlenA (lpString="*.flac") returned 6 [0065.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.ape") returned 0 [0065.394] lstrlenA (lpString="*.ape") returned 5 [0065.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.wma") returned 0 [0065.394] lstrlenA (lpString="*.wma") returned 5 [0065.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.ac3") returned 0 [0065.394] lstrlenA (lpString="*.ac3") returned 5 [0065.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", pszSpec="*.mxf") returned 0 [0065.394] lstrlenA (lpString="*.mxf") returned 5 [0065.394] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe853200, ftCreationTime.dwHighDateTime=0x1ca24ae, ftLastAccessTime.dwLowDateTime=0x575e0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe853200, ftLastWriteTime.dwHighDateTime=0x1ca24ae, nFileSizeHigh=0x0, nFileSizeLow=0x33737, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessData.xml", cAlternateFileName="MICROS~4.XML")) returned 1 [0065.394] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.394] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.BusinessData.xml") returned -1 [0065.394] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.BusinessData.xml") returned -1 [0065.394] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.BusinessData.xml") returned -1 [0065.394] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll") returned="Microsoft.Office.BusinessData.dll" [0065.394] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.394] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.394] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.394] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.394] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.BusinessData.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml" [0065.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", pszSpec="*.zip") returned 0 [0065.394] lstrlenA (lpString="*.zip") returned 5 [0065.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", pszSpec="*.rar") returned 0 [0065.394] lstrlenA (lpString="*.rar") returned 5 [0065.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", pszSpec="*.7z") returned 0 [0065.394] lstrlenA (lpString="*.7z") returned 4 [0065.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", pszSpec="*.tar") returned 0 [0065.394] lstrlenA (lpString="*.tar") returned 5 [0065.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", pszSpec="*.gzip") returned 0 [0065.394] lstrlenA (lpString="*.gzip") returned 6 [0065.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", pszSpec="*.jpg") returned 0 [0065.394] lstrlenA (lpString="*.jpg") returned 5 [0065.394] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", pszSpec="*.jpeg") returned 0 [0065.395] lstrlenA (lpString="*.jpeg") returned 6 [0065.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", pszSpec="*.psd") returned 0 [0065.395] lstrlenA (lpString="*.psd") returned 5 [0065.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", pszSpec="*.gif") returned 0 [0065.395] lstrlenA (lpString="*.gif") returned 5 [0065.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", pszSpec="*.doc") returned 0 [0065.395] lstrlenA (lpString="*.doc") returned 5 [0065.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", pszSpec="*.docx") returned 0 [0065.395] lstrlenA (lpString="*.docx") returned 6 [0065.395] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0139200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0139200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x4998, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", cAlternateFileName="MI6145~1.DLL")) returned 1 [0065.395] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.395] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned -1 [0065.395] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned -1 [0065.395] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned -1 [0065.395] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml") returned="Microsoft.Office.BusinessData.xml" [0065.395] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.395] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.395] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.395] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.396] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll" [0065.396] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdb13800, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x543977b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcdb13800, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0xa780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.FormControl.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0065.396] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.396] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.InfoPath.FormControl.dll") returned -1 [0065.396] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.InfoPath.FormControl.dll") returned -1 [0065.396] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.InfoPath.FormControl.dll") returned -1 [0065.396] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll" [0065.396] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.396] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.396] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.396] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.396] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.InfoPath.FormControl.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll" [0065.397] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0139200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x61e95fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0139200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x63790, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.SemiTrust.dll", cAlternateFileName="MIE42F~1.DLL")) returned 1 [0065.397] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.397] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned -1 [0065.397] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned -1 [0065.397] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned -1 [0065.397] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll") returned="Microsoft.Office.InfoPath.FormControl.dll" [0065.397] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.397] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.397] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll" [0065.397] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x542d90d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0xc5265, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0065.397] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.397] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.xml") returned -1 [0065.397] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.xml") returned -1 [0065.397] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.xml") returned -1 [0065.397] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned="Microsoft.Office.Interop.InfoPath.SemiTrust.dll" [0065.397] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.397] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.397] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml" [0065.397] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0139200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x561caed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0139200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x15780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.Xml.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0065.397] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.397] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Interop.InfoPath.Xml.dll") returned -1 [0065.397] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Interop.InfoPath.Xml.dll") returned -1 [0065.398] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Interop.InfoPath.Xml.dll") returned -1 [0065.398] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml") returned="Microsoft.Office.Interop.InfoPath.SemiTrust.xml" [0065.398] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.398] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.398] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.398] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.398] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.Interop.InfoPath.Xml.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll" [0065.398] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62def200, ftCreationTime.dwHighDateTime=0x1c9bc30, ftLastAccessTime.dwLowDateTime=0x65d38290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x62def200, ftLastWriteTime.dwHighDateTime=0x1c9bc30, nFileSizeHigh=0x0, nFileSizeLow=0x837d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.Xml.xml", cAlternateFileName="MI4026~1.XML")) returned 1 [0065.398] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.398] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Interop.InfoPath.Xml.xml") returned -1 [0065.398] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Interop.InfoPath.Xml.xml") returned -1 [0065.398] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Interop.InfoPath.Xml.xml") returned -1 [0065.398] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll") returned="Microsoft.Office.Interop.InfoPath.Xml.dll" [0065.398] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.398] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.398] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.398] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.398] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.Interop.InfoPath.Xml.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml" [0065.398] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x102e00, ftCreationTime.dwHighDateTime=0x1cab7e3, ftLastAccessTime.dwLowDateTime=0x853ab920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x102e00, ftLastWriteTime.dwHighDateTime=0x1cab7e3, nFileSizeHigh=0x0, nFileSizeLow=0x12798, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", cAlternateFileName="MIAE71~1.DLL")) returned 1 [0065.398] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.398] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned -1 [0065.398] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned -1 [0065.398] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned -1 [0065.399] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml") returned="Microsoft.Office.Interop.InfoPath.Xml.xml" [0065.399] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.399] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.399] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.399] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.399] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll" [0065.399] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x853ab920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x67760, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.office.workflow.actions.proxy.dll", cAlternateFileName="MIF37A~1.DLL")) returned 1 [0065.399] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.399] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="microsoft.office.workflow.actions.proxy.dll") returned -1 [0065.399] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="microsoft.office.workflow.actions.proxy.dll") returned -1 [0065.399] lstrcmpiA (lpString1="", lpString2="microsoft.office.workflow.actions.proxy.dll") returned -1 [0065.399] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll" [0065.399] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.399] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.399] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.399] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.399] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="microsoft.office.workflow.actions.proxy.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll" [0065.399] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17441800, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x5687ccb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17441800, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x7d780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SharePoint.BusinessData.Administration.Client.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0065.399] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.399] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned -1 [0065.399] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned -1 [0065.399] lstrcmpiA (lpString1="", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned -1 [0065.399] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll") returned="microsoft.office.workflow.actions.proxy.dll" [0065.399] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.399] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.400] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.400] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.400] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll" [0065.400] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe853200, ftCreationTime.dwHighDateTime=0x1ca24ae, ftLastAccessTime.dwLowDateTime=0x5687ccb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe853200, ftLastWriteTime.dwHighDateTime=0x1ca24ae, nFileSizeHigh=0x0, nFileSizeLow=0x311b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SharePoint.BusinessData.Administration.Client.xml", cAlternateFileName="MICROS~2.XML")) returned 1 [0065.401] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.401] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.xml") returned -1 [0065.401] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.xml") returned -1 [0065.401] lstrcmpiA (lpString1="", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.xml") returned -1 [0065.401] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned="Microsoft.SharePoint.BusinessData.Administration.Client.dll" [0065.401] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.401] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.401] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.401] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.401] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml" [0065.401] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x853ab920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x74760, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.sharepoint.workflowactions.proxy.dll", cAlternateFileName="MI6AA3~1.DLL")) returned 1 [0065.401] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.401] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="microsoft.sharepoint.workflowactions.proxy.dll") returned -1 [0065.401] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="microsoft.sharepoint.workflowactions.proxy.dll") returned -1 [0065.401] lstrcmpiA (lpString1="", lpString2="microsoft.sharepoint.workflowactions.proxy.dll") returned -1 [0065.401] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml") returned="Microsoft.SharePoint.BusinessData.Administration.Client.xml" [0065.401] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.401] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.401] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.401] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.401] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="microsoft.sharepoint.workflowactions.proxy.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll" [0065.401] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x69c26830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x84760, dwReserved0=0x0, dwReserved1=0x0, cFileName="MIMEDIR.DLL", cAlternateFileName="")) returned 1 [0065.402] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.402] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MIMEDIR.DLL") returned -1 [0065.402] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MIMEDIR.DLL") returned -1 [0065.402] lstrcmpiA (lpString1="", lpString2="MIMEDIR.DLL") returned -1 [0065.402] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll") returned="microsoft.sharepoint.workflowactions.proxy.dll" [0065.402] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.402] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.402] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.402] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.402] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MIMEDIR.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL" [0065.402] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2796a00, ftCreationTime.dwHighDateTime=0x1cacb3c, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2796a00, ftLastWriteTime.dwHighDateTime=0x1cacb3c, nFileSizeHigh=0x0, nFileSizeLow=0x8b760, dwReserved0=0x0, dwReserved1=0x0, cFileName="misc.exe", cAlternateFileName="")) returned 1 [0065.402] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.402] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="misc.exe") returned -1 [0065.402] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="misc.exe") returned -1 [0065.402] lstrcmpiA (lpString1="", lpString2="misc.exe") returned -1 [0065.402] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL") returned="MIMEDIR.DLL" [0065.402] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.402] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.402] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.402] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.402] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="misc.exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe") returned="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe" [0065.402] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x58adaa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x12588, dwReserved0=0x0, dwReserved1=0x0, cFileName="MLCFG32.CPL", cAlternateFileName="")) returned 1 [0065.402] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.402] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MLCFG32.CPL") returned -1 [0065.402] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MLCFG32.CPL") returned -1 [0065.402] lstrcmpiA (lpString1="", lpString2="MLCFG32.CPL") returned -1 [0065.402] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe") returned="misc.exe" [0065.403] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.403] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.403] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.403] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.403] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MLCFG32.CPL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL" [0065.403] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x5980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MLSHEXT.DLL", cAlternateFileName="")) returned 1 [0065.403] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.403] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MLSHEXT.DLL") returned -1 [0065.403] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MLSHEXT.DLL") returned -1 [0065.403] lstrcmpiA (lpString1="", lpString2="MLSHEXT.DLL") returned -1 [0065.403] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL") returned="MLCFG32.CPL" [0065.403] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.403] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.403] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.403] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.403] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MLSHEXT.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL" [0065.403] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe79fd00, ftCreationTime.dwHighDateTime=0x1c9cdff, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe79fd00, ftLastWriteTime.dwHighDateTime=0x1c9cdff, nFileSizeHigh=0x0, nFileSizeLow=0x25f87, dwReserved0=0x0, dwReserved1=0x0, cFileName="MML2OMML.XSL", cAlternateFileName="")) returned 1 [0065.403] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.403] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MML2OMML.XSL") returned -1 [0065.403] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MML2OMML.XSL") returned -1 [0065.403] lstrcmpiA (lpString1="", lpString2="MML2OMML.XSL") returned -1 [0065.403] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL") returned="MLSHEXT.DLL" [0065.403] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.403] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.403] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.403] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.404] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MML2OMML.XSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL" [0065.404] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee75d00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6140cc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ee75d00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x9f368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MODELENG.DLL", cAlternateFileName="")) returned 1 [0065.404] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.404] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MODELENG.DLL") returned -1 [0065.404] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MODELENG.DLL") returned -1 [0065.404] lstrcmpiA (lpString1="", lpString2="MODELENG.DLL") returned -1 [0065.404] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL") returned="MML2OMML.XSL" [0065.404] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.404] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.404] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.404] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.404] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MODELENG.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL" [0065.404] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e01e00, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83e01e00, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0x9a790, dwReserved0=0x0, dwReserved1=0x0, cFileName="MORPH9.DLL", cAlternateFileName="")) returned 1 [0065.404] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.404] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MORPH9.DLL") returned -1 [0065.404] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MORPH9.DLL") returned -1 [0065.404] lstrcmpiA (lpString1="", lpString2="MORPH9.DLL") returned -1 [0065.404] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL") returned="MODELENG.DLL" [0065.404] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.404] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.404] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.404] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.405] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MORPH9.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL" [0065.405] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x82755f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x32960, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPXINT.DLL", cAlternateFileName="")) returned 1 [0065.405] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.405] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MPXINT.DLL") returned -1 [0065.405] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MPXINT.DLL") returned -1 [0065.405] lstrcmpiA (lpString1="", lpString2="MPXINT.DLL") returned -1 [0065.405] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL") returned="MORPH9.DLL" [0065.405] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.405] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.405] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.405] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.405] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MPXINT.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL" [0065.405] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaca1de00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaca1de00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0xa5580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACC.OLB", cAlternateFileName="")) returned 1 [0065.405] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.405] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSACC.OLB") returned -1 [0065.405] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSACC.OLB") returned -1 [0065.405] lstrcmpiA (lpString1="", lpString2="MSACC.OLB") returned -1 [0065.405] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL") returned="MPXINT.DLL" [0065.405] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.406] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.406] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.406] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.406] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSACC.OLB" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB" [0065.406] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fbe00, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5fbe00, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x132cb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.EXE", cAlternateFileName="")) returned 1 [0065.406] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.406] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSACCESS.EXE") returned -1 [0065.406] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSACCESS.EXE") returned -1 [0065.406] lstrcmpiA (lpString1="", lpString2="MSACCESS.EXE") returned -1 [0065.406] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB") returned="MSACC.OLB" [0065.406] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.406] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.406] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.406] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.406] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSACCESS.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE" [0065.406] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe53eb900, ftCreationTime.dwHighDateTime=0x1cab7e4, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe53eb900, ftLastWriteTime.dwHighDateTime=0x1cab7e4, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaccess.exe.manifest", cAlternateFileName="MSACCE~1.MAN")) returned 1 [0065.406] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.406] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msaccess.exe.manifest") returned -1 [0065.406] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msaccess.exe.manifest") returned -1 [0065.406] lstrcmpiA (lpString1="", lpString2="msaccess.exe.manifest") returned -1 [0065.406] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE") returned="MSACCESS.EXE" [0065.406] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.406] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.407] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.407] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.407] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="msaccess.exe.manifest" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest") returned="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest" [0065.407] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2e9100, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2e9100, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x14188, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSAEXP30.DLL", cAlternateFileName="")) returned 1 [0065.407] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.407] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSAEXP30.DLL") returned -1 [0065.407] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSAEXP30.DLL") returned -1 [0065.407] lstrcmpiA (lpString1="", lpString2="MSAEXP30.DLL") returned -1 [0065.407] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest") returned="msaccess.exe.manifest" [0065.407] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.407] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.407] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.407] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.407] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSAEXP30.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL" [0065.407] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67a5b300, ftCreationTime.dwHighDateTime=0x1ca99c5, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67a5b300, ftLastWriteTime.dwHighDateTime=0x1ca99c5, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCOL11.INF", cAlternateFileName="")) returned 1 [0065.407] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.407] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSCOL11.INF") returned -1 [0065.407] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSCOL11.INF") returned -1 [0065.407] lstrcmpiA (lpString1="", lpString2="MSCOL11.INF") returned -1 [0065.407] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL") returned="MSAEXP30.DLL" [0065.407] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.407] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.407] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.407] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.407] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSCOL11.INF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF" [0065.407] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd78b00, ftCreationTime.dwHighDateTime=0x1c7a766, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9dd78b00, ftLastWriteTime.dwHighDateTime=0x1c7a766, nFileSizeHigh=0x0, nFileSizeLow=0x1aad, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCOL11.PPD", cAlternateFileName="")) returned 1 [0065.408] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.408] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSCOL11.PPD") returned -1 [0065.408] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSCOL11.PPD") returned -1 [0065.408] lstrcmpiA (lpString1="", lpString2="MSCOL11.PPD") returned -1 [0065.408] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF") returned="MSCOL11.INF" [0065.408] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.408] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.408] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.408] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.408] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSCOL11.PPD" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD" [0065.408] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ccb6a00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa1ff9760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ccb6a00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7cm_en.dub", cAlternateFileName="MSBB80~1.DUB")) returned 1 [0065.408] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.408] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscss7cm_en.dub") returned -1 [0065.408] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7cm_en.dub") returned -1 [0065.408] lstrcmpiA (lpString1="", lpString2="mscss7cm_en.dub") returned -1 [0065.408] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD") returned="MSCOL11.PPD" [0065.408] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.408] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.408] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.408] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.408] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mscss7cm_en.dub" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub" [0065.408] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21901e00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6dc8680, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x21901e00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7cm_es.dub", cAlternateFileName="MSCSS7~1.DUB")) returned 1 [0065.408] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.409] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscss7cm_es.dub") returned -1 [0065.409] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7cm_es.dub") returned -1 [0065.409] lstrcmpiA (lpString1="", lpString2="mscss7cm_es.dub") returned -1 [0065.409] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub") returned="mscss7cm_en.dub" [0065.409] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.409] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.409] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.409] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.409] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mscss7cm_es.dub" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub" [0065.409] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f2dc400, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa3e79140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1f2dc400, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7cm_fr.dub", cAlternateFileName="MSCSS7~3.DUB")) returned 1 [0065.409] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.409] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscss7cm_fr.dub") returned -1 [0065.409] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7cm_fr.dub") returned -1 [0065.409] lstrcmpiA (lpString1="", lpString2="mscss7cm_fr.dub") returned -1 [0065.409] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub") returned="mscss7cm_es.dub" [0065.409] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.409] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.409] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.409] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.409] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mscss7cm_fr.dub" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub" [0065.409] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57d49a00, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa22a7020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x57d49a00, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0x75398, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7en.dll", cAlternateFileName="")) returned 1 [0065.409] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.409] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscss7en.dll") returned -1 [0065.409] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7en.dll") returned -1 [0065.409] lstrcmpiA (lpString1="", lpString2="mscss7en.dll") returned -1 [0065.409] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub") returned="mscss7cm_fr.dub" [0065.410] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.410] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.410] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.410] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.410] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mscss7en.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll" [0065.410] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4474ff00, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa6da2520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4474ff00, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x75398, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7es.dll", cAlternateFileName="")) returned 1 [0065.410] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.410] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscss7es.dll") returned -1 [0065.410] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7es.dll") returned -1 [0065.410] lstrcmpiA (lpString1="", lpString2="mscss7es.dll") returned -1 [0065.410] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll") returned="mscss7en.dll" [0065.410] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.410] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.410] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.410] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.410] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mscss7es.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll" [0065.410] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5efba800, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa4c02e60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5efba800, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0x75398, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7fr.dll", cAlternateFileName="")) returned 1 [0065.410] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.410] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscss7fr.dll") returned -1 [0065.410] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7fr.dll") returned -1 [0065.410] lstrcmpiA (lpString1="", lpString2="mscss7fr.dll") returned -1 [0065.410] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll") returned="mscss7es.dll" [0065.410] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.410] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.410] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.410] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.411] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mscss7fr.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll" [0065.411] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dfc9700, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa2045a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1dfc9700, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x19400, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7wre_en.dub", cAlternateFileName="MS79E7~1.DUB")) returned 1 [0065.411] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.411] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscss7wre_en.dub") returned -1 [0065.411] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7wre_en.dub") returned -1 [0065.411] lstrcmpiA (lpString1="", lpString2="mscss7wre_en.dub") returned -1 [0065.411] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll") returned="mscss7fr.dll" [0065.411] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.411] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.411] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.411] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.411] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mscss7wre_en.dub" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub" [0065.411] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22c14b00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6dee7e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x22c14b00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7wre_es.dub", cAlternateFileName="MSCSS7~2.DUB")) returned 1 [0065.411] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.411] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscss7wre_es.dub") returned -1 [0065.411] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7wre_es.dub") returned -1 [0065.411] lstrcmpiA (lpString1="", lpString2="mscss7wre_es.dub") returned -1 [0065.411] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub") returned="mscss7wre_en.dub" [0065.411] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.411] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.411] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.411] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.411] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mscss7wre_es.dub" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub" [0065.411] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x205ef100, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa408e480, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x205ef100, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7wre_fr.dub", cAlternateFileName="MSCSS7~4.DUB")) returned 1 [0065.411] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.411] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mscss7wre_fr.dub") returned -1 [0065.412] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7wre_fr.dub") returned -1 [0065.412] lstrcmpiA (lpString1="", lpString2="mscss7wre_fr.dub") returned -1 [0065.412] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub") returned="mscss7wre_es.dub" [0065.412] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.412] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.412] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.412] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.412] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mscss7wre_fr.dub" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub" [0065.412] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52ee1a00, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x58c0b550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52ee1a00, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0xee9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7.dll", cAlternateFileName="")) returned 1 [0065.412] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.412] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mset7.dll") returned -1 [0065.412] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7.dll") returned -1 [0065.412] lstrcmpiA (lpString1="", lpString2="mset7.dll") returned -1 [0065.412] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub") returned="mscss7wre_fr.dub" [0065.412] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.412] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.412] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.412] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.412] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mset7.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll" [0065.412] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b94600, ftCreationTime.dwHighDateTime=0x1c879f3, ftLastAccessTime.dwLowDateTime=0x69def8b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b94600, ftLastWriteTime.dwHighDateTime=0x1c879f3, nFileSizeHigh=0x0, nFileSizeLow=0x2c5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7db.kic", cAlternateFileName="")) returned 1 [0065.412] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.412] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mset7db.kic") returned -1 [0065.412] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7db.kic") returned -1 [0065.412] lstrcmpiA (lpString1="", lpString2="mset7db.kic") returned -1 [0065.412] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll") returned="mset7.dll" [0065.412] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.412] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.412] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.412] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.413] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mset7db.kic" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic" [0065.413] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34365600, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x69e15a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34365600, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x1c5b3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7en.kic", cAlternateFileName="")) returned 1 [0065.413] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.413] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mset7en.kic") returned -1 [0065.413] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7en.kic") returned -1 [0065.413] lstrcmpiA (lpString1="", lpString2="mset7en.kic") returned -1 [0065.413] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic") returned="mset7db.kic" [0065.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.413] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.413] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.413] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.413] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mset7en.kic" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic" [0065.413] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x69e3bb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x13e9f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7es.kic", cAlternateFileName="")) returned 1 [0065.413] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.413] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mset7es.kic") returned -1 [0065.413] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7es.kic") returned -1 [0065.413] lstrcmpiA (lpString1="", lpString2="mset7es.kic") returned -1 [0065.413] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic") returned="mset7en.kic" [0065.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.413] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.413] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.413] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.413] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mset7es.kic" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic" [0065.413] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x58c0b550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x1c4c1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7fr.kic", cAlternateFileName="")) returned 1 [0065.413] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.413] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mset7fr.kic") returned -1 [0065.413] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7fr.kic") returned -1 [0065.414] lstrcmpiA (lpString1="", lpString2="mset7fr.kic") returned -1 [0065.414] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic") returned="mset7es.kic" [0065.414] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.414] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.414] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.414] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.414] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mset7fr.kic" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic" [0065.414] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x58c57810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x3567a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7ge.kic", cAlternateFileName="")) returned 1 [0065.414] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.414] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mset7ge.kic") returned -1 [0065.414] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7ge.kic") returned -1 [0065.414] lstrcmpiA (lpString1="", lpString2="mset7ge.kic") returned -1 [0065.414] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic") returned="mset7fr.kic" [0065.414] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.414] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.414] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.414] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.414] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mset7ge.kic" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic" [0065.414] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x1da59c, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7jp.kic", cAlternateFileName="")) returned 1 [0065.414] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.414] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mset7jp.kic") returned -1 [0065.414] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7jp.kic") returned -1 [0065.414] lstrcmpiA (lpString1="", lpString2="mset7jp.kic") returned -1 [0065.414] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic") returned="mset7ge.kic" [0065.414] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.415] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.415] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.415] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.415] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mset7jp.kic" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic" [0065.415] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52ee1a00, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52ee1a00, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x81988, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7tk.dll", cAlternateFileName="")) returned 1 [0065.415] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.415] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mset7tk.dll") returned -1 [0065.415] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7tk.dll") returned -1 [0065.415] lstrcmpiA (lpString1="", lpString2="mset7tk.dll") returned -1 [0065.415] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic") returned="mset7jp.kic" [0065.415] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.415] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.415] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.415] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.415] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mset7tk.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll" [0065.415] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ed9dc00, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x69e3bb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ed9dc00, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x10f798, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7tkjp.dll", cAlternateFileName="MSET7T~1.DLL")) returned 1 [0065.415] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.415] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mset7tkjp.dll") returned -1 [0065.415] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7tkjp.dll") returned -1 [0065.415] lstrcmpiA (lpString1="", lpString2="mset7tkjp.dll") returned -1 [0065.415] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll") returned="mset7tk.dll" [0065.415] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.415] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.415] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.416] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.416] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mset7tkjp.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll" [0065.416] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab61d00, ftCreationTime.dwHighDateTime=0x1bf9d1a, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ab61d00, ftLastWriteTime.dwHighDateTime=0x1bf9d1a, nFileSizeHigh=0x0, nFileSizeLow=0xe36, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN.ICO", cAlternateFileName="")) returned 1 [0065.416] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.416] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSN.ICO") returned -1 [0065.416] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSN.ICO") returned -1 [0065.416] lstrcmpiA (lpString1="", lpString2="MSN.ICO") returned -1 [0065.416] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll") returned="mset7tkjp.dll" [0065.416] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.416] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.416] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.416] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.416] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSN.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO" [0065.416] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4306b00, ftCreationTime.dwHighDateTime=0x1ca223a, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4306b00, ftLastWriteTime.dwHighDateTime=0x1ca223a, nFileSizeHigh=0x0, nFileSizeLow=0x3392, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO0127.ACL", cAlternateFileName="")) returned 1 [0065.416] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.416] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSO0127.ACL") returned -1 [0065.416] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSO0127.ACL") returned -1 [0065.416] lstrcmpiA (lpString1="", lpString2="MSO0127.ACL") returned -1 [0065.416] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO") returned="MSN.ICO" [0065.416] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.416] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.416] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.416] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.416] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSO0127.ACL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL" [0065.416] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76339d00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xdc9d7360, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x76339d00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x36178, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCF.DLL", cAlternateFileName="")) returned 1 [0065.416] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.417] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOCF.DLL") returned -1 [0065.417] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOCF.DLL") returned -1 [0065.417] lstrcmpiA (lpString1="", lpString2="MSOCF.DLL") returned -1 [0065.417] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL") returned="MSO0127.ACL" [0065.417] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.417] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.417] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.417] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.417] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSOCF.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL" [0065.417] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x716ee900, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xdc9fd4c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x716ee900, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x6a790, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCFU.DLL", cAlternateFileName="")) returned 1 [0065.417] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.417] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOCFU.DLL") returned -1 [0065.417] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOCFU.DLL") returned -1 [0065.417] lstrcmpiA (lpString1="", lpString2="MSOCFU.DLL") returned -1 [0065.417] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL") returned="MSOCF.DLL" [0065.417] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.417] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.417] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.417] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.417] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSOCFU.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL" [0065.417] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76339d00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xdc9fd4c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x76339d00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x4590, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCFUIUTILITIESDLL.DLL", cAlternateFileName="MSOCFU~1.DLL")) returned 1 [0065.417] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.417] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOCFUIUTILITIESDLL.DLL") returned -1 [0065.417] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOCFUIUTILITIESDLL.DLL") returned -1 [0065.417] lstrcmpiA (lpString1="", lpString2="MSOCFUIUTILITIESDLL.DLL") returned -1 [0065.417] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL") returned="MSOCFU.DLL" [0065.417] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.418] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.418] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.418] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.418] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSOCFUIUTILITIESDLL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL" [0065.418] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dadcd00, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xd61ff3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1dadcd00, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xa7f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSODCW.DLL", cAlternateFileName="")) returned 1 [0065.418] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.418] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSODCW.DLL") returned -1 [0065.418] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSODCW.DLL") returned -1 [0065.418] lstrcmpiA (lpString1="", lpString2="MSODCW.DLL") returned -1 [0065.418] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL") returned="MSOCFUIUTILITIESDLL.DLL" [0065.418] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.418] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.418] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.418] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.418] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSODCW.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL" [0065.418] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4939000, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4939000, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x17b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOHEV.DLL", cAlternateFileName="")) returned 1 [0065.418] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.418] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOHEV.DLL") returned -1 [0065.418] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOHEV.DLL") returned -1 [0065.418] lstrcmpiA (lpString1="", lpString2="MSOHEV.DLL") returned -1 [0065.418] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL") returned="MSODCW.DLL" [0065.418] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.418] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.418] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.418] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.418] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSOHEV.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL" [0065.419] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4939000, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4939000, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x12d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOHEVI.DLL", cAlternateFileName="")) returned 1 [0065.419] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.419] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOHEVI.DLL") returned -1 [0065.419] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOHEVI.DLL") returned -1 [0065.419] lstrcmpiA (lpString1="", lpString2="MSOHEVI.DLL") returned -1 [0065.419] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL") returned="MSOHEV.DLL" [0065.419] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.419] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.419] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.419] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.419] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSOHEVI.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL" [0065.419] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a159300, ftCreationTime.dwHighDateTime=0x1ca91da, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a159300, ftLastWriteTime.dwHighDateTime=0x1ca91da, nFileSizeHigh=0x0, nFileSizeLow=0x15780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOHTMED.EXE", cAlternateFileName="")) returned 1 [0065.419] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.419] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOHTMED.EXE") returned -1 [0065.419] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOHTMED.EXE") returned -1 [0065.419] lstrcmpiA (lpString1="", lpString2="MSOHTMED.EXE") returned -1 [0065.419] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL") returned="MSOHEVI.DLL" [0065.419] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.419] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.419] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.419] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.419] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSOHTMED.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE" [0065.419] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa94b500, ftCreationTime.dwHighDateTime=0x1caca29, ftLastAccessTime.dwLowDateTime=0x593a1b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa94b500, ftLastWriteTime.dwHighDateTime=0x1caca29, nFileSizeHigh=0x0, nFileSizeLow=0xa398, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSTYLE.DLL", cAlternateFileName="")) returned 1 [0065.420] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.420] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOSTYLE.DLL") returned -1 [0065.420] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOSTYLE.DLL") returned -1 [0065.420] lstrcmpiA (lpString1="", lpString2="MSOSTYLE.DLL") returned -1 [0065.420] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE") returned="MSOHTMED.EXE" [0065.420] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.420] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Office14\\") returned="" [0065.420] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" [0065.420] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\office14\\how to decrypt files.txt")) returned 0x20 [0065.420] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSOSTYLE.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL" [0065.420] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d58a800, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd6297920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7d58a800, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0xde180, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSYNC.EXE", cAlternateFileName="")) returned 1 [0065.420] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.420] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOSYNC.EXE") returned -1 [0065.420] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOSYNC.EXE") returned -1 [0065.420] lstrcmpiA (lpString1="", lpString2="MSOSYNC.EXE") returned -1 [0065.420] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL") returned="MSOSTYLE.DLL" [0065.422] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d58a800, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd62e3be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7d58a800, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x77978, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC.EXE", cAlternateFileName="")) returned 1 [0065.422] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.422] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOUC.EXE") returned -1 [0065.422] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOUC.EXE") returned -1 [0065.422] lstrcmpiA (lpString1="", lpString2="MSOUC.EXE") returned -1 [0065.422] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE") returned="MSOSYNC.EXE" [0065.423] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x593c7cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x65d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUTL.OLB", cAlternateFileName="")) returned 1 [0065.423] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.423] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOUTL.OLB") returned -1 [0065.423] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOUTL.OLB") returned -1 [0065.423] lstrcmpiA (lpString1="", lpString2="MSOUTL.OLB") returned -1 [0065.423] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE") returned="MSOUC.EXE" [0065.423] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda57df00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd6309d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xda57df00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x45578, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUTLS.DLL", cAlternateFileName="")) returned 1 [0065.423] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.423] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSOUTLS.DLL") returned -1 [0065.423] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOUTLS.DLL") returned -1 [0065.423] lstrcmpiA (lpString1="", lpString2="MSOUTLS.DLL") returned -1 [0065.423] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB") returned="MSOUTL.OLB" [0065.423] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62f00800, ftCreationTime.dwHighDateTime=0x1caba23, ftLastAccessTime.dwLowDateTime=0xbde72640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x62f00800, ftLastWriteTime.dwHighDateTime=0x1caba23, nFileSizeHigh=0x0, nFileSizeLow=0x11560, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPJEVTS.DLL", cAlternateFileName="")) returned 1 [0065.423] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.423] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSPJEVTS.DLL") returned -1 [0065.423] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPJEVTS.DLL") returned -1 [0065.423] lstrcmpiA (lpString1="", lpString2="MSPJEVTS.DLL") returned -1 [0065.423] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL") returned="MSOUTLS.DLL" [0065.423] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcab1b00, ftCreationTime.dwHighDateTime=0x1cabea2, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcab1b00, ftLastWriteTime.dwHighDateTime=0x1cabea2, nFileSizeHigh=0x0, nFileSizeLow=0x62588, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPPT.OLB", cAlternateFileName="")) returned 1 [0065.423] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.423] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSPPT.OLB") returned -1 [0065.423] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPPT.OLB") returned -1 [0065.423] lstrcmpiA (lpString1="", lpString2="MSPPT.OLB") returned -1 [0065.423] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL") returned="MSPJEVTS.DLL" [0065.423] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe57c63a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xd65a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPRJ.OLB", cAlternateFileName="")) returned 1 [0065.424] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.424] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSPRJ.OLB") returned -1 [0065.424] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPRJ.OLB") returned -1 [0065.424] lstrcmpiA (lpString1="", lpString2="MSPRJ.OLB") returned -1 [0065.424] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB") returned="MSPPT.OLB" [0065.424] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6ae000, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xdac3c1c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6ae000, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x4e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="msproof7.dll", cAlternateFileName="")) returned 1 [0065.424] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.424] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="msproof7.dll") returned -1 [0065.424] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msproof7.dll") returned -1 [0065.424] lstrcmpiA (lpString1="", lpString2="msproof7.dll") returned -1 [0065.424] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB") returned="MSPRJ.OLB" [0065.424] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x1963b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPST32.DLL", cAlternateFileName="")) returned 1 [0065.424] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.424] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSPST32.DLL") returned -1 [0065.424] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPST32.DLL") returned -1 [0065.424] lstrcmpiA (lpString1="", lpString2="MSPST32.DLL") returned -1 [0065.424] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll") returned="msproof7.dll" [0065.424] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e01e00, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x6a1356f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83e01e00, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0xdb4b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.EXE", cAlternateFileName="")) returned 1 [0065.424] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.424] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSPUB.EXE") returned -1 [0065.424] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB.EXE") returned -1 [0065.424] lstrcmpiA (lpString1="", lpString2="MSPUB.EXE") returned -1 [0065.424] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL") returned="MSPST32.DLL" [0065.425] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d978100, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d978100, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x4b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="mspub.exe.manifest", cAlternateFileName="MSPUBE~1.MAN")) returned 1 [0065.425] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.425] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mspub.exe.manifest") returned -1 [0065.425] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mspub.exe.manifest") returned -1 [0065.425] lstrcmpiA (lpString1="", lpString2="mspub.exe.manifest") returned -1 [0065.425] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE") returned="MSPUB.EXE" [0065.425] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33918f00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33918f00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3ff28, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.TLB", cAlternateFileName="")) returned 1 [0065.425] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.425] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSPUB.TLB") returned -1 [0065.425] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB.TLB") returned -1 [0065.425] lstrcmpiA (lpString1="", lpString2="MSPUB.TLB") returned -1 [0065.425] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest") returned="mspub.exe.manifest" [0065.425] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32ad2d00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32ad2d00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0xd1160, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSQRY32.EXE", cAlternateFileName="")) returned 1 [0065.425] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.425] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSQRY32.EXE") returned -1 [0065.425] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSQRY32.EXE") returned -1 [0065.425] lstrcmpiA (lpString1="", lpString2="MSQRY32.EXE") returned -1 [0065.425] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB") returned="MSPUB.TLB" [0065.425] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e550, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSRTEDIT.DLL", cAlternateFileName="")) returned 1 [0065.425] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.425] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSRTEDIT.DLL") returned -1 [0065.425] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSRTEDIT.DLL") returned -1 [0065.425] lstrcmpiA (lpString1="", lpString2="MSRTEDIT.DLL") returned -1 [0065.425] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE") returned="MSQRY32.EXE" [0065.425] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40dec00, ftCreationTime.dwHighDateTime=0x1cb7010, ftLastAccessTime.dwLowDateTime=0xcf055920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x40dec00, ftLastWriteTime.dwHighDateTime=0x1cb7010, nFileSizeHigh=0x0, nFileSizeLow=0xff368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORDB.EXE", cAlternateFileName="")) returned 1 [0065.425] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.426] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSTORDB.EXE") returned -1 [0065.426] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTORDB.EXE") returned -1 [0065.426] lstrcmpiA (lpString1="", lpString2="MSTORDB.EXE") returned -1 [0065.426] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL") returned="MSRTEDIT.DLL" [0065.426] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7931a00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x59460250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7931a00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x20158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORE.EXE", cAlternateFileName="")) returned 1 [0065.426] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.426] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSTORE.EXE") returned -1 [0065.426] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTORE.EXE") returned -1 [0065.426] lstrcmpiA (lpString1="", lpString2="MSTORE.EXE") returned -1 [0065.426] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE") returned="MSTORDB.EXE" [0065.426] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8c44700, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a28c350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8c44700, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x89b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORES.DLL", cAlternateFileName="")) returned 1 [0065.426] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.426] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSTORES.DLL") returned -1 [0065.426] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTORES.DLL") returned -1 [0065.426] lstrcmpiA (lpString1="", lpString2="MSTORES.DLL") returned -1 [0065.426] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE") returned="MSTORE.EXE" [0065.426] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7466000, ftCreationTime.dwHighDateTime=0x1caccde, ftLastAccessTime.dwLowDateTime=0x6a2fe770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7466000, ftLastWriteTime.dwHighDateTime=0x1caccde, nFileSizeHigh=0x0, nFileSizeLow=0xdc158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWORD.OLB", cAlternateFileName="")) returned 1 [0065.426] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.426] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSWORD.OLB") returned -1 [0065.426] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSWORD.OLB") returned -1 [0065.426] lstrcmpiA (lpString1="", lpString2="MSWORD.OLB") returned -1 [0065.426] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL") returned="MSTORES.DLL" [0065.426] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x633f6700, ftCreationTime.dwHighDateTime=0x1c9ce43, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x633f6700, ftLastWriteTime.dwHighDateTime=0x1c9ce43, nFileSizeHigh=0x0, nFileSizeLow=0x46530, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSYUBIN7.DLL", cAlternateFileName="")) returned 1 [0065.426] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.426] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MSYUBIN7.DLL") returned -1 [0065.426] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSYUBIN7.DLL") returned -1 [0065.426] lstrcmpiA (lpString1="", lpString2="MSYUBIN7.DLL") returned -1 [0065.427] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB") returned="MSWORD.OLB" [0065.427] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e32200, ftCreationTime.dwHighDateTime=0x1c62ad6, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e32200, ftLastWriteTime.dwHighDateTime=0x1c62ad6, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x0, cFileName="MYSL.ICO", cAlternateFileName="")) returned 1 [0065.427] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.427] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MYSL.ICO") returned -1 [0065.427] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MYSL.ICO") returned -1 [0065.427] lstrcmpiA (lpString1="", lpString2="MYSL.ICO") returned -1 [0065.427] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL") returned="MSYUBIN7.DLL" [0065.427] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636bfc00, ftCreationTime.dwHighDateTime=0x1cb7010, ftLastAccessTime.dwLowDateTime=0xd79ccfa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x636bfc00, ftLastWriteTime.dwHighDateTime=0x1cb7010, nFileSizeHigh=0x0, nFileSizeLow=0x1b968, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAME.DLL", cAlternateFileName="")) returned 1 [0065.427] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.427] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NAME.DLL") returned -1 [0065.427] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NAME.DLL") returned -1 [0065.427] lstrcmpiA (lpString1="", lpString2="NAME.DLL") returned -1 [0065.427] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO") returned="MYSL.ICO" [0065.427] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a7a600, ftCreationTime.dwHighDateTime=0x1cab99a, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19a7a600, ftLastWriteTime.dwHighDateTime=0x1cab99a, nFileSizeHigh=0x0, nFileSizeLow=0x4780, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAMECONTROLPROXY.DLL", cAlternateFileName="NAMECO~1.DLL")) returned 1 [0065.427] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.427] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="NAMECONTROLPROXY.DLL") returned -1 [0065.427] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NAMECONTROLPROXY.DLL") returned -1 [0065.427] lstrcmpiA (lpString1="", lpString2="NAMECONTROLPROXY.DLL") returned -1 [0065.427] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL") returned="NAME.DLL" [0065.427] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a7a600, ftCreationTime.dwHighDateTime=0x1cab99a, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19a7a600, ftLastWriteTime.dwHighDateTime=0x1cab99a, nFileSizeHigh=0x0, nFileSizeLow=0x1ab80, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAMECONTROLSERVER.EXE", cAlternateFileName="NAMECO~1.EXE")) returned 1 [0065.427] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.428] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL") returned="NAMECONTROLPROXY.DLL" [0065.428] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948ed600, ftCreationTime.dwHighDateTime=0x1ca913a, ftLastAccessTime.dwLowDateTime=0xbdf30d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x948ed600, ftLastWriteTime.dwHighDateTime=0x1ca913a, nFileSizeHigh=0x0, nFileSizeLow=0x26180, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAMEEXT.DLL", cAlternateFileName="")) returned 1 [0065.428] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.428] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE") returned="NAMECONTROLSERVER.EXE" [0065.428] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b465500, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x6a4c77f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b465500, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x77cdb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7Data0011.DLL", cAlternateFileName="NL7DAT~1.DLL")) returned 1 [0065.428] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.428] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL") returned="NAMEEXT.DLL" [0065.428] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b465500, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b465500, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x258bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7Lexicons0011.DLL", cAlternateFileName="NL7LEX~1.DLL")) returned 1 [0065.428] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.428] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL") returned="NL7Data0011.DLL" [0065.428] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17736b00, ftCreationTime.dwHighDateTime=0x1cbae39, ftLastAccessTime.dwLowDateTime=0xa225ad60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x17736b00, ftLastWriteTime.dwHighDateTime=0x1cbae39, nFileSizeHigh=0x0, nFileSizeLow=0x589bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7MODELS0009.dll", cAlternateFileName="NL7MOD~3.DLL")) returned 1 [0065.428] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.428] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL") returned="NL7Lexicons0011.DLL" [0065.428] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a36d00, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa7323800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56a36d00, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0x5ef3b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7MODELS000A.dll", cAlternateFileName="NL7MOD~1.DLL")) returned 1 [0065.428] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.428] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll") returned="NL7MODELS0009.dll" [0065.428] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c1cc400, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa4b90a40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3c1cc400, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x5697b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7MODELS000C.dll", cAlternateFileName="NL7MOD~2.DLL")) returned 1 [0065.428] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.428] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll") returned="NL7MODELS000A.dll" [0065.429] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b465500, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x6a513ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b465500, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x652bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7Models0011.DLL", cAlternateFileName="NL7MOD~4.DLL")) returned 1 [0065.429] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.429] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll") returned="NL7MODELS000C.dll" [0065.429] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42d95200, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42d95200, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NPAUTHZ.DLL", cAlternateFileName="")) returned 1 [0065.429] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.429] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL") returned="NL7Models0011.DLL" [0065.429] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bc1b000, ftCreationTime.dwHighDateTime=0x1cbe56f, ftLastAccessTime.dwLowDateTime=0xe07baf60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1bc1b000, ftLastWriteTime.dwHighDateTime=0x1cbe56f, nFileSizeHigh=0x0, nFileSizeLow=0x1ceb168, dwReserved0=0x0, dwReserved1=0x0, cFileName="OART.DLL", cAlternateFileName="")) returned 1 [0065.429] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.429] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL") returned="NPAUTHZ.DLL" [0065.429] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b7fea00, ftCreationTime.dwHighDateTime=0x1cac1ed, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fea00, ftLastWriteTime.dwHighDateTime=0x1cac1ed, nFileSizeHigh=0x0, nFileSizeLow=0x124e978, dwReserved0=0x0, dwReserved1=0x0, cFileName="OARTCONV.DLL", cAlternateFileName="")) returned 1 [0065.429] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.429] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL") returned="OART.DLL" [0065.429] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x6b251510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0xd00c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCRHC.DAT", cAlternateFileName="")) returned 1 [0065.429] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.429] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL") returned="OARTCONV.DLL" [0065.429] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0xa00c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCRVC.DAT", cAlternateFileName="")) returned 1 [0065.429] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.429] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT") returned="OCRHC.DAT" [0065.429] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67a5b300, ftCreationTime.dwHighDateTime=0x1ca99c5, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67a5b300, ftLastWriteTime.dwHighDateTime=0x1ca99c5, nFileSizeHigh=0x0, nFileSizeLow=0x1c99, dwReserved0=0x0, dwReserved1=0x0, cFileName="OEMPRINT.CAT", cAlternateFileName="")) returned 1 [0065.429] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.430] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT") returned="OCRVC.DAT" [0065.430] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e266b00, ftCreationTime.dwHighDateTime=0x1cbd863, ftLastAccessTime.dwLowDateTime=0xdb444c00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7e266b00, ftLastWriteTime.dwHighDateTime=0x1cbd863, nFileSizeHigh=0x0, nFileSizeLow=0x961380, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFOWC.DLL", cAlternateFileName="")) returned 1 [0065.430] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.430] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT") returned="OEMPRINT.CAT" [0065.430] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39d43b00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x59759dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39d43b00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x123e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFRHD.DLL", cAlternateFileName="")) returned 1 [0065.430] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.430] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL") returned="OFFOWC.DLL" [0065.430] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54f27b00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x5977ff30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54f27b00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x7d778, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFXML.DLL", cAlternateFileName="")) returned 1 [0065.430] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.430] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL") returned="OFFRHD.DLL" [0065.430] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32a39900, ftCreationTime.dwHighDateTime=0x1c6f3cf, ftLastAccessTime.dwLowDateTime=0x5977ff30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32a39900, ftLastWriteTime.dwHighDateTime=0x1c6f3cf, nFileSizeHigh=0x0, nFileSizeLow=0x9bb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="ogalegit.dll", cAlternateFileName="")) returned 1 [0065.430] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.430] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL") returned="OFFXML.DLL" [0065.430] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfc62000, ftCreationTime.dwHighDateTime=0x1cb6ffe, ftLastAccessTime.dwLowDateTime=0xdd1216c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xbfc62000, ftLastWriteTime.dwHighDateTime=0x1cb6ffe, nFileSizeHigh=0x0, nFileSizeLow=0x4bc778, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIMG.DLL", cAlternateFileName="")) returned 1 [0065.430] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.430] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll") returned="ogalegit.dll" [0065.430] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd58faa00, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd79f3100, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd58faa00, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x49168, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIS.EXE", cAlternateFileName="")) returned 1 [0065.430] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.430] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL") returned="OIMG.DLL" [0065.431] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd58faa00, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd7afdaa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd58faa00, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x175970, dwReserved0=0x0, dwReserved1=0x0, cFileName="OISAPP.DLL", cAlternateFileName="")) returned 1 [0065.431] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.431] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE") returned="OIS.EXE" [0065.431] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc74da00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x6bd53ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc74da00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x6988, dwReserved0=0x0, dwReserved1=0x0, cFileName="oisctrl.dll", cAlternateFileName="")) returned 1 [0065.431] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.431] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL") returned="OISAPP.DLL" [0065.431] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd58faa00, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd7b23c00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd58faa00, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x59f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="OISGRAPH.DLL", cAlternateFileName="")) returned 1 [0065.431] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.431] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll") returned="oisctrl.dll" [0065.431] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6bd9fd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x3f580, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLKFSTUB.DLL", cAlternateFileName="")) returned 1 [0065.431] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.431] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL") returned="OISGRAPH.DLL" [0065.431] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42068a00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42068a00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0x1374c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLKIRM.XML", cAlternateFileName="")) returned 1 [0065.431] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.431] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL") returned="OLKFSTUB.DLL" [0065.431] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42068a00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x6bd9fd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42068a00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0x13594, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLKIRMV.XML", cAlternateFileName="")) returned 1 [0065.431] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.431] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML") returned="OLKIRM.XML" [0065.431] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x6be5e470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x44ab80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLMAPI32.DLL", cAlternateFileName="")) returned 1 [0065.431] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.431] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML") returned="OLKIRMV.XML" [0065.431] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e85b00, ftCreationTime.dwHighDateTime=0x1c9e5a5, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33e85b00, ftLastWriteTime.dwHighDateTime=0x1c9e5a5, nFileSizeHigh=0x0, nFileSizeLow=0x172bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMML2MML.XSL", cAlternateFileName="")) returned 1 [0065.432] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.432] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46c75c00, ftCreationTime.dwHighDateTime=0x1cab8a7, ftLastAccessTime.dwLowDateTime=0x6be845d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46c75c00, ftLastWriteTime.dwHighDateTime=0x1cab8a7, nFileSizeHigh=0x0, nFileSizeLow=0x10d980, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSMAIN.DLL", cAlternateFileName="")) returned 1 [0065.432] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.432] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46c75c00, ftCreationTime.dwHighDateTime=0x1cab8a7, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46c75c00, ftLastWriteTime.dwHighDateTime=0x1cab8a7, nFileSizeHigh=0x0, nFileSizeLow=0x59d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSXP32.DLL", cAlternateFileName="")) returned 1 [0065.432] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.432] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82531f00, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82531f00, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0xc4390, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnIE.dll", cAlternateFileName="")) returned 1 [0065.432] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.432] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8121f200, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x6be845d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8121f200, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0x91390, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnIELinkedNotes.dll", cAlternateFileName="ONBTTN~1.DLL")) returned 1 [0065.432] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.432] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee925900, ftCreationTime.dwHighDateTime=0x1cab8aa, ftLastAccessTime.dwLowDateTime=0x6beaa730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee925900, ftLastWriteTime.dwHighDateTime=0x1cab8aa, nFileSizeHigh=0x0, nFileSizeLow=0xdbd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnOL.dll", cAlternateFileName="")) returned 1 [0065.432] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.432] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82531f00, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x6bed0890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82531f00, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0x9d580, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnPPT.dll", cAlternateFileName="ONBTTN~2.DLL")) returned 1 [0065.433] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.433] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8121f200, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x6bed0890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8121f200, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0x9d578, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnWD.dll", cAlternateFileName="")) returned 1 [0065.433] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.433] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c1f0570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote", cAlternateFileName="")) returned 1 [0065.433] lstrcmpA (lpString1=".", lpString2="OneNote") returned -1 [0065.433] lstrcmpA (lpString1="..", lpString2="OneNote") returned -1 [0065.433] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c1f0570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2d807e, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0065.435] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.435] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c1f0570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0065.435] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.435] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.435] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fd1300, ftCreationTime.dwHighDateTime=0x1c8e623, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5fd1300, ftLastWriteTime.dwHighDateTime=0x1c8e623, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SendToOneNote-PipelineConfig.xml", cAlternateFileName="SENDTO~1.XML")) returned 1 [0065.435] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.439] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.439] CloseHandle (hObject=0x8c) returned 1 [0065.439] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\", lpString2="SendToOneNote-PipelineConfig.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml" [0065.439] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7167100, ftCreationTime.dwHighDateTime=0x1c9d832, ftLastAccessTime.dwLowDateTime=0x598184b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7167100, ftLastWriteTime.dwHighDateTime=0x1c9d832, nFileSizeHigh=0x0, nFileSizeLow=0x2580, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNote.gpd", cAlternateFileName="SENDTO~1.GPD")) returned 1 [0065.439] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.439] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d77db00, ftCreationTime.dwHighDateTime=0x1c8e25a, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d77db00, ftLastWriteTime.dwHighDateTime=0x1c8e25a, nFileSizeHigh=0x0, nFileSizeLow=0x7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNote.ini", cAlternateFileName="SENDTO~1.INI")) returned 1 [0065.439] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.439] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x5983e610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x1bf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNOteFilter.dll", cAlternateFileName="SENDTO~1.DLL")) returned 1 [0065.439] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.440] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5b7d200, ftCreationTime.dwHighDateTime=0x1c8edfe, ftLastAccessTime.dwLowDateTime=0x5983e610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf5b7d200, ftLastWriteTime.dwHighDateTime=0x1c8edfe, nFileSizeHigh=0x0, nFileSizeLow=0x51, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendtoOneNoteFilter.gpd", cAlternateFileName="SENDTO~2.GPD")) returned 1 [0065.440] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.440] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1fd700, ftCreationTime.dwHighDateTime=0x1c8e624, ftLastAccessTime.dwLowDateTime=0x5983e610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a1fd700, ftLastWriteTime.dwHighDateTime=0x1c8e624, nFileSizeHigh=0x0, nFileSizeLow=0x1ca2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNoteNames.gpd", cAlternateFileName="SENDTO~3.GPD")) returned 1 [0065.440] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.440] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0xeb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNoteUI.dll", cAlternateFileName="SENDTO~2.DLL")) returned 1 [0065.440] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.440] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0xeb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNoteUI.dll", cAlternateFileName="SENDTO~2.DLL")) returned 0 [0065.440] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0065.440] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5ccd00, ftCreationTime.dwHighDateTime=0x1cacf90, ftLastAccessTime.dwLowDateTime=0x6bf1cb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c5ccd00, ftLastWriteTime.dwHighDateTime=0x1cacf90, nFileSizeHigh=0x0, nFileSizeLow=0x208560, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ONENOTE.EXE", cAlternateFileName="")) returned 1 [0065.440] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.440] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde807b00, ftCreationTime.dwHighDateTime=0x1ca1b0c, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde807b00, ftLastWriteTime.dwHighDateTime=0x1ca1b0c, nFileSizeHigh=0x0, nFileSizeLow=0x138f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTEIRM.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0065.440] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.440] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x6bf1cb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x3bd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTEM.EXE", cAlternateFileName="")) returned 1 [0065.440] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.440] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x26d70, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTEMANAGED.DLL", cAlternateFileName="ONENOT~1.DLL")) returned 1 [0065.441] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.441] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5ccd00, ftCreationTime.dwHighDateTime=0x1cacf90, ftLastAccessTime.dwLowDateTime=0x6bf42cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c5ccd00, ftLastWriteTime.dwHighDateTime=0x1cacf90, nFileSizeHigh=0x0, nFileSizeLow=0x182970, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONFILTER.DLL", cAlternateFileName="")) returned 1 [0065.441] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.441] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x6bf68e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x135a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONLNTCOMLIB.DLL", cAlternateFileName="ONLNTC~1.DLL")) returned 1 [0065.441] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.441] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8dfa00, ftCreationTime.dwHighDateTime=0x1cacf90, ftLastAccessTime.dwLowDateTime=0x6c157ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d8dfa00, ftLastWriteTime.dwHighDateTime=0x1cacf90, nFileSizeHigh=0x0, nFileSizeLow=0xd3e368, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONMAIN.DLL", cAlternateFileName="")) returned 1 [0065.441] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.441] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8121f200, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x598184b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8121f200, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0xa8180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONPPTAddin.dll", cAlternateFileName="ONPPTA~1.DLL")) returned 1 [0065.441] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.441] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8121f200, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x59864770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8121f200, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0xb9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONWordAddin.dll", cAlternateFileName="ONWORD~1.DLL")) returned 1 [0065.441] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.441] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd041f000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x1bbb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGCHART.DLL", cAlternateFileName="")) returned 1 [0065.441] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.441] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd0491420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xaeb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGCHWIZ.DLL", cAlternateFileName="")) returned 1 [0065.441] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.442] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd64609a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x14590, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGWIZ.EXE", cAlternateFileName="")) returned 1 [0065.442] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.442] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd64d2dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x6a798, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORMELEMS.DLL", cAlternateFileName="")) returned 1 [0065.442] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.442] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x830db760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x11990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORMMODEL.MDL", cAlternateFileName="")) returned 1 [0065.442] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.442] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eac400, ftCreationTime.dwHighDateTime=0x1cabc89, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84eac400, ftLastWriteTime.dwHighDateTime=0x1cabc89, nFileSizeHigh=0x0, nFileSizeLow=0x3d05, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPP.HTM", cAlternateFileName="")) returned 1 [0065.442] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.442] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eac400, ftCreationTime.dwHighDateTime=0x1cabc89, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84eac400, ftLastWriteTime.dwHighDateTime=0x1cabc89, nFileSizeHigh=0x0, nFileSizeLow=0xc119, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPP.VBS", cAlternateFileName="")) returned 1 [0065.442] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.442] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xa160, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLACCT.DLL", cAlternateFileName="")) returned 1 [0065.442] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.442] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7df9900, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7df9900, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x28960, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLCTL.DLL", cAlternateFileName="")) returned 1 [0065.442] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.442] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc37fa400, ftCreationTime.dwHighDateTime=0x1ca0b28, ftLastAccessTime.dwLowDateTime=0x6c393490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc37fa400, ftLastWriteTime.dwHighDateTime=0x1ca0b28, nFileSizeHigh=0x0, nFileSizeLow=0x380000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLFLTR.DAT", cAlternateFileName="")) returned 1 [0065.442] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.443] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3eeae600, ftCreationTime.dwHighDateTime=0x1ca5083, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3eeae600, ftLastWriteTime.dwHighDateTime=0x1ca5083, nFileSizeHigh=0x0, nFileSizeLow=0xab940, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLFLTR.DLL", cAlternateFileName="")) returned 1 [0065.443] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.443] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x599bb3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0xaff88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLMIME.DLL", cAlternateFileName="")) returned 1 [0065.443] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.443] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x6cc5a5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x175ed60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.EXE", cAlternateFileName="")) returned 1 [0065.443] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.443] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d147f00, ftCreationTime.dwHighDateTime=0x1cac9af, ftLastAccessTime.dwLowDateTime=0x6cc5a5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d147f00, ftLastWriteTime.dwHighDateTime=0x1cac9af, nFileSizeHigh=0x0, nFileSizeLow=0x4b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.EXE.MANIFEST", cAlternateFileName="OUTLOO~1.MAN")) returned 1 [0065.443] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.443] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookAutoDiscover", cAlternateFileName="OUTLOO~1")) returned 1 [0065.443] lstrcmpA (lpString1=".", lpString2="OutlookAutoDiscover") returned -1 [0065.443] lstrcmpA (lpString1="..", lpString2="OutlookAutoDiscover") returned -1 [0065.443] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2d807e, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0065.445] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.445] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0065.447] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.447] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.447] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x330, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AMERITECH.NET.XML", cAlternateFileName="AMERIT~1.XML")) returned 1 [0065.447] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.449] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.452] CloseHandle (hObject=0x8c) returned 1 [0065.452] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="AMERITECH.NET.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML" [0065.452] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x0, dwReserved1=0x0, cFileName="BTINTERNET.NET.XML", cAlternateFileName="BTINTE~1.XML")) returned 1 [0065.452] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.452] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x51b201b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x780074, dwReserved1=0x74, cFileName="BTOPENWORLD.COM.XML", cAlternateFileName="BTOPEN~1.XML")) returned 1 [0065.452] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.453] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x52837ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x328, dwReserved0=0x780074, dwReserved1=0x74, cFileName="FLASH.NET.XML", cAlternateFileName="FLASHN~1.XML")) returned 1 [0065.453] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.453] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6a513ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x780074, dwReserved1=0x74, cFileName="NL.ROGERS.COM.XML", cAlternateFileName="NLROGE~1.XML")) returned 1 [0065.453] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.453] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6a87fa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x780074, dwReserved1=0x74, cFileName="NVBELL.NET.XML", cAlternateFileName="NVBELL~1.XML")) returned 1 [0065.453] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.453] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PACBELL.NET.XML", cAlternateFileName="PACBEL~1.XML")) returned 1 [0065.453] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.453] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PRODIGY.NET.XML", cAlternateFileName="PRODIG~1.XML")) returned 1 [0065.453] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.453] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x780074, dwReserved1=0x74, cFileName="ROGERS.COM.XML", cAlternateFileName="ROGERS~1.XML")) returned 1 [0065.453] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.453] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x330, dwReserved0=0x780074, dwReserved1=0x74, cFileName="SBCGLOBAL.NET.XML", cAlternateFileName="SBCGLO~1.XML")) returned 1 [0065.453] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.453] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x780074, dwReserved1=0x74, cFileName="SNET.NET.XML", cAlternateFileName="SNETNE~1.XML")) returned 1 [0065.453] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.453] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x780074, dwReserved1=0x74, cFileName="SWBELL.NET.XML", cAlternateFileName="SWBELL~1.XML")) returned 1 [0065.453] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.454] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x780074, dwReserved1=0x74, cFileName="TALK21.COM.XML", cAlternateFileName="TALK21~1.XML")) returned 1 [0065.454] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.454] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x780074, dwReserved1=0x74, cFileName="WANS.NET.XML", cAlternateFileName="WANSNE~1.XML")) returned 1 [0065.454] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.454] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.CA.XML", cAlternateFileName="YAHOOC~2.XML")) returned 1 [0065.454] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.454] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c79650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.CO.ID.XML", cAlternateFileName="YA6C44~1.XML")) returned 1 [0065.454] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.454] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.CO.IN.XML", cAlternateFileName="YA8E91~1.XML")) returned 1 [0065.454] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.454] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a900, ftCreationTime.dwHighDateTime=0x1c6ea7d, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a900, ftLastWriteTime.dwHighDateTime=0x1c6ea7d, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.CO.JP.XML", cAlternateFileName="YAHOOC~3.XML")) returned 1 [0065.454] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.454] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c79650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.CO.KR.XML", cAlternateFileName="YAEF96~1.XML")) returned 1 [0065.454] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.454] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.CO.NZ.XML", cAlternateFileName="YA186B~1.XML")) returned 1 [0065.454] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.454] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.CO.TH.XML", cAlternateFileName="YACB7D~1.XML")) returned 1 [0065.454] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.455] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.CO.UK.XML", cAlternateFileName="YAE791~1.XML")) returned 1 [0065.455] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.455] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.COM.AR.XML", cAlternateFileName="YA81CD~1.XML")) returned 1 [0065.455] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.455] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.COM.AU.XML", cAlternateFileName="YA02CD~1.XML")) returned 1 [0065.455] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.455] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.COM.BR.XML", cAlternateFileName="YAHOOC~1.XML")) returned 1 [0065.455] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.455] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.COM.CN.XML", cAlternateFileName="YAHOOC~4.XML")) returned 1 [0065.455] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.455] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.COM.HK.XML", cAlternateFileName="YA56AC~1.XML")) returned 1 [0065.455] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.455] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.COM.MX.XML", cAlternateFileName="YAEA08~1.XML")) returned 1 [0065.455] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.455] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.COM.MY.XML", cAlternateFileName="YA0670~1.XML")) returned 1 [0065.455] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.456] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.COM.PH.XML", cAlternateFileName="YA6D1B~1.XML")) returned 1 [0065.456] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.456] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.COM.SG.XML", cAlternateFileName="YAC50A~1.XML")) returned 1 [0065.456] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.456] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.COM.TW.XML", cAlternateFileName="YAB0F6~1.XML")) returned 1 [0065.456] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.456] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.COM.VN.XML", cAlternateFileName="YA38FD~1.XML")) returned 1 [0065.456] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.456] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.COM.XML", cAlternateFileName="YA531A~1.XML")) returned 1 [0065.456] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.456] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.DE.XML", cAlternateFileName="YAHOOD~1.XML")) returned 1 [0065.456] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.456] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x328, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.ES.XML", cAlternateFileName="YAHOOE~1.XML")) returned 1 [0065.456] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.456] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.FR.XML", cAlternateFileName="YAHOOF~1.XML")) returned 1 [0065.456] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.457] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.HK.XML", cAlternateFileName="YAHOOH~1.XML")) returned 1 [0065.457] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.457] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.IE.XML", cAlternateFileName="YAHOOI~1.XML")) returned 1 [0065.457] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.457] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c79650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.IT.XML", cAlternateFileName="YAHOOI~2.XML")) returned 1 [0065.457] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.457] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a900, ftCreationTime.dwHighDateTime=0x1c6ea7d, ftLastAccessTime.dwLowDateTime=0x70c79650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a900, ftLastWriteTime.dwHighDateTime=0x1c6ea7d, nFileSizeHigh=0x0, nFileSizeLow=0x331, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.JP.XML", cAlternateFileName="YAHOOJ~1.XML")) returned 1 [0065.457] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.457] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.NO.XML", cAlternateFileName="YAHOON~1.XML")) returned 1 [0065.457] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.457] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.PL.XML", cAlternateFileName="YAHOOP~1.XML")) returned 1 [0065.457] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.457] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.SE.XML", cAlternateFileName="YAHOOS~1.XML")) returned 1 [0065.457] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.457] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x780074, dwReserved1=0x74, cFileName="YAHOO.SE.XML", cAlternateFileName="YAHOOS~1.XML")) returned 0 [0065.457] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0065.457] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x59a53950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x5f190, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="OUTLPH.DLL", cAlternateFileName="")) returned 1 [0065.458] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.458] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x59c42b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe558, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLRPC.DLL", cAlternateFileName="")) returned 1 [0065.458] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.458] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6ccf2b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x11770, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLVBS.DLL", cAlternateFileName="")) returned 1 [0065.458] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0065.458] FindNextFileA (in: hFindFile=0x2d6f58, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAGESIZE", cAlternateFileName="")) returned 1 [0065.458] lstrcmpA (lpString1=".", lpString2="PAGESIZE") returned -1 [0065.458] lstrcmpA (lpString1="..", lpString2="PAGESIZE") returned -1 [0065.458] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2d807e, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0065.460] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.460] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0065.460] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.460] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.460] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb180a100, ftCreationTime.dwHighDateTime=0x1ca10e6, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb180a100, ftLastWriteTime.dwHighDateTime=0x1ca10e6, nFileSizeHigh=0x0, nFileSizeLow=0xfb6, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PGLBL001.XML", cAlternateFileName="")) returned 1 [0065.461] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.464] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.464] CloseHandle (hObject=0x8c) returned 1 [0065.464] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL001.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML" [0065.464] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d99800, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61d99800, ftLastWriteTime.dwHighDateTime=0x1ca1a4b, nFileSizeHigh=0x0, nFileSizeLow=0x15b1fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL002.XML", cAlternateFileName="")) returned 1 [0065.464] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.464] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c7ce900, ftCreationTime.dwHighDateTime=0x1c9f4a3, ftLastAccessTime.dwLowDateTime=0x5a340bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c7ce900, ftLastWriteTime.dwHighDateTime=0x1c9f4a3, nFileSizeHigh=0x0, nFileSizeLow=0x33a1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL010.XML", cAlternateFileName="")) returned 1 [0065.464] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.464] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x632f2e00, ftCreationTime.dwHighDateTime=0x1c66206, ftLastAccessTime.dwLowDateTime=0x5a340bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x632f2e00, ftLastWriteTime.dwHighDateTime=0x1c66206, nFileSizeHigh=0x0, nFileSizeLow=0x1390, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL011.XML", cAlternateFileName="")) returned 1 [0065.464] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.464] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dea2700, ftCreationTime.dwHighDateTime=0x1ca1b37, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9dea2700, ftLastWriteTime.dwHighDateTime=0x1ca1b37, nFileSizeHigh=0x0, nFileSizeLow=0xa5178, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL012.XML", cAlternateFileName="")) returned 1 [0065.464] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.464] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca994100, ftCreationTime.dwHighDateTime=0x1ca1b2d, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca994100, ftLastWriteTime.dwHighDateTime=0x1ca1b2d, nFileSizeHigh=0x0, nFileSizeLow=0x22cf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL016.XML", cAlternateFileName="")) returned 1 [0065.464] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.465] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9ac00, ftCreationTime.dwHighDateTime=0x1c6c1cc, ftLastAccessTime.dwLowDateTime=0x5a340bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69d9ac00, ftLastWriteTime.dwHighDateTime=0x1c6c1cc, nFileSizeHigh=0x0, nFileSizeLow=0x101bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL020.XML", cAlternateFileName="")) returned 1 [0065.465] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.465] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93746100, ftCreationTime.dwHighDateTime=0x1ca1b28, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93746100, ftLastWriteTime.dwHighDateTime=0x1ca1b28, nFileSizeHigh=0x0, nFileSizeLow=0x24c9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL022.XML", cAlternateFileName="")) returned 1 [0065.465] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.465] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x632f2e00, ftCreationTime.dwHighDateTime=0x1c66206, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x632f2e00, ftLastWriteTime.dwHighDateTime=0x1c66206, nFileSizeHigh=0x0, nFileSizeLow=0x1f4e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL026.XML", cAlternateFileName="")) returned 1 [0065.465] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.465] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54389200, ftCreationTime.dwHighDateTime=0x1c9f606, ftLastAccessTime.dwLowDateTime=0x5a340bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54389200, ftLastWriteTime.dwHighDateTime=0x1c9f606, nFileSizeHigh=0x0, nFileSizeLow=0x6d7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL027.XML", cAlternateFileName="")) returned 1 [0065.465] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.465] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b28800, ftCreationTime.dwHighDateTime=0x1c9e3fe, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b28800, ftLastWriteTime.dwHighDateTime=0x1c9e3fe, nFileSizeHigh=0x0, nFileSizeLow=0x266a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL044.XML", cAlternateFileName="")) returned 1 [0065.465] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.465] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x187aa500, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x5a366d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x187aa500, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x10e590, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL048.XML", cAlternateFileName="")) returned 1 [0065.465] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.465] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf22b5d00, ftCreationTime.dwHighDateTime=0x1c9f604, ftLastAccessTime.dwLowDateTime=0x5a366d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf22b5d00, ftLastWriteTime.dwHighDateTime=0x1c9f604, nFileSizeHigh=0x0, nFileSizeLow=0x59f76, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL054.XML", cAlternateFileName="")) returned 1 [0065.465] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.465] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc9300, ftCreationTime.dwHighDateTime=0x1c6b6bd, ftLastAccessTime.dwLowDateTime=0x5a366d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecc9300, ftLastWriteTime.dwHighDateTime=0x1c6b6bd, nFileSizeHigh=0x0, nFileSizeLow=0x26c44, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL058.XML", cAlternateFileName="")) returned 1 [0065.465] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.466] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cc7d000, ftCreationTime.dwHighDateTime=0x1c68eef, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cc7d000, ftLastWriteTime.dwHighDateTime=0x1c68eef, nFileSizeHigh=0x0, nFileSizeLow=0x165d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL065.XML", cAlternateFileName="")) returned 1 [0065.466] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.466] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902d7600, ftCreationTime.dwHighDateTime=0x1c69abe, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x902d7600, ftLastWriteTime.dwHighDateTime=0x1c69abe, nFileSizeHigh=0x0, nFileSizeLow=0xacb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL075.XML", cAlternateFileName="")) returned 1 [0065.466] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.466] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbcd1600, ftCreationTime.dwHighDateTime=0x1c6c538, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbcd1600, ftLastWriteTime.dwHighDateTime=0x1c6c538, nFileSizeHigh=0x0, nFileSizeLow=0x6134, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL077.XML", cAlternateFileName="")) returned 1 [0065.466] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.466] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe756a100, ftCreationTime.dwHighDateTime=0x1c6beda, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe756a100, ftLastWriteTime.dwHighDateTime=0x1c6beda, nFileSizeHigh=0x0, nFileSizeLow=0x753, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL078.XML", cAlternateFileName="")) returned 1 [0065.466] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.466] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91fe6500, ftCreationTime.dwHighDateTime=0x1ca1b37, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91fe6500, ftLastWriteTime.dwHighDateTime=0x1ca1b37, nFileSizeHigh=0x0, nFileSizeLow=0xe944e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL081.XML", cAlternateFileName="")) returned 1 [0065.466] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.466] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67337900, ftCreationTime.dwHighDateTime=0x1ca0b56, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67337900, ftLastWriteTime.dwHighDateTime=0x1ca0b56, nFileSizeHigh=0x0, nFileSizeLow=0x38d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL082.XML", cAlternateFileName="")) returned 1 [0065.466] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.466] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf103000, ftCreationTime.dwHighDateTime=0x1ca25ea, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf103000, ftLastWriteTime.dwHighDateTime=0x1ca25ea, nFileSizeHigh=0x0, nFileSizeLow=0x8cda, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL083.XML", cAlternateFileName="")) returned 1 [0065.466] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.467] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9141f00, ftCreationTime.dwHighDateTime=0x1c6d896, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9141f00, ftLastWriteTime.dwHighDateTime=0x1c6d896, nFileSizeHigh=0x0, nFileSizeLow=0xab732, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL086.XML", cAlternateFileName="")) returned 1 [0065.467] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.467] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8d69800, ftCreationTime.dwHighDateTime=0x1c6bedf, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8d69800, ftLastWriteTime.dwHighDateTime=0x1c6bedf, nFileSizeHigh=0x0, nFileSizeLow=0x13d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL087.XML", cAlternateFileName="")) returned 1 [0065.467] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.467] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe893cd00, ftCreationTime.dwHighDateTime=0x1ca0904, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe893cd00, ftLastWriteTime.dwHighDateTime=0x1ca0904, nFileSizeHigh=0x0, nFileSizeLow=0xb532, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL089.XML", cAlternateFileName="")) returned 1 [0065.467] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.467] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a5c4800, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a5c4800, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x124b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL090.XML", cAlternateFileName="")) returned 1 [0065.467] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.467] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4628f00, ftCreationTime.dwHighDateTime=0x1ca1b44, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4628f00, ftLastWriteTime.dwHighDateTime=0x1ca1b44, nFileSizeHigh=0x0, nFileSizeLow=0x19a22, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL092.XML", cAlternateFileName="")) returned 1 [0065.467] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.467] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x206de900, ftCreationTime.dwHighDateTime=0x1ca1b2e, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x206de900, ftLastWriteTime.dwHighDateTime=0x1ca1b2e, nFileSizeHigh=0x0, nFileSizeLow=0xb3da, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL093.XML", cAlternateFileName="")) returned 1 [0065.467] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.467] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b48300, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32b48300, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x1a1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL095.XML", cAlternateFileName="")) returned 1 [0065.467] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.467] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39db9100, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39db9100, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x19ede, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL096.XML", cAlternateFileName="")) returned 1 [0065.467] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.468] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f636100, ftCreationTime.dwHighDateTime=0x1c9ef1a, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f636100, ftLastWriteTime.dwHighDateTime=0x1c9ef1a, nFileSizeHigh=0x0, nFileSizeLow=0x80ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL097.XML", cAlternateFileName="")) returned 1 [0065.468] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.468] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c357500, ftCreationTime.dwHighDateTime=0x1c6d897, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c357500, ftLastWriteTime.dwHighDateTime=0x1c6d897, nFileSizeHigh=0x0, nFileSizeLow=0xe730, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL102.XML", cAlternateFileName="")) returned 1 [0065.468] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.468] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45027800, ftCreationTime.dwHighDateTime=0x1ca0f15, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45027800, ftLastWriteTime.dwHighDateTime=0x1ca0f15, nFileSizeHigh=0x0, nFileSizeLow=0x27aee, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL103.XML", cAlternateFileName="")) returned 1 [0065.468] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.468] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf61dc500, ftCreationTime.dwHighDateTime=0x1ca1702, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf61dc500, ftLastWriteTime.dwHighDateTime=0x1ca1702, nFileSizeHigh=0x0, nFileSizeLow=0x1fcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL104.XML", cAlternateFileName="")) returned 1 [0065.468] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.468] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ffeb200, ftCreationTime.dwHighDateTime=0x1c9fa22, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ffeb200, ftLastWriteTime.dwHighDateTime=0x1c9fa22, nFileSizeHigh=0x0, nFileSizeLow=0x15090, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL105.XML", cAlternateFileName="")) returned 1 [0065.469] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.469] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2fb7700, ftCreationTime.dwHighDateTime=0x1ca1b41, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2fb7700, ftLastWriteTime.dwHighDateTime=0x1ca1b41, nFileSizeHigh=0x0, nFileSizeLow=0x9ae4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL106.XML", cAlternateFileName="")) returned 1 [0065.469] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.469] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45218b00, ftCreationTime.dwHighDateTime=0x1ca1b45, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45218b00, ftLastWriteTime.dwHighDateTime=0x1ca1b45, nFileSizeHigh=0x0, nFileSizeLow=0x1d5c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL107.XML", cAlternateFileName="")) returned 1 [0065.469] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.469] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e92800, ftCreationTime.dwHighDateTime=0x1c9f4a1, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82e92800, ftLastWriteTime.dwHighDateTime=0x1c9f4a1, nFileSizeHigh=0x0, nFileSizeLow=0x2dbec, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL108.XML", cAlternateFileName="")) returned 1 [0065.469] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.469] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b1600, ftCreationTime.dwHighDateTime=0x1ca14c1, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0b1600, ftLastWriteTime.dwHighDateTime=0x1ca14c1, nFileSizeHigh=0x0, nFileSizeLow=0x2b6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL109.XML", cAlternateFileName="")) returned 1 [0065.469] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.469] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x643bf200, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x643bf200, ftLastWriteTime.dwHighDateTime=0x1ca1a4b, nFileSizeHigh=0x0, nFileSizeLow=0xcdbee, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL110.XML", cAlternateFileName="")) returned 1 [0065.469] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.470] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x656d1f00, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x656d1f00, ftLastWriteTime.dwHighDateTime=0x1ca1a4b, nFileSizeHigh=0x0, nFileSizeLow=0x40198, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL111.XML", cAlternateFileName="")) returned 1 [0065.470] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.470] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07a0100, ftCreationTime.dwHighDateTime=0x1ca2c4b, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07a0100, ftLastWriteTime.dwHighDateTime=0x1ca2c4b, nFileSizeHigh=0x0, nFileSizeLow=0x2247e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN001.XML", cAlternateFileName="")) returned 1 [0065.470] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.470] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x669e4c00, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x669e4c00, ftLastWriteTime.dwHighDateTime=0x1ca1a4b, nFileSizeHigh=0x0, nFileSizeLow=0xeb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN002.XML", cAlternateFileName="")) returned 1 [0065.470] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.470] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c7ce900, ftCreationTime.dwHighDateTime=0x1c9f4a3, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c7ce900, ftLastWriteTime.dwHighDateTime=0x1c9f4a3, nFileSizeHigh=0x0, nFileSizeLow=0x1bc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN010.XML", cAlternateFileName="")) returned 1 [0065.470] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.470] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94fa5500, ftCreationTime.dwHighDateTime=0x1ca1b39, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94fa5500, ftLastWriteTime.dwHighDateTime=0x1ca1b39, nFileSizeHigh=0x0, nFileSizeLow=0xe2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN011.XML", cAlternateFileName="")) returned 1 [0065.470] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.470] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc63d500, ftCreationTime.dwHighDateTime=0x1ca1b38, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc63d500, ftLastWriteTime.dwHighDateTime=0x1ca1b38, nFileSizeHigh=0x0, nFileSizeLow=0x2936, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN020.XML", cAlternateFileName="")) returned 1 [0065.470] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.470] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.470] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.470] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.470] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.470] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.471] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.471] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.471] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.471] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0065.486] lstrcmpA (lpString1=".", lpString2="PROOF") returned -1 [0065.486] lstrcmpA (lpString1="..", lpString2="PROOF") returned -1 [0065.486] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2d807e, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0065.488] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.489] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.489] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.489] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0065.489] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0065.489] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0065.490] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.490] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.490] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.491] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.491] CloseHandle (hObject=0x90) returned 1 [0065.491] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\", lpString2="MSGR3EN.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL" [0065.491] lstrcmpA (lpString1=".", lpString2="1036") returned -1 [0065.491] lstrcmpA (lpString1="..", lpString2="1036") returned -1 [0065.491] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0065.492] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.492] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.492] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.493] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.493] CloseHandle (hObject=0x90) returned 1 [0065.493] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\", lpString2="MSGR3FR.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL" [0065.494] lstrcmpA (lpString1=".", lpString2="3082") returned -1 [0065.494] lstrcmpA (lpString1="..", lpString2="3082") returned -1 [0065.494] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0065.494] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.494] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.494] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.495] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.495] CloseHandle (hObject=0x90) returned 1 [0065.496] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\", lpString2="MSGR3ES.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL" [0065.497] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.497] CloseHandle (hObject=0x8c) returned 1 [0065.497] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSGR3EN.LEX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX" [0065.499] lstrcmpA (lpString1=".", lpString2="PUBBA") returned -1 [0065.499] lstrcmpA (lpString1="..", lpString2="PUBBA") returned -1 [0065.499] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1819b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2d807e, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0065.502] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.502] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.502] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.503] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.503] CloseHandle (hObject=0x8c) returned 1 [0065.503] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB10.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR" [0065.504] lstrcmpA (lpString1=".", lpString2="PUBWIZ") returned -1 [0065.504] lstrcmpA (lpString1="..", lpString2="PUBWIZ") returned -1 [0065.504] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70959970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70959970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2d807e, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0065.506] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.507] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.507] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.512] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.512] CloseHandle (hObject=0x8c) returned 1 [0065.512] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="ACCSBAR.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC" [0065.558] lstrcmpA (lpString1=".", lpString2="QUERIES") returned -1 [0065.558] lstrcmpA (lpString1="..", lpString2="QUERIES") returned -1 [0065.558] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0065.560] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.560] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.560] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.562] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.562] CloseHandle (hObject=0x8c) returned 1 [0065.562] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\", lpString2="MSN MoneyCentral Investor Currency Rates.iqy" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Currency Rates.iqy") returned="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Currency Rates.iqy" [0065.741] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.741] CloseHandle (hObject=0x88) returned 1 [0065.741] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\reminder.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\reminder.wav.wannacry")) returned 1 [0065.817] lstrcmpA (lpString1=".", lpString2="SAMPLES") returned -1 [0065.817] lstrcmpA (lpString1="..", lpString2="SAMPLES") returned -1 [0065.817] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa671530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2d807e, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0065.818] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.818] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.818] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.819] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.819] CloseHandle (hObject=0x8c) returned 1 [0065.819] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\", lpString2="SOLVSAMP.XLS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS") returned="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS" [0065.835] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.835] CloseHandle (hObject=0x8c) returned 1 [0065.835] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\samples\\solvsamp.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\samples\\solvsamp.xls.wannacry")) returned 1 [0065.840] lstrcmpA (lpString1=".", lpString2="STARTUP") returned -1 [0065.840] lstrcmpA (lpString1="..", lpString2="STARTUP") returned -1 [0065.840] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2d807e, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0065.840] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.840] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.840] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.842] lstrcmpA (lpString1=".", lpString2="Visio Content") returned -1 [0065.842] lstrcmpA (lpString1="..", lpString2="Visio Content") returned -1 [0065.842] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x504da6a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x504da6a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2d807e, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0065.843] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.843] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.843] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.843] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0065.843] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0065.843] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52203420, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0065.846] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.847] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.847] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.857] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.857] CloseHandle (hObject=0x90) returned 1 [0065.857] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\", lpString2="ACTDIR_M.VST" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST") returned="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST" [0065.861] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.861] CloseHandle (hObject=0x90) returned 1 [0065.861] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\astmgt.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT.XLS.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\astmgt.xls.wannacry")) returned 1 [0065.874] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.874] CloseHandle (hObject=0x90) returned 1 [0065.874] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldgplan.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldgplan.jpg.wannacry")) returned 1 [0065.938] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.938] CloseHandle (hObject=0x90) returned 1 [0065.938] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGDATA.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgdata.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGDATA.XLS.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgdata.xls.wannacry")) returned 1 [0065.946] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.946] CloseHandle (hObject=0x90) returned 1 [0065.946] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRCIMP.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prcimp.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRCIMP.XLS.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prcimp.xls.wannacry")) returned 1 [0065.950] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.950] CloseHandle (hObject=0x90) returned 1 [0065.950] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRJMGT.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prjmgt.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRJMGT.XLS.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prjmgt.xls.wannacry")) returned 1 [0065.953] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.954] CloseHandle (hObject=0x90) returned 1 [0065.954] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PROJTL.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\projtl.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PROJTL.XLS.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\projtl.xls.wannacry")) returned 1 [0065.959] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.959] CloseHandle (hObject=0x90) returned 1 [0065.959] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SALSUM.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\salsum.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SALSUM.XLS.wannacry" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\salsum.xls.wannacry")) returned 1 [0065.968] lstrcmpA (lpString1=".", lpString2="XLSTART") returned -1 [0065.968] lstrcmpA (lpString1="..", lpString2="XLSTART") returned -1 [0065.968] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLSTART\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2d807e, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0065.968] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.968] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.968] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.969] lstrcmpA (lpString1=".", lpString2="Stationery") returned -1 [0065.969] lstrcmpA (lpString1="..", lpString2="Stationery") returned -1 [0065.969] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0065.970] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.970] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.970] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.970] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0065.970] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0065.970] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0065.972] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.972] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.972] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.973] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.973] CloseHandle (hObject=0x8c) returned 1 [0065.973] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\", lpString2="CURRENCY.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF" [0065.975] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.975] CloseHandle (hObject=0x8c) returned 1 [0065.975] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\currency.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\currency.gif.wannacry")) returned 1 [0065.977] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.977] CloseHandle (hObject=0x8c) returned 1 [0065.977] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\dadshirt.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\dadshirt.gif.wannacry")) returned 1 [0065.981] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.981] CloseHandle (hObject=0x8c) returned 1 [0065.981] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\judgesch.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\judgesch.gif.wannacry")) returned 1 [0065.984] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.984] CloseHandle (hObject=0x8c) returned 1 [0065.984] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\jungle.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\jungle.gif.wannacry")) returned 1 [0065.988] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.988] CloseHandle (hObject=0x8c) returned 1 [0065.988] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.jpg.wannacry")) returned 1 [0065.991] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.991] CloseHandle (hObject=0x8c) returned 1 [0065.991] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\offisupp.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\offisupp.gif.wannacry")) returned 1 [0065.994] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.994] CloseHandle (hObject=0x8c) returned 1 [0065.994] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pawprint.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pawprint.gif.wannacry")) returned 1 [0065.997] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0065.997] CloseHandle (hObject=0x8c) returned 1 [0065.997] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.jpg.wannacry")) returned 1 [0066.002] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.002] CloseHandle (hObject=0x8c) returned 1 [0066.002] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG.wannacry" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.jpg.wannacry")) returned 1 [0066.005] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.005] CloseHandle (hObject=0x8c) returned 1 [0066.005] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\techtool.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.GIF.wannacry" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\techtool.gif.wannacry")) returned 1 [0066.006] lstrcmpA (lpString1=".", lpString2="Templates") returned -1 [0066.006] lstrcmpA (lpString1="..", lpString2="Templates") returned -1 [0066.006] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0066.007] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.007] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.007] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.007] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0066.007] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0066.007] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0066.010] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.011] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.011] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.011] lstrcmpA (lpString1=".", lpString2="Access") returned -1 [0066.011] lstrcmpA (lpString1="..", lpString2="Access") returned -1 [0066.011] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15087730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0066.014] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.014] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.014] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.015] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.015] CloseHandle (hObject=0x90) returned 1 [0066.015] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\", lpString2="Assets.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt" [0066.015] lstrcmpA (lpString1=".", lpString2="DataType") returned -1 [0066.015] lstrcmpA (lpString1="..", lpString2="DataType") returned -1 [0066.016] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14f30ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14f56c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d8098, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.018] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.018] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.018] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.024] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.024] CloseHandle (hObject=0x94) returned 1 [0066.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\", lpString2="Address.accft" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\Address.accft" [0066.025] lstrcmpA (lpString1=".", lpString2="Part") returned -1 [0066.025] lstrcmpA (lpString1="..", lpString2="Part") returned -1 [0066.025] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14fa2ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x150615d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d8098, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.027] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.027] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.027] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.028] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.028] CloseHandle (hObject=0x94) returned 1 [0066.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\", lpString2="1 Right.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\1 Right.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\1 Right.accdt" [0066.029] lstrcmpA (lpString1=".", lpString2="WSS") returned -1 [0066.029] lstrcmpA (lpString1="..", lpString2="WSS") returned -1 [0066.029] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14ee4810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d8098, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.029] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.029] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.029] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.030] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.031] CloseHandle (hObject=0x94) returned 1 [0066.031] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\", lpString2="107.accdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt" [0066.034] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0066.034] WriteFile (in: hFile=0x8c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0066.036] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.036] CloseHandle (hObject=0x8c) returned 1 [0066.036] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="AdjacencyLetter.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx" [0066.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.zip") returned 0 [0066.036] lstrlenA (lpString="*.zip") returned 5 [0066.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.rar") returned 0 [0066.036] lstrlenA (lpString="*.rar") returned 5 [0066.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.7z") returned 0 [0066.036] lstrlenA (lpString="*.7z") returned 4 [0066.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.tar") returned 0 [0066.036] lstrlenA (lpString="*.tar") returned 5 [0066.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.gzip") returned 0 [0066.036] lstrlenA (lpString="*.gzip") returned 6 [0066.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.jpg") returned 0 [0066.037] lstrlenA (lpString="*.jpg") returned 5 [0066.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.jpeg") returned 0 [0066.037] lstrlenA (lpString="*.jpeg") returned 6 [0066.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.psd") returned 0 [0066.037] lstrlenA (lpString="*.psd") returned 5 [0066.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.gif") returned 0 [0066.037] lstrlenA (lpString="*.gif") returned 5 [0066.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.doc") returned 0 [0066.037] lstrlenA (lpString="*.doc") returned 5 [0066.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.docx") returned 0 [0066.037] lstrlenA (lpString="*.docx") returned 6 [0066.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.xls") returned 0 [0066.037] lstrlenA (lpString="*.xls") returned 5 [0066.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.xlsx") returned 0 [0066.037] lstrlenA (lpString="*.xlsx") returned 6 [0066.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.ppt") returned 0 [0066.037] lstrlenA (lpString="*.ppt") returned 5 [0066.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.pptx") returned 0 [0066.037] lstrlenA (lpString="*.pptx") returned 6 [0066.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.pdf") returned 0 [0066.037] lstrlenA (lpString="*.pdf") returned 5 [0066.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.mov") returned 0 [0066.037] lstrlenA (lpString="*.mov") returned 5 [0066.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.m2v") returned 0 [0066.037] lstrlenA (lpString="*.m2v") returned 5 [0066.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.3gp") returned 0 [0066.037] lstrlenA (lpString="*.3gp") returned 5 [0066.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.mpeg") returned 0 [0066.037] lstrlenA (lpString="*.mpeg") returned 6 [0066.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.mpg") returned 0 [0066.038] lstrlenA (lpString="*.mpg") returned 5 [0066.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.flv") returned 0 [0066.038] lstrlenA (lpString="*.flv") returned 5 [0066.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.avi") returned 0 [0066.038] lstrlenA (lpString="*.avi") returned 5 [0066.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.mp4") returned 0 [0066.038] lstrlenA (lpString="*.mp4") returned 5 [0066.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.wmv") returned 0 [0066.038] lstrlenA (lpString="*.wmv") returned 5 [0066.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.divx") returned 0 [0066.038] lstrlenA (lpString="*.divx") returned 6 [0066.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.mkv") returned 0 [0066.038] lstrlenA (lpString="*.mkv") returned 5 [0066.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.mp3") returned 0 [0066.038] lstrlenA (lpString="*.mp3") returned 5 [0066.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.wav") returned 0 [0066.038] lstrlenA (lpString="*.wav") returned 5 [0066.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.flac") returned 0 [0066.038] lstrlenA (lpString="*.flac") returned 6 [0066.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.ape") returned 0 [0066.038] lstrlenA (lpString="*.ape") returned 5 [0066.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.wma") returned 0 [0066.038] lstrlenA (lpString="*.wma") returned 5 [0066.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.ac3") returned 0 [0066.038] lstrlenA (lpString="*.ac3") returned 5 [0066.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", pszSpec="*.mxf") returned 0 [0066.038] lstrlenA (lpString="*.mxf") returned 5 [0066.039] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.039] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="AdjacencyMergeLetter.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx" [0066.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.zip") returned 0 [0066.039] lstrlenA (lpString="*.zip") returned 5 [0066.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.rar") returned 0 [0066.039] lstrlenA (lpString="*.rar") returned 5 [0066.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.7z") returned 0 [0066.039] lstrlenA (lpString="*.7z") returned 4 [0066.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.tar") returned 0 [0066.039] lstrlenA (lpString="*.tar") returned 5 [0066.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.gzip") returned 0 [0066.039] lstrlenA (lpString="*.gzip") returned 6 [0066.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.jpg") returned 0 [0066.039] lstrlenA (lpString="*.jpg") returned 5 [0066.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.jpeg") returned 0 [0066.039] lstrlenA (lpString="*.jpeg") returned 6 [0066.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.psd") returned 0 [0066.039] lstrlenA (lpString="*.psd") returned 5 [0066.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.gif") returned 0 [0066.039] lstrlenA (lpString="*.gif") returned 5 [0066.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.doc") returned 0 [0066.039] lstrlenA (lpString="*.doc") returned 5 [0066.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.docx") returned 0 [0066.040] lstrlenA (lpString="*.docx") returned 6 [0066.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.xls") returned 0 [0066.040] lstrlenA (lpString="*.xls") returned 5 [0066.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.xlsx") returned 0 [0066.040] lstrlenA (lpString="*.xlsx") returned 6 [0066.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.ppt") returned 0 [0066.040] lstrlenA (lpString="*.ppt") returned 5 [0066.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.pptx") returned 0 [0066.040] lstrlenA (lpString="*.pptx") returned 6 [0066.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.pdf") returned 0 [0066.040] lstrlenA (lpString="*.pdf") returned 5 [0066.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.mov") returned 0 [0066.040] lstrlenA (lpString="*.mov") returned 5 [0066.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.m2v") returned 0 [0066.040] lstrlenA (lpString="*.m2v") returned 5 [0066.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.3gp") returned 0 [0066.040] lstrlenA (lpString="*.3gp") returned 5 [0066.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.mpeg") returned 0 [0066.040] lstrlenA (lpString="*.mpeg") returned 6 [0066.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.mpg") returned 0 [0066.040] lstrlenA (lpString="*.mpg") returned 5 [0066.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.flv") returned 0 [0066.040] lstrlenA (lpString="*.flv") returned 5 [0066.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.avi") returned 0 [0066.040] lstrlenA (lpString="*.avi") returned 5 [0066.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.mp4") returned 0 [0066.040] lstrlenA (lpString="*.mp4") returned 5 [0066.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.wmv") returned 0 [0066.040] lstrlenA (lpString="*.wmv") returned 5 [0066.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.divx") returned 0 [0066.040] lstrlenA (lpString="*.divx") returned 6 [0066.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.mkv") returned 0 [0066.040] lstrlenA (lpString="*.mkv") returned 5 [0066.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.mp3") returned 0 [0066.040] lstrlenA (lpString="*.mp3") returned 5 [0066.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.wav") returned 0 [0066.041] lstrlenA (lpString="*.wav") returned 5 [0066.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.flac") returned 0 [0066.041] lstrlenA (lpString="*.flac") returned 6 [0066.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.ape") returned 0 [0066.041] lstrlenA (lpString="*.ape") returned 5 [0066.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.wma") returned 0 [0066.041] lstrlenA (lpString="*.wma") returned 5 [0066.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.ac3") returned 0 [0066.041] lstrlenA (lpString="*.ac3") returned 5 [0066.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", pszSpec="*.mxf") returned 0 [0066.041] lstrlenA (lpString="*.mxf") returned 5 [0066.041] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.041] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.041] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.041] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.041] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="AdjacencyReport.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx" [0066.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.zip") returned 0 [0066.041] lstrlenA (lpString="*.zip") returned 5 [0066.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.rar") returned 0 [0066.041] lstrlenA (lpString="*.rar") returned 5 [0066.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.7z") returned 0 [0066.041] lstrlenA (lpString="*.7z") returned 4 [0066.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.tar") returned 0 [0066.041] lstrlenA (lpString="*.tar") returned 5 [0066.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.gzip") returned 0 [0066.041] lstrlenA (lpString="*.gzip") returned 6 [0066.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.jpg") returned 0 [0066.041] lstrlenA (lpString="*.jpg") returned 5 [0066.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.jpeg") returned 0 [0066.042] lstrlenA (lpString="*.jpeg") returned 6 [0066.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.psd") returned 0 [0066.042] lstrlenA (lpString="*.psd") returned 5 [0066.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.gif") returned 0 [0066.042] lstrlenA (lpString="*.gif") returned 5 [0066.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.doc") returned 0 [0066.042] lstrlenA (lpString="*.doc") returned 5 [0066.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.docx") returned 0 [0066.042] lstrlenA (lpString="*.docx") returned 6 [0066.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.xls") returned 0 [0066.042] lstrlenA (lpString="*.xls") returned 5 [0066.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.xlsx") returned 0 [0066.042] lstrlenA (lpString="*.xlsx") returned 6 [0066.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.ppt") returned 0 [0066.042] lstrlenA (lpString="*.ppt") returned 5 [0066.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.pptx") returned 0 [0066.042] lstrlenA (lpString="*.pptx") returned 6 [0066.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.pdf") returned 0 [0066.042] lstrlenA (lpString="*.pdf") returned 5 [0066.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.mov") returned 0 [0066.042] lstrlenA (lpString="*.mov") returned 5 [0066.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.m2v") returned 0 [0066.042] lstrlenA (lpString="*.m2v") returned 5 [0066.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.3gp") returned 0 [0066.042] lstrlenA (lpString="*.3gp") returned 5 [0066.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.mpeg") returned 0 [0066.042] lstrlenA (lpString="*.mpeg") returned 6 [0066.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.mpg") returned 0 [0066.042] lstrlenA (lpString="*.mpg") returned 5 [0066.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.flv") returned 0 [0066.043] lstrlenA (lpString="*.flv") returned 5 [0066.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.avi") returned 0 [0066.043] lstrlenA (lpString="*.avi") returned 5 [0066.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.mp4") returned 0 [0066.043] lstrlenA (lpString="*.mp4") returned 5 [0066.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.wmv") returned 0 [0066.043] lstrlenA (lpString="*.wmv") returned 5 [0066.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.divx") returned 0 [0066.043] lstrlenA (lpString="*.divx") returned 6 [0066.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.mkv") returned 0 [0066.043] lstrlenA (lpString="*.mkv") returned 5 [0066.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.mp3") returned 0 [0066.043] lstrlenA (lpString="*.mp3") returned 5 [0066.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.wav") returned 0 [0066.043] lstrlenA (lpString="*.wav") returned 5 [0066.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.flac") returned 0 [0066.043] lstrlenA (lpString="*.flac") returned 6 [0066.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.ape") returned 0 [0066.043] lstrlenA (lpString="*.ape") returned 5 [0066.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.wma") returned 0 [0066.043] lstrlenA (lpString="*.wma") returned 5 [0066.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.ac3") returned 0 [0066.043] lstrlenA (lpString="*.ac3") returned 5 [0066.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", pszSpec="*.mxf") returned 0 [0066.043] lstrlenA (lpString="*.mxf") returned 5 [0066.043] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdjacencyResume.dotx") returned 1 [0066.044] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdjacencyResume.dotx") returned 1 [0066.044] lstrcmpiA (lpString1="", lpString2="AdjacencyResume.dotx") returned -1 [0066.044] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx") returned="AdjacencyReport.dotx" [0066.044] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.044] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.044] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.044] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.044] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="AdjacencyResume.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx" [0066.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.zip") returned 0 [0066.044] lstrlenA (lpString="*.zip") returned 5 [0066.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.rar") returned 0 [0066.044] lstrlenA (lpString="*.rar") returned 5 [0066.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.7z") returned 0 [0066.044] lstrlenA (lpString="*.7z") returned 4 [0066.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.tar") returned 0 [0066.044] lstrlenA (lpString="*.tar") returned 5 [0066.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.gzip") returned 0 [0066.044] lstrlenA (lpString="*.gzip") returned 6 [0066.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.jpg") returned 0 [0066.044] lstrlenA (lpString="*.jpg") returned 5 [0066.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.jpeg") returned 0 [0066.044] lstrlenA (lpString="*.jpeg") returned 6 [0066.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.psd") returned 0 [0066.044] lstrlenA (lpString="*.psd") returned 5 [0066.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.gif") returned 0 [0066.044] lstrlenA (lpString="*.gif") returned 5 [0066.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.doc") returned 0 [0066.045] lstrlenA (lpString="*.doc") returned 5 [0066.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.docx") returned 0 [0066.045] lstrlenA (lpString="*.docx") returned 6 [0066.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.xls") returned 0 [0066.045] lstrlenA (lpString="*.xls") returned 5 [0066.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.xlsx") returned 0 [0066.045] lstrlenA (lpString="*.xlsx") returned 6 [0066.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.ppt") returned 0 [0066.045] lstrlenA (lpString="*.ppt") returned 5 [0066.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.pptx") returned 0 [0066.045] lstrlenA (lpString="*.pptx") returned 6 [0066.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.pdf") returned 0 [0066.045] lstrlenA (lpString="*.pdf") returned 5 [0066.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.mov") returned 0 [0066.045] lstrlenA (lpString="*.mov") returned 5 [0066.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.m2v") returned 0 [0066.045] lstrlenA (lpString="*.m2v") returned 5 [0066.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.3gp") returned 0 [0066.045] lstrlenA (lpString="*.3gp") returned 5 [0066.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.mpeg") returned 0 [0066.045] lstrlenA (lpString="*.mpeg") returned 6 [0066.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.mpg") returned 0 [0066.046] lstrlenA (lpString="*.mpg") returned 5 [0066.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.flv") returned 0 [0066.046] lstrlenA (lpString="*.flv") returned 5 [0066.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.avi") returned 0 [0066.046] lstrlenA (lpString="*.avi") returned 5 [0066.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.mp4") returned 0 [0066.046] lstrlenA (lpString="*.mp4") returned 5 [0066.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.wmv") returned 0 [0066.046] lstrlenA (lpString="*.wmv") returned 5 [0066.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.divx") returned 0 [0066.046] lstrlenA (lpString="*.divx") returned 6 [0066.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.mkv") returned 0 [0066.046] lstrlenA (lpString="*.mkv") returned 5 [0066.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.mp3") returned 0 [0066.046] lstrlenA (lpString="*.mp3") returned 5 [0066.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.wav") returned 0 [0066.046] lstrlenA (lpString="*.wav") returned 5 [0066.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.flac") returned 0 [0066.046] lstrlenA (lpString="*.flac") returned 6 [0066.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.ape") returned 0 [0066.046] lstrlenA (lpString="*.ape") returned 5 [0066.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.wma") returned 0 [0066.046] lstrlenA (lpString="*.wma") returned 5 [0066.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.ac3") returned 0 [0066.046] lstrlenA (lpString="*.ac3") returned 5 [0066.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", pszSpec="*.mxf") returned 0 [0066.046] lstrlenA (lpString="*.mxf") returned 5 [0066.046] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ADR1.XLT") returned 1 [0066.047] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADR1.XLT") returned 1 [0066.047] lstrcmpiA (lpString1="", lpString2="ADR1.XLT") returned -1 [0066.047] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx") returned="AdjacencyResume.dotx" [0066.047] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.047] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.047] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.047] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.047] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ADR1.XLT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT" [0066.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.zip") returned 0 [0066.047] lstrlenA (lpString="*.zip") returned 5 [0066.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.rar") returned 0 [0066.047] lstrlenA (lpString="*.rar") returned 5 [0066.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.7z") returned 0 [0066.047] lstrlenA (lpString="*.7z") returned 4 [0066.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.tar") returned 0 [0066.047] lstrlenA (lpString="*.tar") returned 5 [0066.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.gzip") returned 0 [0066.047] lstrlenA (lpString="*.gzip") returned 6 [0066.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.jpg") returned 0 [0066.047] lstrlenA (lpString="*.jpg") returned 5 [0066.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.jpeg") returned 0 [0066.047] lstrlenA (lpString="*.jpeg") returned 6 [0066.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.psd") returned 0 [0066.047] lstrlenA (lpString="*.psd") returned 5 [0066.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.gif") returned 0 [0066.047] lstrlenA (lpString="*.gif") returned 5 [0066.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.doc") returned 0 [0066.047] lstrlenA (lpString="*.doc") returned 5 [0066.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.docx") returned 0 [0066.047] lstrlenA (lpString="*.docx") returned 6 [0066.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.xls") returned 0 [0066.048] lstrlenA (lpString="*.xls") returned 5 [0066.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.xlsx") returned 0 [0066.048] lstrlenA (lpString="*.xlsx") returned 6 [0066.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.ppt") returned 0 [0066.048] lstrlenA (lpString="*.ppt") returned 5 [0066.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.pptx") returned 0 [0066.048] lstrlenA (lpString="*.pptx") returned 6 [0066.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.pdf") returned 0 [0066.048] lstrlenA (lpString="*.pdf") returned 5 [0066.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.mov") returned 0 [0066.048] lstrlenA (lpString="*.mov") returned 5 [0066.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.m2v") returned 0 [0066.048] lstrlenA (lpString="*.m2v") returned 5 [0066.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.3gp") returned 0 [0066.048] lstrlenA (lpString="*.3gp") returned 5 [0066.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.mpeg") returned 0 [0066.048] lstrlenA (lpString="*.mpeg") returned 6 [0066.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.mpg") returned 0 [0066.048] lstrlenA (lpString="*.mpg") returned 5 [0066.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.flv") returned 0 [0066.048] lstrlenA (lpString="*.flv") returned 5 [0066.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.avi") returned 0 [0066.048] lstrlenA (lpString="*.avi") returned 5 [0066.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.mp4") returned 0 [0066.048] lstrlenA (lpString="*.mp4") returned 5 [0066.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.wmv") returned 0 [0066.048] lstrlenA (lpString="*.wmv") returned 5 [0066.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.divx") returned 0 [0066.048] lstrlenA (lpString="*.divx") returned 6 [0066.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.mkv") returned 0 [0066.048] lstrlenA (lpString="*.mkv") returned 5 [0066.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.mp3") returned 0 [0066.048] lstrlenA (lpString="*.mp3") returned 5 [0066.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.wav") returned 0 [0066.049] lstrlenA (lpString="*.wav") returned 5 [0066.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.flac") returned 0 [0066.049] lstrlenA (lpString="*.flac") returned 6 [0066.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.ape") returned 0 [0066.049] lstrlenA (lpString="*.ape") returned 5 [0066.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.wma") returned 0 [0066.049] lstrlenA (lpString="*.wma") returned 5 [0066.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.ac3") returned 0 [0066.049] lstrlenA (lpString="*.ac3") returned 5 [0066.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", pszSpec="*.mxf") returned 0 [0066.049] lstrlenA (lpString="*.mxf") returned 5 [0066.049] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ADR10.XLT") returned 1 [0066.049] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADR10.XLT") returned 1 [0066.049] lstrcmpiA (lpString1="", lpString2="ADR10.XLT") returned -1 [0066.049] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT") returned="ADR1.XLT" [0066.049] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.049] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.049] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.049] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.049] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ADR10.XLT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT" [0066.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.zip") returned 0 [0066.049] lstrlenA (lpString="*.zip") returned 5 [0066.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.rar") returned 0 [0066.049] lstrlenA (lpString="*.rar") returned 5 [0066.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.7z") returned 0 [0066.049] lstrlenA (lpString="*.7z") returned 4 [0066.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.tar") returned 0 [0066.049] lstrlenA (lpString="*.tar") returned 5 [0066.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.gzip") returned 0 [0066.049] lstrlenA (lpString="*.gzip") returned 6 [0066.049] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.jpg") returned 0 [0066.050] lstrlenA (lpString="*.jpg") returned 5 [0066.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.jpeg") returned 0 [0066.050] lstrlenA (lpString="*.jpeg") returned 6 [0066.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.psd") returned 0 [0066.050] lstrlenA (lpString="*.psd") returned 5 [0066.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.gif") returned 0 [0066.050] lstrlenA (lpString="*.gif") returned 5 [0066.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.doc") returned 0 [0066.050] lstrlenA (lpString="*.doc") returned 5 [0066.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.docx") returned 0 [0066.050] lstrlenA (lpString="*.docx") returned 6 [0066.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.xls") returned 0 [0066.050] lstrlenA (lpString="*.xls") returned 5 [0066.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.xlsx") returned 0 [0066.050] lstrlenA (lpString="*.xlsx") returned 6 [0066.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.ppt") returned 0 [0066.050] lstrlenA (lpString="*.ppt") returned 5 [0066.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.pptx") returned 0 [0066.050] lstrlenA (lpString="*.pptx") returned 6 [0066.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.pdf") returned 0 [0066.050] lstrlenA (lpString="*.pdf") returned 5 [0066.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.mov") returned 0 [0066.050] lstrlenA (lpString="*.mov") returned 5 [0066.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.m2v") returned 0 [0066.050] lstrlenA (lpString="*.m2v") returned 5 [0066.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.3gp") returned 0 [0066.050] lstrlenA (lpString="*.3gp") returned 5 [0066.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.mpeg") returned 0 [0066.050] lstrlenA (lpString="*.mpeg") returned 6 [0066.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.mpg") returned 0 [0066.050] lstrlenA (lpString="*.mpg") returned 5 [0066.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.flv") returned 0 [0066.050] lstrlenA (lpString="*.flv") returned 5 [0066.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.avi") returned 0 [0066.050] lstrlenA (lpString="*.avi") returned 5 [0066.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.mp4") returned 0 [0066.051] lstrlenA (lpString="*.mp4") returned 5 [0066.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.wmv") returned 0 [0066.051] lstrlenA (lpString="*.wmv") returned 5 [0066.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.divx") returned 0 [0066.051] lstrlenA (lpString="*.divx") returned 6 [0066.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.mkv") returned 0 [0066.051] lstrlenA (lpString="*.mkv") returned 5 [0066.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.mp3") returned 0 [0066.051] lstrlenA (lpString="*.mp3") returned 5 [0066.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.wav") returned 0 [0066.051] lstrlenA (lpString="*.wav") returned 5 [0066.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.flac") returned 0 [0066.051] lstrlenA (lpString="*.flac") returned 6 [0066.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.ape") returned 0 [0066.051] lstrlenA (lpString="*.ape") returned 5 [0066.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.wma") returned 0 [0066.051] lstrlenA (lpString="*.wma") returned 5 [0066.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.ac3") returned 0 [0066.051] lstrlenA (lpString="*.ac3") returned 5 [0066.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", pszSpec="*.mxf") returned 0 [0066.051] lstrlenA (lpString="*.mxf") returned 5 [0066.051] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ADR2.XLT") returned 1 [0066.051] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADR2.XLT") returned 1 [0066.051] lstrcmpiA (lpString1="", lpString2="ADR2.XLT") returned -1 [0066.051] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT") returned="ADR10.XLT" [0066.051] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.051] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.051] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.051] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.051] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ADR2.XLT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT" [0066.051] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.zip") returned 0 [0066.052] lstrlenA (lpString="*.zip") returned 5 [0066.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.rar") returned 0 [0066.052] lstrlenA (lpString="*.rar") returned 5 [0066.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.7z") returned 0 [0066.052] lstrlenA (lpString="*.7z") returned 4 [0066.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.tar") returned 0 [0066.052] lstrlenA (lpString="*.tar") returned 5 [0066.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.gzip") returned 0 [0066.052] lstrlenA (lpString="*.gzip") returned 6 [0066.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.jpg") returned 0 [0066.052] lstrlenA (lpString="*.jpg") returned 5 [0066.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.jpeg") returned 0 [0066.052] lstrlenA (lpString="*.jpeg") returned 6 [0066.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.psd") returned 0 [0066.052] lstrlenA (lpString="*.psd") returned 5 [0066.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.gif") returned 0 [0066.052] lstrlenA (lpString="*.gif") returned 5 [0066.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.doc") returned 0 [0066.052] lstrlenA (lpString="*.doc") returned 5 [0066.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.docx") returned 0 [0066.052] lstrlenA (lpString="*.docx") returned 6 [0066.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.xls") returned 0 [0066.052] lstrlenA (lpString="*.xls") returned 5 [0066.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.xlsx") returned 0 [0066.052] lstrlenA (lpString="*.xlsx") returned 6 [0066.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.ppt") returned 0 [0066.052] lstrlenA (lpString="*.ppt") returned 5 [0066.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.pptx") returned 0 [0066.052] lstrlenA (lpString="*.pptx") returned 6 [0066.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.pdf") returned 0 [0066.052] lstrlenA (lpString="*.pdf") returned 5 [0066.052] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.mov") returned 0 [0066.052] lstrlenA (lpString="*.mov") returned 5 [0066.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.m2v") returned 0 [0066.053] lstrlenA (lpString="*.m2v") returned 5 [0066.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.3gp") returned 0 [0066.053] lstrlenA (lpString="*.3gp") returned 5 [0066.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.mpeg") returned 0 [0066.053] lstrlenA (lpString="*.mpeg") returned 6 [0066.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.mpg") returned 0 [0066.053] lstrlenA (lpString="*.mpg") returned 5 [0066.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.flv") returned 0 [0066.053] lstrlenA (lpString="*.flv") returned 5 [0066.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.avi") returned 0 [0066.053] lstrlenA (lpString="*.avi") returned 5 [0066.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.mp4") returned 0 [0066.053] lstrlenA (lpString="*.mp4") returned 5 [0066.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.wmv") returned 0 [0066.053] lstrlenA (lpString="*.wmv") returned 5 [0066.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.divx") returned 0 [0066.053] lstrlenA (lpString="*.divx") returned 6 [0066.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.mkv") returned 0 [0066.053] lstrlenA (lpString="*.mkv") returned 5 [0066.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.mp3") returned 0 [0066.053] lstrlenA (lpString="*.mp3") returned 5 [0066.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.wav") returned 0 [0066.053] lstrlenA (lpString="*.wav") returned 5 [0066.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.flac") returned 0 [0066.053] lstrlenA (lpString="*.flac") returned 6 [0066.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.ape") returned 0 [0066.053] lstrlenA (lpString="*.ape") returned 5 [0066.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.wma") returned 0 [0066.053] lstrlenA (lpString="*.wma") returned 5 [0066.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.ac3") returned 0 [0066.053] lstrlenA (lpString="*.ac3") returned 5 [0066.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", pszSpec="*.mxf") returned 0 [0066.053] lstrlenA (lpString="*.mxf") returned 5 [0066.053] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ADR3.XLT") returned 1 [0066.054] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADR3.XLT") returned 1 [0066.054] lstrcmpiA (lpString1="", lpString2="ADR3.XLT") returned -1 [0066.054] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT") returned="ADR2.XLT" [0066.054] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.054] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.054] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.054] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.054] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ADR3.XLT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT" [0066.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT", pszSpec="*.zip") returned 0 [0066.054] lstrlenA (lpString="*.zip") returned 5 [0066.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT", pszSpec="*.rar") returned 0 [0066.054] lstrlenA (lpString="*.rar") returned 5 [0066.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT", pszSpec="*.7z") returned 0 [0066.054] lstrlenA (lpString="*.7z") returned 4 [0066.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT", pszSpec="*.tar") returned 0 [0066.054] lstrlenA (lpString="*.tar") returned 5 [0066.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT", pszSpec="*.gzip") returned 0 [0066.054] lstrlenA (lpString="*.gzip") returned 6 [0066.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT", pszSpec="*.jpg") returned 0 [0066.054] lstrlenA (lpString="*.jpg") returned 5 [0066.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT", pszSpec="*.jpeg") returned 0 [0066.054] lstrlenA (lpString="*.jpeg") returned 6 [0066.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT", pszSpec="*.psd") returned 0 [0066.054] lstrlenA (lpString="*.psd") returned 5 [0066.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT", pszSpec="*.gif") returned 0 [0066.054] lstrlenA (lpString="*.gif") returned 5 [0066.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT", pszSpec="*.doc") returned 0 [0066.054] lstrlenA (lpString="*.doc") returned 5 [0066.055] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT", pszSpec="*.docx") returned 0 [0066.055] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ADR4.XLT") returned 1 [0066.055] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADR4.XLT") returned 1 [0066.055] lstrcmpiA (lpString1="", lpString2="ADR4.XLT") returned -1 [0066.055] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT") returned="ADR3.XLT" [0066.055] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.055] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.055] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ADR4.XLT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR4.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR4.XLT" [0066.055] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ADR5.XLT") returned 1 [0066.055] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADR5.XLT") returned 1 [0066.055] lstrcmpiA (lpString1="", lpString2="ADR5.XLT") returned -1 [0066.055] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR4.XLT") returned="ADR4.XLT" [0066.055] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.055] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.055] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.055] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ADR5.XLT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR5.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR5.XLT" [0066.056] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ADR6.XLT") returned 1 [0066.056] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADR6.XLT") returned 1 [0066.056] lstrcmpiA (lpString1="", lpString2="ADR6.XLT") returned -1 [0066.056] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR5.XLT") returned="ADR5.XLT" [0066.056] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.056] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.056] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ADR6.XLT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR6.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR6.XLT" [0066.056] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ADR7.XLT") returned 1 [0066.056] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADR7.XLT") returned 1 [0066.056] lstrcmpiA (lpString1="", lpString2="ADR7.XLT") returned -1 [0066.056] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR6.XLT") returned="ADR6.XLT" [0066.056] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.056] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.056] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.056] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ADR7.XLT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR7.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR7.XLT" [0066.056] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ADR8.XLT") returned 1 [0066.056] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADR8.XLT") returned 1 [0066.056] lstrcmpiA (lpString1="", lpString2="ADR8.XLT") returned -1 [0066.056] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR7.XLT") returned="ADR7.XLT" [0066.056] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.056] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.057] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ADR8.XLT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR8.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR8.XLT" [0066.057] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ADR9.XLT") returned 1 [0066.057] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADR9.XLT") returned 1 [0066.057] lstrcmpiA (lpString1="", lpString2="ADR9.XLT") returned -1 [0066.057] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR8.XLT") returned="ADR8.XLT" [0066.057] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.057] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.057] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ADR9.XLT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR9.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR9.XLT" [0066.057] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ApothecaryLetter.dotx") returned 1 [0066.057] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ApothecaryLetter.dotx") returned 1 [0066.057] lstrcmpiA (lpString1="", lpString2="ApothecaryLetter.dotx") returned -1 [0066.057] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR9.XLT") returned="ADR9.XLT" [0066.057] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.057] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.057] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.057] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ApothecaryLetter.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryLetter.dotx" [0066.057] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ApothecaryMergeLetter.dotx") returned 1 [0066.057] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ApothecaryMergeLetter.dotx") returned 1 [0066.057] lstrcmpiA (lpString1="", lpString2="ApothecaryMergeLetter.dotx") returned -1 [0066.057] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryLetter.dotx") returned="ApothecaryLetter.dotx" [0066.058] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.058] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.058] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ApothecaryMergeLetter.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryMergeLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryMergeLetter.dotx" [0066.058] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ApothecaryNewsletter.dotx") returned 1 [0066.058] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ApothecaryNewsletter.dotx") returned 1 [0066.058] lstrcmpiA (lpString1="", lpString2="ApothecaryNewsletter.dotx") returned -1 [0066.058] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryMergeLetter.dotx") returned="ApothecaryMergeLetter.dotx" [0066.058] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.058] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.058] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ApothecaryNewsletter.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryNewsletter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryNewsletter.dotx" [0066.092] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ApothecaryResume.dotx") returned 1 [0066.092] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ApothecaryResume.dotx") returned 1 [0066.092] lstrcmpiA (lpString1="", lpString2="ApothecaryResume.dotx") returned -1 [0066.092] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryNewsletter.dotx") returned="ApothecaryNewsletter.dotx" [0066.092] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.092] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.092] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.092] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.092] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ApothecaryResume.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryResume.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryResume.dotx" [0066.092] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BillingStatement.xltx") returned 1 [0066.092] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BillingStatement.xltx") returned 1 [0066.092] lstrcmpiA (lpString1="", lpString2="BillingStatement.xltx") returned -1 [0066.092] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryResume.dotx") returned="ApothecaryResume.dotx" [0066.092] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.092] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.092] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.092] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.093] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="BillingStatement.xltx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BillingStatement.xltx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BillingStatement.xltx" [0066.093] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BlackTieLetter.dotx") returned 1 [0066.093] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BlackTieLetter.dotx") returned 1 [0066.093] lstrcmpiA (lpString1="", lpString2="BlackTieLetter.dotx") returned -1 [0066.093] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BillingStatement.xltx") returned="BillingStatement.xltx" [0066.093] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.093] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.093] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.093] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.093] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="BlackTieLetter.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieLetter.dotx" [0066.093] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BlackTieMergeLetter.dotx") returned 1 [0066.093] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BlackTieMergeLetter.dotx") returned 1 [0066.093] lstrcmpiA (lpString1="", lpString2="BlackTieMergeLetter.dotx") returned -1 [0066.093] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieLetter.dotx") returned="BlackTieLetter.dotx" [0066.093] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.093] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.093] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.093] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.093] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="BlackTieMergeLetter.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieMergeLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieMergeLetter.dotx" [0066.093] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BlackTieNewsletter.dotx") returned 1 [0066.093] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BlackTieNewsletter.dotx") returned 1 [0066.093] lstrcmpiA (lpString1="", lpString2="BlackTieNewsletter.dotx") returned -1 [0066.093] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieMergeLetter.dotx") returned="BlackTieMergeLetter.dotx" [0066.093] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.093] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.093] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.093] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.094] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="BlackTieNewsletter.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieNewsletter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieNewsletter.dotx" [0066.094] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BlackTieResume.dotx") returned 1 [0066.094] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BlackTieResume.dotx") returned 1 [0066.094] lstrcmpiA (lpString1="", lpString2="BlackTieResume.dotx") returned -1 [0066.094] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieNewsletter.dotx") returned="BlackTieNewsletter.dotx" [0066.094] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.094] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.094] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.094] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.094] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="BlackTieResume.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieResume.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieResume.dotx" [0066.094] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Blog.dotx") returned 1 [0066.094] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Blog.dotx") returned 1 [0066.094] lstrcmpiA (lpString1="", lpString2="Blog.dotx") returned -1 [0066.094] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieResume.dotx") returned="BlackTieResume.dotx" [0066.094] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.094] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.094] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.094] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.094] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="Blog.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Blog.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Blog.dotx" [0066.094] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BloodPressureTracker.xltx") returned 1 [0066.094] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BloodPressureTracker.xltx") returned 1 [0066.094] lstrcmpiA (lpString1="", lpString2="BloodPressureTracker.xltx") returned -1 [0066.094] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Blog.dotx") returned="Blog.dotx" [0066.094] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.094] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.094] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.095] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.095] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="BloodPressureTracker.xltx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BloodPressureTracker.xltx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BloodPressureTracker.xltx" [0066.095] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ClassicPhotoAlbum.potx") returned 1 [0066.095] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ClassicPhotoAlbum.potx") returned 1 [0066.095] lstrcmpiA (lpString1="", lpString2="ClassicPhotoAlbum.potx") returned -1 [0066.095] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BloodPressureTracker.xltx") returned="BloodPressureTracker.xltx" [0066.095] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.095] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.095] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.095] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.095] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ClassicPhotoAlbum.potx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ClassicPhotoAlbum.potx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ClassicPhotoAlbum.potx" [0066.095] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ContemporaryPhotoAlbum.potx") returned 1 [0066.095] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ContemporaryPhotoAlbum.potx") returned 1 [0066.095] lstrcmpiA (lpString1="", lpString2="ContemporaryPhotoAlbum.potx") returned -1 [0066.095] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ClassicPhotoAlbum.potx") returned="ClassicPhotoAlbum.potx" [0066.095] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.095] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.095] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.095] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.095] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ContemporaryPhotoAlbum.potx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ContemporaryPhotoAlbum.potx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ContemporaryPhotoAlbum.potx" [0066.095] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EquityLetter.Dotx") returned -1 [0066.095] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EquityLetter.Dotx") returned 1 [0066.095] lstrcmpiA (lpString1="", lpString2="EquityLetter.Dotx") returned -1 [0066.095] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ContemporaryPhotoAlbum.potx") returned="ContemporaryPhotoAlbum.potx" [0066.095] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.095] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.096] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.096] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.096] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="EquityLetter.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityLetter.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityLetter.Dotx" [0066.096] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EquityMergeFax.Dotx") returned -1 [0066.096] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EquityMergeFax.Dotx") returned 1 [0066.096] lstrcmpiA (lpString1="", lpString2="EquityMergeFax.Dotx") returned -1 [0066.096] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityLetter.Dotx") returned="EquityLetter.Dotx" [0066.096] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.096] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.096] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.096] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.096] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="EquityMergeFax.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityMergeFax.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityMergeFax.Dotx" [0066.098] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EquityMergeLetter.Dotx") returned -1 [0066.098] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EquityMergeLetter.Dotx") returned 1 [0066.098] lstrcmpiA (lpString1="", lpString2="EquityMergeLetter.Dotx") returned -1 [0066.098] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityMergeFax.Dotx") returned="EquityMergeFax.Dotx" [0066.098] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.099] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.099] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.099] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.099] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="EquityMergeLetter.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityMergeLetter.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityMergeLetter.Dotx" [0066.099] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EquityReport.Dotx") returned -1 [0066.099] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EquityReport.Dotx") returned 1 [0066.099] lstrcmpiA (lpString1="", lpString2="EquityReport.Dotx") returned -1 [0066.099] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityMergeLetter.Dotx") returned="EquityMergeLetter.Dotx" [0066.099] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.099] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.099] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.099] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.099] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="EquityReport.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityReport.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityReport.Dotx" [0066.099] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EquityResume.Dotx") returned -1 [0066.099] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EquityResume.Dotx") returned 1 [0066.099] lstrcmpiA (lpString1="", lpString2="EquityResume.Dotx") returned -1 [0066.099] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityReport.Dotx") returned="EquityReport.Dotx" [0066.099] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.099] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.099] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.099] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.099] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="EquityResume.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityResume.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityResume.Dotx" [0066.099] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EssentialLetter.dotx") returned -1 [0066.100] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EssentialLetter.dotx") returned 1 [0066.100] lstrcmpiA (lpString1="", lpString2="EssentialLetter.dotx") returned -1 [0066.100] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityResume.Dotx") returned="EquityResume.Dotx" [0066.100] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.100] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.100] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.100] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.100] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="EssentialLetter.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialLetter.dotx" [0066.100] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EssentialMergeLetter.dotx") returned -1 [0066.100] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EssentialMergeLetter.dotx") returned 1 [0066.100] lstrcmpiA (lpString1="", lpString2="EssentialMergeLetter.dotx") returned -1 [0066.100] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialLetter.dotx") returned="EssentialLetter.dotx" [0066.100] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.100] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.100] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.100] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.100] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="EssentialMergeLetter.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialMergeLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialMergeLetter.dotx" [0066.100] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EssentialReport.dotx") returned -1 [0066.100] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EssentialReport.dotx") returned 1 [0066.100] lstrcmpiA (lpString1="", lpString2="EssentialReport.dotx") returned -1 [0066.100] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialMergeLetter.dotx") returned="EssentialMergeLetter.dotx" [0066.100] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.100] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.100] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.100] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.100] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="EssentialReport.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialReport.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialReport.dotx" [0066.101] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EssentialResume.dotx") returned -1 [0066.101] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EssentialResume.dotx") returned 1 [0066.101] lstrcmpiA (lpString1="", lpString2="EssentialResume.dotx") returned -1 [0066.101] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialReport.dotx") returned="EssentialReport.dotx" [0066.101] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.101] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.101] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.101] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.101] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="EssentialResume.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialResume.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialResume.dotx" [0066.101] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ExecutiveLetter.dotx") returned -1 [0066.101] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExecutiveLetter.dotx") returned 1 [0066.101] lstrcmpiA (lpString1="", lpString2="ExecutiveLetter.dotx") returned -1 [0066.101] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EssentialResume.dotx") returned="EssentialResume.dotx" [0066.101] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.101] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.101] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.101] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.101] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ExecutiveLetter.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveLetter.dotx" [0066.101] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ExecutiveMergeLetter.dotx") returned -1 [0066.101] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExecutiveMergeLetter.dotx") returned 1 [0066.101] lstrcmpiA (lpString1="", lpString2="ExecutiveMergeLetter.dotx") returned -1 [0066.101] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveLetter.dotx") returned="ExecutiveLetter.dotx" [0066.101] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.101] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.101] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.101] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.102] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ExecutiveMergeLetter.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveMergeLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveMergeLetter.dotx" [0066.102] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ExecutiveNewsletter.dotx") returned -1 [0066.102] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExecutiveNewsletter.dotx") returned 1 [0066.102] lstrcmpiA (lpString1="", lpString2="ExecutiveNewsletter.dotx") returned -1 [0066.102] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveMergeLetter.dotx") returned="ExecutiveMergeLetter.dotx" [0066.102] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.102] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.102] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.102] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.102] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ExecutiveNewsletter.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveNewsletter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveNewsletter.dotx" [0066.102] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ExecutiveReport.dotx") returned -1 [0066.102] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExecutiveReport.dotx") returned 1 [0066.102] lstrcmpiA (lpString1="", lpString2="ExecutiveReport.dotx") returned -1 [0066.102] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveNewsletter.dotx") returned="ExecutiveNewsletter.dotx" [0066.102] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.102] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.102] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.102] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.102] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ExecutiveReport.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveReport.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveReport.dotx" [0066.102] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ExecutiveResume.dotx") returned -1 [0066.102] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExecutiveResume.dotx") returned 1 [0066.102] lstrcmpiA (lpString1="", lpString2="ExecutiveResume.dotx") returned -1 [0066.102] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveReport.dotx") returned="ExecutiveReport.dotx" [0066.102] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.103] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.103] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.103] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.103] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ExecutiveResume.dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveResume.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveResume.dotx" [0066.103] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ExpenseReport.xltx") returned -1 [0066.103] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExpenseReport.xltx") returned 1 [0066.103] lstrcmpiA (lpString1="", lpString2="ExpenseReport.xltx") returned -1 [0066.103] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExecutiveResume.dotx") returned="ExecutiveResume.dotx" [0066.103] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.103] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.103] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.103] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.103] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="ExpenseReport.xltx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExpenseReport.xltx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExpenseReport.xltx" [0066.103] lstrcmpA (lpString1=".", lpString2="FAX") returned -1 [0066.103] lstrcmpA (lpString1="..", lpString2="FAX") returned -1 [0066.103] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ExpenseReport.xltx") returned="ExpenseReport.xltx" [0066.103] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="FAX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX" [0066.103] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3aa710, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d808a, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0066.108] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.108] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.108] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.108] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EquityFax.Dotx") returned -1 [0066.108] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EquityFax.Dotx") returned 1 [0066.108] lstrcmpiA (lpString1="", lpString2="EquityFax.Dotx") returned -1 [0066.108] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\*.*") returned="*.*" [0066.108] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" [0066.108] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\") returned="" [0066.108] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt" [0066.108] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\how to decrypt files.txt")) returned 0xffffffff [0066.108] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0066.111] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.111] CloseHandle (hObject=0x90) returned 1 [0066.111] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\", lpString2="EquityFax.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\EquityFax.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\EquityFax.Dotx" [0066.111] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e48ef50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x19972, dwReserved0=0x0, dwReserved1=0x0, cFileName="MedianFax.Dotx", cAlternateFileName="MEDIAN~1.DOT")) returned 1 [0066.112] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.112] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MedianFax.Dotx") returned -1 [0066.112] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MedianFax.Dotx") returned -1 [0066.112] lstrcmpiA (lpString1="", lpString2="MedianFax.Dotx") returned -1 [0066.112] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\EquityFax.Dotx") returned="EquityFax.Dotx" [0066.112] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" [0066.112] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\") returned="" [0066.112] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt" [0066.112] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\how to decrypt files.txt")) returned 0x20 [0066.112] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\", lpString2="MedianFax.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\MedianFax.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\MedianFax.Dotx" [0066.112] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e4db210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1bbf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrielFax.Dotx", cAlternateFileName="ORIELF~1.DOT")) returned 1 [0066.112] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.112] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OrielFax.Dotx") returned -1 [0066.112] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OrielFax.Dotx") returned -1 [0066.112] lstrcmpiA (lpString1="", lpString2="OrielFax.Dotx") returned -1 [0066.112] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\MedianFax.Dotx") returned="MedianFax.Dotx" [0066.112] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" [0066.112] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\") returned="" [0066.112] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt" [0066.112] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\how to decrypt files.txt")) returned 0x20 [0066.112] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\", lpString2="OrielFax.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx" [0066.112] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x16d67, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginFax.Dotx", cAlternateFileName="ORIGIN~1.DOT")) returned 1 [0066.112] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.112] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OriginFax.Dotx") returned -1 [0066.112] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OriginFax.Dotx") returned -1 [0066.112] lstrcmpiA (lpString1="", lpString2="OriginFax.Dotx") returned -1 [0066.113] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx") returned="OrielFax.Dotx" [0066.113] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" [0066.113] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\") returned="" [0066.113] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt" [0066.113] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\how to decrypt files.txt")) returned 0x20 [0066.113] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\", lpString2="OriginFax.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx" [0066.113] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x13901, dwReserved0=0x0, dwReserved1=0x0, cFileName="UrbanFax.Dotx", cAlternateFileName="URBANF~1.DOT")) returned 1 [0066.113] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.113] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UrbanFax.Dotx") returned -1 [0066.113] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UrbanFax.Dotx") returned -1 [0066.113] lstrcmpiA (lpString1="", lpString2="UrbanFax.Dotx") returned -1 [0066.113] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx") returned="OriginFax.Dotx" [0066.113] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" [0066.113] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\") returned="" [0066.113] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt" [0066.113] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\how to decrypt files.txt")) returned 0x20 [0066.113] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\", lpString2="UrbanFax.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx" [0066.113] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x13901, dwReserved0=0x0, dwReserved1=0x0, cFileName="UrbanFax.Dotx", cAlternateFileName="URBANF~1.DOT")) returned 0 [0066.113] FindClose (in: hFindFile=0x2e3478 | out: hFindFile=0x2e3478) returned 1 [0066.113] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x219e1900, ftCreationTime.dwHighDateTime=0x1ca8f08, ftLastAccessTime.dwLowDateTime=0xf5d65210, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x219e1900, ftLastWriteTime.dwHighDateTime=0x1ca8f08, nFileSizeHigh=0x0, nFileSizeLow=0x1fa5cb9, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="FiveRules.potx", cAlternateFileName="FIVERU~1.POT")) returned 1 [0066.113] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.113] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="FiveRules.potx") returned -1 [0066.114] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FiveRules.potx") returned 1 [0066.114] lstrcmpiA (lpString1="", lpString2="FiveRules.potx") returned -1 [0066.114] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\*.*") returned="*.*" [0066.114] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.114] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.114] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.114] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.114] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="FiveRules.potx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx" [0066.114] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x360, dwReserved0=0x0, dwReserved1=0x0, cFileName="HOW TO DECRYPT FILES.txt", cAlternateFileName="HOWTOD~1.TXT")) returned 1 [0066.114] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.114] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="HOW TO DECRYPT FILES.txt") returned -1 [0066.114] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HOW TO DECRYPT FILES.txt") returned 0 [0066.114] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ba83800, ftCreationTime.dwHighDateTime=0x1ca8f08, ftLastAccessTime.dwLowDateTime=0xf5b76030, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ba83800, ftLastWriteTime.dwHighDateTime=0x1ca8f08, nFileSizeHigh=0x0, nFileSizeLow=0x10b563f, dwReserved0=0x18f7bc, dwReserved1=0x4f0048, cFileName="IntroducingPowerPoint2010.potx", cAlternateFileName="INTROD~1.POT")) returned 1 [0066.114] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.114] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IntroducingPowerPoint2010.potx") returned -1 [0066.114] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IntroducingPowerPoint2010.potx") returned -1 [0066.114] lstrcmpiA (lpString1="", lpString2="IntroducingPowerPoint2010.potx") returned -1 [0066.114] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx") returned="FiveRules.potx" [0066.114] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.114] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.114] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.114] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.114] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="IntroducingPowerPoint2010.potx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx" [0066.114] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b91500, ftCreationTime.dwHighDateTime=0x1c7c8e6, ftLastAccessTime.dwLowDateTime=0xfa5ff110, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77b91500, ftLastWriteTime.dwHighDateTime=0x1c7c8e6, nFileSizeHigh=0x0, nFileSizeLow=0xf6a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoanAmortization.xltx", cAlternateFileName="LOANAM~1.XLT")) returned 1 [0066.114] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.114] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="LoanAmortization.xltx") returned -1 [0066.114] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LoanAmortization.xltx") returned -1 [0066.114] lstrcmpiA (lpString1="", lpString2="LoanAmortization.xltx") returned -1 [0066.115] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx") returned="IntroducingPowerPoint2010.potx" [0066.115] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.115] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.115] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.115] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.115] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="LoanAmortization.xltx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\LoanAmortization.xltx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\LoanAmortization.xltx" [0066.115] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e48ef50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1cbba, dwReserved0=0x0, dwReserved1=0x0, cFileName="MedianLetter.Dotx", cAlternateFileName="MEDIAN~1.DOT")) returned 1 [0066.115] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.115] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MedianLetter.Dotx") returned -1 [0066.115] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MedianLetter.Dotx") returned -1 [0066.115] lstrcmpiA (lpString1="", lpString2="MedianLetter.Dotx") returned -1 [0066.115] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\LoanAmortization.xltx") returned="LoanAmortization.xltx" [0066.115] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.115] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.115] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.115] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.115] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="MedianLetter.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianLetter.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianLetter.Dotx" [0066.115] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e48ef50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1955a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MedianMergeFax.Dotx", cAlternateFileName="MEDIAN~2.DOT")) returned 1 [0066.115] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.115] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MedianMergeFax.Dotx") returned -1 [0066.115] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MedianMergeFax.Dotx") returned -1 [0066.115] lstrcmpiA (lpString1="", lpString2="MedianMergeFax.Dotx") returned -1 [0066.115] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianLetter.Dotx") returned="MedianLetter.Dotx" [0066.115] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.115] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.115] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.115] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.116] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="MedianMergeFax.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianMergeFax.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianMergeFax.Dotx" [0066.116] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e48ef50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1cd77, dwReserved0=0x0, dwReserved1=0x0, cFileName="MedianMergeLetter.Dotx", cAlternateFileName="MEDIAN~3.DOT")) returned 1 [0066.116] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.116] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MedianMergeLetter.Dotx") returned -1 [0066.116] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MedianMergeLetter.Dotx") returned -1 [0066.116] lstrcmpiA (lpString1="", lpString2="MedianMergeLetter.Dotx") returned -1 [0066.116] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianMergeFax.Dotx") returned="MedianMergeFax.Dotx" [0066.116] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.116] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.116] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.116] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.116] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="MedianMergeLetter.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianMergeLetter.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianMergeLetter.Dotx" [0066.116] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e4b50b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x48355, dwReserved0=0x0, dwReserved1=0x0, cFileName="MedianReport.Dotx", cAlternateFileName="MEDIAN~4.DOT")) returned 1 [0066.116] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.116] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MedianReport.Dotx") returned -1 [0066.116] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MedianReport.Dotx") returned -1 [0066.116] lstrcmpiA (lpString1="", lpString2="MedianReport.Dotx") returned -1 [0066.116] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianMergeLetter.Dotx") returned="MedianMergeLetter.Dotx" [0066.116] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.116] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.116] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.116] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.116] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="MedianReport.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianReport.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianReport.Dotx" [0066.116] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e4b50b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x290e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MedianResume.Dotx", cAlternateFileName="ME105B~1.DOT")) returned 1 [0066.116] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.116] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MedianResume.Dotx") returned -1 [0066.117] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MedianResume.Dotx") returned -1 [0066.117] lstrcmpiA (lpString1="", lpString2="MedianResume.Dotx") returned -1 [0066.117] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianReport.Dotx") returned="MedianReport.Dotx" [0066.117] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.117] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.117] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" [0066.117] GetFileAttributesA (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\how to decrypt files.txt")) returned 0x20 [0066.117] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\", lpString2="MedianResume.Dotx" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianResume.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianResume.Dotx" [0066.117] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e5e5bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0xab82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Word 2003 Look.dotx", cAlternateFileName="OFFICE~1.DOT")) returned 1 [0066.117] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.117] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Office Word 2003 Look.dotx") returned -1 [0066.117] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office Word 2003 Look.dotx") returned -1 [0066.117] lstrcmpiA (lpString1="", lpString2="Office Word 2003 Look.dotx") returned -1 [0066.117] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\MedianResume.Dotx") returned="MedianResume.Dotx" [0066.117] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.117] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.119] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc75c370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE", cAlternateFileName="")) returned 1 [0066.119] lstrcmpA (lpString1=".", lpString2="ONENOTE") returned -1 [0066.119] lstrcmpA (lpString1="..", lpString2="ONENOTE") returned -1 [0066.119] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Office Word 2003 Look.dotx") returned="Office Word 2003 Look.dotx" [0066.119] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc75c370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d808a, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0066.119] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.119] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc75c370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.119] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.119] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.119] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0066.119] lstrcmpA (lpString1=".", lpString2="14") returned -1 [0066.119] lstrcmpA (lpString1="..", lpString2="14") returned -1 [0066.119] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\*.*") returned="*.*" [0066.119] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df3c0, dwReserved1=0x2df3bb, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.121] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.121] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.121] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.121] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.121] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7a8630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Notebook Templates", cAlternateFileName="NOTEBO~1")) returned 1 [0066.121] lstrcmpA (lpString1=".", lpString2="Notebook Templates") returned -1 [0066.121] lstrcmpA (lpString1="..", lpString2="Notebook Templates") returned -1 [0066.121] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\*.*") returned="*.*" [0066.121] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7a8630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x2e03c3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0066.122] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.122] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7a8630, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.122] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.122] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.122] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83c0e00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc7ce790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb83c0e00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x1490fe, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Notebook03.onepkg", cAlternateFileName="NOTEBO~1.ONE")) returned 1 [0066.122] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0066.122] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Notebook03.onepkg") returned -1 [0066.122] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Notebook03.onepkg") returned -1 [0066.122] lstrcmpiA (lpString1="", lpString2="Notebook03.onepkg") returned -1 [0066.122] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\*.*") returned="*.*" [0066.122] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\" [0066.122] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\") returned="" [0066.125] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.125] CloseHandle (hObject=0x98) returned 1 [0066.125] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb83c0e00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc7ce790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb83c0e00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x1490fe, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Notebook03.onepkg", cAlternateFileName="NOTEBO~1.ONE")) returned 0 [0066.125] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0066.126] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0066.126] lstrcmpA (lpString1=".", lpString2="Stationery") returned -1 [0066.126] lstrcmpA (lpString1="..", lpString2="Stationery") returned -1 [0066.126] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\*.*") returned="*.*" [0066.126] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0066.126] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.126] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.126] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.126] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.126] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6be3a00, ftCreationTime.dwHighDateTime=0x1ca472f, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6be3a00, ftLastWriteTime.dwHighDateTime=0x1ca472f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ACADEMIC.ONE", cAlternateFileName="")) returned 1 [0066.126] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0066.126] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ACADEMIC.ONE") returned 1 [0066.126] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACADEMIC.ONE") returned 1 [0066.126] lstrcmpiA (lpString1="", lpString2="ACADEMIC.ONE") returned -1 [0066.126] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\*.*") returned="*.*" [0066.126] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\" [0066.126] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\") returned="" [0066.130] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.130] CloseHandle (hObject=0x98) returned 1 [0066.131] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6be3a00, ftCreationTime.dwHighDateTime=0x1ca472f, ftLastAccessTime.dwLowDateTime=0xc75c370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6be3a00, ftLastWriteTime.dwHighDateTime=0x1ca472f, nFileSizeHigh=0x0, nFileSizeLow=0x2b428, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLANK.ONE", cAlternateFileName="")) returned 1 [0066.131] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0066.131] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BLANK.ONE") returned 1 [0066.131] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BLANK.ONE") returned 1 [0066.131] lstrcmpiA (lpString1="", lpString2="BLANK.ONE") returned -1 [0066.131] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\ACADEMIC.ONE") returned="ACADEMIC.ONE" [0066.131] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\" [0066.131] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\") returned="" [0066.131] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6be3a00, ftCreationTime.dwHighDateTime=0x1ca472f, ftLastAccessTime.dwLowDateTime=0xc7824d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6be3a00, ftLastWriteTime.dwHighDateTime=0x1ca472f, nFileSizeHigh=0x0, nFileSizeLow=0x4e630, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="BUSINESS.ONE", cAlternateFileName="")) returned 1 [0066.131] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0066.131] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BUSINESS.ONE") returned 1 [0066.131] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BUSINESS.ONE") returned 1 [0066.131] lstrcmpiA (lpString1="", lpString2="BUSINESS.ONE") returned -1 [0066.131] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BLANK.ONE") returned="BLANK.ONE" [0066.131] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\" [0066.131] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\") returned="" [0066.131] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa58d0d00, ftCreationTime.dwHighDateTime=0x1ca472f, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa58d0d00, ftLastWriteTime.dwHighDateTime=0x1ca472f, nFileSizeHigh=0x0, nFileSizeLow=0x3182e8, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="DESIGNER.ONE", cAlternateFileName="")) returned 1 [0066.131] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0066.131] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DESIGNER.ONE") returned 1 [0066.131] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DESIGNER.ONE") returned 1 [0066.132] lstrcmpiA (lpString1="", lpString2="DESIGNER.ONE") returned -1 [0066.132] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\BUSINESS.ONE") returned="BUSINESS.ONE" [0066.132] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\" [0066.132] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\") returned="" [0066.132] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa45be000, ftCreationTime.dwHighDateTime=0x1ca472f, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa45be000, ftLastWriteTime.dwHighDateTime=0x1ca472f, nFileSizeHigh=0x0, nFileSizeLow=0x37b50, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="PLANNERS.ONE", cAlternateFileName="")) returned 1 [0066.132] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0066.132] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PLANNERS.ONE") returned -1 [0066.132] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PLANNERS.ONE") returned -1 [0066.132] lstrcmpiA (lpString1="", lpString2="PLANNERS.ONE") returned -1 [0066.132] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE") returned="DESIGNER.ONE" [0066.132] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\" [0066.132] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\") returned="" [0066.132] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa45be000, ftCreationTime.dwHighDateTime=0x1ca472f, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa45be000, ftLastWriteTime.dwHighDateTime=0x1ca472f, nFileSizeHigh=0x0, nFileSizeLow=0x37b50, dwReserved0=0x200054, dwReserved1=0x490046, cFileName="PLANNERS.ONE", cAlternateFileName="")) returned 0 [0066.132] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0066.132] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 0 [0066.132] FindClose (in: hFindFile=0x2e34b8 | out: hFindFile=0x2e34b8) returned 1 [0066.132] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0066.132] FindClose (in: hFindFile=0x2e3478 | out: hFindFile=0x2e3478) returned 1 [0066.132] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e4db210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x2db52, dwReserved0=0x4e004f, dwReserved1=0x3, cFileName="OrielLetter.Dotx", cAlternateFileName="ORIELL~1.DOT")) returned 1 [0066.132] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.132] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OrielLetter.Dotx") returned -1 [0066.132] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OrielLetter.Dotx") returned -1 [0066.132] lstrcmpiA (lpString1="", lpString2="OrielLetter.Dotx") returned -1 [0066.132] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\*.*") returned="*.*" [0066.133] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.133] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.133] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e4db210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1b29e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrielMergeFax.Dotx", cAlternateFileName="ORIELM~1.DOT")) returned 1 [0066.133] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.133] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OrielMergeFax.Dotx") returned -1 [0066.133] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OrielMergeFax.Dotx") returned -1 [0066.133] lstrcmpiA (lpString1="", lpString2="OrielMergeFax.Dotx") returned -1 [0066.133] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielLetter.Dotx") returned="OrielLetter.Dotx" [0066.133] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.133] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.133] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e4db210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x2b308, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrielMergeLetter.Dotx", cAlternateFileName="ORIELM~2.DOT")) returned 1 [0066.133] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.133] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OrielMergeLetter.Dotx") returned -1 [0066.133] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OrielMergeLetter.Dotx") returned -1 [0066.133] lstrcmpiA (lpString1="", lpString2="OrielMergeLetter.Dotx") returned -1 [0066.133] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielMergeFax.Dotx") returned="OrielMergeFax.Dotx" [0066.133] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.133] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.133] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e4db210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x82b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrielReport.Dotx", cAlternateFileName="ORIELR~1.DOT")) returned 1 [0066.133] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.133] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OrielReport.Dotx") returned -1 [0066.133] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OrielReport.Dotx") returned -1 [0066.133] lstrcmpiA (lpString1="", lpString2="OrielReport.Dotx") returned -1 [0066.133] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielMergeLetter.Dotx") returned="OrielMergeLetter.Dotx" [0066.133] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.133] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.133] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e4db210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x4ab41, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrielResume.Dotx", cAlternateFileName="ORIELR~2.DOT")) returned 1 [0066.134] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.134] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OrielResume.Dotx") returned -1 [0066.134] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OrielResume.Dotx") returned -1 [0066.134] lstrcmpiA (lpString1="", lpString2="OrielResume.Dotx") returned -1 [0066.134] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielReport.Dotx") returned="OrielReport.Dotx" [0066.134] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.134] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.134] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1f56a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginLetter.Dotx", cAlternateFileName="ORIGIN~1.DOT")) returned 1 [0066.135] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.135] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OriginLetter.Dotx") returned -1 [0066.135] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OriginLetter.Dotx") returned -1 [0066.135] lstrcmpiA (lpString1="", lpString2="OriginLetter.Dotx") returned -1 [0066.135] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OrielResume.Dotx") returned="OrielResume.Dotx" [0066.135] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.135] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.135] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x172e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginMergeFax.Dotx", cAlternateFileName="ORIGIN~2.DOT")) returned 1 [0066.135] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.135] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OriginMergeFax.Dotx") returned -1 [0066.135] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OriginMergeFax.Dotx") returned -1 [0066.135] lstrcmpiA (lpString1="", lpString2="OriginMergeFax.Dotx") returned -1 [0066.135] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginLetter.Dotx") returned="OriginLetter.Dotx" [0066.135] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.135] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.135] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1f314, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginMergeLetter.Dotx", cAlternateFileName="ORIGIN~3.DOT")) returned 1 [0066.135] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.135] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OriginMergeLetter.Dotx") returned -1 [0066.135] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OriginMergeLetter.Dotx") returned -1 [0066.135] lstrcmpiA (lpString1="", lpString2="OriginMergeLetter.Dotx") returned -1 [0066.135] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginMergeFax.Dotx") returned="OriginMergeFax.Dotx" [0066.135] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.135] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.135] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x5b011, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginReport.Dotx", cAlternateFileName="ORIGIN~4.DOT")) returned 1 [0066.135] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.135] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OriginReport.Dotx") returned -1 [0066.135] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OriginReport.Dotx") returned -1 [0066.136] lstrcmpiA (lpString1="", lpString2="OriginReport.Dotx") returned -1 [0066.136] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginMergeLetter.Dotx") returned="OriginMergeLetter.Dotx" [0066.136] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.136] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.136] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x23247, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginResume.Dotx", cAlternateFileName="ORAE40~1.DOT")) returned 1 [0066.136] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.136] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="OriginResume.Dotx") returned -1 [0066.136] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OriginResume.Dotx") returned -1 [0066.136] lstrcmpiA (lpString1="", lpString2="OriginResume.Dotx") returned -1 [0066.136] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginReport.Dotx") returned="OriginReport.Dotx" [0066.136] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.136] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.136] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b91500, ftCreationTime.dwHighDateTime=0x1c7c8e6, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77b91500, ftLastWriteTime.dwHighDateTime=0x1c7c8e6, nFileSizeHigh=0x0, nFileSizeLow=0x75b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="PersonalMonthlyBudget.xltx", cAlternateFileName="PERSON~1.XLT")) returned 1 [0066.136] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.136] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PersonalMonthlyBudget.xltx") returned -1 [0066.136] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PersonalMonthlyBudget.xltx") returned -1 [0066.136] lstrcmpiA (lpString1="", lpString2="PersonalMonthlyBudget.xltx") returned -1 [0066.136] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\OriginResume.Dotx") returned="OriginResume.Dotx" [0066.136] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.136] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.136] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb12da100, ftCreationTime.dwHighDateTime=0x1c69a95, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xb12da100, ftLastWriteTime.dwHighDateTime=0x1c69a95, nFileSizeHigh=0x0, nFileSizeLow=0x2e590, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pitchbook.potx", cAlternateFileName="PITCHB~1.POT")) returned 1 [0066.136] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.136] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Pitchbook.potx") returned -1 [0066.136] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Pitchbook.potx") returned -1 [0066.136] lstrcmpiA (lpString1="", lpString2="Pitchbook.potx") returned -1 [0066.136] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\PersonalMonthlyBudget.xltx") returned="PersonalMonthlyBudget.xltx" [0066.136] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.136] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.137] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22cf4600, ftCreationTime.dwHighDateTime=0x1ca8f08, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x22cf4600, ftLastWriteTime.dwHighDateTime=0x1ca8f08, nFileSizeHigh=0x0, nFileSizeLow=0x9fd6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectStatusReport.potx", cAlternateFileName="PROJEC~1.POT")) returned 1 [0066.137] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.137] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ProjectStatusReport.potx") returned -1 [0066.137] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectStatusReport.potx") returned -1 [0066.137] lstrcmpiA (lpString1="", lpString2="ProjectStatusReport.potx") returned -1 [0066.137] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Pitchbook.potx") returned="Pitchbook.potx" [0066.137] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.137] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.137] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72cd1000, ftCreationTime.dwHighDateTime=0x1c99e00, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72cd1000, ftLastWriteTime.dwHighDateTime=0x1c99e00, nFileSizeHigh=0x0, nFileSizeLow=0x3b42, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROJPLAN.XLTX", cAlternateFileName="PROJPL~1.XLT")) returned 1 [0066.137] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.137] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PROJPLAN.XLTX") returned -1 [0066.137] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PROJPLAN.XLTX") returned -1 [0066.137] lstrcmpiA (lpString1="", lpString2="PROJPLAN.XLTX") returned -1 [0066.137] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ProjectStatusReport.potx") returned="ProjectStatusReport.potx" [0066.137] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.137] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.137] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeda0600, ftCreationTime.dwHighDateTime=0x1c6d971, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdeda0600, ftLastWriteTime.dwHighDateTime=0x1c6d971, nFileSizeHigh=0x0, nFileSizeLow=0x17697, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuizShow.potx", cAlternateFileName="QUIZSH~1.POT")) returned 1 [0066.137] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.137] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QuizShow.potx") returned -1 [0066.137] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuizShow.potx") returned -1 [0066.137] lstrcmpiA (lpString1="", lpString2="QuizShow.potx") returned -1 [0066.137] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\PROJPLAN.XLTX") returned="PROJPLAN.XLTX" [0066.137] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.137] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.137] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b91500, ftCreationTime.dwHighDateTime=0x1c7c8e6, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77b91500, ftLastWriteTime.dwHighDateTime=0x1c7c8e6, nFileSizeHigh=0x0, nFileSizeLow=0xa8ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="SalesReport.xltx", cAlternateFileName="SALESR~1.XLT")) returned 1 [0066.137] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.137] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SalesReport.xltx") returned -1 [0066.137] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SalesReport.xltx") returned -1 [0066.138] lstrcmpiA (lpString1="", lpString2="SalesReport.xltx") returned -1 [0066.138] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\QuizShow.potx") returned="QuizShow.potx" [0066.138] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.138] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.138] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88423a00, ftCreationTime.dwHighDateTime=0x1c99e00, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x88423a00, ftLastWriteTime.dwHighDateTime=0x1c99e00, nFileSizeHigh=0x0, nFileSizeLow=0x2aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKLIST.XLTX", cAlternateFileName="TASKLI~1.XLT")) returned 1 [0066.138] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.138] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TASKLIST.XLTX") returned -1 [0066.138] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TASKLIST.XLTX") returned -1 [0066.138] lstrcmpiA (lpString1="", lpString2="TASKLIST.XLTX") returned -1 [0066.138] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\SalesReport.xltx") returned="SalesReport.xltx" [0066.138] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.138] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.138] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b91500, ftCreationTime.dwHighDateTime=0x1c7c8e6, ftLastAccessTime.dwLowDateTime=0xfa697690, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77b91500, ftLastWriteTime.dwHighDateTime=0x1c7c8e6, nFileSizeHigh=0x0, nFileSizeLow=0x44ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="TimeCard.xltx", cAlternateFileName="TIMECA~1.XLT")) returned 1 [0066.138] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.138] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="TimeCard.xltx") returned -1 [0066.138] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TimeCard.xltx") returned -1 [0066.138] lstrcmpiA (lpString1="", lpString2="TimeCard.xltx") returned -1 [0066.138] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\TASKLIST.XLTX") returned="TASKLIST.XLTX" [0066.138] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.138] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.138] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22cf4600, ftCreationTime.dwHighDateTime=0x1ca8f08, ftLastAccessTime.dwLowDateTime=0xf5ebbe70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x22cf4600, ftLastWriteTime.dwHighDateTime=0x1ca8f08, nFileSizeHigh=0x0, nFileSizeLow=0x12f35d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Training.potx", cAlternateFileName="TRAINI~1.POT")) returned 1 [0066.138] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.138] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Training.potx") returned -1 [0066.139] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Training.potx") returned -1 [0066.139] lstrcmpiA (lpString1="", lpString2="Training.potx") returned -1 [0066.139] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\TimeCard.xltx") returned="TimeCard.xltx" [0066.139] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.139] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.139] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1c5f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="UrbanLetter.Dotx", cAlternateFileName="URBANL~1.DOT")) returned 1 [0066.139] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.139] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UrbanLetter.Dotx") returned -1 [0066.139] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UrbanLetter.Dotx") returned -1 [0066.139] lstrcmpiA (lpString1="", lpString2="UrbanLetter.Dotx") returned -1 [0066.139] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Training.potx") returned="Training.potx" [0066.139] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.139] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.139] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x138a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="UrbanMergeFax.Dotx", cAlternateFileName="URBANM~1.DOT")) returned 1 [0066.139] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.139] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UrbanMergeFax.Dotx") returned -1 [0066.139] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UrbanMergeFax.Dotx") returned -1 [0066.139] lstrcmpiA (lpString1="", lpString2="UrbanMergeFax.Dotx") returned -1 [0066.139] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanLetter.Dotx") returned="UrbanLetter.Dotx" [0066.139] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.139] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.140] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1c1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UrbanMergeLetter.Dotx", cAlternateFileName="URBANM~2.DOT")) returned 1 [0066.140] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.140] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UrbanMergeLetter.Dotx") returned -1 [0066.140] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UrbanMergeLetter.Dotx") returned -1 [0066.140] lstrcmpiA (lpString1="", lpString2="UrbanMergeLetter.Dotx") returned -1 [0066.140] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanMergeFax.Dotx") returned="UrbanMergeFax.Dotx" [0066.140] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.140] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.140] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x219e1900, ftCreationTime.dwHighDateTime=0x1ca8f08, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x219e1900, ftLastWriteTime.dwHighDateTime=0x1ca8f08, nFileSizeHigh=0x0, nFileSizeLow=0x40d6e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="UrbanPhotoAlbum.potx", cAlternateFileName="URBANP~1.POT")) returned 1 [0066.140] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.140] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UrbanPhotoAlbum.potx") returned -1 [0066.140] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UrbanPhotoAlbum.potx") returned -1 [0066.140] lstrcmpiA (lpString1="", lpString2="UrbanPhotoAlbum.potx") returned -1 [0066.140] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanMergeLetter.Dotx") returned="UrbanMergeLetter.Dotx" [0066.140] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.140] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.140] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0xd0fbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="UrbanReport.Dotx", cAlternateFileName="URBANR~1.DOT")) returned 1 [0066.140] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.140] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="UrbanReport.Dotx") returned -1 [0066.140] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanPhotoAlbum.potx") returned="UrbanPhotoAlbum.potx" [0066.140] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.140] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.141] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x1ed1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="UrbanResume.Dotx", cAlternateFileName="URBANR~2.DOT")) returned 1 [0066.141] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.141] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanReport.Dotx") returned="UrbanReport.Dotx" [0066.141] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.141] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.141] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29d4c00, ftCreationTime.dwHighDateTime=0x1c6d972, ftLastAccessTime.dwLowDateTime=0xf5ebbe70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x29d4c00, ftLastWriteTime.dwHighDateTime=0x1c6d972, nFileSizeHigh=0x0, nFileSizeLow=0x2df34, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidescreenPresentation.potx", cAlternateFileName="WIDESC~1.POT")) returned 1 [0066.141] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.141] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanResume.Dotx") returned="UrbanResume.Dotx" [0066.141] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0066.141] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="" [0066.141] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29d4c00, ftCreationTime.dwHighDateTime=0x1c6d972, ftLastAccessTime.dwLowDateTime=0xf5ebbe70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x29d4c00, ftLastWriteTime.dwHighDateTime=0x1c6d972, nFileSizeHigh=0x0, nFileSizeLow=0x2df34, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidescreenPresentation.potx", cAlternateFileName="WIDESC~1.POT")) returned 0 [0066.141] FindClose (in: hFindFile=0x2e3438 | out: hFindFile=0x2e3438) returned 1 [0066.141] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 1 [0066.141] lstrcmpA (lpString1=".", lpString2="Presentation Designs") returned -1 [0066.141] lstrcmpA (lpString1="..", lpString2="Presentation Designs") returned -1 [0066.141] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\*.*") returned="*.*" [0066.141] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0066.141] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.141] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.142] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.142] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.142] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a1600, ftCreationTime.dwHighDateTime=0x1c65230, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb67a1600, ftLastWriteTime.dwHighDateTime=0x1c65230, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Maple.gif", cAlternateFileName="")) returned 1 [0066.142] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.142] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\*.*") returned="*.*" [0066.142] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\" [0066.142] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\") returned="" [0066.143] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.143] CloseHandle (hObject=0x8c) returned 1 [0066.143] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a1600, ftCreationTime.dwHighDateTime=0x1c65230, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb67a1600, ftLastWriteTime.dwHighDateTime=0x1c65230, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Maple.gif", cAlternateFileName="")) returned 0 [0066.144] FindClose (in: hFindFile=0x2e3438 | out: hFindFile=0x2e3438) returned 1 [0066.144] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 0 [0066.144] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0066.144] FindNextFileA (in: hFindFile=0x2d6fb0, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe74f170, ftCreationTime.dwHighDateTime=0x1d55b1a, ftLastAccessTime.dwLowDateTime=0x54945ac0, ftLastAccessTime.dwHighDateTime=0x1d5b790, ftLastWriteTime.dwLowDateTime=0x54945ac0, ftLastWriteTime.dwHighDateTime=0x1d5b790, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x650054, dwReserved1=0x3, cFileName="utg2.exe", cAlternateFileName="")) returned 1 [0066.144] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.144] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\*.*") returned="*.*" [0066.144] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Office\\" | out: lpString1="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0066.144] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Office\\" | out: pszPath="C:\\Program Files\\Microsoft Office\\") returned="" [0066.144] FindNextFileA (in: hFindFile=0x2d6fb0, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe74f170, ftCreationTime.dwHighDateTime=0x1d55b1a, ftLastAccessTime.dwLowDateTime=0x54945ac0, ftLastAccessTime.dwHighDateTime=0x1d5b790, ftLastWriteTime.dwLowDateTime=0x54945ac0, ftLastWriteTime.dwHighDateTime=0x1d5b790, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x650054, dwReserved1=0x3, cFileName="utg2.exe", cAlternateFileName="")) returned 0 [0066.144] FindClose (in: hFindFile=0x2d6fb0 | out: hFindFile=0x2d6fb0) returned 1 [0066.144] FindNextFileA (in: hFindFile=0x2d5f10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdfb78b20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfb78b20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Microsoft SQL Server Compact Edition", cAlternateFileName="MICROS~3")) returned 1 [0066.144] lstrcmpA (lpString1=".", lpString2="Microsoft SQL Server Compact Edition") returned -1 [0066.144] lstrcmpA (lpString1="..", lpString2="Microsoft SQL Server Compact Edition") returned -1 [0066.144] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*" [0066.144] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdfb78b20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfb78b20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0066.144] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.144] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdfb78b20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfb78b20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.144] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.144] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.144] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a644e00, ftCreationTime.dwHighDateTime=0x1d5bb1d, ftLastAccessTime.dwLowDateTime=0x9b124a80, ftLastAccessTime.dwHighDateTime=0x1d58f3a, ftLastWriteTime.dwLowDateTime=0x9b124a80, ftLastWriteTime.dwHighDateTime=0x1d58f3a, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="card.exe", cAlternateFileName="")) returned 1 [0066.145] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.145] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*.*") returned="*.*" [0066.145] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft SQL Server Compact Edition\\" | out: lpString1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\" [0066.145] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\" | out: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\") returned="" [0066.146] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.146] CloseHandle (hObject=0x84) returned 1 [0066.146] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68c26e90, ftCreationTime.dwHighDateTime=0x1d5c2f0, ftLastAccessTime.dwLowDateTime=0x5450f1e0, ftLastAccessTime.dwHighDateTime=0x1d5e14d, ftLastWriteTime.dwLowDateTime=0x5450f1e0, ftLastWriteTime.dwHighDateTime=0x1d5e14d, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="cruises till.exe", cAlternateFileName="CRUISE~1.EXE")) returned 1 [0066.146] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.146] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\card.exe") returned="card.exe" [0066.146] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft SQL Server Compact Edition\\" | out: lpString1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\" [0066.146] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\" | out: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\") returned="" [0066.146] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0066.146] lstrcmpA (lpString1=".", lpString2="v3.5") returned -1 [0066.146] lstrcmpA (lpString1="..", lpString2="v3.5") returned -1 [0066.146] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\cruises till.exe") returned="cruises till.exe" [0066.146] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x2da454, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0066.148] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.148] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.148] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.148] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.148] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0066.148] lstrcmpA (lpString1=".", lpString2="Desktop") returned -1 [0066.148] lstrcmpA (lpString1="..", lpString2="Desktop") returned -1 [0066.148] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*.*") returned="*.*" [0066.148] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0066.149] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.149] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.149] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.149] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.149] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 0 [0066.149] FindClose (in: hFindFile=0x2e3478 | out: hFindFile=0x2e3478) returned 1 [0066.149] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab6f770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x8b840, dwReserved0=0x650044, dwReserved1=0x3, cFileName="sqlceca35.dll", cAlternateFileName="SQLCEC~1.DLL")) returned 1 [0066.149] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.149] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*.*") returned="*.*" [0066.149] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" | out: lpString1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" [0066.149] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" | out: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned="" [0066.150] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.150] CloseHandle (hObject=0x88) returned 1 [0066.150] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x1d040, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlcecompact35.dll", cAlternateFileName="SQLCEC~2.DLL")) returned 1 [0066.150] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.150] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceca35.dll") returned="sqlceca35.dll" [0066.151] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" | out: lpString1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" [0066.151] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" | out: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned="" [0066.151] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab6f770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x24440, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceer35EN.dll", cAlternateFileName="SQLCEE~1.DLL")) returned 1 [0066.151] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.151] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlcecompact35.dll") returned="sqlcecompact35.dll" [0066.151] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" | out: lpString1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" [0066.151] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" | out: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned="" [0066.151] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab958d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x15a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceme35.dll", cAlternateFileName="SQLCEM~1.DLL")) returned 1 [0066.151] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.151] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceer35EN.dll") returned="sqlceer35EN.dll" [0066.151] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" | out: lpString1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" [0066.151] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" | out: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned="" [0066.151] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x3fa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceoledb35.dll", cAlternateFileName="SQLCEO~1.DLL")) returned 1 [0066.151] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.151] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceme35.dll") returned="sqlceme35.dll" [0066.151] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" | out: lpString1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" [0066.151] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" | out: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned="" [0066.151] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb18300, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdeb18300, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x114e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceqp35.dll", cAlternateFileName="SQLCEQ~1.DLL")) returned 1 [0066.151] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.151] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceoledb35.dll") returned="sqlceoledb35.dll" [0066.151] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" | out: lpString1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" [0066.151] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" | out: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned="" [0066.152] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb18300, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5abbba30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdeb18300, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x9d640, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlcese35.dll", cAlternateFileName="SQLCES~1.DLL")) returned 1 [0066.152] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.152] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\sqlceqp35.dll") returned="sqlceqp35.dll" [0066.152] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" | out: lpString1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" [0066.152] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" | out: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned="" [0066.152] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb18300, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5abbba30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdeb18300, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x9d640, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlcese35.dll", cAlternateFileName="SQLCES~1.DLL")) returned 0 [0066.152] FindClose (in: hFindFile=0x2e3438 | out: hFindFile=0x2e3438) returned 1 [0066.152] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5530880, ftCreationTime.dwHighDateTime=0x1d5e4bc, ftLastAccessTime.dwLowDateTime=0xaabb4000, ftLastAccessTime.dwHighDateTime=0x1d5c92c, ftLastWriteTime.dwLowDateTime=0xaabb4000, ftLastWriteTime.dwHighDateTime=0x1d5c92c, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="winscp.exe", cAlternateFileName="")) returned 1 [0066.152] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.152] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*.*") returned="*.*" [0066.152] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft SQL Server Compact Edition\\" | out: lpString1="C:\\Program Files\\Microsoft SQL Server Compact Edition\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\" [0066.152] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\" | out: pszPath="C:\\Program Files\\Microsoft SQL Server Compact Edition\\") returned="" [0066.152] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5530880, ftCreationTime.dwHighDateTime=0x1d5e4bc, ftLastAccessTime.dwLowDateTime=0xaabb4000, ftLastAccessTime.dwHighDateTime=0x1d5c92c, ftLastWriteTime.dwLowDateTime=0xaabb4000, ftLastWriteTime.dwHighDateTime=0x1d5c92c, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="winscp.exe", cAlternateFileName="")) returned 0 [0066.152] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0066.152] FindNextFileA (in: hFindFile=0x2d5f10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdd8f4c20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd8f4c20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Microsoft Sync Framework", cAlternateFileName="MICROS~4")) returned 1 [0066.152] lstrcmpA (lpString1=".", lpString2="Microsoft Sync Framework") returned -1 [0066.152] lstrcmpA (lpString1="..", lpString2="Microsoft Sync Framework") returned -1 [0066.152] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*" [0066.152] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdd8f4c20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd8f4c20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0066.152] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.152] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdd8f4c20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd8f4c20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.153] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.153] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.153] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4ff2b10, ftCreationTime.dwHighDateTime=0x1d58ad4, ftLastAccessTime.dwLowDateTime=0xba521180, ftLastAccessTime.dwHighDateTime=0x1d5b1e7, ftLastWriteTime.dwLowDateTime=0xba521180, ftLastWriteTime.dwHighDateTime=0x1d5b1e7, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="mxslipstream.exe", cAlternateFileName="MXSLIP~1.EXE")) returned 1 [0066.153] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.153] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Sync Framework\\*.*") returned="*.*" [0066.153] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Sync Framework\\" | out: lpString1="C:\\Program Files\\Microsoft Sync Framework\\") returned="C:\\Program Files\\Microsoft Sync Framework\\" [0066.153] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Sync Framework\\" | out: pszPath="C:\\Program Files\\Microsoft Sync Framework\\") returned="" [0066.156] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.156] CloseHandle (hObject=0x84) returned 1 [0066.156] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 1 [0066.156] lstrcmpA (lpString1=".", lpString2="v1.0") returned -1 [0066.156] lstrcmpA (lpString1="..", lpString2="v1.0") returned -1 [0066.156] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Sync Framework\\mxslipstream.exe") returned="mxslipstream.exe" [0066.156] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2da43c, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0066.156] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.156] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.156] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.156] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.156] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Documentation", cAlternateFileName="DOCUME~1")) returned 1 [0066.157] lstrcmpA (lpString1=".", lpString2="Documentation") returned -1 [0066.157] lstrcmpA (lpString1="..", lpString2="Documentation") returned -1 [0066.157] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*.*") returned="*.*" [0066.157] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0066.157] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.157] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.158] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.158] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.158] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0066.158] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0066.158] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0066.158] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\*.*") returned="*.*" [0066.158] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d6f58, dwReserved1=0x2d6f53, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.158] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.158] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.159] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.159] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.159] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="License Agreements", cAlternateFileName="LICENS~1")) returned 1 [0066.159] lstrcmpA (lpString1=".", lpString2="License Agreements") returned -1 [0066.159] lstrcmpA (lpString1="..", lpString2="License Agreements") returned -1 [0066.159] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\*.*") returned="*.*" [0066.159] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d7f60, dwReserved1=0x2d7f5b, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0066.159] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.159] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.159] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.159] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.159] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb2b9400, ftCreationTime.dwHighDateTime=0x1c9c55a, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb2b9400, ftLastWriteTime.dwHighDateTime=0x1c9c55a, nFileSizeHigh=0x0, nFileSizeLow=0x1afd7, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SynchronizationEula.rtf", cAlternateFileName="SYNCHR~1.RTF")) returned 1 [0066.159] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.159] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\*.*") returned="*.*" [0066.159] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\" | out: lpString1="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\" [0066.159] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\" | out: pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\") returned="" [0066.160] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.160] CloseHandle (hObject=0x94) returned 1 [0066.161] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb2b9400, ftCreationTime.dwHighDateTime=0x1c9c55a, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb2b9400, ftLastWriteTime.dwHighDateTime=0x1c9c55a, nFileSizeHigh=0x0, nFileSizeLow=0x1afd7, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SynchronizationEula.rtf", cAlternateFileName="SYNCHR~1.RTF")) returned 0 [0066.161] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0066.161] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="License Agreements", cAlternateFileName="LICENS~1")) returned 0 [0066.161] FindClose (in: hFindFile=0x2e34b8 | out: hFindFile=0x2e34b8) returned 1 [0066.161] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0066.161] FindClose (in: hFindFile=0x2e3478 | out: hFindFile=0x2e3478) returned 1 [0066.161] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0044, dwReserved1=0x3, cFileName="Runtime", cAlternateFileName="")) returned 1 [0066.161] lstrcmpA (lpString1=".", lpString2="Runtime") returned -1 [0066.161] lstrcmpA (lpString1="..", lpString2="Runtime") returned -1 [0066.161] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*.*") returned="*.*" [0066.161] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300031, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0066.161] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.161] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.161] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.161] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.161] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1 [0066.161] lstrcmpA (lpString1=".", lpString2="x64") returned -1 [0066.161] lstrcmpA (lpString1="..", lpString2="x64") returned -1 [0066.161] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\*.*") returned="*.*" [0066.161] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d6f58, dwReserved1=0x2d6f53, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.164] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.164] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.164] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.164] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.164] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x38770, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="FeedSync.dll", cAlternateFileName="")) returned 1 [0066.164] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.164] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\*.*") returned="*.*" [0066.164] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\" | out: lpString1="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\" [0066.164] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\" | out: pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\") returned="" [0066.165] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.165] CloseHandle (hObject=0x90) returned 1 [0066.165] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c136700, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c136700, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x33760, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0066.165] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.165] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll") returned="FeedSync.dll" [0066.165] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\" | out: lpString1="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\" [0066.165] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\" | out: pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\") returned="" [0066.165] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources", cAlternateFileName="RESOUR~1")) returned 1 [0066.165] lstrcmpA (lpString1=".", lpString2="resources") returned -1 [0066.166] lstrcmpA (lpString1="..", lpString2="resources") returned -1 [0066.166] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll") returned="Microsoft.Synchronization.dll" [0066.166] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2df466, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0066.166] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.167] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.167] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.167] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.167] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0066.167] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0066.167] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0066.167] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\*.*") returned="*.*" [0066.167] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df3c0, dwReserved1=0x2df3bb, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0066.167] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.167] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.167] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.167] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.167] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f772f00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f772f00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x3170, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Synchronization.rll", cAlternateFileName="SYNCHR~1.RLL")) returned 1 [0066.167] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0066.167] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\*.*") returned="*.*" [0066.168] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\" | out: lpString1="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\" [0066.168] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\" | out: pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\") returned="" [0066.169] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.169] CloseHandle (hObject=0x98) returned 1 [0066.169] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f772f00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f772f00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x3170, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Synchronization.rll", cAlternateFileName="SYNCHR~1.RLL")) returned 0 [0066.169] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0066.169] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0066.169] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0066.169] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x6db60, dwReserved0=0x650072, dwReserved1=0x3, cFileName="Synchronization.dll", cAlternateFileName="SYNCHR~1.DLL")) returned 1 [0066.169] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.169] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\*.*") returned="*.*" [0066.169] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\" | out: lpString1="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\" [0066.169] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\" | out: pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\") returned="" [0066.169] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x6db60, dwReserved0=0x650072, dwReserved1=0x3, cFileName="Synchronization.dll", cAlternateFileName="SYNCHR~1.DLL")) returned 0 [0066.170] FindClose (in: hFindFile=0x2e34b8 | out: hFindFile=0x2e34b8) returned 1 [0066.170] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 0 [0066.170] FindClose (in: hFindFile=0x2e3478 | out: hFindFile=0x2e3478) returned 1 [0066.170] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f0044, dwReserved1=0x3, cFileName="Runtime", cAlternateFileName="")) returned 0 [0066.170] FindClose (in: hFindFile=0x2e3438 | out: hFindFile=0x2e3438) returned 1 [0066.170] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0 [0066.170] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0066.170] FindNextFileA (in: hFindFile=0x2d5f10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdd777e60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd777e60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Microsoft Synchronization Services", cAlternateFileName="MID7C0~1")) returned 1 [0066.170] lstrcmpA (lpString1=".", lpString2="Microsoft Synchronization Services") returned -1 [0066.170] lstrcmpA (lpString1="..", lpString2="Microsoft Synchronization Services") returned -1 [0066.170] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*" [0066.170] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdd777e60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd777e60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x310076, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0066.171] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.171] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdd777e60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd777e60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.171] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.171] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.171] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50159770, ftCreationTime.dwHighDateTime=0x1d57b9a, ftLastAccessTime.dwLowDateTime=0x3841ef40, ftLastAccessTime.dwHighDateTime=0x1d55ac5, ftLastWriteTime.dwLowDateTime=0x3841ef40, ftLastWriteTime.dwHighDateTime=0x1d55ac5, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="active-charge.exe", cAlternateFileName="ACTIVE~1.EXE")) returned 1 [0066.171] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.171] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Synchronization Services\\*.*") returned="*.*" [0066.171] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Synchronization Services\\" | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\") returned="C:\\Program Files\\Microsoft Synchronization Services\\" [0066.171] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Synchronization Services\\" | out: pszPath="C:\\Program Files\\Microsoft Synchronization Services\\") returned="" [0066.174] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.174] CloseHandle (hObject=0x84) returned 1 [0066.174] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO.NET", cAlternateFileName="")) returned 1 [0066.174] lstrcmpA (lpString1=".", lpString2="ADO.NET") returned -1 [0066.174] lstrcmpA (lpString1="..", lpString2="ADO.NET") returned -1 [0066.174] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Synchronization Services\\active-charge.exe") returned="active-charge.exe" [0066.174] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2da450, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0066.174] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.174] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.174] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.174] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.174] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 1 [0066.174] lstrcmpA (lpString1=".", lpString2="v1.0") returned -1 [0066.174] lstrcmpA (lpString1="..", lpString2="v1.0") returned -1 [0066.175] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*.*") returned="*.*" [0066.175] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0066.177] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.177] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.177] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.177] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.177] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b72c500, ftCreationTime.dwHighDateTime=0x1c8bd0c, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b72c500, ftLastWriteTime.dwHighDateTime=0x1c8bd0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c420, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Synchronization.Data.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0066.177] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.177] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\*.*") returned="*.*" [0066.177] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\" | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\" [0066.177] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\" | out: pszPath="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\") returned="" [0066.179] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.179] CloseHandle (hObject=0x8c) returned 1 [0066.179] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b72c500, ftCreationTime.dwHighDateTime=0x1c8bd0c, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b72c500, ftLastWriteTime.dwHighDateTime=0x1c8bd0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c420, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.Data.Server.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0066.179] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.179] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.dll") returned="Microsoft.Synchronization.Data.dll" [0066.179] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\" | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\" [0066.179] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\" | out: pszPath="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\") returned="" [0066.179] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74481500, ftCreationTime.dwHighDateTime=0x1c8d683, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74481500, ftLastWriteTime.dwHighDateTime=0x1c8d683, nFileSizeHigh=0x0, nFileSizeLow=0x17450, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Microsoft.Synchronization.Data.SqlServerCe.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0066.179] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0066.179] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll") returned="Microsoft.Synchronization.Data.Server.dll" [0066.180] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\" | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\" [0066.180] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\" | out: pszPath="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\") returned="" [0066.180] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74481500, ftCreationTime.dwHighDateTime=0x1c8d683, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74481500, ftLastWriteTime.dwHighDateTime=0x1c8d683, nFileSizeHigh=0x0, nFileSizeLow=0x17450, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName="Microsoft.Synchronization.Data.SqlServerCe.dll", cAlternateFileName="MICROS~2.DLL")) returned 0 [0066.180] FindClose (in: hFindFile=0x2e3478 | out: hFindFile=0x2e3478) returned 1 [0066.180] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0 [0066.180] FindClose (in: hFindFile=0x2e3438 | out: hFindFile=0x2e3438) returned 1 [0066.180] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9fe5030, ftCreationTime.dwHighDateTime=0x1d5bc1b, ftLastAccessTime.dwLowDateTime=0xaccd2840, ftLastAccessTime.dwHighDateTime=0x1d55e3d, ftLastWriteTime.dwLowDateTime=0xaccd2840, ftLastWriteTime.dwHighDateTime=0x1d55e3d, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x440041, dwReserved1=0x3, cFileName="totalcmd.exe", cAlternateFileName="")) returned 1 [0066.180] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.180] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Synchronization Services\\*.*") returned="*.*" [0066.180] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Microsoft Synchronization Services\\" | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\") returned="C:\\Program Files\\Microsoft Synchronization Services\\" [0066.180] PathAddBackslashA (in: pszPath="C:\\Program Files\\Microsoft Synchronization Services\\" | out: pszPath="C:\\Program Files\\Microsoft Synchronization Services\\") returned="" [0066.180] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9fe5030, ftCreationTime.dwHighDateTime=0x1d5bc1b, ftLastAccessTime.dwLowDateTime=0xaccd2840, ftLastAccessTime.dwHighDateTime=0x1d55e3d, ftLastWriteTime.dwLowDateTime=0xaccd2840, ftLastWriteTime.dwHighDateTime=0x1d55e3d, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x440041, dwReserved1=0x3, cFileName="totalcmd.exe", cAlternateFileName="")) returned 0 [0066.180] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0066.180] FindNextFileA (in: hFindFile=0x2d5f10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0066.180] lstrcmpA (lpString1=".", lpString2="MSBuild") returned -1 [0066.181] lstrcmpA (lpString1="..", lpString2="MSBuild") returned -1 [0066.181] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*" [0066.181] FindFirstFileA (in: lpFileName="C:\\Program Files\\MSBuild\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0066.181] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.181] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.181] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.181] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.181] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0066.181] lstrcmpA (lpString1=".", lpString2="Microsoft") returned -1 [0066.181] lstrcmpA (lpString1="..", lpString2="Microsoft") returned -1 [0066.181] PathFindFileNameA (pszPath="C:\\Program Files\\MSBuild\\*.*") returned="*.*" [0066.181] FindFirstFileA (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0066.182] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.182] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.182] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.182] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.182] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 1 [0066.183] lstrcmpA (lpString1=".", lpString2="Windows Workflow Foundation") returned -1 [0066.183] lstrcmpA (lpString1="..", lpString2="Windows Workflow Foundation") returned -1 [0066.183] PathFindFileNameA (pszPath="C:\\Program Files\\MSBuild\\Microsoft\\*.*") returned="*.*" [0066.183] FindFirstFileA (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0066.183] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.183] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.183] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.183] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.183] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0066.183] lstrcmpA (lpString1=".", lpString2="v3.0") returned -1 [0066.183] lstrcmpA (lpString1="..", lpString2="v3.0") returned -1 [0066.183] PathFindFileNameA (pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*.*") returned="*.*" [0066.183] FindFirstFileA (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d6f58, dwReserved1=0x2d6f53, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.183] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.184] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.184] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.184] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.184] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="WORKFL~1.TAR")) returned 1 [0066.184] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.184] PathFindFileNameA (pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*.*") returned="*.*" [0066.184] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" [0066.184] PathAddBackslashA (in: pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" | out: pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned="" [0066.187] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.187] CloseHandle (hObject=0x90) returned 1 [0066.187] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="WORKFL~2.TAR")) returned 1 [0066.187] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.187] PathFindFileNameA (pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets") returned="Workflow.Targets" [0066.187] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" [0066.187] PathAddBackslashA (in: pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" | out: pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned="" [0066.187] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="WORKFL~2.TAR")) returned 0 [0066.187] FindClose (in: hFindFile=0x2e34b8 | out: hFindFile=0x2e34b8) returned 1 [0066.187] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="v3.5", cAlternateFileName="")) returned 1 [0066.187] lstrcmpA (lpString1=".", lpString2="v3.5") returned -1 [0066.187] lstrcmpA (lpString1="..", lpString2="v3.5") returned -1 [0066.188] PathFindFileNameA (pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*.*") returned="*.*" [0066.188] FindFirstFileA (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4c0049, dwReserved1=0x530045, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.188] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.188] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x530000, cFileName="..", cAlternateFileName="")) returned 1 [0066.188] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.188] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.188] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56230575, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0x56230575, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0x562566d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1c01, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="")) returned 1 [0066.188] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.188] PathFindFileNameA (pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*.*") returned="*.*" [0066.188] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\" [0066.188] PathAddBackslashA (in: pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\" | out: pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\") returned="" [0066.189] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.190] CloseHandle (hObject=0x90) returned 1 [0066.190] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c9fc12, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x8c9fc12, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5627c831, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="")) returned 1 [0066.190] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.190] PathFindFileNameA (pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets") returned="Workflow.Targets" [0066.190] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\" [0066.190] PathAddBackslashA (in: pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\" | out: pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\") returned="" [0066.190] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c9fc12, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x8c9fc12, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5627c831, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="")) returned 0 [0066.190] FindClose (in: hFindFile=0x2e34b8 | out: hFindFile=0x2e34b8) returned 1 [0066.190] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="v3.5", cAlternateFileName="")) returned 0 [0066.190] FindClose (in: hFindFile=0x2e3478 | out: hFindFile=0x2e3478) returned 1 [0066.190] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0066.190] FindClose (in: hFindFile=0x2e3438 | out: hFindFile=0x2e3438) returned 1 [0066.191] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0066.191] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0066.191] FindNextFileA (in: hFindFile=0x2d5f10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdd6df8e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd6df8e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x53004d, dwReserved1=0x3, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0066.191] lstrcmpA (lpString1=".", lpString2="Reference Assemblies") returned -1 [0066.191] lstrcmpA (lpString1="..", lpString2="Reference Assemblies") returned -1 [0066.191] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*" [0066.191] FindFirstFileA (in: lpFileName="C:\\Program Files\\Reference Assemblies\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdd6df8e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd6df8e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0066.191] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.191] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdd6df8e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd6df8e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.191] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.191] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fd6a0, ftCreationTime.dwHighDateTime=0x1d587b3, ftLastAccessTime.dwLowDateTime=0xdbbcff10, ftLastAccessTime.dwHighDateTime=0x1d5e2fc, ftLastWriteTime.dwLowDateTime=0xdbbcff10, ftLastWriteTime.dwHighDateTime=0x1d5e2fc, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="3dftp.exe", cAlternateFileName="")) returned 1 [0066.191] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.191] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\*.*") returned="*.*" [0066.191] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\") returned="C:\\Program Files\\Reference Assemblies\\" [0066.191] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\") returned="" [0066.195] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0066.195] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\3dftp.exe") returned="3dftp.exe" [0066.195] FindFirstFileA (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2da434, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0066.195] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.195] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 1 [0066.195] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\*.*") returned="*.*" [0066.195] FindFirstFileA (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0066.195] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.196] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0066.196] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*.*") returned="*.*" [0066.196] FindFirstFileA (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d6f58, dwReserved1=0x2d6f53, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.198] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.198] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa981eb4a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa981eb4a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa981eb4a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x92000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="PresentationBuildTasks.dll", cAlternateFileName="")) returned 1 [0066.198] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.233] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*.*") returned="*.*" [0066.233] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0066.233] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="" [0066.235] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa990338c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa990338c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa99757ac, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3d0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationCore.dll", cAlternateFileName="")) returned 1 [0066.235] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.235] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll") returned="PresentationBuildTasks.dll" [0066.235] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0066.235] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="" [0066.235] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x993ade39, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x993ade39, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5b475983, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PresentationFramework.Aero.dll", cAlternateFileName="")) returned 1 [0066.235] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.235] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll") returned="PresentationCore.dll" [0066.235] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0066.235] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="" [0066.235] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x994463ad, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x994463ad, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5b72321f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PresentationFramework.Classic.dll", cAlternateFileName="")) returned 1 [0066.236] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.236] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll") returned="PresentationFramework.Aero.dll" [0066.236] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0066.236] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="" [0066.236] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa981eb4a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa981eb4a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa98b70cb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x46c000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PresentationFramework.dll", cAlternateFileName="")) returned 1 [0066.236] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.236] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll") returned="PresentationFramework.Classic.dll" [0066.236] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0066.236] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="" [0066.236] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99e17da7, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x99e17da7, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5b807a53, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x5d000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PresentationFramework.Luna.dll", cAlternateFileName="")) returned 1 [0066.236] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.236] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll") returned="PresentationFramework.dll" [0066.236] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0066.236] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="" [0066.236] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99efc5d5, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x99efc5d5, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5cc8f6ff, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="PresentationFramework.Royale.dll", cAlternateFileName="")) returned 1 [0066.236] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.237] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Luna.dll") returned="PresentationFramework.Luna.dll" [0066.237] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0066.237] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="" [0066.237] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa973a308, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa973a308, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9760469, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x82000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="ReachFramework.dll", cAlternateFileName="")) returned 1 [0066.237] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.237] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Royale.dll") returned="PresentationFramework.Royale.dll" [0066.237] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0066.237] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="" [0066.237] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1 [0066.237] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\ReachFramework.dll") returned="ReachFramework.dll" [0066.237] FindFirstFileA (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2df46e, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0066.238] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.238] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803feff7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1bd4, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="FRAMEW~1.XML")) returned 1 [0066.238] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.238] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*.*") returned="*.*" [0066.238] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\" [0066.238] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\") returned="" [0066.239] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803feff7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1bd4, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="FRAMEW~1.XML")) returned 0 [0066.240] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0066.240] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d79cd4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9d79cd4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9d9fe34, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x62000, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1 [0066.240] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.240] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*.*") returned="*.*" [0066.240] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0066.240] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="" [0066.240] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaae31b18, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0xaae31b18, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x53cd8e4b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.IdentityModel.Selectors.dll", cAlternateFileName="")) returned 1 [0066.240] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.240] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.IdentityModel.dll") returned="System.IdentityModel.dll" [0066.240] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0066.240] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="" [0066.240] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaaef01e9, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0xaaef01e9, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x53d25107, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.IO.Log.dll", cAlternateFileName="")) returned 1 [0066.240] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.240] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.IdentityModel.Selectors.dll") returned="System.IdentityModel.Selectors.dll" [0066.240] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0066.240] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="" [0066.241] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa98b70cb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa98b70cb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa98b70cb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x57a00, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.Printing.dll", cAlternateFileName="")) returned 1 [0066.241] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.241] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.IO.Log.dll") returned="System.IO.Log.dll" [0066.241] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0066.241] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="" [0066.241] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9ce1753, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9ce1753, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9d078b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xcf000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.Runtime.Serialization.dll", cAlternateFileName="")) returned 1 [0066.241] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.241] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Printing.dll") returned="System.Printing.dll" [0066.241] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0066.241] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="" [0066.241] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9bfcf11, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9bfcf11, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9c6f332, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x515000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.ServiceModel.dll", cAlternateFileName="")) returned 1 [0066.241] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.241] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Runtime.Serialization.dll") returned="System.Runtime.Serialization.dll" [0066.241] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0066.242] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="" [0066.242] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a53bf17, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9a53bf17, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5cf16e3d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xa8000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.Speech.dll", cAlternateFileName="")) returned 1 [0066.242] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.242] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.ServiceModel.dll") returned="System.ServiceModel.dll" [0066.242] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0066.242] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="" [0066.242] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9655ac7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9655ac7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa967bc27, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x103000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.Workflow.Activities.dll", cAlternateFileName="")) returned 1 [0066.242] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.242] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Speech.dll") returned="System.Speech.dll" [0066.242] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0066.242] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="" [0066.242] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9609806, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9609806, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa962f966, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x173000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.Workflow.ComponentModel.dll", cAlternateFileName="")) returned 1 [0066.242] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.242] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Workflow.Activities.dll") returned="System.Workflow.Activities.dll" [0066.242] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0066.242] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="" [0066.242] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa96a1d87, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa96a1d87, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa96c7ee8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6f000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.Workflow.Runtime.dll", cAlternateFileName="")) returned 1 [0066.242] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.242] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Workflow.ComponentModel.dll") returned="System.Workflow.ComponentModel.dll" [0066.242] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0066.243] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="" [0066.243] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a72b0d0, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9a72b0d0, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5cfaf3b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x2a000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="UIAutomationClient.dll", cAlternateFileName="")) returned 1 [0066.243] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.243] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Workflow.Runtime.dll") returned="System.Workflow.Runtime.dll" [0066.243] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0066.243] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="" [0066.243] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a8f412c, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9a8f412c, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5d04792d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x5d000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="UIAutomationClientsideProviders.dll", cAlternateFileName="")) returned 1 [0066.243] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.243] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationClient.dll") returned="UIAutomationClient.dll" [0066.243] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0066.243] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="" [0066.243] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a98c6a0, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9a98c6a0, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5d106003, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="UIAutomationProvider.dll", cAlternateFileName="")) returned 1 [0066.243] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.243] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationClientsideProviders.dll") returned="UIAutomationClientsideProviders.dll" [0066.243] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0066.243] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="" [0066.244] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aa4ad71, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9aa4ad71, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5d17841d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="UIAutomationTypes.dll", cAlternateFileName="")) returned 1 [0066.244] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.244] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationProvider.dll") returned="UIAutomationProvider.dll" [0066.244] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0066.244] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="" [0066.244] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa97d2889, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa97d2889, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa97f89ea, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x110000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="WindowsBase.dll", cAlternateFileName="")) returned 1 [0066.244] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.244] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationTypes.dll") returned="UIAutomationTypes.dll" [0066.244] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0066.244] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="" [0066.244] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9acf85fb, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9acf85fb, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5d2a8f0d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="WindowsFormsIntegration.dll", cAlternateFileName="")) returned 1 [0066.244] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.245] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WindowsBase.dll") returned="WindowsBase.dll" [0066.245] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0066.245] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="" [0066.245] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803d8e97, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x780074, dwReserved1=0x74, cFileName="WinFXList.xml", cAlternateFileName="WINFXL~1.XML")) returned 1 [0066.245] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.245] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WindowsFormsIntegration.dll") returned="WindowsFormsIntegration.dll" [0066.245] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0066.245] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="" [0066.245] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803d8e97, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x780074, dwReserved1=0x74, cFileName="WinFXList.xml", cAlternateFileName="WINFXL~1.XML")) returned 0 [0066.245] FindClose (in: hFindFile=0x2e34b8 | out: hFindFile=0x2e34b8) returned 1 [0066.245] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="v3.5", cAlternateFileName="")) returned 1 [0066.245] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*.*") returned="*.*" [0066.245] FindFirstFileA (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.247] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.248] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1efbd239, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x1efbd239, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5ce0c4ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Microsoft.Build.Conversion.v3.5.dll", cAlternateFileName="")) returned 1 [0066.248] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.248] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*.*") returned="*.*" [0066.248] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.248] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.249] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xade574cb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xade574cb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xadfae12e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Engine.dll", cAlternateFileName="")) returned 1 [0066.249] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.249] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Conversion.v3.5.dll") returned="Microsoft.Build.Conversion.v3.5.dll" [0066.249] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.249] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.250] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f2b6d7d, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x1f2b6d7d, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5cf16e3d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Microsoft.Build.Framework.dll", cAlternateFileName="")) returned 1 [0066.250] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.250] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Engine.dll") returned="Microsoft.Build.Engine.dll" [0066.250] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.250] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.250] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad64ea7d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad64ea7d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad674bdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Microsoft.Build.Utilities.v3.5.dll", cAlternateFileName="")) returned 1 [0066.250] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.250] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Framework.dll") returned="Microsoft.Build.Framework.dll" [0066.250] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.250] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.250] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f40d9c2, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x1f40d9c2, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5cffb671, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x780074, dwReserved1=0x74, cFileName="Microsoft.VisualC.STLCLR.dll", cAlternateFileName="")) returned 1 [0066.250] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.250] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Utilities.v3.5.dll") returned="Microsoft.Build.Utilities.v3.5.dll" [0066.250] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.250] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.250] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1 [0066.250] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.VisualC.STLCLR.dll") returned="Microsoft.VisualC.STLCLR.dll" [0066.250] FindFirstFileA (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2df46e, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0066.251] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.251] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2273aeba, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x2273aeba, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5d093be9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x5ec3, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 1 [0066.251] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.251] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*.*") returned="*.*" [0066.251] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\" [0066.251] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\") returned="" [0066.252] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2273aeba, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x2273aeba, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5d093be9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x5ec3, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 0 [0066.253] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0066.253] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad69ad3d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad69ad3d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad69ad3d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1 [0066.253] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.253] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*.*") returned="*.*" [0066.253] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.253] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.253] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xace922ee, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xace922ee, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xacfe8f51, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.AddIn.dll", cAlternateFileName="")) returned 1 [0066.253] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.253] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.AddIn.Contract.dll") returned="System.AddIn.Contract.dll" [0066.253] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.253] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.253] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac3b5e7a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xac3b5e7a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xac4c081c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.ComponentModel.DataAnnotations.dll", cAlternateFileName="")) returned 1 [0066.253] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.253] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.AddIn.dll") returned="System.AddIn.dll" [0066.253] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.253] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.254] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae496e97, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xae496e97, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xae5092b8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa3000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.Core.dll", cAlternateFileName="")) returned 1 [0066.254] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.254] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.ComponentModel.DataAnnotations.dll") returned="System.ComponentModel.DataAnnotations.dll" [0066.254] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.254] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.254] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadfae12e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xadfae12e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xadfd428e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.Data.DataSetExtensions.dll", cAlternateFileName="")) returned 1 [0066.254] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.254] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Core.dll") returned="System.Core.dll" [0066.254] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.254] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.254] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac558d9d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xac558d9d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xac6898a0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.Data.Entity.Design.dll", cAlternateFileName="")) returned 1 [0066.254] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.254] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.DataSetExtensions.dll") returned="System.Data.DataSetExtensions.dll" [0066.254] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.255] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.255] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a1495c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0a1495c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0a60c1c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2bf000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.Data.Entity.dll", cAlternateFileName="")) returned 1 [0066.255] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.255] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Entity.Design.dll") returned="System.Data.Entity.Design.dll" [0066.255] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.255] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.255] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac6898a0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xac6898a0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xaca8ddc7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa7000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.Data.Linq.dll", cAlternateFileName="")) returned 1 [0066.255] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.255] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Entity.dll") returned="System.Data.Entity.dll" [0066.255] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.255] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.255] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad6e6ffe, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad6e6ffe, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad7332be, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x71000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.Data.Services.Client.dll", cAlternateFileName="")) returned 1 [0066.255] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.255] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Linq.dll") returned="System.Data.Linq.dll" [0066.255] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.255] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.256] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb097c3db, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb097c3db, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb097c3db, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.Data.Services.Design.dll", cAlternateFileName="")) returned 1 [0066.256] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.256] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Services.Client.dll") returned="System.Data.Services.Client.dll" [0066.256] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.256] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.256] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09a253b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb09a253b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb09c869b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa9000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.Data.Services.dll", cAlternateFileName="")) returned 1 [0066.256] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.256] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Services.Design.dll") returned="System.Data.Services.Design.dll" [0066.256] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.256] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.256] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5092b8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xae5092b8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xae555578, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x47000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.DirectoryServices.AccountManagement.dll", cAlternateFileName="")) returned 1 [0066.256] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.256] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Services.dll") returned="System.Data.Services.dll" [0066.256] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.256] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.257] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb093011a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb093011a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb095627b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.Management.Instrumentation.dll", cAlternateFileName="")) returned 1 [0066.257] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.257] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.DirectoryServices.AccountManagement.dll") returned="System.DirectoryServices.AccountManagement.dll" [0066.257] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.257] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.257] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacfe8f51, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xacfe8f51, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad0cd792, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3a000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.Net.dll", cAlternateFileName="")) returned 1 [0066.257] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.257] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Management.Instrumentation.dll") returned="System.Management.Instrumentation.dll" [0066.257] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.257] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.257] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa96ee048, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa96ee048, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa96ee048, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x78000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.ServiceModel.Web.dll", cAlternateFileName="")) returned 1 [0066.257] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.258] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Net.dll") returned="System.Net.dll" [0066.258] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.258] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.258] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae496e97, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xae496e97, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xae496e97, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.Web.Abstractions.dll", cAlternateFileName="")) returned 1 [0066.258] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.258] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.ServiceModel.Web.dll") returned="System.ServiceModel.Web.dll" [0066.258] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.258] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.258] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabe34b90, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xabe34b90, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xabf193d2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.Web.DynamicData.Design.dll", cAlternateFileName="")) returned 1 [0066.258] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.258] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Abstractions.dll") returned="System.Web.Abstractions.dll" [0066.258] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.258] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.258] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac1ecdf7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xac1ecdf7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xac3b5e7a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.Web.DynamicData.dll", cAlternateFileName="")) returned 1 [0066.258] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.258] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.DynamicData.Design.dll") returned="System.Web.DynamicData.Design.dll" [0066.259] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.259] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.259] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacc30cea, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xacc30cea, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xacd3b68c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.Web.Entity.Design.dll", cAlternateFileName="")) returned 1 [0066.259] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.259] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.DynamicData.dll") returned="System.Web.DynamicData.dll" [0066.259] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.259] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.259] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5edaf9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xae5edaf9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xae71e5fc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.Web.Entity.dll", cAlternateFileName="")) returned 1 [0066.259] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.259] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Entity.Design.dll") returned="System.Web.Entity.Design.dll" [0066.259] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.259] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.259] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadaeb525, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xadaeb525, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xadb11685, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x52000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.Web.Extensions.Design.dll", cAlternateFileName="")) returned 1 [0066.259] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.259] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Entity.dll") returned="System.Web.Entity.dll" [0066.259] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.260] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.260] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab7cf064, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xab7cf064, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xabd0408e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x138000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.Web.Extensions.dll", cAlternateFileName="")) returned 1 [0066.260] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.260] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Extensions.Design.dll") returned="System.Web.Extensions.Design.dll" [0066.260] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.260] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.260] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae97fc00, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xae97fc00, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xae97fc00, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.Web.Routing.dll", cAlternateFileName="")) returned 1 [0066.260] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.260] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Extensions.dll") returned="System.Web.Extensions.dll" [0066.260] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.260] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.260] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a316a7b, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0x6a316a7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0x6a33cbd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.Windows.Presentation.dll", cAlternateFileName="")) returned 1 [0066.260] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.260] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Routing.dll") returned="System.Web.Routing.dll" [0066.260] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.260] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.261] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa96ee048, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa96ee048, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa97141a8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x75000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.WorkflowServices.dll", cAlternateFileName="")) returned 1 [0066.261] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.261] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Windows.Presentation.dll") returned="System.Windows.Presentation.dll" [0066.261] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.261] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.261] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad0cd792, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad0cd792, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad2e2ad6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.Xml.Linq.dll", cAlternateFileName="")) returned 1 [0066.261] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0066.261] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.WorkflowServices.dll") returned="System.WorkflowServices.dll" [0066.261] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0066.261] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="" [0066.261] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad0cd792, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad0cd792, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad2e2ad6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x780074, dwReserved1=0x74, cFileName="System.Xml.Linq.dll", cAlternateFileName="")) returned 0 [0066.261] FindClose (in: hFindFile=0x2e34b8 | out: hFindFile=0x2e34b8) returned 1 [0066.261] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="v3.5", cAlternateFileName="")) returned 0 [0066.261] FindClose (in: hFindFile=0x2e3478 | out: hFindFile=0x2e3478) returned 1 [0066.262] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0 [0066.262] FindClose (in: hFindFile=0x2e3438 | out: hFindFile=0x2e3438) returned 1 [0066.262] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37c1770, ftCreationTime.dwHighDateTime=0x1d5a590, ftLastAccessTime.dwLowDateTime=0x85e67300, ftLastAccessTime.dwHighDateTime=0x1d5e022, ftLastWriteTime.dwLowDateTime=0x85e67300, ftLastWriteTime.dwHighDateTime=0x1d5e022, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x69004d, dwReserved1=0x3, cFileName="smartftp.exe", cAlternateFileName="")) returned 1 [0066.262] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.262] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\*.*") returned="*.*" [0066.262] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Reference Assemblies\\" | out: lpString1="C:\\Program Files\\Reference Assemblies\\") returned="C:\\Program Files\\Reference Assemblies\\" [0066.262] PathAddBackslashA (in: pszPath="C:\\Program Files\\Reference Assemblies\\" | out: pszPath="C:\\Program Files\\Reference Assemblies\\") returned="" [0066.262] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37c1770, ftCreationTime.dwHighDateTime=0x1d5a590, ftLastAccessTime.dwLowDateTime=0x85e67300, ftLastAccessTime.dwHighDateTime=0x1d5e022, ftLastWriteTime.dwLowDateTime=0x85e67300, ftLastWriteTime.dwHighDateTime=0x1d5e022, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x69004d, dwReserved1=0x3, cFileName="smartftp.exe", cAlternateFileName="")) returned 0 [0066.262] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0066.262] FindNextFileA (in: hFindFile=0x2d5f10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xdd647360, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd647360, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0066.262] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*" [0066.262] FindFirstFileA (in: lpFileName="C:\\Program Files\\Uninstall Information\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xdd647360, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd647360, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0066.263] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xdd647360, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd647360, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.263] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea2748b0, ftCreationTime.dwHighDateTime=0x1d5db74, ftLastAccessTime.dwLowDateTime=0x129c2e20, ftLastAccessTime.dwHighDateTime=0x1d587ea, ftLastWriteTime.dwLowDateTime=0x129c2e20, ftLastWriteTime.dwHighDateTime=0x1d587ea, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="alftp.exe", cAlternateFileName="")) returned 1 [0066.263] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.263] PathFindFileNameA (pszPath="C:\\Program Files\\Uninstall Information\\*.*") returned="*.*" [0066.263] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Uninstall Information\\" | out: lpString1="C:\\Program Files\\Uninstall Information\\") returned="C:\\Program Files\\Uninstall Information\\" [0066.263] PathAddBackslashA (in: pszPath="C:\\Program Files\\Uninstall Information\\" | out: pszPath="C:\\Program Files\\Uninstall Information\\") returned="" [0066.264] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26880400, ftCreationTime.dwHighDateTime=0x1d56f07, ftLastAccessTime.dwLowDateTime=0xd3f3f190, ftLastAccessTime.dwHighDateTime=0x1d5c438, ftLastWriteTime.dwLowDateTime=0xd3f3f190, ftLastWriteTime.dwHighDateTime=0x1d5c438, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="garden.exe", cAlternateFileName="")) returned 1 [0066.264] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.265] PathFindFileNameA (pszPath="C:\\Program Files\\Uninstall Information\\alftp.exe") returned="alftp.exe" [0066.265] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Uninstall Information\\" | out: lpString1="C:\\Program Files\\Uninstall Information\\") returned="C:\\Program Files\\Uninstall Information\\" [0066.265] PathAddBackslashA (in: pszPath="C:\\Program Files\\Uninstall Information\\" | out: pszPath="C:\\Program Files\\Uninstall Information\\") returned="" [0066.265] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26880400, ftCreationTime.dwHighDateTime=0x1d56f07, ftLastAccessTime.dwLowDateTime=0xd3f3f190, ftLastAccessTime.dwHighDateTime=0x1d5c438, ftLastWriteTime.dwLowDateTime=0xd3f3f190, ftLastWriteTime.dwHighDateTime=0x1d5c438, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="garden.exe", cAlternateFileName="")) returned 0 [0066.265] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0066.265] FindNextFileA (in: hFindFile=0x2d5f10, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdd6b9780, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd6b9780, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0066.265] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*" [0066.265] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Defender\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdd6b9780, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd6b9780, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0066.265] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdd6b9780, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd6b9780, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.265] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4275b190, ftCreationTime.dwHighDateTime=0x1d5de5a, ftLastAccessTime.dwLowDateTime=0xd8c32960, ftLastAccessTime.dwHighDateTime=0x1d5d43d, ftLastWriteTime.dwLowDateTime=0xd8c32960, ftLastWriteTime.dwHighDateTime=0x1d5d43d, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="box has.exe", cAlternateFileName="BOXHAS~1.EXE")) returned 1 [0066.265] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.265] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\*.*") returned="*.*" [0066.265] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\" [0066.265] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\" | out: pszPath="C:\\Program Files\\Windows Defender\\") returned="" [0066.267] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0066.267] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\box has.exe") returned="box has.exe" [0066.267] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d1294, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0066.267] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23376857, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.267] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe494541, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe494541, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MpAsDesc.dll.mui", cAlternateFileName="")) returned 1 [0066.268] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.268] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\en-US\\*.*") returned="*.*" [0066.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\en-US\\" | out: lpString1="C:\\Program Files\\Windows Defender\\en-US\\") returned="C:\\Program Files\\Windows Defender\\en-US\\" [0066.268] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\en-US\\" | out: pszPath="C:\\Program Files\\Windows Defender\\en-US\\") returned="" [0066.269] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd37ad, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcd37ad, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpEvMsg.dll.mui", cAlternateFileName="")) returned 1 [0066.269] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.269] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui") returned="MpAsDesc.dll.mui" [0066.269] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\en-US\\" | out: lpString1="C:\\Program Files\\Windows Defender\\en-US\\") returned="C:\\Program Files\\Windows Defender\\en-US\\" [0066.269] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\en-US\\" | out: pszPath="C:\\Program Files\\Windows Defender\\en-US\\") returned="" [0066.269] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe494541, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe494541, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsMpRes.dll.mui", cAlternateFileName="")) returned 1 [0066.269] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.269] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui") returned="MpEvMsg.dll.mui" [0066.269] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\en-US\\" | out: lpString1="C:\\Program Files\\Windows Defender\\en-US\\") returned="C:\\Program Files\\Windows Defender\\en-US\\" [0066.269] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\en-US\\" | out: pszPath="C:\\Program Files\\Windows Defender\\en-US\\") returned="" [0066.269] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe494541, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe494541, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsMpRes.dll.mui", cAlternateFileName="")) returned 0 [0066.270] FindClose (in: hFindFile=0x2e3438 | out: hFindFile=0x2e3438) returned 1 [0066.270] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x150a97a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x150a97a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x33b368d0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="MpAsDesc.dll", cAlternateFileName="")) returned 1 [0066.270] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.270] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\*.*") returned="*.*" [0066.270] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\" [0066.270] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\" | out: pszPath="C:\\Program Files\\Windows Defender\\") returned="" [0066.270] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1a0776, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x2a1a0776, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x33bf4fb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x8ba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpClient.dll", cAlternateFileName="")) returned 1 [0066.270] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.270] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MpAsDesc.dll") returned="MpAsDesc.dll" [0066.270] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\" [0066.270] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\" | out: pszPath="C:\\Program Files\\Windows Defender\\") returned="" [0066.270] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.270] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MpClient.dll") returned="MpClient.dll" [0066.270] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\" [0066.270] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\" | out: pszPath="C:\\Program Files\\Windows Defender\\") returned="" [0066.270] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.271] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MpCmdRun.exe") returned="MpCmdRun.exe" [0066.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\" [0066.271] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\" | out: pszPath="C:\\Program Files\\Windows Defender\\") returned="" [0066.271] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.271] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MpCommu.dll") returned="MpCommu.dll" [0066.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\" [0066.271] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\" | out: pszPath="C:\\Program Files\\Windows Defender\\") returned="" [0066.271] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.271] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MpEvMsg.dll") returned="MpEvMsg.dll" [0066.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\" [0066.271] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\" | out: pszPath="C:\\Program Files\\Windows Defender\\") returned="" [0066.271] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.271] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MpOAV.dll") returned="MpOAV.dll" [0066.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\" [0066.271] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\" | out: pszPath="C:\\Program Files\\Windows Defender\\") returned="" [0066.271] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.271] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MpRTP.dll") returned="MpRTP.dll" [0066.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\" [0066.272] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\" | out: pszPath="C:\\Program Files\\Windows Defender\\") returned="" [0066.272] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.272] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MpSvc.dll") returned="MpSvc.dll" [0066.272] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\" [0066.272] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\" | out: pszPath="C:\\Program Files\\Windows Defender\\") returned="" [0066.272] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.272] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MSASCui.exe") returned="MSASCui.exe" [0066.272] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\" [0066.272] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\" | out: pszPath="C:\\Program Files\\Windows Defender\\") returned="" [0066.272] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.272] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MsMpCom.dll") returned="MsMpCom.dll" [0066.272] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\" [0066.272] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\" | out: pszPath="C:\\Program Files\\Windows Defender\\") returned="" [0066.272] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.272] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MsMpLics.dll") returned="MsMpLics.dll" [0066.272] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\" [0066.272] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\" | out: pszPath="C:\\Program Files\\Windows Defender\\") returned="" [0066.273] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.273] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MsMpRes.dll") returned="MsMpRes.dll" [0066.273] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\" [0066.273] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\" | out: pszPath="C:\\Program Files\\Windows Defender\\") returned="" [0066.273] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.273] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\outlook.exe") returned="outlook.exe" [0066.273] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\" [0066.273] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\" | out: pszPath="C:\\Program Files\\Windows Defender\\") returned="" [0066.273] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.273] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\replica.exe") returned="replica.exe" [0066.273] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Defender\\" | out: lpString1="C:\\Program Files\\Windows Defender\\") returned="C:\\Program Files\\Windows Defender\\" [0066.273] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Defender\\" | out: pszPath="C:\\Program Files\\Windows Defender\\") returned="" [0066.273] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*" [0066.273] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Journal\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xdd8f4c20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd8f4c20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0066.274] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.274] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\*.*") returned="*.*" [0066.274] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\" | out: lpString1="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\" [0066.274] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\" | out: pszPath="C:\\Program Files\\Windows Journal\\") returned="" [0066.275] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\afr38.exe") returned="afr38.exe" [0066.275] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d1292, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0066.277] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.277] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\en-US\\*.*") returned="*.*" [0066.277] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\en-US\\" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\") returned="C:\\Program Files\\Windows Journal\\en-US\\" [0066.277] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\en-US\\" | out: pszPath="C:\\Program Files\\Windows Journal\\en-US\\") returned="" [0066.279] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.279] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui") returned="JNTFiltr.dll.mui" [0066.279] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\en-US\\" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\") returned="C:\\Program Files\\Windows Journal\\en-US\\" [0066.279] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\en-US\\" | out: pszPath="C:\\Program Files\\Windows Journal\\en-US\\") returned="" [0066.279] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.280] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui") returned="jnwdui.dll.mui" [0066.280] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\en-US\\" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\") returned="C:\\Program Files\\Windows Journal\\en-US\\" [0066.280] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\en-US\\" | out: pszPath="C:\\Program Files\\Windows Journal\\en-US\\") returned="" [0066.280] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.280] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\en-US\\jnwmon.dll.mui") returned="jnwmon.dll.mui" [0066.280] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\en-US\\" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\") returned="C:\\Program Files\\Windows Journal\\en-US\\" [0066.280] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\en-US\\" | out: pszPath="C:\\Program Files\\Windows Journal\\en-US\\") returned="" [0066.280] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.280] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui") returned="Journal.exe.mui" [0066.280] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\en-US\\" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\") returned="C:\\Program Files\\Windows Journal\\en-US\\" [0066.280] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\en-US\\" | out: pszPath="C:\\Program Files\\Windows Journal\\en-US\\") returned="" [0066.280] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.280] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\en-US\\MSPVWCTL.DLL.mui") returned="MSPVWCTL.DLL.mui" [0066.280] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\en-US\\" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\") returned="C:\\Program Files\\Windows Journal\\en-US\\" [0066.280] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\en-US\\" | out: pszPath="C:\\Program Files\\Windows Journal\\en-US\\") returned="" [0066.281] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.281] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\en-US\\NBMapTIP.dll.mui") returned="NBMapTIP.dll.mui" [0066.281] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\en-US\\" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\") returned="C:\\Program Files\\Windows Journal\\en-US\\" [0066.281] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\en-US\\" | out: pszPath="C:\\Program Files\\Windows Journal\\en-US\\") returned="" [0066.281] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.281] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\*.*") returned="*.*" [0066.281] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\" | out: lpString1="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\" [0066.281] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\" | out: pszPath="C:\\Program Files\\Windows Journal\\") returned="" [0066.281] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.281] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\InkSeg.dll") returned="InkSeg.dll" [0066.281] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\" | out: lpString1="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\" [0066.281] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\" | out: pszPath="C:\\Program Files\\Windows Journal\\") returned="" [0066.281] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.281] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\isspos.exe") returned="isspos.exe" [0066.281] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\" | out: lpString1="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\" [0066.281] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\" | out: pszPath="C:\\Program Files\\Windows Journal\\") returned="" [0066.281] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.281] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\JNTFiltr.dll") returned="JNTFiltr.dll" [0066.282] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\" | out: lpString1="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\" [0066.282] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\" | out: pszPath="C:\\Program Files\\Windows Journal\\") returned="" [0066.282] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.282] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\JNWDRV.dll") returned="JNWDRV.dll" [0066.282] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\" | out: lpString1="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\" [0066.282] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\" | out: pszPath="C:\\Program Files\\Windows Journal\\") returned="" [0066.282] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.282] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\jnwdui.dll") returned="jnwdui.dll" [0066.282] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\" | out: lpString1="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\" [0066.282] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\" | out: pszPath="C:\\Program Files\\Windows Journal\\") returned="" [0066.282] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.282] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\jnwmon.dll") returned="jnwmon.dll" [0066.282] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\" | out: lpString1="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\" [0066.282] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\" | out: pszPath="C:\\Program Files\\Windows Journal\\") returned="" [0066.282] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.282] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\jnwppr.dll") returned="jnwppr.dll" [0066.282] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\" | out: lpString1="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\" [0066.282] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\" | out: pszPath="C:\\Program Files\\Windows Journal\\") returned="" [0066.283] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.283] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\Journal.exe") returned="Journal.exe" [0066.283] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\" | out: lpString1="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\" [0066.283] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\" | out: pszPath="C:\\Program Files\\Windows Journal\\") returned="" [0066.283] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.283] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\lance.exe") returned="lance.exe" [0066.283] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files\\Windows Journal\\" | out: lpString1="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\" [0066.283] PathAddBackslashA (in: pszPath="C:\\Program Files\\Windows Journal\\" | out: pszPath="C:\\Program Files\\Windows Journal\\") returned="" [0066.283] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.283] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.283] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.284] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.284] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x2d1292, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0066.286] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.287] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.287] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.288] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.288] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.288] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.288] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.288] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.288] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.288] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.288] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.288] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.288] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Mail\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdd6df8e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd6df8e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0066.289] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0066.289] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.290] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.291] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.292] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.292] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.292] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.292] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.292] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.292] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.292] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.293] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.293] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Media Player\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdd66d4c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd66d4c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0066.293] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.294] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21ccca7f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2da434, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0066.297] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.299] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.299] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.299] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.299] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.299] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.299] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.299] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.300] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.300] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.300] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.300] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.300] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.300] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Media Player\\Icons\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x2da434, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0066.301] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80471418, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80471418, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0066.303] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.304] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.304] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.305] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.305] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.306] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.306] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.306] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.307] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8044b2b8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8044b2b8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x2da434, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0066.308] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.310] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.312] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.312] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.314] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.314] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.315] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.315] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.315] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.316] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.316] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.317] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.317] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.317] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.318] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.318] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.318] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.318] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.318] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Media Player\\Skins\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9874cd8b, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9874cd8b, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x2da434, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0066.319] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0066.322] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Media Player\\Visualizations\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0066.324] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.324] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.324] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.324] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.324] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.324] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.324] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.325] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.325] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0066.325] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows NT\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdcd5a0e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdcd5a0e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0066.325] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0066.325] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0066.333] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x2da420, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0066.333] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0066.336] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0066.339] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22cc0dd2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0066.342] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Portable Devices\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x987bf1ac, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x987bf1ac, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0066.344] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdfb9ec80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfb9ec80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0066.344] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x237a3493, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0066.348] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa1afe884, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0066.350] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0066.353] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8002, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.355] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2df46e, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0066.357] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2df46e, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0066.359] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d8002, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.364] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0066.367] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d7ffc, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.370] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2df468, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0066.373] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2df468, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0066.375] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805c807b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805c807b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d7ffc, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.420] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0066.424] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d7ff8, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.427] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2df464, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0066.428] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2df464, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0066.431] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8057bdba, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8057bdba, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d7ff8, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.435] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0066.439] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8002, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.439] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d7f60, dwReserved1=0x2d7f5b, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0066.442] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2df46e, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0066.446] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8063a49c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8063a49c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d8002, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.451] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1afe884, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8df54c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0066.453] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b24af3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d6f58, dwReserved1=0x2d6f53, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.455] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa48ceb9, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1b4ad62, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.458] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1b4ad62, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8008, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.464] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\js\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1cc85b8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1cc85b8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45004c, dwReserved1=0x2e0053, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.466] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0066.470] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d800c, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.470] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d7f60, dwReserved1=0x2d7f5b, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0066.476] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22fbc446, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2df478, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0066.477] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x806605fc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x806605fc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d800c, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.484] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740078, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0066.487] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8002, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.489] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d7f60, dwReserved1=0x2d7f5b, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0066.494] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22e64bc5, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2df46e, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0066.495] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8061433b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8061433b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d8002, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.502] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0066.506] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8004, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.507] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d7f60, dwReserved1=0x2d7f5b, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0066.517] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x24022fc4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2df470, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0066.519] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d8004, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.527] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2df472, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0066.529] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\on_desktop\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2df472, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0066.534] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0066.537] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d8000, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.538] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d7f60, dwReserved1=0x2d7f5b, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0066.543] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22c02035, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2df46c, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0066.548] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8052fafa, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8052fafa, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d8000, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.553] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80555c5a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80555c5a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2df46e, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0066.557] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80555c5a, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80555c5a, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2df46e, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0066.584] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x2d1292, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0066.585] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0066.585] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xdd705a40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd705a40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0066.587] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ed8ae0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d5f42, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0066.590] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2d6f62, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.592] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2d6f62, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0066.595] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x802ba700, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d7f78, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0066.601] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d95e8c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d7f78, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0066.606] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d7f78, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0066.609] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d7ee8, dwReserved1=0x2d7ee3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0066.616] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\adobeid.pdf.wannacry")) returned 1 [0066.621] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\") returned="" [0066.621] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0066.621] lstrlenA (lpString="*.zip") returned 5 [0066.621] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0066.621] lstrlenA (lpString="*.rar") returned 5 [0066.622] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0066.622] lstrlenA (lpString="*.7z") returned 4 [0066.622] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0066.622] lstrlenA (lpString="*.tar") returned 5 [0066.622] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf", pszSpec="*.gzip") returned 0 [0066.622] lstrlenA (lpString="*.gzip") returned 6 [0066.622] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0066.622] lstrlenA (lpString="*.jpg") returned 5 [0066.622] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0066.622] lstrlenA (lpString="*.jpeg") returned 6 [0066.622] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0066.622] lstrlenA (lpString="*.psd") returned 5 [0066.622] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf", pszSpec="*.gif") returned 0 [0066.622] lstrlenA (lpString="*.gif") returned 5 [0066.622] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0066.622] lstrlenA (lpString="*.doc") returned 5 [0066.622] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0066.622] lstrlenA (lpString="*.docx") returned 6 [0066.622] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0066.622] lstrlenA (lpString="*.xls") returned 5 [0066.622] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0066.622] lstrlenA (lpString="*.xlsx") returned 6 [0066.623] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0066.623] lstrlenA (lpString="*.ppt") returned 5 [0066.623] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0066.623] lstrlenA (lpString="*.pptx") returned 6 [0066.623] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0066.623] lstrlenA (lpString="*.pdf") returned 5 [0066.623] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf" [0066.623] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf" [0066.623] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf." [0066.623] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf.wannacry" [0066.623] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.624] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11581 [0066.624] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x81efec40, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4)) returned 1 [0066.624] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.624] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x11503, lpOverlapped=0x0) returned 1 [0066.627] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.627] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x11503, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x11503, lpOverlapped=0x0) returned 1 [0066.627] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.628] CloseHandle (hObject=0x94) returned 1 [0066.628] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\defaultid.pdf.wannacry")) returned 1 [0066.629] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11581, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0066.629] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0066.629] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8039ef40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8039ef40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x3, cFileName="CHS", cAlternateFileName="")) returned 1 [0066.629] lstrcmpA (lpString1=".", lpString2="CHS") returned -1 [0066.629] lstrcmpA (lpString1="..", lpString2="CHS") returned -1 [0066.629] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0066.629] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="CHS" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS" [0066.629] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS") returned 63 [0066.629] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8039ef40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8039ef40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d8f98, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0066.630] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.630] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8039ef40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8039ef40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.630] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.630] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.631] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20cc1, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0066.631] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.631] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0066.631] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0066.631] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0066.631] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\*.*") returned="*.*" [0066.631] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\" [0066.631] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\") returned="" [0066.631] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\HOW TO DECRYPT FILES.txt" [0066.631] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\how to decrypt files.txt")) returned 0xffffffff [0066.631] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.632] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0066.632] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0066.633] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.633] CloseHandle (hObject=0x94) returned 1 [0066.633] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf" [0066.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0066.633] lstrlenA (lpString="*.zip") returned 5 [0066.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0066.633] lstrlenA (lpString="*.rar") returned 5 [0066.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0066.634] lstrlenA (lpString="*.7z") returned 4 [0066.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0066.634] lstrlenA (lpString="*.tar") returned 5 [0066.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf", pszSpec="*.gzip") returned 0 [0066.634] lstrlenA (lpString="*.gzip") returned 6 [0066.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0066.634] lstrlenA (lpString="*.jpg") returned 5 [0066.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0066.634] lstrlenA (lpString="*.jpeg") returned 6 [0066.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0066.634] lstrlenA (lpString="*.psd") returned 5 [0066.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf", pszSpec="*.gif") returned 0 [0066.634] lstrlenA (lpString="*.gif") returned 5 [0066.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0066.634] lstrlenA (lpString="*.doc") returned 5 [0066.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0066.634] lstrlenA (lpString="*.docx") returned 6 [0066.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0066.634] lstrlenA (lpString="*.xls") returned 5 [0066.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0066.634] lstrlenA (lpString="*.xlsx") returned 6 [0066.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0066.634] lstrlenA (lpString="*.ppt") returned 5 [0066.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0066.634] lstrlenA (lpString="*.pptx") returned 6 [0066.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0066.634] lstrlenA (lpString="*.pdf") returned 5 [0066.634] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf" [0066.634] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf" [0066.635] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf." [0066.635] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf.wannacry" [0066.635] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.636] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x20cc1 [0066.636] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x99d45400, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x8039ef40, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x99d45400, dwHighDateTime=0x1cb84b4)) returned 1 [0066.636] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.636] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x20c43, lpOverlapped=0x0) returned 1 [0066.639] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf") returned="AdobeID.pdf" [0066.639] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.639] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x20c43, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x20c43, lpOverlapped=0x0) returned 1 [0066.640] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.640] CloseHandle (hObject=0x94) returned 1 [0066.640] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\adobeid.pdf.wannacry")) returned 1 [0066.643] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x207b0, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0066.643] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.643] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0066.643] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0066.643] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0066.643] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf") returned="AdobeID.pdf" [0066.644] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\" [0066.644] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\") returned="" [0066.644] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\HOW TO DECRYPT FILES.txt" [0066.644] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\how to decrypt files.txt")) returned 0x20 [0066.644] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf" [0066.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0066.644] lstrlenA (lpString="*.zip") returned 5 [0066.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0066.644] lstrlenA (lpString="*.rar") returned 5 [0066.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0066.644] lstrlenA (lpString="*.7z") returned 4 [0066.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0066.644] lstrlenA (lpString="*.tar") returned 5 [0066.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf", pszSpec="*.gzip") returned 0 [0066.644] lstrlenA (lpString="*.gzip") returned 6 [0066.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0066.644] lstrlenA (lpString="*.jpg") returned 5 [0066.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0066.644] lstrlenA (lpString="*.jpeg") returned 6 [0066.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0066.644] lstrlenA (lpString="*.psd") returned 5 [0066.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf", pszSpec="*.gif") returned 0 [0066.644] lstrlenA (lpString="*.gif") returned 5 [0066.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0066.644] lstrlenA (lpString="*.doc") returned 5 [0066.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0066.645] lstrlenA (lpString="*.docx") returned 6 [0066.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0066.645] lstrlenA (lpString="*.xls") returned 5 [0066.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0066.645] lstrlenA (lpString="*.xlsx") returned 6 [0066.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0066.645] lstrlenA (lpString="*.ppt") returned 5 [0066.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0066.645] lstrlenA (lpString="*.pptx") returned 6 [0066.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0066.645] lstrlenA (lpString="*.pdf") returned 5 [0066.645] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf" [0066.645] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf" [0066.645] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf." [0066.645] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf.wannacry" [0066.645] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.646] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x207b0 [0066.646] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x99d45400, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x8039ef40, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x99d45400, dwHighDateTime=0x1cb84b4)) returned 1 [0066.646] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.646] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x20732, lpOverlapped=0x0) returned 1 [0066.649] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf") returned="DefaultID.pdf" [0066.649] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.649] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x20732, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x20732, lpOverlapped=0x0) returned 1 [0066.650] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.650] CloseHandle (hObject=0x94) returned 1 [0066.650] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\defaultid.pdf.wannacry")) returned 1 [0066.651] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x207b0, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0066.651] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0066.652] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8039ef40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8039ef40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x3, cFileName="CHT", cAlternateFileName="")) returned 1 [0066.652] lstrcmpA (lpString1=".", lpString2="CHT") returned -1 [0066.652] lstrcmpA (lpString1="..", lpString2="CHT") returned -1 [0066.652] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0066.652] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="CHT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT" [0066.652] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT") returned 63 [0066.652] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8039ef40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8039ef40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d8f98, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0066.653] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.653] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8039ef40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8039ef40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.653] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.653] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.653] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x561b, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0066.653] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.653] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0066.653] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0066.653] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0066.653] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\*.*") returned="*.*" [0066.653] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\" [0066.653] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\") returned="" [0066.653] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\HOW TO DECRYPT FILES.txt" [0066.653] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\how to decrypt files.txt")) returned 0xffffffff [0066.654] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.655] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0066.655] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0066.656] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.656] CloseHandle (hObject=0x94) returned 1 [0066.656] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf" [0066.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0066.656] lstrlenA (lpString="*.zip") returned 5 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0066.656] lstrlenA (lpString="*.rar") returned 5 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0066.656] lstrlenA (lpString="*.7z") returned 4 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0066.656] lstrlenA (lpString="*.tar") returned 5 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf", pszSpec="*.gzip") returned 0 [0066.656] lstrlenA (lpString="*.gzip") returned 6 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0066.656] lstrlenA (lpString="*.jpg") returned 5 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0066.656] lstrlenA (lpString="*.jpeg") returned 6 [0066.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0066.657] lstrlenA (lpString="*.psd") returned 5 [0066.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf", pszSpec="*.gif") returned 0 [0066.657] lstrlenA (lpString="*.gif") returned 5 [0066.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0066.657] lstrlenA (lpString="*.doc") returned 5 [0066.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0066.657] lstrlenA (lpString="*.docx") returned 6 [0066.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0066.657] lstrlenA (lpString="*.xls") returned 5 [0066.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0066.657] lstrlenA (lpString="*.xlsx") returned 6 [0066.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0066.657] lstrlenA (lpString="*.ppt") returned 5 [0066.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0066.657] lstrlenA (lpString="*.pptx") returned 6 [0066.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0066.657] lstrlenA (lpString="*.pdf") returned 5 [0066.657] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf" [0066.657] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf" [0066.657] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf." [0066.657] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf.wannacry" [0066.657] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.658] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x561b [0066.658] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x99d45400, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x8039ef40, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x99d45400, dwHighDateTime=0x1cb84b4)) returned 1 [0066.658] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.658] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x559d, lpOverlapped=0x0) returned 1 [0066.660] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf") returned="AdobeID.pdf" [0066.660] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.661] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x559d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x559d, lpOverlapped=0x0) returned 1 [0066.661] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.661] CloseHandle (hObject=0x94) returned 1 [0066.661] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\adobeid.pdf.wannacry")) returned 1 [0066.664] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x510a, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0066.664] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.664] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0066.664] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0066.664] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0066.664] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf") returned="AdobeID.pdf" [0066.664] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\" [0066.664] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\") returned="" [0066.664] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\HOW TO DECRYPT FILES.txt" [0066.664] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\how to decrypt files.txt")) returned 0x20 [0066.664] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf" [0066.665] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0066.665] lstrlenA (lpString="*.zip") returned 5 [0066.665] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0066.665] lstrlenA (lpString="*.rar") returned 5 [0066.665] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0066.665] lstrlenA (lpString="*.7z") returned 4 [0066.665] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0066.665] lstrlenA (lpString="*.tar") returned 5 [0066.665] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf", pszSpec="*.gzip") returned 0 [0066.665] lstrlenA (lpString="*.gzip") returned 6 [0066.665] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0066.665] lstrlenA (lpString="*.jpg") returned 5 [0066.665] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0066.665] lstrlenA (lpString="*.jpeg") returned 6 [0066.665] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0066.665] lstrlenA (lpString="*.psd") returned 5 [0066.665] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf", pszSpec="*.gif") returned 0 [0066.665] lstrlenA (lpString="*.gif") returned 5 [0066.665] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0066.665] lstrlenA (lpString="*.doc") returned 5 [0066.665] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0066.665] lstrlenA (lpString="*.docx") returned 6 [0066.665] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0066.665] lstrlenA (lpString="*.xls") returned 5 [0066.665] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0066.665] lstrlenA (lpString="*.xlsx") returned 6 [0066.665] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0066.665] lstrlenA (lpString="*.ppt") returned 5 [0066.665] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0066.666] lstrlenA (lpString="*.pptx") returned 6 [0066.666] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0066.666] lstrlenA (lpString="*.pdf") returned 5 [0066.666] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf" [0066.666] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf" [0066.666] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf." [0066.666] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf.wannacry" [0066.666] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.667] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x510a [0066.667] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x99d45400, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x8039ef40, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x99d45400, dwHighDateTime=0x1cb84b4)) returned 1 [0066.667] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.667] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x508c, lpOverlapped=0x0) returned 1 [0066.669] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf") returned="DefaultID.pdf" [0066.669] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.669] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x508c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x508c, lpOverlapped=0x0) returned 1 [0066.670] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.670] CloseHandle (hObject=0x94) returned 1 [0066.670] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\defaultid.pdf.wannacry")) returned 1 [0066.671] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x510a, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0066.671] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0066.671] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x3, cFileName="CZE", cAlternateFileName="")) returned 1 [0066.671] lstrcmpA (lpString1=".", lpString2="CZE") returned -1 [0066.671] lstrcmpA (lpString1="..", lpString2="CZE") returned -1 [0066.671] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0066.671] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="CZE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE" [0066.671] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE") returned 63 [0066.671] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d8f98, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0066.672] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.673] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.673] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.673] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.673] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x16057, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0066.673] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.673] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0066.673] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0066.673] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0066.673] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\*.*") returned="*.*" [0066.673] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\" [0066.673] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\") returned="" [0066.673] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\HOW TO DECRYPT FILES.txt" [0066.673] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\how to decrypt files.txt")) returned 0xffffffff [0066.673] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.674] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0066.674] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0066.675] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.675] CloseHandle (hObject=0x94) returned 1 [0066.675] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf" [0066.675] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0066.675] lstrlenA (lpString="*.zip") returned 5 [0066.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0066.676] lstrlenA (lpString="*.rar") returned 5 [0066.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0066.676] lstrlenA (lpString="*.7z") returned 4 [0066.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0066.676] lstrlenA (lpString="*.tar") returned 5 [0066.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf", pszSpec="*.gzip") returned 0 [0066.676] lstrlenA (lpString="*.gzip") returned 6 [0066.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0066.676] lstrlenA (lpString="*.jpg") returned 5 [0066.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0066.676] lstrlenA (lpString="*.jpeg") returned 6 [0066.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0066.676] lstrlenA (lpString="*.psd") returned 5 [0066.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf", pszSpec="*.gif") returned 0 [0066.676] lstrlenA (lpString="*.gif") returned 5 [0066.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0066.676] lstrlenA (lpString="*.doc") returned 5 [0066.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0066.676] lstrlenA (lpString="*.docx") returned 6 [0066.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0066.676] lstrlenA (lpString="*.xls") returned 5 [0066.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0066.676] lstrlenA (lpString="*.xlsx") returned 6 [0066.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0066.676] lstrlenA (lpString="*.ppt") returned 5 [0066.676] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0066.677] lstrlenA (lpString="*.pptx") returned 6 [0066.677] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0066.677] lstrlenA (lpString="*.pdf") returned 5 [0066.677] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf" [0066.677] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf" [0066.677] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf." [0066.677] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf.wannacry" [0066.677] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.679] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16057 [0066.679] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x99d45400, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a50d20, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x99d45400, dwHighDateTime=0x1cb84b4)) returned 1 [0066.679] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.679] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x15fd9, lpOverlapped=0x0) returned 1 [0066.682] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf") returned="AdobeID.pdf" [0066.682] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.682] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x15fd9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x15fd9, lpOverlapped=0x0) returned 1 [0066.683] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.683] CloseHandle (hObject=0x94) returned 1 [0066.683] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\adobeid.pdf.wannacry")) returned 1 [0066.687] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x155af, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0066.687] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.687] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0066.687] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0066.687] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0066.687] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf") returned="AdobeID.pdf" [0066.687] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\" [0066.687] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\") returned="" [0066.687] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\HOW TO DECRYPT FILES.txt" [0066.687] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\how to decrypt files.txt")) returned 0x20 [0066.687] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf" [0066.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0066.687] lstrlenA (lpString="*.zip") returned 5 [0066.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0066.687] lstrlenA (lpString="*.rar") returned 5 [0066.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0066.687] lstrlenA (lpString="*.7z") returned 4 [0066.687] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0066.687] lstrlenA (lpString="*.tar") returned 5 [0066.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf", pszSpec="*.gzip") returned 0 [0066.688] lstrlenA (lpString="*.gzip") returned 6 [0066.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0066.688] lstrlenA (lpString="*.jpg") returned 5 [0066.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0066.688] lstrlenA (lpString="*.jpeg") returned 6 [0066.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0066.688] lstrlenA (lpString="*.psd") returned 5 [0066.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf", pszSpec="*.gif") returned 0 [0066.688] lstrlenA (lpString="*.gif") returned 5 [0066.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0066.688] lstrlenA (lpString="*.doc") returned 5 [0066.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0066.688] lstrlenA (lpString="*.docx") returned 6 [0066.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0066.688] lstrlenA (lpString="*.xls") returned 5 [0066.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0066.688] lstrlenA (lpString="*.xlsx") returned 6 [0066.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0066.688] lstrlenA (lpString="*.ppt") returned 5 [0066.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0066.688] lstrlenA (lpString="*.pptx") returned 6 [0066.688] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0066.688] lstrlenA (lpString="*.pdf") returned 5 [0066.688] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf" [0066.689] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf" [0066.689] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf." [0066.689] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf.wannacry" [0066.689] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.690] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155af [0066.690] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x99d45400, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a2abc0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x99d45400, dwHighDateTime=0x1cb84b4)) returned 1 [0066.690] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.690] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x15531, lpOverlapped=0x0) returned 1 [0066.693] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf") returned="DefaultID.pdf" [0066.693] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.693] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x15531, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x15531, lpOverlapped=0x0) returned 1 [0066.693] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.694] CloseHandle (hObject=0x94) returned 1 [0066.694] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\defaultid.pdf.wannacry")) returned 1 [0066.695] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x155af, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0066.695] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0066.695] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80378de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80378de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x3, cFileName="DAN", cAlternateFileName="")) returned 1 [0066.695] lstrcmpA (lpString1=".", lpString2="DAN") returned -1 [0066.695] lstrcmpA (lpString1="..", lpString2="DAN") returned -1 [0066.695] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0066.695] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="DAN" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN" [0066.695] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN") returned 63 [0066.695] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80378de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80378de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d8f98, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0066.697] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.697] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80378de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80378de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.697] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.697] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.697] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x106ec, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0066.697] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.697] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0066.697] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0066.697] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0066.697] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\*.*") returned="*.*" [0066.697] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\" [0066.697] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\") returned="" [0066.697] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\HOW TO DECRYPT FILES.txt" [0066.697] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\how to decrypt files.txt")) returned 0xffffffff [0066.697] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.698] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0066.698] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0066.700] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.700] CloseHandle (hObject=0x94) returned 1 [0066.700] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf" [0066.700] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0066.700] lstrlenA (lpString="*.zip") returned 5 [0066.700] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0066.700] lstrlenA (lpString="*.rar") returned 5 [0066.700] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0066.700] lstrlenA (lpString="*.7z") returned 4 [0066.700] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0066.700] lstrlenA (lpString="*.tar") returned 5 [0066.700] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf", pszSpec="*.gzip") returned 0 [0066.700] lstrlenA (lpString="*.gzip") returned 6 [0066.700] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0066.700] lstrlenA (lpString="*.jpg") returned 5 [0066.700] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0066.700] lstrlenA (lpString="*.jpeg") returned 6 [0066.700] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0066.700] lstrlenA (lpString="*.psd") returned 5 [0066.701] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf", pszSpec="*.gif") returned 0 [0066.701] lstrlenA (lpString="*.gif") returned 5 [0066.701] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0066.701] lstrlenA (lpString="*.doc") returned 5 [0066.701] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0066.701] lstrlenA (lpString="*.docx") returned 6 [0066.701] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0066.701] lstrlenA (lpString="*.xls") returned 5 [0066.701] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0066.701] lstrlenA (lpString="*.xlsx") returned 6 [0066.701] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0066.701] lstrlenA (lpString="*.ppt") returned 5 [0066.701] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0066.701] lstrlenA (lpString="*.pptx") returned 6 [0066.701] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0066.701] lstrlenA (lpString="*.pdf") returned 5 [0066.701] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf" [0066.701] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf" [0066.701] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf." [0066.701] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf.wannacry" [0066.701] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.702] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x106ec [0066.702] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80378de0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0066.703] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.703] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1066e, lpOverlapped=0x0) returned 1 [0066.705] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf") returned="AdobeID.pdf" [0066.705] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.705] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1066e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1066e, lpOverlapped=0x0) returned 1 [0066.706] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.706] CloseHandle (hObject=0x94) returned 1 [0066.706] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\adobeid.pdf.wannacry")) returned 1 [0066.709] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x101ce, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0066.709] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.709] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0066.710] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0066.710] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0066.710] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf") returned="AdobeID.pdf" [0066.710] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\" [0066.710] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\") returned="" [0066.710] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\HOW TO DECRYPT FILES.txt" [0066.710] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\how to decrypt files.txt")) returned 0x20 [0066.710] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf" [0066.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0066.710] lstrlenA (lpString="*.zip") returned 5 [0066.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0066.710] lstrlenA (lpString="*.rar") returned 5 [0066.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0066.710] lstrlenA (lpString="*.7z") returned 4 [0066.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0066.710] lstrlenA (lpString="*.tar") returned 5 [0066.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf", pszSpec="*.gzip") returned 0 [0066.710] lstrlenA (lpString="*.gzip") returned 6 [0066.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0066.710] lstrlenA (lpString="*.jpg") returned 5 [0066.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0066.710] lstrlenA (lpString="*.jpeg") returned 6 [0066.710] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0066.710] lstrlenA (lpString="*.psd") returned 5 [0066.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf", pszSpec="*.gif") returned 0 [0066.711] lstrlenA (lpString="*.gif") returned 5 [0066.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0066.711] lstrlenA (lpString="*.doc") returned 5 [0066.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0066.711] lstrlenA (lpString="*.docx") returned 6 [0066.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0066.711] lstrlenA (lpString="*.xls") returned 5 [0066.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0066.711] lstrlenA (lpString="*.xlsx") returned 6 [0066.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0066.711] lstrlenA (lpString="*.ppt") returned 5 [0066.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0066.711] lstrlenA (lpString="*.pptx") returned 6 [0066.711] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0066.711] lstrlenA (lpString="*.pdf") returned 5 [0066.711] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf" [0066.711] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf" [0066.711] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf." [0066.711] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf.wannacry" [0066.711] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.712] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x101ce [0066.712] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80378de0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0066.712] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.712] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x10150, lpOverlapped=0x0) returned 1 [0066.730] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf") returned="DefaultID.pdf" [0066.730] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.730] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x10150, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x10150, lpOverlapped=0x0) returned 1 [0066.731] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.731] CloseHandle (hObject=0x94) returned 1 [0066.731] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\defaultid.pdf.wannacry")) returned 1 [0066.732] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x101ce, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0066.733] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0066.733] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8058e120, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x3, cFileName="DEU", cAlternateFileName="")) returned 1 [0066.733] lstrcmpA (lpString1=".", lpString2="DEU") returned -1 [0066.733] lstrcmpA (lpString1="..", lpString2="DEU") returned -1 [0066.733] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0066.733] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="DEU" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU" [0066.733] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU") returned 63 [0066.733] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8058e120, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d8f98, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0066.734] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.734] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8058e120, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.734] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.734] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.735] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x106d4, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0066.735] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.735] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0066.735] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0066.735] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0066.735] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\*.*") returned="*.*" [0066.735] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\" [0066.735] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\") returned="" [0066.735] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\HOW TO DECRYPT FILES.txt" [0066.735] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\how to decrypt files.txt")) returned 0xffffffff [0066.735] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.736] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0066.736] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0066.737] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.737] CloseHandle (hObject=0x94) returned 1 [0066.737] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf" [0066.738] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0066.738] lstrlenA (lpString="*.zip") returned 5 [0066.738] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0066.738] lstrlenA (lpString="*.rar") returned 5 [0066.738] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0066.738] lstrlenA (lpString="*.7z") returned 4 [0066.738] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0066.738] lstrlenA (lpString="*.tar") returned 5 [0066.738] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf", pszSpec="*.gzip") returned 0 [0066.738] lstrlenA (lpString="*.gzip") returned 6 [0066.738] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0066.738] lstrlenA (lpString="*.jpg") returned 5 [0066.738] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0066.738] lstrlenA (lpString="*.jpeg") returned 6 [0066.738] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0066.738] lstrlenA (lpString="*.psd") returned 5 [0066.738] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf", pszSpec="*.gif") returned 0 [0066.738] lstrlenA (lpString="*.gif") returned 5 [0066.738] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0066.738] lstrlenA (lpString="*.doc") returned 5 [0066.738] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0066.738] lstrlenA (lpString="*.docx") returned 6 [0066.738] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0066.738] lstrlenA (lpString="*.xls") returned 5 [0066.738] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0066.738] lstrlenA (lpString="*.xlsx") returned 6 [0066.738] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0066.738] lstrlenA (lpString="*.ppt") returned 5 [0066.739] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0066.739] lstrlenA (lpString="*.pptx") returned 6 [0066.739] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0066.739] lstrlenA (lpString="*.pdf") returned 5 [0066.739] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf" [0066.739] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf" [0066.739] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf." [0066.739] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf.wannacry" [0066.739] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.740] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x106d4 [0066.740] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x8058e120, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4)) returned 1 [0066.740] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.740] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x10656, lpOverlapped=0x0) returned 1 [0066.743] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf") returned="AdobeID.pdf" [0066.743] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.743] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x10656, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x10656, lpOverlapped=0x0) returned 1 [0066.743] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.743] CloseHandle (hObject=0x94) returned 1 [0066.743] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\adobeid.pdf.wannacry")) returned 1 [0066.746] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x101bc, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0066.746] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.747] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0066.747] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0066.747] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0066.747] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf") returned="AdobeID.pdf" [0066.747] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\" [0066.747] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\") returned="" [0066.747] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\HOW TO DECRYPT FILES.txt" [0066.747] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\how to decrypt files.txt")) returned 0x20 [0066.747] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf" [0066.747] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0066.747] lstrlenA (lpString="*.zip") returned 5 [0066.747] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0066.747] lstrlenA (lpString="*.rar") returned 5 [0066.747] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0066.747] lstrlenA (lpString="*.7z") returned 4 [0066.747] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0066.747] lstrlenA (lpString="*.tar") returned 5 [0066.747] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf", pszSpec="*.gzip") returned 0 [0066.747] lstrlenA (lpString="*.gzip") returned 6 [0066.747] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0066.747] lstrlenA (lpString="*.jpg") returned 5 [0066.747] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0066.747] lstrlenA (lpString="*.jpeg") returned 6 [0066.747] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0066.747] lstrlenA (lpString="*.psd") returned 5 [0066.748] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf", pszSpec="*.gif") returned 0 [0066.748] lstrlenA (lpString="*.gif") returned 5 [0066.748] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0066.748] lstrlenA (lpString="*.doc") returned 5 [0066.748] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0066.748] lstrlenA (lpString="*.docx") returned 6 [0066.748] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0066.748] lstrlenA (lpString="*.xls") returned 5 [0066.748] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0066.748] lstrlenA (lpString="*.xlsx") returned 6 [0066.748] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0066.748] lstrlenA (lpString="*.ppt") returned 5 [0066.748] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0066.748] lstrlenA (lpString="*.pptx") returned 6 [0066.748] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0066.748] lstrlenA (lpString="*.pdf") returned 5 [0066.748] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf" [0066.748] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf" [0066.748] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf." [0066.748] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf.wannacry" [0066.748] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.749] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x101bc [0066.749] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805b4280, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4)) returned 1 [0066.749] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.749] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1013e, lpOverlapped=0x0) returned 1 [0066.752] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf") returned="DefaultID.pdf" [0066.752] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.752] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1013e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1013e, lpOverlapped=0x0) returned 1 [0066.752] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.752] CloseHandle (hObject=0x94) returned 1 [0066.753] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\defaultid.pdf.wannacry")) returned 1 [0066.753] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x101bc, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0066.754] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0066.754] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8058e120, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8058e120, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x3, cFileName="ENU", cAlternateFileName="")) returned 1 [0066.754] lstrcmpA (lpString1=".", lpString2="ENU") returned -1 [0066.754] lstrcmpA (lpString1="..", lpString2="ENU") returned -1 [0066.754] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0066.754] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="ENU" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU" [0066.754] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU") returned 63 [0066.754] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8058e120, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8058e120, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d8f98, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0066.755] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.755] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8058e120, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8058e120, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.755] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.755] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.755] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14096, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0066.755] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.755] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0066.755] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0066.755] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0066.755] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\*.*") returned="*.*" [0066.755] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\" [0066.755] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\") returned="" [0066.756] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\HOW TO DECRYPT FILES.txt" [0066.756] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\how to decrypt files.txt")) returned 0xffffffff [0066.756] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.756] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0066.756] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0066.758] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.758] CloseHandle (hObject=0x94) returned 1 [0066.761] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf" [0066.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0066.761] lstrlenA (lpString="*.zip") returned 5 [0066.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0066.761] lstrlenA (lpString="*.rar") returned 5 [0066.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0066.761] lstrlenA (lpString="*.7z") returned 4 [0066.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0066.761] lstrlenA (lpString="*.tar") returned 5 [0066.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf", pszSpec="*.gzip") returned 0 [0066.761] lstrlenA (lpString="*.gzip") returned 6 [0066.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0066.761] lstrlenA (lpString="*.jpg") returned 5 [0066.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0066.761] lstrlenA (lpString="*.jpeg") returned 6 [0066.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0066.761] lstrlenA (lpString="*.psd") returned 5 [0066.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf", pszSpec="*.gif") returned 0 [0066.761] lstrlenA (lpString="*.gif") returned 5 [0066.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0066.761] lstrlenA (lpString="*.doc") returned 5 [0066.761] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0066.761] lstrlenA (lpString="*.docx") returned 6 [0066.762] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0066.762] lstrlenA (lpString="*.xls") returned 5 [0066.762] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0066.762] lstrlenA (lpString="*.xlsx") returned 6 [0066.762] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0066.762] lstrlenA (lpString="*.ppt") returned 5 [0066.762] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0066.762] lstrlenA (lpString="*.pptx") returned 6 [0066.762] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0066.762] lstrlenA (lpString="*.pdf") returned 5 [0066.762] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf" [0066.762] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf" [0066.762] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf." [0066.762] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf.wannacry" [0066.762] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.763] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14096 [0066.763] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x8058e120, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0066.763] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.763] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x14018, lpOverlapped=0x0) returned 1 [0066.767] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf") returned="AdobeID.pdf" [0066.767] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.767] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x14018, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x14018, lpOverlapped=0x0) returned 1 [0066.767] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.767] CloseHandle (hObject=0x94) returned 1 [0066.767] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\adobeid.pdf.wannacry")) returned 1 [0066.770] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13b0b, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0066.770] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.770] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0066.770] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0066.770] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0066.770] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf") returned="AdobeID.pdf" [0066.770] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\" [0066.770] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\") returned="" [0066.770] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\HOW TO DECRYPT FILES.txt" [0066.770] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\how to decrypt files.txt")) returned 0x20 [0066.771] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf" [0066.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0066.771] lstrlenA (lpString="*.zip") returned 5 [0066.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0066.771] lstrlenA (lpString="*.rar") returned 5 [0066.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0066.771] lstrlenA (lpString="*.7z") returned 4 [0066.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0066.771] lstrlenA (lpString="*.tar") returned 5 [0066.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf", pszSpec="*.gzip") returned 0 [0066.771] lstrlenA (lpString="*.gzip") returned 6 [0066.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0066.771] lstrlenA (lpString="*.jpg") returned 5 [0066.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0066.771] lstrlenA (lpString="*.jpeg") returned 6 [0066.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0066.771] lstrlenA (lpString="*.psd") returned 5 [0066.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf", pszSpec="*.gif") returned 0 [0066.771] lstrlenA (lpString="*.gif") returned 5 [0066.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0066.771] lstrlenA (lpString="*.doc") returned 5 [0066.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0066.771] lstrlenA (lpString="*.docx") returned 6 [0066.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0066.771] lstrlenA (lpString="*.xls") returned 5 [0066.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0066.771] lstrlenA (lpString="*.xlsx") returned 6 [0066.771] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0066.772] lstrlenA (lpString="*.ppt") returned 5 [0066.772] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0066.772] lstrlenA (lpString="*.pptx") returned 6 [0066.772] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0066.772] lstrlenA (lpString="*.pdf") returned 5 [0066.772] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf" [0066.772] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf" [0066.772] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf." [0066.772] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf.wannacry" [0066.772] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.773] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13b0b [0066.773] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x8058e120, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4)) returned 1 [0066.773] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.773] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x13a8d, lpOverlapped=0x0) returned 1 [0066.776] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf") returned="DefaultID.pdf" [0066.776] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.776] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x13a8d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x13a8d, lpOverlapped=0x0) returned 1 [0066.776] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.777] CloseHandle (hObject=0x94) returned 1 [0066.777] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\defaultid.pdf.wannacry")) returned 1 [0066.778] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13b0b, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0066.778] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0066.778] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x3, cFileName="ESP", cAlternateFileName="")) returned 1 [0066.778] lstrcmpA (lpString1=".", lpString2="ESP") returned -1 [0066.778] lstrcmpA (lpString1="..", lpString2="ESP") returned -1 [0066.778] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0066.778] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="ESP" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP" [0066.778] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP") returned 63 [0066.778] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d8f98, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0066.782] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.782] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.783] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.783] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.783] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x109db, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0066.783] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.783] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0066.783] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0066.783] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0066.783] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\*.*") returned="*.*" [0066.783] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\" [0066.783] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\") returned="" [0066.783] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\HOW TO DECRYPT FILES.txt" [0066.783] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\how to decrypt files.txt")) returned 0xffffffff [0066.783] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.784] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0066.784] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0066.785] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.785] CloseHandle (hObject=0x94) returned 1 [0066.786] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf" [0066.786] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0066.786] lstrlenA (lpString="*.zip") returned 5 [0066.786] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0066.786] lstrlenA (lpString="*.rar") returned 5 [0066.786] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0066.786] lstrlenA (lpString="*.7z") returned 4 [0066.786] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0066.786] lstrlenA (lpString="*.tar") returned 5 [0066.786] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf", pszSpec="*.gzip") returned 0 [0066.786] lstrlenA (lpString="*.gzip") returned 6 [0066.786] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0066.786] lstrlenA (lpString="*.jpg") returned 5 [0066.786] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0066.786] lstrlenA (lpString="*.jpeg") returned 6 [0066.786] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0066.786] lstrlenA (lpString="*.psd") returned 5 [0066.786] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf", pszSpec="*.gif") returned 0 [0066.786] lstrlenA (lpString="*.gif") returned 5 [0066.786] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0066.786] lstrlenA (lpString="*.doc") returned 5 [0066.786] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0066.786] lstrlenA (lpString="*.docx") returned 6 [0066.786] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0066.786] lstrlenA (lpString="*.xls") returned 5 [0066.786] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0066.786] lstrlenA (lpString="*.xlsx") returned 6 [0066.787] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0066.787] lstrlenA (lpString="*.ppt") returned 5 [0066.787] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0066.787] lstrlenA (lpString="*.pptx") returned 6 [0066.787] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0066.787] lstrlenA (lpString="*.pdf") returned 5 [0066.787] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf" [0066.787] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf" [0066.787] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf." [0066.787] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf.wannacry" [0066.787] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.788] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x109db [0066.788] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805b4280, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0066.788] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.788] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1095d, lpOverlapped=0x0) returned 1 [0066.791] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf") returned="AdobeID.pdf" [0066.791] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.791] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1095d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1095d, lpOverlapped=0x0) returned 1 [0066.791] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.791] CloseHandle (hObject=0x94) returned 1 [0066.791] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\adobeid.pdf.wannacry")) returned 1 [0066.795] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x104bf, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0066.795] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.795] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0066.796] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0066.796] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0066.796] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf") returned="AdobeID.pdf" [0066.796] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\" [0066.796] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\") returned="" [0066.796] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\HOW TO DECRYPT FILES.txt" [0066.796] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\how to decrypt files.txt")) returned 0x20 [0066.796] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf" [0066.796] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0066.796] lstrlenA (lpString="*.zip") returned 5 [0066.796] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0066.796] lstrlenA (lpString="*.rar") returned 5 [0066.796] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0066.796] lstrlenA (lpString="*.7z") returned 4 [0066.796] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0066.796] lstrlenA (lpString="*.tar") returned 5 [0066.796] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.gzip") returned 0 [0066.796] lstrlenA (lpString="*.gzip") returned 6 [0066.796] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0066.796] lstrlenA (lpString="*.jpg") returned 5 [0066.796] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0066.796] lstrlenA (lpString="*.jpeg") returned 6 [0066.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0066.797] lstrlenA (lpString="*.psd") returned 5 [0066.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.gif") returned 0 [0066.797] lstrlenA (lpString="*.gif") returned 5 [0066.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0066.797] lstrlenA (lpString="*.doc") returned 5 [0066.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0066.797] lstrlenA (lpString="*.docx") returned 6 [0066.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0066.797] lstrlenA (lpString="*.xls") returned 5 [0066.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0066.797] lstrlenA (lpString="*.xlsx") returned 6 [0066.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0066.797] lstrlenA (lpString="*.ppt") returned 5 [0066.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0066.797] lstrlenA (lpString="*.pptx") returned 6 [0066.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0066.797] lstrlenA (lpString="*.pdf") returned 5 [0066.797] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf" [0066.797] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf" [0066.797] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf." [0066.797] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf.wannacry" [0066.797] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.799] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x104bf [0066.799] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805b4280, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0066.799] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.799] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x10441, lpOverlapped=0x0) returned 1 [0066.802] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf") returned="DefaultID.pdf" [0066.802] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.802] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x10441, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x10441, lpOverlapped=0x0) returned 1 [0066.803] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.803] CloseHandle (hObject=0x94) returned 1 [0066.803] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\defaultid.pdf.wannacry")) returned 1 [0066.804] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x104bf, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0066.804] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0066.804] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x3, cFileName="EUQ", cAlternateFileName="")) returned 1 [0066.804] lstrcmpA (lpString1=".", lpString2="EUQ") returned -1 [0066.804] lstrcmpA (lpString1="..", lpString2="EUQ") returned -1 [0066.805] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0066.805] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="EUQ" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ" [0066.805] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ") returned 63 [0066.805] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d8f98, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0066.805] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.805] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.805] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.805] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.805] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 0 [0066.805] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0066.805] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x550045, dwReserved1=0x3, cFileName="FRA", cAlternateFileName="")) returned 1 [0066.805] lstrcmpA (lpString1=".", lpString2="FRA") returned -1 [0066.805] lstrcmpA (lpString1="..", lpString2="FRA") returned -1 [0066.805] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0066.805] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="FRA" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA" [0066.806] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA") returned 63 [0066.806] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0066.807] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.807] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.807] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.807] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.807] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10ab0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0066.807] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.807] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0066.807] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0066.807] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0066.807] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\*.*") returned="*.*" [0066.807] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\" [0066.807] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\") returned="" [0066.807] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\HOW TO DECRYPT FILES.txt" [0066.807] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\how to decrypt files.txt")) returned 0xffffffff [0066.807] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.809] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0066.809] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0066.810] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.810] CloseHandle (hObject=0x94) returned 1 [0066.810] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf" [0066.810] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0066.810] lstrlenA (lpString="*.zip") returned 5 [0066.810] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0066.810] lstrlenA (lpString="*.rar") returned 5 [0066.810] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0066.810] lstrlenA (lpString="*.7z") returned 4 [0066.810] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0066.810] lstrlenA (lpString="*.tar") returned 5 [0066.810] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.gzip") returned 0 [0066.810] lstrlenA (lpString="*.gzip") returned 6 [0066.811] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0066.811] lstrlenA (lpString="*.jpg") returned 5 [0066.811] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0066.811] lstrlenA (lpString="*.jpeg") returned 6 [0066.811] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0066.811] lstrlenA (lpString="*.psd") returned 5 [0066.811] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.gif") returned 0 [0066.811] lstrlenA (lpString="*.gif") returned 5 [0066.811] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0066.811] lstrlenA (lpString="*.doc") returned 5 [0066.811] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0066.811] lstrlenA (lpString="*.docx") returned 6 [0066.811] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0066.811] lstrlenA (lpString="*.xls") returned 5 [0066.811] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0066.811] lstrlenA (lpString="*.xlsx") returned 6 [0066.811] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0066.811] lstrlenA (lpString="*.ppt") returned 5 [0066.811] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0066.811] lstrlenA (lpString="*.pptx") returned 6 [0066.811] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0066.811] lstrlenA (lpString="*.pdf") returned 5 [0066.811] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf" [0066.811] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf" [0066.811] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf." [0066.811] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf.wannacry" [0066.812] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.813] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10ab0 [0066.813] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805b4280, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4)) returned 1 [0066.813] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.813] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x10a32, lpOverlapped=0x0) returned 1 [0066.816] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf") returned="AdobeID.pdf" [0066.816] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.816] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x10a32, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x10a32, lpOverlapped=0x0) returned 1 [0066.816] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.816] CloseHandle (hObject=0x94) returned 1 [0066.817] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\adobeid.pdf.wannacry")) returned 1 [0066.820] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10596, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0066.820] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.820] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0066.820] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0066.820] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0066.820] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf") returned="AdobeID.pdf" [0066.820] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\" [0066.820] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\") returned="" [0066.821] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\HOW TO DECRYPT FILES.txt" [0066.821] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\how to decrypt files.txt")) returned 0x20 [0066.821] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf" [0066.821] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0066.821] lstrlenA (lpString="*.zip") returned 5 [0066.821] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0066.821] lstrlenA (lpString="*.rar") returned 5 [0066.821] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0066.821] lstrlenA (lpString="*.7z") returned 4 [0066.821] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0066.821] lstrlenA (lpString="*.tar") returned 5 [0066.821] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.gzip") returned 0 [0066.821] lstrlenA (lpString="*.gzip") returned 6 [0066.821] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0066.821] lstrlenA (lpString="*.jpg") returned 5 [0066.821] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0066.821] lstrlenA (lpString="*.jpeg") returned 6 [0066.821] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0066.821] lstrlenA (lpString="*.psd") returned 5 [0066.821] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.gif") returned 0 [0066.821] lstrlenA (lpString="*.gif") returned 5 [0066.821] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0066.822] lstrlenA (lpString="*.doc") returned 5 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0066.822] lstrlenA (lpString="*.docx") returned 6 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0066.822] lstrlenA (lpString="*.xls") returned 5 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0066.822] lstrlenA (lpString="*.xlsx") returned 6 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0066.822] lstrlenA (lpString="*.ppt") returned 5 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0066.822] lstrlenA (lpString="*.pptx") returned 6 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0066.822] lstrlenA (lpString="*.pdf") returned 5 [0066.822] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf" [0066.822] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf" [0066.822] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf." [0066.822] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf.wannacry" [0066.822] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.823] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10596 [0066.823] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805b4280, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4)) returned 1 [0066.823] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.823] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x10518, lpOverlapped=0x0) returned 1 [0066.826] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf") returned="DefaultID.pdf" [0066.826] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.826] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x10518, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x10518, lpOverlapped=0x0) returned 1 [0066.827] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.827] CloseHandle (hObject=0x94) returned 1 [0066.827] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\defaultid.pdf.wannacry")) returned 1 [0066.828] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10596, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0066.828] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0066.828] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x3, cFileName="HRV", cAlternateFileName="")) returned 1 [0066.829] lstrcmpA (lpString1=".", lpString2="HRV") returned -1 [0066.829] lstrcmpA (lpString1="..", lpString2="HRV") returned -1 [0066.829] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0066.829] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="HRV" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV" [0066.829] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV") returned 63 [0066.829] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d8f98, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0066.829] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.829] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.829] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.829] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.829] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43b5, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0066.829] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.829] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0066.829] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0066.829] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0066.829] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\*.*") returned="*.*" [0066.829] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\" [0066.830] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\") returned="" [0066.830] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\HOW TO DECRYPT FILES.txt" [0066.830] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\how to decrypt files.txt")) returned 0xffffffff [0066.830] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.831] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0066.831] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0066.832] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.832] CloseHandle (hObject=0x94) returned 1 [0066.832] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf" [0066.832] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0066.832] lstrlenA (lpString="*.zip") returned 5 [0066.832] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0066.832] lstrlenA (lpString="*.rar") returned 5 [0066.832] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0066.832] lstrlenA (lpString="*.7z") returned 4 [0066.832] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0066.832] lstrlenA (lpString="*.tar") returned 5 [0066.832] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.gzip") returned 0 [0066.832] lstrlenA (lpString="*.gzip") returned 6 [0066.832] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0066.832] lstrlenA (lpString="*.jpg") returned 5 [0066.832] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0066.832] lstrlenA (lpString="*.jpeg") returned 6 [0066.832] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0066.833] lstrlenA (lpString="*.psd") returned 5 [0066.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.gif") returned 0 [0066.833] lstrlenA (lpString="*.gif") returned 5 [0066.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0066.833] lstrlenA (lpString="*.doc") returned 5 [0066.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0066.833] lstrlenA (lpString="*.docx") returned 6 [0066.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0066.833] lstrlenA (lpString="*.xls") returned 5 [0066.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0066.833] lstrlenA (lpString="*.xlsx") returned 6 [0066.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0066.833] lstrlenA (lpString="*.ppt") returned 5 [0066.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0066.833] lstrlenA (lpString="*.pptx") returned 6 [0066.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0066.833] lstrlenA (lpString="*.pdf") returned 5 [0066.833] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf" [0066.833] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf" [0066.833] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf." [0066.833] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf.wannacry" [0066.833] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.834] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43b5 [0066.834] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a2abc0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0066.835] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.835] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4337, lpOverlapped=0x0) returned 1 [0066.837] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf") returned="AdobeID.pdf" [0066.837] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.837] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4337, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4337, lpOverlapped=0x0) returned 1 [0066.838] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.838] CloseHandle (hObject=0x94) returned 1 [0066.838] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\adobeid.pdf.wannacry")) returned 1 [0066.841] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e95, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0066.841] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.842] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0066.842] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0066.842] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0066.842] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf") returned="AdobeID.pdf" [0066.842] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\" [0066.842] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\") returned="" [0066.842] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\HOW TO DECRYPT FILES.txt" [0066.842] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\how to decrypt files.txt")) returned 0x20 [0066.842] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf" [0066.842] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0066.842] lstrlenA (lpString="*.zip") returned 5 [0066.842] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0066.842] lstrlenA (lpString="*.rar") returned 5 [0066.842] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0066.842] lstrlenA (lpString="*.7z") returned 4 [0066.842] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0066.842] lstrlenA (lpString="*.tar") returned 5 [0066.842] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.gzip") returned 0 [0066.842] lstrlenA (lpString="*.gzip") returned 6 [0066.842] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0066.842] lstrlenA (lpString="*.jpg") returned 5 [0066.842] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0066.843] lstrlenA (lpString="*.jpeg") returned 6 [0066.843] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0066.843] lstrlenA (lpString="*.psd") returned 5 [0066.843] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.gif") returned 0 [0066.843] lstrlenA (lpString="*.gif") returned 5 [0066.843] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0066.843] lstrlenA (lpString="*.doc") returned 5 [0066.843] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0066.843] lstrlenA (lpString="*.docx") returned 6 [0066.843] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0066.843] lstrlenA (lpString="*.xls") returned 5 [0066.843] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0066.843] lstrlenA (lpString="*.xlsx") returned 6 [0066.843] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0066.843] lstrlenA (lpString="*.ppt") returned 5 [0066.843] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0066.843] lstrlenA (lpString="*.pptx") returned 6 [0066.843] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0066.843] lstrlenA (lpString="*.pdf") returned 5 [0066.843] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf" [0066.843] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf" [0066.843] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf." [0066.843] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf.wannacry" [0066.843] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.844] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e95 [0066.845] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a2abc0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0066.845] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.845] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x3e17, lpOverlapped=0x0) returned 1 [0066.849] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf") returned="DefaultID.pdf" [0066.849] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.849] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x3e17, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x3e17, lpOverlapped=0x0) returned 1 [0066.849] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.849] CloseHandle (hObject=0x94) returned 1 [0066.850] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\defaultid.pdf.wannacry")) returned 1 [0066.851] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e95, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0066.851] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0066.851] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x3, cFileName="HUN", cAlternateFileName="")) returned 1 [0066.851] lstrcmpA (lpString1=".", lpString2="HUN") returned -1 [0066.851] lstrcmpA (lpString1="..", lpString2="HUN") returned -1 [0066.851] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0066.851] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="HUN" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN" [0066.852] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN") returned 63 [0066.852] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d8f98, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0066.853] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.853] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.853] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.853] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.854] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x16097, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0066.854] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.854] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0066.854] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0066.854] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0066.854] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\*.*") returned="*.*" [0066.854] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\" [0066.854] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\") returned="" [0066.854] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\HOW TO DECRYPT FILES.txt" [0066.854] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\how to decrypt files.txt")) returned 0xffffffff [0066.854] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.855] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0066.855] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0066.857] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.857] CloseHandle (hObject=0x94) returned 1 [0066.857] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf" [0066.857] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0066.857] lstrlenA (lpString="*.zip") returned 5 [0066.857] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0066.857] lstrlenA (lpString="*.rar") returned 5 [0066.857] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0066.857] lstrlenA (lpString="*.7z") returned 4 [0066.857] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0066.857] lstrlenA (lpString="*.tar") returned 5 [0066.857] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.gzip") returned 0 [0066.857] lstrlenA (lpString="*.gzip") returned 6 [0066.857] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0066.858] lstrlenA (lpString="*.jpg") returned 5 [0066.858] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0066.858] lstrlenA (lpString="*.jpeg") returned 6 [0066.858] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0066.858] lstrlenA (lpString="*.psd") returned 5 [0066.858] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.gif") returned 0 [0066.858] lstrlenA (lpString="*.gif") returned 5 [0066.858] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0066.858] lstrlenA (lpString="*.doc") returned 5 [0066.858] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0066.858] lstrlenA (lpString="*.docx") returned 6 [0066.858] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0066.858] lstrlenA (lpString="*.xls") returned 5 [0066.858] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0066.858] lstrlenA (lpString="*.xlsx") returned 6 [0066.858] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0066.858] lstrlenA (lpString="*.ppt") returned 5 [0066.858] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0066.858] lstrlenA (lpString="*.pptx") returned 6 [0066.858] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0066.858] lstrlenA (lpString="*.pdf") returned 5 [0066.858] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf" [0066.858] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf" [0066.858] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf." [0066.858] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf.wannacry" [0066.859] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.860] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16097 [0066.860] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a2abc0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0066.860] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.860] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x16019, lpOverlapped=0x0) returned 1 [0066.866] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf") returned="AdobeID.pdf" [0066.866] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.866] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x16019, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x16019, lpOverlapped=0x0) returned 1 [0066.866] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.867] CloseHandle (hObject=0x94) returned 1 [0066.867] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\adobeid.pdf.wannacry")) returned 1 [0066.870] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15db2, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0066.870] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.870] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0066.870] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0066.870] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0066.870] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf") returned="AdobeID.pdf" [0066.870] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\" [0066.870] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\") returned="" [0066.870] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\HOW TO DECRYPT FILES.txt" [0066.870] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\how to decrypt files.txt")) returned 0x20 [0066.870] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf" [0066.870] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0066.870] lstrlenA (lpString="*.zip") returned 5 [0066.870] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0066.870] lstrlenA (lpString="*.rar") returned 5 [0066.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0066.871] lstrlenA (lpString="*.7z") returned 4 [0066.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0066.871] lstrlenA (lpString="*.tar") returned 5 [0066.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.gzip") returned 0 [0066.871] lstrlenA (lpString="*.gzip") returned 6 [0066.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0066.871] lstrlenA (lpString="*.jpg") returned 5 [0066.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0066.871] lstrlenA (lpString="*.jpeg") returned 6 [0066.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0066.871] lstrlenA (lpString="*.psd") returned 5 [0066.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.gif") returned 0 [0066.871] lstrlenA (lpString="*.gif") returned 5 [0066.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0066.871] lstrlenA (lpString="*.doc") returned 5 [0066.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0066.871] lstrlenA (lpString="*.docx") returned 6 [0066.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0066.871] lstrlenA (lpString="*.xls") returned 5 [0066.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0066.871] lstrlenA (lpString="*.xlsx") returned 6 [0066.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0066.871] lstrlenA (lpString="*.ppt") returned 5 [0066.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0066.871] lstrlenA (lpString="*.pptx") returned 6 [0066.872] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0066.872] lstrlenA (lpString="*.pdf") returned 5 [0066.872] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf" [0066.872] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf" [0066.872] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf." [0066.872] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf.wannacry" [0066.872] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.873] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15db2 [0066.873] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a2abc0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0066.873] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.873] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x15d34, lpOverlapped=0x0) returned 1 [0066.876] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf") returned="DefaultID.pdf" [0066.876] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.877] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x15d34, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x15d34, lpOverlapped=0x0) returned 1 [0066.877] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.877] CloseHandle (hObject=0x94) returned 1 [0066.877] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\defaultid.pdf.wannacry")) returned 1 [0066.879] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15db2, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0066.879] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0066.879] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x3, cFileName="ITA", cAlternateFileName="")) returned 1 [0066.879] lstrcmpA (lpString1=".", lpString2="ITA") returned -1 [0066.879] lstrcmpA (lpString1="..", lpString2="ITA") returned -1 [0066.879] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0066.879] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="ITA" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA" [0066.879] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA") returned 63 [0066.879] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d8f98, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0066.880] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.880] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.880] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.880] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.880] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10913, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0066.880] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.880] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0066.880] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0066.880] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0066.880] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\*.*") returned="*.*" [0066.880] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\" [0066.880] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\") returned="" [0066.880] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\HOW TO DECRYPT FILES.txt" [0066.880] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\how to decrypt files.txt")) returned 0xffffffff [0066.881] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.882] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0066.882] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0066.883] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.883] CloseHandle (hObject=0x94) returned 1 [0066.883] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf" [0066.883] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0066.883] lstrlenA (lpString="*.zip") returned 5 [0066.883] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0066.883] lstrlenA (lpString="*.rar") returned 5 [0066.883] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0066.883] lstrlenA (lpString="*.7z") returned 4 [0066.883] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0066.884] lstrlenA (lpString="*.tar") returned 5 [0066.884] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.gzip") returned 0 [0066.884] lstrlenA (lpString="*.gzip") returned 6 [0066.884] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0066.884] lstrlenA (lpString="*.jpg") returned 5 [0066.884] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0066.884] lstrlenA (lpString="*.jpeg") returned 6 [0066.884] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0066.884] lstrlenA (lpString="*.psd") returned 5 [0066.884] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.gif") returned 0 [0066.884] lstrlenA (lpString="*.gif") returned 5 [0066.884] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0066.884] lstrlenA (lpString="*.doc") returned 5 [0066.884] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0066.884] lstrlenA (lpString="*.docx") returned 6 [0066.884] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0066.884] lstrlenA (lpString="*.xls") returned 5 [0066.884] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0066.884] lstrlenA (lpString="*.xlsx") returned 6 [0066.884] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0066.884] lstrlenA (lpString="*.ppt") returned 5 [0066.884] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0066.884] lstrlenA (lpString="*.pptx") returned 6 [0066.884] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0066.885] lstrlenA (lpString="*.pdf") returned 5 [0066.885] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf" [0066.885] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf" [0066.885] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf." [0066.885] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf.wannacry" [0066.885] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.887] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10913 [0066.887] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805b4280, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0066.887] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.887] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x10895, lpOverlapped=0x0) returned 1 [0066.890] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf") returned="AdobeID.pdf" [0066.890] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.890] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x10895, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x10895, lpOverlapped=0x0) returned 1 [0066.890] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.890] CloseHandle (hObject=0x94) returned 1 [0066.891] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\adobeid.pdf.wannacry")) returned 1 [0066.894] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x103f8, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0066.894] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.894] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0066.894] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0066.894] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0066.894] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf") returned="AdobeID.pdf" [0066.894] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\" [0066.894] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\") returned="" [0066.894] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\HOW TO DECRYPT FILES.txt" [0066.895] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\how to decrypt files.txt")) returned 0x20 [0066.895] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf" [0066.895] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0066.895] lstrlenA (lpString="*.zip") returned 5 [0066.895] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0066.895] lstrlenA (lpString="*.rar") returned 5 [0066.895] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0066.895] lstrlenA (lpString="*.7z") returned 4 [0066.895] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0066.895] lstrlenA (lpString="*.tar") returned 5 [0066.895] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.gzip") returned 0 [0066.895] lstrlenA (lpString="*.gzip") returned 6 [0066.895] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0066.895] lstrlenA (lpString="*.jpg") returned 5 [0066.895] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0066.895] lstrlenA (lpString="*.jpeg") returned 6 [0066.895] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0066.895] lstrlenA (lpString="*.psd") returned 5 [0066.895] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.gif") returned 0 [0066.895] lstrlenA (lpString="*.gif") returned 5 [0066.895] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0066.895] lstrlenA (lpString="*.doc") returned 5 [0066.895] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0066.896] lstrlenA (lpString="*.docx") returned 6 [0066.896] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0066.896] lstrlenA (lpString="*.xls") returned 5 [0066.896] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0066.896] lstrlenA (lpString="*.xlsx") returned 6 [0066.896] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0066.896] lstrlenA (lpString="*.ppt") returned 5 [0066.896] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0066.896] lstrlenA (lpString="*.pptx") returned 6 [0066.896] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0066.896] lstrlenA (lpString="*.pdf") returned 5 [0066.896] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf" [0066.896] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf" [0066.896] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf." [0066.896] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf.wannacry" [0066.896] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.897] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x103f8 [0066.897] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805da3e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0066.897] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.897] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1037a, lpOverlapped=0x0) returned 1 [0066.900] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf") returned="DefaultID.pdf" [0066.900] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.900] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1037a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1037a, lpOverlapped=0x0) returned 1 [0066.901] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.901] CloseHandle (hObject=0x94) returned 1 [0066.901] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\defaultid.pdf.wannacry")) returned 1 [0066.902] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x103f8, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0066.902] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0066.902] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x3, cFileName="JPN", cAlternateFileName="")) returned 1 [0066.902] lstrcmpA (lpString1=".", lpString2="JPN") returned -1 [0066.902] lstrcmpA (lpString1="..", lpString2="JPN") returned -1 [0066.903] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0066.903] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="JPN" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN" [0066.903] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN") returned 63 [0066.903] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d8f98, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0066.903] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.903] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.903] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.903] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.903] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5944, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0066.903] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.903] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0066.903] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0066.903] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0066.903] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\*.*") returned="*.*" [0066.904] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\" [0066.904] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\") returned="" [0066.904] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\HOW TO DECRYPT FILES.txt" [0066.904] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\how to decrypt files.txt")) returned 0xffffffff [0066.904] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.905] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0066.905] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0066.906] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.906] CloseHandle (hObject=0x94) returned 1 [0066.906] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf" [0066.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0066.906] lstrlenA (lpString="*.zip") returned 5 [0066.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0066.906] lstrlenA (lpString="*.rar") returned 5 [0066.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0066.906] lstrlenA (lpString="*.7z") returned 4 [0066.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0066.907] lstrlenA (lpString="*.tar") returned 5 [0066.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.gzip") returned 0 [0066.907] lstrlenA (lpString="*.gzip") returned 6 [0066.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0066.907] lstrlenA (lpString="*.jpg") returned 5 [0066.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0066.907] lstrlenA (lpString="*.jpeg") returned 6 [0066.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0066.907] lstrlenA (lpString="*.psd") returned 5 [0066.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.gif") returned 0 [0066.907] lstrlenA (lpString="*.gif") returned 5 [0066.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0066.907] lstrlenA (lpString="*.doc") returned 5 [0066.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0066.907] lstrlenA (lpString="*.docx") returned 6 [0066.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0066.907] lstrlenA (lpString="*.xls") returned 5 [0066.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0066.907] lstrlenA (lpString="*.xlsx") returned 6 [0066.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0066.907] lstrlenA (lpString="*.ppt") returned 5 [0066.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0066.907] lstrlenA (lpString="*.pptx") returned 6 [0066.907] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0066.907] lstrlenA (lpString="*.pdf") returned 5 [0066.907] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf" [0066.907] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf" [0066.908] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf." [0066.908] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf.wannacry" [0066.908] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.909] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5944 [0066.909] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805da3e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4)) returned 1 [0066.909] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.909] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x58c6, lpOverlapped=0x0) returned 1 [0066.912] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf") returned="AdobeID.pdf" [0066.912] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.912] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x58c6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x58c6, lpOverlapped=0x0) returned 1 [0066.912] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.914] CloseHandle (hObject=0x94) returned 1 [0066.914] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\adobeid.pdf.wannacry")) returned 1 [0066.918] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5404, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0066.918] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.918] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0066.918] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0066.918] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0066.918] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf") returned="AdobeID.pdf" [0066.918] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\" [0066.918] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\") returned="" [0066.918] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\HOW TO DECRYPT FILES.txt" [0066.918] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\how to decrypt files.txt")) returned 0x20 [0066.918] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf" [0066.933] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0066.933] lstrlenA (lpString="*.zip") returned 5 [0066.934] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0066.934] lstrlenA (lpString="*.rar") returned 5 [0066.934] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0066.934] lstrlenA (lpString="*.7z") returned 4 [0066.934] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0066.934] lstrlenA (lpString="*.tar") returned 5 [0066.934] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.gzip") returned 0 [0066.934] lstrlenA (lpString="*.gzip") returned 6 [0066.934] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0066.934] lstrlenA (lpString="*.jpg") returned 5 [0066.934] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0066.934] lstrlenA (lpString="*.jpeg") returned 6 [0066.934] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0066.934] lstrlenA (lpString="*.psd") returned 5 [0066.934] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.gif") returned 0 [0066.934] lstrlenA (lpString="*.gif") returned 5 [0066.934] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0066.934] lstrlenA (lpString="*.doc") returned 5 [0066.934] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0066.934] lstrlenA (lpString="*.docx") returned 6 [0066.934] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0066.934] lstrlenA (lpString="*.xls") returned 5 [0066.934] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0066.934] lstrlenA (lpString="*.xlsx") returned 6 [0066.934] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0066.934] lstrlenA (lpString="*.ppt") returned 5 [0066.934] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0066.934] lstrlenA (lpString="*.pptx") returned 6 [0066.934] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0066.934] lstrlenA (lpString="*.pdf") returned 5 [0066.934] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf" [0066.935] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf" [0066.935] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf." [0066.935] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf.wannacry" [0066.935] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.936] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5404 [0066.936] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805da3e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0066.936] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.937] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x5386, lpOverlapped=0x0) returned 1 [0066.938] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf") returned="DefaultID.pdf" [0066.938] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.938] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x5386, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x5386, lpOverlapped=0x0) returned 1 [0066.939] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.939] CloseHandle (hObject=0x94) returned 1 [0066.939] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\defaultid.pdf.wannacry")) returned 1 [0066.940] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5404, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0066.940] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0066.940] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x3, cFileName="KOR", cAlternateFileName="")) returned 1 [0066.940] lstrcmpA (lpString1=".", lpString2="KOR") returned -1 [0066.940] lstrcmpA (lpString1="..", lpString2="KOR") returned -1 [0066.940] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0066.940] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="KOR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR" [0066.940] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR") returned 63 [0066.940] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d8f98, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0066.940] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.940] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.941] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.941] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.941] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x592a, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0066.941] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.941] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0066.941] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0066.941] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0066.941] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\*.*") returned="*.*" [0066.941] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\" [0066.941] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\") returned="" [0066.941] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\HOW TO DECRYPT FILES.txt" [0066.941] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\how to decrypt files.txt")) returned 0xffffffff [0066.941] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.942] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0066.942] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0066.943] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.943] CloseHandle (hObject=0x94) returned 1 [0066.943] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf" [0066.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0066.943] lstrlenA (lpString="*.zip") returned 5 [0066.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0066.943] lstrlenA (lpString="*.rar") returned 5 [0066.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0066.943] lstrlenA (lpString="*.7z") returned 4 [0066.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0066.943] lstrlenA (lpString="*.tar") returned 5 [0066.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.gzip") returned 0 [0066.943] lstrlenA (lpString="*.gzip") returned 6 [0066.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0066.943] lstrlenA (lpString="*.jpg") returned 5 [0066.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0066.943] lstrlenA (lpString="*.jpeg") returned 6 [0066.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0066.943] lstrlenA (lpString="*.psd") returned 5 [0066.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.gif") returned 0 [0066.943] lstrlenA (lpString="*.gif") returned 5 [0066.943] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0066.944] lstrlenA (lpString="*.doc") returned 5 [0066.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0066.944] lstrlenA (lpString="*.docx") returned 6 [0066.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0066.944] lstrlenA (lpString="*.xls") returned 5 [0066.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0066.944] lstrlenA (lpString="*.xlsx") returned 6 [0066.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0066.944] lstrlenA (lpString="*.ppt") returned 5 [0066.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0066.944] lstrlenA (lpString="*.pptx") returned 6 [0066.944] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0066.944] lstrlenA (lpString="*.pdf") returned 5 [0066.944] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf" [0066.944] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf" [0066.944] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf." [0066.944] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf.wannacry" [0066.944] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.945] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x592a [0066.945] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805da3e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4)) returned 1 [0066.945] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.945] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x58ac, lpOverlapped=0x0) returned 1 [0066.946] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf") returned="AdobeID.pdf" [0066.946] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.946] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x58ac, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x58ac, lpOverlapped=0x0) returned 1 [0066.947] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.947] CloseHandle (hObject=0x94) returned 1 [0066.947] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\adobeid.pdf.wannacry")) returned 1 [0066.950] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5416, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0066.950] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.950] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0066.950] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0066.950] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0066.950] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf") returned="AdobeID.pdf" [0066.950] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\" [0066.950] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\") returned="" [0066.950] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\HOW TO DECRYPT FILES.txt" [0066.950] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\how to decrypt files.txt")) returned 0x20 [0066.950] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf" [0066.950] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0066.950] lstrlenA (lpString="*.zip") returned 5 [0066.950] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0066.950] lstrlenA (lpString="*.rar") returned 5 [0066.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0066.951] lstrlenA (lpString="*.7z") returned 4 [0066.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0066.951] lstrlenA (lpString="*.tar") returned 5 [0066.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.gzip") returned 0 [0066.951] lstrlenA (lpString="*.gzip") returned 6 [0066.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0066.951] lstrlenA (lpString="*.jpg") returned 5 [0066.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0066.951] lstrlenA (lpString="*.jpeg") returned 6 [0066.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0066.951] lstrlenA (lpString="*.psd") returned 5 [0066.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.gif") returned 0 [0066.951] lstrlenA (lpString="*.gif") returned 5 [0066.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0066.951] lstrlenA (lpString="*.doc") returned 5 [0066.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0066.951] lstrlenA (lpString="*.docx") returned 6 [0066.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0066.951] lstrlenA (lpString="*.xls") returned 5 [0066.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0066.951] lstrlenA (lpString="*.xlsx") returned 6 [0066.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0066.951] lstrlenA (lpString="*.ppt") returned 5 [0066.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0066.951] lstrlenA (lpString="*.pptx") returned 6 [0066.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0066.952] lstrlenA (lpString="*.pdf") returned 5 [0066.952] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf" [0066.952] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf" [0066.952] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf." [0066.952] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf.wannacry" [0066.952] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.952] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5416 [0066.952] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805da3e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4)) returned 1 [0066.953] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.953] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x5398, lpOverlapped=0x0) returned 1 [0066.955] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf") returned="DefaultID.pdf" [0066.955] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.955] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x5398, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x5398, lpOverlapped=0x0) returned 1 [0066.955] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.956] CloseHandle (hObject=0x94) returned 1 [0066.956] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\defaultid.pdf.wannacry")) returned 1 [0066.957] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5416, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0066.957] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0066.957] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x3, cFileName="NLD", cAlternateFileName="")) returned 1 [0066.957] lstrcmpA (lpString1=".", lpString2="NLD") returned -1 [0066.957] lstrcmpA (lpString1="..", lpString2="NLD") returned -1 [0066.957] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0066.957] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="NLD" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD" [0066.957] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD") returned 63 [0066.957] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d8f98, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0066.958] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.958] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.958] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.958] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.958] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10929, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0066.958] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.958] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0066.958] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0066.958] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0066.958] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\*.*") returned="*.*" [0066.959] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\" [0066.959] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\") returned="" [0066.959] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\HOW TO DECRYPT FILES.txt" [0066.959] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\how to decrypt files.txt")) returned 0xffffffff [0066.959] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.959] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0066.960] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0066.961] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.961] CloseHandle (hObject=0x94) returned 1 [0066.961] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf" [0066.961] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0066.961] lstrlenA (lpString="*.zip") returned 5 [0066.961] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0066.961] lstrlenA (lpString="*.rar") returned 5 [0066.961] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0066.961] lstrlenA (lpString="*.7z") returned 4 [0066.961] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0066.961] lstrlenA (lpString="*.tar") returned 5 [0066.961] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.gzip") returned 0 [0066.961] lstrlenA (lpString="*.gzip") returned 6 [0066.961] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0066.961] lstrlenA (lpString="*.jpg") returned 5 [0066.961] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0066.961] lstrlenA (lpString="*.jpeg") returned 6 [0066.961] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0066.962] lstrlenA (lpString="*.psd") returned 5 [0066.962] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.gif") returned 0 [0066.962] lstrlenA (lpString="*.gif") returned 5 [0066.962] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0066.962] lstrlenA (lpString="*.doc") returned 5 [0066.962] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0066.962] lstrlenA (lpString="*.docx") returned 6 [0066.962] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0066.962] lstrlenA (lpString="*.xls") returned 5 [0066.962] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0066.962] lstrlenA (lpString="*.xlsx") returned 6 [0066.962] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0066.962] lstrlenA (lpString="*.ppt") returned 5 [0066.962] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0066.962] lstrlenA (lpString="*.pptx") returned 6 [0066.962] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0066.962] lstrlenA (lpString="*.pdf") returned 5 [0066.962] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf" [0066.962] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf" [0066.962] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf." [0066.962] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf.wannacry" [0066.962] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.963] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10929 [0066.963] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805da3e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0066.963] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.963] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x108ab, lpOverlapped=0x0) returned 1 [0066.966] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf") returned="AdobeID.pdf" [0066.966] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.966] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x108ab, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x108ab, lpOverlapped=0x0) returned 1 [0066.966] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.966] CloseHandle (hObject=0x94) returned 1 [0066.966] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\adobeid.pdf.wannacry")) returned 1 [0066.969] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10405, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0066.969] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.969] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0066.969] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0066.969] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0066.970] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf") returned="AdobeID.pdf" [0066.970] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\" [0066.970] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\") returned="" [0066.970] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\HOW TO DECRYPT FILES.txt" [0066.970] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\how to decrypt files.txt")) returned 0x20 [0066.970] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf" [0066.970] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0066.970] lstrlenA (lpString="*.zip") returned 5 [0066.970] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0066.970] lstrlenA (lpString="*.rar") returned 5 [0066.970] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0066.970] lstrlenA (lpString="*.7z") returned 4 [0066.970] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0066.970] lstrlenA (lpString="*.tar") returned 5 [0066.970] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.gzip") returned 0 [0066.970] lstrlenA (lpString="*.gzip") returned 6 [0066.970] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0066.970] lstrlenA (lpString="*.jpg") returned 5 [0066.970] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0066.970] lstrlenA (lpString="*.jpeg") returned 6 [0066.970] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0066.970] lstrlenA (lpString="*.psd") returned 5 [0066.970] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.gif") returned 0 [0066.970] lstrlenA (lpString="*.gif") returned 5 [0066.970] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0066.970] lstrlenA (lpString="*.doc") returned 5 [0066.970] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0066.970] lstrlenA (lpString="*.docx") returned 6 [0066.970] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0066.970] lstrlenA (lpString="*.xls") returned 5 [0066.970] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0066.970] lstrlenA (lpString="*.xlsx") returned 6 [0066.971] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0066.971] lstrlenA (lpString="*.ppt") returned 5 [0066.971] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0066.971] lstrlenA (lpString="*.pptx") returned 6 [0066.971] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0066.971] lstrlenA (lpString="*.pdf") returned 5 [0066.971] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf" [0066.971] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf" [0066.971] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf." [0066.971] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf.wannacry" [0066.971] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.971] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10405 [0066.971] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805da3e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0066.972] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.972] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x10387, lpOverlapped=0x0) returned 1 [0066.973] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf") returned="DefaultID.pdf" [0066.973] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.974] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x10387, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x10387, lpOverlapped=0x0) returned 1 [0066.974] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.974] CloseHandle (hObject=0x94) returned 1 [0066.974] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\defaultid.pdf.wannacry")) returned 1 [0066.975] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10405, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0066.975] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0066.975] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x3, cFileName="NOR", cAlternateFileName="")) returned 1 [0066.975] lstrcmpA (lpString1=".", lpString2="NOR") returned -1 [0066.975] lstrcmpA (lpString1="..", lpString2="NOR") returned -1 [0066.975] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0066.975] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="NOR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR" [0066.975] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR") returned 63 [0066.975] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d8f98, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0066.976] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.976] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.976] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.976] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.976] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10956, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0066.976] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.976] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0066.976] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0066.976] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0066.976] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\*.*") returned="*.*" [0066.976] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\" [0066.976] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\") returned="" [0066.976] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\HOW TO DECRYPT FILES.txt" [0066.976] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\how to decrypt files.txt")) returned 0xffffffff [0066.976] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.977] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0066.977] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0066.978] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.978] CloseHandle (hObject=0x94) returned 1 [0066.978] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf" [0066.978] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0066.978] lstrlenA (lpString="*.zip") returned 5 [0066.978] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0066.978] lstrlenA (lpString="*.rar") returned 5 [0066.978] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0066.978] lstrlenA (lpString="*.7z") returned 4 [0066.978] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0066.978] lstrlenA (lpString="*.tar") returned 5 [0066.978] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.gzip") returned 0 [0066.978] lstrlenA (lpString="*.gzip") returned 6 [0066.978] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0066.978] lstrlenA (lpString="*.jpg") returned 5 [0066.978] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0066.978] lstrlenA (lpString="*.jpeg") returned 6 [0066.978] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0066.978] lstrlenA (lpString="*.psd") returned 5 [0066.978] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.gif") returned 0 [0066.978] lstrlenA (lpString="*.gif") returned 5 [0066.978] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0066.979] lstrlenA (lpString="*.doc") returned 5 [0066.979] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0066.979] lstrlenA (lpString="*.docx") returned 6 [0066.979] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0066.979] lstrlenA (lpString="*.xls") returned 5 [0066.979] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0066.979] lstrlenA (lpString="*.xlsx") returned 6 [0066.979] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0066.979] lstrlenA (lpString="*.ppt") returned 5 [0066.979] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0066.979] lstrlenA (lpString="*.pptx") returned 6 [0066.979] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0066.979] lstrlenA (lpString="*.pdf") returned 5 [0066.979] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf" [0066.979] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf" [0066.979] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf." [0066.979] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf.wannacry" [0066.979] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.980] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10956 [0066.980] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805da3e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0066.980] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.980] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x108d8, lpOverlapped=0x0) returned 1 [0066.983] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf") returned="AdobeID.pdf" [0066.983] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.983] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x108d8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x108d8, lpOverlapped=0x0) returned 1 [0066.983] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.984] CloseHandle (hObject=0x94) returned 1 [0066.984] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\adobeid.pdf.wannacry")) returned 1 [0066.986] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1043a, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0066.986] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.987] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0066.987] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0066.987] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0066.987] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf") returned="AdobeID.pdf" [0066.987] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\" [0066.987] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\") returned="" [0066.987] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\HOW TO DECRYPT FILES.txt" [0066.987] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\how to decrypt files.txt")) returned 0x20 [0066.987] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf" [0066.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0066.987] lstrlenA (lpString="*.zip") returned 5 [0066.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0066.987] lstrlenA (lpString="*.rar") returned 5 [0066.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0066.987] lstrlenA (lpString="*.7z") returned 4 [0066.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0066.987] lstrlenA (lpString="*.tar") returned 5 [0066.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.gzip") returned 0 [0066.987] lstrlenA (lpString="*.gzip") returned 6 [0066.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0066.987] lstrlenA (lpString="*.jpg") returned 5 [0066.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0066.987] lstrlenA (lpString="*.jpeg") returned 6 [0066.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0066.987] lstrlenA (lpString="*.psd") returned 5 [0066.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.gif") returned 0 [0066.987] lstrlenA (lpString="*.gif") returned 5 [0066.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0066.987] lstrlenA (lpString="*.doc") returned 5 [0066.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0066.987] lstrlenA (lpString="*.docx") returned 6 [0066.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0066.988] lstrlenA (lpString="*.xls") returned 5 [0066.988] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0066.988] lstrlenA (lpString="*.xlsx") returned 6 [0066.988] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0066.988] lstrlenA (lpString="*.ppt") returned 5 [0066.988] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0066.988] lstrlenA (lpString="*.pptx") returned 6 [0066.988] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0066.988] lstrlenA (lpString="*.pdf") returned 5 [0066.988] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf" [0066.988] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf" [0066.988] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf." [0066.988] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf.wannacry" [0066.988] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.988] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1043a [0066.988] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805da3e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4)) returned 1 [0066.988] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.989] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x103bc, lpOverlapped=0x0) returned 1 [0066.990] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf") returned="DefaultID.pdf" [0066.990] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.990] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x103bc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x103bc, lpOverlapped=0x0) returned 1 [0066.991] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.991] CloseHandle (hObject=0x94) returned 1 [0066.991] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\defaultid.pdf.wannacry")) returned 1 [0066.991] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1043a, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0066.992] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0066.992] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x3, cFileName="POL", cAlternateFileName="")) returned 1 [0066.992] lstrcmpA (lpString1=".", lpString2="POL") returned -1 [0066.992] lstrcmpA (lpString1="..", lpString2="POL") returned -1 [0066.992] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0066.992] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="POL" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL" [0066.992] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL") returned 63 [0066.992] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d8f98, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0066.993] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.993] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0066.993] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.993] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.993] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x26ca2, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0066.993] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0066.993] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0066.993] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0066.993] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0066.993] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\*.*") returned="*.*" [0066.993] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\" [0066.993] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\") returned="" [0066.993] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\HOW TO DECRYPT FILES.txt" [0066.993] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\how to decrypt files.txt")) returned 0xffffffff [0066.993] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.994] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0066.994] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0066.995] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0066.995] CloseHandle (hObject=0x94) returned 1 [0066.995] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf" [0066.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0066.995] lstrlenA (lpString="*.zip") returned 5 [0066.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0066.995] lstrlenA (lpString="*.rar") returned 5 [0066.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0066.995] lstrlenA (lpString="*.7z") returned 4 [0066.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0066.995] lstrlenA (lpString="*.tar") returned 5 [0066.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.gzip") returned 0 [0066.995] lstrlenA (lpString="*.gzip") returned 6 [0066.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0066.995] lstrlenA (lpString="*.jpg") returned 5 [0066.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0066.995] lstrlenA (lpString="*.jpeg") returned 6 [0066.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0066.995] lstrlenA (lpString="*.psd") returned 5 [0066.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.gif") returned 0 [0066.995] lstrlenA (lpString="*.gif") returned 5 [0066.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0066.995] lstrlenA (lpString="*.doc") returned 5 [0066.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0066.996] lstrlenA (lpString="*.docx") returned 6 [0066.996] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0066.996] lstrlenA (lpString="*.xls") returned 5 [0066.996] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0066.996] lstrlenA (lpString="*.xlsx") returned 6 [0066.996] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0066.996] lstrlenA (lpString="*.ppt") returned 5 [0066.996] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0066.996] lstrlenA (lpString="*.pptx") returned 6 [0066.996] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0066.996] lstrlenA (lpString="*.pdf") returned 5 [0066.996] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf" [0066.996] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf" [0066.996] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf." [0066.996] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf.wannacry" [0066.996] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0066.996] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x26ca2 [0066.996] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a2abc0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0066.997] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0066.997] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x26c24, lpOverlapped=0x0) returned 1 [0067.000] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf") returned="AdobeID.pdf" [0067.000] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.000] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x26c24, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x26c24, lpOverlapped=0x0) returned 1 [0067.000] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.000] CloseHandle (hObject=0x94) returned 1 [0067.000] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\adobeid.pdf.wannacry")) returned 1 [0067.003] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25d4a, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0067.003] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.003] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0067.003] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0067.003] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0067.003] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf") returned="AdobeID.pdf" [0067.003] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\" [0067.003] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\") returned="" [0067.003] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\HOW TO DECRYPT FILES.txt" [0067.004] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\how to decrypt files.txt")) returned 0x20 [0067.004] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf" [0067.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0067.004] lstrlenA (lpString="*.zip") returned 5 [0067.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0067.004] lstrlenA (lpString="*.rar") returned 5 [0067.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0067.004] lstrlenA (lpString="*.7z") returned 4 [0067.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0067.004] lstrlenA (lpString="*.tar") returned 5 [0067.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.gzip") returned 0 [0067.004] lstrlenA (lpString="*.gzip") returned 6 [0067.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0067.004] lstrlenA (lpString="*.jpg") returned 5 [0067.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0067.004] lstrlenA (lpString="*.jpeg") returned 6 [0067.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0067.004] lstrlenA (lpString="*.psd") returned 5 [0067.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.gif") returned 0 [0067.004] lstrlenA (lpString="*.gif") returned 5 [0067.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0067.004] lstrlenA (lpString="*.doc") returned 5 [0067.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0067.004] lstrlenA (lpString="*.docx") returned 6 [0067.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0067.004] lstrlenA (lpString="*.xls") returned 5 [0067.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0067.005] lstrlenA (lpString="*.xlsx") returned 6 [0067.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0067.005] lstrlenA (lpString="*.ppt") returned 5 [0067.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0067.005] lstrlenA (lpString="*.pptx") returned 6 [0067.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0067.005] lstrlenA (lpString="*.pdf") returned 5 [0067.005] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf" [0067.005] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf" [0067.005] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf." [0067.005] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf.wannacry" [0067.005] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.005] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25d4a [0067.006] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a2abc0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0067.006] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.006] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x25ccc, lpOverlapped=0x0) returned 1 [0067.008] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf") returned="DefaultID.pdf" [0067.008] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.009] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x25ccc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x25ccc, lpOverlapped=0x0) returned 1 [0067.009] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.009] CloseHandle (hObject=0x94) returned 1 [0067.009] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\defaultid.pdf.wannacry")) returned 1 [0067.010] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25d4a, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0067.010] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.010] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x3, cFileName="PTB", cAlternateFileName="")) returned 1 [0067.010] lstrcmpA (lpString1=".", lpString2="PTB") returned -1 [0067.010] lstrcmpA (lpString1="..", lpString2="PTB") returned -1 [0067.010] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0067.010] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="PTB" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB" [0067.010] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB") returned 63 [0067.010] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d8f98, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.010] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.010] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0067.010] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.010] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.010] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11426, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0067.011] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.011] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0067.011] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0067.011] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0067.011] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\*.*") returned="*.*" [0067.011] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\" [0067.011] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\") returned="" [0067.011] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\HOW TO DECRYPT FILES.txt" [0067.011] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\how to decrypt files.txt")) returned 0xffffffff [0067.011] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.011] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0067.011] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.012] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.013] CloseHandle (hObject=0x94) returned 1 [0067.013] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf" [0067.013] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0067.013] lstrlenA (lpString="*.zip") returned 5 [0067.013] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0067.013] lstrlenA (lpString="*.rar") returned 5 [0067.013] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0067.013] lstrlenA (lpString="*.7z") returned 4 [0067.013] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0067.013] lstrlenA (lpString="*.tar") returned 5 [0067.013] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.gzip") returned 0 [0067.013] lstrlenA (lpString="*.gzip") returned 6 [0067.013] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0067.013] lstrlenA (lpString="*.jpg") returned 5 [0067.013] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0067.013] lstrlenA (lpString="*.jpeg") returned 6 [0067.013] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0067.013] lstrlenA (lpString="*.psd") returned 5 [0067.013] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.gif") returned 0 [0067.013] lstrlenA (lpString="*.gif") returned 5 [0067.013] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0067.013] lstrlenA (lpString="*.doc") returned 5 [0067.013] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0067.013] lstrlenA (lpString="*.docx") returned 6 [0067.013] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0067.014] lstrlenA (lpString="*.xls") returned 5 [0067.014] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0067.014] lstrlenA (lpString="*.xlsx") returned 6 [0067.014] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0067.014] lstrlenA (lpString="*.ppt") returned 5 [0067.014] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0067.014] lstrlenA (lpString="*.pptx") returned 6 [0067.014] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0067.014] lstrlenA (lpString="*.pdf") returned 5 [0067.014] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf" [0067.014] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf" [0067.014] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf." [0067.014] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf.wannacry" [0067.014] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.015] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11426 [0067.015] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805b4280, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4)) returned 1 [0067.015] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.015] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x113a8, lpOverlapped=0x0) returned 1 [0067.017] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf") returned="AdobeID.pdf" [0067.017] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.017] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x113a8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x113a8, lpOverlapped=0x0) returned 1 [0067.017] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.018] CloseHandle (hObject=0x94) returned 1 [0067.018] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\adobeid.pdf.wannacry")) returned 1 [0067.020] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10f09, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0067.020] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.020] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0067.020] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0067.020] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0067.020] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf") returned="AdobeID.pdf" [0067.020] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\" [0067.020] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\") returned="" [0067.020] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\HOW TO DECRYPT FILES.txt" [0067.020] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\how to decrypt files.txt")) returned 0x20 [0067.020] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf" [0067.020] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0067.020] lstrlenA (lpString="*.zip") returned 5 [0067.021] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0067.021] lstrlenA (lpString="*.rar") returned 5 [0067.021] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0067.021] lstrlenA (lpString="*.7z") returned 4 [0067.021] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0067.021] lstrlenA (lpString="*.tar") returned 5 [0067.021] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.gzip") returned 0 [0067.021] lstrlenA (lpString="*.gzip") returned 6 [0067.021] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0067.021] lstrlenA (lpString="*.jpg") returned 5 [0067.021] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0067.021] lstrlenA (lpString="*.jpeg") returned 6 [0067.021] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0067.021] lstrlenA (lpString="*.psd") returned 5 [0067.021] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.gif") returned 0 [0067.021] lstrlenA (lpString="*.gif") returned 5 [0067.021] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0067.021] lstrlenA (lpString="*.doc") returned 5 [0067.021] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0067.021] lstrlenA (lpString="*.docx") returned 6 [0067.021] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0067.021] lstrlenA (lpString="*.xls") returned 5 [0067.021] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0067.021] lstrlenA (lpString="*.xlsx") returned 6 [0067.021] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0067.021] lstrlenA (lpString="*.ppt") returned 5 [0067.021] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0067.021] lstrlenA (lpString="*.pptx") returned 6 [0067.021] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0067.021] lstrlenA (lpString="*.pdf") returned 5 [0067.021] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf" [0067.021] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf" [0067.021] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf." [0067.022] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf.wannacry" [0067.022] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.022] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10f09 [0067.022] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805b4280, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4)) returned 1 [0067.022] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.022] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x10e8b, lpOverlapped=0x0) returned 1 [0067.024] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf") returned="DefaultID.pdf" [0067.024] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.024] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x10e8b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x10e8b, lpOverlapped=0x0) returned 1 [0067.025] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.025] CloseHandle (hObject=0x94) returned 1 [0067.025] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\defaultid.pdf.wannacry")) returned 1 [0067.025] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10f09, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0067.025] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.025] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x3, cFileName="RUM", cAlternateFileName="")) returned 1 [0067.026] lstrcmpA (lpString1=".", lpString2="RUM") returned -1 [0067.026] lstrcmpA (lpString1="..", lpString2="RUM") returned -1 [0067.026] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0067.026] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="RUM" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM" [0067.026] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM") returned 63 [0067.026] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d8f98, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.027] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.027] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0067.027] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.027] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.027] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5891, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0067.027] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.027] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0067.027] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0067.027] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0067.027] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\*.*") returned="*.*" [0067.027] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\" [0067.027] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\") returned="" [0067.027] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\HOW TO DECRYPT FILES.txt" [0067.027] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\how to decrypt files.txt")) returned 0xffffffff [0067.027] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.028] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0067.028] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.029] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.032] CloseHandle (hObject=0x94) returned 1 [0067.032] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf" [0067.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0067.032] lstrlenA (lpString="*.zip") returned 5 [0067.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0067.032] lstrlenA (lpString="*.rar") returned 5 [0067.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0067.032] lstrlenA (lpString="*.7z") returned 4 [0067.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0067.032] lstrlenA (lpString="*.tar") returned 5 [0067.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.gzip") returned 0 [0067.032] lstrlenA (lpString="*.gzip") returned 6 [0067.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0067.032] lstrlenA (lpString="*.jpg") returned 5 [0067.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0067.033] lstrlenA (lpString="*.jpeg") returned 6 [0067.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0067.033] lstrlenA (lpString="*.psd") returned 5 [0067.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.gif") returned 0 [0067.033] lstrlenA (lpString="*.gif") returned 5 [0067.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0067.033] lstrlenA (lpString="*.doc") returned 5 [0067.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0067.033] lstrlenA (lpString="*.docx") returned 6 [0067.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0067.033] lstrlenA (lpString="*.xls") returned 5 [0067.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0067.033] lstrlenA (lpString="*.xlsx") returned 6 [0067.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0067.033] lstrlenA (lpString="*.ppt") returned 5 [0067.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0067.033] lstrlenA (lpString="*.pptx") returned 6 [0067.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0067.033] lstrlenA (lpString="*.pdf") returned 5 [0067.033] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf" [0067.033] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf" [0067.033] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf." [0067.033] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf.wannacry" [0067.033] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.034] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5891 [0067.034] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a2abc0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0067.034] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.034] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x5813, lpOverlapped=0x0) returned 1 [0067.047] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf") returned="AdobeID.pdf" [0067.047] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.047] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x5813, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x5813, lpOverlapped=0x0) returned 1 [0067.047] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.047] CloseHandle (hObject=0x94) returned 1 [0067.047] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\adobeid.pdf.wannacry")) returned 1 [0067.051] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5be8, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0067.051] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.051] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0067.051] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0067.051] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0067.051] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf") returned="AdobeID.pdf" [0067.051] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\" [0067.051] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\") returned="" [0067.051] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\HOW TO DECRYPT FILES.txt" [0067.051] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\how to decrypt files.txt")) returned 0x20 [0067.051] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf" [0067.051] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0067.051] lstrlenA (lpString="*.zip") returned 5 [0067.051] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0067.051] lstrlenA (lpString="*.rar") returned 5 [0067.051] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0067.052] lstrlenA (lpString="*.7z") returned 4 [0067.052] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0067.052] lstrlenA (lpString="*.tar") returned 5 [0067.052] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.gzip") returned 0 [0067.052] lstrlenA (lpString="*.gzip") returned 6 [0067.052] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0067.052] lstrlenA (lpString="*.jpg") returned 5 [0067.052] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0067.052] lstrlenA (lpString="*.jpeg") returned 6 [0067.052] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0067.052] lstrlenA (lpString="*.psd") returned 5 [0067.052] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.gif") returned 0 [0067.052] lstrlenA (lpString="*.gif") returned 5 [0067.052] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0067.052] lstrlenA (lpString="*.doc") returned 5 [0067.052] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0067.052] lstrlenA (lpString="*.docx") returned 6 [0067.052] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0067.052] lstrlenA (lpString="*.xls") returned 5 [0067.052] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0067.052] lstrlenA (lpString="*.xlsx") returned 6 [0067.052] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0067.052] lstrlenA (lpString="*.ppt") returned 5 [0067.052] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0067.053] lstrlenA (lpString="*.pptx") returned 6 [0067.053] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0067.053] lstrlenA (lpString="*.pdf") returned 5 [0067.053] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf" [0067.053] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf" [0067.053] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf." [0067.053] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf.wannacry" [0067.053] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.054] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5be8 [0067.054] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a2abc0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0067.054] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.054] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x5b6a, lpOverlapped=0x0) returned 1 [0067.057] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf") returned="DefaultID.pdf" [0067.057] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.057] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x5b6a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x5b6a, lpOverlapped=0x0) returned 1 [0067.057] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.057] CloseHandle (hObject=0x94) returned 1 [0067.057] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\defaultid.pdf.wannacry")) returned 1 [0067.058] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5be8, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0067.059] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.059] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x3, cFileName="RUS", cAlternateFileName="")) returned 1 [0067.059] lstrcmpA (lpString1=".", lpString2="RUS") returned -1 [0067.059] lstrcmpA (lpString1="..", lpString2="RUS") returned -1 [0067.059] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0067.059] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="RUS" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS" [0067.059] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS") returned 63 [0067.059] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d8f98, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.059] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.059] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0067.059] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.059] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.059] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e071, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0067.059] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.060] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0067.060] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0067.060] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0067.060] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\*.*") returned="*.*" [0067.060] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\" [0067.060] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\") returned="" [0067.060] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\HOW TO DECRYPT FILES.txt" [0067.060] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\how to decrypt files.txt")) returned 0xffffffff [0067.060] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.061] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0067.061] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.062] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.062] CloseHandle (hObject=0x94) returned 1 [0067.062] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf" [0067.062] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0067.062] lstrlenA (lpString="*.zip") returned 5 [0067.062] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0067.062] lstrlenA (lpString="*.rar") returned 5 [0067.062] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0067.062] lstrlenA (lpString="*.7z") returned 4 [0067.062] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0067.063] lstrlenA (lpString="*.tar") returned 5 [0067.063] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.gzip") returned 0 [0067.063] lstrlenA (lpString="*.gzip") returned 6 [0067.063] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0067.063] lstrlenA (lpString="*.jpg") returned 5 [0067.063] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0067.063] lstrlenA (lpString="*.jpeg") returned 6 [0067.063] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0067.063] lstrlenA (lpString="*.psd") returned 5 [0067.063] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.gif") returned 0 [0067.063] lstrlenA (lpString="*.gif") returned 5 [0067.063] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0067.063] lstrlenA (lpString="*.doc") returned 5 [0067.063] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0067.063] lstrlenA (lpString="*.docx") returned 6 [0067.063] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0067.063] lstrlenA (lpString="*.xls") returned 5 [0067.063] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0067.063] lstrlenA (lpString="*.xlsx") returned 6 [0067.063] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0067.063] lstrlenA (lpString="*.ppt") returned 5 [0067.063] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0067.063] lstrlenA (lpString="*.pptx") returned 6 [0067.063] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0067.064] lstrlenA (lpString="*.pdf") returned 5 [0067.064] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf" [0067.064] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf" [0067.064] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf." [0067.064] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf.wannacry" [0067.064] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.064] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e071 [0067.065] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a04a60, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0067.065] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.065] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1dff3, lpOverlapped=0x0) returned 1 [0067.068] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf") returned="AdobeID.pdf" [0067.068] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.068] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1dff3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1dff3, lpOverlapped=0x0) returned 1 [0067.069] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.069] CloseHandle (hObject=0x94) returned 1 [0067.069] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\adobeid.pdf.wannacry")) returned 1 [0067.072] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d17f, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0067.072] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.072] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0067.072] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0067.072] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0067.073] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf") returned="AdobeID.pdf" [0067.073] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\" [0067.073] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\") returned="" [0067.073] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\HOW TO DECRYPT FILES.txt" [0067.073] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\how to decrypt files.txt")) returned 0x20 [0067.073] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf" [0067.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0067.073] lstrlenA (lpString="*.zip") returned 5 [0067.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0067.073] lstrlenA (lpString="*.rar") returned 5 [0067.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0067.073] lstrlenA (lpString="*.7z") returned 4 [0067.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0067.073] lstrlenA (lpString="*.tar") returned 5 [0067.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.gzip") returned 0 [0067.073] lstrlenA (lpString="*.gzip") returned 6 [0067.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0067.073] lstrlenA (lpString="*.jpg") returned 5 [0067.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0067.073] lstrlenA (lpString="*.jpeg") returned 6 [0067.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0067.074] lstrlenA (lpString="*.psd") returned 5 [0067.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.gif") returned 0 [0067.074] lstrlenA (lpString="*.gif") returned 5 [0067.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0067.074] lstrlenA (lpString="*.doc") returned 5 [0067.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0067.074] lstrlenA (lpString="*.docx") returned 6 [0067.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0067.074] lstrlenA (lpString="*.xls") returned 5 [0067.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0067.074] lstrlenA (lpString="*.xlsx") returned 6 [0067.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0067.074] lstrlenA (lpString="*.ppt") returned 5 [0067.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0067.074] lstrlenA (lpString="*.pptx") returned 6 [0067.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0067.074] lstrlenA (lpString="*.pdf") returned 5 [0067.074] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf" [0067.074] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf" [0067.074] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf." [0067.074] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf.wannacry" [0067.074] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.075] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d17f [0067.075] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a04a60, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0067.075] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.075] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1d101, lpOverlapped=0x0) returned 1 [0067.079] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf") returned="DefaultID.pdf" [0067.079] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.079] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1d101, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1d101, lpOverlapped=0x0) returned 1 [0067.079] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.079] CloseHandle (hObject=0x94) returned 1 [0067.080] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\defaultid.pdf.wannacry")) returned 1 [0067.081] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d17f, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0067.081] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.081] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x3, cFileName="SKY", cAlternateFileName="")) returned 1 [0067.081] lstrcmpA (lpString1=".", lpString2="SKY") returned -1 [0067.081] lstrcmpA (lpString1="..", lpString2="SKY") returned -1 [0067.081] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0067.081] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="SKY" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY" [0067.081] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY") returned 63 [0067.081] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d8f98, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.082] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.082] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0067.082] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.082] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.083] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x161fc, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0067.083] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.083] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0067.083] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0067.083] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0067.083] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\*.*") returned="*.*" [0067.083] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\" [0067.083] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\") returned="" [0067.083] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\HOW TO DECRYPT FILES.txt" [0067.083] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\how to decrypt files.txt")) returned 0xffffffff [0067.083] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.084] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0067.084] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.086] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.086] CloseHandle (hObject=0x94) returned 1 [0067.086] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf" [0067.086] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0067.086] lstrlenA (lpString="*.zip") returned 5 [0067.086] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0067.086] lstrlenA (lpString="*.rar") returned 5 [0067.086] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0067.086] lstrlenA (lpString="*.7z") returned 4 [0067.086] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0067.086] lstrlenA (lpString="*.tar") returned 5 [0067.086] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.gzip") returned 0 [0067.086] lstrlenA (lpString="*.gzip") returned 6 [0067.086] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0067.086] lstrlenA (lpString="*.jpg") returned 5 [0067.086] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0067.086] lstrlenA (lpString="*.jpeg") returned 6 [0067.086] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0067.086] lstrlenA (lpString="*.psd") returned 5 [0067.086] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.gif") returned 0 [0067.086] lstrlenA (lpString="*.gif") returned 5 [0067.087] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0067.087] lstrlenA (lpString="*.doc") returned 5 [0067.087] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0067.087] lstrlenA (lpString="*.docx") returned 6 [0067.087] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0067.087] lstrlenA (lpString="*.xls") returned 5 [0067.087] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0067.087] lstrlenA (lpString="*.xlsx") returned 6 [0067.087] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0067.087] lstrlenA (lpString="*.ppt") returned 5 [0067.087] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0067.087] lstrlenA (lpString="*.pptx") returned 6 [0067.087] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0067.087] lstrlenA (lpString="*.pdf") returned 5 [0067.087] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf" [0067.087] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf" [0067.087] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf." [0067.087] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf.wannacry" [0067.087] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.088] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x161fc [0067.088] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a04a60, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4)) returned 1 [0067.088] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.088] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1617e, lpOverlapped=0x0) returned 1 [0067.091] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf") returned="AdobeID.pdf" [0067.091] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.091] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1617e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1617e, lpOverlapped=0x0) returned 1 [0067.091] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.092] CloseHandle (hObject=0x94) returned 1 [0067.092] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\adobeid.pdf.wannacry")) returned 1 [0067.095] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13d46, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0067.095] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.095] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0067.095] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0067.095] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0067.095] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf") returned="AdobeID.pdf" [0067.096] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\" [0067.096] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\") returned="" [0067.096] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\HOW TO DECRYPT FILES.txt" [0067.096] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\how to decrypt files.txt")) returned 0x20 [0067.096] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf" [0067.096] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0067.096] lstrlenA (lpString="*.zip") returned 5 [0067.096] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0067.096] lstrlenA (lpString="*.rar") returned 5 [0067.096] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0067.096] lstrlenA (lpString="*.7z") returned 4 [0067.096] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0067.096] lstrlenA (lpString="*.tar") returned 5 [0067.096] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.gzip") returned 0 [0067.096] lstrlenA (lpString="*.gzip") returned 6 [0067.096] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0067.096] lstrlenA (lpString="*.jpg") returned 5 [0067.096] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0067.096] lstrlenA (lpString="*.jpeg") returned 6 [0067.096] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0067.096] lstrlenA (lpString="*.psd") returned 5 [0067.096] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.gif") returned 0 [0067.096] lstrlenA (lpString="*.gif") returned 5 [0067.096] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0067.096] lstrlenA (lpString="*.doc") returned 5 [0067.097] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0067.097] lstrlenA (lpString="*.docx") returned 6 [0067.097] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0067.097] lstrlenA (lpString="*.xls") returned 5 [0067.097] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0067.097] lstrlenA (lpString="*.xlsx") returned 6 [0067.097] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0067.097] lstrlenA (lpString="*.ppt") returned 5 [0067.097] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0067.097] lstrlenA (lpString="*.pptx") returned 6 [0067.097] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0067.097] lstrlenA (lpString="*.pdf") returned 5 [0067.097] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf" [0067.097] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf" [0067.097] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf." [0067.097] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf.wannacry" [0067.097] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.098] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13d46 [0067.098] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a04a60, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4)) returned 1 [0067.098] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.098] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x13cc8, lpOverlapped=0x0) returned 1 [0067.101] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf") returned="DefaultID.pdf" [0067.101] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.101] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x13cc8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x13cc8, lpOverlapped=0x0) returned 1 [0067.101] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.101] CloseHandle (hObject=0x94) returned 1 [0067.102] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\defaultid.pdf.wannacry")) returned 1 [0067.103] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13d46, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0067.103] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.103] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x3, cFileName="SLV", cAlternateFileName="")) returned 1 [0067.103] lstrcmpA (lpString1=".", lpString2="SLV") returned -1 [0067.103] lstrcmpA (lpString1="..", lpString2="SLV") returned -1 [0067.103] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0067.103] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="SLV" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV" [0067.103] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV") returned 63 [0067.103] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d8f98, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.104] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.104] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0067.104] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.104] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.104] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6133, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0067.105] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.105] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0067.105] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0067.105] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0067.105] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\*.*") returned="*.*" [0067.105] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\" [0067.105] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\") returned="" [0067.105] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\HOW TO DECRYPT FILES.txt" [0067.105] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\how to decrypt files.txt")) returned 0xffffffff [0067.105] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.106] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0067.106] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.107] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.107] CloseHandle (hObject=0x94) returned 1 [0067.108] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf" [0067.108] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0067.108] lstrlenA (lpString="*.zip") returned 5 [0067.108] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0067.108] lstrlenA (lpString="*.rar") returned 5 [0067.108] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0067.108] lstrlenA (lpString="*.7z") returned 4 [0067.108] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0067.108] lstrlenA (lpString="*.tar") returned 5 [0067.108] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.gzip") returned 0 [0067.108] lstrlenA (lpString="*.gzip") returned 6 [0067.108] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0067.108] lstrlenA (lpString="*.jpg") returned 5 [0067.108] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0067.108] lstrlenA (lpString="*.jpeg") returned 6 [0067.108] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0067.108] lstrlenA (lpString="*.psd") returned 5 [0067.108] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.gif") returned 0 [0067.108] lstrlenA (lpString="*.gif") returned 5 [0067.108] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0067.108] lstrlenA (lpString="*.doc") returned 5 [0067.108] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0067.108] lstrlenA (lpString="*.docx") returned 6 [0067.108] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0067.108] lstrlenA (lpString="*.xls") returned 5 [0067.109] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0067.109] lstrlenA (lpString="*.xlsx") returned 6 [0067.109] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0067.109] lstrlenA (lpString="*.ppt") returned 5 [0067.109] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0067.109] lstrlenA (lpString="*.pptx") returned 6 [0067.109] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0067.109] lstrlenA (lpString="*.pdf") returned 5 [0067.109] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf" [0067.109] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf" [0067.109] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf." [0067.109] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf.wannacry" [0067.109] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.110] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6133 [0067.110] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a04a60, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0067.110] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.110] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60b5, lpOverlapped=0x0) returned 1 [0067.112] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf") returned="AdobeID.pdf" [0067.112] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.112] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60b5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60b5, lpOverlapped=0x0) returned 1 [0067.113] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.113] CloseHandle (hObject=0x94) returned 1 [0067.113] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\adobeid.pdf.wannacry")) returned 1 [0067.116] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5aac, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0067.116] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.116] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0067.116] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0067.116] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0067.116] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf") returned="AdobeID.pdf" [0067.117] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\" [0067.117] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\") returned="" [0067.117] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\HOW TO DECRYPT FILES.txt" [0067.117] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\how to decrypt files.txt")) returned 0x20 [0067.117] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf" [0067.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0067.117] lstrlenA (lpString="*.zip") returned 5 [0067.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0067.117] lstrlenA (lpString="*.rar") returned 5 [0067.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0067.117] lstrlenA (lpString="*.7z") returned 4 [0067.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0067.117] lstrlenA (lpString="*.tar") returned 5 [0067.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.gzip") returned 0 [0067.117] lstrlenA (lpString="*.gzip") returned 6 [0067.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0067.117] lstrlenA (lpString="*.jpg") returned 5 [0067.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0067.117] lstrlenA (lpString="*.jpeg") returned 6 [0067.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0067.117] lstrlenA (lpString="*.psd") returned 5 [0067.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.gif") returned 0 [0067.117] lstrlenA (lpString="*.gif") returned 5 [0067.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0067.118] lstrlenA (lpString="*.doc") returned 5 [0067.118] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0067.118] lstrlenA (lpString="*.docx") returned 6 [0067.118] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0067.118] lstrlenA (lpString="*.xls") returned 5 [0067.118] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0067.118] lstrlenA (lpString="*.xlsx") returned 6 [0067.118] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0067.118] lstrlenA (lpString="*.ppt") returned 5 [0067.118] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0067.118] lstrlenA (lpString="*.pptx") returned 6 [0067.118] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0067.118] lstrlenA (lpString="*.pdf") returned 5 [0067.118] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf" [0067.118] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf" [0067.118] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf." [0067.118] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf.wannacry" [0067.118] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.119] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5aac [0067.119] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a04a60, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0067.119] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.119] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x5a2e, lpOverlapped=0x0) returned 1 [0067.121] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf") returned="DefaultID.pdf" [0067.122] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.122] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x5a2e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x5a2e, lpOverlapped=0x0) returned 1 [0067.122] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.122] CloseHandle (hObject=0x94) returned 1 [0067.122] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\defaultid.pdf.wannacry")) returned 1 [0067.123] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5aac, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0067.123] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.123] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x3, cFileName="SUO", cAlternateFileName="")) returned 1 [0067.123] lstrcmpA (lpString1=".", lpString2="SUO") returned -1 [0067.123] lstrcmpA (lpString1="..", lpString2="SUO") returned -1 [0067.123] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0067.124] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="SUO" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO" [0067.124] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO") returned 63 [0067.124] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d8f98, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.124] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.124] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0067.124] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.124] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.124] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x107e2, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0067.124] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.124] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0067.124] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0067.124] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0067.124] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\*.*") returned="*.*" [0067.124] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\" [0067.124] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\") returned="" [0067.124] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\HOW TO DECRYPT FILES.txt" [0067.125] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\how to decrypt files.txt")) returned 0xffffffff [0067.125] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.125] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0067.125] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.127] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.127] CloseHandle (hObject=0x94) returned 1 [0067.127] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf" [0067.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0067.127] lstrlenA (lpString="*.zip") returned 5 [0067.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0067.127] lstrlenA (lpString="*.rar") returned 5 [0067.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0067.127] lstrlenA (lpString="*.7z") returned 4 [0067.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0067.127] lstrlenA (lpString="*.tar") returned 5 [0067.128] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.gzip") returned 0 [0067.128] lstrlenA (lpString="*.gzip") returned 6 [0067.128] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0067.128] lstrlenA (lpString="*.jpg") returned 5 [0067.128] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0067.128] lstrlenA (lpString="*.jpeg") returned 6 [0067.128] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0067.128] lstrlenA (lpString="*.psd") returned 5 [0067.128] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.gif") returned 0 [0067.128] lstrlenA (lpString="*.gif") returned 5 [0067.128] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0067.128] lstrlenA (lpString="*.doc") returned 5 [0067.128] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0067.128] lstrlenA (lpString="*.docx") returned 6 [0067.128] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0067.128] lstrlenA (lpString="*.xls") returned 5 [0067.128] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0067.128] lstrlenA (lpString="*.xlsx") returned 6 [0067.128] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0067.128] lstrlenA (lpString="*.ppt") returned 5 [0067.128] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0067.128] lstrlenA (lpString="*.pptx") returned 6 [0067.128] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0067.128] lstrlenA (lpString="*.pdf") returned 5 [0067.128] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf" [0067.129] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf" [0067.129] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf." [0067.129] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf.wannacry" [0067.129] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.129] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x107e2 [0067.129] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805b4280, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0067.130] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.130] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x10764, lpOverlapped=0x0) returned 1 [0067.132] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf") returned="AdobeID.pdf" [0067.132] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.132] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x10764, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x10764, lpOverlapped=0x0) returned 1 [0067.133] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.133] CloseHandle (hObject=0x94) returned 1 [0067.133] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\adobeid.pdf.wannacry")) returned 1 [0067.136] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x102c8, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0067.136] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.136] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0067.137] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0067.137] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0067.137] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf") returned="AdobeID.pdf" [0067.137] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\" [0067.137] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\") returned="" [0067.137] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\HOW TO DECRYPT FILES.txt" [0067.137] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\how to decrypt files.txt")) returned 0x20 [0067.137] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf" [0067.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0067.137] lstrlenA (lpString="*.zip") returned 5 [0067.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0067.137] lstrlenA (lpString="*.rar") returned 5 [0067.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0067.138] lstrlenA (lpString="*.7z") returned 4 [0067.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0067.138] lstrlenA (lpString="*.tar") returned 5 [0067.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.gzip") returned 0 [0067.138] lstrlenA (lpString="*.gzip") returned 6 [0067.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0067.138] lstrlenA (lpString="*.jpg") returned 5 [0067.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0067.138] lstrlenA (lpString="*.jpeg") returned 6 [0067.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0067.138] lstrlenA (lpString="*.psd") returned 5 [0067.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.gif") returned 0 [0067.138] lstrlenA (lpString="*.gif") returned 5 [0067.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0067.138] lstrlenA (lpString="*.doc") returned 5 [0067.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0067.138] lstrlenA (lpString="*.docx") returned 6 [0067.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0067.138] lstrlenA (lpString="*.xls") returned 5 [0067.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0067.138] lstrlenA (lpString="*.xlsx") returned 6 [0067.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0067.138] lstrlenA (lpString="*.ppt") returned 5 [0067.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0067.139] lstrlenA (lpString="*.pptx") returned 6 [0067.139] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0067.139] lstrlenA (lpString="*.pdf") returned 5 [0067.139] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf" [0067.139] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf" [0067.139] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf." [0067.139] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf.wannacry" [0067.139] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.140] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x102c8 [0067.140] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805b4280, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0067.140] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.140] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1024a, lpOverlapped=0x0) returned 1 [0067.143] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf") returned="DefaultID.pdf" [0067.143] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.143] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1024a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1024a, lpOverlapped=0x0) returned 1 [0067.144] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.144] CloseHandle (hObject=0x94) returned 1 [0067.144] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\defaultid.pdf.wannacry")) returned 1 [0067.145] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x102c8, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0067.145] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.145] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80600540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80600540, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x3, cFileName="SVE", cAlternateFileName="")) returned 1 [0067.145] lstrcmpA (lpString1=".", lpString2="SVE") returned -1 [0067.145] lstrcmpA (lpString1="..", lpString2="SVE") returned -1 [0067.145] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0067.145] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="SVE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE" [0067.145] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE") returned 63 [0067.146] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80600540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80600540, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d8f98, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.146] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.146] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80600540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80600540, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0067.146] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.146] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.146] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12696, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0067.146] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.146] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0067.146] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0067.146] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0067.146] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\*.*") returned="*.*" [0067.146] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\" [0067.146] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\") returned="" [0067.146] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\HOW TO DECRYPT FILES.txt" [0067.146] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\how to decrypt files.txt")) returned 0xffffffff [0067.147] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.147] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0067.147] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.149] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.149] CloseHandle (hObject=0x94) returned 1 [0067.149] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf" [0067.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0067.149] lstrlenA (lpString="*.zip") returned 5 [0067.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0067.149] lstrlenA (lpString="*.rar") returned 5 [0067.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0067.149] lstrlenA (lpString="*.7z") returned 4 [0067.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0067.149] lstrlenA (lpString="*.tar") returned 5 [0067.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.gzip") returned 0 [0067.149] lstrlenA (lpString="*.gzip") returned 6 [0067.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0067.149] lstrlenA (lpString="*.jpg") returned 5 [0067.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0067.149] lstrlenA (lpString="*.jpeg") returned 6 [0067.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0067.150] lstrlenA (lpString="*.psd") returned 5 [0067.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.gif") returned 0 [0067.150] lstrlenA (lpString="*.gif") returned 5 [0067.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0067.150] lstrlenA (lpString="*.doc") returned 5 [0067.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0067.150] lstrlenA (lpString="*.docx") returned 6 [0067.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0067.150] lstrlenA (lpString="*.xls") returned 5 [0067.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0067.150] lstrlenA (lpString="*.xlsx") returned 6 [0067.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0067.150] lstrlenA (lpString="*.ppt") returned 5 [0067.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0067.150] lstrlenA (lpString="*.pptx") returned 6 [0067.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0067.150] lstrlenA (lpString="*.pdf") returned 5 [0067.150] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf" [0067.150] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf" [0067.150] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf." [0067.150] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf.wannacry" [0067.150] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.151] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12696 [0067.151] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x805da3e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0067.151] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.151] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x12618, lpOverlapped=0x0) returned 1 [0067.205] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf") returned="AdobeID.pdf" [0067.205] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.205] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x12618, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x12618, lpOverlapped=0x0) returned 1 [0067.206] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.206] CloseHandle (hObject=0x94) returned 1 [0067.206] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\adobeid.pdf.wannacry")) returned 1 [0067.210] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80600540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11c35, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0067.210] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.210] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0067.210] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0067.210] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0067.210] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf") returned="AdobeID.pdf" [0067.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\" [0067.210] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\") returned="" [0067.210] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\HOW TO DECRYPT FILES.txt" [0067.210] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\how to decrypt files.txt")) returned 0x20 [0067.210] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf" [0067.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0067.210] lstrlenA (lpString="*.zip") returned 5 [0067.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0067.210] lstrlenA (lpString="*.rar") returned 5 [0067.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0067.210] lstrlenA (lpString="*.7z") returned 4 [0067.210] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0067.211] lstrlenA (lpString="*.tar") returned 5 [0067.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.gzip") returned 0 [0067.211] lstrlenA (lpString="*.gzip") returned 6 [0067.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0067.211] lstrlenA (lpString="*.jpg") returned 5 [0067.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0067.211] lstrlenA (lpString="*.jpeg") returned 6 [0067.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0067.211] lstrlenA (lpString="*.psd") returned 5 [0067.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.gif") returned 0 [0067.211] lstrlenA (lpString="*.gif") returned 5 [0067.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0067.211] lstrlenA (lpString="*.doc") returned 5 [0067.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0067.211] lstrlenA (lpString="*.docx") returned 6 [0067.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0067.211] lstrlenA (lpString="*.xls") returned 5 [0067.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0067.211] lstrlenA (lpString="*.xlsx") returned 6 [0067.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0067.211] lstrlenA (lpString="*.ppt") returned 5 [0067.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0067.211] lstrlenA (lpString="*.pptx") returned 6 [0067.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0067.211] lstrlenA (lpString="*.pdf") returned 5 [0067.211] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf" [0067.212] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf" [0067.212] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf." [0067.212] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf.wannacry" [0067.212] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.214] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11c35 [0067.214] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80600540, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0067.214] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.214] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x11bb7, lpOverlapped=0x0) returned 1 [0067.216] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf") returned="DefaultID.pdf" [0067.216] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.216] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x11bb7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x11bb7, lpOverlapped=0x0) returned 1 [0067.217] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.217] CloseHandle (hObject=0x94) returned 1 [0067.217] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\defaultid.pdf.wannacry")) returned 1 [0067.218] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80600540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11c35, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0067.218] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.218] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809de900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x3, cFileName="TUR", cAlternateFileName="")) returned 1 [0067.218] lstrcmpA (lpString1=".", lpString2="TUR") returned -1 [0067.219] lstrcmpA (lpString1="..", lpString2="TUR") returned -1 [0067.219] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0067.219] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="TUR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR" [0067.219] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR") returned 63 [0067.219] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809de900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d8f98, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.220] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.220] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809de900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0067.220] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.220] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.220] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49db0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0067.220] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.220] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0067.220] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0067.220] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0067.220] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\*.*") returned="*.*" [0067.220] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\" [0067.220] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\") returned="" [0067.220] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\HOW TO DECRYPT FILES.txt" [0067.221] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\how to decrypt files.txt")) returned 0xffffffff [0067.221] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.222] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0067.222] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.223] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.224] CloseHandle (hObject=0x94) returned 1 [0067.224] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf" [0067.224] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0067.224] lstrlenA (lpString="*.zip") returned 5 [0067.224] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0067.224] lstrlenA (lpString="*.rar") returned 5 [0067.224] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0067.224] lstrlenA (lpString="*.7z") returned 4 [0067.224] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0067.224] lstrlenA (lpString="*.tar") returned 5 [0067.224] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.gzip") returned 0 [0067.224] lstrlenA (lpString="*.gzip") returned 6 [0067.224] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0067.224] lstrlenA (lpString="*.jpg") returned 5 [0067.224] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0067.224] lstrlenA (lpString="*.jpeg") returned 6 [0067.224] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0067.224] lstrlenA (lpString="*.psd") returned 5 [0067.224] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.gif") returned 0 [0067.224] lstrlenA (lpString="*.gif") returned 5 [0067.224] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0067.224] lstrlenA (lpString="*.doc") returned 5 [0067.224] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0067.224] lstrlenA (lpString="*.docx") returned 6 [0067.224] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0067.225] lstrlenA (lpString="*.xls") returned 5 [0067.225] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0067.225] lstrlenA (lpString="*.xlsx") returned 6 [0067.225] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0067.225] lstrlenA (lpString="*.ppt") returned 5 [0067.225] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0067.225] lstrlenA (lpString="*.pptx") returned 6 [0067.225] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0067.225] lstrlenA (lpString="*.pdf") returned 5 [0067.225] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf" [0067.225] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf" [0067.225] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf." [0067.225] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf.wannacry" [0067.225] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.226] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x49db0 [0067.226] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a04a60, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0067.226] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.226] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x49d32, lpOverlapped=0x0) returned 1 [0067.259] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf") returned="AdobeID.pdf" [0067.259] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.259] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x49d32, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x49d32, lpOverlapped=0x0) returned 1 [0067.261] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.261] CloseHandle (hObject=0x94) returned 1 [0067.261] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\adobeid.pdf.wannacry")) returned 1 [0067.289] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x48d8f, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0067.289] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.289] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0067.289] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0067.289] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0067.289] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf") returned="AdobeID.pdf" [0067.289] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\" [0067.289] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\") returned="" [0067.289] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\HOW TO DECRYPT FILES.txt" [0067.289] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\how to decrypt files.txt")) returned 0x20 [0067.289] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf" [0067.289] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0067.289] lstrlenA (lpString="*.zip") returned 5 [0067.290] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0067.290] lstrlenA (lpString="*.rar") returned 5 [0067.290] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0067.290] lstrlenA (lpString="*.7z") returned 4 [0067.290] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0067.290] lstrlenA (lpString="*.tar") returned 5 [0067.290] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.gzip") returned 0 [0067.290] lstrlenA (lpString="*.gzip") returned 6 [0067.290] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0067.290] lstrlenA (lpString="*.jpg") returned 5 [0067.290] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0067.290] lstrlenA (lpString="*.jpeg") returned 6 [0067.290] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0067.290] lstrlenA (lpString="*.psd") returned 5 [0067.290] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.gif") returned 0 [0067.290] lstrlenA (lpString="*.gif") returned 5 [0067.290] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0067.290] lstrlenA (lpString="*.doc") returned 5 [0067.290] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0067.290] lstrlenA (lpString="*.docx") returned 6 [0067.290] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0067.291] lstrlenA (lpString="*.xls") returned 5 [0067.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0067.291] lstrlenA (lpString="*.xlsx") returned 6 [0067.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0067.291] lstrlenA (lpString="*.ppt") returned 5 [0067.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0067.291] lstrlenA (lpString="*.pptx") returned 6 [0067.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0067.291] lstrlenA (lpString="*.pdf") returned 5 [0067.291] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf" [0067.291] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf" [0067.291] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf." [0067.291] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf.wannacry" [0067.291] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.292] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x48d8f [0067.292] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80a04a60, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0067.292] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.292] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x48d11, lpOverlapped=0x0) returned 1 [0067.299] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf") returned="DefaultID.pdf" [0067.299] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.300] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x48d11, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x48d11, lpOverlapped=0x0) returned 1 [0067.301] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.301] CloseHandle (hObject=0x94) returned 1 [0067.301] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\defaultid.pdf.wannacry")) returned 1 [0067.302] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x48d8f, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0067.302] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.302] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80861b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x809de900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x809de900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x3, cFileName="UKR", cAlternateFileName="")) returned 1 [0067.303] lstrcmpA (lpString1=".", lpString2="UKR") returned -1 [0067.303] lstrcmpA (lpString1="..", lpString2="UKR") returned -1 [0067.303] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*") returned="*.*" [0067.303] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\", lpString2="UKR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR" [0067.303] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR") returned 63 [0067.303] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80861b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x809de900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x809de900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3000003, dwReserved1=0x2d8f98, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.303] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.303] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80861b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x809de900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x809de900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0067.303] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.303] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.303] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80861b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x197f2, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0067.303] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.303] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeID.pdf") returned 1 [0067.303] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeID.pdf") returned 1 [0067.303] lstrcmpiA (lpString1="", lpString2="AdobeID.pdf") returned -1 [0067.303] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\*.*") returned="*.*" [0067.303] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\" [0067.304] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\") returned="" [0067.304] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\HOW TO DECRYPT FILES.txt" [0067.304] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\how to decrypt files.txt")) returned 0xffffffff [0067.304] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.305] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0067.305] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.306] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.306] CloseHandle (hObject=0x94) returned 1 [0067.306] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\", lpString2="AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf" [0067.306] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.zip") returned 0 [0067.306] lstrlenA (lpString="*.zip") returned 5 [0067.306] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.rar") returned 0 [0067.306] lstrlenA (lpString="*.rar") returned 5 [0067.306] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.7z") returned 0 [0067.306] lstrlenA (lpString="*.7z") returned 4 [0067.307] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.tar") returned 0 [0067.307] lstrlenA (lpString="*.tar") returned 5 [0067.307] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.gzip") returned 0 [0067.307] lstrlenA (lpString="*.gzip") returned 6 [0067.307] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.jpg") returned 0 [0067.307] lstrlenA (lpString="*.jpg") returned 5 [0067.307] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.jpeg") returned 0 [0067.307] lstrlenA (lpString="*.jpeg") returned 6 [0067.307] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.psd") returned 0 [0067.307] lstrlenA (lpString="*.psd") returned 5 [0067.307] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.gif") returned 0 [0067.307] lstrlenA (lpString="*.gif") returned 5 [0067.307] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.doc") returned 0 [0067.307] lstrlenA (lpString="*.doc") returned 5 [0067.307] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.docx") returned 0 [0067.307] lstrlenA (lpString="*.docx") returned 6 [0067.307] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.xls") returned 0 [0067.307] lstrlenA (lpString="*.xls") returned 5 [0067.307] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.xlsx") returned 0 [0067.307] lstrlenA (lpString="*.xlsx") returned 6 [0067.307] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.ppt") returned 0 [0067.307] lstrlenA (lpString="*.ppt") returned 5 [0067.307] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.pptx") returned 0 [0067.307] lstrlenA (lpString="*.pptx") returned 6 [0067.307] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", pszSpec="*.pdf") returned 1 [0067.307] lstrlenA (lpString="*.pdf") returned 5 [0067.307] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf" [0067.308] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf" [0067.308] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf." [0067.308] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf.wannacry" [0067.308] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\adobeid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.309] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x197f2 [0067.309] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80861b40, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4)) returned 1 [0067.309] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.309] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x19774, lpOverlapped=0x0) returned 1 [0067.320] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf") returned="AdobeID.pdf" [0067.320] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.320] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x19774, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x19774, lpOverlapped=0x0) returned 1 [0067.321] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.321] CloseHandle (hObject=0x94) returned 1 [0067.321] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\adobeid.pdf.wannacry")) returned 1 [0067.339] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x809de900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x48d20, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0067.339] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.339] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DefaultID.pdf") returned 1 [0067.339] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DefaultID.pdf") returned 1 [0067.339] lstrcmpiA (lpString1="", lpString2="DefaultID.pdf") returned -1 [0067.339] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf") returned="AdobeID.pdf" [0067.339] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\" [0067.339] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\") returned="" [0067.339] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\HOW TO DECRYPT FILES.txt" [0067.340] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\how to decrypt files.txt")) returned 0x20 [0067.340] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\", lpString2="DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf" [0067.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.zip") returned 0 [0067.340] lstrlenA (lpString="*.zip") returned 5 [0067.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.rar") returned 0 [0067.340] lstrlenA (lpString="*.rar") returned 5 [0067.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.7z") returned 0 [0067.340] lstrlenA (lpString="*.7z") returned 4 [0067.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.tar") returned 0 [0067.340] lstrlenA (lpString="*.tar") returned 5 [0067.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.gzip") returned 0 [0067.340] lstrlenA (lpString="*.gzip") returned 6 [0067.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.jpg") returned 0 [0067.340] lstrlenA (lpString="*.jpg") returned 5 [0067.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.jpeg") returned 0 [0067.340] lstrlenA (lpString="*.jpeg") returned 6 [0067.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.psd") returned 0 [0067.340] lstrlenA (lpString="*.psd") returned 5 [0067.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.gif") returned 0 [0067.340] lstrlenA (lpString="*.gif") returned 5 [0067.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.doc") returned 0 [0067.341] lstrlenA (lpString="*.doc") returned 5 [0067.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.docx") returned 0 [0067.341] lstrlenA (lpString="*.docx") returned 6 [0067.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.xls") returned 0 [0067.341] lstrlenA (lpString="*.xls") returned 5 [0067.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.xlsx") returned 0 [0067.341] lstrlenA (lpString="*.xlsx") returned 6 [0067.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.ppt") returned 0 [0067.341] lstrlenA (lpString="*.ppt") returned 5 [0067.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.pptx") returned 0 [0067.341] lstrlenA (lpString="*.pptx") returned 6 [0067.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", pszSpec="*.pdf") returned 1 [0067.341] lstrlenA (lpString="*.pdf") returned 5 [0067.341] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf" [0067.341] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf" [0067.341] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf." [0067.341] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf.wannacry" [0067.342] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\defaultid.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.343] GetFileSize (in: hFile=0x94, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x48d20 [0067.343] GetFileTime (in: hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x809de900, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4)) returned 1 [0067.343] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.343] ReadFile (in: hFile=0x94, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x48ca2, lpOverlapped=0x0) returned 1 [0067.349] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf") returned="DefaultID.pdf" [0067.349] SetFilePointer (in: hFile=0x94, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0067.349] WriteFile (in: hFile=0x94, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x48ca2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x48ca2, lpOverlapped=0x0) returned 1 [0067.350] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.351] CloseHandle (hObject=0x94) returned 1 [0067.351] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\defaultid.pdf.wannacry")) returned 1 [0067.352] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x809de900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x48d20, dwReserved0=0x4000004, dwReserved1=0x2d8f90, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0067.352] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.352] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80861b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x809de900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x809de900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x3, cFileName="UKR", cAlternateFileName="")) returned 0 [0067.352] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0067.352] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440049, dwReserved1=0x3, cFileName="Javascripts", cAlternateFileName="JAVASC~1")) returned 1 [0067.352] lstrcmpA (lpString1=".", lpString2="Javascripts") returned -1 [0067.352] lstrcmpA (lpString1="..", lpString2="Javascripts") returned -1 [0067.353] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\*.*") returned="*.*" [0067.353] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\", lpString2="Javascripts" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts" [0067.353] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts") returned 59 [0067.353] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e03c8, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0067.353] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.353] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.353] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.353] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.353] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x121ba8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="JSByteCodeWin.bin", cAlternateFileName="JSBYTE~1.BIN")) returned 1 [0067.353] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0067.353] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="JSByteCodeWin.bin") returned -1 [0067.353] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="JSByteCodeWin.bin") returned -1 [0067.354] lstrcmpiA (lpString1="", lpString2="JSByteCodeWin.bin") returned -1 [0067.354] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\*.*") returned="*.*" [0067.354] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\" [0067.354] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\") returned="" [0067.354] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\HOW TO DECRYPT FILES.txt" [0067.354] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\javascripts\\how to decrypt files.txt")) returned 0xffffffff [0067.354] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\javascripts\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0067.355] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0067.355] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.356] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.356] CloseHandle (hObject=0x90) returned 1 [0067.356] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\", lpString2="JSByteCodeWin.bin" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin" [0067.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.zip") returned 0 [0067.356] lstrlenA (lpString="*.zip") returned 5 [0067.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.rar") returned 0 [0067.356] lstrlenA (lpString="*.rar") returned 5 [0067.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.7z") returned 0 [0067.356] lstrlenA (lpString="*.7z") returned 4 [0067.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.tar") returned 0 [0067.357] lstrlenA (lpString="*.tar") returned 5 [0067.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.gzip") returned 0 [0067.357] lstrlenA (lpString="*.gzip") returned 6 [0067.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.jpg") returned 0 [0067.357] lstrlenA (lpString="*.jpg") returned 5 [0067.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.jpeg") returned 0 [0067.357] lstrlenA (lpString="*.jpeg") returned 6 [0067.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.psd") returned 0 [0067.357] lstrlenA (lpString="*.psd") returned 5 [0067.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.gif") returned 0 [0067.357] lstrlenA (lpString="*.gif") returned 5 [0067.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.doc") returned 0 [0067.357] lstrlenA (lpString="*.doc") returned 5 [0067.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.docx") returned 0 [0067.357] lstrlenA (lpString="*.docx") returned 6 [0067.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.xls") returned 0 [0067.357] lstrlenA (lpString="*.xls") returned 5 [0067.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.xlsx") returned 0 [0067.357] lstrlenA (lpString="*.xlsx") returned 6 [0067.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.ppt") returned 0 [0067.357] lstrlenA (lpString="*.ppt") returned 5 [0067.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.pptx") returned 0 [0067.357] lstrlenA (lpString="*.pptx") returned 6 [0067.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.pdf") returned 0 [0067.357] lstrlenA (lpString="*.pdf") returned 5 [0067.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.mov") returned 0 [0067.357] lstrlenA (lpString="*.mov") returned 5 [0067.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.m2v") returned 0 [0067.357] lstrlenA (lpString="*.m2v") returned 5 [0067.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.3gp") returned 0 [0067.357] lstrlenA (lpString="*.3gp") returned 5 [0067.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.mpeg") returned 0 [0067.358] lstrlenA (lpString="*.mpeg") returned 6 [0067.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.mpg") returned 0 [0067.358] lstrlenA (lpString="*.mpg") returned 5 [0067.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.flv") returned 0 [0067.358] lstrlenA (lpString="*.flv") returned 5 [0067.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.avi") returned 0 [0067.358] lstrlenA (lpString="*.avi") returned 5 [0067.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.mp4") returned 0 [0067.358] lstrlenA (lpString="*.mp4") returned 5 [0067.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.wmv") returned 0 [0067.358] lstrlenA (lpString="*.wmv") returned 5 [0067.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.divx") returned 0 [0067.358] lstrlenA (lpString="*.divx") returned 6 [0067.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.mkv") returned 0 [0067.358] lstrlenA (lpString="*.mkv") returned 5 [0067.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.mp3") returned 0 [0067.358] lstrlenA (lpString="*.mp3") returned 5 [0067.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.wav") returned 0 [0067.358] lstrlenA (lpString="*.wav") returned 5 [0067.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.flac") returned 0 [0067.358] lstrlenA (lpString="*.flac") returned 6 [0067.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.ape") returned 0 [0067.358] lstrlenA (lpString="*.ape") returned 5 [0067.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.wma") returned 0 [0067.358] lstrlenA (lpString="*.wma") returned 5 [0067.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.ac3") returned 0 [0067.358] lstrlenA (lpString="*.ac3") returned 5 [0067.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", pszSpec="*.mxf") returned 0 [0067.358] lstrlenA (lpString="*.mxf") returned 5 [0067.358] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x121ba8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="JSByteCodeWin.bin", cAlternateFileName="JSBYTE~1.BIN")) returned 0 [0067.359] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0067.359] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa6790, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="JP2KLib.dll", cAlternateFileName="")) returned 1 [0067.359] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0067.359] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="JP2KLib.dll") returned -1 [0067.359] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="JP2KLib.dll") returned -1 [0067.359] lstrcmpiA (lpString1="", lpString2="JP2KLib.dll") returned -1 [0067.359] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\*.*") returned="*.*" [0067.359] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0067.359] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="" [0067.359] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\HOW TO DECRYPT FILES.txt" [0067.359] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\how to decrypt files.txt")) returned 0x20 [0067.359] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\", lpString2="JP2KLib.dll" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll" [0067.359] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.zip") returned 0 [0067.359] lstrlenA (lpString="*.zip") returned 5 [0067.359] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.rar") returned 0 [0067.359] lstrlenA (lpString="*.rar") returned 5 [0067.359] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.7z") returned 0 [0067.359] lstrlenA (lpString="*.7z") returned 4 [0067.359] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.tar") returned 0 [0067.359] lstrlenA (lpString="*.tar") returned 5 [0067.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.gzip") returned 0 [0067.360] lstrlenA (lpString="*.gzip") returned 6 [0067.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.jpg") returned 0 [0067.360] lstrlenA (lpString="*.jpg") returned 5 [0067.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.jpeg") returned 0 [0067.360] lstrlenA (lpString="*.jpeg") returned 6 [0067.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.psd") returned 0 [0067.360] lstrlenA (lpString="*.psd") returned 5 [0067.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.gif") returned 0 [0067.360] lstrlenA (lpString="*.gif") returned 5 [0067.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.doc") returned 0 [0067.360] lstrlenA (lpString="*.doc") returned 5 [0067.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.docx") returned 0 [0067.360] lstrlenA (lpString="*.docx") returned 6 [0067.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.xls") returned 0 [0067.360] lstrlenA (lpString="*.xls") returned 5 [0067.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.xlsx") returned 0 [0067.360] lstrlenA (lpString="*.xlsx") returned 6 [0067.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.ppt") returned 0 [0067.360] lstrlenA (lpString="*.ppt") returned 5 [0067.360] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.pptx") returned 0 [0067.361] lstrlenA (lpString="*.pptx") returned 6 [0067.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.pdf") returned 0 [0067.361] lstrlenA (lpString="*.pdf") returned 5 [0067.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.mov") returned 0 [0067.361] lstrlenA (lpString="*.mov") returned 5 [0067.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.m2v") returned 0 [0067.361] lstrlenA (lpString="*.m2v") returned 5 [0067.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.3gp") returned 0 [0067.361] lstrlenA (lpString="*.3gp") returned 5 [0067.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.mpeg") returned 0 [0067.361] lstrlenA (lpString="*.mpeg") returned 6 [0067.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.mpg") returned 0 [0067.361] lstrlenA (lpString="*.mpg") returned 5 [0067.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.flv") returned 0 [0067.361] lstrlenA (lpString="*.flv") returned 5 [0067.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.avi") returned 0 [0067.361] lstrlenA (lpString="*.avi") returned 5 [0067.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.mp4") returned 0 [0067.361] lstrlenA (lpString="*.mp4") returned 5 [0067.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.wmv") returned 0 [0067.361] lstrlenA (lpString="*.wmv") returned 5 [0067.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.divx") returned 0 [0067.361] lstrlenA (lpString="*.divx") returned 6 [0067.361] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.mkv") returned 0 [0067.361] lstrlenA (lpString="*.mkv") returned 5 [0067.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.mp3") returned 0 [0067.362] lstrlenA (lpString="*.mp3") returned 5 [0067.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.wav") returned 0 [0067.362] lstrlenA (lpString="*.wav") returned 5 [0067.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.flac") returned 0 [0067.362] lstrlenA (lpString="*.flac") returned 6 [0067.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.ape") returned 0 [0067.362] lstrlenA (lpString="*.ape") returned 5 [0067.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.wma") returned 0 [0067.362] lstrlenA (lpString="*.wma") returned 5 [0067.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.ac3") returned 0 [0067.362] lstrlenA (lpString="*.ac3") returned 5 [0067.362] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll", pszSpec="*.mxf") returned 0 [0067.362] lstrlenA (lpString="*.mxf") returned 5 [0067.362] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Legal", cAlternateFileName="")) returned 1 [0067.362] lstrcmpA (lpString1=".", lpString2="Legal") returned -1 [0067.362] lstrcmpA (lpString1="..", lpString2="Legal") returned -1 [0067.362] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\JP2KLib.dll") returned="JP2KLib.dll" [0067.362] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\", lpString2="Legal" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" [0067.362] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal") returned 53 [0067.362] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d7f78, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0067.366] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.366] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0067.366] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.366] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.366] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CAT", cAlternateFileName="")) returned 1 [0067.366] lstrcmpA (lpString1=".", lpString2="CAT") returned -1 [0067.366] lstrcmpA (lpString1="..", lpString2="CAT") returned -1 [0067.366] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0067.366] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT" [0067.366] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT") returned 57 [0067.366] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d7ee8, dwReserved1=0x2d7ee3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.372] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.372] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0067.372] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.372] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.372] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0067.372] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.372] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0067.372] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0067.372] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0067.372] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\*.*") returned="*.*" [0067.372] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\" [0067.372] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\") returned="" [0067.373] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\HOW TO DECRYPT FILES.txt" [0067.373] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\how to decrypt files.txt")) returned 0xffffffff [0067.373] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.374] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0067.374] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.376] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.376] CloseHandle (hObject=0x94) returned 1 [0067.376] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini" [0067.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.zip") returned 0 [0067.376] lstrlenA (lpString="*.zip") returned 5 [0067.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.rar") returned 0 [0067.376] lstrlenA (lpString="*.rar") returned 5 [0067.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.7z") returned 0 [0067.376] lstrlenA (lpString="*.7z") returned 4 [0067.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.tar") returned 0 [0067.376] lstrlenA (lpString="*.tar") returned 5 [0067.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.gzip") returned 0 [0067.376] lstrlenA (lpString="*.gzip") returned 6 [0067.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.jpg") returned 0 [0067.376] lstrlenA (lpString="*.jpg") returned 5 [0067.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.jpeg") returned 0 [0067.376] lstrlenA (lpString="*.jpeg") returned 6 [0067.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.psd") returned 0 [0067.376] lstrlenA (lpString="*.psd") returned 5 [0067.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.gif") returned 0 [0067.377] lstrlenA (lpString="*.gif") returned 5 [0067.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.doc") returned 0 [0067.377] lstrlenA (lpString="*.doc") returned 5 [0067.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.docx") returned 0 [0067.377] lstrlenA (lpString="*.docx") returned 6 [0067.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.xls") returned 0 [0067.377] lstrlenA (lpString="*.xls") returned 5 [0067.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.xlsx") returned 0 [0067.377] lstrlenA (lpString="*.xlsx") returned 6 [0067.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.ppt") returned 0 [0067.377] lstrlenA (lpString="*.ppt") returned 5 [0067.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.pptx") returned 0 [0067.377] lstrlenA (lpString="*.pptx") returned 6 [0067.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.pdf") returned 0 [0067.377] lstrlenA (lpString="*.pdf") returned 5 [0067.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.mov") returned 0 [0067.377] lstrlenA (lpString="*.mov") returned 5 [0067.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.m2v") returned 0 [0067.377] lstrlenA (lpString="*.m2v") returned 5 [0067.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.3gp") returned 0 [0067.377] lstrlenA (lpString="*.3gp") returned 5 [0067.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.mpeg") returned 0 [0067.377] lstrlenA (lpString="*.mpeg") returned 6 [0067.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.mpg") returned 0 [0067.377] lstrlenA (lpString="*.mpg") returned 5 [0067.377] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.flv") returned 0 [0067.378] lstrlenA (lpString="*.flv") returned 5 [0067.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.avi") returned 0 [0067.378] lstrlenA (lpString="*.avi") returned 5 [0067.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.mp4") returned 0 [0067.378] lstrlenA (lpString="*.mp4") returned 5 [0067.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.wmv") returned 0 [0067.378] lstrlenA (lpString="*.wmv") returned 5 [0067.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.divx") returned 0 [0067.378] lstrlenA (lpString="*.divx") returned 6 [0067.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.mkv") returned 0 [0067.378] lstrlenA (lpString="*.mkv") returned 5 [0067.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.mp3") returned 0 [0067.378] lstrlenA (lpString="*.mp3") returned 5 [0067.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.wav") returned 0 [0067.378] lstrlenA (lpString="*.wav") returned 5 [0067.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.flac") returned 0 [0067.378] lstrlenA (lpString="*.flac") returned 6 [0067.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.ape") returned 0 [0067.378] lstrlenA (lpString="*.ape") returned 5 [0067.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.wma") returned 0 [0067.378] lstrlenA (lpString="*.wma") returned 5 [0067.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.ac3") returned 0 [0067.378] lstrlenA (lpString="*.ac3") returned 5 [0067.378] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini", pszSpec="*.mxf") returned 0 [0067.378] lstrlenA (lpString="*.mxf") returned 5 [0067.378] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0067.379] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.379] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0067.379] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0067.379] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0067.379] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\eula.ini") returned="eula.ini" [0067.379] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\" [0067.379] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\") returned="" [0067.379] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\HOW TO DECRYPT FILES.txt" [0067.379] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\how to decrypt files.txt")) returned 0x20 [0067.379] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html" [0067.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.zip") returned 0 [0067.379] lstrlenA (lpString="*.zip") returned 5 [0067.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.rar") returned 0 [0067.379] lstrlenA (lpString="*.rar") returned 5 [0067.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.7z") returned 0 [0067.379] lstrlenA (lpString="*.7z") returned 4 [0067.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.tar") returned 0 [0067.379] lstrlenA (lpString="*.tar") returned 5 [0067.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.gzip") returned 0 [0067.379] lstrlenA (lpString="*.gzip") returned 6 [0067.379] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.jpg") returned 0 [0067.379] lstrlenA (lpString="*.jpg") returned 5 [0067.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.jpeg") returned 0 [0067.380] lstrlenA (lpString="*.jpeg") returned 6 [0067.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.psd") returned 0 [0067.380] lstrlenA (lpString="*.psd") returned 5 [0067.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.gif") returned 0 [0067.380] lstrlenA (lpString="*.gif") returned 5 [0067.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.doc") returned 0 [0067.380] lstrlenA (lpString="*.doc") returned 5 [0067.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.docx") returned 0 [0067.380] lstrlenA (lpString="*.docx") returned 6 [0067.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.xls") returned 0 [0067.380] lstrlenA (lpString="*.xls") returned 5 [0067.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.xlsx") returned 0 [0067.380] lstrlenA (lpString="*.xlsx") returned 6 [0067.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.ppt") returned 0 [0067.380] lstrlenA (lpString="*.ppt") returned 5 [0067.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.pptx") returned 0 [0067.380] lstrlenA (lpString="*.pptx") returned 6 [0067.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.pdf") returned 0 [0067.380] lstrlenA (lpString="*.pdf") returned 5 [0067.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.mov") returned 0 [0067.380] lstrlenA (lpString="*.mov") returned 5 [0067.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.m2v") returned 0 [0067.380] lstrlenA (lpString="*.m2v") returned 5 [0067.380] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.3gp") returned 0 [0067.380] lstrlenA (lpString="*.3gp") returned 5 [0067.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.mpeg") returned 0 [0067.381] lstrlenA (lpString="*.mpeg") returned 6 [0067.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.mpg") returned 0 [0067.381] lstrlenA (lpString="*.mpg") returned 5 [0067.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.flv") returned 0 [0067.381] lstrlenA (lpString="*.flv") returned 5 [0067.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.avi") returned 0 [0067.381] lstrlenA (lpString="*.avi") returned 5 [0067.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.mp4") returned 0 [0067.381] lstrlenA (lpString="*.mp4") returned 5 [0067.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.wmv") returned 0 [0067.381] lstrlenA (lpString="*.wmv") returned 5 [0067.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.divx") returned 0 [0067.381] lstrlenA (lpString="*.divx") returned 6 [0067.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.mkv") returned 0 [0067.381] lstrlenA (lpString="*.mkv") returned 5 [0067.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.mp3") returned 0 [0067.381] lstrlenA (lpString="*.mp3") returned 5 [0067.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.wav") returned 0 [0067.381] lstrlenA (lpString="*.wav") returned 5 [0067.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.flac") returned 0 [0067.381] lstrlenA (lpString="*.flac") returned 6 [0067.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.ape") returned 0 [0067.381] lstrlenA (lpString="*.ape") returned 5 [0067.381] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.wma") returned 0 [0067.382] lstrlenA (lpString="*.wma") returned 5 [0067.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.ac3") returned 0 [0067.382] lstrlenA (lpString="*.ac3") returned 5 [0067.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html", pszSpec="*.mxf") returned 0 [0067.382] lstrlenA (lpString="*.mxf") returned 5 [0067.382] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0067.382] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.382] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="CHS", cAlternateFileName="")) returned 1 [0067.382] lstrcmpA (lpString1=".", lpString2="CHS") returned -1 [0067.382] lstrcmpA (lpString1="..", lpString2="CHS") returned -1 [0067.382] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0067.382] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="CHS" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS" [0067.382] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS") returned 57 [0067.382] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.388] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.388] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.388] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.388] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.388] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0067.388] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.388] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0067.388] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0067.388] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0067.388] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\*.*") returned="*.*" [0067.388] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\" [0067.389] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\") returned="" [0067.389] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\HOW TO DECRYPT FILES.txt" [0067.389] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\how to decrypt files.txt")) returned 0xffffffff [0067.389] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.390] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0067.390] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.391] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.391] CloseHandle (hObject=0x94) returned 1 [0067.391] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini" [0067.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.zip") returned 0 [0067.391] lstrlenA (lpString="*.zip") returned 5 [0067.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.rar") returned 0 [0067.391] lstrlenA (lpString="*.rar") returned 5 [0067.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.7z") returned 0 [0067.392] lstrlenA (lpString="*.7z") returned 4 [0067.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.tar") returned 0 [0067.392] lstrlenA (lpString="*.tar") returned 5 [0067.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.gzip") returned 0 [0067.392] lstrlenA (lpString="*.gzip") returned 6 [0067.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.jpg") returned 0 [0067.392] lstrlenA (lpString="*.jpg") returned 5 [0067.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.jpeg") returned 0 [0067.392] lstrlenA (lpString="*.jpeg") returned 6 [0067.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.psd") returned 0 [0067.392] lstrlenA (lpString="*.psd") returned 5 [0067.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.gif") returned 0 [0067.392] lstrlenA (lpString="*.gif") returned 5 [0067.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.doc") returned 0 [0067.392] lstrlenA (lpString="*.doc") returned 5 [0067.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.docx") returned 0 [0067.392] lstrlenA (lpString="*.docx") returned 6 [0067.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.xls") returned 0 [0067.392] lstrlenA (lpString="*.xls") returned 5 [0067.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.xlsx") returned 0 [0067.392] lstrlenA (lpString="*.xlsx") returned 6 [0067.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.ppt") returned 0 [0067.392] lstrlenA (lpString="*.ppt") returned 5 [0067.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.pptx") returned 0 [0067.392] lstrlenA (lpString="*.pptx") returned 6 [0067.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.pdf") returned 0 [0067.393] lstrlenA (lpString="*.pdf") returned 5 [0067.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.mov") returned 0 [0067.393] lstrlenA (lpString="*.mov") returned 5 [0067.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.m2v") returned 0 [0067.393] lstrlenA (lpString="*.m2v") returned 5 [0067.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.3gp") returned 0 [0067.393] lstrlenA (lpString="*.3gp") returned 5 [0067.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.mpeg") returned 0 [0067.393] lstrlenA (lpString="*.mpeg") returned 6 [0067.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.mpg") returned 0 [0067.393] lstrlenA (lpString="*.mpg") returned 5 [0067.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.flv") returned 0 [0067.393] lstrlenA (lpString="*.flv") returned 5 [0067.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.avi") returned 0 [0067.393] lstrlenA (lpString="*.avi") returned 5 [0067.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.mp4") returned 0 [0067.393] lstrlenA (lpString="*.mp4") returned 5 [0067.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.wmv") returned 0 [0067.393] lstrlenA (lpString="*.wmv") returned 5 [0067.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.divx") returned 0 [0067.393] lstrlenA (lpString="*.divx") returned 6 [0067.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.mkv") returned 0 [0067.393] lstrlenA (lpString="*.mkv") returned 5 [0067.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.mp3") returned 0 [0067.393] lstrlenA (lpString="*.mp3") returned 5 [0067.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.wav") returned 0 [0067.393] lstrlenA (lpString="*.wav") returned 5 [0067.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.flac") returned 0 [0067.394] lstrlenA (lpString="*.flac") returned 6 [0067.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.ape") returned 0 [0067.394] lstrlenA (lpString="*.ape") returned 5 [0067.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.wma") returned 0 [0067.394] lstrlenA (lpString="*.wma") returned 5 [0067.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.ac3") returned 0 [0067.394] lstrlenA (lpString="*.ac3") returned 5 [0067.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini", pszSpec="*.mxf") returned 0 [0067.394] lstrlenA (lpString="*.mxf") returned 5 [0067.394] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12dac, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0067.394] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.394] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0067.394] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0067.394] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0067.394] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\eula.ini") returned="eula.ini" [0067.394] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\" [0067.394] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\") returned="" [0067.394] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\HOW TO DECRYPT FILES.txt" [0067.394] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\how to decrypt files.txt")) returned 0x20 [0067.394] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html" [0067.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.zip") returned 0 [0067.395] lstrlenA (lpString="*.zip") returned 5 [0067.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.rar") returned 0 [0067.395] lstrlenA (lpString="*.rar") returned 5 [0067.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.7z") returned 0 [0067.395] lstrlenA (lpString="*.7z") returned 4 [0067.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.tar") returned 0 [0067.395] lstrlenA (lpString="*.tar") returned 5 [0067.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.gzip") returned 0 [0067.395] lstrlenA (lpString="*.gzip") returned 6 [0067.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.jpg") returned 0 [0067.395] lstrlenA (lpString="*.jpg") returned 5 [0067.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.jpeg") returned 0 [0067.395] lstrlenA (lpString="*.jpeg") returned 6 [0067.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.psd") returned 0 [0067.395] lstrlenA (lpString="*.psd") returned 5 [0067.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.gif") returned 0 [0067.395] lstrlenA (lpString="*.gif") returned 5 [0067.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.doc") returned 0 [0067.395] lstrlenA (lpString="*.doc") returned 5 [0067.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.docx") returned 0 [0067.395] lstrlenA (lpString="*.docx") returned 6 [0067.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.xls") returned 0 [0067.395] lstrlenA (lpString="*.xls") returned 5 [0067.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.xlsx") returned 0 [0067.395] lstrlenA (lpString="*.xlsx") returned 6 [0067.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.ppt") returned 0 [0067.395] lstrlenA (lpString="*.ppt") returned 5 [0067.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.pptx") returned 0 [0067.396] lstrlenA (lpString="*.pptx") returned 6 [0067.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.pdf") returned 0 [0067.396] lstrlenA (lpString="*.pdf") returned 5 [0067.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.mov") returned 0 [0067.396] lstrlenA (lpString="*.mov") returned 5 [0067.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.m2v") returned 0 [0067.396] lstrlenA (lpString="*.m2v") returned 5 [0067.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.3gp") returned 0 [0067.396] lstrlenA (lpString="*.3gp") returned 5 [0067.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.mpeg") returned 0 [0067.396] lstrlenA (lpString="*.mpeg") returned 6 [0067.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.mpg") returned 0 [0067.396] lstrlenA (lpString="*.mpg") returned 5 [0067.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.flv") returned 0 [0067.396] lstrlenA (lpString="*.flv") returned 5 [0067.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.avi") returned 0 [0067.396] lstrlenA (lpString="*.avi") returned 5 [0067.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.mp4") returned 0 [0067.396] lstrlenA (lpString="*.mp4") returned 5 [0067.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.wmv") returned 0 [0067.396] lstrlenA (lpString="*.wmv") returned 5 [0067.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.divx") returned 0 [0067.396] lstrlenA (lpString="*.divx") returned 6 [0067.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.mkv") returned 0 [0067.396] lstrlenA (lpString="*.mkv") returned 5 [0067.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.mp3") returned 0 [0067.397] lstrlenA (lpString="*.mp3") returned 5 [0067.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.wav") returned 0 [0067.397] lstrlenA (lpString="*.wav") returned 5 [0067.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.flac") returned 0 [0067.397] lstrlenA (lpString="*.flac") returned 6 [0067.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.ape") returned 0 [0067.397] lstrlenA (lpString="*.ape") returned 5 [0067.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.wma") returned 0 [0067.397] lstrlenA (lpString="*.wma") returned 5 [0067.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.ac3") returned 0 [0067.397] lstrlenA (lpString="*.ac3") returned 5 [0067.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html", pszSpec="*.mxf") returned 0 [0067.397] lstrlenA (lpString="*.mxf") returned 5 [0067.397] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12dac, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0067.397] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.397] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="CHT", cAlternateFileName="")) returned 1 [0067.397] lstrcmpA (lpString1=".", lpString2="CHT") returned -1 [0067.397] lstrcmpA (lpString1="..", lpString2="CHT") returned -1 [0067.397] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0067.397] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="CHT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT" [0067.397] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT") returned 57 [0067.397] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.401] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.401] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.401] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.401] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.401] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0067.401] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.401] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0067.401] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0067.401] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0067.401] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\*.*") returned="*.*" [0067.401] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\" [0067.402] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\") returned="" [0067.402] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\HOW TO DECRYPT FILES.txt" [0067.402] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\how to decrypt files.txt")) returned 0xffffffff [0067.402] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.403] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0067.403] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.404] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.405] CloseHandle (hObject=0x94) returned 1 [0067.405] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini" [0067.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.zip") returned 0 [0067.405] lstrlenA (lpString="*.zip") returned 5 [0067.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.rar") returned 0 [0067.405] lstrlenA (lpString="*.rar") returned 5 [0067.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.7z") returned 0 [0067.405] lstrlenA (lpString="*.7z") returned 4 [0067.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.tar") returned 0 [0067.405] lstrlenA (lpString="*.tar") returned 5 [0067.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.gzip") returned 0 [0067.405] lstrlenA (lpString="*.gzip") returned 6 [0067.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.jpg") returned 0 [0067.405] lstrlenA (lpString="*.jpg") returned 5 [0067.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.jpeg") returned 0 [0067.405] lstrlenA (lpString="*.jpeg") returned 6 [0067.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.psd") returned 0 [0067.405] lstrlenA (lpString="*.psd") returned 5 [0067.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.gif") returned 0 [0067.405] lstrlenA (lpString="*.gif") returned 5 [0067.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.doc") returned 0 [0067.405] lstrlenA (lpString="*.doc") returned 5 [0067.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.docx") returned 0 [0067.406] lstrlenA (lpString="*.docx") returned 6 [0067.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.xls") returned 0 [0067.406] lstrlenA (lpString="*.xls") returned 5 [0067.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.xlsx") returned 0 [0067.406] lstrlenA (lpString="*.xlsx") returned 6 [0067.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.ppt") returned 0 [0067.406] lstrlenA (lpString="*.ppt") returned 5 [0067.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.pptx") returned 0 [0067.406] lstrlenA (lpString="*.pptx") returned 6 [0067.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.pdf") returned 0 [0067.406] lstrlenA (lpString="*.pdf") returned 5 [0067.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.mov") returned 0 [0067.406] lstrlenA (lpString="*.mov") returned 5 [0067.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.m2v") returned 0 [0067.406] lstrlenA (lpString="*.m2v") returned 5 [0067.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.3gp") returned 0 [0067.406] lstrlenA (lpString="*.3gp") returned 5 [0067.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.mpeg") returned 0 [0067.406] lstrlenA (lpString="*.mpeg") returned 6 [0067.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.mpg") returned 0 [0067.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.flv") returned 0 [0067.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.avi") returned 0 [0067.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.mp4") returned 0 [0067.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.wmv") returned 0 [0067.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.divx") returned 0 [0067.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.mkv") returned 0 [0067.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.mp3") returned 0 [0067.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.wav") returned 0 [0067.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.flac") returned 0 [0067.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.ape") returned 0 [0067.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.wma") returned 0 [0067.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.ac3") returned 0 [0067.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini", pszSpec="*.mxf") returned 0 [0067.407] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0067.407] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.407] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0067.407] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0067.407] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0067.407] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\eula.ini") returned="eula.ini" [0067.407] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\" [0067.407] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\") returned="" [0067.407] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\HOW TO DECRYPT FILES.txt" [0067.408] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\how to decrypt files.txt")) returned 0x20 [0067.408] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html" [0067.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.zip") returned 0 [0067.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.rar") returned 0 [0067.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.7z") returned 0 [0067.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.tar") returned 0 [0067.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.gzip") returned 0 [0067.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.jpg") returned 0 [0067.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.jpeg") returned 0 [0067.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.psd") returned 0 [0067.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.gif") returned 0 [0067.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.doc") returned 0 [0067.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.docx") returned 0 [0067.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.xls") returned 0 [0067.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.xlsx") returned 0 [0067.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.ppt") returned 0 [0067.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.pptx") returned 0 [0067.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.pdf") returned 0 [0067.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.mov") returned 0 [0067.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.m2v") returned 0 [0067.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.3gp") returned 0 [0067.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.mpeg") returned 0 [0067.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.mpg") returned 0 [0067.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.flv") returned 0 [0067.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.avi") returned 0 [0067.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.mp4") returned 0 [0067.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.wmv") returned 0 [0067.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.divx") returned 0 [0067.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.mkv") returned 0 [0067.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.mp3") returned 0 [0067.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.wav") returned 0 [0067.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.flac") returned 0 [0067.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.ape") returned 0 [0067.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.wma") returned 0 [0067.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.ac3") returned 0 [0067.410] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html", pszSpec="*.mxf") returned 0 [0067.410] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0067.410] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.410] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81cc37a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="CZE", cAlternateFileName="")) returned 1 [0067.410] lstrcmpA (lpString1=".", lpString2="CZE") returned -1 [0067.410] lstrcmpA (lpString1="..", lpString2="CZE") returned -1 [0067.410] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0067.410] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="CZE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE" [0067.410] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81cc37a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.412] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.412] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81cc37a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.412] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.412] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.412] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3a8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0067.412] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.412] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0067.412] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0067.412] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0067.412] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\*.*") returned="*.*" [0067.412] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\" [0067.412] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\") returned="" [0067.412] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\HOW TO DECRYPT FILES.txt" [0067.412] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\how to decrypt files.txt")) returned 0xffffffff [0067.412] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.413] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.415] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.415] CloseHandle (hObject=0x94) returned 1 [0067.415] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini" [0067.415] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.zip") returned 0 [0067.415] lstrlenA (lpString="*.zip") returned 5 [0067.415] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.rar") returned 0 [0067.415] lstrlenA (lpString="*.rar") returned 5 [0067.415] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.7z") returned 0 [0067.415] lstrlenA (lpString="*.7z") returned 4 [0067.415] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.tar") returned 0 [0067.415] lstrlenA (lpString="*.tar") returned 5 [0067.415] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.gzip") returned 0 [0067.415] lstrlenA (lpString="*.gzip") returned 6 [0067.415] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.jpg") returned 0 [0067.415] lstrlenA (lpString="*.jpg") returned 5 [0067.415] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.jpeg") returned 0 [0067.415] lstrlenA (lpString="*.jpeg") returned 6 [0067.415] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.psd") returned 0 [0067.415] lstrlenA (lpString="*.psd") returned 5 [0067.415] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.gif") returned 0 [0067.416] lstrlenA (lpString="*.gif") returned 5 [0067.416] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.doc") returned 0 [0067.416] lstrlenA (lpString="*.doc") returned 5 [0067.416] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.docx") returned 0 [0067.416] lstrlenA (lpString="*.docx") returned 6 [0067.416] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.xls") returned 0 [0067.416] lstrlenA (lpString="*.xls") returned 5 [0067.416] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.xlsx") returned 0 [0067.416] lstrlenA (lpString="*.xlsx") returned 6 [0067.416] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.ppt") returned 0 [0067.416] lstrlenA (lpString="*.ppt") returned 5 [0067.416] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.pptx") returned 0 [0067.416] lstrlenA (lpString="*.pptx") returned 6 [0067.416] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.pdf") returned 0 [0067.416] lstrlenA (lpString="*.pdf") returned 5 [0067.416] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.mov") returned 0 [0067.416] lstrlenA (lpString="*.mov") returned 5 [0067.416] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.m2v") returned 0 [0067.416] lstrlenA (lpString="*.m2v") returned 5 [0067.416] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.3gp") returned 0 [0067.416] lstrlenA (lpString="*.3gp") returned 5 [0067.416] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.mpeg") returned 0 [0067.416] lstrlenA (lpString="*.mpeg") returned 6 [0067.416] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.mpg") returned 0 [0067.416] lstrlenA (lpString="*.mpg") returned 5 [0067.416] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.flv") returned 0 [0067.417] lstrlenA (lpString="*.flv") returned 5 [0067.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.avi") returned 0 [0067.417] lstrlenA (lpString="*.avi") returned 5 [0067.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.mp4") returned 0 [0067.417] lstrlenA (lpString="*.mp4") returned 5 [0067.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.wmv") returned 0 [0067.417] lstrlenA (lpString="*.wmv") returned 5 [0067.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.divx") returned 0 [0067.417] lstrlenA (lpString="*.divx") returned 6 [0067.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.mkv") returned 0 [0067.417] lstrlenA (lpString="*.mkv") returned 5 [0067.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.mp3") returned 0 [0067.417] lstrlenA (lpString="*.mp3") returned 5 [0067.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.wav") returned 0 [0067.417] lstrlenA (lpString="*.wav") returned 5 [0067.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.flac") returned 0 [0067.417] lstrlenA (lpString="*.flac") returned 6 [0067.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.ape") returned 0 [0067.417] lstrlenA (lpString="*.ape") returned 5 [0067.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.wma") returned 0 [0067.417] lstrlenA (lpString="*.wma") returned 5 [0067.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.ac3") returned 0 [0067.417] lstrlenA (lpString="*.ac3") returned 5 [0067.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini", pszSpec="*.mxf") returned 0 [0067.417] lstrlenA (lpString="*.mxf") returned 5 [0067.417] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x112b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0067.418] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.418] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0067.418] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0067.418] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0067.418] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\eula.ini") returned="eula.ini" [0067.418] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\" [0067.418] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\") returned="" [0067.418] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\HOW TO DECRYPT FILES.txt" [0067.418] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\how to decrypt files.txt")) returned 0x20 [0067.418] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html" [0067.418] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.zip") returned 0 [0067.418] lstrlenA (lpString="*.zip") returned 5 [0067.418] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.rar") returned 0 [0067.418] lstrlenA (lpString="*.rar") returned 5 [0067.418] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.7z") returned 0 [0067.419] lstrlenA (lpString="*.7z") returned 4 [0067.419] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.tar") returned 0 [0067.419] lstrlenA (lpString="*.tar") returned 5 [0067.419] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.gzip") returned 0 [0067.419] lstrlenA (lpString="*.gzip") returned 6 [0067.419] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.jpg") returned 0 [0067.419] lstrlenA (lpString="*.jpg") returned 5 [0067.419] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.jpeg") returned 0 [0067.419] lstrlenA (lpString="*.jpeg") returned 6 [0067.419] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.psd") returned 0 [0067.419] lstrlenA (lpString="*.psd") returned 5 [0067.419] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.gif") returned 0 [0067.419] lstrlenA (lpString="*.gif") returned 5 [0067.419] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.doc") returned 0 [0067.419] lstrlenA (lpString="*.doc") returned 5 [0067.419] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.docx") returned 0 [0067.419] lstrlenA (lpString="*.docx") returned 6 [0067.419] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.xls") returned 0 [0067.419] lstrlenA (lpString="*.xls") returned 5 [0067.419] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.xlsx") returned 0 [0067.419] lstrlenA (lpString="*.xlsx") returned 6 [0067.419] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.ppt") returned 0 [0067.419] lstrlenA (lpString="*.ppt") returned 5 [0067.419] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.pptx") returned 0 [0067.419] lstrlenA (lpString="*.pptx") returned 6 [0067.419] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.pdf") returned 0 [0067.420] lstrlenA (lpString="*.pdf") returned 5 [0067.420] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.mov") returned 0 [0067.420] lstrlenA (lpString="*.mov") returned 5 [0067.420] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.m2v") returned 0 [0067.420] lstrlenA (lpString="*.m2v") returned 5 [0067.420] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.3gp") returned 0 [0067.420] lstrlenA (lpString="*.3gp") returned 5 [0067.420] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.mpeg") returned 0 [0067.420] lstrlenA (lpString="*.mpeg") returned 6 [0067.420] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.mpg") returned 0 [0067.420] lstrlenA (lpString="*.mpg") returned 5 [0067.420] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.flv") returned 0 [0067.420] lstrlenA (lpString="*.flv") returned 5 [0067.420] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.avi") returned 0 [0067.420] lstrlenA (lpString="*.avi") returned 5 [0067.420] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.mp4") returned 0 [0067.420] lstrlenA (lpString="*.mp4") returned 5 [0067.420] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.wmv") returned 0 [0067.420] lstrlenA (lpString="*.wmv") returned 5 [0067.420] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.divx") returned 0 [0067.420] lstrlenA (lpString="*.divx") returned 6 [0067.420] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.mkv") returned 0 [0067.420] lstrlenA (lpString="*.mkv") returned 5 [0067.420] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.mp3") returned 0 [0067.420] lstrlenA (lpString="*.mp3") returned 5 [0067.420] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.wav") returned 0 [0067.421] lstrlenA (lpString="*.wav") returned 5 [0067.421] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.flac") returned 0 [0067.421] lstrlenA (lpString="*.flac") returned 6 [0067.421] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.ape") returned 0 [0067.421] lstrlenA (lpString="*.ape") returned 5 [0067.421] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.wma") returned 0 [0067.421] lstrlenA (lpString="*.wma") returned 5 [0067.421] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.ac3") returned 0 [0067.421] lstrlenA (lpString="*.ac3") returned 5 [0067.421] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html", pszSpec="*.mxf") returned 0 [0067.421] lstrlenA (lpString="*.mxf") returned 5 [0067.421] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x112b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0067.421] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.421] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="DAN", cAlternateFileName="")) returned 1 [0067.421] lstrcmpA (lpString1=".", lpString2="DAN") returned -1 [0067.421] lstrcmpA (lpString1="..", lpString2="DAN") returned -1 [0067.421] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0067.421] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="DAN" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN" [0067.421] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN") returned 57 [0067.421] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.423] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.423] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.423] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.423] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.423] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x416, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0067.423] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.423] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0067.423] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0067.423] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0067.423] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\*.*") returned="*.*" [0067.423] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\" [0067.423] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\") returned="" [0067.423] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\HOW TO DECRYPT FILES.txt" [0067.423] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\how to decrypt files.txt")) returned 0xffffffff [0067.423] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.424] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0067.424] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.426] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.426] CloseHandle (hObject=0x94) returned 1 [0067.426] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini" [0067.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.zip") returned 0 [0067.426] lstrlenA (lpString="*.zip") returned 5 [0067.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.rar") returned 0 [0067.426] lstrlenA (lpString="*.rar") returned 5 [0067.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.7z") returned 0 [0067.426] lstrlenA (lpString="*.7z") returned 4 [0067.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.tar") returned 0 [0067.426] lstrlenA (lpString="*.tar") returned 5 [0067.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.gzip") returned 0 [0067.426] lstrlenA (lpString="*.gzip") returned 6 [0067.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.jpg") returned 0 [0067.426] lstrlenA (lpString="*.jpg") returned 5 [0067.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.jpeg") returned 0 [0067.426] lstrlenA (lpString="*.jpeg") returned 6 [0067.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.psd") returned 0 [0067.426] lstrlenA (lpString="*.psd") returned 5 [0067.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.gif") returned 0 [0067.427] lstrlenA (lpString="*.gif") returned 5 [0067.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.doc") returned 0 [0067.427] lstrlenA (lpString="*.doc") returned 5 [0067.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.docx") returned 0 [0067.427] lstrlenA (lpString="*.docx") returned 6 [0067.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.xls") returned 0 [0067.427] lstrlenA (lpString="*.xls") returned 5 [0067.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.xlsx") returned 0 [0067.427] lstrlenA (lpString="*.xlsx") returned 6 [0067.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.ppt") returned 0 [0067.427] lstrlenA (lpString="*.ppt") returned 5 [0067.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.pptx") returned 0 [0067.427] lstrlenA (lpString="*.pptx") returned 6 [0067.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.pdf") returned 0 [0067.427] lstrlenA (lpString="*.pdf") returned 5 [0067.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.mov") returned 0 [0067.427] lstrlenA (lpString="*.mov") returned 5 [0067.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.m2v") returned 0 [0067.427] lstrlenA (lpString="*.m2v") returned 5 [0067.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.3gp") returned 0 [0067.427] lstrlenA (lpString="*.3gp") returned 5 [0067.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.mpeg") returned 0 [0067.427] lstrlenA (lpString="*.mpeg") returned 6 [0067.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.mpg") returned 0 [0067.427] lstrlenA (lpString="*.mpg") returned 5 [0067.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.flv") returned 0 [0067.427] lstrlenA (lpString="*.flv") returned 5 [0067.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.avi") returned 0 [0067.427] lstrlenA (lpString="*.avi") returned 5 [0067.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.mp4") returned 0 [0067.427] lstrlenA (lpString="*.mp4") returned 5 [0067.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.wmv") returned 0 [0067.428] lstrlenA (lpString="*.wmv") returned 5 [0067.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.divx") returned 0 [0067.428] lstrlenA (lpString="*.divx") returned 6 [0067.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.mkv") returned 0 [0067.428] lstrlenA (lpString="*.mkv") returned 5 [0067.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.mp3") returned 0 [0067.428] lstrlenA (lpString="*.mp3") returned 5 [0067.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.wav") returned 0 [0067.428] lstrlenA (lpString="*.wav") returned 5 [0067.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.flac") returned 0 [0067.428] lstrlenA (lpString="*.flac") returned 6 [0067.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.ape") returned 0 [0067.428] lstrlenA (lpString="*.ape") returned 5 [0067.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.wma") returned 0 [0067.428] lstrlenA (lpString="*.wma") returned 5 [0067.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.ac3") returned 0 [0067.428] lstrlenA (lpString="*.ac3") returned 5 [0067.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini", pszSpec="*.mxf") returned 0 [0067.428] lstrlenA (lpString="*.mxf") returned 5 [0067.428] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbd79, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0067.428] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.428] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0067.428] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0067.428] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0067.428] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\eula.ini") returned="eula.ini" [0067.428] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\" [0067.428] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\") returned="" [0067.428] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\HOW TO DECRYPT FILES.txt" [0067.429] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\how to decrypt files.txt")) returned 0x20 [0067.429] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html" [0067.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.zip") returned 0 [0067.429] lstrlenA (lpString="*.zip") returned 5 [0067.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.rar") returned 0 [0067.429] lstrlenA (lpString="*.rar") returned 5 [0067.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.7z") returned 0 [0067.429] lstrlenA (lpString="*.7z") returned 4 [0067.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.tar") returned 0 [0067.429] lstrlenA (lpString="*.tar") returned 5 [0067.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.gzip") returned 0 [0067.429] lstrlenA (lpString="*.gzip") returned 6 [0067.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.jpg") returned 0 [0067.429] lstrlenA (lpString="*.jpg") returned 5 [0067.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.jpeg") returned 0 [0067.429] lstrlenA (lpString="*.jpeg") returned 6 [0067.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.psd") returned 0 [0067.429] lstrlenA (lpString="*.psd") returned 5 [0067.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.gif") returned 0 [0067.429] lstrlenA (lpString="*.gif") returned 5 [0067.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.doc") returned 0 [0067.429] lstrlenA (lpString="*.doc") returned 5 [0067.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.docx") returned 0 [0067.429] lstrlenA (lpString="*.docx") returned 6 [0067.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.xls") returned 0 [0067.429] lstrlenA (lpString="*.xls") returned 5 [0067.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.xlsx") returned 0 [0067.429] lstrlenA (lpString="*.xlsx") returned 6 [0067.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.ppt") returned 0 [0067.430] lstrlenA (lpString="*.ppt") returned 5 [0067.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.pptx") returned 0 [0067.430] lstrlenA (lpString="*.pptx") returned 6 [0067.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.pdf") returned 0 [0067.430] lstrlenA (lpString="*.pdf") returned 5 [0067.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.mov") returned 0 [0067.430] lstrlenA (lpString="*.mov") returned 5 [0067.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.m2v") returned 0 [0067.430] lstrlenA (lpString="*.m2v") returned 5 [0067.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.3gp") returned 0 [0067.430] lstrlenA (lpString="*.3gp") returned 5 [0067.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.mpeg") returned 0 [0067.430] lstrlenA (lpString="*.mpeg") returned 6 [0067.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.mpg") returned 0 [0067.430] lstrlenA (lpString="*.mpg") returned 5 [0067.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.flv") returned 0 [0067.430] lstrlenA (lpString="*.flv") returned 5 [0067.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.avi") returned 0 [0067.430] lstrlenA (lpString="*.avi") returned 5 [0067.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.mp4") returned 0 [0067.430] lstrlenA (lpString="*.mp4") returned 5 [0067.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.wmv") returned 0 [0067.430] lstrlenA (lpString="*.wmv") returned 5 [0067.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.divx") returned 0 [0067.430] lstrlenA (lpString="*.divx") returned 6 [0067.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.mkv") returned 0 [0067.430] lstrlenA (lpString="*.mkv") returned 5 [0067.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.mp3") returned 0 [0067.430] lstrlenA (lpString="*.mp3") returned 5 [0067.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.wav") returned 0 [0067.430] lstrlenA (lpString="*.wav") returned 5 [0067.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.flac") returned 0 [0067.431] lstrlenA (lpString="*.flac") returned 6 [0067.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.ape") returned 0 [0067.431] lstrlenA (lpString="*.ape") returned 5 [0067.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.wma") returned 0 [0067.431] lstrlenA (lpString="*.wma") returned 5 [0067.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.ac3") returned 0 [0067.431] lstrlenA (lpString="*.ac3") returned 5 [0067.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html", pszSpec="*.mxf") returned 0 [0067.431] lstrlenA (lpString="*.mxf") returned 5 [0067.431] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbd79, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0067.431] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.431] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="DEU", cAlternateFileName="")) returned 1 [0067.431] lstrcmpA (lpString1=".", lpString2="DEU") returned -1 [0067.431] lstrcmpA (lpString1="..", lpString2="DEU") returned -1 [0067.431] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0067.431] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="DEU" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU" [0067.431] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU") returned 57 [0067.431] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.431] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.431] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.432] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.432] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.432] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0067.432] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.432] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0067.432] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0067.432] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0067.432] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\*.*") returned="*.*" [0067.432] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\" [0067.432] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\") returned="" [0067.432] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\HOW TO DECRYPT FILES.txt" [0067.432] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\how to decrypt files.txt")) returned 0xffffffff [0067.432] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.433] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0067.433] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.437] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.437] CloseHandle (hObject=0x94) returned 1 [0067.437] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini" [0067.437] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.zip") returned 0 [0067.437] lstrlenA (lpString="*.zip") returned 5 [0067.437] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.rar") returned 0 [0067.437] lstrlenA (lpString="*.rar") returned 5 [0067.437] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.7z") returned 0 [0067.437] lstrlenA (lpString="*.7z") returned 4 [0067.437] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.tar") returned 0 [0067.437] lstrlenA (lpString="*.tar") returned 5 [0067.437] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.gzip") returned 0 [0067.437] lstrlenA (lpString="*.gzip") returned 6 [0067.437] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.jpg") returned 0 [0067.437] lstrlenA (lpString="*.jpg") returned 5 [0067.437] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.jpeg") returned 0 [0067.437] lstrlenA (lpString="*.jpeg") returned 6 [0067.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.psd") returned 0 [0067.438] lstrlenA (lpString="*.psd") returned 5 [0067.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.gif") returned 0 [0067.438] lstrlenA (lpString="*.gif") returned 5 [0067.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.doc") returned 0 [0067.438] lstrlenA (lpString="*.doc") returned 5 [0067.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.docx") returned 0 [0067.438] lstrlenA (lpString="*.docx") returned 6 [0067.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.xls") returned 0 [0067.438] lstrlenA (lpString="*.xls") returned 5 [0067.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.xlsx") returned 0 [0067.438] lstrlenA (lpString="*.xlsx") returned 6 [0067.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.ppt") returned 0 [0067.438] lstrlenA (lpString="*.ppt") returned 5 [0067.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.pptx") returned 0 [0067.438] lstrlenA (lpString="*.pptx") returned 6 [0067.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.pdf") returned 0 [0067.438] lstrlenA (lpString="*.pdf") returned 5 [0067.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.mov") returned 0 [0067.438] lstrlenA (lpString="*.mov") returned 5 [0067.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.m2v") returned 0 [0067.438] lstrlenA (lpString="*.m2v") returned 5 [0067.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.3gp") returned 0 [0067.438] lstrlenA (lpString="*.3gp") returned 5 [0067.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.mpeg") returned 0 [0067.438] lstrlenA (lpString="*.mpeg") returned 6 [0067.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.mpg") returned 0 [0067.439] lstrlenA (lpString="*.mpg") returned 5 [0067.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.flv") returned 0 [0067.439] lstrlenA (lpString="*.flv") returned 5 [0067.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.avi") returned 0 [0067.439] lstrlenA (lpString="*.avi") returned 5 [0067.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.mp4") returned 0 [0067.439] lstrlenA (lpString="*.mp4") returned 5 [0067.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.wmv") returned 0 [0067.439] lstrlenA (lpString="*.wmv") returned 5 [0067.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.divx") returned 0 [0067.439] lstrlenA (lpString="*.divx") returned 6 [0067.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.mkv") returned 0 [0067.439] lstrlenA (lpString="*.mkv") returned 5 [0067.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.mp3") returned 0 [0067.439] lstrlenA (lpString="*.mp3") returned 5 [0067.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.wav") returned 0 [0067.439] lstrlenA (lpString="*.wav") returned 5 [0067.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.flac") returned 0 [0067.439] lstrlenA (lpString="*.flac") returned 6 [0067.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.ape") returned 0 [0067.439] lstrlenA (lpString="*.ape") returned 5 [0067.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.wma") returned 0 [0067.439] lstrlenA (lpString="*.wma") returned 5 [0067.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.ac3") returned 0 [0067.439] lstrlenA (lpString="*.ac3") returned 5 [0067.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini", pszSpec="*.mxf") returned 0 [0067.439] lstrlenA (lpString="*.mxf") returned 5 [0067.439] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc750, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0067.440] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.440] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0067.440] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0067.440] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0067.440] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\eula.ini") returned="eula.ini" [0067.440] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\" [0067.440] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\") returned="" [0067.440] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\HOW TO DECRYPT FILES.txt" [0067.440] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\how to decrypt files.txt")) returned 0x20 [0067.440] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html" [0067.440] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.zip") returned 0 [0067.440] lstrlenA (lpString="*.zip") returned 5 [0067.440] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.rar") returned 0 [0067.440] lstrlenA (lpString="*.rar") returned 5 [0067.440] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.7z") returned 0 [0067.440] lstrlenA (lpString="*.7z") returned 4 [0067.440] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.tar") returned 0 [0067.440] lstrlenA (lpString="*.tar") returned 5 [0067.440] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.gzip") returned 0 [0067.440] lstrlenA (lpString="*.gzip") returned 6 [0067.440] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.jpg") returned 0 [0067.441] lstrlenA (lpString="*.jpg") returned 5 [0067.441] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.jpeg") returned 0 [0067.441] lstrlenA (lpString="*.jpeg") returned 6 [0067.441] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.psd") returned 0 [0067.441] lstrlenA (lpString="*.psd") returned 5 [0067.441] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.gif") returned 0 [0067.441] lstrlenA (lpString="*.gif") returned 5 [0067.441] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.doc") returned 0 [0067.441] lstrlenA (lpString="*.doc") returned 5 [0067.441] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.docx") returned 0 [0067.441] lstrlenA (lpString="*.docx") returned 6 [0067.441] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.xls") returned 0 [0067.441] lstrlenA (lpString="*.xls") returned 5 [0067.441] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.xlsx") returned 0 [0067.441] lstrlenA (lpString="*.xlsx") returned 6 [0067.441] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.ppt") returned 0 [0067.441] lstrlenA (lpString="*.ppt") returned 5 [0067.441] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.pptx") returned 0 [0067.441] lstrlenA (lpString="*.pptx") returned 6 [0067.441] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.pdf") returned 0 [0067.441] lstrlenA (lpString="*.pdf") returned 5 [0067.441] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.mov") returned 0 [0067.441] lstrlenA (lpString="*.mov") returned 5 [0067.441] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.m2v") returned 0 [0067.441] lstrlenA (lpString="*.m2v") returned 5 [0067.442] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.3gp") returned 0 [0067.442] lstrlenA (lpString="*.3gp") returned 5 [0067.442] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.mpeg") returned 0 [0067.442] lstrlenA (lpString="*.mpeg") returned 6 [0067.442] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.mpg") returned 0 [0067.442] lstrlenA (lpString="*.mpg") returned 5 [0067.442] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.flv") returned 0 [0067.442] lstrlenA (lpString="*.flv") returned 5 [0067.442] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.avi") returned 0 [0067.442] lstrlenA (lpString="*.avi") returned 5 [0067.442] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.mp4") returned 0 [0067.442] lstrlenA (lpString="*.mp4") returned 5 [0067.442] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.wmv") returned 0 [0067.442] lstrlenA (lpString="*.wmv") returned 5 [0067.442] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.divx") returned 0 [0067.442] lstrlenA (lpString="*.divx") returned 6 [0067.442] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.mkv") returned 0 [0067.442] lstrlenA (lpString="*.mkv") returned 5 [0067.442] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.mp3") returned 0 [0067.442] lstrlenA (lpString="*.mp3") returned 5 [0067.442] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.wav") returned 0 [0067.442] lstrlenA (lpString="*.wav") returned 5 [0067.442] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.flac") returned 0 [0067.442] lstrlenA (lpString="*.flac") returned 6 [0067.442] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.ape") returned 0 [0067.442] lstrlenA (lpString="*.ape") returned 5 [0067.442] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.wma") returned 0 [0067.443] lstrlenA (lpString="*.wma") returned 5 [0067.443] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.ac3") returned 0 [0067.443] lstrlenA (lpString="*.ac3") returned 5 [0067.443] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html", pszSpec="*.mxf") returned 0 [0067.443] lstrlenA (lpString="*.mxf") returned 5 [0067.443] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc750, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0067.443] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.443] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ENU", cAlternateFileName="")) returned 1 [0067.443] lstrcmpA (lpString1=".", lpString2="ENU") returned -1 [0067.443] lstrcmpA (lpString1="..", lpString2="ENU") returned -1 [0067.443] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0067.443] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="ENU" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU" [0067.443] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU") returned 57 [0067.443] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.449] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.450] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.450] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.450] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.450] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0067.450] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.450] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0067.450] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0067.450] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0067.450] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\*.*") returned="*.*" [0067.450] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\" [0067.450] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\") returned="" [0067.450] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\HOW TO DECRYPT FILES.txt" [0067.450] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\how to decrypt files.txt")) returned 0xffffffff [0067.450] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.452] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0067.452] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.453] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.453] CloseHandle (hObject=0x94) returned 1 [0067.453] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini" [0067.453] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.zip") returned 0 [0067.453] lstrlenA (lpString="*.zip") returned 5 [0067.453] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.rar") returned 0 [0067.453] lstrlenA (lpString="*.rar") returned 5 [0067.453] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.7z") returned 0 [0067.453] lstrlenA (lpString="*.7z") returned 4 [0067.453] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.tar") returned 0 [0067.453] lstrlenA (lpString="*.tar") returned 5 [0067.453] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.gzip") returned 0 [0067.453] lstrlenA (lpString="*.gzip") returned 6 [0067.453] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.jpg") returned 0 [0067.453] lstrlenA (lpString="*.jpg") returned 5 [0067.453] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.jpeg") returned 0 [0067.453] lstrlenA (lpString="*.jpeg") returned 6 [0067.454] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.psd") returned 0 [0067.454] lstrlenA (lpString="*.psd") returned 5 [0067.454] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.gif") returned 0 [0067.454] lstrlenA (lpString="*.gif") returned 5 [0067.454] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.doc") returned 0 [0067.454] lstrlenA (lpString="*.doc") returned 5 [0067.454] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.docx") returned 0 [0067.454] lstrlenA (lpString="*.docx") returned 6 [0067.454] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.xls") returned 0 [0067.454] lstrlenA (lpString="*.xls") returned 5 [0067.454] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.xlsx") returned 0 [0067.454] lstrlenA (lpString="*.xlsx") returned 6 [0067.454] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.ppt") returned 0 [0067.454] lstrlenA (lpString="*.ppt") returned 5 [0067.454] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.pptx") returned 0 [0067.454] lstrlenA (lpString="*.pptx") returned 6 [0067.454] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.pdf") returned 0 [0067.454] lstrlenA (lpString="*.pdf") returned 5 [0067.454] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.mov") returned 0 [0067.454] lstrlenA (lpString="*.mov") returned 5 [0067.454] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.m2v") returned 0 [0067.454] lstrlenA (lpString="*.m2v") returned 5 [0067.454] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.3gp") returned 0 [0067.454] lstrlenA (lpString="*.3gp") returned 5 [0067.454] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.mpeg") returned 0 [0067.454] lstrlenA (lpString="*.mpeg") returned 6 [0067.454] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.mpg") returned 0 [0067.455] lstrlenA (lpString="*.mpg") returned 5 [0067.455] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.flv") returned 0 [0067.455] lstrlenA (lpString="*.flv") returned 5 [0067.455] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.avi") returned 0 [0067.455] lstrlenA (lpString="*.avi") returned 5 [0067.455] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.mp4") returned 0 [0067.455] lstrlenA (lpString="*.mp4") returned 5 [0067.455] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.wmv") returned 0 [0067.455] lstrlenA (lpString="*.wmv") returned 5 [0067.455] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.divx") returned 0 [0067.455] lstrlenA (lpString="*.divx") returned 6 [0067.455] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.mkv") returned 0 [0067.455] lstrlenA (lpString="*.mkv") returned 5 [0067.455] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.mp3") returned 0 [0067.455] lstrlenA (lpString="*.mp3") returned 5 [0067.455] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.wav") returned 0 [0067.455] lstrlenA (lpString="*.wav") returned 5 [0067.455] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.flac") returned 0 [0067.455] lstrlenA (lpString="*.flac") returned 6 [0067.455] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.ape") returned 0 [0067.455] lstrlenA (lpString="*.ape") returned 5 [0067.455] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.wma") returned 0 [0067.455] lstrlenA (lpString="*.wma") returned 5 [0067.455] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.ac3") returned 0 [0067.455] lstrlenA (lpString="*.ac3") returned 5 [0067.456] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini", pszSpec="*.mxf") returned 0 [0067.456] lstrlenA (lpString="*.mxf") returned 5 [0067.456] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa835, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0067.456] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.456] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0067.456] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0067.456] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0067.456] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\eula.ini") returned="eula.ini" [0067.456] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\" [0067.456] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\") returned="" [0067.456] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\HOW TO DECRYPT FILES.txt" [0067.456] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\how to decrypt files.txt")) returned 0x20 [0067.456] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html" [0067.456] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.zip") returned 0 [0067.456] lstrlenA (lpString="*.zip") returned 5 [0067.456] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.rar") returned 0 [0067.456] lstrlenA (lpString="*.rar") returned 5 [0067.456] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.7z") returned 0 [0067.456] lstrlenA (lpString="*.7z") returned 4 [0067.456] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.tar") returned 0 [0067.456] lstrlenA (lpString="*.tar") returned 5 [0067.457] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.gzip") returned 0 [0067.457] lstrlenA (lpString="*.gzip") returned 6 [0067.457] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.jpg") returned 0 [0067.457] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.jpeg") returned 0 [0067.457] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.psd") returned 0 [0067.457] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.gif") returned 0 [0067.457] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.doc") returned 0 [0067.457] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.docx") returned 0 [0067.457] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.xls") returned 0 [0067.457] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.xlsx") returned 0 [0067.457] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.ppt") returned 0 [0067.457] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.pptx") returned 0 [0067.457] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.pdf") returned 0 [0067.457] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.mov") returned 0 [0067.457] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.m2v") returned 0 [0067.457] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.3gp") returned 0 [0067.457] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.mpeg") returned 0 [0067.457] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.mpg") returned 0 [0067.458] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.flv") returned 0 [0067.458] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.avi") returned 0 [0067.458] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.mp4") returned 0 [0067.458] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.wmv") returned 0 [0067.458] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.divx") returned 0 [0067.458] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.mkv") returned 0 [0067.458] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.mp3") returned 0 [0067.458] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.wav") returned 0 [0067.458] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.flac") returned 0 [0067.458] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.ape") returned 0 [0067.458] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.wma") returned 0 [0067.458] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.ac3") returned 0 [0067.458] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html", pszSpec="*.mxf") returned 0 [0067.458] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa835, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0067.458] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.458] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ESP", cAlternateFileName="")) returned 1 [0067.458] lstrcmpA (lpString1=".", lpString2="ESP") returned -1 [0067.458] lstrcmpA (lpString1="..", lpString2="ESP") returned -1 [0067.459] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0067.459] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="ESP" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP" [0067.459] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.460] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.460] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.460] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.460] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.460] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0067.460] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.460] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0067.460] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0067.460] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0067.460] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\*.*") returned="*.*" [0067.460] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\" [0067.460] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\") returned="" [0067.460] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\HOW TO DECRYPT FILES.txt" [0067.460] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\esp\\how to decrypt files.txt")) returned 0xffffffff [0067.461] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\esp\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.462] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.463] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.463] CloseHandle (hObject=0x94) returned 1 [0067.463] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini" [0067.463] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.zip") returned 0 [0067.463] lstrlenA (lpString="*.zip") returned 5 [0067.463] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.rar") returned 0 [0067.463] lstrlenA (lpString="*.rar") returned 5 [0067.463] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.7z") returned 0 [0067.463] lstrlenA (lpString="*.7z") returned 4 [0067.463] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.tar") returned 0 [0067.464] lstrlenA (lpString="*.tar") returned 5 [0067.464] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.gzip") returned 0 [0067.464] lstrlenA (lpString="*.gzip") returned 6 [0067.464] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.jpg") returned 0 [0067.464] lstrlenA (lpString="*.jpg") returned 5 [0067.464] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.jpeg") returned 0 [0067.464] lstrlenA (lpString="*.jpeg") returned 6 [0067.464] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.psd") returned 0 [0067.464] lstrlenA (lpString="*.psd") returned 5 [0067.464] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.gif") returned 0 [0067.464] lstrlenA (lpString="*.gif") returned 5 [0067.464] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.doc") returned 0 [0067.464] lstrlenA (lpString="*.doc") returned 5 [0067.464] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.docx") returned 0 [0067.464] lstrlenA (lpString="*.docx") returned 6 [0067.464] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.xls") returned 0 [0067.464] lstrlenA (lpString="*.xls") returned 5 [0067.465] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.xlsx") returned 0 [0067.465] lstrlenA (lpString="*.xlsx") returned 6 [0067.465] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.ppt") returned 0 [0067.465] lstrlenA (lpString="*.ppt") returned 5 [0067.465] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.pptx") returned 0 [0067.465] lstrlenA (lpString="*.pptx") returned 6 [0067.465] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.pdf") returned 0 [0067.465] lstrlenA (lpString="*.pdf") returned 5 [0067.465] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.mov") returned 0 [0067.465] lstrlenA (lpString="*.mov") returned 5 [0067.465] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.m2v") returned 0 [0067.465] lstrlenA (lpString="*.m2v") returned 5 [0067.465] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.3gp") returned 0 [0067.465] lstrlenA (lpString="*.3gp") returned 5 [0067.465] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.mpeg") returned 0 [0067.465] lstrlenA (lpString="*.mpeg") returned 6 [0067.465] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.mpg") returned 0 [0067.465] lstrlenA (lpString="*.mpg") returned 5 [0067.465] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.flv") returned 0 [0067.465] lstrlenA (lpString="*.flv") returned 5 [0067.465] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.avi") returned 0 [0067.465] lstrlenA (lpString="*.avi") returned 5 [0067.465] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.mp4") returned 0 [0067.465] lstrlenA (lpString="*.mp4") returned 5 [0067.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.wmv") returned 0 [0067.466] lstrlenA (lpString="*.wmv") returned 5 [0067.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.divx") returned 0 [0067.466] lstrlenA (lpString="*.divx") returned 6 [0067.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.mkv") returned 0 [0067.466] lstrlenA (lpString="*.mkv") returned 5 [0067.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.mp3") returned 0 [0067.466] lstrlenA (lpString="*.mp3") returned 5 [0067.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.wav") returned 0 [0067.466] lstrlenA (lpString="*.wav") returned 5 [0067.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.flac") returned 0 [0067.466] lstrlenA (lpString="*.flac") returned 6 [0067.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.ape") returned 0 [0067.466] lstrlenA (lpString="*.ape") returned 5 [0067.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.wma") returned 0 [0067.466] lstrlenA (lpString="*.wma") returned 5 [0067.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.ac3") returned 0 [0067.466] lstrlenA (lpString="*.ac3") returned 5 [0067.466] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini", pszSpec="*.mxf") returned 0 [0067.466] lstrlenA (lpString="*.mxf") returned 5 [0067.466] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0067.466] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.466] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0067.467] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0067.467] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0067.467] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\eula.ini") returned="eula.ini" [0067.467] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\" [0067.467] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\") returned="" [0067.467] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\HOW TO DECRYPT FILES.txt" [0067.467] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\esp\\how to decrypt files.txt")) returned 0x20 [0067.467] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html" [0067.467] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.zip") returned 0 [0067.467] lstrlenA (lpString="*.zip") returned 5 [0067.467] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.rar") returned 0 [0067.467] lstrlenA (lpString="*.rar") returned 5 [0067.467] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.7z") returned 0 [0067.467] lstrlenA (lpString="*.7z") returned 4 [0067.467] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.tar") returned 0 [0067.467] lstrlenA (lpString="*.tar") returned 5 [0067.467] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.gzip") returned 0 [0067.467] lstrlenA (lpString="*.gzip") returned 6 [0067.467] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.jpg") returned 0 [0067.468] lstrlenA (lpString="*.jpg") returned 5 [0067.468] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.jpeg") returned 0 [0067.468] lstrlenA (lpString="*.jpeg") returned 6 [0067.468] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.psd") returned 0 [0067.468] lstrlenA (lpString="*.psd") returned 5 [0067.468] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.gif") returned 0 [0067.468] lstrlenA (lpString="*.gif") returned 5 [0067.468] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.doc") returned 0 [0067.468] lstrlenA (lpString="*.doc") returned 5 [0067.468] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.docx") returned 0 [0067.468] lstrlenA (lpString="*.docx") returned 6 [0067.468] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.xls") returned 0 [0067.468] lstrlenA (lpString="*.xls") returned 5 [0067.468] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.xlsx") returned 0 [0067.468] lstrlenA (lpString="*.xlsx") returned 6 [0067.468] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.ppt") returned 0 [0067.468] lstrlenA (lpString="*.ppt") returned 5 [0067.468] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.pptx") returned 0 [0067.468] lstrlenA (lpString="*.pptx") returned 6 [0067.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.pdf") returned 0 [0067.469] lstrlenA (lpString="*.pdf") returned 5 [0067.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.mov") returned 0 [0067.469] lstrlenA (lpString="*.mov") returned 5 [0067.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.m2v") returned 0 [0067.469] lstrlenA (lpString="*.m2v") returned 5 [0067.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.3gp") returned 0 [0067.469] lstrlenA (lpString="*.3gp") returned 5 [0067.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.mpeg") returned 0 [0067.469] lstrlenA (lpString="*.mpeg") returned 6 [0067.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.mpg") returned 0 [0067.469] lstrlenA (lpString="*.mpg") returned 5 [0067.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.flv") returned 0 [0067.469] lstrlenA (lpString="*.flv") returned 5 [0067.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.avi") returned 0 [0067.469] lstrlenA (lpString="*.avi") returned 5 [0067.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.mp4") returned 0 [0067.469] lstrlenA (lpString="*.mp4") returned 5 [0067.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.wmv") returned 0 [0067.469] lstrlenA (lpString="*.wmv") returned 5 [0067.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.divx") returned 0 [0067.469] lstrlenA (lpString="*.divx") returned 6 [0067.469] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.mkv") returned 0 [0067.469] lstrlenA (lpString="*.mkv") returned 5 [0067.470] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.mp3") returned 0 [0067.470] lstrlenA (lpString="*.mp3") returned 5 [0067.470] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.wav") returned 0 [0067.470] lstrlenA (lpString="*.wav") returned 5 [0067.470] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.flac") returned 0 [0067.470] lstrlenA (lpString="*.flac") returned 6 [0067.470] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.ape") returned 0 [0067.470] lstrlenA (lpString="*.ape") returned 5 [0067.470] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.wma") returned 0 [0067.470] lstrlenA (lpString="*.wma") returned 5 [0067.470] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.ac3") returned 0 [0067.470] lstrlenA (lpString="*.ac3") returned 5 [0067.470] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html", pszSpec="*.mxf") returned 0 [0067.470] lstrlenA (lpString="*.mxf") returned 5 [0067.470] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0067.470] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.470] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="EUQ", cAlternateFileName="")) returned 1 [0067.470] lstrcmpA (lpString1=".", lpString2="EUQ") returned -1 [0067.470] lstrcmpA (lpString1="..", lpString2="EUQ") returned -1 [0067.470] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0067.470] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="EUQ" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ" [0067.471] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ") returned 57 [0067.471] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.471] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.471] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.471] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.471] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.471] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0067.471] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.471] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0067.471] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0067.471] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0067.471] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\*.*") returned="*.*" [0067.471] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\" [0067.471] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\") returned="" [0067.471] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\HOW TO DECRYPT FILES.txt" [0067.472] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\euq\\how to decrypt files.txt")) returned 0xffffffff [0067.472] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\euq\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.473] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0067.473] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.474] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.474] CloseHandle (hObject=0x94) returned 1 [0067.474] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini" [0067.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.zip") returned 0 [0067.474] lstrlenA (lpString="*.zip") returned 5 [0067.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.rar") returned 0 [0067.474] lstrlenA (lpString="*.rar") returned 5 [0067.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.7z") returned 0 [0067.474] lstrlenA (lpString="*.7z") returned 4 [0067.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.tar") returned 0 [0067.474] lstrlenA (lpString="*.tar") returned 5 [0067.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.gzip") returned 0 [0067.474] lstrlenA (lpString="*.gzip") returned 6 [0067.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.jpg") returned 0 [0067.474] lstrlenA (lpString="*.jpg") returned 5 [0067.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.jpeg") returned 0 [0067.474] lstrlenA (lpString="*.jpeg") returned 6 [0067.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.psd") returned 0 [0067.474] lstrlenA (lpString="*.psd") returned 5 [0067.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.gif") returned 0 [0067.475] lstrlenA (lpString="*.gif") returned 5 [0067.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.doc") returned 0 [0067.475] lstrlenA (lpString="*.doc") returned 5 [0067.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.docx") returned 0 [0067.475] lstrlenA (lpString="*.docx") returned 6 [0067.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.xls") returned 0 [0067.475] lstrlenA (lpString="*.xls") returned 5 [0067.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.xlsx") returned 0 [0067.475] lstrlenA (lpString="*.xlsx") returned 6 [0067.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.ppt") returned 0 [0067.475] lstrlenA (lpString="*.ppt") returned 5 [0067.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.pptx") returned 0 [0067.475] lstrlenA (lpString="*.pptx") returned 6 [0067.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.pdf") returned 0 [0067.475] lstrlenA (lpString="*.pdf") returned 5 [0067.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.mov") returned 0 [0067.475] lstrlenA (lpString="*.mov") returned 5 [0067.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.m2v") returned 0 [0067.475] lstrlenA (lpString="*.m2v") returned 5 [0067.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.3gp") returned 0 [0067.475] lstrlenA (lpString="*.3gp") returned 5 [0067.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.mpeg") returned 0 [0067.475] lstrlenA (lpString="*.mpeg") returned 6 [0067.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.mpg") returned 0 [0067.475] lstrlenA (lpString="*.mpg") returned 5 [0067.475] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.flv") returned 0 [0067.476] lstrlenA (lpString="*.flv") returned 5 [0067.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.avi") returned 0 [0067.476] lstrlenA (lpString="*.avi") returned 5 [0067.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.mp4") returned 0 [0067.476] lstrlenA (lpString="*.mp4") returned 5 [0067.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.wmv") returned 0 [0067.476] lstrlenA (lpString="*.wmv") returned 5 [0067.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.divx") returned 0 [0067.476] lstrlenA (lpString="*.divx") returned 6 [0067.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.mkv") returned 0 [0067.476] lstrlenA (lpString="*.mkv") returned 5 [0067.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.mp3") returned 0 [0067.476] lstrlenA (lpString="*.mp3") returned 5 [0067.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.wav") returned 0 [0067.476] lstrlenA (lpString="*.wav") returned 5 [0067.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.flac") returned 0 [0067.476] lstrlenA (lpString="*.flac") returned 6 [0067.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.ape") returned 0 [0067.476] lstrlenA (lpString="*.ape") returned 5 [0067.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.wma") returned 0 [0067.476] lstrlenA (lpString="*.wma") returned 5 [0067.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.ac3") returned 0 [0067.476] lstrlenA (lpString="*.ac3") returned 5 [0067.476] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini", pszSpec="*.mxf") returned 0 [0067.476] lstrlenA (lpString="*.mxf") returned 5 [0067.476] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xaedb, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0067.476] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.476] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0067.476] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0067.476] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0067.476] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\eula.ini") returned="eula.ini" [0067.477] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\" [0067.477] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\") returned="" [0067.477] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\HOW TO DECRYPT FILES.txt" [0067.477] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\euq\\how to decrypt files.txt")) returned 0x20 [0067.477] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html" [0067.477] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.zip") returned 0 [0067.477] lstrlenA (lpString="*.zip") returned 5 [0067.477] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.rar") returned 0 [0067.477] lstrlenA (lpString="*.rar") returned 5 [0067.477] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.7z") returned 0 [0067.477] lstrlenA (lpString="*.7z") returned 4 [0067.477] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.tar") returned 0 [0067.477] lstrlenA (lpString="*.tar") returned 5 [0067.477] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.gzip") returned 0 [0067.477] lstrlenA (lpString="*.gzip") returned 6 [0067.477] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.jpg") returned 0 [0067.477] lstrlenA (lpString="*.jpg") returned 5 [0067.477] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.jpeg") returned 0 [0067.477] lstrlenA (lpString="*.jpeg") returned 6 [0067.477] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.psd") returned 0 [0067.477] lstrlenA (lpString="*.psd") returned 5 [0067.477] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.gif") returned 0 [0067.477] lstrlenA (lpString="*.gif") returned 5 [0067.477] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.doc") returned 0 [0067.477] lstrlenA (lpString="*.doc") returned 5 [0067.477] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.docx") returned 0 [0067.477] lstrlenA (lpString="*.docx") returned 6 [0067.477] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.xls") returned 0 [0067.477] lstrlenA (lpString="*.xls") returned 5 [0067.477] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.xlsx") returned 0 [0067.478] lstrlenA (lpString="*.xlsx") returned 6 [0067.478] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.ppt") returned 0 [0067.478] lstrlenA (lpString="*.ppt") returned 5 [0067.478] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.pptx") returned 0 [0067.478] lstrlenA (lpString="*.pptx") returned 6 [0067.478] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.pdf") returned 0 [0067.478] lstrlenA (lpString="*.pdf") returned 5 [0067.478] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.mov") returned 0 [0067.478] lstrlenA (lpString="*.mov") returned 5 [0067.478] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.m2v") returned 0 [0067.478] lstrlenA (lpString="*.m2v") returned 5 [0067.478] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.3gp") returned 0 [0067.478] lstrlenA (lpString="*.3gp") returned 5 [0067.478] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.mpeg") returned 0 [0067.478] lstrlenA (lpString="*.mpeg") returned 6 [0067.478] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.mpg") returned 0 [0067.478] lstrlenA (lpString="*.mpg") returned 5 [0067.478] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.flv") returned 0 [0067.478] lstrlenA (lpString="*.flv") returned 5 [0067.478] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.avi") returned 0 [0067.478] lstrlenA (lpString="*.avi") returned 5 [0067.478] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.mp4") returned 0 [0067.478] lstrlenA (lpString="*.mp4") returned 5 [0067.478] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.wmv") returned 0 [0067.478] lstrlenA (lpString="*.wmv") returned 5 [0067.478] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.divx") returned 0 [0067.478] lstrlenA (lpString="*.divx") returned 6 [0067.478] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.mkv") returned 0 [0067.478] lstrlenA (lpString="*.mkv") returned 5 [0067.478] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.mp3") returned 0 [0067.478] lstrlenA (lpString="*.mp3") returned 5 [0067.479] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.wav") returned 0 [0067.479] lstrlenA (lpString="*.wav") returned 5 [0067.479] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.flac") returned 0 [0067.479] lstrlenA (lpString="*.flac") returned 6 [0067.479] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.ape") returned 0 [0067.479] lstrlenA (lpString="*.ape") returned 5 [0067.479] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.wma") returned 0 [0067.479] lstrlenA (lpString="*.wma") returned 5 [0067.479] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.ac3") returned 0 [0067.479] lstrlenA (lpString="*.ac3") returned 5 [0067.479] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html", pszSpec="*.mxf") returned 0 [0067.479] lstrlenA (lpString="*.mxf") returned 5 [0067.479] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xaedb, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0067.479] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.479] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="FRA", cAlternateFileName="")) returned 1 [0067.479] lstrcmpA (lpString1=".", lpString2="FRA") returned -1 [0067.479] lstrcmpA (lpString1="..", lpString2="FRA") returned -1 [0067.479] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0067.479] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="FRA" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA" [0067.479] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA") returned 57 [0067.479] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.480] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.480] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.481] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.481] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.481] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4d8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0067.481] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.481] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0067.481] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0067.481] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0067.481] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\*.*") returned="*.*" [0067.481] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\" [0067.481] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\") returned="" [0067.481] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\HOW TO DECRYPT FILES.txt" [0067.481] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\how to decrypt files.txt")) returned 0xffffffff [0067.481] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.482] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0067.482] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.483] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.483] CloseHandle (hObject=0x94) returned 1 [0067.483] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini" [0067.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.zip") returned 0 [0067.483] lstrlenA (lpString="*.zip") returned 5 [0067.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.rar") returned 0 [0067.483] lstrlenA (lpString="*.rar") returned 5 [0067.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.7z") returned 0 [0067.483] lstrlenA (lpString="*.7z") returned 4 [0067.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.tar") returned 0 [0067.484] lstrlenA (lpString="*.tar") returned 5 [0067.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.gzip") returned 0 [0067.484] lstrlenA (lpString="*.gzip") returned 6 [0067.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.jpg") returned 0 [0067.484] lstrlenA (lpString="*.jpg") returned 5 [0067.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.jpeg") returned 0 [0067.484] lstrlenA (lpString="*.jpeg") returned 6 [0067.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.psd") returned 0 [0067.484] lstrlenA (lpString="*.psd") returned 5 [0067.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.gif") returned 0 [0067.484] lstrlenA (lpString="*.gif") returned 5 [0067.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.doc") returned 0 [0067.484] lstrlenA (lpString="*.doc") returned 5 [0067.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.docx") returned 0 [0067.484] lstrlenA (lpString="*.docx") returned 6 [0067.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.xls") returned 0 [0067.484] lstrlenA (lpString="*.xls") returned 5 [0067.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.xlsx") returned 0 [0067.484] lstrlenA (lpString="*.xlsx") returned 6 [0067.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.ppt") returned 0 [0067.484] lstrlenA (lpString="*.ppt") returned 5 [0067.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.pptx") returned 0 [0067.484] lstrlenA (lpString="*.pptx") returned 6 [0067.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.pdf") returned 0 [0067.484] lstrlenA (lpString="*.pdf") returned 5 [0067.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.mov") returned 0 [0067.484] lstrlenA (lpString="*.mov") returned 5 [0067.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.m2v") returned 0 [0067.484] lstrlenA (lpString="*.m2v") returned 5 [0067.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.3gp") returned 0 [0067.484] lstrlenA (lpString="*.3gp") returned 5 [0067.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.mpeg") returned 0 [0067.485] lstrlenA (lpString="*.mpeg") returned 6 [0067.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.mpg") returned 0 [0067.485] lstrlenA (lpString="*.mpg") returned 5 [0067.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.flv") returned 0 [0067.485] lstrlenA (lpString="*.flv") returned 5 [0067.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.avi") returned 0 [0067.485] lstrlenA (lpString="*.avi") returned 5 [0067.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.mp4") returned 0 [0067.485] lstrlenA (lpString="*.mp4") returned 5 [0067.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.wmv") returned 0 [0067.485] lstrlenA (lpString="*.wmv") returned 5 [0067.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.divx") returned 0 [0067.485] lstrlenA (lpString="*.divx") returned 6 [0067.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.mkv") returned 0 [0067.485] lstrlenA (lpString="*.mkv") returned 5 [0067.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.mp3") returned 0 [0067.485] lstrlenA (lpString="*.mp3") returned 5 [0067.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.wav") returned 0 [0067.485] lstrlenA (lpString="*.wav") returned 5 [0067.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.flac") returned 0 [0067.485] lstrlenA (lpString="*.flac") returned 6 [0067.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.ape") returned 0 [0067.485] lstrlenA (lpString="*.ape") returned 5 [0067.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.wma") returned 0 [0067.485] lstrlenA (lpString="*.wma") returned 5 [0067.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.ac3") returned 0 [0067.485] lstrlenA (lpString="*.ac3") returned 5 [0067.485] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", pszSpec="*.mxf") returned 0 [0067.485] lstrlenA (lpString="*.mxf") returned 5 [0067.485] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe94c, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0067.485] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.485] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0067.486] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0067.486] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0067.486] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini") returned="eula.ini" [0067.486] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\" [0067.486] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\") returned="" [0067.486] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\HOW TO DECRYPT FILES.txt" [0067.486] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\how to decrypt files.txt")) returned 0x20 [0067.486] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html" [0067.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.zip") returned 0 [0067.486] lstrlenA (lpString="*.zip") returned 5 [0067.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.rar") returned 0 [0067.486] lstrlenA (lpString="*.rar") returned 5 [0067.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.7z") returned 0 [0067.486] lstrlenA (lpString="*.7z") returned 4 [0067.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.tar") returned 0 [0067.486] lstrlenA (lpString="*.tar") returned 5 [0067.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.gzip") returned 0 [0067.486] lstrlenA (lpString="*.gzip") returned 6 [0067.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.jpg") returned 0 [0067.486] lstrlenA (lpString="*.jpg") returned 5 [0067.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.jpeg") returned 0 [0067.486] lstrlenA (lpString="*.jpeg") returned 6 [0067.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.psd") returned 0 [0067.486] lstrlenA (lpString="*.psd") returned 5 [0067.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.gif") returned 0 [0067.486] lstrlenA (lpString="*.gif") returned 5 [0067.486] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.doc") returned 0 [0067.486] lstrlenA (lpString="*.doc") returned 5 [0067.487] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.docx") returned 0 [0067.487] lstrlenA (lpString="*.docx") returned 6 [0067.487] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.xls") returned 0 [0067.487] lstrlenA (lpString="*.xls") returned 5 [0067.487] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.xlsx") returned 0 [0067.487] lstrlenA (lpString="*.xlsx") returned 6 [0067.487] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.ppt") returned 0 [0067.487] lstrlenA (lpString="*.ppt") returned 5 [0067.487] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.pptx") returned 0 [0067.487] lstrlenA (lpString="*.pptx") returned 6 [0067.487] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.pdf") returned 0 [0067.487] lstrlenA (lpString="*.pdf") returned 5 [0067.487] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.mov") returned 0 [0067.487] lstrlenA (lpString="*.mov") returned 5 [0067.487] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.m2v") returned 0 [0067.487] lstrlenA (lpString="*.m2v") returned 5 [0067.487] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.3gp") returned 0 [0067.487] lstrlenA (lpString="*.3gp") returned 5 [0067.487] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.mpeg") returned 0 [0067.487] lstrlenA (lpString="*.mpeg") returned 6 [0067.487] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.mpg") returned 0 [0067.487] lstrlenA (lpString="*.mpg") returned 5 [0067.487] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.flv") returned 0 [0067.487] lstrlenA (lpString="*.flv") returned 5 [0067.487] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.avi") returned 0 [0067.487] lstrlenA (lpString="*.avi") returned 5 [0067.487] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.mp4") returned 0 [0067.487] lstrlenA (lpString="*.mp4") returned 5 [0067.488] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.wmv") returned 0 [0067.488] lstrlenA (lpString="*.wmv") returned 5 [0067.488] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.divx") returned 0 [0067.488] lstrlenA (lpString="*.divx") returned 6 [0067.488] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.mkv") returned 0 [0067.488] lstrlenA (lpString="*.mkv") returned 5 [0067.488] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.mp3") returned 0 [0067.488] lstrlenA (lpString="*.mp3") returned 5 [0067.488] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.wav") returned 0 [0067.488] lstrlenA (lpString="*.wav") returned 5 [0067.488] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.flac") returned 0 [0067.488] lstrlenA (lpString="*.flac") returned 6 [0067.488] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.ape") returned 0 [0067.488] lstrlenA (lpString="*.ape") returned 5 [0067.488] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.wma") returned 0 [0067.488] lstrlenA (lpString="*.wma") returned 5 [0067.488] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.ac3") returned 0 [0067.488] lstrlenA (lpString="*.ac3") returned 5 [0067.488] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", pszSpec="*.mxf") returned 0 [0067.488] lstrlenA (lpString="*.mxf") returned 5 [0067.488] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe94c, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0067.488] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.488] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ce9900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="HRV", cAlternateFileName="")) returned 1 [0067.488] lstrcmpA (lpString1=".", lpString2="HRV") returned -1 [0067.489] lstrcmpA (lpString1="..", lpString2="HRV") returned -1 [0067.489] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0067.489] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="HRV" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV" [0067.489] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV") returned 57 [0067.489] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ce9900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.491] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.491] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ce9900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.491] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.491] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.491] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0067.491] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.491] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0067.491] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0067.491] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0067.491] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\*.*") returned="*.*" [0067.491] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\" [0067.491] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\") returned="" [0067.491] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\HOW TO DECRYPT FILES.txt" [0067.492] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\how to decrypt files.txt")) returned 0xffffffff [0067.492] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.492] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0067.492] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.494] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.494] CloseHandle (hObject=0x94) returned 1 [0067.494] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini" [0067.494] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.zip") returned 0 [0067.494] lstrlenA (lpString="*.zip") returned 5 [0067.494] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.rar") returned 0 [0067.494] lstrlenA (lpString="*.rar") returned 5 [0067.494] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.7z") returned 0 [0067.494] lstrlenA (lpString="*.7z") returned 4 [0067.494] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.tar") returned 0 [0067.494] lstrlenA (lpString="*.tar") returned 5 [0067.494] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.gzip") returned 0 [0067.494] lstrlenA (lpString="*.gzip") returned 6 [0067.494] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.jpg") returned 0 [0067.494] lstrlenA (lpString="*.jpg") returned 5 [0067.494] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.jpeg") returned 0 [0067.494] lstrlenA (lpString="*.jpeg") returned 6 [0067.494] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.psd") returned 0 [0067.494] lstrlenA (lpString="*.psd") returned 5 [0067.494] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.gif") returned 0 [0067.494] lstrlenA (lpString="*.gif") returned 5 [0067.494] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.doc") returned 0 [0067.494] lstrlenA (lpString="*.doc") returned 5 [0067.494] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.docx") returned 0 [0067.494] lstrlenA (lpString="*.docx") returned 6 [0067.494] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.xls") returned 0 [0067.494] lstrlenA (lpString="*.xls") returned 5 [0067.495] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.xlsx") returned 0 [0067.495] lstrlenA (lpString="*.xlsx") returned 6 [0067.495] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.ppt") returned 0 [0067.495] lstrlenA (lpString="*.ppt") returned 5 [0067.495] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.pptx") returned 0 [0067.495] lstrlenA (lpString="*.pptx") returned 6 [0067.495] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.pdf") returned 0 [0067.495] lstrlenA (lpString="*.pdf") returned 5 [0067.495] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.mov") returned 0 [0067.495] lstrlenA (lpString="*.mov") returned 5 [0067.495] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.m2v") returned 0 [0067.495] lstrlenA (lpString="*.m2v") returned 5 [0067.495] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.3gp") returned 0 [0067.495] lstrlenA (lpString="*.3gp") returned 5 [0067.495] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.mpeg") returned 0 [0067.495] lstrlenA (lpString="*.mpeg") returned 6 [0067.495] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.mpg") returned 0 [0067.495] lstrlenA (lpString="*.mpg") returned 5 [0067.495] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.flv") returned 0 [0067.495] lstrlenA (lpString="*.flv") returned 5 [0067.495] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.avi") returned 0 [0067.495] lstrlenA (lpString="*.avi") returned 5 [0067.495] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.mp4") returned 0 [0067.495] lstrlenA (lpString="*.mp4") returned 5 [0067.495] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.wmv") returned 0 [0067.495] lstrlenA (lpString="*.wmv") returned 5 [0067.495] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.divx") returned 0 [0067.495] lstrlenA (lpString="*.divx") returned 6 [0067.495] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.mkv") returned 0 [0067.495] lstrlenA (lpString="*.mkv") returned 5 [0067.495] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.mp3") returned 0 [0067.495] lstrlenA (lpString="*.mp3") returned 5 [0067.495] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.wav") returned 0 [0067.496] lstrlenA (lpString="*.wav") returned 5 [0067.496] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.flac") returned 0 [0067.496] lstrlenA (lpString="*.flac") returned 6 [0067.496] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.ape") returned 0 [0067.496] lstrlenA (lpString="*.ape") returned 5 [0067.496] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.wma") returned 0 [0067.496] lstrlenA (lpString="*.wma") returned 5 [0067.496] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.ac3") returned 0 [0067.496] lstrlenA (lpString="*.ac3") returned 5 [0067.496] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", pszSpec="*.mxf") returned 0 [0067.496] lstrlenA (lpString="*.mxf") returned 5 [0067.496] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc490, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0067.496] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.496] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0067.496] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0067.496] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0067.496] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini") returned="eula.ini" [0067.496] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\" [0067.496] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\") returned="" [0067.496] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\HOW TO DECRYPT FILES.txt" [0067.496] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\how to decrypt files.txt")) returned 0x20 [0067.496] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html" [0067.496] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.zip") returned 0 [0067.496] lstrlenA (lpString="*.zip") returned 5 [0067.496] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.rar") returned 0 [0067.496] lstrlenA (lpString="*.rar") returned 5 [0067.496] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.7z") returned 0 [0067.497] lstrlenA (lpString="*.7z") returned 4 [0067.497] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.tar") returned 0 [0067.497] lstrlenA (lpString="*.tar") returned 5 [0067.497] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.gzip") returned 0 [0067.497] lstrlenA (lpString="*.gzip") returned 6 [0067.497] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.jpg") returned 0 [0067.497] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.jpeg") returned 0 [0067.497] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.psd") returned 0 [0067.497] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.gif") returned 0 [0067.497] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.doc") returned 0 [0067.497] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.docx") returned 0 [0067.497] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.xls") returned 0 [0067.497] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.xlsx") returned 0 [0067.497] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.ppt") returned 0 [0067.497] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.pptx") returned 0 [0067.497] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.pdf") returned 0 [0067.497] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.mov") returned 0 [0067.497] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.m2v") returned 0 [0067.497] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.3gp") returned 0 [0067.497] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.mpeg") returned 0 [0067.498] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.mpg") returned 0 [0067.498] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.flv") returned 0 [0067.498] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.avi") returned 0 [0067.498] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.mp4") returned 0 [0067.498] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.wmv") returned 0 [0067.498] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.divx") returned 0 [0067.498] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.mkv") returned 0 [0067.498] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.mp3") returned 0 [0067.498] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.wav") returned 0 [0067.498] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.flac") returned 0 [0067.498] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.ape") returned 0 [0067.498] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.wma") returned 0 [0067.498] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.ac3") returned 0 [0067.498] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", pszSpec="*.mxf") returned 0 [0067.498] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc490, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0067.498] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.498] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81cc37a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="HUN", cAlternateFileName="")) returned 1 [0067.498] lstrcmpA (lpString1=".", lpString2="HUN") returned -1 [0067.498] lstrcmpA (lpString1="..", lpString2="HUN") returned -1 [0067.498] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0067.499] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="HUN" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN" [0067.499] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81cc37a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.499] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.499] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81cc37a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.499] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.499] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.499] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81c9d640, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a4, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0067.499] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.499] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0067.499] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0067.499] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0067.499] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\*.*") returned="*.*" [0067.499] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\" [0067.499] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\") returned="" [0067.499] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\HOW TO DECRYPT FILES.txt" [0067.499] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\how to decrypt files.txt")) returned 0xffffffff [0067.500] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.500] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.501] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.501] CloseHandle (hObject=0x94) returned 1 [0067.501] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini" [0067.501] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.zip") returned 0 [0067.501] lstrlenA (lpString="*.zip") returned 5 [0067.501] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.rar") returned 0 [0067.501] lstrlenA (lpString="*.rar") returned 5 [0067.501] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.7z") returned 0 [0067.501] lstrlenA (lpString="*.7z") returned 4 [0067.501] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.tar") returned 0 [0067.502] lstrlenA (lpString="*.tar") returned 5 [0067.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.gzip") returned 0 [0067.502] lstrlenA (lpString="*.gzip") returned 6 [0067.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.jpg") returned 0 [0067.502] lstrlenA (lpString="*.jpg") returned 5 [0067.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.jpeg") returned 0 [0067.502] lstrlenA (lpString="*.jpeg") returned 6 [0067.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.psd") returned 0 [0067.502] lstrlenA (lpString="*.psd") returned 5 [0067.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.gif") returned 0 [0067.502] lstrlenA (lpString="*.gif") returned 5 [0067.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.doc") returned 0 [0067.502] lstrlenA (lpString="*.doc") returned 5 [0067.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.docx") returned 0 [0067.502] lstrlenA (lpString="*.docx") returned 6 [0067.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.xls") returned 0 [0067.502] lstrlenA (lpString="*.xls") returned 5 [0067.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.xlsx") returned 0 [0067.502] lstrlenA (lpString="*.xlsx") returned 6 [0067.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.ppt") returned 0 [0067.502] lstrlenA (lpString="*.ppt") returned 5 [0067.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.pptx") returned 0 [0067.502] lstrlenA (lpString="*.pptx") returned 6 [0067.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.pdf") returned 0 [0067.502] lstrlenA (lpString="*.pdf") returned 5 [0067.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.mov") returned 0 [0067.502] lstrlenA (lpString="*.mov") returned 5 [0067.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.m2v") returned 0 [0067.502] lstrlenA (lpString="*.m2v") returned 5 [0067.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.3gp") returned 0 [0067.502] lstrlenA (lpString="*.3gp") returned 5 [0067.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.mpeg") returned 0 [0067.502] lstrlenA (lpString="*.mpeg") returned 6 [0067.502] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.mpg") returned 0 [0067.502] lstrlenA (lpString="*.mpg") returned 5 [0067.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.flv") returned 0 [0067.503] lstrlenA (lpString="*.flv") returned 5 [0067.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.avi") returned 0 [0067.503] lstrlenA (lpString="*.avi") returned 5 [0067.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.mp4") returned 0 [0067.503] lstrlenA (lpString="*.mp4") returned 5 [0067.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.wmv") returned 0 [0067.503] lstrlenA (lpString="*.wmv") returned 5 [0067.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.divx") returned 0 [0067.503] lstrlenA (lpString="*.divx") returned 6 [0067.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.mkv") returned 0 [0067.503] lstrlenA (lpString="*.mkv") returned 5 [0067.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.mp3") returned 0 [0067.503] lstrlenA (lpString="*.mp3") returned 5 [0067.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.wav") returned 0 [0067.503] lstrlenA (lpString="*.wav") returned 5 [0067.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.flac") returned 0 [0067.503] lstrlenA (lpString="*.flac") returned 6 [0067.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.ape") returned 0 [0067.503] lstrlenA (lpString="*.ape") returned 5 [0067.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.wma") returned 0 [0067.503] lstrlenA (lpString="*.wma") returned 5 [0067.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.ac3") returned 0 [0067.503] lstrlenA (lpString="*.ac3") returned 5 [0067.503] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini", pszSpec="*.mxf") returned 0 [0067.503] lstrlenA (lpString="*.mxf") returned 5 [0067.503] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11ef3, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0067.503] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.503] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0067.503] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0067.503] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0067.503] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini") returned="eula.ini" [0067.503] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\" [0067.504] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\") returned="" [0067.504] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\HOW TO DECRYPT FILES.txt" [0067.504] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\how to decrypt files.txt")) returned 0x20 [0067.504] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html" [0067.504] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.zip") returned 0 [0067.504] lstrlenA (lpString="*.zip") returned 5 [0067.504] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.rar") returned 0 [0067.504] lstrlenA (lpString="*.rar") returned 5 [0067.504] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.7z") returned 0 [0067.504] lstrlenA (lpString="*.7z") returned 4 [0067.504] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.tar") returned 0 [0067.504] lstrlenA (lpString="*.tar") returned 5 [0067.504] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.gzip") returned 0 [0067.504] lstrlenA (lpString="*.gzip") returned 6 [0067.504] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.jpg") returned 0 [0067.504] lstrlenA (lpString="*.jpg") returned 5 [0067.504] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.jpeg") returned 0 [0067.504] lstrlenA (lpString="*.jpeg") returned 6 [0067.504] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.psd") returned 0 [0067.504] lstrlenA (lpString="*.psd") returned 5 [0067.504] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.gif") returned 0 [0067.504] lstrlenA (lpString="*.gif") returned 5 [0067.504] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.doc") returned 0 [0067.504] lstrlenA (lpString="*.doc") returned 5 [0067.504] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.docx") returned 0 [0067.504] lstrlenA (lpString="*.docx") returned 6 [0067.504] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.xls") returned 0 [0067.504] lstrlenA (lpString="*.xls") returned 5 [0067.504] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.xlsx") returned 0 [0067.505] lstrlenA (lpString="*.xlsx") returned 6 [0067.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.ppt") returned 0 [0067.505] lstrlenA (lpString="*.ppt") returned 5 [0067.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.pptx") returned 0 [0067.505] lstrlenA (lpString="*.pptx") returned 6 [0067.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.pdf") returned 0 [0067.505] lstrlenA (lpString="*.pdf") returned 5 [0067.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.mov") returned 0 [0067.505] lstrlenA (lpString="*.mov") returned 5 [0067.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.m2v") returned 0 [0067.505] lstrlenA (lpString="*.m2v") returned 5 [0067.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.3gp") returned 0 [0067.505] lstrlenA (lpString="*.3gp") returned 5 [0067.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.mpeg") returned 0 [0067.505] lstrlenA (lpString="*.mpeg") returned 6 [0067.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.mpg") returned 0 [0067.505] lstrlenA (lpString="*.mpg") returned 5 [0067.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.flv") returned 0 [0067.505] lstrlenA (lpString="*.flv") returned 5 [0067.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.avi") returned 0 [0067.505] lstrlenA (lpString="*.avi") returned 5 [0067.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.mp4") returned 0 [0067.505] lstrlenA (lpString="*.mp4") returned 5 [0067.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.wmv") returned 0 [0067.505] lstrlenA (lpString="*.wmv") returned 5 [0067.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.divx") returned 0 [0067.505] lstrlenA (lpString="*.divx") returned 6 [0067.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.mkv") returned 0 [0067.505] lstrlenA (lpString="*.mkv") returned 5 [0067.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.mp3") returned 0 [0067.505] lstrlenA (lpString="*.mp3") returned 5 [0067.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.wav") returned 0 [0067.505] lstrlenA (lpString="*.wav") returned 5 [0067.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.flac") returned 0 [0067.506] lstrlenA (lpString="*.flac") returned 6 [0067.506] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.ape") returned 0 [0067.506] lstrlenA (lpString="*.ape") returned 5 [0067.506] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.wma") returned 0 [0067.506] lstrlenA (lpString="*.wma") returned 5 [0067.506] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.ac3") returned 0 [0067.506] lstrlenA (lpString="*.ac3") returned 5 [0067.506] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html", pszSpec="*.mxf") returned 0 [0067.506] lstrlenA (lpString="*.mxf") returned 5 [0067.506] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11ef3, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0067.506] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.506] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ITA", cAlternateFileName="")) returned 1 [0067.506] lstrcmpA (lpString1=".", lpString2="ITA") returned -1 [0067.506] lstrcmpA (lpString1="..", lpString2="ITA") returned -1 [0067.506] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0067.506] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="ITA" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA" [0067.506] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA") returned 57 [0067.506] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.509] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.509] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.509] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.509] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.509] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0067.509] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.509] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0067.509] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0067.509] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0067.509] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\*.*") returned="*.*" [0067.509] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\" [0067.509] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\") returned="" [0067.509] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\HOW TO DECRYPT FILES.txt" [0067.509] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\how to decrypt files.txt")) returned 0xffffffff [0067.509] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.510] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0067.510] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.511] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.511] CloseHandle (hObject=0x94) returned 1 [0067.511] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini" [0067.511] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.zip") returned 0 [0067.512] lstrlenA (lpString="*.zip") returned 5 [0067.512] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.rar") returned 0 [0067.512] lstrlenA (lpString="*.rar") returned 5 [0067.512] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.7z") returned 0 [0067.512] lstrlenA (lpString="*.7z") returned 4 [0067.512] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.tar") returned 0 [0067.512] lstrlenA (lpString="*.tar") returned 5 [0067.512] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.gzip") returned 0 [0067.512] lstrlenA (lpString="*.gzip") returned 6 [0067.512] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.jpg") returned 0 [0067.512] lstrlenA (lpString="*.jpg") returned 5 [0067.512] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.jpeg") returned 0 [0067.512] lstrlenA (lpString="*.jpeg") returned 6 [0067.512] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.psd") returned 0 [0067.512] lstrlenA (lpString="*.psd") returned 5 [0067.512] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.gif") returned 0 [0067.512] lstrlenA (lpString="*.gif") returned 5 [0067.512] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.doc") returned 0 [0067.513] lstrlenA (lpString="*.doc") returned 5 [0067.513] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.docx") returned 0 [0067.513] lstrlenA (lpString="*.docx") returned 6 [0067.513] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.xls") returned 0 [0067.513] lstrlenA (lpString="*.xls") returned 5 [0067.513] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.xlsx") returned 0 [0067.513] lstrlenA (lpString="*.xlsx") returned 6 [0067.513] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.ppt") returned 0 [0067.513] lstrlenA (lpString="*.ppt") returned 5 [0067.513] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.pptx") returned 0 [0067.513] lstrlenA (lpString="*.pptx") returned 6 [0067.513] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.pdf") returned 0 [0067.513] lstrlenA (lpString="*.pdf") returned 5 [0067.513] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.mov") returned 0 [0067.513] lstrlenA (lpString="*.mov") returned 5 [0067.513] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.m2v") returned 0 [0067.513] lstrlenA (lpString="*.m2v") returned 5 [0067.513] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.3gp") returned 0 [0067.513] lstrlenA (lpString="*.3gp") returned 5 [0067.513] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.mpeg") returned 0 [0067.513] lstrlenA (lpString="*.mpeg") returned 6 [0067.513] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.mpg") returned 0 [0067.513] lstrlenA (lpString="*.mpg") returned 5 [0067.513] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.flv") returned 0 [0067.513] lstrlenA (lpString="*.flv") returned 5 [0067.513] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.avi") returned 0 [0067.513] lstrlenA (lpString="*.avi") returned 5 [0067.513] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.mp4") returned 0 [0067.513] lstrlenA (lpString="*.mp4") returned 5 [0067.513] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.wmv") returned 0 [0067.513] lstrlenA (lpString="*.wmv") returned 5 [0067.513] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.divx") returned 0 [0067.514] lstrlenA (lpString="*.divx") returned 6 [0067.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.mkv") returned 0 [0067.514] lstrlenA (lpString="*.mkv") returned 5 [0067.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.mp3") returned 0 [0067.514] lstrlenA (lpString="*.mp3") returned 5 [0067.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.wav") returned 0 [0067.514] lstrlenA (lpString="*.wav") returned 5 [0067.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.flac") returned 0 [0067.514] lstrlenA (lpString="*.flac") returned 6 [0067.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.ape") returned 0 [0067.514] lstrlenA (lpString="*.ape") returned 5 [0067.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.wma") returned 0 [0067.514] lstrlenA (lpString="*.wma") returned 5 [0067.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.ac3") returned 0 [0067.514] lstrlenA (lpString="*.ac3") returned 5 [0067.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini", pszSpec="*.mxf") returned 0 [0067.514] lstrlenA (lpString="*.mxf") returned 5 [0067.514] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc60d, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0067.514] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.514] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0067.514] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0067.514] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0067.514] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini") returned="eula.ini" [0067.514] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\" [0067.514] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\") returned="" [0067.514] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\HOW TO DECRYPT FILES.txt" [0067.514] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\how to decrypt files.txt")) returned 0x20 [0067.515] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html" [0067.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.zip") returned 0 [0067.515] lstrlenA (lpString="*.zip") returned 5 [0067.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.rar") returned 0 [0067.515] lstrlenA (lpString="*.rar") returned 5 [0067.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.7z") returned 0 [0067.515] lstrlenA (lpString="*.7z") returned 4 [0067.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.tar") returned 0 [0067.515] lstrlenA (lpString="*.tar") returned 5 [0067.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.gzip") returned 0 [0067.515] lstrlenA (lpString="*.gzip") returned 6 [0067.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.jpg") returned 0 [0067.515] lstrlenA (lpString="*.jpg") returned 5 [0067.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.jpeg") returned 0 [0067.515] lstrlenA (lpString="*.jpeg") returned 6 [0067.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.psd") returned 0 [0067.515] lstrlenA (lpString="*.psd") returned 5 [0067.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.gif") returned 0 [0067.515] lstrlenA (lpString="*.gif") returned 5 [0067.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.doc") returned 0 [0067.515] lstrlenA (lpString="*.doc") returned 5 [0067.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.docx") returned 0 [0067.515] lstrlenA (lpString="*.docx") returned 6 [0067.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.xls") returned 0 [0067.515] lstrlenA (lpString="*.xls") returned 5 [0067.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.xlsx") returned 0 [0067.515] lstrlenA (lpString="*.xlsx") returned 6 [0067.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.ppt") returned 0 [0067.515] lstrlenA (lpString="*.ppt") returned 5 [0067.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.pptx") returned 0 [0067.515] lstrlenA (lpString="*.pptx") returned 6 [0067.516] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.pdf") returned 0 [0067.516] lstrlenA (lpString="*.pdf") returned 5 [0067.516] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.mov") returned 0 [0067.516] lstrlenA (lpString="*.mov") returned 5 [0067.516] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.m2v") returned 0 [0067.516] lstrlenA (lpString="*.m2v") returned 5 [0067.516] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.3gp") returned 0 [0067.516] lstrlenA (lpString="*.3gp") returned 5 [0067.516] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.mpeg") returned 0 [0067.516] lstrlenA (lpString="*.mpeg") returned 6 [0067.516] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.mpg") returned 0 [0067.516] lstrlenA (lpString="*.mpg") returned 5 [0067.516] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.flv") returned 0 [0067.516] lstrlenA (lpString="*.flv") returned 5 [0067.516] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.avi") returned 0 [0067.516] lstrlenA (lpString="*.avi") returned 5 [0067.516] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.mp4") returned 0 [0067.516] lstrlenA (lpString="*.mp4") returned 5 [0067.516] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.wmv") returned 0 [0067.516] lstrlenA (lpString="*.wmv") returned 5 [0067.516] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.divx") returned 0 [0067.516] lstrlenA (lpString="*.divx") returned 6 [0067.516] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.mkv") returned 0 [0067.516] lstrlenA (lpString="*.mkv") returned 5 [0067.516] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.mp3") returned 0 [0067.516] lstrlenA (lpString="*.mp3") returned 5 [0067.516] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.wav") returned 0 [0067.516] lstrlenA (lpString="*.wav") returned 5 [0067.516] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.flac") returned 0 [0067.516] lstrlenA (lpString="*.flac") returned 6 [0067.516] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.ape") returned 0 [0067.516] lstrlenA (lpString="*.ape") returned 5 [0067.517] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.wma") returned 0 [0067.517] lstrlenA (lpString="*.wma") returned 5 [0067.517] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.ac3") returned 0 [0067.517] lstrlenA (lpString="*.ac3") returned 5 [0067.517] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html", pszSpec="*.mxf") returned 0 [0067.517] lstrlenA (lpString="*.mxf") returned 5 [0067.517] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc60d, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0067.517] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.517] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="JPN", cAlternateFileName="")) returned 1 [0067.517] lstrcmpA (lpString1=".", lpString2="JPN") returned -1 [0067.517] lstrcmpA (lpString1="..", lpString2="JPN") returned -1 [0067.517] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0067.517] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="JPN" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN" [0067.517] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN") returned 57 [0067.517] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.578] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.578] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.579] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.579] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.579] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x298, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0067.579] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.579] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0067.579] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0067.579] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0067.579] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\*.*") returned="*.*" [0067.579] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\" [0067.579] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\") returned="" [0067.579] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\HOW TO DECRYPT FILES.txt" [0067.579] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\jpn\\how to decrypt files.txt")) returned 0xffffffff [0067.579] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\jpn\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.580] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0067.580] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.582] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.582] CloseHandle (hObject=0x94) returned 1 [0067.582] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini" [0067.582] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.zip") returned 0 [0067.582] lstrlenA (lpString="*.zip") returned 5 [0067.582] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.rar") returned 0 [0067.582] lstrlenA (lpString="*.rar") returned 5 [0067.582] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.7z") returned 0 [0067.582] lstrlenA (lpString="*.7z") returned 4 [0067.582] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.tar") returned 0 [0067.582] lstrlenA (lpString="*.tar") returned 5 [0067.582] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.gzip") returned 0 [0067.582] lstrlenA (lpString="*.gzip") returned 6 [0067.582] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.jpg") returned 0 [0067.582] lstrlenA (lpString="*.jpg") returned 5 [0067.582] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.jpeg") returned 0 [0067.583] lstrlenA (lpString="*.jpeg") returned 6 [0067.583] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.psd") returned 0 [0067.583] lstrlenA (lpString="*.psd") returned 5 [0067.583] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.gif") returned 0 [0067.583] lstrlenA (lpString="*.gif") returned 5 [0067.583] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.doc") returned 0 [0067.583] lstrlenA (lpString="*.doc") returned 5 [0067.583] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.docx") returned 0 [0067.583] lstrlenA (lpString="*.docx") returned 6 [0067.583] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.xls") returned 0 [0067.583] lstrlenA (lpString="*.xls") returned 5 [0067.583] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.xlsx") returned 0 [0067.583] lstrlenA (lpString="*.xlsx") returned 6 [0067.583] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.ppt") returned 0 [0067.583] lstrlenA (lpString="*.ppt") returned 5 [0067.583] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.pptx") returned 0 [0067.583] lstrlenA (lpString="*.pptx") returned 6 [0067.583] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.pdf") returned 0 [0067.583] lstrlenA (lpString="*.pdf") returned 5 [0067.583] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.mov") returned 0 [0067.583] lstrlenA (lpString="*.mov") returned 5 [0067.583] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.m2v") returned 0 [0067.583] lstrlenA (lpString="*.m2v") returned 5 [0067.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.3gp") returned 0 [0067.584] lstrlenA (lpString="*.3gp") returned 5 [0067.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.mpeg") returned 0 [0067.584] lstrlenA (lpString="*.mpeg") returned 6 [0067.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.mpg") returned 0 [0067.584] lstrlenA (lpString="*.mpg") returned 5 [0067.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.flv") returned 0 [0067.584] lstrlenA (lpString="*.flv") returned 5 [0067.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.avi") returned 0 [0067.584] lstrlenA (lpString="*.avi") returned 5 [0067.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.mp4") returned 0 [0067.584] lstrlenA (lpString="*.mp4") returned 5 [0067.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.wmv") returned 0 [0067.584] lstrlenA (lpString="*.wmv") returned 5 [0067.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.divx") returned 0 [0067.584] lstrlenA (lpString="*.divx") returned 6 [0067.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.mkv") returned 0 [0067.584] lstrlenA (lpString="*.mkv") returned 5 [0067.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.mp3") returned 0 [0067.584] lstrlenA (lpString="*.mp3") returned 5 [0067.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.wav") returned 0 [0067.584] lstrlenA (lpString="*.wav") returned 5 [0067.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.flac") returned 0 [0067.584] lstrlenA (lpString="*.flac") returned 6 [0067.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.ape") returned 0 [0067.585] lstrlenA (lpString="*.ape") returned 5 [0067.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.wma") returned 0 [0067.585] lstrlenA (lpString="*.wma") returned 5 [0067.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.ac3") returned 0 [0067.585] lstrlenA (lpString="*.ac3") returned 5 [0067.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini", pszSpec="*.mxf") returned 0 [0067.585] lstrlenA (lpString="*.mxf") returned 5 [0067.585] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1dc34, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0067.585] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.585] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0067.585] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0067.585] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0067.585] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini") returned="eula.ini" [0067.585] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\" [0067.585] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\") returned="" [0067.585] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\HOW TO DECRYPT FILES.txt" [0067.585] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\jpn\\how to decrypt files.txt")) returned 0x20 [0067.585] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html" [0067.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.zip") returned 0 [0067.585] lstrlenA (lpString="*.zip") returned 5 [0067.586] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.rar") returned 0 [0067.586] lstrlenA (lpString="*.rar") returned 5 [0067.586] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.7z") returned 0 [0067.586] lstrlenA (lpString="*.7z") returned 4 [0067.586] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.tar") returned 0 [0067.586] lstrlenA (lpString="*.tar") returned 5 [0067.586] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.gzip") returned 0 [0067.586] lstrlenA (lpString="*.gzip") returned 6 [0067.586] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.jpg") returned 0 [0067.586] lstrlenA (lpString="*.jpg") returned 5 [0067.586] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.jpeg") returned 0 [0067.586] lstrlenA (lpString="*.jpeg") returned 6 [0067.586] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.psd") returned 0 [0067.586] lstrlenA (lpString="*.psd") returned 5 [0067.586] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.gif") returned 0 [0067.586] lstrlenA (lpString="*.gif") returned 5 [0067.586] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.doc") returned 0 [0067.586] lstrlenA (lpString="*.doc") returned 5 [0067.586] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.docx") returned 0 [0067.586] lstrlenA (lpString="*.docx") returned 6 [0067.586] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.xls") returned 0 [0067.586] lstrlenA (lpString="*.xls") returned 5 [0067.586] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.xlsx") returned 0 [0067.586] lstrlenA (lpString="*.xlsx") returned 6 [0067.587] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.ppt") returned 0 [0067.587] lstrlenA (lpString="*.ppt") returned 5 [0067.587] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.pptx") returned 0 [0067.587] lstrlenA (lpString="*.pptx") returned 6 [0067.587] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.pdf") returned 0 [0067.587] lstrlenA (lpString="*.pdf") returned 5 [0067.587] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.mov") returned 0 [0067.587] lstrlenA (lpString="*.mov") returned 5 [0067.587] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.m2v") returned 0 [0067.587] lstrlenA (lpString="*.m2v") returned 5 [0067.587] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.3gp") returned 0 [0067.587] lstrlenA (lpString="*.3gp") returned 5 [0067.587] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.mpeg") returned 0 [0067.587] lstrlenA (lpString="*.mpeg") returned 6 [0067.587] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.mpg") returned 0 [0067.587] lstrlenA (lpString="*.mpg") returned 5 [0067.587] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.flv") returned 0 [0067.587] lstrlenA (lpString="*.flv") returned 5 [0067.587] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.avi") returned 0 [0067.587] lstrlenA (lpString="*.avi") returned 5 [0067.587] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.mp4") returned 0 [0067.587] lstrlenA (lpString="*.mp4") returned 5 [0067.587] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.wmv") returned 0 [0067.587] lstrlenA (lpString="*.wmv") returned 5 [0067.587] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.divx") returned 0 [0067.587] lstrlenA (lpString="*.divx") returned 6 [0067.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.mkv") returned 0 [0067.588] lstrlenA (lpString="*.mkv") returned 5 [0067.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.mp3") returned 0 [0067.588] lstrlenA (lpString="*.mp3") returned 5 [0067.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.wav") returned 0 [0067.588] lstrlenA (lpString="*.wav") returned 5 [0067.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.flac") returned 0 [0067.588] lstrlenA (lpString="*.flac") returned 6 [0067.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.ape") returned 0 [0067.588] lstrlenA (lpString="*.ape") returned 5 [0067.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.wma") returned 0 [0067.588] lstrlenA (lpString="*.wma") returned 5 [0067.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.ac3") returned 0 [0067.588] lstrlenA (lpString="*.ac3") returned 5 [0067.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html", pszSpec="*.mxf") returned 0 [0067.588] lstrlenA (lpString="*.mxf") returned 5 [0067.588] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1dc34, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0067.588] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.588] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="KOR", cAlternateFileName="")) returned 1 [0067.588] lstrcmpA (lpString1=".", lpString2="KOR") returned -1 [0067.588] lstrcmpA (lpString1="..", lpString2="KOR") returned -1 [0067.588] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0067.589] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="KOR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR" [0067.589] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR") returned 57 [0067.589] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.592] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.592] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.592] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.592] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.592] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0067.593] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.593] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0067.593] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0067.593] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0067.593] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\*.*") returned="*.*" [0067.593] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\" [0067.593] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\") returned="" [0067.593] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\HOW TO DECRYPT FILES.txt" [0067.593] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\how to decrypt files.txt")) returned 0xffffffff [0067.593] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.597] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0067.598] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.599] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.599] CloseHandle (hObject=0x94) returned 1 [0067.599] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini" [0067.599] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.zip") returned 0 [0067.599] lstrlenA (lpString="*.zip") returned 5 [0067.599] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.rar") returned 0 [0067.600] lstrlenA (lpString="*.rar") returned 5 [0067.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.7z") returned 0 [0067.600] lstrlenA (lpString="*.7z") returned 4 [0067.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.tar") returned 0 [0067.600] lstrlenA (lpString="*.tar") returned 5 [0067.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.gzip") returned 0 [0067.600] lstrlenA (lpString="*.gzip") returned 6 [0067.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.jpg") returned 0 [0067.600] lstrlenA (lpString="*.jpg") returned 5 [0067.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.jpeg") returned 0 [0067.600] lstrlenA (lpString="*.jpeg") returned 6 [0067.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.psd") returned 0 [0067.600] lstrlenA (lpString="*.psd") returned 5 [0067.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.gif") returned 0 [0067.600] lstrlenA (lpString="*.gif") returned 5 [0067.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.doc") returned 0 [0067.600] lstrlenA (lpString="*.doc") returned 5 [0067.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.docx") returned 0 [0067.600] lstrlenA (lpString="*.docx") returned 6 [0067.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.xls") returned 0 [0067.600] lstrlenA (lpString="*.xls") returned 5 [0067.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.xlsx") returned 0 [0067.600] lstrlenA (lpString="*.xlsx") returned 6 [0067.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.ppt") returned 0 [0067.601] lstrlenA (lpString="*.ppt") returned 5 [0067.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.pptx") returned 0 [0067.601] lstrlenA (lpString="*.pptx") returned 6 [0067.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.pdf") returned 0 [0067.601] lstrlenA (lpString="*.pdf") returned 5 [0067.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.mov") returned 0 [0067.601] lstrlenA (lpString="*.mov") returned 5 [0067.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.m2v") returned 0 [0067.601] lstrlenA (lpString="*.m2v") returned 5 [0067.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.3gp") returned 0 [0067.601] lstrlenA (lpString="*.3gp") returned 5 [0067.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.mpeg") returned 0 [0067.601] lstrlenA (lpString="*.mpeg") returned 6 [0067.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.mpg") returned 0 [0067.601] lstrlenA (lpString="*.mpg") returned 5 [0067.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.flv") returned 0 [0067.601] lstrlenA (lpString="*.flv") returned 5 [0067.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.avi") returned 0 [0067.601] lstrlenA (lpString="*.avi") returned 5 [0067.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.mp4") returned 0 [0067.602] lstrlenA (lpString="*.mp4") returned 5 [0067.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.wmv") returned 0 [0067.602] lstrlenA (lpString="*.wmv") returned 5 [0067.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.divx") returned 0 [0067.602] lstrlenA (lpString="*.divx") returned 6 [0067.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.mkv") returned 0 [0067.602] lstrlenA (lpString="*.mkv") returned 5 [0067.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.mp3") returned 0 [0067.602] lstrlenA (lpString="*.mp3") returned 5 [0067.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.wav") returned 0 [0067.602] lstrlenA (lpString="*.wav") returned 5 [0067.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.flac") returned 0 [0067.602] lstrlenA (lpString="*.flac") returned 6 [0067.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.ape") returned 0 [0067.602] lstrlenA (lpString="*.ape") returned 5 [0067.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.wma") returned 0 [0067.602] lstrlenA (lpString="*.wma") returned 5 [0067.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.ac3") returned 0 [0067.602] lstrlenA (lpString="*.ac3") returned 5 [0067.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", pszSpec="*.mxf") returned 0 [0067.602] lstrlenA (lpString="*.mxf") returned 5 [0067.602] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18e95, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0067.602] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.603] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0067.603] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0067.603] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0067.603] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini") returned="eula.ini" [0067.603] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\" [0067.603] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\") returned="" [0067.603] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\HOW TO DECRYPT FILES.txt" [0067.603] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\how to decrypt files.txt")) returned 0x20 [0067.603] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html" [0067.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.zip") returned 0 [0067.603] lstrlenA (lpString="*.zip") returned 5 [0067.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.rar") returned 0 [0067.603] lstrlenA (lpString="*.rar") returned 5 [0067.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.7z") returned 0 [0067.603] lstrlenA (lpString="*.7z") returned 4 [0067.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.tar") returned 0 [0067.603] lstrlenA (lpString="*.tar") returned 5 [0067.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.gzip") returned 0 [0067.603] lstrlenA (lpString="*.gzip") returned 6 [0067.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.jpg") returned 0 [0067.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.jpeg") returned 0 [0067.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.psd") returned 0 [0067.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.gif") returned 0 [0067.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.doc") returned 0 [0067.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.docx") returned 0 [0067.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.xls") returned 0 [0067.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.xlsx") returned 0 [0067.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.ppt") returned 0 [0067.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.pptx") returned 0 [0067.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.pdf") returned 0 [0067.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.mov") returned 0 [0067.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.m2v") returned 0 [0067.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.3gp") returned 0 [0067.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.mpeg") returned 0 [0067.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.mpg") returned 0 [0067.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.flv") returned 0 [0067.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.avi") returned 0 [0067.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.mp4") returned 0 [0067.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.wmv") returned 0 [0067.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.divx") returned 0 [0067.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.mkv") returned 0 [0067.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.mp3") returned 0 [0067.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.wav") returned 0 [0067.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.flac") returned 0 [0067.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.ape") returned 0 [0067.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.wma") returned 0 [0067.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.ac3") returned 0 [0067.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", pszSpec="*.mxf") returned 0 [0067.605] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18e95, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0067.605] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.605] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="NLD", cAlternateFileName="")) returned 1 [0067.605] lstrcmpA (lpString1=".", lpString2="NLD") returned -1 [0067.606] lstrcmpA (lpString1="..", lpString2="NLD") returned -1 [0067.606] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0067.606] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="NLD" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD" [0067.606] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.634] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.634] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.634] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.634] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.634] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0067.635] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.635] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0067.635] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0067.635] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0067.635] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\*.*") returned="*.*" [0067.635] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\" [0067.635] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\") returned="" [0067.635] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\HOW TO DECRYPT FILES.txt" [0067.635] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nld\\how to decrypt files.txt")) returned 0xffffffff [0067.635] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nld\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.636] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.637] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.637] CloseHandle (hObject=0x94) returned 1 [0067.637] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini" [0067.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.zip") returned 0 [0067.637] lstrlenA (lpString="*.zip") returned 5 [0067.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.rar") returned 0 [0067.637] lstrlenA (lpString="*.rar") returned 5 [0067.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.7z") returned 0 [0067.637] lstrlenA (lpString="*.7z") returned 4 [0067.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.tar") returned 0 [0067.637] lstrlenA (lpString="*.tar") returned 5 [0067.638] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.gzip") returned 0 [0067.638] lstrlenA (lpString="*.gzip") returned 6 [0067.638] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.jpg") returned 0 [0067.638] lstrlenA (lpString="*.jpg") returned 5 [0067.638] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.jpeg") returned 0 [0067.638] lstrlenA (lpString="*.jpeg") returned 6 [0067.638] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.psd") returned 0 [0067.638] lstrlenA (lpString="*.psd") returned 5 [0067.638] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.gif") returned 0 [0067.638] lstrlenA (lpString="*.gif") returned 5 [0067.638] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.doc") returned 0 [0067.638] lstrlenA (lpString="*.doc") returned 5 [0067.638] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.docx") returned 0 [0067.638] lstrlenA (lpString="*.docx") returned 6 [0067.638] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.xls") returned 0 [0067.638] lstrlenA (lpString="*.xls") returned 5 [0067.638] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.xlsx") returned 0 [0067.638] lstrlenA (lpString="*.xlsx") returned 6 [0067.638] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.ppt") returned 0 [0067.638] lstrlenA (lpString="*.ppt") returned 5 [0067.638] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.pptx") returned 0 [0067.638] lstrlenA (lpString="*.pptx") returned 6 [0067.638] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.pdf") returned 0 [0067.638] lstrlenA (lpString="*.pdf") returned 5 [0067.638] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.mov") returned 0 [0067.638] lstrlenA (lpString="*.mov") returned 5 [0067.638] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.m2v") returned 0 [0067.638] lstrlenA (lpString="*.m2v") returned 5 [0067.638] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.3gp") returned 0 [0067.638] lstrlenA (lpString="*.3gp") returned 5 [0067.638] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.mpeg") returned 0 [0067.639] lstrlenA (lpString="*.mpeg") returned 6 [0067.639] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.mpg") returned 0 [0067.639] lstrlenA (lpString="*.mpg") returned 5 [0067.639] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.flv") returned 0 [0067.639] lstrlenA (lpString="*.flv") returned 5 [0067.639] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.avi") returned 0 [0067.639] lstrlenA (lpString="*.avi") returned 5 [0067.639] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.mp4") returned 0 [0067.639] lstrlenA (lpString="*.mp4") returned 5 [0067.639] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.wmv") returned 0 [0067.639] lstrlenA (lpString="*.wmv") returned 5 [0067.639] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.divx") returned 0 [0067.639] lstrlenA (lpString="*.divx") returned 6 [0067.639] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.mkv") returned 0 [0067.639] lstrlenA (lpString="*.mkv") returned 5 [0067.639] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.mp3") returned 0 [0067.639] lstrlenA (lpString="*.mp3") returned 5 [0067.639] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.wav") returned 0 [0067.639] lstrlenA (lpString="*.wav") returned 5 [0067.639] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.flac") returned 0 [0067.639] lstrlenA (lpString="*.flac") returned 6 [0067.639] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.ape") returned 0 [0067.639] lstrlenA (lpString="*.ape") returned 5 [0067.639] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.wma") returned 0 [0067.639] lstrlenA (lpString="*.wma") returned 5 [0067.639] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.ac3") returned 0 [0067.639] lstrlenA (lpString="*.ac3") returned 5 [0067.639] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini", pszSpec="*.mxf") returned 0 [0067.639] lstrlenA (lpString="*.mxf") returned 5 [0067.639] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc288, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0067.639] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.639] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0067.640] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0067.640] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0067.640] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini") returned="eula.ini" [0067.640] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\" [0067.640] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\") returned="" [0067.640] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\HOW TO DECRYPT FILES.txt" [0067.640] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nld\\how to decrypt files.txt")) returned 0x20 [0067.640] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html" [0067.640] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.zip") returned 0 [0067.640] lstrlenA (lpString="*.zip") returned 5 [0067.640] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.rar") returned 0 [0067.640] lstrlenA (lpString="*.rar") returned 5 [0067.640] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.7z") returned 0 [0067.640] lstrlenA (lpString="*.7z") returned 4 [0067.640] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.tar") returned 0 [0067.640] lstrlenA (lpString="*.tar") returned 5 [0067.640] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.gzip") returned 0 [0067.640] lstrlenA (lpString="*.gzip") returned 6 [0067.640] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.jpg") returned 0 [0067.640] lstrlenA (lpString="*.jpg") returned 5 [0067.640] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.jpeg") returned 0 [0067.640] lstrlenA (lpString="*.jpeg") returned 6 [0067.640] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.psd") returned 0 [0067.640] lstrlenA (lpString="*.psd") returned 5 [0067.640] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.gif") returned 0 [0067.640] lstrlenA (lpString="*.gif") returned 5 [0067.640] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.doc") returned 0 [0067.640] lstrlenA (lpString="*.doc") returned 5 [0067.640] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.docx") returned 0 [0067.640] lstrlenA (lpString="*.docx") returned 6 [0067.640] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.xls") returned 0 [0067.640] lstrlenA (lpString="*.xls") returned 5 [0067.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.xlsx") returned 0 [0067.641] lstrlenA (lpString="*.xlsx") returned 6 [0067.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.ppt") returned 0 [0067.641] lstrlenA (lpString="*.ppt") returned 5 [0067.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.pptx") returned 0 [0067.641] lstrlenA (lpString="*.pptx") returned 6 [0067.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.pdf") returned 0 [0067.641] lstrlenA (lpString="*.pdf") returned 5 [0067.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.mov") returned 0 [0067.641] lstrlenA (lpString="*.mov") returned 5 [0067.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.m2v") returned 0 [0067.641] lstrlenA (lpString="*.m2v") returned 5 [0067.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.3gp") returned 0 [0067.641] lstrlenA (lpString="*.3gp") returned 5 [0067.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.mpeg") returned 0 [0067.641] lstrlenA (lpString="*.mpeg") returned 6 [0067.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.mpg") returned 0 [0067.641] lstrlenA (lpString="*.mpg") returned 5 [0067.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.flv") returned 0 [0067.641] lstrlenA (lpString="*.flv") returned 5 [0067.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.avi") returned 0 [0067.641] lstrlenA (lpString="*.avi") returned 5 [0067.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.mp4") returned 0 [0067.641] lstrlenA (lpString="*.mp4") returned 5 [0067.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.wmv") returned 0 [0067.641] lstrlenA (lpString="*.wmv") returned 5 [0067.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.divx") returned 0 [0067.641] lstrlenA (lpString="*.divx") returned 6 [0067.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.mkv") returned 0 [0067.641] lstrlenA (lpString="*.mkv") returned 5 [0067.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.mp3") returned 0 [0067.641] lstrlenA (lpString="*.mp3") returned 5 [0067.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.wav") returned 0 [0067.641] lstrlenA (lpString="*.wav") returned 5 [0067.641] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.flac") returned 0 [0067.641] lstrlenA (lpString="*.flac") returned 6 [0067.642] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.ape") returned 0 [0067.642] lstrlenA (lpString="*.ape") returned 5 [0067.642] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.wma") returned 0 [0067.642] lstrlenA (lpString="*.wma") returned 5 [0067.642] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.ac3") returned 0 [0067.642] lstrlenA (lpString="*.ac3") returned 5 [0067.642] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html", pszSpec="*.mxf") returned 0 [0067.642] lstrlenA (lpString="*.mxf") returned 5 [0067.642] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc288, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0067.642] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.642] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="NOR", cAlternateFileName="")) returned 1 [0067.642] lstrcmpA (lpString1=".", lpString2="NOR") returned -1 [0067.642] lstrcmpA (lpString1="..", lpString2="NOR") returned -1 [0067.642] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0067.642] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="NOR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR" [0067.642] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR") returned 57 [0067.642] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.642] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.642] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.642] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.642] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.642] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0067.643] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.643] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0067.643] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0067.643] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0067.643] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\*.*") returned="*.*" [0067.643] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\" [0067.643] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\") returned="" [0067.643] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\HOW TO DECRYPT FILES.txt" [0067.643] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\how to decrypt files.txt")) returned 0xffffffff [0067.643] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.644] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0067.644] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.645] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.645] CloseHandle (hObject=0x94) returned 1 [0067.645] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini" [0067.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.zip") returned 0 [0067.645] lstrlenA (lpString="*.zip") returned 5 [0067.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.rar") returned 0 [0067.645] lstrlenA (lpString="*.rar") returned 5 [0067.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.7z") returned 0 [0067.645] lstrlenA (lpString="*.7z") returned 4 [0067.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.tar") returned 0 [0067.645] lstrlenA (lpString="*.tar") returned 5 [0067.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.gzip") returned 0 [0067.645] lstrlenA (lpString="*.gzip") returned 6 [0067.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.jpg") returned 0 [0067.645] lstrlenA (lpString="*.jpg") returned 5 [0067.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.jpeg") returned 0 [0067.645] lstrlenA (lpString="*.jpeg") returned 6 [0067.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.psd") returned 0 [0067.645] lstrlenA (lpString="*.psd") returned 5 [0067.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.gif") returned 0 [0067.646] lstrlenA (lpString="*.gif") returned 5 [0067.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.doc") returned 0 [0067.646] lstrlenA (lpString="*.doc") returned 5 [0067.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.docx") returned 0 [0067.646] lstrlenA (lpString="*.docx") returned 6 [0067.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.xls") returned 0 [0067.646] lstrlenA (lpString="*.xls") returned 5 [0067.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.xlsx") returned 0 [0067.646] lstrlenA (lpString="*.xlsx") returned 6 [0067.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.ppt") returned 0 [0067.646] lstrlenA (lpString="*.ppt") returned 5 [0067.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.pptx") returned 0 [0067.646] lstrlenA (lpString="*.pptx") returned 6 [0067.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.pdf") returned 0 [0067.646] lstrlenA (lpString="*.pdf") returned 5 [0067.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.mov") returned 0 [0067.646] lstrlenA (lpString="*.mov") returned 5 [0067.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.m2v") returned 0 [0067.646] lstrlenA (lpString="*.m2v") returned 5 [0067.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.3gp") returned 0 [0067.646] lstrlenA (lpString="*.3gp") returned 5 [0067.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.mpeg") returned 0 [0067.646] lstrlenA (lpString="*.mpeg") returned 6 [0067.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.mpg") returned 0 [0067.646] lstrlenA (lpString="*.mpg") returned 5 [0067.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.flv") returned 0 [0067.646] lstrlenA (lpString="*.flv") returned 5 [0067.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.avi") returned 0 [0067.646] lstrlenA (lpString="*.avi") returned 5 [0067.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.mp4") returned 0 [0067.646] lstrlenA (lpString="*.mp4") returned 5 [0067.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.wmv") returned 0 [0067.646] lstrlenA (lpString="*.wmv") returned 5 [0067.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.divx") returned 0 [0067.647] lstrlenA (lpString="*.divx") returned 6 [0067.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.mkv") returned 0 [0067.647] lstrlenA (lpString="*.mkv") returned 5 [0067.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.mp3") returned 0 [0067.647] lstrlenA (lpString="*.mp3") returned 5 [0067.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.wav") returned 0 [0067.647] lstrlenA (lpString="*.wav") returned 5 [0067.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.flac") returned 0 [0067.647] lstrlenA (lpString="*.flac") returned 6 [0067.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.ape") returned 0 [0067.647] lstrlenA (lpString="*.ape") returned 5 [0067.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.wma") returned 0 [0067.647] lstrlenA (lpString="*.wma") returned 5 [0067.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.ac3") returned 0 [0067.647] lstrlenA (lpString="*.ac3") returned 5 [0067.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", pszSpec="*.mxf") returned 0 [0067.647] lstrlenA (lpString="*.mxf") returned 5 [0067.647] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xba2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0067.647] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.647] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0067.647] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0067.647] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0067.647] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini") returned="eula.ini" [0067.647] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\" [0067.647] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\") returned="" [0067.647] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\HOW TO DECRYPT FILES.txt" [0067.647] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\how to decrypt files.txt")) returned 0x20 [0067.647] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html" [0067.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.zip") returned 0 [0067.647] lstrlenA (lpString="*.zip") returned 5 [0067.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.rar") returned 0 [0067.648] lstrlenA (lpString="*.rar") returned 5 [0067.648] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.7z") returned 0 [0067.648] lstrlenA (lpString="*.7z") returned 4 [0067.648] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.tar") returned 0 [0067.648] lstrlenA (lpString="*.tar") returned 5 [0067.648] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.gzip") returned 0 [0067.648] lstrlenA (lpString="*.gzip") returned 6 [0067.648] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.jpg") returned 0 [0067.648] lstrlenA (lpString="*.jpg") returned 5 [0067.648] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.jpeg") returned 0 [0067.648] lstrlenA (lpString="*.jpeg") returned 6 [0067.648] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.psd") returned 0 [0067.648] lstrlenA (lpString="*.psd") returned 5 [0067.648] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.gif") returned 0 [0067.648] lstrlenA (lpString="*.gif") returned 5 [0067.648] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.doc") returned 0 [0067.648] lstrlenA (lpString="*.doc") returned 5 [0067.648] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.docx") returned 0 [0067.648] lstrlenA (lpString="*.docx") returned 6 [0067.648] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.xls") returned 0 [0067.648] lstrlenA (lpString="*.xls") returned 5 [0067.648] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.xlsx") returned 0 [0067.648] lstrlenA (lpString="*.xlsx") returned 6 [0067.648] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.ppt") returned 0 [0067.648] lstrlenA (lpString="*.ppt") returned 5 [0067.648] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.pptx") returned 0 [0067.648] lstrlenA (lpString="*.pptx") returned 6 [0067.648] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.pdf") returned 0 [0067.648] lstrlenA (lpString="*.pdf") returned 5 [0067.648] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.mov") returned 0 [0067.648] lstrlenA (lpString="*.mov") returned 5 [0067.648] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.m2v") returned 0 [0067.648] lstrlenA (lpString="*.m2v") returned 5 [0067.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.3gp") returned 0 [0067.649] lstrlenA (lpString="*.3gp") returned 5 [0067.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.mpeg") returned 0 [0067.649] lstrlenA (lpString="*.mpeg") returned 6 [0067.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.mpg") returned 0 [0067.649] lstrlenA (lpString="*.mpg") returned 5 [0067.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.flv") returned 0 [0067.649] lstrlenA (lpString="*.flv") returned 5 [0067.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.avi") returned 0 [0067.649] lstrlenA (lpString="*.avi") returned 5 [0067.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.mp4") returned 0 [0067.649] lstrlenA (lpString="*.mp4") returned 5 [0067.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.wmv") returned 0 [0067.649] lstrlenA (lpString="*.wmv") returned 5 [0067.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.divx") returned 0 [0067.649] lstrlenA (lpString="*.divx") returned 6 [0067.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.mkv") returned 0 [0067.649] lstrlenA (lpString="*.mkv") returned 5 [0067.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.mp3") returned 0 [0067.649] lstrlenA (lpString="*.mp3") returned 5 [0067.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.wav") returned 0 [0067.649] lstrlenA (lpString="*.wav") returned 5 [0067.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.flac") returned 0 [0067.649] lstrlenA (lpString="*.flac") returned 6 [0067.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.ape") returned 0 [0067.649] lstrlenA (lpString="*.ape") returned 5 [0067.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.wma") returned 0 [0067.650] lstrlenA (lpString="*.wma") returned 5 [0067.650] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.ac3") returned 0 [0067.650] lstrlenA (lpString="*.ac3") returned 5 [0067.650] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", pszSpec="*.mxf") returned 0 [0067.650] lstrlenA (lpString="*.mxf") returned 5 [0067.650] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xba2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0067.650] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.802] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="POL", cAlternateFileName="")) returned 1 [0067.802] lstrcmpA (lpString1=".", lpString2="POL") returned -1 [0067.802] lstrcmpA (lpString1="..", lpString2="POL") returned -1 [0067.802] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0067.802] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="POL" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL" [0067.802] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL") returned 57 [0067.802] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.916] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.916] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.916] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.916] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.916] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0067.916] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.916] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0067.916] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0067.916] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0067.916] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\*.*") returned="*.*" [0067.916] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\" [0067.916] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\") returned="" [0067.916] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\HOW TO DECRYPT FILES.txt" [0067.916] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\how to decrypt files.txt")) returned 0xffffffff [0067.917] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.918] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0067.918] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.919] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.919] CloseHandle (hObject=0x94) returned 1 [0067.919] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini" [0067.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.zip") returned 0 [0067.920] lstrlenA (lpString="*.zip") returned 5 [0067.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.rar") returned 0 [0067.920] lstrlenA (lpString="*.rar") returned 5 [0067.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.7z") returned 0 [0067.920] lstrlenA (lpString="*.7z") returned 4 [0067.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.tar") returned 0 [0067.920] lstrlenA (lpString="*.tar") returned 5 [0067.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.gzip") returned 0 [0067.920] lstrlenA (lpString="*.gzip") returned 6 [0067.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.jpg") returned 0 [0067.920] lstrlenA (lpString="*.jpg") returned 5 [0067.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.jpeg") returned 0 [0067.920] lstrlenA (lpString="*.jpeg") returned 6 [0067.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.psd") returned 0 [0067.920] lstrlenA (lpString="*.psd") returned 5 [0067.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.gif") returned 0 [0067.920] lstrlenA (lpString="*.gif") returned 5 [0067.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.doc") returned 0 [0067.920] lstrlenA (lpString="*.doc") returned 5 [0067.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.docx") returned 0 [0067.920] lstrlenA (lpString="*.docx") returned 6 [0067.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.xls") returned 0 [0067.920] lstrlenA (lpString="*.xls") returned 5 [0067.920] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.xlsx") returned 0 [0067.920] lstrlenA (lpString="*.xlsx") returned 6 [0067.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.ppt") returned 0 [0067.921] lstrlenA (lpString="*.ppt") returned 5 [0067.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.pptx") returned 0 [0067.921] lstrlenA (lpString="*.pptx") returned 6 [0067.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.pdf") returned 0 [0067.921] lstrlenA (lpString="*.pdf") returned 5 [0067.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.mov") returned 0 [0067.921] lstrlenA (lpString="*.mov") returned 5 [0067.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.m2v") returned 0 [0067.921] lstrlenA (lpString="*.m2v") returned 5 [0067.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.3gp") returned 0 [0067.921] lstrlenA (lpString="*.3gp") returned 5 [0067.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.mpeg") returned 0 [0067.921] lstrlenA (lpString="*.mpeg") returned 6 [0067.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.mpg") returned 0 [0067.921] lstrlenA (lpString="*.mpg") returned 5 [0067.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.flv") returned 0 [0067.921] lstrlenA (lpString="*.flv") returned 5 [0067.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.avi") returned 0 [0067.921] lstrlenA (lpString="*.avi") returned 5 [0067.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.mp4") returned 0 [0067.921] lstrlenA (lpString="*.mp4") returned 5 [0067.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.wmv") returned 0 [0067.921] lstrlenA (lpString="*.wmv") returned 5 [0067.921] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.divx") returned 0 [0067.921] lstrlenA (lpString="*.divx") returned 6 [0067.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.mkv") returned 0 [0067.922] lstrlenA (lpString="*.mkv") returned 5 [0067.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.mp3") returned 0 [0067.922] lstrlenA (lpString="*.mp3") returned 5 [0067.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.wav") returned 0 [0067.922] lstrlenA (lpString="*.wav") returned 5 [0067.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.flac") returned 0 [0067.922] lstrlenA (lpString="*.flac") returned 6 [0067.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.ape") returned 0 [0067.922] lstrlenA (lpString="*.ape") returned 5 [0067.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.wma") returned 0 [0067.922] lstrlenA (lpString="*.wma") returned 5 [0067.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.ac3") returned 0 [0067.922] lstrlenA (lpString="*.ac3") returned 5 [0067.922] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", pszSpec="*.mxf") returned 0 [0067.922] lstrlenA (lpString="*.mxf") returned 5 [0067.922] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xf0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0067.922] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.922] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0067.922] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0067.922] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0067.922] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini") returned="eula.ini" [0067.922] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\" [0067.922] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\") returned="" [0067.922] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\HOW TO DECRYPT FILES.txt" [0067.923] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\how to decrypt files.txt")) returned 0x20 [0067.923] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html" [0067.923] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.zip") returned 0 [0067.923] lstrlenA (lpString="*.zip") returned 5 [0067.923] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.rar") returned 0 [0067.923] lstrlenA (lpString="*.rar") returned 5 [0067.923] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.7z") returned 0 [0067.923] lstrlenA (lpString="*.7z") returned 4 [0067.923] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.tar") returned 0 [0067.923] lstrlenA (lpString="*.tar") returned 5 [0067.923] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.gzip") returned 0 [0067.923] lstrlenA (lpString="*.gzip") returned 6 [0067.923] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.jpg") returned 0 [0067.923] lstrlenA (lpString="*.jpg") returned 5 [0067.923] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.jpeg") returned 0 [0067.923] lstrlenA (lpString="*.jpeg") returned 6 [0067.923] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.psd") returned 0 [0067.923] lstrlenA (lpString="*.psd") returned 5 [0067.923] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.gif") returned 0 [0067.923] lstrlenA (lpString="*.gif") returned 5 [0067.923] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.doc") returned 0 [0067.923] lstrlenA (lpString="*.doc") returned 5 [0067.923] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.docx") returned 0 [0067.924] lstrlenA (lpString="*.docx") returned 6 [0067.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.xls") returned 0 [0067.924] lstrlenA (lpString="*.xls") returned 5 [0067.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.xlsx") returned 0 [0067.924] lstrlenA (lpString="*.xlsx") returned 6 [0067.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.ppt") returned 0 [0067.924] lstrlenA (lpString="*.ppt") returned 5 [0067.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.pptx") returned 0 [0067.924] lstrlenA (lpString="*.pptx") returned 6 [0067.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.pdf") returned 0 [0067.924] lstrlenA (lpString="*.pdf") returned 5 [0067.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.mov") returned 0 [0067.924] lstrlenA (lpString="*.mov") returned 5 [0067.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.m2v") returned 0 [0067.924] lstrlenA (lpString="*.m2v") returned 5 [0067.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.3gp") returned 0 [0067.924] lstrlenA (lpString="*.3gp") returned 5 [0067.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.mpeg") returned 0 [0067.924] lstrlenA (lpString="*.mpeg") returned 6 [0067.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.mpg") returned 0 [0067.924] lstrlenA (lpString="*.mpg") returned 5 [0067.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.flv") returned 0 [0067.924] lstrlenA (lpString="*.flv") returned 5 [0067.924] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.avi") returned 0 [0067.924] lstrlenA (lpString="*.avi") returned 5 [0067.925] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.mp4") returned 0 [0067.925] lstrlenA (lpString="*.mp4") returned 5 [0067.925] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.wmv") returned 0 [0067.925] lstrlenA (lpString="*.wmv") returned 5 [0067.925] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.divx") returned 0 [0067.925] lstrlenA (lpString="*.divx") returned 6 [0067.925] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.mkv") returned 0 [0067.925] lstrlenA (lpString="*.mkv") returned 5 [0067.925] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.mp3") returned 0 [0067.925] lstrlenA (lpString="*.mp3") returned 5 [0067.925] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.wav") returned 0 [0067.925] lstrlenA (lpString="*.wav") returned 5 [0067.925] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.flac") returned 0 [0067.925] lstrlenA (lpString="*.flac") returned 6 [0067.925] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.ape") returned 0 [0067.925] lstrlenA (lpString="*.ape") returned 5 [0067.925] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.wma") returned 0 [0067.925] lstrlenA (lpString="*.wma") returned 5 [0067.925] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.ac3") returned 0 [0067.925] lstrlenA (lpString="*.ac3") returned 5 [0067.925] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", pszSpec="*.mxf") returned 0 [0067.925] lstrlenA (lpString="*.mxf") returned 5 [0067.925] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xf0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0067.925] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.926] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="PTB", cAlternateFileName="")) returned 1 [0067.926] lstrcmpA (lpString1=".", lpString2="PTB") returned -1 [0067.926] lstrcmpA (lpString1="..", lpString2="PTB") returned -1 [0067.926] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0067.926] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="PTB" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB" [0067.926] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB") returned 57 [0067.926] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.948] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.948] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.948] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.948] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.948] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0067.948] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.948] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0067.948] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0067.948] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0067.948] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\*.*") returned="*.*" [0067.948] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\" [0067.948] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\") returned="" [0067.948] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\HOW TO DECRYPT FILES.txt" [0067.948] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ptb\\how to decrypt files.txt")) returned 0xffffffff [0067.949] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ptb\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.950] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0067.950] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.951] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.952] CloseHandle (hObject=0x94) returned 1 [0067.952] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini" [0067.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.zip") returned 0 [0067.952] lstrlenA (lpString="*.zip") returned 5 [0067.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.rar") returned 0 [0067.952] lstrlenA (lpString="*.rar") returned 5 [0067.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.7z") returned 0 [0067.952] lstrlenA (lpString="*.7z") returned 4 [0067.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.tar") returned 0 [0067.952] lstrlenA (lpString="*.tar") returned 5 [0067.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.gzip") returned 0 [0067.952] lstrlenA (lpString="*.gzip") returned 6 [0067.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.jpg") returned 0 [0067.952] lstrlenA (lpString="*.jpg") returned 5 [0067.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.jpeg") returned 0 [0067.952] lstrlenA (lpString="*.jpeg") returned 6 [0067.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.psd") returned 0 [0067.952] lstrlenA (lpString="*.psd") returned 5 [0067.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.gif") returned 0 [0067.952] lstrlenA (lpString="*.gif") returned 5 [0067.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.doc") returned 0 [0067.952] lstrlenA (lpString="*.doc") returned 5 [0067.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.docx") returned 0 [0067.952] lstrlenA (lpString="*.docx") returned 6 [0067.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.xls") returned 0 [0067.953] lstrlenA (lpString="*.xls") returned 5 [0067.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.xlsx") returned 0 [0067.953] lstrlenA (lpString="*.xlsx") returned 6 [0067.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.ppt") returned 0 [0067.953] lstrlenA (lpString="*.ppt") returned 5 [0067.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.pptx") returned 0 [0067.953] lstrlenA (lpString="*.pptx") returned 6 [0067.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.pdf") returned 0 [0067.953] lstrlenA (lpString="*.pdf") returned 5 [0067.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.mov") returned 0 [0067.953] lstrlenA (lpString="*.mov") returned 5 [0067.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.m2v") returned 0 [0067.953] lstrlenA (lpString="*.m2v") returned 5 [0067.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.3gp") returned 0 [0067.953] lstrlenA (lpString="*.3gp") returned 5 [0067.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.mpeg") returned 0 [0067.953] lstrlenA (lpString="*.mpeg") returned 6 [0067.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.mpg") returned 0 [0067.953] lstrlenA (lpString="*.mpg") returned 5 [0067.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.flv") returned 0 [0067.953] lstrlenA (lpString="*.flv") returned 5 [0067.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.avi") returned 0 [0067.953] lstrlenA (lpString="*.avi") returned 5 [0067.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.mp4") returned 0 [0067.953] lstrlenA (lpString="*.mp4") returned 5 [0067.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.wmv") returned 0 [0067.953] lstrlenA (lpString="*.wmv") returned 5 [0067.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.divx") returned 0 [0067.954] lstrlenA (lpString="*.divx") returned 6 [0067.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.mkv") returned 0 [0067.954] lstrlenA (lpString="*.mkv") returned 5 [0067.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.mp3") returned 0 [0067.954] lstrlenA (lpString="*.mp3") returned 5 [0067.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.wav") returned 0 [0067.954] lstrlenA (lpString="*.wav") returned 5 [0067.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.flac") returned 0 [0067.954] lstrlenA (lpString="*.flac") returned 6 [0067.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.ape") returned 0 [0067.954] lstrlenA (lpString="*.ape") returned 5 [0067.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.wma") returned 0 [0067.954] lstrlenA (lpString="*.wma") returned 5 [0067.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.ac3") returned 0 [0067.954] lstrlenA (lpString="*.ac3") returned 5 [0067.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", pszSpec="*.mxf") returned 0 [0067.954] lstrlenA (lpString="*.mxf") returned 5 [0067.954] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd746, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0067.954] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.954] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0067.954] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0067.954] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0067.954] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini") returned="eula.ini" [0067.954] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\" [0067.955] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\") returned="" [0067.955] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\HOW TO DECRYPT FILES.txt" [0067.955] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ptb\\how to decrypt files.txt")) returned 0x20 [0067.955] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html" [0067.955] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.zip") returned 0 [0067.955] lstrlenA (lpString="*.zip") returned 5 [0067.955] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.rar") returned 0 [0067.955] lstrlenA (lpString="*.rar") returned 5 [0067.955] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.7z") returned 0 [0067.955] lstrlenA (lpString="*.7z") returned 4 [0067.955] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.tar") returned 0 [0067.955] lstrlenA (lpString="*.tar") returned 5 [0067.955] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.gzip") returned 0 [0067.955] lstrlenA (lpString="*.gzip") returned 6 [0067.955] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.jpg") returned 0 [0067.955] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.jpeg") returned 0 [0067.955] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.psd") returned 0 [0067.955] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.gif") returned 0 [0067.955] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.doc") returned 0 [0067.955] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.docx") returned 0 [0067.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.xls") returned 0 [0067.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.xlsx") returned 0 [0067.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.ppt") returned 0 [0067.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.pptx") returned 0 [0067.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.pdf") returned 0 [0067.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.mov") returned 0 [0067.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.m2v") returned 0 [0067.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.3gp") returned 0 [0067.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.mpeg") returned 0 [0067.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.mpg") returned 0 [0067.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.flv") returned 0 [0067.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.avi") returned 0 [0067.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.mp4") returned 0 [0067.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.wmv") returned 0 [0067.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.divx") returned 0 [0067.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.mkv") returned 0 [0067.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.mp3") returned 0 [0067.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.wav") returned 0 [0067.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.flac") returned 0 [0067.956] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.ape") returned 0 [0067.957] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.wma") returned 0 [0067.957] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.ac3") returned 0 [0067.957] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html", pszSpec="*.mxf") returned 0 [0067.957] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd746, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0067.957] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.957] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="RUM", cAlternateFileName="")) returned 1 [0067.957] lstrcmpA (lpString1=".", lpString2="RUM") returned -1 [0067.957] lstrcmpA (lpString1="..", lpString2="RUM") returned -1 [0067.957] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0067.957] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="RUM" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM" [0067.957] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.959] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.959] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.959] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.959] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.959] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0067.959] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.959] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0067.959] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0067.959] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0067.959] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\*.*") returned="*.*" [0067.959] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\" [0067.960] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\") returned="" [0067.960] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\HOW TO DECRYPT FILES.txt" [0067.960] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\how to decrypt files.txt")) returned 0xffffffff [0067.960] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.961] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.962] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.962] CloseHandle (hObject=0x94) returned 1 [0067.962] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini" [0067.962] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.zip") returned 0 [0067.962] lstrlenA (lpString="*.zip") returned 5 [0067.962] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.rar") returned 0 [0067.963] lstrlenA (lpString="*.rar") returned 5 [0067.963] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.7z") returned 0 [0067.963] lstrlenA (lpString="*.7z") returned 4 [0067.963] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.tar") returned 0 [0067.963] lstrlenA (lpString="*.tar") returned 5 [0067.963] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.gzip") returned 0 [0067.963] lstrlenA (lpString="*.gzip") returned 6 [0067.963] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.jpg") returned 0 [0067.963] lstrlenA (lpString="*.jpg") returned 5 [0067.963] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.jpeg") returned 0 [0067.963] lstrlenA (lpString="*.jpeg") returned 6 [0067.963] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.psd") returned 0 [0067.963] lstrlenA (lpString="*.psd") returned 5 [0067.963] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.gif") returned 0 [0067.963] lstrlenA (lpString="*.gif") returned 5 [0067.963] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.doc") returned 0 [0067.963] lstrlenA (lpString="*.doc") returned 5 [0067.963] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.docx") returned 0 [0067.963] lstrlenA (lpString="*.docx") returned 6 [0067.963] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.xls") returned 0 [0067.963] lstrlenA (lpString="*.xls") returned 5 [0067.963] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.xlsx") returned 0 [0067.963] lstrlenA (lpString="*.xlsx") returned 6 [0067.963] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.ppt") returned 0 [0067.963] lstrlenA (lpString="*.ppt") returned 5 [0067.963] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.pptx") returned 0 [0067.963] lstrlenA (lpString="*.pptx") returned 6 [0067.963] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.pdf") returned 0 [0067.964] lstrlenA (lpString="*.pdf") returned 5 [0067.964] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.mov") returned 0 [0067.964] lstrlenA (lpString="*.mov") returned 5 [0067.964] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.m2v") returned 0 [0067.964] lstrlenA (lpString="*.m2v") returned 5 [0067.964] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.3gp") returned 0 [0067.964] lstrlenA (lpString="*.3gp") returned 5 [0067.964] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.mpeg") returned 0 [0067.964] lstrlenA (lpString="*.mpeg") returned 6 [0067.964] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.mpg") returned 0 [0067.964] lstrlenA (lpString="*.mpg") returned 5 [0067.964] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.flv") returned 0 [0067.964] lstrlenA (lpString="*.flv") returned 5 [0067.964] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.avi") returned 0 [0067.964] lstrlenA (lpString="*.avi") returned 5 [0067.964] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.mp4") returned 0 [0067.964] lstrlenA (lpString="*.mp4") returned 5 [0067.964] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.wmv") returned 0 [0067.964] lstrlenA (lpString="*.wmv") returned 5 [0067.964] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.divx") returned 0 [0067.964] lstrlenA (lpString="*.divx") returned 6 [0067.964] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.mkv") returned 0 [0067.964] lstrlenA (lpString="*.mkv") returned 5 [0067.964] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.mp3") returned 0 [0067.964] lstrlenA (lpString="*.mp3") returned 5 [0067.965] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.wav") returned 0 [0067.965] lstrlenA (lpString="*.wav") returned 5 [0067.965] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.flac") returned 0 [0067.965] lstrlenA (lpString="*.flac") returned 6 [0067.965] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.ape") returned 0 [0067.965] lstrlenA (lpString="*.ape") returned 5 [0067.965] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.wma") returned 0 [0067.965] lstrlenA (lpString="*.wma") returned 5 [0067.965] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.ac3") returned 0 [0067.965] lstrlenA (lpString="*.ac3") returned 5 [0067.965] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", pszSpec="*.mxf") returned 0 [0067.965] lstrlenA (lpString="*.mxf") returned 5 [0067.965] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe796, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0067.965] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.965] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0067.965] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0067.965] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0067.965] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini") returned="eula.ini" [0067.965] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\" [0067.965] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\") returned="" [0067.965] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\HOW TO DECRYPT FILES.txt" [0067.965] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\how to decrypt files.txt")) returned 0x20 [0067.965] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html" [0067.966] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.zip") returned 0 [0067.966] lstrlenA (lpString="*.zip") returned 5 [0067.966] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.rar") returned 0 [0067.966] lstrlenA (lpString="*.rar") returned 5 [0067.966] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.7z") returned 0 [0067.966] lstrlenA (lpString="*.7z") returned 4 [0067.966] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.tar") returned 0 [0067.966] lstrlenA (lpString="*.tar") returned 5 [0067.966] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.gzip") returned 0 [0067.966] lstrlenA (lpString="*.gzip") returned 6 [0067.966] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.jpg") returned 0 [0067.966] lstrlenA (lpString="*.jpg") returned 5 [0067.966] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.jpeg") returned 0 [0067.966] lstrlenA (lpString="*.jpeg") returned 6 [0067.966] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.psd") returned 0 [0067.966] lstrlenA (lpString="*.psd") returned 5 [0067.966] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.gif") returned 0 [0067.966] lstrlenA (lpString="*.gif") returned 5 [0067.966] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.doc") returned 0 [0067.966] lstrlenA (lpString="*.doc") returned 5 [0067.966] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.docx") returned 0 [0067.966] lstrlenA (lpString="*.docx") returned 6 [0067.966] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.xls") returned 0 [0067.966] lstrlenA (lpString="*.xls") returned 5 [0067.966] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.xlsx") returned 0 [0067.966] lstrlenA (lpString="*.xlsx") returned 6 [0067.966] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.ppt") returned 0 [0067.966] lstrlenA (lpString="*.ppt") returned 5 [0067.967] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.pptx") returned 0 [0067.967] lstrlenA (lpString="*.pptx") returned 6 [0067.967] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.pdf") returned 0 [0067.967] lstrlenA (lpString="*.pdf") returned 5 [0067.967] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.mov") returned 0 [0067.967] lstrlenA (lpString="*.mov") returned 5 [0067.967] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.m2v") returned 0 [0067.967] lstrlenA (lpString="*.m2v") returned 5 [0067.967] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.3gp") returned 0 [0067.967] lstrlenA (lpString="*.3gp") returned 5 [0067.967] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.mpeg") returned 0 [0067.967] lstrlenA (lpString="*.mpeg") returned 6 [0067.967] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.mpg") returned 0 [0067.967] lstrlenA (lpString="*.mpg") returned 5 [0067.967] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.flv") returned 0 [0067.967] lstrlenA (lpString="*.flv") returned 5 [0067.967] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.avi") returned 0 [0067.967] lstrlenA (lpString="*.avi") returned 5 [0067.967] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.mp4") returned 0 [0067.967] lstrlenA (lpString="*.mp4") returned 5 [0067.967] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.wmv") returned 0 [0067.967] lstrlenA (lpString="*.wmv") returned 5 [0067.967] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.divx") returned 0 [0067.967] lstrlenA (lpString="*.divx") returned 6 [0067.967] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.mkv") returned 0 [0067.967] lstrlenA (lpString="*.mkv") returned 5 [0067.967] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.mp3") returned 0 [0067.968] lstrlenA (lpString="*.mp3") returned 5 [0067.968] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.wav") returned 0 [0067.968] lstrlenA (lpString="*.wav") returned 5 [0067.968] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.flac") returned 0 [0067.968] lstrlenA (lpString="*.flac") returned 6 [0067.968] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.ape") returned 0 [0067.968] lstrlenA (lpString="*.ape") returned 5 [0067.968] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.wma") returned 0 [0067.968] lstrlenA (lpString="*.wma") returned 5 [0067.968] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.ac3") returned 0 [0067.968] lstrlenA (lpString="*.ac3") returned 5 [0067.968] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", pszSpec="*.mxf") returned 0 [0067.968] lstrlenA (lpString="*.mxf") returned 5 [0067.968] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe796, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0067.968] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.968] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="RUS", cAlternateFileName="")) returned 1 [0067.968] lstrcmpA (lpString1=".", lpString2="RUS") returned -1 [0067.968] lstrcmpA (lpString1="..", lpString2="RUS") returned -1 [0067.968] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0067.968] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="RUS" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS" [0067.968] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS") returned 57 [0067.968] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.969] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.969] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.969] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.969] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.969] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0067.969] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.969] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0067.970] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0067.970] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0067.970] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\*.*") returned="*.*" [0067.970] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\" [0067.970] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\") returned="" [0067.970] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\HOW TO DECRYPT FILES.txt" [0067.970] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rus\\how to decrypt files.txt")) returned 0xffffffff [0067.970] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rus\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.971] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0067.971] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.972] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.972] CloseHandle (hObject=0x94) returned 1 [0067.972] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini" [0067.972] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.zip") returned 0 [0067.972] lstrlenA (lpString="*.zip") returned 5 [0067.972] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.rar") returned 0 [0067.973] lstrlenA (lpString="*.rar") returned 5 [0067.973] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.7z") returned 0 [0067.973] lstrlenA (lpString="*.7z") returned 4 [0067.973] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.tar") returned 0 [0067.973] lstrlenA (lpString="*.tar") returned 5 [0067.973] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.gzip") returned 0 [0067.973] lstrlenA (lpString="*.gzip") returned 6 [0067.973] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.jpg") returned 0 [0067.973] lstrlenA (lpString="*.jpg") returned 5 [0067.973] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.jpeg") returned 0 [0067.973] lstrlenA (lpString="*.jpeg") returned 6 [0067.973] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.psd") returned 0 [0067.973] lstrlenA (lpString="*.psd") returned 5 [0067.973] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.gif") returned 0 [0067.973] lstrlenA (lpString="*.gif") returned 5 [0067.973] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.doc") returned 0 [0067.973] lstrlenA (lpString="*.doc") returned 5 [0067.973] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.docx") returned 0 [0067.973] lstrlenA (lpString="*.docx") returned 6 [0067.973] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.xls") returned 0 [0067.973] lstrlenA (lpString="*.xls") returned 5 [0067.973] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.xlsx") returned 0 [0067.973] lstrlenA (lpString="*.xlsx") returned 6 [0067.973] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.ppt") returned 0 [0067.973] lstrlenA (lpString="*.ppt") returned 5 [0067.973] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.pptx") returned 0 [0067.974] lstrlenA (lpString="*.pptx") returned 6 [0067.974] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.pdf") returned 0 [0067.974] lstrlenA (lpString="*.pdf") returned 5 [0067.974] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.mov") returned 0 [0067.974] lstrlenA (lpString="*.mov") returned 5 [0067.974] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.m2v") returned 0 [0067.974] lstrlenA (lpString="*.m2v") returned 5 [0067.974] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.3gp") returned 0 [0067.974] lstrlenA (lpString="*.3gp") returned 5 [0067.974] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.mpeg") returned 0 [0067.974] lstrlenA (lpString="*.mpeg") returned 6 [0067.974] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.mpg") returned 0 [0067.974] lstrlenA (lpString="*.mpg") returned 5 [0067.974] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.flv") returned 0 [0067.974] lstrlenA (lpString="*.flv") returned 5 [0067.974] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.avi") returned 0 [0067.974] lstrlenA (lpString="*.avi") returned 5 [0067.974] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.mp4") returned 0 [0067.974] lstrlenA (lpString="*.mp4") returned 5 [0067.974] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.wmv") returned 0 [0067.974] lstrlenA (lpString="*.wmv") returned 5 [0067.974] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.divx") returned 0 [0067.974] lstrlenA (lpString="*.divx") returned 6 [0067.974] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.mkv") returned 0 [0067.974] lstrlenA (lpString="*.mkv") returned 5 [0067.974] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.mp3") returned 0 [0067.974] lstrlenA (lpString="*.mp3") returned 5 [0067.975] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.wav") returned 0 [0067.975] lstrlenA (lpString="*.wav") returned 5 [0067.975] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.flac") returned 0 [0067.975] lstrlenA (lpString="*.flac") returned 6 [0067.975] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.ape") returned 0 [0067.975] lstrlenA (lpString="*.ape") returned 5 [0067.975] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.wma") returned 0 [0067.975] lstrlenA (lpString="*.wma") returned 5 [0067.975] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.ac3") returned 0 [0067.975] lstrlenA (lpString="*.ac3") returned 5 [0067.975] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini", pszSpec="*.mxf") returned 0 [0067.975] lstrlenA (lpString="*.mxf") returned 5 [0067.975] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3ece3, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0067.975] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.975] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0067.975] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0067.975] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0067.975] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini") returned="eula.ini" [0067.975] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\" [0067.975] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\") returned="" [0067.975] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\HOW TO DECRYPT FILES.txt" [0067.975] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rus\\how to decrypt files.txt")) returned 0x20 [0067.975] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html" [0067.976] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.zip") returned 0 [0067.976] lstrlenA (lpString="*.zip") returned 5 [0067.976] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.rar") returned 0 [0067.976] lstrlenA (lpString="*.rar") returned 5 [0067.976] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.7z") returned 0 [0067.976] lstrlenA (lpString="*.7z") returned 4 [0067.976] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.tar") returned 0 [0067.976] lstrlenA (lpString="*.tar") returned 5 [0067.976] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.gzip") returned 0 [0067.976] lstrlenA (lpString="*.gzip") returned 6 [0067.976] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.jpg") returned 0 [0067.976] lstrlenA (lpString="*.jpg") returned 5 [0067.976] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.jpeg") returned 0 [0067.976] lstrlenA (lpString="*.jpeg") returned 6 [0067.976] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.psd") returned 0 [0067.976] lstrlenA (lpString="*.psd") returned 5 [0067.976] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.gif") returned 0 [0067.976] lstrlenA (lpString="*.gif") returned 5 [0067.976] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.doc") returned 0 [0067.976] lstrlenA (lpString="*.doc") returned 5 [0067.976] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.docx") returned 0 [0067.976] lstrlenA (lpString="*.docx") returned 6 [0067.976] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.xls") returned 0 [0067.976] lstrlenA (lpString="*.xls") returned 5 [0067.976] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.xlsx") returned 0 [0067.976] lstrlenA (lpString="*.xlsx") returned 6 [0067.977] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.ppt") returned 0 [0067.977] lstrlenA (lpString="*.ppt") returned 5 [0067.977] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.pptx") returned 0 [0067.977] lstrlenA (lpString="*.pptx") returned 6 [0067.977] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.pdf") returned 0 [0067.977] lstrlenA (lpString="*.pdf") returned 5 [0067.977] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.mov") returned 0 [0067.977] lstrlenA (lpString="*.mov") returned 5 [0067.977] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.m2v") returned 0 [0067.977] lstrlenA (lpString="*.m2v") returned 5 [0067.977] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.3gp") returned 0 [0067.977] lstrlenA (lpString="*.3gp") returned 5 [0067.977] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.mpeg") returned 0 [0067.977] lstrlenA (lpString="*.mpeg") returned 6 [0067.977] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.mpg") returned 0 [0067.977] lstrlenA (lpString="*.mpg") returned 5 [0067.977] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.flv") returned 0 [0067.977] lstrlenA (lpString="*.flv") returned 5 [0067.977] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.avi") returned 0 [0067.977] lstrlenA (lpString="*.avi") returned 5 [0067.977] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.mp4") returned 0 [0067.977] lstrlenA (lpString="*.mp4") returned 5 [0067.977] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.wmv") returned 0 [0067.977] lstrlenA (lpString="*.wmv") returned 5 [0067.977] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.divx") returned 0 [0067.977] lstrlenA (lpString="*.divx") returned 6 [0067.978] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.mkv") returned 0 [0067.978] lstrlenA (lpString="*.mkv") returned 5 [0067.978] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.mp3") returned 0 [0067.978] lstrlenA (lpString="*.mp3") returned 5 [0067.978] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.wav") returned 0 [0067.978] lstrlenA (lpString="*.wav") returned 5 [0067.978] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.flac") returned 0 [0067.978] lstrlenA (lpString="*.flac") returned 6 [0067.978] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.ape") returned 0 [0067.978] lstrlenA (lpString="*.ape") returned 5 [0067.978] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.wma") returned 0 [0067.978] lstrlenA (lpString="*.wma") returned 5 [0067.978] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.ac3") returned 0 [0067.978] lstrlenA (lpString="*.ac3") returned 5 [0067.978] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html", pszSpec="*.mxf") returned 0 [0067.978] lstrlenA (lpString="*.mxf") returned 5 [0067.978] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3ece3, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0067.978] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.978] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="SKY", cAlternateFileName="")) returned 1 [0067.978] lstrcmpA (lpString1=".", lpString2="SKY") returned -1 [0067.978] lstrcmpA (lpString1="..", lpString2="SKY") returned -1 [0067.978] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0067.978] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="SKY" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY" [0067.978] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY") returned 57 [0067.979] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.979] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.979] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.979] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.979] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.979] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x478, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0067.979] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.979] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0067.979] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0067.979] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0067.979] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\*.*") returned="*.*" [0067.980] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\" [0067.980] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\") returned="" [0067.980] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\HOW TO DECRYPT FILES.txt" [0067.980] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\how to decrypt files.txt")) returned 0xffffffff [0067.980] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.981] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0067.981] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.982] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.982] CloseHandle (hObject=0x94) returned 1 [0067.982] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini" [0067.982] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.zip") returned 0 [0067.982] lstrlenA (lpString="*.zip") returned 5 [0067.983] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.rar") returned 0 [0067.983] lstrlenA (lpString="*.rar") returned 5 [0067.983] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.7z") returned 0 [0067.983] lstrlenA (lpString="*.7z") returned 4 [0067.983] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.tar") returned 0 [0067.983] lstrlenA (lpString="*.tar") returned 5 [0067.983] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.gzip") returned 0 [0067.983] lstrlenA (lpString="*.gzip") returned 6 [0067.983] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.jpg") returned 0 [0067.983] lstrlenA (lpString="*.jpg") returned 5 [0067.983] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.jpeg") returned 0 [0067.983] lstrlenA (lpString="*.jpeg") returned 6 [0067.983] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.psd") returned 0 [0067.983] lstrlenA (lpString="*.psd") returned 5 [0067.983] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.gif") returned 0 [0067.983] lstrlenA (lpString="*.gif") returned 5 [0067.983] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.doc") returned 0 [0067.983] lstrlenA (lpString="*.doc") returned 5 [0067.983] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.docx") returned 0 [0067.983] lstrlenA (lpString="*.docx") returned 6 [0067.983] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.xls") returned 0 [0067.983] lstrlenA (lpString="*.xls") returned 5 [0067.983] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.xlsx") returned 0 [0067.983] lstrlenA (lpString="*.xlsx") returned 6 [0067.983] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.ppt") returned 0 [0067.983] lstrlenA (lpString="*.ppt") returned 5 [0067.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.pptx") returned 0 [0067.984] lstrlenA (lpString="*.pptx") returned 6 [0067.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.pdf") returned 0 [0067.984] lstrlenA (lpString="*.pdf") returned 5 [0067.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.mov") returned 0 [0067.984] lstrlenA (lpString="*.mov") returned 5 [0067.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.m2v") returned 0 [0067.984] lstrlenA (lpString="*.m2v") returned 5 [0067.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.3gp") returned 0 [0067.984] lstrlenA (lpString="*.3gp") returned 5 [0067.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.mpeg") returned 0 [0067.984] lstrlenA (lpString="*.mpeg") returned 6 [0067.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.mpg") returned 0 [0067.984] lstrlenA (lpString="*.mpg") returned 5 [0067.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.flv") returned 0 [0067.984] lstrlenA (lpString="*.flv") returned 5 [0067.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.avi") returned 0 [0067.984] lstrlenA (lpString="*.avi") returned 5 [0067.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.mp4") returned 0 [0067.984] lstrlenA (lpString="*.mp4") returned 5 [0067.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.wmv") returned 0 [0067.984] lstrlenA (lpString="*.wmv") returned 5 [0067.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.divx") returned 0 [0067.984] lstrlenA (lpString="*.divx") returned 6 [0067.984] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.mkv") returned 0 [0067.984] lstrlenA (lpString="*.mkv") returned 5 [0067.985] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.mp3") returned 0 [0067.985] lstrlenA (lpString="*.mp3") returned 5 [0067.985] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.wav") returned 0 [0067.985] lstrlenA (lpString="*.wav") returned 5 [0067.985] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.flac") returned 0 [0067.985] lstrlenA (lpString="*.flac") returned 6 [0067.985] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.ape") returned 0 [0067.985] lstrlenA (lpString="*.ape") returned 5 [0067.985] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.wma") returned 0 [0067.985] lstrlenA (lpString="*.wma") returned 5 [0067.985] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.ac3") returned 0 [0067.985] lstrlenA (lpString="*.ac3") returned 5 [0067.985] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", pszSpec="*.mxf") returned 0 [0067.985] lstrlenA (lpString="*.mxf") returned 5 [0067.985] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10d39, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0067.985] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.985] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0067.985] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0067.985] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0067.985] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini") returned="eula.ini" [0067.985] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\" [0067.985] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\") returned="" [0067.985] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\HOW TO DECRYPT FILES.txt" [0067.985] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\how to decrypt files.txt")) returned 0x20 [0067.986] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html" [0067.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.zip") returned 0 [0067.986] lstrlenA (lpString="*.zip") returned 5 [0067.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.rar") returned 0 [0067.986] lstrlenA (lpString="*.rar") returned 5 [0067.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.7z") returned 0 [0067.986] lstrlenA (lpString="*.7z") returned 4 [0067.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.tar") returned 0 [0067.986] lstrlenA (lpString="*.tar") returned 5 [0067.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.gzip") returned 0 [0067.986] lstrlenA (lpString="*.gzip") returned 6 [0067.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.jpg") returned 0 [0067.986] lstrlenA (lpString="*.jpg") returned 5 [0067.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.jpeg") returned 0 [0067.986] lstrlenA (lpString="*.jpeg") returned 6 [0067.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.psd") returned 0 [0067.986] lstrlenA (lpString="*.psd") returned 5 [0067.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.gif") returned 0 [0067.986] lstrlenA (lpString="*.gif") returned 5 [0067.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.doc") returned 0 [0067.986] lstrlenA (lpString="*.doc") returned 5 [0067.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.docx") returned 0 [0067.986] lstrlenA (lpString="*.docx") returned 6 [0067.986] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.xls") returned 0 [0067.986] lstrlenA (lpString="*.xls") returned 5 [0067.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.xlsx") returned 0 [0067.987] lstrlenA (lpString="*.xlsx") returned 6 [0067.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.ppt") returned 0 [0067.987] lstrlenA (lpString="*.ppt") returned 5 [0067.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.pptx") returned 0 [0067.987] lstrlenA (lpString="*.pptx") returned 6 [0067.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.pdf") returned 0 [0067.987] lstrlenA (lpString="*.pdf") returned 5 [0067.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.mov") returned 0 [0067.987] lstrlenA (lpString="*.mov") returned 5 [0067.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.m2v") returned 0 [0067.987] lstrlenA (lpString="*.m2v") returned 5 [0067.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.3gp") returned 0 [0067.987] lstrlenA (lpString="*.3gp") returned 5 [0067.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.mpeg") returned 0 [0067.987] lstrlenA (lpString="*.mpeg") returned 6 [0067.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.mpg") returned 0 [0067.987] lstrlenA (lpString="*.mpg") returned 5 [0067.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.flv") returned 0 [0067.987] lstrlenA (lpString="*.flv") returned 5 [0067.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.avi") returned 0 [0067.987] lstrlenA (lpString="*.avi") returned 5 [0067.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.mp4") returned 0 [0067.987] lstrlenA (lpString="*.mp4") returned 5 [0067.988] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.wmv") returned 0 [0067.988] lstrlenA (lpString="*.wmv") returned 5 [0067.988] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.divx") returned 0 [0067.988] lstrlenA (lpString="*.divx") returned 6 [0067.988] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.mkv") returned 0 [0067.988] lstrlenA (lpString="*.mkv") returned 5 [0067.988] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.mp3") returned 0 [0067.988] lstrlenA (lpString="*.mp3") returned 5 [0067.988] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.wav") returned 0 [0067.988] lstrlenA (lpString="*.wav") returned 5 [0067.988] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.flac") returned 0 [0067.988] lstrlenA (lpString="*.flac") returned 6 [0067.988] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.ape") returned 0 [0067.988] lstrlenA (lpString="*.ape") returned 5 [0067.988] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.wma") returned 0 [0067.988] lstrlenA (lpString="*.wma") returned 5 [0067.988] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.ac3") returned 0 [0067.988] lstrlenA (lpString="*.ac3") returned 5 [0067.988] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", pszSpec="*.mxf") returned 0 [0067.988] lstrlenA (lpString="*.mxf") returned 5 [0067.988] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10d39, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0067.988] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.988] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="SLV", cAlternateFileName="")) returned 1 [0067.988] lstrcmpA (lpString1=".", lpString2="SLV") returned -1 [0067.989] lstrcmpA (lpString1="..", lpString2="SLV") returned -1 [0067.989] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0067.989] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="SLV" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV" [0067.989] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV") returned 57 [0067.989] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0067.990] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.990] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.990] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.990] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.990] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x440, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0067.990] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.990] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0067.990] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0067.990] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0067.990] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\*.*") returned="*.*" [0067.990] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\" [0067.991] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\") returned="" [0067.991] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\HOW TO DECRYPT FILES.txt" [0067.991] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\slv\\how to decrypt files.txt")) returned 0xffffffff [0067.991] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\slv\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0067.992] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0067.992] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0067.993] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0067.993] CloseHandle (hObject=0x94) returned 1 [0067.993] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini" [0067.993] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.zip") returned 0 [0067.993] lstrlenA (lpString="*.zip") returned 5 [0067.993] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.rar") returned 0 [0067.993] lstrlenA (lpString="*.rar") returned 5 [0067.994] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.7z") returned 0 [0067.994] lstrlenA (lpString="*.7z") returned 4 [0067.994] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.tar") returned 0 [0067.994] lstrlenA (lpString="*.tar") returned 5 [0067.994] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.gzip") returned 0 [0067.994] lstrlenA (lpString="*.gzip") returned 6 [0067.994] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.jpg") returned 0 [0067.994] lstrlenA (lpString="*.jpg") returned 5 [0067.994] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.jpeg") returned 0 [0067.994] lstrlenA (lpString="*.jpeg") returned 6 [0067.994] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.psd") returned 0 [0067.994] lstrlenA (lpString="*.psd") returned 5 [0067.994] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.gif") returned 0 [0067.994] lstrlenA (lpString="*.gif") returned 5 [0067.994] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.doc") returned 0 [0067.994] lstrlenA (lpString="*.doc") returned 5 [0067.994] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.docx") returned 0 [0067.994] lstrlenA (lpString="*.docx") returned 6 [0067.994] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.xls") returned 0 [0067.994] lstrlenA (lpString="*.xls") returned 5 [0067.994] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.xlsx") returned 0 [0067.994] lstrlenA (lpString="*.xlsx") returned 6 [0067.994] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.ppt") returned 0 [0067.994] lstrlenA (lpString="*.ppt") returned 5 [0067.994] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.pptx") returned 0 [0067.994] lstrlenA (lpString="*.pptx") returned 6 [0067.994] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.pdf") returned 0 [0067.995] lstrlenA (lpString="*.pdf") returned 5 [0067.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.mov") returned 0 [0067.995] lstrlenA (lpString="*.mov") returned 5 [0067.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.m2v") returned 0 [0067.995] lstrlenA (lpString="*.m2v") returned 5 [0067.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.3gp") returned 0 [0067.995] lstrlenA (lpString="*.3gp") returned 5 [0067.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.mpeg") returned 0 [0067.995] lstrlenA (lpString="*.mpeg") returned 6 [0067.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.mpg") returned 0 [0067.995] lstrlenA (lpString="*.mpg") returned 5 [0067.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.flv") returned 0 [0067.995] lstrlenA (lpString="*.flv") returned 5 [0067.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.avi") returned 0 [0067.995] lstrlenA (lpString="*.avi") returned 5 [0067.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.mp4") returned 0 [0067.995] lstrlenA (lpString="*.mp4") returned 5 [0067.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.wmv") returned 0 [0067.995] lstrlenA (lpString="*.wmv") returned 5 [0067.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.divx") returned 0 [0067.995] lstrlenA (lpString="*.divx") returned 6 [0067.995] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.mkv") returned 0 [0067.996] lstrlenA (lpString="*.mkv") returned 5 [0067.996] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.mp3") returned 0 [0067.996] lstrlenA (lpString="*.mp3") returned 5 [0067.996] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.wav") returned 0 [0067.996] lstrlenA (lpString="*.wav") returned 5 [0067.996] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.flac") returned 0 [0067.996] lstrlenA (lpString="*.flac") returned 6 [0067.996] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.ape") returned 0 [0067.996] lstrlenA (lpString="*.ape") returned 5 [0067.996] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.wma") returned 0 [0067.996] lstrlenA (lpString="*.wma") returned 5 [0067.996] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.ac3") returned 0 [0067.996] lstrlenA (lpString="*.ac3") returned 5 [0067.996] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini", pszSpec="*.mxf") returned 0 [0067.996] lstrlenA (lpString="*.mxf") returned 5 [0067.996] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc2f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0067.996] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0067.996] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0067.996] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0067.996] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0067.996] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini") returned="eula.ini" [0067.996] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\" [0067.996] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\") returned="" [0067.996] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\HOW TO DECRYPT FILES.txt" [0067.996] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\slv\\how to decrypt files.txt")) returned 0x20 [0067.997] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html" [0067.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.zip") returned 0 [0067.997] lstrlenA (lpString="*.zip") returned 5 [0067.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.rar") returned 0 [0067.997] lstrlenA (lpString="*.rar") returned 5 [0067.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.7z") returned 0 [0067.997] lstrlenA (lpString="*.7z") returned 4 [0067.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.tar") returned 0 [0067.997] lstrlenA (lpString="*.tar") returned 5 [0067.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.gzip") returned 0 [0067.997] lstrlenA (lpString="*.gzip") returned 6 [0067.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.jpg") returned 0 [0067.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.jpeg") returned 0 [0067.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.psd") returned 0 [0067.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.gif") returned 0 [0067.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.doc") returned 0 [0067.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.docx") returned 0 [0067.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.xls") returned 0 [0067.997] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.xlsx") returned 0 [0067.998] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.ppt") returned 0 [0067.998] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.pptx") returned 0 [0067.998] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.pdf") returned 0 [0067.998] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.mov") returned 0 [0067.998] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.m2v") returned 0 [0067.998] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.3gp") returned 0 [0067.998] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.mpeg") returned 0 [0067.998] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.mpg") returned 0 [0067.998] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.flv") returned 0 [0067.998] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.avi") returned 0 [0067.998] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.mp4") returned 0 [0067.998] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.wmv") returned 0 [0067.998] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.divx") returned 0 [0067.998] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.mkv") returned 0 [0067.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.mp3") returned 0 [0067.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.wav") returned 0 [0067.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.flac") returned 0 [0067.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.ape") returned 0 [0067.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.wma") returned 0 [0067.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.ac3") returned 0 [0067.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html", pszSpec="*.mxf") returned 0 [0067.999] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc2f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0067.999] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0067.999] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="SUO", cAlternateFileName="")) returned 1 [0067.999] lstrcmpA (lpString1=".", lpString2="SUO") returned -1 [0067.999] lstrcmpA (lpString1="..", lpString2="SUO") returned -1 [0067.999] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0067.999] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="SUO" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO" [0067.999] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.000] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.000] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.000] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.000] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.000] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0068.000] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.000] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0068.000] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0068.000] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0068.000] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\*.*") returned="*.*" [0068.000] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\" [0068.000] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\") returned="" [0068.000] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\HOW TO DECRYPT FILES.txt" [0068.000] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\how to decrypt files.txt")) returned 0xffffffff [0068.000] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.001] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0068.003] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.003] CloseHandle (hObject=0x94) returned 1 [0068.003] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini" [0068.003] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.zip") returned 0 [0068.003] lstrlenA (lpString="*.zip") returned 5 [0068.003] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.rar") returned 0 [0068.003] lstrlenA (lpString="*.rar") returned 5 [0068.003] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.7z") returned 0 [0068.003] lstrlenA (lpString="*.7z") returned 4 [0068.003] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.tar") returned 0 [0068.003] lstrlenA (lpString="*.tar") returned 5 [0068.003] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.gzip") returned 0 [0068.003] lstrlenA (lpString="*.gzip") returned 6 [0068.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.jpg") returned 0 [0068.004] lstrlenA (lpString="*.jpg") returned 5 [0068.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.jpeg") returned 0 [0068.004] lstrlenA (lpString="*.jpeg") returned 6 [0068.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.psd") returned 0 [0068.004] lstrlenA (lpString="*.psd") returned 5 [0068.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.gif") returned 0 [0068.004] lstrlenA (lpString="*.gif") returned 5 [0068.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.doc") returned 0 [0068.004] lstrlenA (lpString="*.doc") returned 5 [0068.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.docx") returned 0 [0068.004] lstrlenA (lpString="*.docx") returned 6 [0068.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.xls") returned 0 [0068.004] lstrlenA (lpString="*.xls") returned 5 [0068.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.xlsx") returned 0 [0068.004] lstrlenA (lpString="*.xlsx") returned 6 [0068.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.ppt") returned 0 [0068.004] lstrlenA (lpString="*.ppt") returned 5 [0068.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.pptx") returned 0 [0068.004] lstrlenA (lpString="*.pptx") returned 6 [0068.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.pdf") returned 0 [0068.004] lstrlenA (lpString="*.pdf") returned 5 [0068.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.mov") returned 0 [0068.004] lstrlenA (lpString="*.mov") returned 5 [0068.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.m2v") returned 0 [0068.004] lstrlenA (lpString="*.m2v") returned 5 [0068.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.3gp") returned 0 [0068.005] lstrlenA (lpString="*.3gp") returned 5 [0068.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.mpeg") returned 0 [0068.005] lstrlenA (lpString="*.mpeg") returned 6 [0068.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.mpg") returned 0 [0068.005] lstrlenA (lpString="*.mpg") returned 5 [0068.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.flv") returned 0 [0068.005] lstrlenA (lpString="*.flv") returned 5 [0068.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.avi") returned 0 [0068.005] lstrlenA (lpString="*.avi") returned 5 [0068.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.mp4") returned 0 [0068.005] lstrlenA (lpString="*.mp4") returned 5 [0068.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.wmv") returned 0 [0068.005] lstrlenA (lpString="*.wmv") returned 5 [0068.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.divx") returned 0 [0068.005] lstrlenA (lpString="*.divx") returned 6 [0068.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.mkv") returned 0 [0068.005] lstrlenA (lpString="*.mkv") returned 5 [0068.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.mp3") returned 0 [0068.005] lstrlenA (lpString="*.mp3") returned 5 [0068.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.wav") returned 0 [0068.005] lstrlenA (lpString="*.wav") returned 5 [0068.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.flac") returned 0 [0068.005] lstrlenA (lpString="*.flac") returned 6 [0068.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.ape") returned 0 [0068.005] lstrlenA (lpString="*.ape") returned 5 [0068.006] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.wma") returned 0 [0068.006] lstrlenA (lpString="*.wma") returned 5 [0068.006] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.ac3") returned 0 [0068.006] lstrlenA (lpString="*.ac3") returned 5 [0068.006] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", pszSpec="*.mxf") returned 0 [0068.006] lstrlenA (lpString="*.mxf") returned 5 [0068.006] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd34f, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0068.006] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.006] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0068.006] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0068.006] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0068.006] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini") returned="eula.ini" [0068.006] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\" [0068.006] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\") returned="" [0068.006] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\HOW TO DECRYPT FILES.txt" [0068.006] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\how to decrypt files.txt")) returned 0x20 [0068.006] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html" [0068.006] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.zip") returned 0 [0068.006] lstrlenA (lpString="*.zip") returned 5 [0068.006] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.rar") returned 0 [0068.007] lstrlenA (lpString="*.rar") returned 5 [0068.007] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.7z") returned 0 [0068.007] lstrlenA (lpString="*.7z") returned 4 [0068.007] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.tar") returned 0 [0068.007] lstrlenA (lpString="*.tar") returned 5 [0068.007] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.gzip") returned 0 [0068.007] lstrlenA (lpString="*.gzip") returned 6 [0068.007] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.jpg") returned 0 [0068.007] lstrlenA (lpString="*.jpg") returned 5 [0068.007] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.jpeg") returned 0 [0068.007] lstrlenA (lpString="*.jpeg") returned 6 [0068.007] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.psd") returned 0 [0068.007] lstrlenA (lpString="*.psd") returned 5 [0068.007] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.gif") returned 0 [0068.007] lstrlenA (lpString="*.gif") returned 5 [0068.007] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.doc") returned 0 [0068.007] lstrlenA (lpString="*.doc") returned 5 [0068.007] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.docx") returned 0 [0068.007] lstrlenA (lpString="*.docx") returned 6 [0068.007] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.xls") returned 0 [0068.007] lstrlenA (lpString="*.xls") returned 5 [0068.007] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.xlsx") returned 0 [0068.007] lstrlenA (lpString="*.xlsx") returned 6 [0068.007] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.ppt") returned 0 [0068.007] lstrlenA (lpString="*.ppt") returned 5 [0068.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.pptx") returned 0 [0068.008] lstrlenA (lpString="*.pptx") returned 6 [0068.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.pdf") returned 0 [0068.008] lstrlenA (lpString="*.pdf") returned 5 [0068.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.mov") returned 0 [0068.008] lstrlenA (lpString="*.mov") returned 5 [0068.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.m2v") returned 0 [0068.008] lstrlenA (lpString="*.m2v") returned 5 [0068.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.3gp") returned 0 [0068.008] lstrlenA (lpString="*.3gp") returned 5 [0068.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.mpeg") returned 0 [0068.008] lstrlenA (lpString="*.mpeg") returned 6 [0068.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.mpg") returned 0 [0068.008] lstrlenA (lpString="*.mpg") returned 5 [0068.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.flv") returned 0 [0068.008] lstrlenA (lpString="*.flv") returned 5 [0068.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.avi") returned 0 [0068.008] lstrlenA (lpString="*.avi") returned 5 [0068.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.mp4") returned 0 [0068.008] lstrlenA (lpString="*.mp4") returned 5 [0068.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.wmv") returned 0 [0068.008] lstrlenA (lpString="*.wmv") returned 5 [0068.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.divx") returned 0 [0068.008] lstrlenA (lpString="*.divx") returned 6 [0068.008] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.mkv") returned 0 [0068.009] lstrlenA (lpString="*.mkv") returned 5 [0068.009] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.mp3") returned 0 [0068.009] lstrlenA (lpString="*.mp3") returned 5 [0068.009] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.wav") returned 0 [0068.009] lstrlenA (lpString="*.wav") returned 5 [0068.009] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.flac") returned 0 [0068.009] lstrlenA (lpString="*.flac") returned 6 [0068.009] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.ape") returned 0 [0068.009] lstrlenA (lpString="*.ape") returned 5 [0068.009] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.wma") returned 0 [0068.009] lstrlenA (lpString="*.wma") returned 5 [0068.009] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.ac3") returned 0 [0068.009] lstrlenA (lpString="*.ac3") returned 5 [0068.009] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", pszSpec="*.mxf") returned 0 [0068.009] lstrlenA (lpString="*.mxf") returned 5 [0068.009] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd34f, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0068.009] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0068.009] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="SVE", cAlternateFileName="")) returned 1 [0068.009] lstrcmpA (lpString1=".", lpString2="SVE") returned -1 [0068.009] lstrcmpA (lpString1="..", lpString2="SVE") returned -1 [0068.009] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0068.009] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="SVE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE" [0068.009] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE") returned 57 [0068.010] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.010] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.010] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.010] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.010] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.010] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3f6, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0068.010] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.010] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0068.010] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0068.010] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0068.011] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\*.*") returned="*.*" [0068.011] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\" [0068.011] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\") returned="" [0068.011] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\HOW TO DECRYPT FILES.txt" [0068.011] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\how to decrypt files.txt")) returned 0xffffffff [0068.011] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.012] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0068.012] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0068.013] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.013] CloseHandle (hObject=0x94) returned 1 [0068.014] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini" [0068.014] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.zip") returned 0 [0068.014] lstrlenA (lpString="*.zip") returned 5 [0068.014] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.rar") returned 0 [0068.014] lstrlenA (lpString="*.rar") returned 5 [0068.014] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.7z") returned 0 [0068.014] lstrlenA (lpString="*.7z") returned 4 [0068.014] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.tar") returned 0 [0068.014] lstrlenA (lpString="*.tar") returned 5 [0068.014] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.gzip") returned 0 [0068.014] lstrlenA (lpString="*.gzip") returned 6 [0068.014] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.jpg") returned 0 [0068.014] lstrlenA (lpString="*.jpg") returned 5 [0068.014] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.jpeg") returned 0 [0068.014] lstrlenA (lpString="*.jpeg") returned 6 [0068.014] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.psd") returned 0 [0068.014] lstrlenA (lpString="*.psd") returned 5 [0068.014] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.gif") returned 0 [0068.014] lstrlenA (lpString="*.gif") returned 5 [0068.014] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.doc") returned 0 [0068.014] lstrlenA (lpString="*.doc") returned 5 [0068.014] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.docx") returned 0 [0068.014] lstrlenA (lpString="*.docx") returned 6 [0068.014] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.xls") returned 0 [0068.014] lstrlenA (lpString="*.xls") returned 5 [0068.015] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.xlsx") returned 0 [0068.015] lstrlenA (lpString="*.xlsx") returned 6 [0068.015] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.ppt") returned 0 [0068.015] lstrlenA (lpString="*.ppt") returned 5 [0068.015] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.pptx") returned 0 [0068.015] lstrlenA (lpString="*.pptx") returned 6 [0068.015] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.pdf") returned 0 [0068.015] lstrlenA (lpString="*.pdf") returned 5 [0068.015] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.mov") returned 0 [0068.015] lstrlenA (lpString="*.mov") returned 5 [0068.015] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.m2v") returned 0 [0068.015] lstrlenA (lpString="*.m2v") returned 5 [0068.015] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.3gp") returned 0 [0068.015] lstrlenA (lpString="*.3gp") returned 5 [0068.015] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.mpeg") returned 0 [0068.015] lstrlenA (lpString="*.mpeg") returned 6 [0068.015] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.mpg") returned 0 [0068.015] lstrlenA (lpString="*.mpg") returned 5 [0068.015] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.flv") returned 0 [0068.015] lstrlenA (lpString="*.flv") returned 5 [0068.015] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.avi") returned 0 [0068.015] lstrlenA (lpString="*.avi") returned 5 [0068.015] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.mp4") returned 0 [0068.015] lstrlenA (lpString="*.mp4") returned 5 [0068.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.wmv") returned 0 [0068.016] lstrlenA (lpString="*.wmv") returned 5 [0068.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.divx") returned 0 [0068.016] lstrlenA (lpString="*.divx") returned 6 [0068.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.mkv") returned 0 [0068.016] lstrlenA (lpString="*.mkv") returned 5 [0068.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.mp3") returned 0 [0068.016] lstrlenA (lpString="*.mp3") returned 5 [0068.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.wav") returned 0 [0068.016] lstrlenA (lpString="*.wav") returned 5 [0068.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.flac") returned 0 [0068.016] lstrlenA (lpString="*.flac") returned 6 [0068.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.ape") returned 0 [0068.016] lstrlenA (lpString="*.ape") returned 5 [0068.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.wma") returned 0 [0068.016] lstrlenA (lpString="*.wma") returned 5 [0068.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.ac3") returned 0 [0068.016] lstrlenA (lpString="*.ac3") returned 5 [0068.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", pszSpec="*.mxf") returned 0 [0068.016] lstrlenA (lpString="*.mxf") returned 5 [0068.016] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc8bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0068.016] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.016] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0068.016] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0068.016] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0068.017] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini") returned="eula.ini" [0068.017] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\" [0068.017] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\") returned="" [0068.017] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\HOW TO DECRYPT FILES.txt" [0068.017] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\how to decrypt files.txt")) returned 0x20 [0068.017] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html" [0068.017] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.zip") returned 0 [0068.017] lstrlenA (lpString="*.zip") returned 5 [0068.017] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.rar") returned 0 [0068.017] lstrlenA (lpString="*.rar") returned 5 [0068.017] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.7z") returned 0 [0068.017] lstrlenA (lpString="*.7z") returned 4 [0068.017] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.tar") returned 0 [0068.017] lstrlenA (lpString="*.tar") returned 5 [0068.017] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.gzip") returned 0 [0068.017] lstrlenA (lpString="*.gzip") returned 6 [0068.017] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.jpg") returned 0 [0068.017] lstrlenA (lpString="*.jpg") returned 5 [0068.017] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.jpeg") returned 0 [0068.017] lstrlenA (lpString="*.jpeg") returned 6 [0068.017] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.psd") returned 0 [0068.017] lstrlenA (lpString="*.psd") returned 5 [0068.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.gif") returned 0 [0068.018] lstrlenA (lpString="*.gif") returned 5 [0068.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.doc") returned 0 [0068.018] lstrlenA (lpString="*.doc") returned 5 [0068.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.docx") returned 0 [0068.018] lstrlenA (lpString="*.docx") returned 6 [0068.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.xls") returned 0 [0068.018] lstrlenA (lpString="*.xls") returned 5 [0068.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.xlsx") returned 0 [0068.018] lstrlenA (lpString="*.xlsx") returned 6 [0068.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.ppt") returned 0 [0068.018] lstrlenA (lpString="*.ppt") returned 5 [0068.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.pptx") returned 0 [0068.018] lstrlenA (lpString="*.pptx") returned 6 [0068.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.pdf") returned 0 [0068.018] lstrlenA (lpString="*.pdf") returned 5 [0068.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.mov") returned 0 [0068.018] lstrlenA (lpString="*.mov") returned 5 [0068.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.m2v") returned 0 [0068.018] lstrlenA (lpString="*.m2v") returned 5 [0068.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.3gp") returned 0 [0068.018] lstrlenA (lpString="*.3gp") returned 5 [0068.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.mpeg") returned 0 [0068.018] lstrlenA (lpString="*.mpeg") returned 6 [0068.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.mpg") returned 0 [0068.018] lstrlenA (lpString="*.mpg") returned 5 [0068.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.flv") returned 0 [0068.019] lstrlenA (lpString="*.flv") returned 5 [0068.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.avi") returned 0 [0068.019] lstrlenA (lpString="*.avi") returned 5 [0068.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.mp4") returned 0 [0068.019] lstrlenA (lpString="*.mp4") returned 5 [0068.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.wmv") returned 0 [0068.019] lstrlenA (lpString="*.wmv") returned 5 [0068.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.divx") returned 0 [0068.019] lstrlenA (lpString="*.divx") returned 6 [0068.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.mkv") returned 0 [0068.019] lstrlenA (lpString="*.mkv") returned 5 [0068.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.mp3") returned 0 [0068.019] lstrlenA (lpString="*.mp3") returned 5 [0068.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.wav") returned 0 [0068.019] lstrlenA (lpString="*.wav") returned 5 [0068.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.flac") returned 0 [0068.019] lstrlenA (lpString="*.flac") returned 6 [0068.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.ape") returned 0 [0068.019] lstrlenA (lpString="*.ape") returned 5 [0068.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.wma") returned 0 [0068.019] lstrlenA (lpString="*.wma") returned 5 [0068.019] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.ac3") returned 0 [0068.019] lstrlenA (lpString="*.ac3") returned 5 [0068.020] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", pszSpec="*.mxf") returned 0 [0068.020] lstrlenA (lpString="*.mxf") returned 5 [0068.020] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc8bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0068.020] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0068.020] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="TUR", cAlternateFileName="")) returned 1 [0068.020] lstrcmpA (lpString1=".", lpString2="TUR") returned -1 [0068.020] lstrcmpA (lpString1="..", lpString2="TUR") returned -1 [0068.020] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0068.020] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="TUR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR" [0068.020] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR") returned 57 [0068.020] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.023] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.023] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.023] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.023] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.023] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41e, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0068.023] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.023] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0068.023] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0068.023] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0068.023] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\*.*") returned="*.*" [0068.023] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\" [0068.023] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\") returned="" [0068.023] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\HOW TO DECRYPT FILES.txt" [0068.023] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\tur\\how to decrypt files.txt")) returned 0xffffffff [0068.024] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\tur\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.025] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0068.025] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0068.026] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.026] CloseHandle (hObject=0x94) returned 1 [0068.026] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini" [0068.026] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.zip") returned 0 [0068.026] lstrlenA (lpString="*.zip") returned 5 [0068.026] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.rar") returned 0 [0068.026] lstrlenA (lpString="*.rar") returned 5 [0068.026] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.7z") returned 0 [0068.026] lstrlenA (lpString="*.7z") returned 4 [0068.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.tar") returned 0 [0068.027] lstrlenA (lpString="*.tar") returned 5 [0068.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.gzip") returned 0 [0068.027] lstrlenA (lpString="*.gzip") returned 6 [0068.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.jpg") returned 0 [0068.027] lstrlenA (lpString="*.jpg") returned 5 [0068.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.jpeg") returned 0 [0068.027] lstrlenA (lpString="*.jpeg") returned 6 [0068.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.psd") returned 0 [0068.027] lstrlenA (lpString="*.psd") returned 5 [0068.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.gif") returned 0 [0068.027] lstrlenA (lpString="*.gif") returned 5 [0068.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.doc") returned 0 [0068.027] lstrlenA (lpString="*.doc") returned 5 [0068.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.docx") returned 0 [0068.027] lstrlenA (lpString="*.docx") returned 6 [0068.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.xls") returned 0 [0068.027] lstrlenA (lpString="*.xls") returned 5 [0068.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.xlsx") returned 0 [0068.027] lstrlenA (lpString="*.xlsx") returned 6 [0068.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.ppt") returned 0 [0068.027] lstrlenA (lpString="*.ppt") returned 5 [0068.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.pptx") returned 0 [0068.027] lstrlenA (lpString="*.pptx") returned 6 [0068.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.pdf") returned 0 [0068.028] lstrlenA (lpString="*.pdf") returned 5 [0068.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.mov") returned 0 [0068.028] lstrlenA (lpString="*.mov") returned 5 [0068.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.m2v") returned 0 [0068.028] lstrlenA (lpString="*.m2v") returned 5 [0068.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.3gp") returned 0 [0068.028] lstrlenA (lpString="*.3gp") returned 5 [0068.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.mpeg") returned 0 [0068.028] lstrlenA (lpString="*.mpeg") returned 6 [0068.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.mpg") returned 0 [0068.028] lstrlenA (lpString="*.mpg") returned 5 [0068.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.flv") returned 0 [0068.028] lstrlenA (lpString="*.flv") returned 5 [0068.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.avi") returned 0 [0068.028] lstrlenA (lpString="*.avi") returned 5 [0068.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.mp4") returned 0 [0068.028] lstrlenA (lpString="*.mp4") returned 5 [0068.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.wmv") returned 0 [0068.028] lstrlenA (lpString="*.wmv") returned 5 [0068.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.divx") returned 0 [0068.028] lstrlenA (lpString="*.divx") returned 6 [0068.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.mkv") returned 0 [0068.028] lstrlenA (lpString="*.mkv") returned 5 [0068.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.mp3") returned 0 [0068.028] lstrlenA (lpString="*.mp3") returned 5 [0068.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.wav") returned 0 [0068.029] lstrlenA (lpString="*.wav") returned 5 [0068.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.flac") returned 0 [0068.029] lstrlenA (lpString="*.flac") returned 6 [0068.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.ape") returned 0 [0068.029] lstrlenA (lpString="*.ape") returned 5 [0068.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.wma") returned 0 [0068.029] lstrlenA (lpString="*.wma") returned 5 [0068.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.ac3") returned 0 [0068.029] lstrlenA (lpString="*.ac3") returned 5 [0068.029] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini", pszSpec="*.mxf") returned 0 [0068.029] lstrlenA (lpString="*.mxf") returned 5 [0068.029] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfa69, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0068.029] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.029] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0068.029] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0068.029] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0068.029] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini") returned="eula.ini" [0068.029] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\" [0068.029] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\") returned="" [0068.029] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\HOW TO DECRYPT FILES.txt" [0068.029] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\tur\\how to decrypt files.txt")) returned 0x20 [0068.029] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html" [0068.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.zip") returned 0 [0068.030] lstrlenA (lpString="*.zip") returned 5 [0068.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.rar") returned 0 [0068.030] lstrlenA (lpString="*.rar") returned 5 [0068.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.7z") returned 0 [0068.030] lstrlenA (lpString="*.7z") returned 4 [0068.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.tar") returned 0 [0068.030] lstrlenA (lpString="*.tar") returned 5 [0068.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.gzip") returned 0 [0068.030] lstrlenA (lpString="*.gzip") returned 6 [0068.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.jpg") returned 0 [0068.030] lstrlenA (lpString="*.jpg") returned 5 [0068.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.jpeg") returned 0 [0068.030] lstrlenA (lpString="*.jpeg") returned 6 [0068.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.psd") returned 0 [0068.030] lstrlenA (lpString="*.psd") returned 5 [0068.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.gif") returned 0 [0068.030] lstrlenA (lpString="*.gif") returned 5 [0068.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.doc") returned 0 [0068.030] lstrlenA (lpString="*.doc") returned 5 [0068.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.docx") returned 0 [0068.030] lstrlenA (lpString="*.docx") returned 6 [0068.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.xls") returned 0 [0068.030] lstrlenA (lpString="*.xls") returned 5 [0068.030] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.xlsx") returned 0 [0068.030] lstrlenA (lpString="*.xlsx") returned 6 [0068.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.ppt") returned 0 [0068.031] lstrlenA (lpString="*.ppt") returned 5 [0068.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.pptx") returned 0 [0068.031] lstrlenA (lpString="*.pptx") returned 6 [0068.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.pdf") returned 0 [0068.031] lstrlenA (lpString="*.pdf") returned 5 [0068.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.mov") returned 0 [0068.031] lstrlenA (lpString="*.mov") returned 5 [0068.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.m2v") returned 0 [0068.031] lstrlenA (lpString="*.m2v") returned 5 [0068.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.3gp") returned 0 [0068.031] lstrlenA (lpString="*.3gp") returned 5 [0068.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.mpeg") returned 0 [0068.031] lstrlenA (lpString="*.mpeg") returned 6 [0068.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.mpg") returned 0 [0068.031] lstrlenA (lpString="*.mpg") returned 5 [0068.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.flv") returned 0 [0068.031] lstrlenA (lpString="*.flv") returned 5 [0068.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.avi") returned 0 [0068.031] lstrlenA (lpString="*.avi") returned 5 [0068.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.mp4") returned 0 [0068.031] lstrlenA (lpString="*.mp4") returned 5 [0068.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.wmv") returned 0 [0068.031] lstrlenA (lpString="*.wmv") returned 5 [0068.031] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.divx") returned 0 [0068.031] lstrlenA (lpString="*.divx") returned 6 [0068.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.mkv") returned 0 [0068.032] lstrlenA (lpString="*.mkv") returned 5 [0068.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.mp3") returned 0 [0068.032] lstrlenA (lpString="*.mp3") returned 5 [0068.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.wav") returned 0 [0068.032] lstrlenA (lpString="*.wav") returned 5 [0068.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.flac") returned 0 [0068.032] lstrlenA (lpString="*.flac") returned 6 [0068.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.ape") returned 0 [0068.032] lstrlenA (lpString="*.ape") returned 5 [0068.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.wma") returned 0 [0068.032] lstrlenA (lpString="*.wma") returned 5 [0068.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.ac3") returned 0 [0068.032] lstrlenA (lpString="*.ac3") returned 5 [0068.032] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html", pszSpec="*.mxf") returned 0 [0068.032] lstrlenA (lpString="*.mxf") returned 5 [0068.032] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfa69, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0068.032] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0068.032] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="UKR", cAlternateFileName="")) returned 1 [0068.032] lstrcmpA (lpString1=".", lpString2="UKR") returned -1 [0068.032] lstrcmpA (lpString1="..", lpString2="UKR") returned -1 [0068.032] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*") returned="*.*" [0068.032] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\", lpString2="UKR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR" [0068.032] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR") returned 57 [0068.033] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.033] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.033] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.033] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.033] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.033] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0068.033] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.033] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eula.ini") returned -1 [0068.033] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula.ini") returned 1 [0068.033] lstrcmpiA (lpString1="", lpString2="eula.ini") returned -1 [0068.033] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\*.*") returned="*.*" [0068.033] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\" [0068.033] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\") returned="" [0068.033] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\HOW TO DECRYPT FILES.txt" [0068.033] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ukr\\how to decrypt files.txt")) returned 0xffffffff [0068.034] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ukr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.035] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0068.035] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0068.036] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.036] CloseHandle (hObject=0x94) returned 1 [0068.036] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\", lpString2="eula.ini" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini" [0068.036] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.zip") returned 0 [0068.036] lstrlenA (lpString="*.zip") returned 5 [0068.036] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.rar") returned 0 [0068.036] lstrlenA (lpString="*.rar") returned 5 [0068.036] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.7z") returned 0 [0068.036] lstrlenA (lpString="*.7z") returned 4 [0068.036] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.tar") returned 0 [0068.036] lstrlenA (lpString="*.tar") returned 5 [0068.036] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.gzip") returned 0 [0068.036] lstrlenA (lpString="*.gzip") returned 6 [0068.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.jpg") returned 0 [0068.037] lstrlenA (lpString="*.jpg") returned 5 [0068.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.jpeg") returned 0 [0068.037] lstrlenA (lpString="*.jpeg") returned 6 [0068.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.psd") returned 0 [0068.037] lstrlenA (lpString="*.psd") returned 5 [0068.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.gif") returned 0 [0068.037] lstrlenA (lpString="*.gif") returned 5 [0068.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.doc") returned 0 [0068.037] lstrlenA (lpString="*.doc") returned 5 [0068.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.docx") returned 0 [0068.037] lstrlenA (lpString="*.docx") returned 6 [0068.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.xls") returned 0 [0068.037] lstrlenA (lpString="*.xls") returned 5 [0068.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.xlsx") returned 0 [0068.037] lstrlenA (lpString="*.xlsx") returned 6 [0068.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.ppt") returned 0 [0068.037] lstrlenA (lpString="*.ppt") returned 5 [0068.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.pptx") returned 0 [0068.037] lstrlenA (lpString="*.pptx") returned 6 [0068.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.pdf") returned 0 [0068.037] lstrlenA (lpString="*.pdf") returned 5 [0068.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.mov") returned 0 [0068.037] lstrlenA (lpString="*.mov") returned 5 [0068.037] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.m2v") returned 0 [0068.038] lstrlenA (lpString="*.m2v") returned 5 [0068.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.3gp") returned 0 [0068.038] lstrlenA (lpString="*.3gp") returned 5 [0068.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.mpeg") returned 0 [0068.038] lstrlenA (lpString="*.mpeg") returned 6 [0068.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.mpg") returned 0 [0068.038] lstrlenA (lpString="*.mpg") returned 5 [0068.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.flv") returned 0 [0068.038] lstrlenA (lpString="*.flv") returned 5 [0068.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.avi") returned 0 [0068.038] lstrlenA (lpString="*.avi") returned 5 [0068.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.mp4") returned 0 [0068.038] lstrlenA (lpString="*.mp4") returned 5 [0068.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.wmv") returned 0 [0068.038] lstrlenA (lpString="*.wmv") returned 5 [0068.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.divx") returned 0 [0068.038] lstrlenA (lpString="*.divx") returned 6 [0068.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.mkv") returned 0 [0068.038] lstrlenA (lpString="*.mkv") returned 5 [0068.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.mp3") returned 0 [0068.038] lstrlenA (lpString="*.mp3") returned 5 [0068.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.wav") returned 0 [0068.038] lstrlenA (lpString="*.wav") returned 5 [0068.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.flac") returned 0 [0068.038] lstrlenA (lpString="*.flac") returned 6 [0068.038] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.ape") returned 0 [0068.039] lstrlenA (lpString="*.ape") returned 5 [0068.039] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.wma") returned 0 [0068.039] lstrlenA (lpString="*.wma") returned 5 [0068.039] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.ac3") returned 0 [0068.039] lstrlenA (lpString="*.ac3") returned 5 [0068.039] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini", pszSpec="*.mxf") returned 0 [0068.039] lstrlenA (lpString="*.mxf") returned 5 [0068.039] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3a6af, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0068.039] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.039] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="license.html") returned -1 [0068.039] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="license.html") returned -1 [0068.039] lstrcmpiA (lpString1="", lpString2="license.html") returned -1 [0068.039] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini") returned="eula.ini" [0068.039] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\" [0068.039] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\") returned="" [0068.039] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\HOW TO DECRYPT FILES.txt" [0068.039] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ukr\\how to decrypt files.txt")) returned 0x20 [0068.039] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\", lpString2="license.html" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html" [0068.039] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.zip") returned 0 [0068.039] lstrlenA (lpString="*.zip") returned 5 [0068.039] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.rar") returned 0 [0068.039] lstrlenA (lpString="*.rar") returned 5 [0068.039] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.7z") returned 0 [0068.040] lstrlenA (lpString="*.7z") returned 4 [0068.040] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.tar") returned 0 [0068.040] lstrlenA (lpString="*.tar") returned 5 [0068.040] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.gzip") returned 0 [0068.040] lstrlenA (lpString="*.gzip") returned 6 [0068.040] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.jpg") returned 0 [0068.040] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.jpeg") returned 0 [0068.040] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.psd") returned 0 [0068.040] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.gif") returned 0 [0068.040] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.doc") returned 0 [0068.040] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.docx") returned 0 [0068.040] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.xls") returned 0 [0068.040] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.xlsx") returned 0 [0068.040] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.ppt") returned 0 [0068.040] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.pptx") returned 0 [0068.040] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.pdf") returned 0 [0068.040] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.mov") returned 0 [0068.040] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.m2v") returned 0 [0068.040] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.3gp") returned 0 [0068.040] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.mpeg") returned 0 [0068.040] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.mpg") returned 0 [0068.041] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.flv") returned 0 [0068.041] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.avi") returned 0 [0068.041] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.mp4") returned 0 [0068.041] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.wmv") returned 0 [0068.041] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.divx") returned 0 [0068.041] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.mkv") returned 0 [0068.041] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.mp3") returned 0 [0068.041] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.wav") returned 0 [0068.041] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.flac") returned 0 [0068.041] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.ape") returned 0 [0068.041] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.wma") returned 0 [0068.041] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.ac3") returned 0 [0068.041] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html", pszSpec="*.mxf") returned 0 [0068.041] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3a6af, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0068.041] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0068.041] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="UKR", cAlternateFileName="")) returned 0 [0068.041] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0068.042] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65004c, dwReserved1=0x3, cFileName="Locale", cAlternateFileName="")) returned 1 [0068.042] lstrcmpA (lpString1=".", lpString2="Locale") returned -1 [0068.042] lstrcmpA (lpString1="..", lpString2="Locale") returned -1 [0068.042] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\*.*") returned="*.*" [0068.042] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\", lpString2="Locale" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0068.042] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0068.061] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.061] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.061] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.061] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.061] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ca_ES", cAlternateFileName="")) returned 1 [0068.061] lstrcmpA (lpString1=".", lpString2="ca_ES") returned -1 [0068.061] lstrcmpA (lpString1="..", lpString2="ca_ES") returned -1 [0068.061] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*.*") returned="*.*" [0068.061] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\", lpString2="ca_ES" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0068.061] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d7ee8, dwReserved1=0x2d7ee3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.064] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.064] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0068.064] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.064] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.064] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="accessibility.CAT", cAlternateFileName="ACCESS~1.CAT")) returned 1 [0068.064] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.064] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="accessibility.CAT") returned 1 [0068.064] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="accessibility.CAT") returned 1 [0068.064] lstrcmpiA (lpString1="", lpString2="accessibility.CAT") returned -1 [0068.064] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\*.*") returned="*.*" [0068.064] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0068.064] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0068.065] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0068.065] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0xffffffff [0068.065] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.066] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0068.067] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.067] CloseHandle (hObject=0x94) returned 1 [0068.067] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="accessibility.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT" [0068.067] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.zip") returned 0 [0068.068] lstrlenA (lpString="*.zip") returned 5 [0068.068] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.rar") returned 0 [0068.068] lstrlenA (lpString="*.rar") returned 5 [0068.068] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.7z") returned 0 [0068.068] lstrlenA (lpString="*.7z") returned 4 [0068.068] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.tar") returned 0 [0068.068] lstrlenA (lpString="*.tar") returned 5 [0068.068] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.gzip") returned 0 [0068.068] lstrlenA (lpString="*.gzip") returned 6 [0068.068] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.jpg") returned 0 [0068.068] lstrlenA (lpString="*.jpg") returned 5 [0068.068] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.jpeg") returned 0 [0068.068] lstrlenA (lpString="*.jpeg") returned 6 [0068.068] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.psd") returned 0 [0068.068] lstrlenA (lpString="*.psd") returned 5 [0068.068] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.gif") returned 0 [0068.068] lstrlenA (lpString="*.gif") returned 5 [0068.068] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.doc") returned 0 [0068.068] lstrlenA (lpString="*.doc") returned 5 [0068.068] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.docx") returned 0 [0068.068] lstrlenA (lpString="*.docx") returned 6 [0068.068] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.xls") returned 0 [0068.068] lstrlenA (lpString="*.xls") returned 5 [0068.068] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.xlsx") returned 0 [0068.068] lstrlenA (lpString="*.xlsx") returned 6 [0068.068] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.ppt") returned 0 [0068.068] lstrlenA (lpString="*.ppt") returned 5 [0068.069] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.pptx") returned 0 [0068.069] lstrlenA (lpString="*.pptx") returned 6 [0068.069] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.pdf") returned 0 [0068.069] lstrlenA (lpString="*.pdf") returned 5 [0068.069] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.mov") returned 0 [0068.069] lstrlenA (lpString="*.mov") returned 5 [0068.069] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.m2v") returned 0 [0068.069] lstrlenA (lpString="*.m2v") returned 5 [0068.069] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.3gp") returned 0 [0068.069] lstrlenA (lpString="*.3gp") returned 5 [0068.069] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.mpeg") returned 0 [0068.069] lstrlenA (lpString="*.mpeg") returned 6 [0068.069] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.mpg") returned 0 [0068.069] lstrlenA (lpString="*.mpg") returned 5 [0068.069] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.flv") returned 0 [0068.069] lstrlenA (lpString="*.flv") returned 5 [0068.069] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.avi") returned 0 [0068.069] lstrlenA (lpString="*.avi") returned 5 [0068.069] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.mp4") returned 0 [0068.069] lstrlenA (lpString="*.mp4") returned 5 [0068.069] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.wmv") returned 0 [0068.069] lstrlenA (lpString="*.wmv") returned 5 [0068.069] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.divx") returned 0 [0068.069] lstrlenA (lpString="*.divx") returned 6 [0068.069] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.mkv") returned 0 [0068.069] lstrlenA (lpString="*.mkv") returned 5 [0068.069] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.mp3") returned 0 [0068.070] lstrlenA (lpString="*.mp3") returned 5 [0068.070] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.wav") returned 0 [0068.070] lstrlenA (lpString="*.wav") returned 5 [0068.070] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.flac") returned 0 [0068.070] lstrlenA (lpString="*.flac") returned 6 [0068.070] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.ape") returned 0 [0068.070] lstrlenA (lpString="*.ape") returned 5 [0068.070] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.wma") returned 0 [0068.070] lstrlenA (lpString="*.wma") returned 5 [0068.070] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.ac3") returned 0 [0068.070] lstrlenA (lpString="*.ac3") returned 5 [0068.070] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT", pszSpec="*.mxf") returned 0 [0068.070] lstrlenA (lpString="*.mxf") returned 5 [0068.070] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6dc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.CAT", cAlternateFileName="")) returned 1 [0068.070] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.070] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Acroform.CAT") returned 1 [0068.070] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Acroform.CAT") returned 1 [0068.070] lstrcmpiA (lpString1="", lpString2="Acroform.CAT") returned -1 [0068.070] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\accessibility.CAT") returned="accessibility.CAT" [0068.070] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0068.070] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0068.070] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0068.070] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0068.071] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="Acroform.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT" [0068.071] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.zip") returned 0 [0068.071] lstrlenA (lpString="*.zip") returned 5 [0068.071] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.rar") returned 0 [0068.071] lstrlenA (lpString="*.rar") returned 5 [0068.071] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.7z") returned 0 [0068.071] lstrlenA (lpString="*.7z") returned 4 [0068.071] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.tar") returned 0 [0068.071] lstrlenA (lpString="*.tar") returned 5 [0068.071] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.gzip") returned 0 [0068.071] lstrlenA (lpString="*.gzip") returned 6 [0068.071] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.jpg") returned 0 [0068.071] lstrlenA (lpString="*.jpg") returned 5 [0068.071] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.jpeg") returned 0 [0068.071] lstrlenA (lpString="*.jpeg") returned 6 [0068.071] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.psd") returned 0 [0068.071] lstrlenA (lpString="*.psd") returned 5 [0068.071] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.gif") returned 0 [0068.071] lstrlenA (lpString="*.gif") returned 5 [0068.071] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.doc") returned 0 [0068.071] lstrlenA (lpString="*.doc") returned 5 [0068.071] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.docx") returned 0 [0068.071] lstrlenA (lpString="*.docx") returned 6 [0068.071] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.xls") returned 0 [0068.071] lstrlenA (lpString="*.xls") returned 5 [0068.071] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.xlsx") returned 0 [0068.071] lstrlenA (lpString="*.xlsx") returned 6 [0068.071] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.ppt") returned 0 [0068.072] lstrlenA (lpString="*.ppt") returned 5 [0068.072] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.pptx") returned 0 [0068.072] lstrlenA (lpString="*.pptx") returned 6 [0068.072] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.pdf") returned 0 [0068.072] lstrlenA (lpString="*.pdf") returned 5 [0068.072] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.mov") returned 0 [0068.072] lstrlenA (lpString="*.mov") returned 5 [0068.072] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.m2v") returned 0 [0068.072] lstrlenA (lpString="*.m2v") returned 5 [0068.072] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.3gp") returned 0 [0068.072] lstrlenA (lpString="*.3gp") returned 5 [0068.072] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.mpeg") returned 0 [0068.072] lstrlenA (lpString="*.mpeg") returned 6 [0068.072] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.mpg") returned 0 [0068.072] lstrlenA (lpString="*.mpg") returned 5 [0068.072] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.flv") returned 0 [0068.072] lstrlenA (lpString="*.flv") returned 5 [0068.072] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.avi") returned 0 [0068.072] lstrlenA (lpString="*.avi") returned 5 [0068.072] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.mp4") returned 0 [0068.072] lstrlenA (lpString="*.mp4") returned 5 [0068.072] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.wmv") returned 0 [0068.072] lstrlenA (lpString="*.wmv") returned 5 [0068.072] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.divx") returned 0 [0068.072] lstrlenA (lpString="*.divx") returned 6 [0068.072] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.mkv") returned 0 [0068.072] lstrlenA (lpString="*.mkv") returned 5 [0068.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.mp3") returned 0 [0068.073] lstrlenA (lpString="*.mp3") returned 5 [0068.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.wav") returned 0 [0068.073] lstrlenA (lpString="*.wav") returned 5 [0068.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.flac") returned 0 [0068.073] lstrlenA (lpString="*.flac") returned 6 [0068.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.ape") returned 0 [0068.073] lstrlenA (lpString="*.ape") returned 5 [0068.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.wma") returned 0 [0068.073] lstrlenA (lpString="*.wma") returned 5 [0068.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.ac3") returned 0 [0068.073] lstrlenA (lpString="*.ac3") returned 5 [0068.073] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT", pszSpec="*.mxf") returned 0 [0068.073] lstrlenA (lpString="*.mxf") returned 5 [0068.073] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="AdobeCollabSync.CAT", cAlternateFileName="ADOBEC~1.CAT")) returned 1 [0068.073] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.073] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeCollabSync.CAT") returned 1 [0068.073] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeCollabSync.CAT") returned 1 [0068.073] lstrcmpiA (lpString1="", lpString2="AdobeCollabSync.CAT") returned -1 [0068.073] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Acroform.CAT") returned="Acroform.CAT" [0068.073] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0068.073] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0068.073] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0068.073] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0068.074] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="AdobeCollabSync.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT" [0068.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.zip") returned 0 [0068.074] lstrlenA (lpString="*.zip") returned 5 [0068.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.rar") returned 0 [0068.074] lstrlenA (lpString="*.rar") returned 5 [0068.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.7z") returned 0 [0068.074] lstrlenA (lpString="*.7z") returned 4 [0068.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.tar") returned 0 [0068.074] lstrlenA (lpString="*.tar") returned 5 [0068.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.gzip") returned 0 [0068.074] lstrlenA (lpString="*.gzip") returned 6 [0068.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.jpg") returned 0 [0068.074] lstrlenA (lpString="*.jpg") returned 5 [0068.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.jpeg") returned 0 [0068.074] lstrlenA (lpString="*.jpeg") returned 6 [0068.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.psd") returned 0 [0068.074] lstrlenA (lpString="*.psd") returned 5 [0068.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.gif") returned 0 [0068.074] lstrlenA (lpString="*.gif") returned 5 [0068.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.doc") returned 0 [0068.074] lstrlenA (lpString="*.doc") returned 5 [0068.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.docx") returned 0 [0068.074] lstrlenA (lpString="*.docx") returned 6 [0068.074] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.xls") returned 0 [0068.074] lstrlenA (lpString="*.xls") returned 5 [0068.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.xlsx") returned 0 [0068.075] lstrlenA (lpString="*.xlsx") returned 6 [0068.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.ppt") returned 0 [0068.075] lstrlenA (lpString="*.ppt") returned 5 [0068.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.pptx") returned 0 [0068.075] lstrlenA (lpString="*.pptx") returned 6 [0068.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.pdf") returned 0 [0068.075] lstrlenA (lpString="*.pdf") returned 5 [0068.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.mov") returned 0 [0068.075] lstrlenA (lpString="*.mov") returned 5 [0068.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.m2v") returned 0 [0068.075] lstrlenA (lpString="*.m2v") returned 5 [0068.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.3gp") returned 0 [0068.075] lstrlenA (lpString="*.3gp") returned 5 [0068.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.mpeg") returned 0 [0068.075] lstrlenA (lpString="*.mpeg") returned 6 [0068.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.mpg") returned 0 [0068.075] lstrlenA (lpString="*.mpg") returned 5 [0068.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.flv") returned 0 [0068.075] lstrlenA (lpString="*.flv") returned 5 [0068.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.avi") returned 0 [0068.075] lstrlenA (lpString="*.avi") returned 5 [0068.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.mp4") returned 0 [0068.075] lstrlenA (lpString="*.mp4") returned 5 [0068.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.wmv") returned 0 [0068.075] lstrlenA (lpString="*.wmv") returned 5 [0068.075] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.divx") returned 0 [0068.075] lstrlenA (lpString="*.divx") returned 6 [0068.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.mkv") returned 0 [0068.076] lstrlenA (lpString="*.mkv") returned 5 [0068.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.mp3") returned 0 [0068.076] lstrlenA (lpString="*.mp3") returned 5 [0068.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.wav") returned 0 [0068.076] lstrlenA (lpString="*.wav") returned 5 [0068.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.flac") returned 0 [0068.076] lstrlenA (lpString="*.flac") returned 6 [0068.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.ape") returned 0 [0068.076] lstrlenA (lpString="*.ape") returned 5 [0068.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.wma") returned 0 [0068.076] lstrlenA (lpString="*.wma") returned 5 [0068.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.ac3") returned 0 [0068.076] lstrlenA (lpString="*.ac3") returned 5 [0068.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT", pszSpec="*.mxf") returned 0 [0068.076] lstrlenA (lpString="*.mxf") returned 5 [0068.076] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7d400, dwReserved0=0x74, dwReserved1=0x0, cFileName="Annots.CAT", cAlternateFileName="")) returned 1 [0068.076] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.076] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Annots.CAT") returned 1 [0068.076] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Annots.CAT") returned 1 [0068.076] lstrcmpiA (lpString1="", lpString2="Annots.CAT") returned -1 [0068.076] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\AdobeCollabSync.CAT") returned="AdobeCollabSync.CAT" [0068.076] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0068.076] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0068.076] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0068.077] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0068.077] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="Annots.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT" [0068.077] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.zip") returned 0 [0068.077] lstrlenA (lpString="*.zip") returned 5 [0068.077] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.rar") returned 0 [0068.077] lstrlenA (lpString="*.rar") returned 5 [0068.077] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.7z") returned 0 [0068.077] lstrlenA (lpString="*.7z") returned 4 [0068.077] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.tar") returned 0 [0068.077] lstrlenA (lpString="*.tar") returned 5 [0068.077] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.gzip") returned 0 [0068.077] lstrlenA (lpString="*.gzip") returned 6 [0068.077] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.jpg") returned 0 [0068.077] lstrlenA (lpString="*.jpg") returned 5 [0068.077] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.jpeg") returned 0 [0068.077] lstrlenA (lpString="*.jpeg") returned 6 [0068.077] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.psd") returned 0 [0068.077] lstrlenA (lpString="*.psd") returned 5 [0068.077] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.gif") returned 0 [0068.077] lstrlenA (lpString="*.gif") returned 5 [0068.077] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.doc") returned 0 [0068.077] lstrlenA (lpString="*.doc") returned 5 [0068.077] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.docx") returned 0 [0068.077] lstrlenA (lpString="*.docx") returned 6 [0068.078] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.xls") returned 0 [0068.078] lstrlenA (lpString="*.xls") returned 5 [0068.078] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.xlsx") returned 0 [0068.078] lstrlenA (lpString="*.xlsx") returned 6 [0068.078] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.ppt") returned 0 [0068.078] lstrlenA (lpString="*.ppt") returned 5 [0068.078] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.pptx") returned 0 [0068.078] lstrlenA (lpString="*.pptx") returned 6 [0068.078] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.pdf") returned 0 [0068.078] lstrlenA (lpString="*.pdf") returned 5 [0068.078] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.mov") returned 0 [0068.078] lstrlenA (lpString="*.mov") returned 5 [0068.078] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.m2v") returned 0 [0068.078] lstrlenA (lpString="*.m2v") returned 5 [0068.078] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.3gp") returned 0 [0068.078] lstrlenA (lpString="*.3gp") returned 5 [0068.078] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.mpeg") returned 0 [0068.078] lstrlenA (lpString="*.mpeg") returned 6 [0068.078] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.mpg") returned 0 [0068.078] lstrlenA (lpString="*.mpg") returned 5 [0068.078] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.flv") returned 0 [0068.078] lstrlenA (lpString="*.flv") returned 5 [0068.078] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.avi") returned 0 [0068.078] lstrlenA (lpString="*.avi") returned 5 [0068.078] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.mp4") returned 0 [0068.078] lstrlenA (lpString="*.mp4") returned 5 [0068.078] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.wmv") returned 0 [0068.078] lstrlenA (lpString="*.wmv") returned 5 [0068.079] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.divx") returned 0 [0068.079] lstrlenA (lpString="*.divx") returned 6 [0068.079] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.mkv") returned 0 [0068.079] lstrlenA (lpString="*.mkv") returned 5 [0068.079] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.mp3") returned 0 [0068.079] lstrlenA (lpString="*.mp3") returned 5 [0068.079] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.wav") returned 0 [0068.079] lstrlenA (lpString="*.wav") returned 5 [0068.079] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.flac") returned 0 [0068.079] lstrlenA (lpString="*.flac") returned 6 [0068.079] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.ape") returned 0 [0068.079] lstrlenA (lpString="*.ape") returned 5 [0068.079] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.wma") returned 0 [0068.079] lstrlenA (lpString="*.wma") returned 5 [0068.079] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.ac3") returned 0 [0068.079] lstrlenA (lpString="*.ac3") returned 5 [0068.079] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT", pszSpec="*.mxf") returned 0 [0068.079] lstrlenA (lpString="*.mxf") returned 5 [0068.079] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x74, dwReserved1=0x0, cFileName="BRdlang32.CAT", cAlternateFileName="BRDLAN~1.CAT")) returned 1 [0068.079] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.079] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="BRdlang32.CAT") returned 1 [0068.079] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BRdlang32.CAT") returned 1 [0068.079] lstrcmpiA (lpString1="", lpString2="BRdlang32.CAT") returned -1 [0068.079] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Annots.CAT") returned="Annots.CAT" [0068.079] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0068.079] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0068.080] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0068.080] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0068.080] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="BRdlang32.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT" [0068.080] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.zip") returned 0 [0068.080] lstrlenA (lpString="*.zip") returned 5 [0068.080] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.rar") returned 0 [0068.080] lstrlenA (lpString="*.rar") returned 5 [0068.080] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.7z") returned 0 [0068.080] lstrlenA (lpString="*.7z") returned 4 [0068.080] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.tar") returned 0 [0068.080] lstrlenA (lpString="*.tar") returned 5 [0068.080] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.gzip") returned 0 [0068.080] lstrlenA (lpString="*.gzip") returned 6 [0068.080] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.jpg") returned 0 [0068.080] lstrlenA (lpString="*.jpg") returned 5 [0068.080] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.jpeg") returned 0 [0068.080] lstrlenA (lpString="*.jpeg") returned 6 [0068.080] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.psd") returned 0 [0068.080] lstrlenA (lpString="*.psd") returned 5 [0068.080] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.gif") returned 0 [0068.080] lstrlenA (lpString="*.gif") returned 5 [0068.080] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.doc") returned 0 [0068.080] lstrlenA (lpString="*.doc") returned 5 [0068.080] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.docx") returned 0 [0068.081] lstrlenA (lpString="*.docx") returned 6 [0068.081] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.xls") returned 0 [0068.081] lstrlenA (lpString="*.xls") returned 5 [0068.081] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.xlsx") returned 0 [0068.081] lstrlenA (lpString="*.xlsx") returned 6 [0068.081] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.ppt") returned 0 [0068.081] lstrlenA (lpString="*.ppt") returned 5 [0068.081] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.pptx") returned 0 [0068.081] lstrlenA (lpString="*.pptx") returned 6 [0068.081] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.pdf") returned 0 [0068.081] lstrlenA (lpString="*.pdf") returned 5 [0068.081] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.mov") returned 0 [0068.081] lstrlenA (lpString="*.mov") returned 5 [0068.081] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.m2v") returned 0 [0068.081] lstrlenA (lpString="*.m2v") returned 5 [0068.081] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.3gp") returned 0 [0068.081] lstrlenA (lpString="*.3gp") returned 5 [0068.081] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.mpeg") returned 0 [0068.081] lstrlenA (lpString="*.mpeg") returned 6 [0068.081] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.mpg") returned 0 [0068.081] lstrlenA (lpString="*.mpg") returned 5 [0068.081] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.flv") returned 0 [0068.081] lstrlenA (lpString="*.flv") returned 5 [0068.081] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.avi") returned 0 [0068.081] lstrlenA (lpString="*.avi") returned 5 [0068.081] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.mp4") returned 0 [0068.081] lstrlenA (lpString="*.mp4") returned 5 [0068.082] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.wmv") returned 0 [0068.082] lstrlenA (lpString="*.wmv") returned 5 [0068.082] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.divx") returned 0 [0068.082] lstrlenA (lpString="*.divx") returned 6 [0068.082] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.mkv") returned 0 [0068.082] lstrlenA (lpString="*.mkv") returned 5 [0068.082] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.mp3") returned 0 [0068.082] lstrlenA (lpString="*.mp3") returned 5 [0068.082] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.wav") returned 0 [0068.082] lstrlenA (lpString="*.wav") returned 5 [0068.082] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.flac") returned 0 [0068.082] lstrlenA (lpString="*.flac") returned 6 [0068.082] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.ape") returned 0 [0068.082] lstrlenA (lpString="*.ape") returned 5 [0068.082] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.wma") returned 0 [0068.082] lstrlenA (lpString="*.wma") returned 5 [0068.082] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.ac3") returned 0 [0068.082] lstrlenA (lpString="*.ac3") returned 5 [0068.082] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT", pszSpec="*.mxf") returned 0 [0068.082] lstrlenA (lpString="*.mxf") returned 5 [0068.082] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1fe00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Checkers.CAT", cAlternateFileName="")) returned 1 [0068.082] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.083] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Checkers.CAT") returned 1 [0068.083] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Checkers.CAT") returned 1 [0068.083] lstrcmpiA (lpString1="", lpString2="Checkers.CAT") returned -1 [0068.083] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\BRdlang32.CAT") returned="BRdlang32.CAT" [0068.083] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0068.083] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0068.083] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0068.083] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0068.083] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="Checkers.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT" [0068.083] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.zip") returned 0 [0068.083] lstrlenA (lpString="*.zip") returned 5 [0068.083] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.rar") returned 0 [0068.083] lstrlenA (lpString="*.rar") returned 5 [0068.083] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.7z") returned 0 [0068.083] lstrlenA (lpString="*.7z") returned 4 [0068.083] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.tar") returned 0 [0068.083] lstrlenA (lpString="*.tar") returned 5 [0068.083] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.gzip") returned 0 [0068.083] lstrlenA (lpString="*.gzip") returned 6 [0068.083] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.jpg") returned 0 [0068.083] lstrlenA (lpString="*.jpg") returned 5 [0068.084] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.jpeg") returned 0 [0068.084] lstrlenA (lpString="*.jpeg") returned 6 [0068.084] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.psd") returned 0 [0068.084] lstrlenA (lpString="*.psd") returned 5 [0068.084] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.gif") returned 0 [0068.084] lstrlenA (lpString="*.gif") returned 5 [0068.084] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.doc") returned 0 [0068.084] lstrlenA (lpString="*.doc") returned 5 [0068.084] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.docx") returned 0 [0068.084] lstrlenA (lpString="*.docx") returned 6 [0068.084] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.xls") returned 0 [0068.084] lstrlenA (lpString="*.xls") returned 5 [0068.084] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.xlsx") returned 0 [0068.084] lstrlenA (lpString="*.xlsx") returned 6 [0068.084] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.ppt") returned 0 [0068.084] lstrlenA (lpString="*.ppt") returned 5 [0068.084] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.pptx") returned 0 [0068.084] lstrlenA (lpString="*.pptx") returned 6 [0068.084] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.pdf") returned 0 [0068.084] lstrlenA (lpString="*.pdf") returned 5 [0068.084] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.mov") returned 0 [0068.084] lstrlenA (lpString="*.mov") returned 5 [0068.084] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.m2v") returned 0 [0068.084] lstrlenA (lpString="*.m2v") returned 5 [0068.084] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.3gp") returned 0 [0068.084] lstrlenA (lpString="*.3gp") returned 5 [0068.084] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.mpeg") returned 0 [0068.084] lstrlenA (lpString="*.mpeg") returned 6 [0068.085] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.mpg") returned 0 [0068.085] lstrlenA (lpString="*.mpg") returned 5 [0068.085] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.flv") returned 0 [0068.085] lstrlenA (lpString="*.flv") returned 5 [0068.085] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.avi") returned 0 [0068.085] lstrlenA (lpString="*.avi") returned 5 [0068.085] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.mp4") returned 0 [0068.085] lstrlenA (lpString="*.mp4") returned 5 [0068.085] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.wmv") returned 0 [0068.085] lstrlenA (lpString="*.wmv") returned 5 [0068.085] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.divx") returned 0 [0068.085] lstrlenA (lpString="*.divx") returned 6 [0068.085] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.mkv") returned 0 [0068.085] lstrlenA (lpString="*.mkv") returned 5 [0068.085] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.mp3") returned 0 [0068.085] lstrlenA (lpString="*.mp3") returned 5 [0068.085] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.wav") returned 0 [0068.085] lstrlenA (lpString="*.wav") returned 5 [0068.085] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.flac") returned 0 [0068.085] lstrlenA (lpString="*.flac") returned 6 [0068.085] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.ape") returned 0 [0068.085] lstrlenA (lpString="*.ape") returned 5 [0068.085] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.wma") returned 0 [0068.085] lstrlenA (lpString="*.wma") returned 5 [0068.085] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.ac3") returned 0 [0068.085] lstrlenA (lpString="*.ac3") returned 5 [0068.085] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT", pszSpec="*.mxf") returned 0 [0068.086] lstrlenA (lpString="*.mxf") returned 5 [0068.086] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20400, dwReserved0=0x74, dwReserved1=0x0, cFileName="DigSig.CAT", cAlternateFileName="")) returned 1 [0068.086] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.086] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DigSig.CAT") returned 1 [0068.086] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DigSig.CAT") returned 1 [0068.086] lstrcmpiA (lpString1="", lpString2="DigSig.CAT") returned -1 [0068.086] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Checkers.CAT") returned="Checkers.CAT" [0068.086] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0068.086] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0068.086] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0068.086] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0068.086] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="DigSig.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT" [0068.086] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.zip") returned 0 [0068.086] lstrlenA (lpString="*.zip") returned 5 [0068.086] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.rar") returned 0 [0068.086] lstrlenA (lpString="*.rar") returned 5 [0068.086] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.7z") returned 0 [0068.086] lstrlenA (lpString="*.7z") returned 4 [0068.086] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.tar") returned 0 [0068.086] lstrlenA (lpString="*.tar") returned 5 [0068.086] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.gzip") returned 0 [0068.086] lstrlenA (lpString="*.gzip") returned 6 [0068.086] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.jpg") returned 0 [0068.087] lstrlenA (lpString="*.jpg") returned 5 [0068.087] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.jpeg") returned 0 [0068.087] lstrlenA (lpString="*.jpeg") returned 6 [0068.087] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.psd") returned 0 [0068.087] lstrlenA (lpString="*.psd") returned 5 [0068.087] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.gif") returned 0 [0068.087] lstrlenA (lpString="*.gif") returned 5 [0068.087] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.doc") returned 0 [0068.087] lstrlenA (lpString="*.doc") returned 5 [0068.087] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.docx") returned 0 [0068.087] lstrlenA (lpString="*.docx") returned 6 [0068.087] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.xls") returned 0 [0068.087] lstrlenA (lpString="*.xls") returned 5 [0068.087] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.xlsx") returned 0 [0068.087] lstrlenA (lpString="*.xlsx") returned 6 [0068.087] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.ppt") returned 0 [0068.087] lstrlenA (lpString="*.ppt") returned 5 [0068.087] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.pptx") returned 0 [0068.087] lstrlenA (lpString="*.pptx") returned 6 [0068.087] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.pdf") returned 0 [0068.087] lstrlenA (lpString="*.pdf") returned 5 [0068.087] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.mov") returned 0 [0068.087] lstrlenA (lpString="*.mov") returned 5 [0068.087] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.m2v") returned 0 [0068.087] lstrlenA (lpString="*.m2v") returned 5 [0068.087] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.3gp") returned 0 [0068.087] lstrlenA (lpString="*.3gp") returned 5 [0068.088] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.mpeg") returned 0 [0068.088] lstrlenA (lpString="*.mpeg") returned 6 [0068.088] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.mpg") returned 0 [0068.088] lstrlenA (lpString="*.mpg") returned 5 [0068.088] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.flv") returned 0 [0068.088] lstrlenA (lpString="*.flv") returned 5 [0068.088] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.avi") returned 0 [0068.088] lstrlenA (lpString="*.avi") returned 5 [0068.088] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.mp4") returned 0 [0068.088] lstrlenA (lpString="*.mp4") returned 5 [0068.088] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.wmv") returned 0 [0068.088] lstrlenA (lpString="*.wmv") returned 5 [0068.088] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.divx") returned 0 [0068.088] lstrlenA (lpString="*.divx") returned 6 [0068.088] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.mkv") returned 0 [0068.088] lstrlenA (lpString="*.mkv") returned 5 [0068.088] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.mp3") returned 0 [0068.088] lstrlenA (lpString="*.mp3") returned 5 [0068.088] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.wav") returned 0 [0068.088] lstrlenA (lpString="*.wav") returned 5 [0068.088] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.flac") returned 0 [0068.088] lstrlenA (lpString="*.flac") returned 6 [0068.088] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.ape") returned 0 [0068.088] lstrlenA (lpString="*.ape") returned 5 [0068.088] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.wma") returned 0 [0068.089] lstrlenA (lpString="*.wma") returned 5 [0068.089] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.ac3") returned 0 [0068.089] lstrlenA (lpString="*.ac3") returned 5 [0068.089] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT", pszSpec="*.mxf") returned 0 [0068.089] lstrlenA (lpString="*.mxf") returned 5 [0068.089] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="DVA.CAT", cAlternateFileName="")) returned 1 [0068.089] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.089] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DVA.CAT") returned 1 [0068.089] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DVA.CAT") returned 1 [0068.089] lstrcmpiA (lpString1="", lpString2="DVA.CAT") returned -1 [0068.089] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DigSig.CAT") returned="DigSig.CAT" [0068.089] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0068.089] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0068.089] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0068.089] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0068.089] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="DVA.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DVA.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DVA.CAT" [0068.089] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DVA.CAT", pszSpec="*.zip") returned 0 [0068.089] lstrlenA (lpString="*.zip") returned 5 [0068.089] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DVA.CAT", pszSpec="*.rar") returned 0 [0068.089] lstrlenA (lpString="*.rar") returned 5 [0068.089] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DVA.CAT", pszSpec="*.7z") returned 0 [0068.089] lstrlenA (lpString="*.7z") returned 4 [0068.089] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DVA.CAT", pszSpec="*.tar") returned 0 [0068.089] lstrlenA (lpString="*.tar") returned 5 [0068.090] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DVA.CAT", pszSpec="*.gzip") returned 0 [0068.090] lstrlenA (lpString="*.gzip") returned 6 [0068.090] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DVA.CAT", pszSpec="*.jpg") returned 0 [0068.090] lstrlenA (lpString="*.jpg") returned 5 [0068.090] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DVA.CAT", pszSpec="*.jpeg") returned 0 [0068.090] lstrlenA (lpString="*.jpeg") returned 6 [0068.090] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DVA.CAT", pszSpec="*.psd") returned 0 [0068.090] lstrlenA (lpString="*.psd") returned 5 [0068.090] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DVA.CAT", pszSpec="*.gif") returned 0 [0068.090] lstrlenA (lpString="*.gif") returned 5 [0068.090] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DVA.CAT", pszSpec="*.doc") returned 0 [0068.090] lstrlenA (lpString="*.doc") returned 5 [0068.090] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DVA.CAT", pszSpec="*.docx") returned 0 [0068.090] lstrlenA (lpString="*.docx") returned 6 [0068.090] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="eBook.CAT", cAlternateFileName="")) returned 1 [0068.090] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.090] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eBook.CAT") returned -1 [0068.091] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eBook.CAT") returned 1 [0068.091] lstrcmpiA (lpString1="", lpString2="eBook.CAT") returned -1 [0068.091] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\DVA.CAT") returned="DVA.CAT" [0068.091] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0068.091] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0068.091] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0068.091] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0068.091] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="eBook.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\eBook.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\eBook.CAT" [0068.091] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x74, dwReserved1=0x0, cFileName="EScript.CAT", cAlternateFileName="")) returned 1 [0068.091] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.091] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EScript.CAT") returned -1 [0068.091] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EScript.CAT") returned 1 [0068.091] lstrcmpiA (lpString1="", lpString2="EScript.CAT") returned -1 [0068.091] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\eBook.CAT") returned="eBook.CAT" [0068.091] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0068.091] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0068.091] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0068.091] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0068.091] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="EScript.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\EScript.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\EScript.CAT" [0068.092] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x74, dwReserved1=0x0, cFileName="IA32.CAT", cAlternateFileName="")) returned 1 [0068.092] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.092] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IA32.CAT") returned -1 [0068.092] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IA32.CAT") returned -1 [0068.092] lstrcmpiA (lpString1="", lpString2="IA32.CAT") returned -1 [0068.092] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\EScript.CAT") returned="EScript.CAT" [0068.092] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0068.092] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0068.092] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0068.092] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0068.092] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="IA32.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\IA32.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\IA32.CAT" [0068.092] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x74, dwReserved1=0x0, cFileName="makeaccessible.CAT", cAlternateFileName="MAKEAC~1.CAT")) returned 1 [0068.092] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.092] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="makeaccessible.CAT") returned -1 [0068.092] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="makeaccessible.CAT") returned -1 [0068.092] lstrcmpiA (lpString1="", lpString2="makeaccessible.CAT") returned -1 [0068.092] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\IA32.CAT") returned="IA32.CAT" [0068.092] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0068.092] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0068.092] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0068.092] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0068.093] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="makeaccessible.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\makeaccessible.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\makeaccessible.CAT" [0068.093] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14200, dwReserved0=0x74, dwReserved1=0x0, cFileName="Multimedia.CAT", cAlternateFileName="MULTIM~1.CAT")) returned 1 [0068.093] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.093] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Multimedia.CAT") returned -1 [0068.093] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Multimedia.CAT") returned -1 [0068.093] lstrcmpiA (lpString1="", lpString2="Multimedia.CAT") returned -1 [0068.093] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\makeaccessible.CAT") returned="makeaccessible.CAT" [0068.093] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0068.093] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0068.093] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0068.093] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0068.093] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="Multimedia.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Multimedia.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Multimedia.CAT" [0068.093] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x74, dwReserved1=0x0, cFileName="pddom.CAT", cAlternateFileName="")) returned 1 [0068.093] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.093] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="pddom.CAT") returned -1 [0068.093] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pddom.CAT") returned -1 [0068.093] lstrcmpiA (lpString1="", lpString2="pddom.CAT") returned -1 [0068.093] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Multimedia.CAT") returned="Multimedia.CAT" [0068.093] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0068.093] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0068.093] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0068.094] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0068.094] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="pddom.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\pddom.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\pddom.CAT" [0068.094] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x85c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="PPKLite.CAT", cAlternateFileName="")) returned 1 [0068.094] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.094] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PPKLite.CAT") returned -1 [0068.094] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PPKLite.CAT") returned -1 [0068.094] lstrcmpiA (lpString1="", lpString2="PPKLite.CAT") returned -1 [0068.094] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\pddom.CAT") returned="pddom.CAT" [0068.094] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0068.094] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0068.094] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0068.094] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0068.094] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="PPKLite.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\PPKLite.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\PPKLite.CAT" [0068.094] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x158e00, dwReserved0=0x74, dwReserved1=0x0, cFileName="RdLang32.CAT", cAlternateFileName="")) returned 1 [0068.094] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.094] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RdLang32.CAT") returned -1 [0068.094] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RdLang32.CAT") returned -1 [0068.094] lstrcmpiA (lpString1="", lpString2="RdLang32.CAT") returned -1 [0068.094] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\PPKLite.CAT") returned="PPKLite.CAT" [0068.094] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0068.095] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0068.095] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0068.095] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0068.095] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="RdLang32.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\RdLang32.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\RdLang32.CAT" [0068.095] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8333a740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="ReadOutLoud.CAT", cAlternateFileName="READOU~1.CAT")) returned 1 [0068.095] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.095] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ReadOutLoud.CAT") returned -1 [0068.095] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ReadOutLoud.CAT") returned -1 [0068.095] lstrcmpiA (lpString1="", lpString2="ReadOutLoud.CAT") returned -1 [0068.095] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\RdLang32.CAT") returned="RdLang32.CAT" [0068.095] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0068.095] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0068.095] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0068.095] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0068.095] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="ReadOutLoud.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\ReadOutLoud.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\ReadOutLoud.CAT" [0068.095] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x74, dwReserved1=0x0, cFileName="reflow.CAT", cAlternateFileName="")) returned 1 [0068.095] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.095] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="reflow.CAT") returned -1 [0068.095] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="reflow.CAT") returned -1 [0068.095] lstrcmpiA (lpString1="", lpString2="reflow.CAT") returned -1 [0068.096] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\ReadOutLoud.CAT") returned="ReadOutLoud.CAT" [0068.096] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0068.096] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0068.096] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0068.096] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0068.096] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="reflow.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\reflow.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\reflow.CAT" [0068.096] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db99d60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="SaveAsRTF.CAT", cAlternateFileName="SAVEAS~1.CAT")) returned 1 [0068.096] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.096] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SaveAsRTF.CAT") returned -1 [0068.096] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SaveAsRTF.CAT") returned -1 [0068.096] lstrcmpiA (lpString1="", lpString2="SaveAsRTF.CAT") returned -1 [0068.096] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\reflow.CAT") returned="reflow.CAT" [0068.096] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0068.096] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0068.096] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0068.096] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0068.096] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="SaveAsRTF.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SaveAsRTF.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SaveAsRTF.CAT" [0068.096] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x74, dwReserved1=0x0, cFileName="Search.CAT", cAlternateFileName="")) returned 1 [0068.096] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.096] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Search.CAT") returned -1 [0068.096] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Search.CAT") returned -1 [0068.097] lstrcmpiA (lpString1="", lpString2="Search.CAT") returned -1 [0068.097] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SaveAsRTF.CAT") returned="SaveAsRTF.CAT" [0068.097] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0068.097] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0068.097] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0068.097] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0068.097] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="Search.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Search.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Search.CAT" [0068.097] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x833145e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x74, dwReserved1=0x0, cFileName="SendMail.CAT", cAlternateFileName="")) returned 1 [0068.097] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.097] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SendMail.CAT") returned -1 [0068.097] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SendMail.CAT") returned -1 [0068.097] lstrcmpiA (lpString1="", lpString2="SendMail.CAT") returned -1 [0068.097] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Search.CAT") returned="Search.CAT" [0068.097] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0068.097] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0068.097] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0068.097] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0068.097] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="SendMail.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SendMail.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SendMail.CAT" [0068.097] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0068.098] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0068.098] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0068.098] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\SendMail.CAT") returned="SendMail.CAT" [0068.098] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="Services" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services" [0068.098] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2e048a, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0068.108] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.108] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0068.108] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.108] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.108] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9586, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0068.108] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0068.108] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DEXShare.asfx") returned 1 [0068.108] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DEXShare.asfx") returned 1 [0068.108] lstrcmpiA (lpString1="", lpString2="DEXShare.asfx") returned -1 [0068.108] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\*.*") returned="*.*" [0068.108] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\" [0068.108] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\") returned="" [0068.108] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\HOW TO DECRYPT FILES.txt" [0068.108] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\services\\how to decrypt files.txt")) returned 0xffffffff [0068.109] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\services\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0068.115] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.115] CloseHandle (hObject=0x98) returned 1 [0068.115] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\", lpString2="DEXShare.asfx" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\DEXShare.asfx") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\DEXShare.asfx" [0068.116] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0068.116] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0068.116] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Services.asfx") returned -1 [0068.116] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Services.asfx") returned -1 [0068.116] lstrcmpiA (lpString1="", lpString2="Services.asfx") returned -1 [0068.116] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\DEXShare.asfx") returned="DEXShare.asfx" [0068.116] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\" [0068.116] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\") returned="" [0068.116] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\HOW TO DECRYPT FILES.txt" [0068.116] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\services\\how to decrypt files.txt")) returned 0x20 [0068.116] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\", lpString2="Services.asfx" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\Services.asfx") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\Services.asfx" [0068.116] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0068.116] FindClose (in: hFindFile=0x2e3578 | out: hFindFile=0x2e3578) returned 1 [0068.116] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f498460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Spelling.CAT", cAlternateFileName="")) returned 1 [0068.116] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.116] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Spelling.CAT") returned -1 [0068.116] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Spelling.CAT") returned -1 [0068.117] lstrcmpiA (lpString1="", lpString2="Spelling.CAT") returned -1 [0068.117] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\*.*") returned="*.*" [0068.117] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0068.117] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0068.117] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0068.117] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0068.117] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="Spelling.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Spelling.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Spelling.CAT" [0068.117] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5309e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="updater.CAT", cAlternateFileName="")) returned 1 [0068.117] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.117] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="updater.CAT") returned -1 [0068.117] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="updater.CAT") returned -1 [0068.117] lstrcmpiA (lpString1="", lpString2="updater.CAT") returned -1 [0068.117] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Spelling.CAT") returned="Spelling.CAT" [0068.117] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0068.117] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0068.117] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0068.117] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0068.117] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="updater.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\updater.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\updater.CAT" [0068.118] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x74, dwReserved1=0x0, cFileName="WebLink.CAT", cAlternateFileName="")) returned 1 [0068.118] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.118] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WebLink.CAT") returned -1 [0068.118] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebLink.CAT") returned -1 [0068.118] lstrcmpiA (lpString1="", lpString2="WebLink.CAT") returned -1 [0068.118] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\updater.CAT") returned="updater.CAT" [0068.118] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0068.118] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="" [0068.118] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" [0068.118] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ca_es\\how to decrypt files.txt")) returned 0x20 [0068.118] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\", lpString2="WebLink.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\WebLink.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\WebLink.CAT" [0068.118] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x74, dwReserved1=0x0, cFileName="WebLink.CAT", cAlternateFileName="")) returned 0 [0068.118] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0068.118] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="cs_CZ", cAlternateFileName="")) returned 1 [0068.118] lstrcmpA (lpString1=".", lpString2="cs_CZ") returned -1 [0068.118] lstrcmpA (lpString1="..", lpString2="cs_CZ") returned -1 [0068.118] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*.*") returned="*.*" [0068.118] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\", lpString2="cs_CZ" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" [0068.118] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.122] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.122] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.122] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.122] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.122] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="accessibility.CZE", cAlternateFileName="ACCESS~1.CZE")) returned 1 [0068.122] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.122] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="accessibility.CZE") returned 1 [0068.122] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="accessibility.CZE") returned 1 [0068.122] lstrcmpiA (lpString1="", lpString2="accessibility.CZE") returned -1 [0068.122] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\*.*") returned="*.*" [0068.122] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0068.122] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0068.122] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" [0068.122] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\how to decrypt files.txt")) returned 0xffffffff [0068.122] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0068.125] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.125] CloseHandle (hObject=0x94) returned 1 [0068.125] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="accessibility.CZE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\accessibility.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\accessibility.CZE" [0068.125] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x63e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.CZE", cAlternateFileName="")) returned 1 [0068.125] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.125] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\accessibility.CZE") returned="accessibility.CZE" [0068.125] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0068.125] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0068.125] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" [0068.125] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\how to decrypt files.txt")) returned 0x20 [0068.126] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="Acroform.CZE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Acroform.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Acroform.CZE" [0068.126] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d35bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="AdobeCollabSync.CZE", cAlternateFileName="ADOBEC~1.CZE")) returned 1 [0068.126] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.126] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Acroform.CZE") returned="Acroform.CZE" [0068.126] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0068.126] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0068.126] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" [0068.126] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\how to decrypt files.txt")) returned 0x20 [0068.126] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="AdobeCollabSync.CZE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\AdobeCollabSync.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\AdobeCollabSync.CZE" [0068.126] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x76c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Annots.CZE", cAlternateFileName="")) returned 1 [0068.126] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.126] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\AdobeCollabSync.CZE") returned="AdobeCollabSync.CZE" [0068.126] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0068.126] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0068.126] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" [0068.126] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\how to decrypt files.txt")) returned 0x20 [0068.126] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="Annots.CZE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Annots.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Annots.CZE" [0068.127] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x74, dwReserved1=0x0, cFileName="BRdlang32.CZE", cAlternateFileName="BRDLAN~1.CZE")) returned 1 [0068.127] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.127] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Annots.CZE") returned="Annots.CZE" [0068.127] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0068.127] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0068.127] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" [0068.127] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\how to decrypt files.txt")) returned 0x20 [0068.127] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="BRdlang32.CZE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\BRdlang32.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\BRdlang32.CZE" [0068.127] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1da00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Checkers.CZE", cAlternateFileName="")) returned 1 [0068.127] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.127] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\BRdlang32.CZE") returned="BRdlang32.CZE" [0068.127] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0068.127] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0068.127] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" [0068.127] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\how to decrypt files.txt")) returned 0x20 [0068.127] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="Checkers.CZE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Checkers.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Checkers.CZE" [0068.127] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x74, dwReserved1=0x0, cFileName="DigSig.CZE", cAlternateFileName="")) returned 1 [0068.127] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.127] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Checkers.CZE") returned="Checkers.CZE" [0068.128] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0068.128] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0068.128] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" [0068.128] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\how to decrypt files.txt")) returned 0x20 [0068.128] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="DigSig.CZE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DigSig.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DigSig.CZE" [0068.128] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x74, dwReserved1=0x0, cFileName="DVA.CZE", cAlternateFileName="")) returned 1 [0068.128] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.128] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DigSig.CZE") returned="DigSig.CZE" [0068.128] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0068.128] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0068.128] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" [0068.128] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\how to decrypt files.txt")) returned 0x20 [0068.128] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="DVA.CZE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DVA.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DVA.CZE" [0068.128] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8327c060, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="eBook.CZE", cAlternateFileName="")) returned 1 [0068.128] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.128] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DVA.CZE") returned="DVA.CZE" [0068.128] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0068.128] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0068.129] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" [0068.129] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\how to decrypt files.txt")) returned 0x20 [0068.129] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="eBook.CZE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\eBook.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\eBook.CZE" [0068.129] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="EScript.CZE", cAlternateFileName="")) returned 1 [0068.129] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.129] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\eBook.CZE") returned="eBook.CZE" [0068.129] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0068.129] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0068.129] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" [0068.129] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\how to decrypt files.txt")) returned 0x20 [0068.129] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="EScript.CZE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\EScript.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\EScript.CZE" [0068.129] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x74, dwReserved1=0x0, cFileName="IA32.CZE", cAlternateFileName="")) returned 1 [0068.129] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.129] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\EScript.CZE") returned="EScript.CZE" [0068.129] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0068.129] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0068.129] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" [0068.129] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\how to decrypt files.txt")) returned 0x20 [0068.130] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db4daa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="makeaccessible.CZE", cAlternateFileName="MAKEAC~1.CZE")) returned 1 [0068.130] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.130] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\IA32.CZE") returned="IA32.CZE" [0068.130] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0068.130] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0068.131] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7bb9a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x74, dwReserved1=0x0, cFileName="Multimedia.CZE", cAlternateFileName="MULTIM~1.CZE")) returned 1 [0068.131] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.131] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\makeaccessible.CZE") returned="makeaccessible.CZE" [0068.131] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0068.131] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0068.131] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db27940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="pddom.CZE", cAlternateFileName="")) returned 1 [0068.131] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.131] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Multimedia.CZE") returned="Multimedia.CZE" [0068.131] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0068.131] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0068.131] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83209c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7d000, dwReserved0=0x74, dwReserved1=0x0, cFileName="PPKLite.CZE", cAlternateFileName="")) returned 1 [0068.131] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.131] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\pddom.CZE") returned="pddom.CZE" [0068.131] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0068.131] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0068.132] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807c95c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x145000, dwReserved0=0x74, dwReserved1=0x0, cFileName="RdLang32.CZE", cAlternateFileName="")) returned 1 [0068.132] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.132] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\PPKLite.CZE") returned="PPKLite.CZE" [0068.132] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0068.132] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0068.132] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="ReadOutLoud.CZE", cAlternateFileName="READOU~1.CZE")) returned 1 [0068.132] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.132] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\RdLang32.CZE") returned="RdLang32.CZE" [0068.132] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0068.132] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0068.132] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db017e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x74, dwReserved1=0x0, cFileName="reflow.CZE", cAlternateFileName="")) returned 1 [0068.132] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.132] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\ReadOutLoud.CZE") returned="ReadOutLoud.CZE" [0068.132] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0068.132] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0068.132] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dadb680, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x74, dwReserved1=0x0, cFileName="SaveAsRTF.CZE", cAlternateFileName="SAVEAS~1.CZE")) returned 1 [0068.132] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.133] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\reflow.CZE") returned="reflow.CZE" [0068.133] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0068.133] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0068.133] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8322fda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Search.CZE", cAlternateFileName="")) returned 1 [0068.133] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.133] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\SaveAsRTF.CZE") returned="SaveAsRTF.CZE" [0068.133] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0068.133] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0068.133] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8322fda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="SendMail.CZE", cAlternateFileName="")) returned 1 [0068.133] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.133] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Search.CZE") returned="Search.CZE" [0068.133] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0068.133] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0068.133] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0068.133] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0068.133] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0068.133] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\SendMail.CZE") returned="SendMail.CZE" [0068.133] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2e048a, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0068.135] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.135] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0068.135] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.135] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.135] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9342, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0068.135] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0068.135] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\*.*") returned="*.*" [0068.135] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\" [0068.135] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\") returned="" [0068.143] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.144] CloseHandle (hObject=0x98) returned 1 [0068.144] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.zip") returned 0 [0068.144] lstrlenA (lpString="*.zip") returned 5 [0068.144] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.rar") returned 0 [0068.144] lstrlenA (lpString="*.rar") returned 5 [0068.144] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.7z") returned 0 [0068.144] lstrlenA (lpString="*.7z") returned 4 [0068.144] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.tar") returned 0 [0068.144] lstrlenA (lpString="*.tar") returned 5 [0068.144] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.gzip") returned 0 [0068.144] lstrlenA (lpString="*.gzip") returned 6 [0068.144] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.jpg") returned 0 [0068.144] lstrlenA (lpString="*.jpg") returned 5 [0068.144] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.jpeg") returned 0 [0068.144] lstrlenA (lpString="*.jpeg") returned 6 [0068.144] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.psd") returned 0 [0068.144] lstrlenA (lpString="*.psd") returned 5 [0068.144] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.gif") returned 0 [0068.144] lstrlenA (lpString="*.gif") returned 5 [0068.144] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.doc") returned 0 [0068.144] lstrlenA (lpString="*.doc") returned 5 [0068.145] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.docx") returned 0 [0068.145] lstrlenA (lpString="*.docx") returned 6 [0068.145] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.xls") returned 0 [0068.145] lstrlenA (lpString="*.xls") returned 5 [0068.145] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.xlsx") returned 0 [0068.145] lstrlenA (lpString="*.xlsx") returned 6 [0068.145] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.ppt") returned 0 [0068.145] lstrlenA (lpString="*.ppt") returned 5 [0068.145] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.pptx") returned 0 [0068.145] lstrlenA (lpString="*.pptx") returned 6 [0068.145] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.pdf") returned 0 [0068.145] lstrlenA (lpString="*.pdf") returned 5 [0068.145] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.mov") returned 0 [0068.145] lstrlenA (lpString="*.mov") returned 5 [0068.145] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.m2v") returned 0 [0068.145] lstrlenA (lpString="*.m2v") returned 5 [0068.145] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.3gp") returned 0 [0068.145] lstrlenA (lpString="*.3gp") returned 5 [0068.145] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.mpeg") returned 0 [0068.145] lstrlenA (lpString="*.mpeg") returned 6 [0068.145] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.mpg") returned 0 [0068.145] lstrlenA (lpString="*.mpg") returned 5 [0068.145] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.flv") returned 0 [0068.145] lstrlenA (lpString="*.flv") returned 5 [0068.145] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.avi") returned 0 [0068.145] lstrlenA (lpString="*.avi") returned 5 [0068.145] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.mp4") returned 0 [0068.145] lstrlenA (lpString="*.mp4") returned 5 [0068.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.wmv") returned 0 [0068.146] lstrlenA (lpString="*.wmv") returned 5 [0068.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.divx") returned 0 [0068.146] lstrlenA (lpString="*.divx") returned 6 [0068.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.mkv") returned 0 [0068.146] lstrlenA (lpString="*.mkv") returned 5 [0068.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.mp3") returned 0 [0068.146] lstrlenA (lpString="*.mp3") returned 5 [0068.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.wav") returned 0 [0068.146] lstrlenA (lpString="*.wav") returned 5 [0068.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.flac") returned 0 [0068.146] lstrlenA (lpString="*.flac") returned 6 [0068.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.ape") returned 0 [0068.146] lstrlenA (lpString="*.ape") returned 5 [0068.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.wma") returned 0 [0068.146] lstrlenA (lpString="*.wma") returned 5 [0068.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.ac3") returned 0 [0068.146] lstrlenA (lpString="*.ac3") returned 5 [0068.146] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", pszSpec="*.mxf") returned 0 [0068.146] lstrlenA (lpString="*.mxf") returned 5 [0068.146] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0068.146] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0068.146] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx") returned="DEXShare.asfx" [0068.147] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\" [0068.147] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\") returned="" [0068.148] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.zip") returned 0 [0068.149] lstrlenA (lpString="*.zip") returned 5 [0068.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.rar") returned 0 [0068.149] lstrlenA (lpString="*.rar") returned 5 [0068.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.7z") returned 0 [0068.149] lstrlenA (lpString="*.7z") returned 4 [0068.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.tar") returned 0 [0068.149] lstrlenA (lpString="*.tar") returned 5 [0068.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.gzip") returned 0 [0068.149] lstrlenA (lpString="*.gzip") returned 6 [0068.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.jpg") returned 0 [0068.149] lstrlenA (lpString="*.jpg") returned 5 [0068.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.jpeg") returned 0 [0068.149] lstrlenA (lpString="*.jpeg") returned 6 [0068.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.psd") returned 0 [0068.149] lstrlenA (lpString="*.psd") returned 5 [0068.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.gif") returned 0 [0068.149] lstrlenA (lpString="*.gif") returned 5 [0068.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.doc") returned 0 [0068.149] lstrlenA (lpString="*.doc") returned 5 [0068.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.docx") returned 0 [0068.149] lstrlenA (lpString="*.docx") returned 6 [0068.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.xls") returned 0 [0068.149] lstrlenA (lpString="*.xls") returned 5 [0068.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.xlsx") returned 0 [0068.149] lstrlenA (lpString="*.xlsx") returned 6 [0068.149] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.ppt") returned 0 [0068.150] lstrlenA (lpString="*.ppt") returned 5 [0068.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.pptx") returned 0 [0068.150] lstrlenA (lpString="*.pptx") returned 6 [0068.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.pdf") returned 0 [0068.150] lstrlenA (lpString="*.pdf") returned 5 [0068.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.mov") returned 0 [0068.150] lstrlenA (lpString="*.mov") returned 5 [0068.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.m2v") returned 0 [0068.150] lstrlenA (lpString="*.m2v") returned 5 [0068.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.3gp") returned 0 [0068.150] lstrlenA (lpString="*.3gp") returned 5 [0068.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.mpeg") returned 0 [0068.150] lstrlenA (lpString="*.mpeg") returned 6 [0068.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.mpg") returned 0 [0068.150] lstrlenA (lpString="*.mpg") returned 5 [0068.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.flv") returned 0 [0068.150] lstrlenA (lpString="*.flv") returned 5 [0068.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.avi") returned 0 [0068.150] lstrlenA (lpString="*.avi") returned 5 [0068.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.mp4") returned 0 [0068.150] lstrlenA (lpString="*.mp4") returned 5 [0068.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.wmv") returned 0 [0068.150] lstrlenA (lpString="*.wmv") returned 5 [0068.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.divx") returned 0 [0068.150] lstrlenA (lpString="*.divx") returned 6 [0068.150] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.mkv") returned 0 [0068.151] lstrlenA (lpString="*.mkv") returned 5 [0068.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.mp3") returned 0 [0068.151] lstrlenA (lpString="*.mp3") returned 5 [0068.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.wav") returned 0 [0068.151] lstrlenA (lpString="*.wav") returned 5 [0068.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.flac") returned 0 [0068.151] lstrlenA (lpString="*.flac") returned 6 [0068.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.ape") returned 0 [0068.151] lstrlenA (lpString="*.ape") returned 5 [0068.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.wma") returned 0 [0068.151] lstrlenA (lpString="*.wma") returned 5 [0068.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.ac3") returned 0 [0068.151] lstrlenA (lpString="*.ac3") returned 5 [0068.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", pszSpec="*.mxf") returned 0 [0068.151] lstrlenA (lpString="*.mxf") returned 5 [0068.151] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0068.151] FindClose (in: hFindFile=0x2e3578 | out: hFindFile=0x2e3578) returned 1 [0068.152] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7e0106a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Spelling.CZE", cAlternateFileName="")) returned 1 [0068.152] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.152] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\*.*") returned="*.*" [0068.152] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0068.152] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0068.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.zip") returned 0 [0068.152] lstrlenA (lpString="*.zip") returned 5 [0068.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.rar") returned 0 [0068.152] lstrlenA (lpString="*.rar") returned 5 [0068.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.7z") returned 0 [0068.152] lstrlenA (lpString="*.7z") returned 4 [0068.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.tar") returned 0 [0068.152] lstrlenA (lpString="*.tar") returned 5 [0068.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.gzip") returned 0 [0068.152] lstrlenA (lpString="*.gzip") returned 6 [0068.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.jpg") returned 0 [0068.152] lstrlenA (lpString="*.jpg") returned 5 [0068.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.jpeg") returned 0 [0068.152] lstrlenA (lpString="*.jpeg") returned 6 [0068.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.psd") returned 0 [0068.152] lstrlenA (lpString="*.psd") returned 5 [0068.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.gif") returned 0 [0068.153] lstrlenA (lpString="*.gif") returned 5 [0068.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.doc") returned 0 [0068.153] lstrlenA (lpString="*.doc") returned 5 [0068.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.docx") returned 0 [0068.153] lstrlenA (lpString="*.docx") returned 6 [0068.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.xls") returned 0 [0068.153] lstrlenA (lpString="*.xls") returned 5 [0068.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.xlsx") returned 0 [0068.153] lstrlenA (lpString="*.xlsx") returned 6 [0068.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.ppt") returned 0 [0068.153] lstrlenA (lpString="*.ppt") returned 5 [0068.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.pptx") returned 0 [0068.153] lstrlenA (lpString="*.pptx") returned 6 [0068.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.pdf") returned 0 [0068.153] lstrlenA (lpString="*.pdf") returned 5 [0068.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.mov") returned 0 [0068.153] lstrlenA (lpString="*.mov") returned 5 [0068.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.m2v") returned 0 [0068.153] lstrlenA (lpString="*.m2v") returned 5 [0068.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.3gp") returned 0 [0068.153] lstrlenA (lpString="*.3gp") returned 5 [0068.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.mpeg") returned 0 [0068.153] lstrlenA (lpString="*.mpeg") returned 6 [0068.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.mpg") returned 0 [0068.153] lstrlenA (lpString="*.mpg") returned 5 [0068.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.flv") returned 0 [0068.154] lstrlenA (lpString="*.flv") returned 5 [0068.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.avi") returned 0 [0068.154] lstrlenA (lpString="*.avi") returned 5 [0068.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.mp4") returned 0 [0068.154] lstrlenA (lpString="*.mp4") returned 5 [0068.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.wmv") returned 0 [0068.154] lstrlenA (lpString="*.wmv") returned 5 [0068.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.divx") returned 0 [0068.154] lstrlenA (lpString="*.divx") returned 6 [0068.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.mkv") returned 0 [0068.154] lstrlenA (lpString="*.mkv") returned 5 [0068.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.mp3") returned 0 [0068.154] lstrlenA (lpString="*.mp3") returned 5 [0068.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.wav") returned 0 [0068.154] lstrlenA (lpString="*.wav") returned 5 [0068.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.flac") returned 0 [0068.154] lstrlenA (lpString="*.flac") returned 6 [0068.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.ape") returned 0 [0068.154] lstrlenA (lpString="*.ape") returned 5 [0068.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.wma") returned 0 [0068.154] lstrlenA (lpString="*.wma") returned 5 [0068.154] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.ac3") returned 0 [0068.154] lstrlenA (lpString="*.ac3") returned 5 [0068.155] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE", pszSpec="*.mxf") returned 0 [0068.155] lstrlenA (lpString="*.mxf") returned 5 [0068.155] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5309e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="updater.CZE", cAlternateFileName="")) returned 1 [0068.155] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.155] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Spelling.CZE") returned="Spelling.CZE" [0068.155] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0068.155] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0068.155] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.zip") returned 0 [0068.155] lstrlenA (lpString="*.zip") returned 5 [0068.155] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.rar") returned 0 [0068.155] lstrlenA (lpString="*.rar") returned 5 [0068.155] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.7z") returned 0 [0068.155] lstrlenA (lpString="*.7z") returned 4 [0068.155] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.tar") returned 0 [0068.155] lstrlenA (lpString="*.tar") returned 5 [0068.155] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.gzip") returned 0 [0068.155] lstrlenA (lpString="*.gzip") returned 6 [0068.155] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.jpg") returned 0 [0068.155] lstrlenA (lpString="*.jpg") returned 5 [0068.155] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.jpeg") returned 0 [0068.155] lstrlenA (lpString="*.jpeg") returned 6 [0068.155] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.psd") returned 0 [0068.155] lstrlenA (lpString="*.psd") returned 5 [0068.156] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.gif") returned 0 [0068.156] lstrlenA (lpString="*.gif") returned 5 [0068.156] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.doc") returned 0 [0068.156] lstrlenA (lpString="*.doc") returned 5 [0068.156] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.docx") returned 0 [0068.156] lstrlenA (lpString="*.docx") returned 6 [0068.156] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.xls") returned 0 [0068.156] lstrlenA (lpString="*.xls") returned 5 [0068.156] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.xlsx") returned 0 [0068.156] lstrlenA (lpString="*.xlsx") returned 6 [0068.156] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.ppt") returned 0 [0068.156] lstrlenA (lpString="*.ppt") returned 5 [0068.156] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.pptx") returned 0 [0068.156] lstrlenA (lpString="*.pptx") returned 6 [0068.156] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.pdf") returned 0 [0068.156] lstrlenA (lpString="*.pdf") returned 5 [0068.156] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.mov") returned 0 [0068.156] lstrlenA (lpString="*.mov") returned 5 [0068.156] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.m2v") returned 0 [0068.156] lstrlenA (lpString="*.m2v") returned 5 [0068.156] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.3gp") returned 0 [0068.156] lstrlenA (lpString="*.3gp") returned 5 [0068.156] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.mpeg") returned 0 [0068.156] lstrlenA (lpString="*.mpeg") returned 6 [0068.156] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.mpg") returned 0 [0068.156] lstrlenA (lpString="*.mpg") returned 5 [0068.156] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.flv") returned 0 [0068.156] lstrlenA (lpString="*.flv") returned 5 [0068.157] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.avi") returned 0 [0068.157] lstrlenA (lpString="*.avi") returned 5 [0068.157] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.mp4") returned 0 [0068.157] lstrlenA (lpString="*.mp4") returned 5 [0068.157] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.wmv") returned 0 [0068.157] lstrlenA (lpString="*.wmv") returned 5 [0068.157] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.divx") returned 0 [0068.157] lstrlenA (lpString="*.divx") returned 6 [0068.157] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.mkv") returned 0 [0068.157] lstrlenA (lpString="*.mkv") returned 5 [0068.157] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.mp3") returned 0 [0068.157] lstrlenA (lpString="*.mp3") returned 5 [0068.157] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.wav") returned 0 [0068.157] lstrlenA (lpString="*.wav") returned 5 [0068.157] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.flac") returned 0 [0068.157] lstrlenA (lpString="*.flac") returned 6 [0068.157] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.ape") returned 0 [0068.157] lstrlenA (lpString="*.ape") returned 5 [0068.157] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.wma") returned 0 [0068.157] lstrlenA (lpString="*.wma") returned 5 [0068.157] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.ac3") returned 0 [0068.157] lstrlenA (lpString="*.ac3") returned 5 [0068.157] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE", pszSpec="*.mxf") returned 0 [0068.157] lstrlenA (lpString="*.mxf") returned 5 [0068.157] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8322fda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="WebLink.CZE", cAlternateFileName="")) returned 1 [0068.157] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.158] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\updater.CZE") returned="updater.CZE" [0068.158] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0068.158] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="" [0068.158] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.zip") returned 0 [0068.158] lstrlenA (lpString="*.zip") returned 5 [0068.158] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.rar") returned 0 [0068.158] lstrlenA (lpString="*.rar") returned 5 [0068.158] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.7z") returned 0 [0068.158] lstrlenA (lpString="*.7z") returned 4 [0068.158] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.tar") returned 0 [0068.158] lstrlenA (lpString="*.tar") returned 5 [0068.158] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.gzip") returned 0 [0068.158] lstrlenA (lpString="*.gzip") returned 6 [0068.158] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.jpg") returned 0 [0068.158] lstrlenA (lpString="*.jpg") returned 5 [0068.158] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.jpeg") returned 0 [0068.158] lstrlenA (lpString="*.jpeg") returned 6 [0068.158] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.psd") returned 0 [0068.158] lstrlenA (lpString="*.psd") returned 5 [0068.158] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.gif") returned 0 [0068.158] lstrlenA (lpString="*.gif") returned 5 [0068.158] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.doc") returned 0 [0068.158] lstrlenA (lpString="*.doc") returned 5 [0068.158] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.docx") returned 0 [0068.158] lstrlenA (lpString="*.docx") returned 6 [0068.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.xls") returned 0 [0068.159] lstrlenA (lpString="*.xls") returned 5 [0068.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.xlsx") returned 0 [0068.159] lstrlenA (lpString="*.xlsx") returned 6 [0068.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.ppt") returned 0 [0068.159] lstrlenA (lpString="*.ppt") returned 5 [0068.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.pptx") returned 0 [0068.159] lstrlenA (lpString="*.pptx") returned 6 [0068.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.pdf") returned 0 [0068.159] lstrlenA (lpString="*.pdf") returned 5 [0068.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.mov") returned 0 [0068.159] lstrlenA (lpString="*.mov") returned 5 [0068.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.m2v") returned 0 [0068.159] lstrlenA (lpString="*.m2v") returned 5 [0068.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.3gp") returned 0 [0068.159] lstrlenA (lpString="*.3gp") returned 5 [0068.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.mpeg") returned 0 [0068.159] lstrlenA (lpString="*.mpeg") returned 6 [0068.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.mpg") returned 0 [0068.159] lstrlenA (lpString="*.mpg") returned 5 [0068.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.flv") returned 0 [0068.159] lstrlenA (lpString="*.flv") returned 5 [0068.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.avi") returned 0 [0068.159] lstrlenA (lpString="*.avi") returned 5 [0068.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.mp4") returned 0 [0068.159] lstrlenA (lpString="*.mp4") returned 5 [0068.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.wmv") returned 0 [0068.160] lstrlenA (lpString="*.wmv") returned 5 [0068.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.divx") returned 0 [0068.160] lstrlenA (lpString="*.divx") returned 6 [0068.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.mkv") returned 0 [0068.160] lstrlenA (lpString="*.mkv") returned 5 [0068.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.mp3") returned 0 [0068.160] lstrlenA (lpString="*.mp3") returned 5 [0068.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.wav") returned 0 [0068.160] lstrlenA (lpString="*.wav") returned 5 [0068.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.flac") returned 0 [0068.160] lstrlenA (lpString="*.flac") returned 6 [0068.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.ape") returned 0 [0068.160] lstrlenA (lpString="*.ape") returned 5 [0068.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.wma") returned 0 [0068.160] lstrlenA (lpString="*.wma") returned 5 [0068.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.ac3") returned 0 [0068.160] lstrlenA (lpString="*.ac3") returned 5 [0068.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\WebLink.CZE", pszSpec="*.mxf") returned 0 [0068.160] lstrlenA (lpString="*.mxf") returned 5 [0068.160] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8322fda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="WebLink.CZE", cAlternateFileName="")) returned 0 [0068.160] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0068.160] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="da_DK", cAlternateFileName="")) returned 1 [0068.160] lstrcmpA (lpString1=".", lpString2="da_DK") returned -1 [0068.160] lstrcmpA (lpString1="..", lpString2="da_DK") returned -1 [0068.161] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*.*") returned="*.*" [0068.161] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.164] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.164] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.164] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.164] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.164] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="accessibility.DAN", cAlternateFileName="ACCESS~1.DAN")) returned 1 [0068.164] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.164] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\*.*") returned="*.*" [0068.164] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0068.165] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0068.168] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.169] CloseHandle (hObject=0x94) returned 1 [0068.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.zip") returned 0 [0068.169] lstrlenA (lpString="*.zip") returned 5 [0068.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.rar") returned 0 [0068.169] lstrlenA (lpString="*.rar") returned 5 [0068.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.7z") returned 0 [0068.169] lstrlenA (lpString="*.7z") returned 4 [0068.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.tar") returned 0 [0068.169] lstrlenA (lpString="*.tar") returned 5 [0068.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.gzip") returned 0 [0068.169] lstrlenA (lpString="*.gzip") returned 6 [0068.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.jpg") returned 0 [0068.169] lstrlenA (lpString="*.jpg") returned 5 [0068.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.jpeg") returned 0 [0068.169] lstrlenA (lpString="*.jpeg") returned 6 [0068.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.psd") returned 0 [0068.169] lstrlenA (lpString="*.psd") returned 5 [0068.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.gif") returned 0 [0068.169] lstrlenA (lpString="*.gif") returned 5 [0068.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.doc") returned 0 [0068.169] lstrlenA (lpString="*.doc") returned 5 [0068.169] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.docx") returned 0 [0068.170] lstrlenA (lpString="*.docx") returned 6 [0068.170] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.xls") returned 0 [0068.170] lstrlenA (lpString="*.xls") returned 5 [0068.170] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.xlsx") returned 0 [0068.170] lstrlenA (lpString="*.xlsx") returned 6 [0068.170] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.ppt") returned 0 [0068.170] lstrlenA (lpString="*.ppt") returned 5 [0068.170] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.pptx") returned 0 [0068.170] lstrlenA (lpString="*.pptx") returned 6 [0068.170] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.pdf") returned 0 [0068.170] lstrlenA (lpString="*.pdf") returned 5 [0068.170] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.mov") returned 0 [0068.170] lstrlenA (lpString="*.mov") returned 5 [0068.170] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.m2v") returned 0 [0068.170] lstrlenA (lpString="*.m2v") returned 5 [0068.170] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.3gp") returned 0 [0068.170] lstrlenA (lpString="*.3gp") returned 5 [0068.170] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.mpeg") returned 0 [0068.170] lstrlenA (lpString="*.mpeg") returned 6 [0068.170] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.mpg") returned 0 [0068.170] lstrlenA (lpString="*.mpg") returned 5 [0068.170] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.flv") returned 0 [0068.170] lstrlenA (lpString="*.flv") returned 5 [0068.170] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.avi") returned 0 [0068.170] lstrlenA (lpString="*.avi") returned 5 [0068.170] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.mp4") returned 0 [0068.171] lstrlenA (lpString="*.mp4") returned 5 [0068.171] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.wmv") returned 0 [0068.171] lstrlenA (lpString="*.wmv") returned 5 [0068.171] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.divx") returned 0 [0068.171] lstrlenA (lpString="*.divx") returned 6 [0068.171] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.mkv") returned 0 [0068.171] lstrlenA (lpString="*.mkv") returned 5 [0068.171] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.mp3") returned 0 [0068.171] lstrlenA (lpString="*.mp3") returned 5 [0068.171] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.wav") returned 0 [0068.171] lstrlenA (lpString="*.wav") returned 5 [0068.171] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.flac") returned 0 [0068.171] lstrlenA (lpString="*.flac") returned 6 [0068.171] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.ape") returned 0 [0068.171] lstrlenA (lpString="*.ape") returned 5 [0068.171] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.wma") returned 0 [0068.171] lstrlenA (lpString="*.wma") returned 5 [0068.171] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.ac3") returned 0 [0068.171] lstrlenA (lpString="*.ac3") returned 5 [0068.171] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN", pszSpec="*.mxf") returned 0 [0068.171] lstrlenA (lpString="*.mxf") returned 5 [0068.171] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x64600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.DAN", cAlternateFileName="")) returned 1 [0068.171] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.171] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\accessibility.DAN") returned="accessibility.DAN" [0068.171] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0068.172] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0068.172] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.zip") returned 0 [0068.172] lstrlenA (lpString="*.zip") returned 5 [0068.172] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.rar") returned 0 [0068.172] lstrlenA (lpString="*.rar") returned 5 [0068.172] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.7z") returned 0 [0068.172] lstrlenA (lpString="*.7z") returned 4 [0068.172] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.tar") returned 0 [0068.172] lstrlenA (lpString="*.tar") returned 5 [0068.172] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.gzip") returned 0 [0068.172] lstrlenA (lpString="*.gzip") returned 6 [0068.172] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.jpg") returned 0 [0068.172] lstrlenA (lpString="*.jpg") returned 5 [0068.172] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.jpeg") returned 0 [0068.172] lstrlenA (lpString="*.jpeg") returned 6 [0068.172] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.psd") returned 0 [0068.172] lstrlenA (lpString="*.psd") returned 5 [0068.172] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.gif") returned 0 [0068.172] lstrlenA (lpString="*.gif") returned 5 [0068.172] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.doc") returned 0 [0068.172] lstrlenA (lpString="*.doc") returned 5 [0068.172] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.docx") returned 0 [0068.172] lstrlenA (lpString="*.docx") returned 6 [0068.172] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.xls") returned 0 [0068.173] lstrlenA (lpString="*.xls") returned 5 [0068.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.xlsx") returned 0 [0068.173] lstrlenA (lpString="*.xlsx") returned 6 [0068.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.ppt") returned 0 [0068.173] lstrlenA (lpString="*.ppt") returned 5 [0068.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.pptx") returned 0 [0068.173] lstrlenA (lpString="*.pptx") returned 6 [0068.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.pdf") returned 0 [0068.173] lstrlenA (lpString="*.pdf") returned 5 [0068.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.mov") returned 0 [0068.173] lstrlenA (lpString="*.mov") returned 5 [0068.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.m2v") returned 0 [0068.173] lstrlenA (lpString="*.m2v") returned 5 [0068.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.3gp") returned 0 [0068.173] lstrlenA (lpString="*.3gp") returned 5 [0068.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.mpeg") returned 0 [0068.173] lstrlenA (lpString="*.mpeg") returned 6 [0068.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.mpg") returned 0 [0068.173] lstrlenA (lpString="*.mpg") returned 5 [0068.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.flv") returned 0 [0068.173] lstrlenA (lpString="*.flv") returned 5 [0068.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.avi") returned 0 [0068.173] lstrlenA (lpString="*.avi") returned 5 [0068.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.mp4") returned 0 [0068.173] lstrlenA (lpString="*.mp4") returned 5 [0068.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.wmv") returned 0 [0068.173] lstrlenA (lpString="*.wmv") returned 5 [0068.173] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.divx") returned 0 [0068.174] lstrlenA (lpString="*.divx") returned 6 [0068.174] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.mkv") returned 0 [0068.174] lstrlenA (lpString="*.mkv") returned 5 [0068.174] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.mp3") returned 0 [0068.174] lstrlenA (lpString="*.mp3") returned 5 [0068.174] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.wav") returned 0 [0068.174] lstrlenA (lpString="*.wav") returned 5 [0068.174] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.flac") returned 0 [0068.174] lstrlenA (lpString="*.flac") returned 6 [0068.174] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.ape") returned 0 [0068.174] lstrlenA (lpString="*.ape") returned 5 [0068.174] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.wma") returned 0 [0068.174] lstrlenA (lpString="*.wma") returned 5 [0068.174] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.ac3") returned 0 [0068.174] lstrlenA (lpString="*.ac3") returned 5 [0068.174] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN", pszSpec="*.mxf") returned 0 [0068.174] lstrlenA (lpString="*.mxf") returned 5 [0068.174] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="AdobeCollabSync.DAN", cAlternateFileName="ADOBEC~1.DAN")) returned 1 [0068.174] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.174] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Acroform.DAN") returned="Acroform.DAN" [0068.174] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0068.174] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0068.174] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\AdobeCollabSync.DAN", pszSpec="*.zip") returned 0 [0068.175] lstrlenA (lpString="*.zip") returned 5 [0068.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\AdobeCollabSync.DAN", pszSpec="*.rar") returned 0 [0068.175] lstrlenA (lpString="*.rar") returned 5 [0068.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\AdobeCollabSync.DAN", pszSpec="*.7z") returned 0 [0068.175] lstrlenA (lpString="*.7z") returned 4 [0068.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\AdobeCollabSync.DAN", pszSpec="*.tar") returned 0 [0068.175] lstrlenA (lpString="*.tar") returned 5 [0068.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\AdobeCollabSync.DAN", pszSpec="*.gzip") returned 0 [0068.175] lstrlenA (lpString="*.gzip") returned 6 [0068.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\AdobeCollabSync.DAN", pszSpec="*.jpg") returned 0 [0068.175] lstrlenA (lpString="*.jpg") returned 5 [0068.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\AdobeCollabSync.DAN", pszSpec="*.jpeg") returned 0 [0068.175] lstrlenA (lpString="*.jpeg") returned 6 [0068.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\AdobeCollabSync.DAN", pszSpec="*.psd") returned 0 [0068.175] lstrlenA (lpString="*.psd") returned 5 [0068.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\AdobeCollabSync.DAN", pszSpec="*.gif") returned 0 [0068.175] lstrlenA (lpString="*.gif") returned 5 [0068.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\AdobeCollabSync.DAN", pszSpec="*.doc") returned 0 [0068.175] lstrlenA (lpString="*.doc") returned 5 [0068.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\AdobeCollabSync.DAN", pszSpec="*.docx") returned 0 [0068.175] lstrlenA (lpString="*.docx") returned 6 [0068.175] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82db9460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x76400, dwReserved0=0x74, dwReserved1=0x0, cFileName="Annots.DAN", cAlternateFileName="")) returned 1 [0068.176] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.176] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\AdobeCollabSync.DAN") returned="AdobeCollabSync.DAN" [0068.176] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0068.176] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0068.176] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820558a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x74, dwReserved1=0x0, cFileName="BRdlang32.DAN", cAlternateFileName="BRDLAN~1.DAN")) returned 1 [0068.176] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.176] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Annots.DAN") returned="Annots.DAN" [0068.176] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0068.176] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0068.176] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1de00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Checkers.DAN", cAlternateFileName="")) returned 1 [0068.176] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.176] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\BRdlang32.DAN") returned="BRdlang32.DAN" [0068.176] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0068.176] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0068.176] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f200, dwReserved0=0x74, dwReserved1=0x0, cFileName="DigSig.DAN", cAlternateFileName="")) returned 1 [0068.176] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.176] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Checkers.DAN") returned="Checkers.DAN" [0068.177] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0068.177] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0068.177] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="DVA.DAN", cAlternateFileName="")) returned 1 [0068.177] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.177] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\DigSig.DAN") returned="DigSig.DAN" [0068.177] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0068.177] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0068.177] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="eBook.DAN", cAlternateFileName="")) returned 1 [0068.177] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.177] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\DVA.DAN") returned="DVA.DAN" [0068.177] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0068.177] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0068.177] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x74, dwReserved1=0x0, cFileName="EScript.DAN", cAlternateFileName="")) returned 1 [0068.177] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.177] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\eBook.DAN") returned="eBook.DAN" [0068.177] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0068.177] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0068.178] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x74, dwReserved1=0x0, cFileName="IA32.DAN", cAlternateFileName="")) returned 1 [0068.178] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.178] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\EScript.DAN") returned="EScript.DAN" [0068.178] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0068.178] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0068.178] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x74, dwReserved1=0x0, cFileName="makeaccessible.DAN", cAlternateFileName="MAKEAC~1.DAN")) returned 1 [0068.178] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.178] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\IA32.DAN") returned="IA32.DAN" [0068.178] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0068.178] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0068.178] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x74, dwReserved1=0x0, cFileName="Multimedia.DAN", cAlternateFileName="MULTIM~1.DAN")) returned 1 [0068.178] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.178] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\makeaccessible.DAN") returned="makeaccessible.DAN" [0068.178] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0068.178] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0068.178] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="pddom.DAN", cAlternateFileName="")) returned 1 [0068.179] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.179] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Multimedia.DAN") returned="Multimedia.DAN" [0068.179] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0068.179] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0068.179] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7f000, dwReserved0=0x74, dwReserved1=0x0, cFileName="PPKLITE.DAN", cAlternateFileName="")) returned 1 [0068.179] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.179] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\pddom.DAN") returned="pddom.DAN" [0068.179] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0068.179] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0068.179] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x144c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="RdLang32.DAN", cAlternateFileName="")) returned 1 [0068.179] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.179] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\PPKLITE.DAN") returned="PPKLITE.DAN" [0068.179] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0068.179] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0068.179] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="ReadOutLoud.DAN", cAlternateFileName="READOU~1.DAN")) returned 1 [0068.179] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.179] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\RdLang32.DAN") returned="RdLang32.DAN" [0068.179] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0068.180] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0068.180] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x74, dwReserved1=0x0, cFileName="reflow.DAN", cAlternateFileName="")) returned 1 [0068.180] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.180] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\ReadOutLoud.DAN") returned="ReadOutLoud.DAN" [0068.180] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0068.180] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0068.180] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x74, dwReserved1=0x0, cFileName="SaveAsRTF.DAN", cAlternateFileName="SAVEAS~1.DAN")) returned 1 [0068.180] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.180] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\reflow.DAN") returned="reflow.DAN" [0068.180] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0068.180] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0068.180] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Search.DAN", cAlternateFileName="")) returned 1 [0068.180] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.180] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\SaveAsRTF.DAN") returned="SaveAsRTF.DAN" [0068.180] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0068.180] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0068.180] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82cd4c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x74, dwReserved1=0x0, cFileName="SendMail.DAN", cAlternateFileName="")) returned 1 [0068.181] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.181] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Search.DAN") returned="Search.DAN" [0068.181] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0068.181] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0068.181] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0068.181] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0068.181] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0068.181] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\SendMail.DAN") returned="SendMail.DAN" [0068.181] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2e048a, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0068.181] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.181] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0068.181] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.182] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.182] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8ca7, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0068.182] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0068.182] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\*.*") returned="*.*" [0068.182] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\" [0068.182] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\") returned="" [0068.186] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.187] CloseHandle (hObject=0x98) returned 1 [0068.187] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0068.187] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0068.187] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\DEXShare.asfx") returned="DEXShare.asfx" [0068.187] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\" [0068.187] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\") returned="" [0068.187] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0068.187] FindClose (in: hFindFile=0x2e3578 | out: hFindFile=0x2e3578) returned 1 [0068.187] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddfb360, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Spelling.DAN", cAlternateFileName="")) returned 1 [0068.187] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.187] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\*.*") returned="*.*" [0068.187] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0068.187] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0068.187] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f4be5c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="updater.DAN", cAlternateFileName="")) returned 1 [0068.188] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.188] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Spelling.DAN") returned="Spelling.DAN" [0068.188] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0068.188] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0068.188] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Weblink.DAN", cAlternateFileName="")) returned 1 [0068.188] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.188] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\updater.DAN") returned="updater.DAN" [0068.188] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0068.188] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="" [0068.188] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82caeac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Weblink.DAN", cAlternateFileName="")) returned 0 [0068.188] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0068.188] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="de_DE", cAlternateFileName="")) returned 1 [0068.188] lstrcmpA (lpString1=".", lpString2="de_DE") returned -1 [0068.188] lstrcmpA (lpString1="..", lpString2="de_DE") returned -1 [0068.188] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*.*") returned="*.*" [0068.188] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.191] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.192] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.192] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.192] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.192] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="accessibility.DEU", cAlternateFileName="ACCESS~1.DEU")) returned 1 [0068.192] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.192] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\*.*") returned="*.*" [0068.192] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0068.192] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0068.193] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.193] CloseHandle (hObject=0x94) returned 1 [0068.194] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ba4120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acroform.DEU", cAlternateFileName="")) returned 1 [0068.194] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.194] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\accessibility.DEU") returned="accessibility.DEU" [0068.194] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0068.194] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0068.194] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="AdobeCollabSync.DEU", cAlternateFileName="ADOBEC~1.DEU")) returned 1 [0068.194] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.194] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Acroform.DEU") returned="Acroform.DEU" [0068.194] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0068.194] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0068.194] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82a99780, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80a00, dwReserved0=0x74, dwReserved1=0x0, cFileName="Annots.DEU", cAlternateFileName="")) returned 1 [0068.194] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.194] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\AdobeCollabSync.DEU") returned="AdobeCollabSync.DEU" [0068.194] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0068.194] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0068.195] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.195] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Annots.DEU") returned="Annots.DEU" [0068.195] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0068.195] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0068.195] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.195] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\BRdlang32.DEU") returned="BRdlang32.DEU" [0068.195] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0068.195] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0068.195] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.195] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Checkers.DEU") returned="Checkers.DEU" [0068.195] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0068.195] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0068.195] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.195] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\DigSig.DEU") returned="DigSig.DEU" [0068.195] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0068.196] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0068.196] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.196] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\DVA.DEU") returned="DVA.DEU" [0068.196] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0068.196] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0068.196] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.196] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\eBook.DEU") returned="eBook.DEU" [0068.196] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0068.196] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0068.196] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.196] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Escript.deu") returned="Escript.deu" [0068.196] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0068.196] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0068.196] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.196] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\IA32.DEU") returned="IA32.DEU" [0068.197] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0068.197] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0068.197] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.197] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\makeaccessible.DEU") returned="makeaccessible.DEU" [0068.197] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0068.197] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0068.197] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.197] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Multimedia.DEU") returned="Multimedia.DEU" [0068.197] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0068.197] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0068.197] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.197] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\pddom.DEU") returned="pddom.DEU" [0068.197] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0068.197] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0068.197] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.197] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\PPKLITE.DEU") returned="PPKLITE.DEU" [0068.198] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0068.198] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0068.198] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.198] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\RdLang32.DEU") returned="RdLang32.DEU" [0068.198] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0068.198] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0068.198] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.198] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\ReadOutLoud.DEU") returned="ReadOutLoud.DEU" [0068.198] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0068.198] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0068.198] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.198] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\reflow.DEU") returned="reflow.DEU" [0068.198] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0068.198] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0068.198] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.199] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\SaveAsRTF.DEU") returned="SaveAsRTF.DEU" [0068.199] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0068.199] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0068.199] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.199] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Search.DEU") returned="Search.DEU" [0068.199] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0068.199] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0068.199] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0068.199] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0068.199] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\SendMail.deu") returned="SendMail.deu" [0068.199] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2e048a, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0068.200] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.201] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.201] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.201] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0068.201] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\*.*") returned="*.*" [0068.201] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\" [0068.201] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\") returned="" [0068.204] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.204] CloseHandle (hObject=0x98) returned 1 [0068.204] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0068.204] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\DEXShare.asfx") returned="DEXShare.asfx" [0068.204] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\" [0068.204] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\") returned="" [0068.204] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.204] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\*.*") returned="*.*" [0068.204] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0068.204] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0068.205] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.205] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Spelling.DEU") returned="Spelling.DEU" [0068.205] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0068.205] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0068.205] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.205] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\updater.DEU") returned="updater.DEU" [0068.205] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0068.205] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="" [0068.205] lstrcmpA (lpString1=".", lpString2="es_ES") returned -1 [0068.205] lstrcmpA (lpString1="..", lpString2="es_ES") returned -1 [0068.205] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*.*") returned="*.*" [0068.205] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.207] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.207] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.207] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.207] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.208] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\*.*") returned="*.*" [0068.208] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0068.208] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0068.209] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.209] CloseHandle (hObject=0x94) returned 1 [0068.209] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.210] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\accessibility.ESP") returned="accessibility.ESP" [0068.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0068.210] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0068.210] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.210] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Acroform.ESP") returned="Acroform.ESP" [0068.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0068.210] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0068.210] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.210] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\AdobeCollabSync.ESP") returned="AdobeCollabSync.ESP" [0068.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0068.210] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0068.210] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.210] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Annots.ESP") returned="Annots.ESP" [0068.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0068.210] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0068.210] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.211] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\BRdlang32.ESP") returned="BRdlang32.ESP" [0068.211] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0068.211] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0068.211] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.211] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Checkers.ESP") returned="Checkers.ESP" [0068.211] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0068.211] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0068.211] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.211] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\DigSig.ESP") returned="DigSig.ESP" [0068.211] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0068.211] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0068.211] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.211] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\DVA.ESP") returned="DVA.ESP" [0068.211] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0068.211] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0068.211] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.212] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\eBook.ESP") returned="eBook.ESP" [0068.212] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0068.212] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0068.212] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.212] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\EScript.ESP") returned="EScript.ESP" [0068.212] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0068.212] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0068.212] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.212] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\IA32.ESP") returned="IA32.ESP" [0068.212] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0068.212] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0068.212] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.212] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\makeaccessible.ESP") returned="makeaccessible.ESP" [0068.212] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0068.212] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0068.212] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.212] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Multimedia.ESP") returned="Multimedia.ESP" [0068.213] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0068.213] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0068.213] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.213] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\pddom.ESP") returned="pddom.ESP" [0068.213] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0068.213] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0068.213] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.213] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\PPKLITE.ESP") returned="PPKLITE.ESP" [0068.213] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0068.213] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0068.216] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.216] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\RdLang32.ESP") returned="RdLang32.ESP" [0068.216] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0068.216] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0068.217] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.217] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\ReadOutLoud.ESP") returned="ReadOutLoud.ESP" [0068.217] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0068.217] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0068.217] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.217] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\reflow.ESP") returned="reflow.ESP" [0068.217] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0068.217] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0068.217] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.217] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\SaveAsRTF.ESP") returned="SaveAsRTF.ESP" [0068.217] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0068.217] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0068.217] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.217] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Search.ESP") returned="Search.ESP" [0068.217] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0068.217] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0068.218] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0068.218] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0068.218] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\SendMail.ESP") returned="SendMail.ESP" [0068.218] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2e048a, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0068.218] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.218] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.218] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.218] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0068.218] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\*.*") returned="*.*" [0068.218] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\" [0068.218] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\") returned="" [0068.222] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.222] CloseHandle (hObject=0x98) returned 1 [0068.222] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0068.222] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\DEXShare.asfx") returned="DEXShare.asfx" [0068.222] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\" [0068.222] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\") returned="" [0068.222] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.222] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\*.*") returned="*.*" [0068.222] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0068.223] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0068.223] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.223] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Spelling.ESP") returned="Spelling.ESP" [0068.223] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0068.223] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0068.223] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.223] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\updater.ESP") returned="updater.ESP" [0068.223] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0068.223] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="" [0068.223] lstrcmpA (lpString1=".", lpString2="eu_ES") returned -1 [0068.223] lstrcmpA (lpString1="..", lpString2="eu_ES") returned -1 [0068.223] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*.*") returned="*.*" [0068.223] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.226] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.226] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.226] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.226] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.226] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\*.*") returned="*.*" [0068.226] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0068.226] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0068.228] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.228] CloseHandle (hObject=0x94) returned 1 [0068.228] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.228] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\accessibility.EUQ") returned="accessibility.EUQ" [0068.228] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0068.228] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0068.228] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.228] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Acroform.EUQ") returned="Acroform.EUQ" [0068.228] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0068.229] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0068.229] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.229] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\AdobeCollabSync.EUQ") returned="AdobeCollabSync.EUQ" [0068.229] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0068.229] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0068.229] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.229] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Annots.EUQ") returned="Annots.EUQ" [0068.229] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0068.229] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0068.229] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.229] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\BRdlang32.EUQ") returned="BRdlang32.EUQ" [0068.229] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0068.230] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0068.230] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.230] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Checkers.EUQ") returned="Checkers.EUQ" [0068.230] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0068.230] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0068.230] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.230] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\DigSig.EUQ") returned="DigSig.EUQ" [0068.230] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0068.230] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0068.230] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.230] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\DVA.EUQ") returned="DVA.EUQ" [0068.230] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0068.230] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0068.230] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.230] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\eBook.EUQ") returned="eBook.EUQ" [0068.230] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0068.231] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0068.231] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.231] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\EScript.EUQ") returned="EScript.EUQ" [0068.231] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0068.231] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0068.231] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.231] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\IA32.EUQ") returned="IA32.EUQ" [0068.231] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0068.231] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0068.231] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.231] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\makeaccessible.EUQ") returned="makeaccessible.EUQ" [0068.231] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0068.231] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0068.231] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.231] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Multimedia.EUQ") returned="Multimedia.EUQ" [0068.231] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0068.232] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0068.232] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.232] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\pddom.EUQ") returned="pddom.EUQ" [0068.232] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0068.232] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0068.232] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.232] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\PPKLite.EUQ") returned="PPKLite.EUQ" [0068.232] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0068.232] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0068.232] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.232] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\RdLang32.EUQ") returned="RdLang32.EUQ" [0068.232] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0068.232] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0068.232] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.232] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\ReadOutLoud.EUQ") returned="ReadOutLoud.EUQ" [0068.232] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0068.232] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0068.233] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.233] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\reflow.EUQ") returned="reflow.EUQ" [0068.233] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0068.233] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0068.233] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.233] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\SaveAsRTF.EUQ") returned="SaveAsRTF.EUQ" [0068.233] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0068.233] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0068.233] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.233] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Search.EUQ") returned="Search.EUQ" [0068.233] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0068.233] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0068.233] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0068.233] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0068.233] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\SendMail.EUQ") returned="SendMail.EUQ" [0068.233] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2e048a, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0068.234] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.234] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.234] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.234] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0068.234] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\*.*") returned="*.*" [0068.234] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\" [0068.234] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\") returned="" [0068.238] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.238] CloseHandle (hObject=0x98) returned 1 [0068.238] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0068.238] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\DEXShare.asfx") returned="DEXShare.asfx" [0068.238] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\" [0068.238] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\") returned="" [0068.238] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.238] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\*.*") returned="*.*" [0068.238] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0068.238] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0068.238] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.238] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Spelling.EUQ") returned="Spelling.EUQ" [0068.239] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0068.239] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0068.239] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.239] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\updater.EUQ") returned="updater.EUQ" [0068.239] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0068.239] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="" [0068.239] lstrcmpA (lpString1=".", lpString2="fi_FI") returned -1 [0068.239] lstrcmpA (lpString1="..", lpString2="fi_FI") returned -1 [0068.239] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*.*") returned="*.*" [0068.239] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.242] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.242] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.242] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.242] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.242] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\*.*") returned="*.*" [0068.242] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0068.242] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="" [0068.243] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.244] CloseHandle (hObject=0x94) returned 1 [0068.244] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.244] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\accessibility.SUO") returned="accessibility.SUO" [0068.244] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0068.244] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="" [0068.244] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.244] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Acroform.SUO") returned="Acroform.SUO" [0068.244] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0068.244] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="" [0068.244] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.244] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\AdobeCollabSync.SUO") returned="AdobeCollabSync.SUO" [0068.245] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0068.245] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="" [0068.245] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.245] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Annots.SUO") returned="Annots.SUO" [0068.245] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0068.245] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="" [0068.245] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.245] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\BRdlang32.SUO") returned="BRdlang32.SUO" [0068.245] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0068.245] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="" [0068.245] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.245] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Checkers.SUO") returned="Checkers.SUO" [0068.245] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0068.246] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="" [0068.246] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.246] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\DigSig.SUO") returned="DigSig.SUO" [0068.246] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0068.246] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="" [0068.246] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.246] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\DVA.SUO") returned="DVA.SUO" [0068.246] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0068.246] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="" [0068.246] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.246] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\eBook.SUO") returned="eBook.SUO" [0068.246] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0068.246] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="" [0068.246] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.246] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\EScript.SUO") returned="EScript.SUO" [0068.247] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0068.247] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="" [0068.247] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.247] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\IA32.SUO") returned="IA32.SUO" [0068.247] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0068.247] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="" [0068.247] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.247] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\makeaccessible.SUO") returned="makeaccessible.SUO" [0068.247] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0068.247] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="" [0068.247] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.247] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Multimedia.SUO") returned="Multimedia.SUO" [0068.247] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0068.247] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="" [0068.247] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.247] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\pddom.SUO") returned="pddom.SUO" [0068.247] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0068.248] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="" [0068.248] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.248] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\PPKLITE.SUO") returned="PPKLITE.SUO" [0068.248] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0068.248] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="" [0068.248] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.248] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\RdLang32.SUO") returned="RdLang32.SUO" [0068.248] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0068.248] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="" [0068.248] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.248] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\ReadOutLoud.SUO") returned="ReadOutLoud.SUO" [0068.248] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0068.248] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="" [0068.248] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.248] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\reflow.SUO") returned="reflow.SUO" [0068.248] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0068.249] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="" [0068.249] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.249] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\SaveAsRTF.SUO") returned="SaveAsRTF.SUO" [0068.249] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0068.249] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="" [0068.249] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.249] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Search.SUO") returned="Search.SUO" [0068.249] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0068.249] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="" [0068.249] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0068.249] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0068.249] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\SendMail.SUO") returned="SendMail.SUO" [0068.249] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2e048a, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0068.251] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.251] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.251] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.251] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0068.251] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\*.*") returned="*.*" [0068.251] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\" [0068.251] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\") returned="" [0068.254] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.254] CloseHandle (hObject=0x98) returned 1 [0068.254] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0068.254] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\DEXShare.asfx") returned="DEXShare.asfx" [0068.254] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\" [0068.255] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\") returned="" [0068.255] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.255] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\*.*") returned="*.*" [0068.255] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0068.255] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="" [0068.255] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.255] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Spelling.SUO") returned="Spelling.SUO" [0068.255] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0068.255] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="" [0068.255] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.255] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\updater.SUO") returned="updater.SUO" [0068.255] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0068.255] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="" [0068.255] lstrcmpA (lpString1=".", lpString2="fr_FR") returned -1 [0068.256] lstrcmpA (lpString1="..", lpString2="fr_FR") returned -1 [0068.256] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*.*") returned="*.*" [0068.256] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f824e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.259] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.259] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.259] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.259] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.259] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\*.*") returned="*.*" [0068.259] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" [0068.259] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\") returned="" [0068.262] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.262] CloseHandle (hObject=0x94) returned 1 [0068.262] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.262] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\accessibility.FRA") returned="accessibility.FRA" [0068.262] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" [0068.262] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\") returned="" [0068.263] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.263] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Acroform.FRA") returned="Acroform.FRA" [0068.263] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" [0068.263] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\") returned="" [0068.263] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.263] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\AdobeCollabSync.FRA") returned="AdobeCollabSync.FRA" [0068.263] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" [0068.263] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\") returned="" [0068.263] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.263] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Annots.FRA") returned="Annots.FRA" [0068.263] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" [0068.263] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\") returned="" [0068.263] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.263] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\BRdlang32.FRA") returned="BRdlang32.FRA" [0068.263] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" [0068.263] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\") returned="" [0068.264] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.264] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Checkers.FRA") returned="Checkers.FRA" [0068.264] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" [0068.264] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\") returned="" [0068.264] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.264] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\DigSig.FRA") returned="DigSig.FRA" [0068.264] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" [0068.264] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\") returned="" [0068.264] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.264] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\DVA.FRA") returned="DVA.FRA" [0068.264] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" [0068.264] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\") returned="" [0068.264] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.264] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\eBook.FRA") returned="eBook.FRA" [0068.264] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" [0068.264] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\") returned="" [0068.265] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0068.265] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\EScript.fra") returned="EScript.fra" [0068.265] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" [0068.265] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\") returned="" [0068.265] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\IA32.FRA") returned="IA32.FRA" [0068.265] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\makeaccessible.FRA") returned="makeaccessible.FRA" [0068.265] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Multimedia.FRA") returned="Multimedia.FRA" [0068.265] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\pddom.FRA") returned="pddom.FRA" [0068.265] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\PPKLITE.FRA") returned="PPKLITE.FRA" [0068.266] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0068.266] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0068.266] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2e048a, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0068.266] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.266] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.266] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.270] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.270] CloseHandle (hObject=0x98) returned 1 [0068.271] lstrcmpA (lpString1=".", lpString2="hr_HR") returned -1 [0068.271] lstrcmpA (lpString1="..", lpString2="hr_HR") returned -1 [0068.271] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.273] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.273] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.273] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.274] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.274] CloseHandle (hObject=0x94) returned 1 [0068.275] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0068.275] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0068.276] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2e048a, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0068.277] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.277] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.277] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.280] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.280] CloseHandle (hObject=0x98) returned 1 [0068.281] lstrcmpA (lpString1=".", lpString2="hu_HU") returned -1 [0068.281] lstrcmpA (lpString1="..", lpString2="hu_HU") returned -1 [0068.281] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.283] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.283] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.284] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.285] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.285] CloseHandle (hObject=0x94) returned 1 [0068.286] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0068.286] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0068.286] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2e048a, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0068.287] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.287] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.287] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.290] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.290] CloseHandle (hObject=0x98) returned 1 [0068.290] lstrcmpA (lpString1=".", lpString2="it_IT") returned -1 [0068.290] lstrcmpA (lpString1="..", lpString2="it_IT") returned -1 [0068.290] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.293] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.293] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.293] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.295] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.295] CloseHandle (hObject=0x94) returned 1 [0068.296] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0068.296] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0068.296] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2e048a, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0068.297] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.297] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.298] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.301] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.301] CloseHandle (hObject=0x98) returned 1 [0068.301] lstrcmpA (lpString1=".", lpString2="ja_JP") returned -1 [0068.301] lstrcmpA (lpString1="..", lpString2="ja_JP") returned -1 [0068.301] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.304] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.304] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.304] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.306] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.306] CloseHandle (hObject=0x94) returned 1 [0068.307] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0068.307] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0068.307] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2e048a, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0068.308] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.308] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.308] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.311] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.311] CloseHandle (hObject=0x98) returned 1 [0068.312] lstrcmpA (lpString1=".", lpString2="ko_KR") returned -1 [0068.312] lstrcmpA (lpString1="..", lpString2="ko_KR") returned -1 [0068.312] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.315] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.315] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.315] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.316] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.316] CloseHandle (hObject=0x94) returned 1 [0068.317] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0068.317] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0068.317] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2e048a, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0068.318] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.318] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.319] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.322] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.325] CloseHandle (hObject=0x98) returned 1 [0068.326] lstrcmpA (lpString1=".", lpString2="nb_NO") returned -1 [0068.326] lstrcmpA (lpString1="..", lpString2="nb_NO") returned -1 [0068.326] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.328] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.328] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.328] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.329] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.330] CloseHandle (hObject=0x94) returned 1 [0068.331] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0068.331] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0068.331] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2e048a, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0068.331] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.331] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.331] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.335] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.335] CloseHandle (hObject=0x98) returned 1 [0068.335] lstrcmpA (lpString1=".", lpString2="nl_NL") returned -1 [0068.335] lstrcmpA (lpString1="..", lpString2="nl_NL") returned -1 [0068.335] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.338] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.338] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.338] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.340] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.340] CloseHandle (hObject=0x94) returned 1 [0068.341] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0068.341] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0068.341] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2e048a, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0068.342] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.342] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.342] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.349] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.349] CloseHandle (hObject=0x98) returned 1 [0068.349] lstrcmpA (lpString1=".", lpString2="pl_PL") returned -1 [0068.349] lstrcmpA (lpString1="..", lpString2="pl_PL") returned -1 [0068.349] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.352] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.352] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.352] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.354] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.354] CloseHandle (hObject=0x94) returned 1 [0068.355] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0068.355] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0068.355] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2e048a, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0068.356] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.356] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.356] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.359] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.359] CloseHandle (hObject=0x98) returned 1 [0068.360] lstrcmpA (lpString1=".", lpString2="pt_BR") returned -1 [0068.360] lstrcmpA (lpString1="..", lpString2="pt_BR") returned -1 [0068.360] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.362] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.362] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.362] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.364] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.364] CloseHandle (hObject=0x94) returned 1 [0068.365] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0068.365] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0068.365] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2e048a, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0068.366] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.367] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.367] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.369] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.370] CloseHandle (hObject=0x98) returned 1 [0068.370] lstrcmpA (lpString1=".", lpString2="ro_RO") returned -1 [0068.370] lstrcmpA (lpString1="..", lpString2="ro_RO") returned -1 [0068.370] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.372] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.372] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.372] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.374] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.374] CloseHandle (hObject=0x94) returned 1 [0068.375] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0068.375] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0068.375] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2e048a, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0068.375] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.375] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.375] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.378] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.378] CloseHandle (hObject=0x98) returned 1 [0068.379] lstrcmpA (lpString1=".", lpString2="ru_RU") returned -1 [0068.379] lstrcmpA (lpString1="..", lpString2="ru_RU") returned -1 [0068.379] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.382] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.382] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.382] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.383] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.383] CloseHandle (hObject=0x94) returned 1 [0068.384] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0068.384] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0068.384] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2e048a, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0068.386] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.386] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.386] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.389] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.389] CloseHandle (hObject=0x98) returned 1 [0068.389] lstrcmpA (lpString1=".", lpString2="sk_SK") returned -1 [0068.389] lstrcmpA (lpString1="..", lpString2="sk_SK") returned -1 [0068.389] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.391] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.392] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.392] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.393] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.393] CloseHandle (hObject=0x94) returned 1 [0068.394] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0068.394] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0068.395] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2e048a, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0068.395] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.395] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.395] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.399] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.399] CloseHandle (hObject=0x98) returned 1 [0068.399] lstrcmpA (lpString1=".", lpString2="sl_SI") returned -1 [0068.399] lstrcmpA (lpString1="..", lpString2="sl_SI") returned -1 [0068.399] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.403] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.404] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.404] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.405] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.405] CloseHandle (hObject=0x94) returned 1 [0068.406] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0068.406] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0068.406] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2e048a, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0068.408] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.408] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.408] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.414] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.414] CloseHandle (hObject=0x98) returned 1 [0068.415] lstrcmpA (lpString1=".", lpString2="sv_SE") returned -1 [0068.415] lstrcmpA (lpString1="..", lpString2="sv_SE") returned -1 [0068.415] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.425] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.425] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.425] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.427] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.427] CloseHandle (hObject=0x94) returned 1 [0068.428] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0068.428] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0068.428] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2e048a, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0068.430] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.430] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.430] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.433] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.433] CloseHandle (hObject=0x98) returned 1 [0068.434] lstrcmpA (lpString1=".", lpString2="tr_TR") returned -1 [0068.434] lstrcmpA (lpString1="..", lpString2="tr_TR") returned -1 [0068.434] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.440] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.440] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.440] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.443] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.443] CloseHandle (hObject=0x94) returned 1 [0068.444] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0068.445] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0068.445] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2e048a, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0068.446] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.446] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.446] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.449] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.450] CloseHandle (hObject=0x98) returned 1 [0068.450] lstrcmpA (lpString1=".", lpString2="uk_UA") returned -1 [0068.450] lstrcmpA (lpString1="..", lpString2="uk_UA") returned -1 [0068.450] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.453] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.453] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.453] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.455] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.455] CloseHandle (hObject=0x94) returned 1 [0068.457] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0068.457] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0068.457] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2e048a, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0068.457] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.458] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.458] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.461] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0068.461] CloseHandle (hObject=0x98) returned 1 [0068.462] lstrcmpA (lpString1=".", lpString2="zh_CN") returned -1 [0068.462] lstrcmpA (lpString1="..", lpString2="zh_CN") returned -1 [0068.462] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.470] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.470] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.472] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2e048a, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0068.480] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.518] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2e048a, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0068.571] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pdfsigqformalrep.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pdfsigqformalrep.pdf.wannacry")) returned 1 [0068.574] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="pe.dll") returned -1 [0068.574] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pe.dll") returned -1 [0068.574] lstrcmpiA (lpString1="", lpString2="pe.dll") returned -1 [0068.574] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\how to decrypt files.txt")) returned 0x20 [0068.574] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\", lpString2="pe.dll" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pe.dll") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pe.dll" [0068.574] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="piaglbreakfinder.dll") returned -1 [0068.574] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="piaglbreakfinder.dll") returned -1 [0068.574] lstrcmpiA (lpString1="", lpString2="piaglbreakfinder.dll") returned -1 [0068.576] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2df450, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0068.581] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e05720, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82e519e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e246a, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.584] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e519e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e44ac, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0068.593] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2e246a, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0068.596] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0068.623] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eb2980, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d7ee8, dwReserved1=0x2d7ee3, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0068.644] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Dynamic.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\dynamic.pdf.wannacry")) returned 1 [0068.657] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Faces.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\faces.pdf.wannacry")) returned 1 [0068.679] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Pointers.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\pointers.pdf.wannacry")) returned 1 [0068.683] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\SignHere.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\signhere.pdf.wannacry")) returned 1 [0068.726] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Standard.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standard.pdf.wannacry")) returned 1 [0068.775] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\StandardBusiness.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standardbusiness.pdf.wannacry")) returned 1 [0068.777] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0068.797] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Dynamic.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\dynamic.pdf.wannacry")) returned 1 [0068.805] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\hanko.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Hanko.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\hanko.pdf.wannacry")) returned 1 [0068.818] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\SignHere.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\signhere.pdf.wannacry")) returned 1 [0068.824] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\StandardBusiness.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\standardbusiness.pdf.wannacry")) returned 1 [0068.826] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0068.834] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Dynamic.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\dynamic.pdf.wannacry")) returned 1 [0068.848] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\hanko.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\hanko.pdf.wannacry")) returned 1 [0068.853] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\SignHere.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\signhere.pdf.wannacry")) returned 1 [0068.868] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\StandardBusiness.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\standardbusiness.pdf.wannacry")) returned 1 [0068.869] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80731040, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0068.891] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Dynamic.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\dynamic.pdf.wannacry")) returned 1 [0068.965] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\faces.pdf.wannacry")) returned 1 [0068.997] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Pointers.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\pointers.pdf.wannacry")) returned 1 [0069.013] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\SignHere.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\signhere.pdf.wannacry")) returned 1 [0069.108] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Standard.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standard.pdf.wannacry")) returned 1 [0069.121] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\StandardBusiness.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standardbusiness.pdf.wannacry")) returned 1 [0069.123] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0069.141] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\Dynamic.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\dynamic.pdf.wannacry")) returned 1 [0069.145] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\SignHere.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\signhere.pdf.wannacry")) returned 1 [0069.158] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\StandardBusiness.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\standardbusiness.pdf.wannacry")) returned 1 [0069.160] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0069.208] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\dynamic.pdf.wannacry")) returned 1 [0069.218] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\signhere.pdf.wannacry")) returned 1 [0069.226] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\standardbusiness.pdf.wannacry")) returned 1 [0069.228] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0069.248] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\dynamic.pdf.wannacry")) returned 1 [0069.257] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\signhere.pdf.wannacry")) returned 1 [0069.263] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\standardbusiness.pdf.wannacry")) returned 1 [0069.265] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0069.274] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\Dynamic.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\dynamic.pdf.wannacry")) returned 1 [0069.380] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\SignHere.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\signhere.pdf.wannacry")) returned 1 [0069.438] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\StandardBusiness.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\standardbusiness.pdf.wannacry")) returned 1 [0069.441] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e8c820, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0069.705] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Dynamic.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\dynamic.pdf.wannacry")) returned 1 [0069.766] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Faces.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\faces.pdf.wannacry")) returned 1 [0070.852] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Pointers.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\pointers.pdf.wannacry")) returned 1 [0070.920] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\SignHere.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\signhere.pdf.wannacry")) returned 1 [0071.415] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Standard.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standard.pdf.wannacry")) returned 1 [0071.971] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\StandardBusiness.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standardbusiness.pdf.wannacry")) returned 1 [0071.975] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7feb61e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0072.165] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\Dynamic.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\dynamic.pdf.wannacry")) returned 1 [0072.169] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\SignHere.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\signhere.pdf.wannacry")) returned 1 [0072.175] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\StandardBusiness.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\standardbusiness.pdf.wannacry")) returned 1 [0072.176] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8070aee0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0072.183] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Dynamic.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\dynamic.pdf.wannacry")) returned 1 [0072.187] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Faces.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\faces.pdf.wannacry")) returned 1 [0072.190] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Pointers.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\pointers.pdf.wannacry")) returned 1 [0072.194] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\SignHere.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\signhere.pdf.wannacry")) returned 1 [0072.197] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Standard.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standard.pdf.wannacry")) returned 1 [0072.201] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\StandardBusiness.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standardbusiness.pdf.wannacry")) returned 1 [0072.202] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806e4d80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0072.331] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Dynamic.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\dynamic.pdf.wannacry")) returned 1 [0072.335] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Faces.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\faces.pdf.wannacry")) returned 1 [0072.340] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Pointers.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\pointers.pdf.wannacry")) returned 1 [0072.344] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\SignHere.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\signhere.pdf.wannacry")) returned 1 [0072.349] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Standard.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standard.pdf.wannacry")) returned 1 [0072.353] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\StandardBusiness.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standardbusiness.pdf.wannacry")) returned 1 [0072.355] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0072.362] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\dynamic.pdf.wannacry")) returned 1 [0072.514] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\SignHere.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\signhere.pdf.wannacry")) returned 1 [0072.536] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\standardbusiness.pdf.wannacry")) returned 1 [0072.538] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0072.587] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Dynamic.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\dynamic.pdf.wannacry")) returned 1 [0072.607] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\hanko.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Hanko.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\hanko.pdf.wannacry")) returned 1 [0072.628] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\SignHere.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\signhere.pdf.wannacry")) returned 1 [0072.639] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\StandardBusiness.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\standardbusiness.pdf.wannacry")) returned 1 [0072.642] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0073.040] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Dynamic.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\dynamic.pdf.wannacry")) returned 1 [0073.068] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\hanko.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Hanko.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\hanko.pdf.wannacry")) returned 1 [0073.084] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\SignHere.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\signhere.pdf.wannacry")) returned 1 [0073.094] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\StandardBusiness.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\standardbusiness.pdf.wannacry")) returned 1 [0073.095] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0073.097] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\") returned="" [0073.097] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\HOW TO DECRYPT FILES.txt" [0073.097] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\how to decrypt files.txt")) returned 0xffffffff [0073.097] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0073.099] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0073.099] WriteFile (in: hFile=0x9c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0073.100] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0073.101] CloseHandle (hObject=0x9c) returned 1 [0073.101] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\", lpString2="Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf" [0073.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf", pszSpec="*.zip") returned 0 [0073.101] lstrlenA (lpString="*.zip") returned 5 [0073.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf", pszSpec="*.rar") returned 0 [0073.101] lstrlenA (lpString="*.rar") returned 5 [0073.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf", pszSpec="*.7z") returned 0 [0073.101] lstrlenA (lpString="*.7z") returned 4 [0073.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf", pszSpec="*.tar") returned 0 [0073.101] lstrlenA (lpString="*.tar") returned 5 [0073.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf", pszSpec="*.gzip") returned 0 [0073.101] lstrlenA (lpString="*.gzip") returned 6 [0073.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf", pszSpec="*.jpg") returned 0 [0073.101] lstrlenA (lpString="*.jpg") returned 5 [0073.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf", pszSpec="*.jpeg") returned 0 [0073.101] lstrlenA (lpString="*.jpeg") returned 6 [0073.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf", pszSpec="*.psd") returned 0 [0073.101] lstrlenA (lpString="*.psd") returned 5 [0073.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf", pszSpec="*.gif") returned 0 [0073.101] lstrlenA (lpString="*.gif") returned 5 [0073.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf", pszSpec="*.doc") returned 0 [0073.101] lstrlenA (lpString="*.doc") returned 5 [0073.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf", pszSpec="*.docx") returned 0 [0073.101] lstrlenA (lpString="*.docx") returned 6 [0073.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf", pszSpec="*.xls") returned 0 [0073.101] lstrlenA (lpString="*.xls") returned 5 [0073.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf", pszSpec="*.xlsx") returned 0 [0073.101] lstrlenA (lpString="*.xlsx") returned 6 [0073.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf", pszSpec="*.ppt") returned 0 [0073.101] lstrlenA (lpString="*.ppt") returned 5 [0073.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf", pszSpec="*.pptx") returned 0 [0073.101] lstrlenA (lpString="*.pptx") returned 6 [0073.101] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf", pszSpec="*.pdf") returned 1 [0073.102] lstrlenA (lpString="*.pdf") returned 5 [0073.104] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xff3a [0073.104] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x7feb61e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0073.104] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.104] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xfebc, lpOverlapped=0x0) returned 1 [0073.108] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf") returned="Dynamic.pdf" [0073.108] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.108] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xfebc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xfebc, lpOverlapped=0x0) returned 1 [0073.355] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.355] CloseHandle (hObject=0x9c) returned 1 [0073.355] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\dynamic.pdf.wannacry")) returned 1 [0073.357] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9542, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0073.357] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0073.357] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SignHere.pdf") returned -1 [0073.357] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SignHere.pdf") returned -1 [0073.357] lstrcmpiA (lpString1="", lpString2="SignHere.pdf") returned -1 [0073.357] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf") returned="Dynamic.pdf" [0073.357] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\" [0073.357] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\") returned="" [0073.357] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\HOW TO DECRYPT FILES.txt" [0073.357] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\how to decrypt files.txt")) returned 0x20 [0073.357] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\", lpString2="SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf" [0073.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf", pszSpec="*.zip") returned 0 [0073.357] lstrlenA (lpString="*.zip") returned 5 [0073.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf", pszSpec="*.rar") returned 0 [0073.357] lstrlenA (lpString="*.rar") returned 5 [0073.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf", pszSpec="*.7z") returned 0 [0073.358] lstrlenA (lpString="*.7z") returned 4 [0073.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf", pszSpec="*.tar") returned 0 [0073.358] lstrlenA (lpString="*.tar") returned 5 [0073.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf", pszSpec="*.gzip") returned 0 [0073.358] lstrlenA (lpString="*.gzip") returned 6 [0073.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf", pszSpec="*.jpg") returned 0 [0073.358] lstrlenA (lpString="*.jpg") returned 5 [0073.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf", pszSpec="*.jpeg") returned 0 [0073.358] lstrlenA (lpString="*.jpeg") returned 6 [0073.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf", pszSpec="*.psd") returned 0 [0073.358] lstrlenA (lpString="*.psd") returned 5 [0073.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf", pszSpec="*.gif") returned 0 [0073.358] lstrlenA (lpString="*.gif") returned 5 [0073.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf", pszSpec="*.doc") returned 0 [0073.358] lstrlenA (lpString="*.doc") returned 5 [0073.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf", pszSpec="*.docx") returned 0 [0073.358] lstrlenA (lpString="*.docx") returned 6 [0073.358] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf", pszSpec="*.xls") returned 0 [0073.358] lstrlenA (lpString="*.xls") returned 5 [0073.359] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf", pszSpec="*.xlsx") returned 0 [0073.359] lstrlenA (lpString="*.xlsx") returned 6 [0073.359] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf", pszSpec="*.ppt") returned 0 [0073.359] lstrlenA (lpString="*.ppt") returned 5 [0073.359] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf", pszSpec="*.pptx") returned 0 [0073.359] lstrlenA (lpString="*.pptx") returned 6 [0073.359] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf", pszSpec="*.pdf") returned 1 [0073.359] lstrlenA (lpString="*.pdf") returned 5 [0073.359] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf" [0073.359] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf" [0073.359] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf." [0073.359] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf.wannacry" [0073.359] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0073.360] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9542 [0073.360] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x7fedc340, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0073.360] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.361] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x94c4, lpOverlapped=0x0) returned 1 [0073.363] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf") returned="SignHere.pdf" [0073.363] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.363] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x94c4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x94c4, lpOverlapped=0x0) returned 1 [0073.364] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.364] CloseHandle (hObject=0x9c) returned 1 [0073.364] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\signhere.pdf.wannacry")) returned 1 [0073.365] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x180e0, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0073.366] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0073.366] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StandardBusiness.pdf") returned -1 [0073.366] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StandardBusiness.pdf") returned -1 [0073.366] lstrcmpiA (lpString1="", lpString2="StandardBusiness.pdf") returned -1 [0073.366] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf") returned="SignHere.pdf" [0073.366] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\" [0073.366] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\") returned="" [0073.366] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\HOW TO DECRYPT FILES.txt" [0073.366] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\how to decrypt files.txt")) returned 0x20 [0073.366] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\", lpString2="StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf" [0073.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf", pszSpec="*.zip") returned 0 [0073.366] lstrlenA (lpString="*.zip") returned 5 [0073.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf", pszSpec="*.rar") returned 0 [0073.366] lstrlenA (lpString="*.rar") returned 5 [0073.366] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf", pszSpec="*.7z") returned 0 [0073.367] lstrlenA (lpString="*.7z") returned 4 [0073.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf", pszSpec="*.tar") returned 0 [0073.367] lstrlenA (lpString="*.tar") returned 5 [0073.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf", pszSpec="*.gzip") returned 0 [0073.367] lstrlenA (lpString="*.gzip") returned 6 [0073.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf", pszSpec="*.jpg") returned 0 [0073.367] lstrlenA (lpString="*.jpg") returned 5 [0073.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf", pszSpec="*.jpeg") returned 0 [0073.367] lstrlenA (lpString="*.jpeg") returned 6 [0073.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf", pszSpec="*.psd") returned 0 [0073.367] lstrlenA (lpString="*.psd") returned 5 [0073.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf", pszSpec="*.gif") returned 0 [0073.367] lstrlenA (lpString="*.gif") returned 5 [0073.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf", pszSpec="*.doc") returned 0 [0073.367] lstrlenA (lpString="*.doc") returned 5 [0073.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf", pszSpec="*.docx") returned 0 [0073.367] lstrlenA (lpString="*.docx") returned 6 [0073.367] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf", pszSpec="*.xls") returned 0 [0073.367] lstrlenA (lpString="*.xls") returned 5 [0073.368] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf", pszSpec="*.xlsx") returned 0 [0073.368] lstrlenA (lpString="*.xlsx") returned 6 [0073.368] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf", pszSpec="*.ppt") returned 0 [0073.368] lstrlenA (lpString="*.ppt") returned 5 [0073.368] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf", pszSpec="*.pptx") returned 0 [0073.368] lstrlenA (lpString="*.pptx") returned 6 [0073.368] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf", pszSpec="*.pdf") returned 1 [0073.368] lstrlenA (lpString="*.pdf") returned 5 [0073.368] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf" [0073.368] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf" [0073.368] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf." [0073.368] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf.wannacry" [0073.368] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0073.369] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x180e0 [0073.369] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x7feb61e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0073.369] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.369] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x18062, lpOverlapped=0x0) returned 1 [0073.374] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf") returned="StandardBusiness.pdf" [0073.374] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.374] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x18062, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x18062, lpOverlapped=0x0) returned 1 [0073.375] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.375] CloseHandle (hObject=0x9c) returned 1 [0073.375] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\standardbusiness.pdf.wannacry")) returned 1 [0073.376] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x180e0, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0073.376] FindClose (in: hFindFile=0x2e35b8 | out: hFindFile=0x2e35b8) returned 1 [0073.376] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73e8, dwReserved1=0x3, cFileName="NOR", cAlternateFileName="")) returned 1 [0073.376] lstrcmpA (lpString1=".", lpString2="NOR") returned -1 [0073.376] lstrcmpA (lpString1="..", lpString2="NOR") returned -1 [0073.376] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*.*") returned="*.*" [0073.377] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", lpString2="NOR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR" [0073.377] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR") returned 79 [0073.377] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0073.377] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0073.377] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0073.377] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0073.377] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0073.377] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfbd7, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0073.377] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0073.377] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Dynamic.pdf") returned 1 [0073.377] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Dynamic.pdf") returned 1 [0073.378] lstrcmpiA (lpString1="", lpString2="Dynamic.pdf") returned -1 [0073.378] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\*.*") returned="*.*" [0073.378] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\" [0073.378] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\") returned="" [0073.378] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\HOW TO DECRYPT FILES.txt" [0073.378] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\how to decrypt files.txt")) returned 0xffffffff [0073.378] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0073.381] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0073.381] WriteFile (in: hFile=0x9c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0073.382] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0073.382] CloseHandle (hObject=0x9c) returned 1 [0073.382] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\", lpString2="Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf" [0073.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf", pszSpec="*.zip") returned 0 [0073.382] lstrlenA (lpString="*.zip") returned 5 [0073.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf", pszSpec="*.rar") returned 0 [0073.382] lstrlenA (lpString="*.rar") returned 5 [0073.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf", pszSpec="*.7z") returned 0 [0073.382] lstrlenA (lpString="*.7z") returned 4 [0073.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf", pszSpec="*.tar") returned 0 [0073.382] lstrlenA (lpString="*.tar") returned 5 [0073.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf", pszSpec="*.gzip") returned 0 [0073.382] lstrlenA (lpString="*.gzip") returned 6 [0073.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf", pszSpec="*.jpg") returned 0 [0073.383] lstrlenA (lpString="*.jpg") returned 5 [0073.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf", pszSpec="*.jpeg") returned 0 [0073.383] lstrlenA (lpString="*.jpeg") returned 6 [0073.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf", pszSpec="*.psd") returned 0 [0073.383] lstrlenA (lpString="*.psd") returned 5 [0073.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf", pszSpec="*.gif") returned 0 [0073.383] lstrlenA (lpString="*.gif") returned 5 [0073.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf", pszSpec="*.doc") returned 0 [0073.383] lstrlenA (lpString="*.doc") returned 5 [0073.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf", pszSpec="*.docx") returned 0 [0073.383] lstrlenA (lpString="*.docx") returned 6 [0073.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf", pszSpec="*.xls") returned 0 [0073.383] lstrlenA (lpString="*.xls") returned 5 [0073.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf", pszSpec="*.xlsx") returned 0 [0073.383] lstrlenA (lpString="*.xlsx") returned 6 [0073.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf", pszSpec="*.ppt") returned 0 [0073.383] lstrlenA (lpString="*.ppt") returned 5 [0073.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf", pszSpec="*.pptx") returned 0 [0073.384] lstrlenA (lpString="*.pptx") returned 6 [0073.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf", pszSpec="*.pdf") returned 1 [0073.384] lstrlenA (lpString="*.pdf") returned 5 [0073.384] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf" [0073.384] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf" [0073.384] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf." [0073.384] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf.wannacry" [0073.384] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0073.385] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfbd7 [0073.385] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x7ff28600, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4)) returned 1 [0073.385] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.385] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xfb59, lpOverlapped=0x0) returned 1 [0073.388] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf") returned="Dynamic.pdf" [0073.388] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.388] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xfb59, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xfb59, lpOverlapped=0x0) returned 1 [0073.388] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.388] CloseHandle (hObject=0x9c) returned 1 [0073.388] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\dynamic.pdf.wannacry")) returned 1 [0073.389] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x95a4, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0073.390] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0073.390] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SignHere.pdf") returned -1 [0073.390] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SignHere.pdf") returned -1 [0073.390] lstrcmpiA (lpString1="", lpString2="SignHere.pdf") returned -1 [0073.390] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf") returned="Dynamic.pdf" [0073.390] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\" [0073.390] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\") returned="" [0073.390] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\HOW TO DECRYPT FILES.txt" [0073.390] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\how to decrypt files.txt")) returned 0x20 [0073.390] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\", lpString2="SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf" [0073.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf", pszSpec="*.zip") returned 0 [0073.390] lstrlenA (lpString="*.zip") returned 5 [0073.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf", pszSpec="*.rar") returned 0 [0073.390] lstrlenA (lpString="*.rar") returned 5 [0073.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf", pszSpec="*.7z") returned 0 [0073.390] lstrlenA (lpString="*.7z") returned 4 [0073.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf", pszSpec="*.tar") returned 0 [0073.390] lstrlenA (lpString="*.tar") returned 5 [0073.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf", pszSpec="*.gzip") returned 0 [0073.390] lstrlenA (lpString="*.gzip") returned 6 [0073.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf", pszSpec="*.jpg") returned 0 [0073.390] lstrlenA (lpString="*.jpg") returned 5 [0073.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf", pszSpec="*.jpeg") returned 0 [0073.391] lstrlenA (lpString="*.jpeg") returned 6 [0073.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf", pszSpec="*.psd") returned 0 [0073.391] lstrlenA (lpString="*.psd") returned 5 [0073.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf", pszSpec="*.gif") returned 0 [0073.391] lstrlenA (lpString="*.gif") returned 5 [0073.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf", pszSpec="*.doc") returned 0 [0073.391] lstrlenA (lpString="*.doc") returned 5 [0073.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf", pszSpec="*.docx") returned 0 [0073.391] lstrlenA (lpString="*.docx") returned 6 [0073.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf", pszSpec="*.xls") returned 0 [0073.391] lstrlenA (lpString="*.xls") returned 5 [0073.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf", pszSpec="*.xlsx") returned 0 [0073.391] lstrlenA (lpString="*.xlsx") returned 6 [0073.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf", pszSpec="*.ppt") returned 0 [0073.391] lstrlenA (lpString="*.ppt") returned 5 [0073.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf", pszSpec="*.pptx") returned 0 [0073.391] lstrlenA (lpString="*.pptx") returned 6 [0073.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf", pszSpec="*.pdf") returned 1 [0073.391] lstrlenA (lpString="*.pdf") returned 5 [0073.391] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf" [0073.391] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf" [0073.391] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf." [0073.391] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf.wannacry" [0073.391] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0073.392] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x95a4 [0073.392] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x7ff28600, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4)) returned 1 [0073.392] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.392] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x9526, lpOverlapped=0x0) returned 1 [0073.397] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf") returned="SignHere.pdf" [0073.397] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.397] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x9526, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x9526, lpOverlapped=0x0) returned 1 [0073.397] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.397] CloseHandle (hObject=0x9c) returned 1 [0073.398] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\signhere.pdf.wannacry")) returned 1 [0073.399] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17ff8, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0073.399] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0073.399] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StandardBusiness.pdf") returned -1 [0073.399] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StandardBusiness.pdf") returned -1 [0073.399] lstrcmpiA (lpString1="", lpString2="StandardBusiness.pdf") returned -1 [0073.399] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf") returned="SignHere.pdf" [0073.399] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\" [0073.399] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\") returned="" [0073.399] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\HOW TO DECRYPT FILES.txt" [0073.399] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\how to decrypt files.txt")) returned 0x20 [0073.399] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\", lpString2="StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf" [0073.399] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf", pszSpec="*.zip") returned 0 [0073.399] lstrlenA (lpString="*.zip") returned 5 [0073.399] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf", pszSpec="*.rar") returned 0 [0073.399] lstrlenA (lpString="*.rar") returned 5 [0073.399] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf", pszSpec="*.7z") returned 0 [0073.399] lstrlenA (lpString="*.7z") returned 4 [0073.400] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf", pszSpec="*.tar") returned 0 [0073.400] lstrlenA (lpString="*.tar") returned 5 [0073.400] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf", pszSpec="*.gzip") returned 0 [0073.400] lstrlenA (lpString="*.gzip") returned 6 [0073.400] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf", pszSpec="*.jpg") returned 0 [0073.400] lstrlenA (lpString="*.jpg") returned 5 [0073.400] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf", pszSpec="*.jpeg") returned 0 [0073.400] lstrlenA (lpString="*.jpeg") returned 6 [0073.400] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf", pszSpec="*.psd") returned 0 [0073.400] lstrlenA (lpString="*.psd") returned 5 [0073.400] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf", pszSpec="*.gif") returned 0 [0073.400] lstrlenA (lpString="*.gif") returned 5 [0073.400] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf", pszSpec="*.doc") returned 0 [0073.400] lstrlenA (lpString="*.doc") returned 5 [0073.400] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf", pszSpec="*.docx") returned 0 [0073.400] lstrlenA (lpString="*.docx") returned 6 [0073.400] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf", pszSpec="*.xls") returned 0 [0073.400] lstrlenA (lpString="*.xls") returned 5 [0073.400] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf", pszSpec="*.xlsx") returned 0 [0073.400] lstrlenA (lpString="*.xlsx") returned 6 [0073.400] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf", pszSpec="*.ppt") returned 0 [0073.400] lstrlenA (lpString="*.ppt") returned 5 [0073.400] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf", pszSpec="*.pptx") returned 0 [0073.400] lstrlenA (lpString="*.pptx") returned 6 [0073.400] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf", pszSpec="*.pdf") returned 1 [0073.400] lstrlenA (lpString="*.pdf") returned 5 [0073.400] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf" [0073.401] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf" [0073.401] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf." [0073.401] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf.wannacry" [0073.401] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0073.401] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17ff8 [0073.402] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x7ff28600, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4)) returned 1 [0073.402] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.402] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x17f7a, lpOverlapped=0x0) returned 1 [0073.405] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf") returned="StandardBusiness.pdf" [0073.405] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.405] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x17f7a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x17f7a, lpOverlapped=0x0) returned 1 [0073.405] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.405] CloseHandle (hObject=0x9c) returned 1 [0073.406] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\standardbusiness.pdf.wannacry")) returned 1 [0073.407] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17ff8, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0073.407] FindClose (in: hFindFile=0x2e35b8 | out: hFindFile=0x2e35b8) returned 1 [0073.407] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806bec20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73e8, dwReserved1=0x3, cFileName="POL", cAlternateFileName="")) returned 1 [0073.407] lstrcmpA (lpString1=".", lpString2="POL") returned -1 [0073.407] lstrcmpA (lpString1="..", lpString2="POL") returned -1 [0073.407] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*.*") returned="*.*" [0073.407] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", lpString2="POL" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL" [0073.407] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL") returned 79 [0073.407] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806bec20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0073.413] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0073.413] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806bec20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0073.413] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0073.413] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0073.413] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x907a, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0073.413] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0073.413] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Dynamic.pdf") returned 1 [0073.413] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Dynamic.pdf") returned 1 [0073.413] lstrcmpiA (lpString1="", lpString2="Dynamic.pdf") returned -1 [0073.413] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\*.*") returned="*.*" [0073.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\" [0073.413] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\") returned="" [0073.414] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\HOW TO DECRYPT FILES.txt" [0073.414] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\how to decrypt files.txt")) returned 0xffffffff [0073.414] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0073.415] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0073.415] WriteFile (in: hFile=0x9c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0073.416] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0073.416] CloseHandle (hObject=0x9c) returned 1 [0073.416] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", lpString2="Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf" [0073.416] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf", pszSpec="*.zip") returned 0 [0073.416] lstrlenA (lpString="*.zip") returned 5 [0073.416] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf", pszSpec="*.rar") returned 0 [0073.416] lstrlenA (lpString="*.rar") returned 5 [0073.416] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf", pszSpec="*.7z") returned 0 [0073.416] lstrlenA (lpString="*.7z") returned 4 [0073.416] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf", pszSpec="*.tar") returned 0 [0073.416] lstrlenA (lpString="*.tar") returned 5 [0073.416] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf", pszSpec="*.gzip") returned 0 [0073.416] lstrlenA (lpString="*.gzip") returned 6 [0073.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf", pszSpec="*.jpg") returned 0 [0073.417] lstrlenA (lpString="*.jpg") returned 5 [0073.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf", pszSpec="*.jpeg") returned 0 [0073.417] lstrlenA (lpString="*.jpeg") returned 6 [0073.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf", pszSpec="*.psd") returned 0 [0073.417] lstrlenA (lpString="*.psd") returned 5 [0073.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf", pszSpec="*.gif") returned 0 [0073.417] lstrlenA (lpString="*.gif") returned 5 [0073.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf", pszSpec="*.doc") returned 0 [0073.417] lstrlenA (lpString="*.doc") returned 5 [0073.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf", pszSpec="*.docx") returned 0 [0073.417] lstrlenA (lpString="*.docx") returned 6 [0073.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf", pszSpec="*.xls") returned 0 [0073.417] lstrlenA (lpString="*.xls") returned 5 [0073.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf", pszSpec="*.xlsx") returned 0 [0073.417] lstrlenA (lpString="*.xlsx") returned 6 [0073.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf", pszSpec="*.ppt") returned 0 [0073.417] lstrlenA (lpString="*.ppt") returned 5 [0073.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf", pszSpec="*.pptx") returned 0 [0073.417] lstrlenA (lpString="*.pptx") returned 6 [0073.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf", pszSpec="*.pdf") returned 1 [0073.417] lstrlenA (lpString="*.pdf") returned 5 [0073.417] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf" [0073.417] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf" [0073.417] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf." [0073.417] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf.wannacry" [0073.417] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0073.418] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x907a [0073.418] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x806e4d80, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0073.418] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.419] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x8ffc, lpOverlapped=0x0) returned 1 [0073.421] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf") returned="Dynamic.pdf" [0073.421] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.421] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x8ffc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x8ffc, lpOverlapped=0x0) returned 1 [0073.421] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.421] CloseHandle (hObject=0x9c) returned 1 [0073.421] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\dynamic.pdf.wannacry")) returned 1 [0073.423] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0073.423] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0073.423] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Faces.pdf") returned -1 [0073.423] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Faces.pdf") returned 1 [0073.423] lstrcmpiA (lpString1="", lpString2="Faces.pdf") returned -1 [0073.423] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf") returned="Dynamic.pdf" [0073.423] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\" [0073.423] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\") returned="" [0073.423] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\HOW TO DECRYPT FILES.txt" [0073.423] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\how to decrypt files.txt")) returned 0x20 [0073.423] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", lpString2="Faces.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf" [0073.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf", pszSpec="*.zip") returned 0 [0073.423] lstrlenA (lpString="*.zip") returned 5 [0073.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf", pszSpec="*.rar") returned 0 [0073.423] lstrlenA (lpString="*.rar") returned 5 [0073.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf", pszSpec="*.7z") returned 0 [0073.423] lstrlenA (lpString="*.7z") returned 4 [0073.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf", pszSpec="*.tar") returned 0 [0073.424] lstrlenA (lpString="*.tar") returned 5 [0073.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf", pszSpec="*.gzip") returned 0 [0073.424] lstrlenA (lpString="*.gzip") returned 6 [0073.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf", pszSpec="*.jpg") returned 0 [0073.424] lstrlenA (lpString="*.jpg") returned 5 [0073.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf", pszSpec="*.jpeg") returned 0 [0073.424] lstrlenA (lpString="*.jpeg") returned 6 [0073.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf", pszSpec="*.psd") returned 0 [0073.424] lstrlenA (lpString="*.psd") returned 5 [0073.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf", pszSpec="*.gif") returned 0 [0073.424] lstrlenA (lpString="*.gif") returned 5 [0073.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf", pszSpec="*.doc") returned 0 [0073.424] lstrlenA (lpString="*.doc") returned 5 [0073.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf", pszSpec="*.docx") returned 0 [0073.424] lstrlenA (lpString="*.docx") returned 6 [0073.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf", pszSpec="*.xls") returned 0 [0073.424] lstrlenA (lpString="*.xls") returned 5 [0073.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf", pszSpec="*.xlsx") returned 0 [0073.424] lstrlenA (lpString="*.xlsx") returned 6 [0073.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf", pszSpec="*.ppt") returned 0 [0073.424] lstrlenA (lpString="*.ppt") returned 5 [0073.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf", pszSpec="*.pptx") returned 0 [0073.424] lstrlenA (lpString="*.pptx") returned 6 [0073.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf", pszSpec="*.pdf") returned 1 [0073.424] lstrlenA (lpString="*.pdf") returned 5 [0073.424] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf" [0073.424] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf" [0073.425] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf." [0073.425] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf.wannacry" [0073.425] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0073.425] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x80f5 [0073.426] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x806bec20, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0073.426] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.426] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x8077, lpOverlapped=0x0) returned 1 [0073.428] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf") returned="Faces.pdf" [0073.428] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.428] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x8077, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x8077, lpOverlapped=0x0) returned 1 [0073.429] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.429] CloseHandle (hObject=0x9c) returned 1 [0073.429] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\faces.pdf.wannacry")) returned 1 [0073.430] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb731, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0073.430] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0073.430] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Pointers.pdf") returned -1 [0073.430] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Pointers.pdf") returned -1 [0073.430] lstrcmpiA (lpString1="", lpString2="Pointers.pdf") returned -1 [0073.430] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf") returned="Faces.pdf" [0073.430] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\" [0073.430] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\") returned="" [0073.430] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\HOW TO DECRYPT FILES.txt" [0073.430] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\how to decrypt files.txt")) returned 0x20 [0073.430] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", lpString2="Pointers.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf" [0073.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf", pszSpec="*.zip") returned 0 [0073.431] lstrlenA (lpString="*.zip") returned 5 [0073.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf", pszSpec="*.rar") returned 0 [0073.431] lstrlenA (lpString="*.rar") returned 5 [0073.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf", pszSpec="*.7z") returned 0 [0073.431] lstrlenA (lpString="*.7z") returned 4 [0073.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf", pszSpec="*.tar") returned 0 [0073.431] lstrlenA (lpString="*.tar") returned 5 [0073.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf", pszSpec="*.gzip") returned 0 [0073.431] lstrlenA (lpString="*.gzip") returned 6 [0073.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf", pszSpec="*.jpg") returned 0 [0073.431] lstrlenA (lpString="*.jpg") returned 5 [0073.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf", pszSpec="*.jpeg") returned 0 [0073.431] lstrlenA (lpString="*.jpeg") returned 6 [0073.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf", pszSpec="*.psd") returned 0 [0073.431] lstrlenA (lpString="*.psd") returned 5 [0073.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf", pszSpec="*.gif") returned 0 [0073.431] lstrlenA (lpString="*.gif") returned 5 [0073.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf", pszSpec="*.doc") returned 0 [0073.431] lstrlenA (lpString="*.doc") returned 5 [0073.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf", pszSpec="*.docx") returned 0 [0073.431] lstrlenA (lpString="*.docx") returned 6 [0073.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf", pszSpec="*.xls") returned 0 [0073.431] lstrlenA (lpString="*.xls") returned 5 [0073.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf", pszSpec="*.xlsx") returned 0 [0073.431] lstrlenA (lpString="*.xlsx") returned 6 [0073.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf", pszSpec="*.ppt") returned 0 [0073.431] lstrlenA (lpString="*.ppt") returned 5 [0073.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf", pszSpec="*.pptx") returned 0 [0073.432] lstrlenA (lpString="*.pptx") returned 6 [0073.432] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf", pszSpec="*.pdf") returned 1 [0073.432] lstrlenA (lpString="*.pdf") returned 5 [0073.432] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf" [0073.432] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf" [0073.432] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf." [0073.432] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf.wannacry" [0073.432] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0073.433] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb731 [0073.433] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x806bec20, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0073.433] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.433] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xb6b3, lpOverlapped=0x0) returned 1 [0073.436] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf") returned="Pointers.pdf" [0073.436] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.436] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xb6b3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xb6b3, lpOverlapped=0x0) returned 1 [0073.437] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.437] CloseHandle (hObject=0x9c) returned 1 [0073.437] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\pointers.pdf.wannacry")) returned 1 [0073.438] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4fff9, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0073.438] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0073.439] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SignHere.pdf") returned -1 [0073.439] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SignHere.pdf") returned -1 [0073.439] lstrcmpiA (lpString1="", lpString2="SignHere.pdf") returned -1 [0073.439] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf") returned="Pointers.pdf" [0073.439] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\" [0073.439] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\") returned="" [0073.439] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\HOW TO DECRYPT FILES.txt" [0073.439] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\how to decrypt files.txt")) returned 0x20 [0073.439] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", lpString2="SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf" [0073.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf", pszSpec="*.zip") returned 0 [0073.439] lstrlenA (lpString="*.zip") returned 5 [0073.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf", pszSpec="*.rar") returned 0 [0073.439] lstrlenA (lpString="*.rar") returned 5 [0073.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf", pszSpec="*.7z") returned 0 [0073.439] lstrlenA (lpString="*.7z") returned 4 [0073.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf", pszSpec="*.tar") returned 0 [0073.439] lstrlenA (lpString="*.tar") returned 5 [0073.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf", pszSpec="*.gzip") returned 0 [0073.439] lstrlenA (lpString="*.gzip") returned 6 [0073.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf", pszSpec="*.jpg") returned 0 [0073.439] lstrlenA (lpString="*.jpg") returned 5 [0073.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf", pszSpec="*.jpeg") returned 0 [0073.439] lstrlenA (lpString="*.jpeg") returned 6 [0073.440] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf", pszSpec="*.psd") returned 0 [0073.440] lstrlenA (lpString="*.psd") returned 5 [0073.440] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf", pszSpec="*.gif") returned 0 [0073.440] lstrlenA (lpString="*.gif") returned 5 [0073.440] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf", pszSpec="*.doc") returned 0 [0073.440] lstrlenA (lpString="*.doc") returned 5 [0073.440] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf", pszSpec="*.docx") returned 0 [0073.440] lstrlenA (lpString="*.docx") returned 6 [0073.440] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf", pszSpec="*.xls") returned 0 [0073.440] lstrlenA (lpString="*.xls") returned 5 [0073.440] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf", pszSpec="*.xlsx") returned 0 [0073.440] lstrlenA (lpString="*.xlsx") returned 6 [0073.440] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf", pszSpec="*.ppt") returned 0 [0073.440] lstrlenA (lpString="*.ppt") returned 5 [0073.440] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf", pszSpec="*.pptx") returned 0 [0073.440] lstrlenA (lpString="*.pptx") returned 6 [0073.440] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf", pszSpec="*.pdf") returned 1 [0073.440] lstrlenA (lpString="*.pdf") returned 5 [0073.440] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf" [0073.440] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf" [0073.440] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf." [0073.440] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf.wannacry" [0073.440] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0073.441] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4fff9 [0073.441] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x806bec20, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0073.441] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.441] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4ff7b, lpOverlapped=0x0) returned 1 [0073.447] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf") returned="SignHere.pdf" [0073.448] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.448] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4ff7b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4ff7b, lpOverlapped=0x0) returned 1 [0073.449] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.449] CloseHandle (hObject=0x9c) returned 1 [0073.449] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\signhere.pdf.wannacry")) returned 1 [0073.451] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f5, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0073.451] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0073.451] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Standard.pdf") returned -1 [0073.451] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Standard.pdf") returned -1 [0073.451] lstrcmpiA (lpString1="", lpString2="Standard.pdf") returned -1 [0073.451] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf") returned="SignHere.pdf" [0073.451] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\" [0073.451] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\") returned="" [0073.451] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\HOW TO DECRYPT FILES.txt" [0073.451] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\how to decrypt files.txt")) returned 0x20 [0073.451] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", lpString2="Standard.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf" [0073.451] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf", pszSpec="*.zip") returned 0 [0073.451] lstrlenA (lpString="*.zip") returned 5 [0073.451] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf", pszSpec="*.rar") returned 0 [0073.451] lstrlenA (lpString="*.rar") returned 5 [0073.451] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf", pszSpec="*.7z") returned 0 [0073.452] lstrlenA (lpString="*.7z") returned 4 [0073.452] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf", pszSpec="*.tar") returned 0 [0073.452] lstrlenA (lpString="*.tar") returned 5 [0073.452] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf", pszSpec="*.gzip") returned 0 [0073.452] lstrlenA (lpString="*.gzip") returned 6 [0073.452] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf", pszSpec="*.jpg") returned 0 [0073.452] lstrlenA (lpString="*.jpg") returned 5 [0073.452] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf", pszSpec="*.jpeg") returned 0 [0073.452] lstrlenA (lpString="*.jpeg") returned 6 [0073.452] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf", pszSpec="*.psd") returned 0 [0073.452] lstrlenA (lpString="*.psd") returned 5 [0073.452] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf", pszSpec="*.gif") returned 0 [0073.452] lstrlenA (lpString="*.gif") returned 5 [0073.452] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf", pszSpec="*.doc") returned 0 [0073.452] lstrlenA (lpString="*.doc") returned 5 [0073.452] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf", pszSpec="*.docx") returned 0 [0073.452] lstrlenA (lpString="*.docx") returned 6 [0073.452] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf", pszSpec="*.xls") returned 0 [0073.452] lstrlenA (lpString="*.xls") returned 5 [0073.452] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf", pszSpec="*.xlsx") returned 0 [0073.452] lstrlenA (lpString="*.xlsx") returned 6 [0073.452] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf", pszSpec="*.ppt") returned 0 [0073.452] lstrlenA (lpString="*.ppt") returned 5 [0073.452] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf", pszSpec="*.pptx") returned 0 [0073.452] lstrlenA (lpString="*.pptx") returned 6 [0073.452] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf", pszSpec="*.pdf") returned 1 [0073.453] lstrlenA (lpString="*.pdf") returned 5 [0073.453] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf" [0073.453] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf" [0073.453] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf." [0073.453] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf.wannacry" [0073.453] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0073.454] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c4f5 [0073.454] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x806bec20, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0073.454] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.454] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1c477, lpOverlapped=0x0) returned 1 [0073.457] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf") returned="Standard.pdf" [0073.457] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.457] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1c477, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1c477, lpOverlapped=0x0) returned 1 [0073.458] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.458] CloseHandle (hObject=0x9c) returned 1 [0073.458] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standard.pdf.wannacry")) returned 1 [0073.459] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10873, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0073.459] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0073.459] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StandardBusiness.pdf") returned -1 [0073.459] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StandardBusiness.pdf") returned -1 [0073.459] lstrcmpiA (lpString1="", lpString2="StandardBusiness.pdf") returned -1 [0073.459] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf") returned="Standard.pdf" [0073.459] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\" [0073.460] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\") returned="" [0073.460] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\HOW TO DECRYPT FILES.txt" [0073.460] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\how to decrypt files.txt")) returned 0x20 [0073.460] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\", lpString2="StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf" [0073.460] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf", pszSpec="*.zip") returned 0 [0073.460] lstrlenA (lpString="*.zip") returned 5 [0073.460] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf", pszSpec="*.rar") returned 0 [0073.460] lstrlenA (lpString="*.rar") returned 5 [0073.460] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf", pszSpec="*.7z") returned 0 [0073.460] lstrlenA (lpString="*.7z") returned 4 [0073.460] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf", pszSpec="*.tar") returned 0 [0073.460] lstrlenA (lpString="*.tar") returned 5 [0073.460] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf", pszSpec="*.gzip") returned 0 [0073.460] lstrlenA (lpString="*.gzip") returned 6 [0073.460] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf", pszSpec="*.jpg") returned 0 [0073.460] lstrlenA (lpString="*.jpg") returned 5 [0073.460] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf", pszSpec="*.jpeg") returned 0 [0073.460] lstrlenA (lpString="*.jpeg") returned 6 [0073.460] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf", pszSpec="*.psd") returned 0 [0073.460] lstrlenA (lpString="*.psd") returned 5 [0073.460] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf", pszSpec="*.gif") returned 0 [0073.460] lstrlenA (lpString="*.gif") returned 5 [0073.460] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf", pszSpec="*.doc") returned 0 [0073.460] lstrlenA (lpString="*.doc") returned 5 [0073.461] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf", pszSpec="*.docx") returned 0 [0073.461] lstrlenA (lpString="*.docx") returned 6 [0073.461] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf", pszSpec="*.xls") returned 0 [0073.461] lstrlenA (lpString="*.xls") returned 5 [0073.461] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf", pszSpec="*.xlsx") returned 0 [0073.461] lstrlenA (lpString="*.xlsx") returned 6 [0073.461] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf", pszSpec="*.ppt") returned 0 [0073.461] lstrlenA (lpString="*.ppt") returned 5 [0073.461] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf", pszSpec="*.pptx") returned 0 [0073.461] lstrlenA (lpString="*.pptx") returned 6 [0073.461] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf", pszSpec="*.pdf") returned 1 [0073.461] lstrlenA (lpString="*.pdf") returned 5 [0073.461] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf" [0073.461] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf" [0073.461] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf." [0073.461] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf.wannacry" [0073.461] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0073.462] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10873 [0073.462] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x806bec20, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0073.462] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.462] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x107f5, lpOverlapped=0x0) returned 1 [0073.465] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf") returned="StandardBusiness.pdf" [0073.465] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.465] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x107f5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x107f5, lpOverlapped=0x0) returned 1 [0073.466] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.466] CloseHandle (hObject=0x9c) returned 1 [0073.466] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standardbusiness.pdf.wannacry")) returned 1 [0073.467] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10873, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0073.467] FindClose (in: hFindFile=0x2e35b8 | out: hFindFile=0x2e35b8) returned 1 [0073.467] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff748c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff748c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73e8, dwReserved1=0x3, cFileName="PTB", cAlternateFileName="")) returned 1 [0073.467] lstrcmpA (lpString1=".", lpString2="PTB") returned -1 [0073.467] lstrcmpA (lpString1="..", lpString2="PTB") returned -1 [0073.468] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*.*") returned="*.*" [0073.468] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", lpString2="PTB" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB" [0073.468] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB") returned 79 [0073.468] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff748c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff748c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0073.468] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0073.468] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff748c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff748c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0073.468] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0073.468] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0073.468] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc4a8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0073.468] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0073.468] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Dynamic.pdf") returned 1 [0073.468] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Dynamic.pdf") returned 1 [0073.468] lstrcmpiA (lpString1="", lpString2="Dynamic.pdf") returned -1 [0073.468] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\*.*") returned="*.*" [0073.468] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\" [0073.468] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\") returned="" [0073.468] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\HOW TO DECRYPT FILES.txt" [0073.469] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\how to decrypt files.txt")) returned 0xffffffff [0073.469] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0073.471] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0073.472] WriteFile (in: hFile=0x9c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0073.473] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0073.473] CloseHandle (hObject=0x9c) returned 1 [0073.473] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\", lpString2="Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf" [0073.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf", pszSpec="*.zip") returned 0 [0073.473] lstrlenA (lpString="*.zip") returned 5 [0073.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf", pszSpec="*.rar") returned 0 [0073.473] lstrlenA (lpString="*.rar") returned 5 [0073.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf", pszSpec="*.7z") returned 0 [0073.473] lstrlenA (lpString="*.7z") returned 4 [0073.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf", pszSpec="*.tar") returned 0 [0073.473] lstrlenA (lpString="*.tar") returned 5 [0073.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf", pszSpec="*.gzip") returned 0 [0073.473] lstrlenA (lpString="*.gzip") returned 6 [0073.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf", pszSpec="*.jpg") returned 0 [0073.473] lstrlenA (lpString="*.jpg") returned 5 [0073.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf", pszSpec="*.jpeg") returned 0 [0073.473] lstrlenA (lpString="*.jpeg") returned 6 [0073.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf", pszSpec="*.psd") returned 0 [0073.473] lstrlenA (lpString="*.psd") returned 5 [0073.473] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf", pszSpec="*.gif") returned 0 [0073.474] lstrlenA (lpString="*.gif") returned 5 [0073.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf", pszSpec="*.doc") returned 0 [0073.474] lstrlenA (lpString="*.doc") returned 5 [0073.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf", pszSpec="*.docx") returned 0 [0073.474] lstrlenA (lpString="*.docx") returned 6 [0073.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf", pszSpec="*.xls") returned 0 [0073.474] lstrlenA (lpString="*.xls") returned 5 [0073.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf", pszSpec="*.xlsx") returned 0 [0073.474] lstrlenA (lpString="*.xlsx") returned 6 [0073.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf", pszSpec="*.ppt") returned 0 [0073.474] lstrlenA (lpString="*.ppt") returned 5 [0073.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf", pszSpec="*.pptx") returned 0 [0073.474] lstrlenA (lpString="*.pptx") returned 6 [0073.474] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf", pszSpec="*.pdf") returned 1 [0073.474] lstrlenA (lpString="*.pdf") returned 5 [0073.474] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf" [0073.474] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf" [0073.474] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf." [0073.474] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf.wannacry" [0073.474] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0073.475] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc4a8 [0073.475] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x7ff748c0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4)) returned 1 [0073.475] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.475] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xc42a, lpOverlapped=0x0) returned 1 [0073.481] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf") returned="Dynamic.pdf" [0073.481] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.481] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xc42a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xc42a, lpOverlapped=0x0) returned 1 [0073.481] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.481] CloseHandle (hObject=0x9c) returned 1 [0073.481] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\dynamic.pdf.wannacry")) returned 1 [0073.483] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9c53, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0073.483] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0073.483] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SignHere.pdf") returned -1 [0073.483] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SignHere.pdf") returned -1 [0073.483] lstrcmpiA (lpString1="", lpString2="SignHere.pdf") returned -1 [0073.483] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf") returned="Dynamic.pdf" [0073.483] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\" [0073.483] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\") returned="" [0073.483] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\HOW TO DECRYPT FILES.txt" [0073.483] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\how to decrypt files.txt")) returned 0x20 [0073.483] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\", lpString2="SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf" [0073.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf", pszSpec="*.zip") returned 0 [0073.483] lstrlenA (lpString="*.zip") returned 5 [0073.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf", pszSpec="*.rar") returned 0 [0073.483] lstrlenA (lpString="*.rar") returned 5 [0073.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf", pszSpec="*.7z") returned 0 [0073.483] lstrlenA (lpString="*.7z") returned 4 [0073.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf", pszSpec="*.tar") returned 0 [0073.483] lstrlenA (lpString="*.tar") returned 5 [0073.483] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf", pszSpec="*.gzip") returned 0 [0073.484] lstrlenA (lpString="*.gzip") returned 6 [0073.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf", pszSpec="*.jpg") returned 0 [0073.484] lstrlenA (lpString="*.jpg") returned 5 [0073.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf", pszSpec="*.jpeg") returned 0 [0073.484] lstrlenA (lpString="*.jpeg") returned 6 [0073.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf", pszSpec="*.psd") returned 0 [0073.484] lstrlenA (lpString="*.psd") returned 5 [0073.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf", pszSpec="*.gif") returned 0 [0073.484] lstrlenA (lpString="*.gif") returned 5 [0073.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf", pszSpec="*.doc") returned 0 [0073.484] lstrlenA (lpString="*.doc") returned 5 [0073.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf", pszSpec="*.docx") returned 0 [0073.484] lstrlenA (lpString="*.docx") returned 6 [0073.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf", pszSpec="*.xls") returned 0 [0073.484] lstrlenA (lpString="*.xls") returned 5 [0073.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf", pszSpec="*.xlsx") returned 0 [0073.484] lstrlenA (lpString="*.xlsx") returned 6 [0073.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf", pszSpec="*.ppt") returned 0 [0073.484] lstrlenA (lpString="*.ppt") returned 5 [0073.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf", pszSpec="*.pptx") returned 0 [0073.484] lstrlenA (lpString="*.pptx") returned 6 [0073.484] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf", pszSpec="*.pdf") returned 1 [0073.484] lstrlenA (lpString="*.pdf") returned 5 [0073.484] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf" [0073.484] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf" [0073.484] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf." [0073.485] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf.wannacry" [0073.485] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0073.486] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9c53 [0073.486] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x7ff748c0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4)) returned 1 [0073.486] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.486] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x9bd5, lpOverlapped=0x0) returned 1 [0073.488] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf") returned="SignHere.pdf" [0073.488] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.488] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x9bd5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x9bd5, lpOverlapped=0x0) returned 1 [0073.488] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.488] CloseHandle (hObject=0x9c) returned 1 [0073.489] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\signhere.pdf.wannacry")) returned 1 [0073.490] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x19c87, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0073.490] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0073.490] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StandardBusiness.pdf") returned -1 [0073.490] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StandardBusiness.pdf") returned -1 [0073.490] lstrcmpiA (lpString1="", lpString2="StandardBusiness.pdf") returned -1 [0073.490] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf") returned="SignHere.pdf" [0073.490] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\" [0073.490] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\") returned="" [0073.490] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\HOW TO DECRYPT FILES.txt" [0073.490] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\how to decrypt files.txt")) returned 0x20 [0073.490] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\", lpString2="StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf" [0073.490] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf", pszSpec="*.zip") returned 0 [0073.490] lstrlenA (lpString="*.zip") returned 5 [0073.490] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf", pszSpec="*.rar") returned 0 [0073.490] lstrlenA (lpString="*.rar") returned 5 [0073.490] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf", pszSpec="*.7z") returned 0 [0073.490] lstrlenA (lpString="*.7z") returned 4 [0073.491] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf", pszSpec="*.tar") returned 0 [0073.491] lstrlenA (lpString="*.tar") returned 5 [0073.491] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf", pszSpec="*.gzip") returned 0 [0073.491] lstrlenA (lpString="*.gzip") returned 6 [0073.491] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf", pszSpec="*.jpg") returned 0 [0073.491] lstrlenA (lpString="*.jpg") returned 5 [0073.491] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf", pszSpec="*.jpeg") returned 0 [0073.491] lstrlenA (lpString="*.jpeg") returned 6 [0073.491] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf", pszSpec="*.psd") returned 0 [0073.491] lstrlenA (lpString="*.psd") returned 5 [0073.491] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf", pszSpec="*.gif") returned 0 [0073.491] lstrlenA (lpString="*.gif") returned 5 [0073.491] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf", pszSpec="*.doc") returned 0 [0073.491] lstrlenA (lpString="*.doc") returned 5 [0073.491] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf", pszSpec="*.docx") returned 0 [0073.491] lstrlenA (lpString="*.docx") returned 6 [0073.491] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf", pszSpec="*.xls") returned 0 [0073.491] lstrlenA (lpString="*.xls") returned 5 [0073.491] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf", pszSpec="*.xlsx") returned 0 [0073.491] lstrlenA (lpString="*.xlsx") returned 6 [0073.491] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf", pszSpec="*.ppt") returned 0 [0073.491] lstrlenA (lpString="*.ppt") returned 5 [0073.491] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf", pszSpec="*.pptx") returned 0 [0073.491] lstrlenA (lpString="*.pptx") returned 6 [0073.491] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf", pszSpec="*.pdf") returned 1 [0073.491] lstrlenA (lpString="*.pdf") returned 5 [0073.491] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf" [0073.491] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf" [0073.492] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf." [0073.492] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf.wannacry" [0073.492] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0073.493] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19c87 [0073.493] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x7ff748c0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x98a32700, dwHighDateTime=0x1cb84b4)) returned 1 [0073.493] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.493] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x19c09, lpOverlapped=0x0) returned 1 [0073.495] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf") returned="StandardBusiness.pdf" [0073.495] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.495] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x19c09, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x19c09, lpOverlapped=0x0) returned 1 [0073.496] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.496] CloseHandle (hObject=0x9c) returned 1 [0073.496] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\standardbusiness.pdf.wannacry")) returned 1 [0073.497] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x19c87, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0073.497] FindClose (in: hFindFile=0x2e35b8 | out: hFindFile=0x2e35b8) returned 1 [0073.497] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80698ac0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806bec20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73e8, dwReserved1=0x3, cFileName="RUM", cAlternateFileName="")) returned 1 [0073.497] lstrcmpA (lpString1=".", lpString2="RUM") returned -1 [0073.498] lstrcmpA (lpString1="..", lpString2="RUM") returned -1 [0073.498] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*.*") returned="*.*" [0073.498] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", lpString2="RUM" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM" [0073.498] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM") returned 79 [0073.498] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80698ac0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806bec20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0073.500] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0073.500] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80698ac0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806bec20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0073.500] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0073.500] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0073.501] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15fc8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0073.501] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0073.501] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Dynamic.pdf") returned 1 [0073.501] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Dynamic.pdf") returned 1 [0073.501] lstrcmpiA (lpString1="", lpString2="Dynamic.pdf") returned -1 [0073.501] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\*.*") returned="*.*" [0073.501] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\" [0073.501] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\") returned="" [0073.501] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\HOW TO DECRYPT FILES.txt" [0073.501] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\how to decrypt files.txt")) returned 0xffffffff [0073.501] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0073.503] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0073.503] WriteFile (in: hFile=0x9c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0073.504] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0073.504] CloseHandle (hObject=0x9c) returned 1 [0073.504] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\", lpString2="Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf" [0073.504] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf", pszSpec="*.zip") returned 0 [0073.505] lstrlenA (lpString="*.zip") returned 5 [0073.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf", pszSpec="*.rar") returned 0 [0073.505] lstrlenA (lpString="*.rar") returned 5 [0073.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf", pszSpec="*.7z") returned 0 [0073.505] lstrlenA (lpString="*.7z") returned 4 [0073.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf", pszSpec="*.tar") returned 0 [0073.505] lstrlenA (lpString="*.tar") returned 5 [0073.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf", pszSpec="*.gzip") returned 0 [0073.505] lstrlenA (lpString="*.gzip") returned 6 [0073.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf", pszSpec="*.jpg") returned 0 [0073.505] lstrlenA (lpString="*.jpg") returned 5 [0073.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf", pszSpec="*.jpeg") returned 0 [0073.505] lstrlenA (lpString="*.jpeg") returned 6 [0073.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf", pszSpec="*.psd") returned 0 [0073.505] lstrlenA (lpString="*.psd") returned 5 [0073.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf", pszSpec="*.gif") returned 0 [0073.505] lstrlenA (lpString="*.gif") returned 5 [0073.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf", pszSpec="*.doc") returned 0 [0073.505] lstrlenA (lpString="*.doc") returned 5 [0073.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf", pszSpec="*.docx") returned 0 [0073.505] lstrlenA (lpString="*.docx") returned 6 [0073.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf", pszSpec="*.xls") returned 0 [0073.505] lstrlenA (lpString="*.xls") returned 5 [0073.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf", pszSpec="*.xlsx") returned 0 [0073.505] lstrlenA (lpString="*.xlsx") returned 6 [0073.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf", pszSpec="*.ppt") returned 0 [0073.505] lstrlenA (lpString="*.ppt") returned 5 [0073.505] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf", pszSpec="*.pptx") returned 0 [0073.506] lstrlenA (lpString="*.pptx") returned 6 [0073.506] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf", pszSpec="*.pdf") returned 1 [0073.506] lstrlenA (lpString="*.pdf") returned 5 [0073.506] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf" [0073.506] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf" [0073.506] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf." [0073.506] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf.wannacry" [0073.506] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0073.508] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15fc8 [0073.509] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x806bec20, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0073.509] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.509] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x15f4a, lpOverlapped=0x0) returned 1 [0073.511] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf") returned="Dynamic.pdf" [0073.511] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.512] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x15f4a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x15f4a, lpOverlapped=0x0) returned 1 [0073.512] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.512] CloseHandle (hObject=0x9c) returned 1 [0073.512] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\dynamic.pdf.wannacry")) returned 1 [0073.514] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0073.514] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0073.514] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Faces.pdf") returned -1 [0073.514] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Faces.pdf") returned 1 [0073.514] lstrcmpiA (lpString1="", lpString2="Faces.pdf") returned -1 [0073.514] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf") returned="Dynamic.pdf" [0073.514] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\" [0073.514] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\") returned="" [0073.514] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\HOW TO DECRYPT FILES.txt" [0073.514] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\how to decrypt files.txt")) returned 0x20 [0073.514] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\", lpString2="Faces.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf" [0073.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf", pszSpec="*.zip") returned 0 [0073.514] lstrlenA (lpString="*.zip") returned 5 [0073.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf", pszSpec="*.rar") returned 0 [0073.514] lstrlenA (lpString="*.rar") returned 5 [0073.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf", pszSpec="*.7z") returned 0 [0073.514] lstrlenA (lpString="*.7z") returned 4 [0073.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf", pszSpec="*.tar") returned 0 [0073.514] lstrlenA (lpString="*.tar") returned 5 [0073.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf", pszSpec="*.gzip") returned 0 [0073.514] lstrlenA (lpString="*.gzip") returned 6 [0073.514] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf", pszSpec="*.jpg") returned 0 [0073.515] lstrlenA (lpString="*.jpg") returned 5 [0073.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf", pszSpec="*.jpeg") returned 0 [0073.515] lstrlenA (lpString="*.jpeg") returned 6 [0073.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf", pszSpec="*.psd") returned 0 [0073.515] lstrlenA (lpString="*.psd") returned 5 [0073.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf", pszSpec="*.gif") returned 0 [0073.515] lstrlenA (lpString="*.gif") returned 5 [0073.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf", pszSpec="*.doc") returned 0 [0073.515] lstrlenA (lpString="*.doc") returned 5 [0073.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf", pszSpec="*.docx") returned 0 [0073.515] lstrlenA (lpString="*.docx") returned 6 [0073.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf", pszSpec="*.xls") returned 0 [0073.515] lstrlenA (lpString="*.xls") returned 5 [0073.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf", pszSpec="*.xlsx") returned 0 [0073.515] lstrlenA (lpString="*.xlsx") returned 6 [0073.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf", pszSpec="*.ppt") returned 0 [0073.515] lstrlenA (lpString="*.ppt") returned 5 [0073.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf", pszSpec="*.pptx") returned 0 [0073.515] lstrlenA (lpString="*.pptx") returned 6 [0073.515] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf", pszSpec="*.pdf") returned 1 [0073.515] lstrlenA (lpString="*.pdf") returned 5 [0073.515] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf" [0073.515] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf" [0073.515] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf." [0073.515] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf.wannacry" [0073.515] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0073.516] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x80f5 [0073.517] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x806bec20, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0073.517] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.517] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x8077, lpOverlapped=0x0) returned 1 [0073.575] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf") returned="Faces.pdf" [0073.575] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.581] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x8077, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x8077, lpOverlapped=0x0) returned 1 [0073.587] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.587] CloseHandle (hObject=0x9c) returned 1 [0073.587] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\faces.pdf.wannacry")) returned 1 [0073.600] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb731, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0073.600] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0073.600] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Pointers.pdf") returned -1 [0073.600] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Pointers.pdf") returned -1 [0073.600] lstrcmpiA (lpString1="", lpString2="Pointers.pdf") returned -1 [0073.600] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf") returned="Faces.pdf" [0073.600] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\" [0073.600] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\") returned="" [0073.600] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\HOW TO DECRYPT FILES.txt" [0073.600] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\how to decrypt files.txt")) returned 0x20 [0073.601] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\", lpString2="Pointers.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf" [0073.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf", pszSpec="*.zip") returned 0 [0073.601] lstrlenA (lpString="*.zip") returned 5 [0073.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf", pszSpec="*.rar") returned 0 [0073.601] lstrlenA (lpString="*.rar") returned 5 [0073.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf", pszSpec="*.7z") returned 0 [0073.601] lstrlenA (lpString="*.7z") returned 4 [0073.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf", pszSpec="*.tar") returned 0 [0073.601] lstrlenA (lpString="*.tar") returned 5 [0073.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf", pszSpec="*.gzip") returned 0 [0073.601] lstrlenA (lpString="*.gzip") returned 6 [0073.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf", pszSpec="*.jpg") returned 0 [0073.601] lstrlenA (lpString="*.jpg") returned 5 [0073.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf", pszSpec="*.jpeg") returned 0 [0073.601] lstrlenA (lpString="*.jpeg") returned 6 [0073.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf", pszSpec="*.psd") returned 0 [0073.601] lstrlenA (lpString="*.psd") returned 5 [0073.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf", pszSpec="*.gif") returned 0 [0073.601] lstrlenA (lpString="*.gif") returned 5 [0073.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf", pszSpec="*.doc") returned 0 [0073.601] lstrlenA (lpString="*.doc") returned 5 [0073.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf", pszSpec="*.docx") returned 0 [0073.601] lstrlenA (lpString="*.docx") returned 6 [0073.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf", pszSpec="*.xls") returned 0 [0073.601] lstrlenA (lpString="*.xls") returned 5 [0073.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf", pszSpec="*.xlsx") returned 0 [0073.601] lstrlenA (lpString="*.xlsx") returned 6 [0073.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf", pszSpec="*.ppt") returned 0 [0073.602] lstrlenA (lpString="*.ppt") returned 5 [0073.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf", pszSpec="*.pptx") returned 0 [0073.602] lstrlenA (lpString="*.pptx") returned 6 [0073.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf", pszSpec="*.pdf") returned 1 [0073.603] lstrlenA (lpString="*.pdf") returned 5 [0073.603] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf" [0073.603] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf" [0073.603] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf." [0073.603] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf.wannacry" [0073.603] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0073.611] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb731 [0073.611] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80698ac0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0073.611] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.611] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xb6b3, lpOverlapped=0x0) returned 1 [0073.616] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf") returned="Pointers.pdf" [0073.616] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.616] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xb6b3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xb6b3, lpOverlapped=0x0) returned 1 [0073.618] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.618] CloseHandle (hObject=0x9c) returned 1 [0073.618] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\pointers.pdf.wannacry")) returned 1 [0073.628] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe736, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0073.628] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0073.628] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SignHere.pdf") returned -1 [0073.629] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SignHere.pdf") returned -1 [0073.629] lstrcmpiA (lpString1="", lpString2="SignHere.pdf") returned -1 [0073.629] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf") returned="Pointers.pdf" [0073.632] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\" [0073.632] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\") returned="" [0073.632] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\HOW TO DECRYPT FILES.txt" [0073.632] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\how to decrypt files.txt")) returned 0x20 [0073.632] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\", lpString2="SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf" [0073.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf", pszSpec="*.zip") returned 0 [0073.633] lstrlenA (lpString="*.zip") returned 5 [0073.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf", pszSpec="*.rar") returned 0 [0073.634] lstrlenA (lpString="*.rar") returned 5 [0073.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf", pszSpec="*.7z") returned 0 [0073.634] lstrlenA (lpString="*.7z") returned 4 [0073.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf", pszSpec="*.tar") returned 0 [0073.634] lstrlenA (lpString="*.tar") returned 5 [0073.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf", pszSpec="*.gzip") returned 0 [0073.634] lstrlenA (lpString="*.gzip") returned 6 [0073.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf", pszSpec="*.jpg") returned 0 [0073.634] lstrlenA (lpString="*.jpg") returned 5 [0073.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf", pszSpec="*.jpeg") returned 0 [0073.637] lstrlenA (lpString="*.jpeg") returned 6 [0073.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf", pszSpec="*.psd") returned 0 [0073.637] lstrlenA (lpString="*.psd") returned 5 [0073.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf", pszSpec="*.gif") returned 0 [0073.637] lstrlenA (lpString="*.gif") returned 5 [0073.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf", pszSpec="*.doc") returned 0 [0073.637] lstrlenA (lpString="*.doc") returned 5 [0073.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf", pszSpec="*.docx") returned 0 [0073.637] lstrlenA (lpString="*.docx") returned 6 [0073.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf", pszSpec="*.xls") returned 0 [0073.637] lstrlenA (lpString="*.xls") returned 5 [0073.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf", pszSpec="*.xlsx") returned 0 [0073.637] lstrlenA (lpString="*.xlsx") returned 6 [0073.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf", pszSpec="*.ppt") returned 0 [0073.637] lstrlenA (lpString="*.ppt") returned 5 [0073.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf", pszSpec="*.pptx") returned 0 [0073.637] lstrlenA (lpString="*.pptx") returned 6 [0073.637] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf", pszSpec="*.pdf") returned 1 [0073.637] lstrlenA (lpString="*.pdf") returned 5 [0073.637] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf" [0073.637] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf" [0073.637] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf." [0073.637] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf.wannacry" [0073.637] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0073.638] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe736 [0073.638] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80698ac0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0073.638] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.638] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xe6b8, lpOverlapped=0x0) returned 1 [0073.641] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf") returned="SignHere.pdf" [0073.641] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.641] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xe6b8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xe6b8, lpOverlapped=0x0) returned 1 [0073.641] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.641] CloseHandle (hObject=0x9c) returned 1 [0073.641] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\signhere.pdf.wannacry")) returned 1 [0073.643] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f5, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0073.643] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0073.643] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Standard.pdf") returned -1 [0073.643] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Standard.pdf") returned -1 [0073.643] lstrcmpiA (lpString1="", lpString2="Standard.pdf") returned -1 [0073.643] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf") returned="SignHere.pdf" [0073.643] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\" [0073.643] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\") returned="" [0073.643] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\HOW TO DECRYPT FILES.txt" [0073.643] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\how to decrypt files.txt")) returned 0x20 [0073.643] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\", lpString2="Standard.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf" [0073.643] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf", pszSpec="*.zip") returned 0 [0073.643] lstrlenA (lpString="*.zip") returned 5 [0073.643] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf", pszSpec="*.rar") returned 0 [0073.643] lstrlenA (lpString="*.rar") returned 5 [0073.643] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf", pszSpec="*.7z") returned 0 [0073.643] lstrlenA (lpString="*.7z") returned 4 [0073.643] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf", pszSpec="*.tar") returned 0 [0073.643] lstrlenA (lpString="*.tar") returned 5 [0073.643] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf", pszSpec="*.gzip") returned 0 [0073.643] lstrlenA (lpString="*.gzip") returned 6 [0073.643] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf", pszSpec="*.jpg") returned 0 [0073.643] lstrlenA (lpString="*.jpg") returned 5 [0073.643] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf", pszSpec="*.jpeg") returned 0 [0073.643] lstrlenA (lpString="*.jpeg") returned 6 [0073.643] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf", pszSpec="*.psd") returned 0 [0073.643] lstrlenA (lpString="*.psd") returned 5 [0073.643] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf", pszSpec="*.gif") returned 0 [0073.643] lstrlenA (lpString="*.gif") returned 5 [0073.643] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf", pszSpec="*.doc") returned 0 [0073.644] lstrlenA (lpString="*.doc") returned 5 [0073.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf", pszSpec="*.docx") returned 0 [0073.644] lstrlenA (lpString="*.docx") returned 6 [0073.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf", pszSpec="*.xls") returned 0 [0073.644] lstrlenA (lpString="*.xls") returned 5 [0073.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf", pszSpec="*.xlsx") returned 0 [0073.644] lstrlenA (lpString="*.xlsx") returned 6 [0073.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf", pszSpec="*.ppt") returned 0 [0073.644] lstrlenA (lpString="*.ppt") returned 5 [0073.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf", pszSpec="*.pptx") returned 0 [0073.644] lstrlenA (lpString="*.pptx") returned 6 [0073.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf", pszSpec="*.pdf") returned 1 [0073.644] lstrlenA (lpString="*.pdf") returned 5 [0073.644] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf" [0073.644] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf" [0073.644] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf." [0073.644] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf.wannacry" [0073.644] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0073.645] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c4f5 [0073.645] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x806bec20, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0073.645] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.645] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1c477, lpOverlapped=0x0) returned 1 [0073.648] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf") returned="Standard.pdf" [0073.648] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.648] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1c477, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1c477, lpOverlapped=0x0) returned 1 [0073.649] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.649] CloseHandle (hObject=0x9c) returned 1 [0073.649] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standard.pdf.wannacry")) returned 1 [0073.651] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2fe62, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0073.651] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0073.651] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StandardBusiness.pdf") returned -1 [0073.651] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StandardBusiness.pdf") returned -1 [0073.651] lstrcmpiA (lpString1="", lpString2="StandardBusiness.pdf") returned -1 [0073.651] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf") returned="Standard.pdf" [0073.651] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\" [0073.651] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\") returned="" [0073.651] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\HOW TO DECRYPT FILES.txt" [0073.651] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\how to decrypt files.txt")) returned 0x20 [0073.651] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\", lpString2="StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf" [0073.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf", pszSpec="*.zip") returned 0 [0073.651] lstrlenA (lpString="*.zip") returned 5 [0073.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf", pszSpec="*.rar") returned 0 [0073.651] lstrlenA (lpString="*.rar") returned 5 [0073.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf", pszSpec="*.7z") returned 0 [0073.651] lstrlenA (lpString="*.7z") returned 4 [0073.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf", pszSpec="*.tar") returned 0 [0073.651] lstrlenA (lpString="*.tar") returned 5 [0073.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf", pszSpec="*.gzip") returned 0 [0073.651] lstrlenA (lpString="*.gzip") returned 6 [0073.652] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf", pszSpec="*.jpg") returned 0 [0073.652] lstrlenA (lpString="*.jpg") returned 5 [0073.652] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf", pszSpec="*.jpeg") returned 0 [0073.652] lstrlenA (lpString="*.jpeg") returned 6 [0073.652] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf", pszSpec="*.psd") returned 0 [0073.652] lstrlenA (lpString="*.psd") returned 5 [0073.652] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf", pszSpec="*.gif") returned 0 [0073.652] lstrlenA (lpString="*.gif") returned 5 [0073.652] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf", pszSpec="*.doc") returned 0 [0073.652] lstrlenA (lpString="*.doc") returned 5 [0073.652] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf", pszSpec="*.docx") returned 0 [0073.652] lstrlenA (lpString="*.docx") returned 6 [0073.652] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf", pszSpec="*.xls") returned 0 [0073.652] lstrlenA (lpString="*.xls") returned 5 [0073.652] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf", pszSpec="*.xlsx") returned 0 [0073.652] lstrlenA (lpString="*.xlsx") returned 6 [0073.652] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf", pszSpec="*.ppt") returned 0 [0073.652] lstrlenA (lpString="*.ppt") returned 5 [0073.652] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf", pszSpec="*.pptx") returned 0 [0073.652] lstrlenA (lpString="*.pptx") returned 6 [0073.652] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf", pszSpec="*.pdf") returned 1 [0073.652] lstrlenA (lpString="*.pdf") returned 5 [0073.652] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf" [0073.652] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf" [0073.652] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf." [0073.652] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf.wannacry" [0073.653] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0073.653] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2fe62 [0073.653] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80698ac0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0073.654] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.654] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2fde4, lpOverlapped=0x0) returned 1 [0073.665] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf") returned="StandardBusiness.pdf" [0073.665] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0073.665] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2fde4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2fde4, lpOverlapped=0x0) returned 1 [0073.666] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0073.666] CloseHandle (hObject=0x9c) returned 1 [0073.666] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standardbusiness.pdf.wannacry")) returned 1 [0073.668] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2fe62, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0073.668] FindClose (in: hFindFile=0x2e35b8 | out: hFindFile=0x2e35b8) returned 1 [0073.668] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80672960, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80698ac0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73e8, dwReserved1=0x3, cFileName="RUS", cAlternateFileName="")) returned 1 [0073.668] lstrcmpA (lpString1=".", lpString2="RUS") returned -1 [0073.668] lstrcmpA (lpString1="..", lpString2="RUS") returned -1 [0073.668] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*.*") returned="*.*" [0073.668] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", lpString2="RUS" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS" [0073.668] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS") returned 79 [0073.668] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80672960, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80698ac0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0074.008] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.008] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80672960, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80698ac0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0074.009] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.009] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.009] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xeac7, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0074.009] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.009] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Dynamic.pdf") returned 1 [0074.009] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Dynamic.pdf") returned 1 [0074.009] lstrcmpiA (lpString1="", lpString2="Dynamic.pdf") returned -1 [0074.009] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\*.*") returned="*.*" [0074.009] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\" [0074.009] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\") returned="" [0074.009] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\HOW TO DECRYPT FILES.txt" [0074.009] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\how to decrypt files.txt")) returned 0xffffffff [0074.009] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.011] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0074.011] WriteFile (in: hFile=0x9c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0074.015] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.015] CloseHandle (hObject=0x9c) returned 1 [0074.015] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\", lpString2="Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf" [0074.015] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf", pszSpec="*.zip") returned 0 [0074.015] lstrlenA (lpString="*.zip") returned 5 [0074.015] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf", pszSpec="*.rar") returned 0 [0074.015] lstrlenA (lpString="*.rar") returned 5 [0074.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf", pszSpec="*.7z") returned 0 [0074.016] lstrlenA (lpString="*.7z") returned 4 [0074.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf", pszSpec="*.tar") returned 0 [0074.016] lstrlenA (lpString="*.tar") returned 5 [0074.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf", pszSpec="*.gzip") returned 0 [0074.016] lstrlenA (lpString="*.gzip") returned 6 [0074.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf", pszSpec="*.jpg") returned 0 [0074.016] lstrlenA (lpString="*.jpg") returned 5 [0074.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf", pszSpec="*.jpeg") returned 0 [0074.016] lstrlenA (lpString="*.jpeg") returned 6 [0074.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf", pszSpec="*.psd") returned 0 [0074.016] lstrlenA (lpString="*.psd") returned 5 [0074.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf", pszSpec="*.gif") returned 0 [0074.016] lstrlenA (lpString="*.gif") returned 5 [0074.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf", pszSpec="*.doc") returned 0 [0074.016] lstrlenA (lpString="*.doc") returned 5 [0074.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf", pszSpec="*.docx") returned 0 [0074.016] lstrlenA (lpString="*.docx") returned 6 [0074.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf", pszSpec="*.xls") returned 0 [0074.016] lstrlenA (lpString="*.xls") returned 5 [0074.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf", pszSpec="*.xlsx") returned 0 [0074.016] lstrlenA (lpString="*.xlsx") returned 6 [0074.016] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf", pszSpec="*.ppt") returned 0 [0074.016] lstrlenA (lpString="*.ppt") returned 5 [0074.017] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf", pszSpec="*.pptx") returned 0 [0074.017] lstrlenA (lpString="*.pptx") returned 6 [0074.017] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf", pszSpec="*.pdf") returned 1 [0074.017] lstrlenA (lpString="*.pdf") returned 5 [0074.017] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf" [0074.017] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf" [0074.017] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf." [0074.017] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf.wannacry" [0074.017] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.022] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeac7 [0074.022] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80698ac0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0074.022] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.022] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xea49, lpOverlapped=0x0) returned 1 [0074.025] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf") returned="Dynamic.pdf" [0074.025] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.025] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xea49, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xea49, lpOverlapped=0x0) returned 1 [0074.025] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.026] CloseHandle (hObject=0x9c) returned 1 [0074.026] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\dynamic.pdf.wannacry")) returned 1 [0074.027] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0074.027] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.027] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Faces.pdf") returned -1 [0074.027] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Faces.pdf") returned 1 [0074.027] lstrcmpiA (lpString1="", lpString2="Faces.pdf") returned -1 [0074.027] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf") returned="Dynamic.pdf" [0074.027] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\" [0074.027] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\") returned="" [0074.027] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\HOW TO DECRYPT FILES.txt" [0074.027] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\how to decrypt files.txt")) returned 0x20 [0074.027] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\", lpString2="Faces.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf" [0074.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf", pszSpec="*.zip") returned 0 [0074.028] lstrlenA (lpString="*.zip") returned 5 [0074.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf", pszSpec="*.rar") returned 0 [0074.028] lstrlenA (lpString="*.rar") returned 5 [0074.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf", pszSpec="*.7z") returned 0 [0074.028] lstrlenA (lpString="*.7z") returned 4 [0074.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf", pszSpec="*.tar") returned 0 [0074.028] lstrlenA (lpString="*.tar") returned 5 [0074.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf", pszSpec="*.gzip") returned 0 [0074.028] lstrlenA (lpString="*.gzip") returned 6 [0074.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf", pszSpec="*.jpg") returned 0 [0074.028] lstrlenA (lpString="*.jpg") returned 5 [0074.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf", pszSpec="*.jpeg") returned 0 [0074.028] lstrlenA (lpString="*.jpeg") returned 6 [0074.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf", pszSpec="*.psd") returned 0 [0074.028] lstrlenA (lpString="*.psd") returned 5 [0074.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf", pszSpec="*.gif") returned 0 [0074.028] lstrlenA (lpString="*.gif") returned 5 [0074.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf", pszSpec="*.doc") returned 0 [0074.028] lstrlenA (lpString="*.doc") returned 5 [0074.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf", pszSpec="*.docx") returned 0 [0074.028] lstrlenA (lpString="*.docx") returned 6 [0074.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf", pszSpec="*.xls") returned 0 [0074.028] lstrlenA (lpString="*.xls") returned 5 [0074.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf", pszSpec="*.xlsx") returned 0 [0074.028] lstrlenA (lpString="*.xlsx") returned 6 [0074.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf", pszSpec="*.ppt") returned 0 [0074.028] lstrlenA (lpString="*.ppt") returned 5 [0074.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf", pszSpec="*.pptx") returned 0 [0074.028] lstrlenA (lpString="*.pptx") returned 6 [0074.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf", pszSpec="*.pdf") returned 1 [0074.028] lstrlenA (lpString="*.pdf") returned 5 [0074.028] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf" [0074.029] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf" [0074.029] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf." [0074.029] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf.wannacry" [0074.029] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.030] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x80f5 [0074.030] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80698ac0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0074.030] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.030] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x8077, lpOverlapped=0x0) returned 1 [0074.032] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf") returned="Faces.pdf" [0074.032] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.032] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x8077, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x8077, lpOverlapped=0x0) returned 1 [0074.033] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.033] CloseHandle (hObject=0x9c) returned 1 [0074.033] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\faces.pdf.wannacry")) returned 1 [0074.034] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb731, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0074.034] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.034] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Pointers.pdf") returned -1 [0074.034] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Pointers.pdf") returned -1 [0074.034] lstrcmpiA (lpString1="", lpString2="Pointers.pdf") returned -1 [0074.034] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf") returned="Faces.pdf" [0074.034] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\" [0074.034] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\") returned="" [0074.034] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\HOW TO DECRYPT FILES.txt" [0074.034] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\how to decrypt files.txt")) returned 0x20 [0074.034] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\", lpString2="Pointers.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf" [0074.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf", pszSpec="*.zip") returned 0 [0074.035] lstrlenA (lpString="*.zip") returned 5 [0074.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf", pszSpec="*.rar") returned 0 [0074.035] lstrlenA (lpString="*.rar") returned 5 [0074.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf", pszSpec="*.7z") returned 0 [0074.035] lstrlenA (lpString="*.7z") returned 4 [0074.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf", pszSpec="*.tar") returned 0 [0074.035] lstrlenA (lpString="*.tar") returned 5 [0074.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf", pszSpec="*.gzip") returned 0 [0074.035] lstrlenA (lpString="*.gzip") returned 6 [0074.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf", pszSpec="*.jpg") returned 0 [0074.035] lstrlenA (lpString="*.jpg") returned 5 [0074.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf", pszSpec="*.jpeg") returned 0 [0074.035] lstrlenA (lpString="*.jpeg") returned 6 [0074.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf", pszSpec="*.psd") returned 0 [0074.035] lstrlenA (lpString="*.psd") returned 5 [0074.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf", pszSpec="*.gif") returned 0 [0074.035] lstrlenA (lpString="*.gif") returned 5 [0074.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf", pszSpec="*.doc") returned 0 [0074.035] lstrlenA (lpString="*.doc") returned 5 [0074.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf", pszSpec="*.docx") returned 0 [0074.035] lstrlenA (lpString="*.docx") returned 6 [0074.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf", pszSpec="*.xls") returned 0 [0074.035] lstrlenA (lpString="*.xls") returned 5 [0074.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf", pszSpec="*.xlsx") returned 0 [0074.035] lstrlenA (lpString="*.xlsx") returned 6 [0074.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf", pszSpec="*.ppt") returned 0 [0074.035] lstrlenA (lpString="*.ppt") returned 5 [0074.035] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf", pszSpec="*.pptx") returned 0 [0074.036] lstrlenA (lpString="*.pptx") returned 6 [0074.036] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf", pszSpec="*.pdf") returned 1 [0074.036] lstrlenA (lpString="*.pdf") returned 5 [0074.036] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf" [0074.036] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf" [0074.036] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf." [0074.036] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf.wannacry" [0074.036] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.037] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb731 [0074.037] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80698ac0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0074.037] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.037] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xb6b3, lpOverlapped=0x0) returned 1 [0074.039] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf") returned="Pointers.pdf" [0074.039] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.040] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xb6b3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xb6b3, lpOverlapped=0x0) returned 1 [0074.040] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.040] CloseHandle (hObject=0x9c) returned 1 [0074.040] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\pointers.pdf.wannacry")) returned 1 [0074.041] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa118, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0074.041] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.041] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SignHere.pdf") returned -1 [0074.041] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SignHere.pdf") returned -1 [0074.041] lstrcmpiA (lpString1="", lpString2="SignHere.pdf") returned -1 [0074.041] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf") returned="Pointers.pdf" [0074.041] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\" [0074.041] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\") returned="" [0074.041] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\HOW TO DECRYPT FILES.txt" [0074.041] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\how to decrypt files.txt")) returned 0x20 [0074.042] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\", lpString2="SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf" [0074.042] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf", pszSpec="*.zip") returned 0 [0074.042] lstrlenA (lpString="*.zip") returned 5 [0074.042] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf", pszSpec="*.rar") returned 0 [0074.042] lstrlenA (lpString="*.rar") returned 5 [0074.042] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf", pszSpec="*.7z") returned 0 [0074.042] lstrlenA (lpString="*.7z") returned 4 [0074.042] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf", pszSpec="*.tar") returned 0 [0074.042] lstrlenA (lpString="*.tar") returned 5 [0074.042] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf", pszSpec="*.gzip") returned 0 [0074.042] lstrlenA (lpString="*.gzip") returned 6 [0074.042] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf", pszSpec="*.jpg") returned 0 [0074.042] lstrlenA (lpString="*.jpg") returned 5 [0074.042] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf", pszSpec="*.jpeg") returned 0 [0074.042] lstrlenA (lpString="*.jpeg") returned 6 [0074.042] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf", pszSpec="*.psd") returned 0 [0074.042] lstrlenA (lpString="*.psd") returned 5 [0074.042] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf", pszSpec="*.gif") returned 0 [0074.042] lstrlenA (lpString="*.gif") returned 5 [0074.042] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf", pszSpec="*.doc") returned 0 [0074.042] lstrlenA (lpString="*.doc") returned 5 [0074.042] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf", pszSpec="*.docx") returned 0 [0074.042] lstrlenA (lpString="*.docx") returned 6 [0074.042] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf", pszSpec="*.xls") returned 0 [0074.042] lstrlenA (lpString="*.xls") returned 5 [0074.043] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf", pszSpec="*.xlsx") returned 0 [0074.043] lstrlenA (lpString="*.xlsx") returned 6 [0074.043] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf", pszSpec="*.ppt") returned 0 [0074.043] lstrlenA (lpString="*.ppt") returned 5 [0074.043] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf", pszSpec="*.pptx") returned 0 [0074.043] lstrlenA (lpString="*.pptx") returned 6 [0074.043] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf", pszSpec="*.pdf") returned 1 [0074.043] lstrlenA (lpString="*.pdf") returned 5 [0074.043] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf" [0074.043] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf" [0074.043] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf." [0074.043] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf.wannacry" [0074.043] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.044] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa118 [0074.044] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80672960, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0074.044] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.044] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xa09a, lpOverlapped=0x0) returned 1 [0074.047] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf") returned="SignHere.pdf" [0074.047] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.047] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xa09a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xa09a, lpOverlapped=0x0) returned 1 [0074.047] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.047] CloseHandle (hObject=0x9c) returned 1 [0074.047] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\signhere.pdf.wannacry")) returned 1 [0074.048] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f5, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0074.048] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.048] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Standard.pdf") returned -1 [0074.049] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Standard.pdf") returned -1 [0074.049] lstrcmpiA (lpString1="", lpString2="Standard.pdf") returned -1 [0074.049] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf") returned="SignHere.pdf" [0074.049] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\" [0074.049] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\") returned="" [0074.049] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\HOW TO DECRYPT FILES.txt" [0074.049] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\how to decrypt files.txt")) returned 0x20 [0074.049] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\", lpString2="Standard.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf" [0074.049] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf", pszSpec="*.zip") returned 0 [0074.049] lstrlenA (lpString="*.zip") returned 5 [0074.049] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf", pszSpec="*.rar") returned 0 [0074.049] lstrlenA (lpString="*.rar") returned 5 [0074.049] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf", pszSpec="*.7z") returned 0 [0074.049] lstrlenA (lpString="*.7z") returned 4 [0074.049] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf", pszSpec="*.tar") returned 0 [0074.049] lstrlenA (lpString="*.tar") returned 5 [0074.049] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf", pszSpec="*.gzip") returned 0 [0074.049] lstrlenA (lpString="*.gzip") returned 6 [0074.049] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf", pszSpec="*.jpg") returned 0 [0074.049] lstrlenA (lpString="*.jpg") returned 5 [0074.049] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf", pszSpec="*.jpeg") returned 0 [0074.049] lstrlenA (lpString="*.jpeg") returned 6 [0074.049] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf", pszSpec="*.psd") returned 0 [0074.049] lstrlenA (lpString="*.psd") returned 5 [0074.050] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf", pszSpec="*.gif") returned 0 [0074.050] lstrlenA (lpString="*.gif") returned 5 [0074.050] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf", pszSpec="*.doc") returned 0 [0074.050] lstrlenA (lpString="*.doc") returned 5 [0074.050] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf", pszSpec="*.docx") returned 0 [0074.050] lstrlenA (lpString="*.docx") returned 6 [0074.050] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf", pszSpec="*.xls") returned 0 [0074.050] lstrlenA (lpString="*.xls") returned 5 [0074.050] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf", pszSpec="*.xlsx") returned 0 [0074.050] lstrlenA (lpString="*.xlsx") returned 6 [0074.050] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf", pszSpec="*.ppt") returned 0 [0074.050] lstrlenA (lpString="*.ppt") returned 5 [0074.050] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf", pszSpec="*.pptx") returned 0 [0074.050] lstrlenA (lpString="*.pptx") returned 6 [0074.050] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf", pszSpec="*.pdf") returned 1 [0074.050] lstrlenA (lpString="*.pdf") returned 5 [0074.050] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf" [0074.050] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf" [0074.050] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf." [0074.050] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf.wannacry" [0074.050] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.051] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c4f5 [0074.051] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80698ac0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0074.051] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.051] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1c477, lpOverlapped=0x0) returned 1 [0074.072] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf") returned="Standard.pdf" [0074.072] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.072] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1c477, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1c477, lpOverlapped=0x0) returned 1 [0074.073] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.073] CloseHandle (hObject=0x9c) returned 1 [0074.073] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standard.pdf.wannacry")) returned 1 [0074.075] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1ac4e, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0074.075] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.075] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StandardBusiness.pdf") returned -1 [0074.075] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StandardBusiness.pdf") returned -1 [0074.075] lstrcmpiA (lpString1="", lpString2="StandardBusiness.pdf") returned -1 [0074.075] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf") returned="Standard.pdf" [0074.075] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\" [0074.075] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\") returned="" [0074.075] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\HOW TO DECRYPT FILES.txt" [0074.075] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\how to decrypt files.txt")) returned 0x20 [0074.076] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\", lpString2="StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf" [0074.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf", pszSpec="*.zip") returned 0 [0074.076] lstrlenA (lpString="*.zip") returned 5 [0074.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf", pszSpec="*.rar") returned 0 [0074.076] lstrlenA (lpString="*.rar") returned 5 [0074.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf", pszSpec="*.7z") returned 0 [0074.076] lstrlenA (lpString="*.7z") returned 4 [0074.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf", pszSpec="*.tar") returned 0 [0074.076] lstrlenA (lpString="*.tar") returned 5 [0074.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf", pszSpec="*.gzip") returned 0 [0074.076] lstrlenA (lpString="*.gzip") returned 6 [0074.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf", pszSpec="*.jpg") returned 0 [0074.076] lstrlenA (lpString="*.jpg") returned 5 [0074.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf", pszSpec="*.jpeg") returned 0 [0074.076] lstrlenA (lpString="*.jpeg") returned 6 [0074.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf", pszSpec="*.psd") returned 0 [0074.076] lstrlenA (lpString="*.psd") returned 5 [0074.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf", pszSpec="*.gif") returned 0 [0074.076] lstrlenA (lpString="*.gif") returned 5 [0074.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf", pszSpec="*.doc") returned 0 [0074.076] lstrlenA (lpString="*.doc") returned 5 [0074.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf", pszSpec="*.docx") returned 0 [0074.076] lstrlenA (lpString="*.docx") returned 6 [0074.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf", pszSpec="*.xls") returned 0 [0074.076] lstrlenA (lpString="*.xls") returned 5 [0074.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf", pszSpec="*.xlsx") returned 0 [0074.077] lstrlenA (lpString="*.xlsx") returned 6 [0074.077] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf", pszSpec="*.ppt") returned 0 [0074.077] lstrlenA (lpString="*.ppt") returned 5 [0074.077] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf", pszSpec="*.pptx") returned 0 [0074.077] lstrlenA (lpString="*.pptx") returned 6 [0074.077] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf", pszSpec="*.pdf") returned 1 [0074.077] lstrlenA (lpString="*.pdf") returned 5 [0074.077] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf" [0074.077] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf" [0074.077] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf." [0074.077] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf.wannacry" [0074.077] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.078] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ac4e [0074.078] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80672960, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0074.078] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.078] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1abd0, lpOverlapped=0x0) returned 1 [0074.083] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf") returned="StandardBusiness.pdf" [0074.083] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.083] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1abd0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1abd0, lpOverlapped=0x0) returned 1 [0074.084] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.084] CloseHandle (hObject=0x9c) returned 1 [0074.084] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standardbusiness.pdf.wannacry")) returned 1 [0074.085] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1ac4e, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0074.086] FindClose (in: hFindFile=0x2e35b8 | out: hFindFile=0x2e35b8) returned 1 [0074.086] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80672960, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73e8, dwReserved1=0x3, cFileName="SKY", cAlternateFileName="")) returned 1 [0074.086] lstrcmpA (lpString1=".", lpString2="SKY") returned -1 [0074.086] lstrcmpA (lpString1="..", lpString2="SKY") returned -1 [0074.086] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*.*") returned="*.*" [0074.086] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", lpString2="SKY" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY" [0074.086] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY") returned 79 [0074.086] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80672960, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0074.088] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.089] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80672960, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0074.089] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.089] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.089] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa85d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0074.089] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.089] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Dynamic.pdf") returned 1 [0074.089] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Dynamic.pdf") returned 1 [0074.089] lstrcmpiA (lpString1="", lpString2="Dynamic.pdf") returned -1 [0074.089] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\*.*") returned="*.*" [0074.089] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\" [0074.089] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\") returned="" [0074.089] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\HOW TO DECRYPT FILES.txt" [0074.089] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\how to decrypt files.txt")) returned 0xffffffff [0074.089] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.090] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0074.090] WriteFile (in: hFile=0x9c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0074.091] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.091] CloseHandle (hObject=0x9c) returned 1 [0074.091] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", lpString2="Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf" [0074.092] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf", pszSpec="*.zip") returned 0 [0074.092] lstrlenA (lpString="*.zip") returned 5 [0074.092] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf", pszSpec="*.rar") returned 0 [0074.092] lstrlenA (lpString="*.rar") returned 5 [0074.092] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf", pszSpec="*.7z") returned 0 [0074.092] lstrlenA (lpString="*.7z") returned 4 [0074.092] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf", pszSpec="*.tar") returned 0 [0074.092] lstrlenA (lpString="*.tar") returned 5 [0074.092] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf", pszSpec="*.gzip") returned 0 [0074.092] lstrlenA (lpString="*.gzip") returned 6 [0074.092] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf", pszSpec="*.jpg") returned 0 [0074.092] lstrlenA (lpString="*.jpg") returned 5 [0074.092] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf", pszSpec="*.jpeg") returned 0 [0074.092] lstrlenA (lpString="*.jpeg") returned 6 [0074.092] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf", pszSpec="*.psd") returned 0 [0074.092] lstrlenA (lpString="*.psd") returned 5 [0074.092] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf", pszSpec="*.gif") returned 0 [0074.092] lstrlenA (lpString="*.gif") returned 5 [0074.092] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf", pszSpec="*.doc") returned 0 [0074.092] lstrlenA (lpString="*.doc") returned 5 [0074.092] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf", pszSpec="*.docx") returned 0 [0074.092] lstrlenA (lpString="*.docx") returned 6 [0074.092] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf", pszSpec="*.xls") returned 0 [0074.092] lstrlenA (lpString="*.xls") returned 5 [0074.092] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf", pszSpec="*.xlsx") returned 0 [0074.092] lstrlenA (lpString="*.xlsx") returned 6 [0074.092] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf", pszSpec="*.ppt") returned 0 [0074.093] lstrlenA (lpString="*.ppt") returned 5 [0074.093] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf", pszSpec="*.pptx") returned 0 [0074.093] lstrlenA (lpString="*.pptx") returned 6 [0074.093] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf", pszSpec="*.pdf") returned 1 [0074.093] lstrlenA (lpString="*.pdf") returned 5 [0074.093] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf" [0074.093] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf" [0074.093] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf." [0074.093] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf.wannacry" [0074.093] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.095] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa85d [0074.095] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80672960, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4)) returned 1 [0074.095] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.095] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xa7df, lpOverlapped=0x0) returned 1 [0074.097] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf") returned="Dynamic.pdf" [0074.097] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.097] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xa7df, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xa7df, lpOverlapped=0x0) returned 1 [0074.097] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.097] CloseHandle (hObject=0x9c) returned 1 [0074.098] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\dynamic.pdf.wannacry")) returned 1 [0074.099] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0074.099] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.099] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Faces.pdf") returned -1 [0074.099] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Faces.pdf") returned 1 [0074.099] lstrcmpiA (lpString1="", lpString2="Faces.pdf") returned -1 [0074.099] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf") returned="Dynamic.pdf" [0074.099] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\" [0074.099] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\") returned="" [0074.099] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\HOW TO DECRYPT FILES.txt" [0074.099] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\how to decrypt files.txt")) returned 0x20 [0074.099] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", lpString2="Faces.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf" [0074.099] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf", pszSpec="*.zip") returned 0 [0074.099] lstrlenA (lpString="*.zip") returned 5 [0074.099] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf", pszSpec="*.rar") returned 0 [0074.099] lstrlenA (lpString="*.rar") returned 5 [0074.099] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf", pszSpec="*.7z") returned 0 [0074.099] lstrlenA (lpString="*.7z") returned 4 [0074.099] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf", pszSpec="*.tar") returned 0 [0074.099] lstrlenA (lpString="*.tar") returned 5 [0074.100] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf", pszSpec="*.gzip") returned 0 [0074.100] lstrlenA (lpString="*.gzip") returned 6 [0074.100] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf", pszSpec="*.jpg") returned 0 [0074.100] lstrlenA (lpString="*.jpg") returned 5 [0074.100] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf", pszSpec="*.jpeg") returned 0 [0074.100] lstrlenA (lpString="*.jpeg") returned 6 [0074.100] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf", pszSpec="*.psd") returned 0 [0074.100] lstrlenA (lpString="*.psd") returned 5 [0074.100] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf", pszSpec="*.gif") returned 0 [0074.100] lstrlenA (lpString="*.gif") returned 5 [0074.100] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf", pszSpec="*.doc") returned 0 [0074.100] lstrlenA (lpString="*.doc") returned 5 [0074.100] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf", pszSpec="*.docx") returned 0 [0074.100] lstrlenA (lpString="*.docx") returned 6 [0074.100] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf", pszSpec="*.xls") returned 0 [0074.100] lstrlenA (lpString="*.xls") returned 5 [0074.100] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf", pszSpec="*.xlsx") returned 0 [0074.100] lstrlenA (lpString="*.xlsx") returned 6 [0074.100] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf", pszSpec="*.ppt") returned 0 [0074.100] lstrlenA (lpString="*.ppt") returned 5 [0074.100] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf", pszSpec="*.pptx") returned 0 [0074.100] lstrlenA (lpString="*.pptx") returned 6 [0074.100] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf", pszSpec="*.pdf") returned 1 [0074.100] lstrlenA (lpString="*.pdf") returned 5 [0074.100] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf" [0074.100] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf" [0074.100] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf." [0074.100] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf.wannacry" [0074.101] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.101] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x80f5 [0074.101] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80672960, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4)) returned 1 [0074.101] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.102] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x8077, lpOverlapped=0x0) returned 1 [0074.104] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf") returned="Faces.pdf" [0074.104] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.104] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x8077, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x8077, lpOverlapped=0x0) returned 1 [0074.104] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.104] CloseHandle (hObject=0x9c) returned 1 [0074.104] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\faces.pdf.wannacry")) returned 1 [0074.105] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb731, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0074.105] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.105] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Pointers.pdf") returned -1 [0074.105] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Pointers.pdf") returned -1 [0074.105] lstrcmpiA (lpString1="", lpString2="Pointers.pdf") returned -1 [0074.105] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf") returned="Faces.pdf" [0074.105] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\" [0074.106] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\") returned="" [0074.106] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\HOW TO DECRYPT FILES.txt" [0074.106] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\how to decrypt files.txt")) returned 0x20 [0074.106] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", lpString2="Pointers.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf" [0074.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf", pszSpec="*.zip") returned 0 [0074.106] lstrlenA (lpString="*.zip") returned 5 [0074.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf", pszSpec="*.rar") returned 0 [0074.106] lstrlenA (lpString="*.rar") returned 5 [0074.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf", pszSpec="*.7z") returned 0 [0074.106] lstrlenA (lpString="*.7z") returned 4 [0074.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf", pszSpec="*.tar") returned 0 [0074.106] lstrlenA (lpString="*.tar") returned 5 [0074.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf", pszSpec="*.gzip") returned 0 [0074.106] lstrlenA (lpString="*.gzip") returned 6 [0074.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf", pszSpec="*.jpg") returned 0 [0074.106] lstrlenA (lpString="*.jpg") returned 5 [0074.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf", pszSpec="*.jpeg") returned 0 [0074.106] lstrlenA (lpString="*.jpeg") returned 6 [0074.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf", pszSpec="*.psd") returned 0 [0074.106] lstrlenA (lpString="*.psd") returned 5 [0074.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf", pszSpec="*.gif") returned 0 [0074.106] lstrlenA (lpString="*.gif") returned 5 [0074.106] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf", pszSpec="*.doc") returned 0 [0074.106] lstrlenA (lpString="*.doc") returned 5 [0074.107] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf", pszSpec="*.docx") returned 0 [0074.107] lstrlenA (lpString="*.docx") returned 6 [0074.107] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf", pszSpec="*.xls") returned 0 [0074.107] lstrlenA (lpString="*.xls") returned 5 [0074.107] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf", pszSpec="*.xlsx") returned 0 [0074.107] lstrlenA (lpString="*.xlsx") returned 6 [0074.107] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf", pszSpec="*.ppt") returned 0 [0074.107] lstrlenA (lpString="*.ppt") returned 5 [0074.107] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf", pszSpec="*.pptx") returned 0 [0074.107] lstrlenA (lpString="*.pptx") returned 6 [0074.107] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf", pszSpec="*.pdf") returned 1 [0074.107] lstrlenA (lpString="*.pdf") returned 5 [0074.107] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf" [0074.107] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf" [0074.107] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf." [0074.107] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf.wannacry" [0074.107] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.108] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb731 [0074.108] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80672960, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4)) returned 1 [0074.108] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.108] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xb6b3, lpOverlapped=0x0) returned 1 [0074.111] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf") returned="Pointers.pdf" [0074.111] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.111] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xb6b3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xb6b3, lpOverlapped=0x0) returned 1 [0074.111] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.111] CloseHandle (hObject=0x9c) returned 1 [0074.111] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\pointers.pdf.wannacry")) returned 1 [0074.112] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb9dd, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0074.112] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.112] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SignHere.pdf") returned -1 [0074.113] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SignHere.pdf") returned -1 [0074.113] lstrcmpiA (lpString1="", lpString2="SignHere.pdf") returned -1 [0074.113] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf") returned="Pointers.pdf" [0074.113] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\" [0074.113] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\") returned="" [0074.113] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\HOW TO DECRYPT FILES.txt" [0074.113] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\how to decrypt files.txt")) returned 0x20 [0074.113] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", lpString2="SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf" [0074.113] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf", pszSpec="*.zip") returned 0 [0074.113] lstrlenA (lpString="*.zip") returned 5 [0074.113] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf", pszSpec="*.rar") returned 0 [0074.113] lstrlenA (lpString="*.rar") returned 5 [0074.113] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf", pszSpec="*.7z") returned 0 [0074.113] lstrlenA (lpString="*.7z") returned 4 [0074.113] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf", pszSpec="*.tar") returned 0 [0074.113] lstrlenA (lpString="*.tar") returned 5 [0074.113] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf", pszSpec="*.gzip") returned 0 [0074.113] lstrlenA (lpString="*.gzip") returned 6 [0074.113] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf", pszSpec="*.jpg") returned 0 [0074.113] lstrlenA (lpString="*.jpg") returned 5 [0074.113] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf", pszSpec="*.jpeg") returned 0 [0074.113] lstrlenA (lpString="*.jpeg") returned 6 [0074.113] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf", pszSpec="*.psd") returned 0 [0074.114] lstrlenA (lpString="*.psd") returned 5 [0074.114] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf", pszSpec="*.gif") returned 0 [0074.114] lstrlenA (lpString="*.gif") returned 5 [0074.114] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf", pszSpec="*.doc") returned 0 [0074.114] lstrlenA (lpString="*.doc") returned 5 [0074.114] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf", pszSpec="*.docx") returned 0 [0074.114] lstrlenA (lpString="*.docx") returned 6 [0074.114] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf", pszSpec="*.xls") returned 0 [0074.114] lstrlenA (lpString="*.xls") returned 5 [0074.114] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf", pszSpec="*.xlsx") returned 0 [0074.114] lstrlenA (lpString="*.xlsx") returned 6 [0074.114] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf", pszSpec="*.ppt") returned 0 [0074.114] lstrlenA (lpString="*.ppt") returned 5 [0074.114] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf", pszSpec="*.pptx") returned 0 [0074.114] lstrlenA (lpString="*.pptx") returned 6 [0074.114] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf", pszSpec="*.pdf") returned 1 [0074.114] lstrlenA (lpString="*.pdf") returned 5 [0074.114] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf" [0074.114] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf" [0074.114] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf." [0074.114] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf.wannacry" [0074.114] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.115] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9dd [0074.115] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80672960, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4)) returned 1 [0074.115] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.115] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xb95f, lpOverlapped=0x0) returned 1 [0074.118] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf") returned="SignHere.pdf" [0074.118] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.118] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xb95f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xb95f, lpOverlapped=0x0) returned 1 [0074.118] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.118] CloseHandle (hObject=0x9c) returned 1 [0074.118] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\signhere.pdf.wannacry")) returned 1 [0074.119] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f5, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0074.119] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.119] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Standard.pdf") returned -1 [0074.119] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Standard.pdf") returned -1 [0074.119] lstrcmpiA (lpString1="", lpString2="Standard.pdf") returned -1 [0074.119] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf") returned="SignHere.pdf" [0074.119] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\" [0074.119] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\") returned="" [0074.119] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\HOW TO DECRYPT FILES.txt" [0074.119] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\how to decrypt files.txt")) returned 0x20 [0074.120] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", lpString2="Standard.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf" [0074.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf", pszSpec="*.zip") returned 0 [0074.120] lstrlenA (lpString="*.zip") returned 5 [0074.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf", pszSpec="*.rar") returned 0 [0074.120] lstrlenA (lpString="*.rar") returned 5 [0074.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf", pszSpec="*.7z") returned 0 [0074.120] lstrlenA (lpString="*.7z") returned 4 [0074.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf", pszSpec="*.tar") returned 0 [0074.120] lstrlenA (lpString="*.tar") returned 5 [0074.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf", pszSpec="*.gzip") returned 0 [0074.120] lstrlenA (lpString="*.gzip") returned 6 [0074.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf", pszSpec="*.jpg") returned 0 [0074.120] lstrlenA (lpString="*.jpg") returned 5 [0074.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf", pszSpec="*.jpeg") returned 0 [0074.120] lstrlenA (lpString="*.jpeg") returned 6 [0074.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf", pszSpec="*.psd") returned 0 [0074.120] lstrlenA (lpString="*.psd") returned 5 [0074.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf", pszSpec="*.gif") returned 0 [0074.120] lstrlenA (lpString="*.gif") returned 5 [0074.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf", pszSpec="*.doc") returned 0 [0074.120] lstrlenA (lpString="*.doc") returned 5 [0074.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf", pszSpec="*.docx") returned 0 [0074.120] lstrlenA (lpString="*.docx") returned 6 [0074.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf", pszSpec="*.xls") returned 0 [0074.120] lstrlenA (lpString="*.xls") returned 5 [0074.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf", pszSpec="*.xlsx") returned 0 [0074.121] lstrlenA (lpString="*.xlsx") returned 6 [0074.121] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf", pszSpec="*.ppt") returned 0 [0074.121] lstrlenA (lpString="*.ppt") returned 5 [0074.121] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf", pszSpec="*.pptx") returned 0 [0074.121] lstrlenA (lpString="*.pptx") returned 6 [0074.121] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf", pszSpec="*.pdf") returned 1 [0074.121] lstrlenA (lpString="*.pdf") returned 5 [0074.121] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf" [0074.121] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf" [0074.121] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf." [0074.121] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf.wannacry" [0074.121] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.122] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c4f5 [0074.122] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80672960, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4)) returned 1 [0074.122] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.122] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1c477, lpOverlapped=0x0) returned 1 [0074.127] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf") returned="Standard.pdf" [0074.127] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.127] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1c477, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1c477, lpOverlapped=0x0) returned 1 [0074.128] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.128] CloseHandle (hObject=0x9c) returned 1 [0074.128] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standard.pdf.wannacry")) returned 1 [0074.129] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14758, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0074.129] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.129] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StandardBusiness.pdf") returned -1 [0074.129] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StandardBusiness.pdf") returned -1 [0074.129] lstrcmpiA (lpString1="", lpString2="StandardBusiness.pdf") returned -1 [0074.129] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf") returned="Standard.pdf" [0074.129] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\" [0074.129] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\") returned="" [0074.129] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\HOW TO DECRYPT FILES.txt" [0074.129] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\how to decrypt files.txt")) returned 0x20 [0074.130] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\", lpString2="StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf" [0074.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf", pszSpec="*.zip") returned 0 [0074.130] lstrlenA (lpString="*.zip") returned 5 [0074.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf", pszSpec="*.rar") returned 0 [0074.130] lstrlenA (lpString="*.rar") returned 5 [0074.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf", pszSpec="*.7z") returned 0 [0074.130] lstrlenA (lpString="*.7z") returned 4 [0074.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf", pszSpec="*.tar") returned 0 [0074.130] lstrlenA (lpString="*.tar") returned 5 [0074.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf", pszSpec="*.gzip") returned 0 [0074.130] lstrlenA (lpString="*.gzip") returned 6 [0074.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf", pszSpec="*.jpg") returned 0 [0074.130] lstrlenA (lpString="*.jpg") returned 5 [0074.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf", pszSpec="*.jpeg") returned 0 [0074.130] lstrlenA (lpString="*.jpeg") returned 6 [0074.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf", pszSpec="*.psd") returned 0 [0074.130] lstrlenA (lpString="*.psd") returned 5 [0074.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf", pszSpec="*.gif") returned 0 [0074.130] lstrlenA (lpString="*.gif") returned 5 [0074.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf", pszSpec="*.doc") returned 0 [0074.130] lstrlenA (lpString="*.doc") returned 5 [0074.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf", pszSpec="*.docx") returned 0 [0074.130] lstrlenA (lpString="*.docx") returned 6 [0074.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf", pszSpec="*.xls") returned 0 [0074.130] lstrlenA (lpString="*.xls") returned 5 [0074.130] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf", pszSpec="*.xlsx") returned 0 [0074.130] lstrlenA (lpString="*.xlsx") returned 6 [0074.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf", pszSpec="*.ppt") returned 0 [0074.131] lstrlenA (lpString="*.ppt") returned 5 [0074.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf", pszSpec="*.pptx") returned 0 [0074.131] lstrlenA (lpString="*.pptx") returned 6 [0074.131] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf", pszSpec="*.pdf") returned 1 [0074.131] lstrlenA (lpString="*.pdf") returned 5 [0074.131] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf" [0074.131] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf" [0074.131] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf." [0074.131] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf.wannacry" [0074.131] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.132] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14758 [0074.132] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80672960, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4)) returned 1 [0074.132] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.132] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x146da, lpOverlapped=0x0) returned 1 [0074.135] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf") returned="StandardBusiness.pdf" [0074.135] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.135] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x146da, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x146da, lpOverlapped=0x0) returned 1 [0074.135] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.136] CloseHandle (hObject=0x9c) returned 1 [0074.136] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standardbusiness.pdf.wannacry")) returned 1 [0074.137] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14758, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0074.137] FindClose (in: hFindFile=0x2e35b8 | out: hFindFile=0x2e35b8) returned 1 [0074.137] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73e8, dwReserved1=0x3, cFileName="SLV", cAlternateFileName="")) returned 1 [0074.137] lstrcmpA (lpString1=".", lpString2="SLV") returned -1 [0074.137] lstrcmpA (lpString1="..", lpString2="SLV") returned -1 [0074.137] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*.*") returned="*.*" [0074.137] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", lpString2="SLV" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV" [0074.137] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV") returned 79 [0074.137] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0074.140] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.140] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0074.140] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.140] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.140] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e146, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0074.140] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.140] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Dynamic.pdf") returned 1 [0074.140] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Dynamic.pdf") returned 1 [0074.140] lstrcmpiA (lpString1="", lpString2="Dynamic.pdf") returned -1 [0074.140] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\*.*") returned="*.*" [0074.140] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\" [0074.140] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\") returned="" [0074.140] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\HOW TO DECRYPT FILES.txt" [0074.141] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\how to decrypt files.txt")) returned 0xffffffff [0074.141] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.142] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0074.142] WriteFile (in: hFile=0x9c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0074.143] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.143] CloseHandle (hObject=0x9c) returned 1 [0074.143] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\", lpString2="Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf" [0074.143] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf", pszSpec="*.zip") returned 0 [0074.143] lstrlenA (lpString="*.zip") returned 5 [0074.143] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf", pszSpec="*.rar") returned 0 [0074.143] lstrlenA (lpString="*.rar") returned 5 [0074.143] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf", pszSpec="*.7z") returned 0 [0074.143] lstrlenA (lpString="*.7z") returned 4 [0074.143] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf", pszSpec="*.tar") returned 0 [0074.143] lstrlenA (lpString="*.tar") returned 5 [0074.143] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf", pszSpec="*.gzip") returned 0 [0074.144] lstrlenA (lpString="*.gzip") returned 6 [0074.144] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf", pszSpec="*.jpg") returned 0 [0074.144] lstrlenA (lpString="*.jpg") returned 5 [0074.144] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf", pszSpec="*.jpeg") returned 0 [0074.144] lstrlenA (lpString="*.jpeg") returned 6 [0074.144] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf", pszSpec="*.psd") returned 0 [0074.144] lstrlenA (lpString="*.psd") returned 5 [0074.144] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf", pszSpec="*.gif") returned 0 [0074.144] lstrlenA (lpString="*.gif") returned 5 [0074.144] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf", pszSpec="*.doc") returned 0 [0074.144] lstrlenA (lpString="*.doc") returned 5 [0074.144] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf", pszSpec="*.docx") returned 0 [0074.144] lstrlenA (lpString="*.docx") returned 6 [0074.144] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf", pszSpec="*.xls") returned 0 [0074.144] lstrlenA (lpString="*.xls") returned 5 [0074.144] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf", pszSpec="*.xlsx") returned 0 [0074.144] lstrlenA (lpString="*.xlsx") returned 6 [0074.144] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf", pszSpec="*.ppt") returned 0 [0074.144] lstrlenA (lpString="*.ppt") returned 5 [0074.144] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf", pszSpec="*.pptx") returned 0 [0074.144] lstrlenA (lpString="*.pptx") returned 6 [0074.144] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf", pszSpec="*.pdf") returned 1 [0074.144] lstrlenA (lpString="*.pdf") returned 5 [0074.144] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf" [0074.144] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf" [0074.144] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf." [0074.144] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf.wannacry" [0074.145] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.145] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e146 [0074.145] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x8064c800, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0074.146] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.146] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1e0c8, lpOverlapped=0x0) returned 1 [0074.148] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf") returned="Dynamic.pdf" [0074.148] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.149] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1e0c8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1e0c8, lpOverlapped=0x0) returned 1 [0074.149] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.149] CloseHandle (hObject=0x9c) returned 1 [0074.149] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\dynamic.pdf.wannacry")) returned 1 [0074.151] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0074.151] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.151] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Faces.pdf") returned -1 [0074.151] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Faces.pdf") returned 1 [0074.151] lstrcmpiA (lpString1="", lpString2="Faces.pdf") returned -1 [0074.151] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf") returned="Dynamic.pdf" [0074.151] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\" [0074.151] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\") returned="" [0074.151] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\HOW TO DECRYPT FILES.txt" [0074.151] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\how to decrypt files.txt")) returned 0x20 [0074.151] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\", lpString2="Faces.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf" [0074.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf", pszSpec="*.zip") returned 0 [0074.151] lstrlenA (lpString="*.zip") returned 5 [0074.151] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf", pszSpec="*.rar") returned 0 [0074.151] lstrlenA (lpString="*.rar") returned 5 [0074.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf", pszSpec="*.7z") returned 0 [0074.152] lstrlenA (lpString="*.7z") returned 4 [0074.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf", pszSpec="*.tar") returned 0 [0074.152] lstrlenA (lpString="*.tar") returned 5 [0074.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf", pszSpec="*.gzip") returned 0 [0074.152] lstrlenA (lpString="*.gzip") returned 6 [0074.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf", pszSpec="*.jpg") returned 0 [0074.152] lstrlenA (lpString="*.jpg") returned 5 [0074.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf", pszSpec="*.jpeg") returned 0 [0074.152] lstrlenA (lpString="*.jpeg") returned 6 [0074.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf", pszSpec="*.psd") returned 0 [0074.152] lstrlenA (lpString="*.psd") returned 5 [0074.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf", pszSpec="*.gif") returned 0 [0074.152] lstrlenA (lpString="*.gif") returned 5 [0074.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf", pszSpec="*.doc") returned 0 [0074.152] lstrlenA (lpString="*.doc") returned 5 [0074.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf", pszSpec="*.docx") returned 0 [0074.152] lstrlenA (lpString="*.docx") returned 6 [0074.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf", pszSpec="*.xls") returned 0 [0074.152] lstrlenA (lpString="*.xls") returned 5 [0074.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf", pszSpec="*.xlsx") returned 0 [0074.152] lstrlenA (lpString="*.xlsx") returned 6 [0074.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf", pszSpec="*.ppt") returned 0 [0074.152] lstrlenA (lpString="*.ppt") returned 5 [0074.152] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf", pszSpec="*.pptx") returned 0 [0074.152] lstrlenA (lpString="*.pptx") returned 6 [0074.153] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf", pszSpec="*.pdf") returned 1 [0074.153] lstrlenA (lpString="*.pdf") returned 5 [0074.153] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf" [0074.153] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf" [0074.153] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf." [0074.153] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf.wannacry" [0074.153] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.154] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x80f5 [0074.154] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x8064c800, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0074.154] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.154] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x8077, lpOverlapped=0x0) returned 1 [0074.156] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf") returned="Faces.pdf" [0074.156] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.156] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x8077, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x8077, lpOverlapped=0x0) returned 1 [0074.157] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.157] CloseHandle (hObject=0x9c) returned 1 [0074.157] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\faces.pdf.wannacry")) returned 1 [0074.158] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb731, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0074.158] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.158] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Pointers.pdf") returned -1 [0074.158] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Pointers.pdf") returned -1 [0074.159] lstrcmpiA (lpString1="", lpString2="Pointers.pdf") returned -1 [0074.159] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf") returned="Faces.pdf" [0074.159] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\" [0074.159] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\") returned="" [0074.159] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\HOW TO DECRYPT FILES.txt" [0074.159] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\how to decrypt files.txt")) returned 0x20 [0074.159] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\", lpString2="Pointers.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf" [0074.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf", pszSpec="*.zip") returned 0 [0074.159] lstrlenA (lpString="*.zip") returned 5 [0074.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf", pszSpec="*.rar") returned 0 [0074.159] lstrlenA (lpString="*.rar") returned 5 [0074.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf", pszSpec="*.7z") returned 0 [0074.159] lstrlenA (lpString="*.7z") returned 4 [0074.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf", pszSpec="*.tar") returned 0 [0074.159] lstrlenA (lpString="*.tar") returned 5 [0074.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf", pszSpec="*.gzip") returned 0 [0074.159] lstrlenA (lpString="*.gzip") returned 6 [0074.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf", pszSpec="*.jpg") returned 0 [0074.159] lstrlenA (lpString="*.jpg") returned 5 [0074.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf", pszSpec="*.jpeg") returned 0 [0074.159] lstrlenA (lpString="*.jpeg") returned 6 [0074.159] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf", pszSpec="*.psd") returned 0 [0074.159] lstrlenA (lpString="*.psd") returned 5 [0074.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf", pszSpec="*.gif") returned 0 [0074.160] lstrlenA (lpString="*.gif") returned 5 [0074.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf", pszSpec="*.doc") returned 0 [0074.160] lstrlenA (lpString="*.doc") returned 5 [0074.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf", pszSpec="*.docx") returned 0 [0074.160] lstrlenA (lpString="*.docx") returned 6 [0074.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf", pszSpec="*.xls") returned 0 [0074.160] lstrlenA (lpString="*.xls") returned 5 [0074.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf", pszSpec="*.xlsx") returned 0 [0074.160] lstrlenA (lpString="*.xlsx") returned 6 [0074.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf", pszSpec="*.ppt") returned 0 [0074.160] lstrlenA (lpString="*.ppt") returned 5 [0074.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf", pszSpec="*.pptx") returned 0 [0074.160] lstrlenA (lpString="*.pptx") returned 6 [0074.160] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf", pszSpec="*.pdf") returned 1 [0074.160] lstrlenA (lpString="*.pdf") returned 5 [0074.160] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf" [0074.160] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf" [0074.160] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf." [0074.160] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf.wannacry" [0074.160] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.161] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb731 [0074.161] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x8064c800, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0074.161] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.161] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xb6b3, lpOverlapped=0x0) returned 1 [0074.165] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf") returned="Pointers.pdf" [0074.165] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.165] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xb6b3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xb6b3, lpOverlapped=0x0) returned 1 [0074.165] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.165] CloseHandle (hObject=0x9c) returned 1 [0074.165] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\pointers.pdf.wannacry")) returned 1 [0074.166] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12fb3, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0074.167] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.167] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SignHere.pdf") returned -1 [0074.167] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SignHere.pdf") returned -1 [0074.167] lstrcmpiA (lpString1="", lpString2="SignHere.pdf") returned -1 [0074.167] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf") returned="Pointers.pdf" [0074.167] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\" [0074.167] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\") returned="" [0074.167] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\HOW TO DECRYPT FILES.txt" [0074.167] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\how to decrypt files.txt")) returned 0x20 [0074.167] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\", lpString2="SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf" [0074.167] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf", pszSpec="*.zip") returned 0 [0074.167] lstrlenA (lpString="*.zip") returned 5 [0074.167] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf", pszSpec="*.rar") returned 0 [0074.167] lstrlenA (lpString="*.rar") returned 5 [0074.167] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf", pszSpec="*.7z") returned 0 [0074.167] lstrlenA (lpString="*.7z") returned 4 [0074.167] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf", pszSpec="*.tar") returned 0 [0074.167] lstrlenA (lpString="*.tar") returned 5 [0074.167] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf", pszSpec="*.gzip") returned 0 [0074.167] lstrlenA (lpString="*.gzip") returned 6 [0074.167] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf", pszSpec="*.jpg") returned 0 [0074.167] lstrlenA (lpString="*.jpg") returned 5 [0074.168] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf", pszSpec="*.jpeg") returned 0 [0074.168] lstrlenA (lpString="*.jpeg") returned 6 [0074.168] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf", pszSpec="*.psd") returned 0 [0074.168] lstrlenA (lpString="*.psd") returned 5 [0074.168] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf", pszSpec="*.gif") returned 0 [0074.168] lstrlenA (lpString="*.gif") returned 5 [0074.168] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf", pszSpec="*.doc") returned 0 [0074.168] lstrlenA (lpString="*.doc") returned 5 [0074.168] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf", pszSpec="*.docx") returned 0 [0074.168] lstrlenA (lpString="*.docx") returned 6 [0074.168] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf", pszSpec="*.xls") returned 0 [0074.168] lstrlenA (lpString="*.xls") returned 5 [0074.168] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf", pszSpec="*.xlsx") returned 0 [0074.168] lstrlenA (lpString="*.xlsx") returned 6 [0074.168] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf", pszSpec="*.ppt") returned 0 [0074.168] lstrlenA (lpString="*.ppt") returned 5 [0074.168] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf", pszSpec="*.pptx") returned 0 [0074.168] lstrlenA (lpString="*.pptx") returned 6 [0074.168] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf", pszSpec="*.pdf") returned 1 [0074.168] lstrlenA (lpString="*.pdf") returned 5 [0074.168] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf" [0074.168] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf" [0074.168] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf." [0074.168] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf.wannacry" [0074.168] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.169] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12fb3 [0074.169] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x8064c800, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0074.169] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.169] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x12f35, lpOverlapped=0x0) returned 1 [0074.172] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf") returned="SignHere.pdf" [0074.172] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.172] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x12f35, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x12f35, lpOverlapped=0x0) returned 1 [0074.173] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.173] CloseHandle (hObject=0x9c) returned 1 [0074.173] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\signhere.pdf.wannacry")) returned 1 [0074.174] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f5, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0074.174] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.174] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Standard.pdf") returned -1 [0074.174] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Standard.pdf") returned -1 [0074.174] lstrcmpiA (lpString1="", lpString2="Standard.pdf") returned -1 [0074.174] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf") returned="SignHere.pdf" [0074.175] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\" [0074.175] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\") returned="" [0074.175] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\HOW TO DECRYPT FILES.txt" [0074.175] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\how to decrypt files.txt")) returned 0x20 [0074.175] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\", lpString2="Standard.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf" [0074.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf", pszSpec="*.zip") returned 0 [0074.175] lstrlenA (lpString="*.zip") returned 5 [0074.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf", pszSpec="*.rar") returned 0 [0074.175] lstrlenA (lpString="*.rar") returned 5 [0074.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf", pszSpec="*.7z") returned 0 [0074.175] lstrlenA (lpString="*.7z") returned 4 [0074.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf", pszSpec="*.tar") returned 0 [0074.175] lstrlenA (lpString="*.tar") returned 5 [0074.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf", pszSpec="*.gzip") returned 0 [0074.175] lstrlenA (lpString="*.gzip") returned 6 [0074.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf", pszSpec="*.jpg") returned 0 [0074.175] lstrlenA (lpString="*.jpg") returned 5 [0074.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf", pszSpec="*.jpeg") returned 0 [0074.175] lstrlenA (lpString="*.jpeg") returned 6 [0074.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf", pszSpec="*.psd") returned 0 [0074.175] lstrlenA (lpString="*.psd") returned 5 [0074.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf", pszSpec="*.gif") returned 0 [0074.175] lstrlenA (lpString="*.gif") returned 5 [0074.175] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf", pszSpec="*.doc") returned 0 [0074.176] lstrlenA (lpString="*.doc") returned 5 [0074.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf", pszSpec="*.docx") returned 0 [0074.176] lstrlenA (lpString="*.docx") returned 6 [0074.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf", pszSpec="*.xls") returned 0 [0074.176] lstrlenA (lpString="*.xls") returned 5 [0074.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf", pszSpec="*.xlsx") returned 0 [0074.176] lstrlenA (lpString="*.xlsx") returned 6 [0074.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf", pszSpec="*.ppt") returned 0 [0074.176] lstrlenA (lpString="*.ppt") returned 5 [0074.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf", pszSpec="*.pptx") returned 0 [0074.176] lstrlenA (lpString="*.pptx") returned 6 [0074.176] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf", pszSpec="*.pdf") returned 1 [0074.176] lstrlenA (lpString="*.pdf") returned 5 [0074.176] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf" [0074.176] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf" [0074.176] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf." [0074.176] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf.wannacry" [0074.176] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.177] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c4f5 [0074.177] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x8064c800, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0074.177] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.177] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1c477, lpOverlapped=0x0) returned 1 [0074.186] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf") returned="Standard.pdf" [0074.186] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.186] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1c477, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1c477, lpOverlapped=0x0) returned 1 [0074.187] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.187] CloseHandle (hObject=0x9c) returned 1 [0074.187] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standard.pdf.wannacry")) returned 1 [0074.189] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x26254, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0074.189] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.189] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StandardBusiness.pdf") returned -1 [0074.189] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StandardBusiness.pdf") returned -1 [0074.189] lstrcmpiA (lpString1="", lpString2="StandardBusiness.pdf") returned -1 [0074.189] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf") returned="Standard.pdf" [0074.189] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\" [0074.189] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\") returned="" [0074.189] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\HOW TO DECRYPT FILES.txt" [0074.189] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\how to decrypt files.txt")) returned 0x20 [0074.189] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\", lpString2="StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf" [0074.189] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf", pszSpec="*.zip") returned 0 [0074.189] lstrlenA (lpString="*.zip") returned 5 [0074.189] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf", pszSpec="*.rar") returned 0 [0074.189] lstrlenA (lpString="*.rar") returned 5 [0074.189] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf", pszSpec="*.7z") returned 0 [0074.189] lstrlenA (lpString="*.7z") returned 4 [0074.189] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf", pszSpec="*.tar") returned 0 [0074.189] lstrlenA (lpString="*.tar") returned 5 [0074.189] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf", pszSpec="*.gzip") returned 0 [0074.189] lstrlenA (lpString="*.gzip") returned 6 [0074.189] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf", pszSpec="*.jpg") returned 0 [0074.189] lstrlenA (lpString="*.jpg") returned 5 [0074.189] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf", pszSpec="*.jpeg") returned 0 [0074.190] lstrlenA (lpString="*.jpeg") returned 6 [0074.190] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf", pszSpec="*.psd") returned 0 [0074.190] lstrlenA (lpString="*.psd") returned 5 [0074.190] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf", pszSpec="*.gif") returned 0 [0074.190] lstrlenA (lpString="*.gif") returned 5 [0074.190] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf", pszSpec="*.doc") returned 0 [0074.190] lstrlenA (lpString="*.doc") returned 5 [0074.190] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf", pszSpec="*.docx") returned 0 [0074.190] lstrlenA (lpString="*.docx") returned 6 [0074.190] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf", pszSpec="*.xls") returned 0 [0074.190] lstrlenA (lpString="*.xls") returned 5 [0074.190] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf", pszSpec="*.xlsx") returned 0 [0074.190] lstrlenA (lpString="*.xlsx") returned 6 [0074.190] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf", pszSpec="*.ppt") returned 0 [0074.190] lstrlenA (lpString="*.ppt") returned 5 [0074.190] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf", pszSpec="*.pptx") returned 0 [0074.190] lstrlenA (lpString="*.pptx") returned 6 [0074.190] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf", pszSpec="*.pdf") returned 1 [0074.190] lstrlenA (lpString="*.pdf") returned 5 [0074.190] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf" [0074.190] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf" [0074.190] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf." [0074.190] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf.wannacry" [0074.190] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.191] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x26254 [0074.191] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x8064c800, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0074.192] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.192] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x261d6, lpOverlapped=0x0) returned 1 [0074.197] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf") returned="StandardBusiness.pdf" [0074.197] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.197] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x261d6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x261d6, lpOverlapped=0x0) returned 1 [0074.198] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.198] CloseHandle (hObject=0x9c) returned 1 [0074.198] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standardbusiness.pdf.wannacry")) returned 1 [0074.200] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x26254, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0074.200] FindClose (in: hFindFile=0x2e35b8 | out: hFindFile=0x2e35b8) returned 1 [0074.200] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73e8, dwReserved1=0x3, cFileName="SUO", cAlternateFileName="")) returned 1 [0074.200] lstrcmpA (lpString1=".", lpString2="SUO") returned -1 [0074.200] lstrcmpA (lpString1="..", lpString2="SUO") returned -1 [0074.200] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*.*") returned="*.*" [0074.200] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", lpString2="SUO" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO" [0074.200] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO") returned 79 [0074.200] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0074.200] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.200] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0074.200] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.201] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.201] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7e1, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0074.201] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.201] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Dynamic.pdf") returned 1 [0074.201] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Dynamic.pdf") returned 1 [0074.201] lstrcmpiA (lpString1="", lpString2="Dynamic.pdf") returned -1 [0074.201] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\*.*") returned="*.*" [0074.201] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\" [0074.201] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\") returned="" [0074.201] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\HOW TO DECRYPT FILES.txt" [0074.201] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\how to decrypt files.txt")) returned 0xffffffff [0074.201] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.204] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0074.204] WriteFile (in: hFile=0x9c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0074.205] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.205] CloseHandle (hObject=0x9c) returned 1 [0074.205] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", lpString2="Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf" [0074.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf", pszSpec="*.zip") returned 0 [0074.205] lstrlenA (lpString="*.zip") returned 5 [0074.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf", pszSpec="*.rar") returned 0 [0074.206] lstrlenA (lpString="*.rar") returned 5 [0074.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf", pszSpec="*.7z") returned 0 [0074.206] lstrlenA (lpString="*.7z") returned 4 [0074.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf", pszSpec="*.tar") returned 0 [0074.206] lstrlenA (lpString="*.tar") returned 5 [0074.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf", pszSpec="*.gzip") returned 0 [0074.206] lstrlenA (lpString="*.gzip") returned 6 [0074.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf", pszSpec="*.jpg") returned 0 [0074.206] lstrlenA (lpString="*.jpg") returned 5 [0074.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf", pszSpec="*.jpeg") returned 0 [0074.206] lstrlenA (lpString="*.jpeg") returned 6 [0074.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf", pszSpec="*.psd") returned 0 [0074.206] lstrlenA (lpString="*.psd") returned 5 [0074.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf", pszSpec="*.gif") returned 0 [0074.206] lstrlenA (lpString="*.gif") returned 5 [0074.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf", pszSpec="*.doc") returned 0 [0074.206] lstrlenA (lpString="*.doc") returned 5 [0074.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf", pszSpec="*.docx") returned 0 [0074.206] lstrlenA (lpString="*.docx") returned 6 [0074.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf", pszSpec="*.xls") returned 0 [0074.206] lstrlenA (lpString="*.xls") returned 5 [0074.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf", pszSpec="*.xlsx") returned 0 [0074.207] lstrlenA (lpString="*.xlsx") returned 6 [0074.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf", pszSpec="*.ppt") returned 0 [0074.207] lstrlenA (lpString="*.ppt") returned 5 [0074.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf", pszSpec="*.pptx") returned 0 [0074.207] lstrlenA (lpString="*.pptx") returned 6 [0074.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf", pszSpec="*.pdf") returned 1 [0074.207] lstrlenA (lpString="*.pdf") returned 5 [0074.207] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf" [0074.207] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf" [0074.207] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf." [0074.207] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf.wannacry" [0074.207] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.210] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe7e1 [0074.210] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x7f804400, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0074.210] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.210] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xe763, lpOverlapped=0x0) returned 1 [0074.212] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf") returned="Dynamic.pdf" [0074.212] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.212] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xe763, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xe763, lpOverlapped=0x0) returned 1 [0074.213] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.213] CloseHandle (hObject=0x9c) returned 1 [0074.213] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\dynamic.pdf.wannacry")) returned 1 [0074.214] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f82a560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9cbb, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0074.214] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.214] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SignHere.pdf") returned -1 [0074.214] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SignHere.pdf") returned -1 [0074.214] lstrcmpiA (lpString1="", lpString2="SignHere.pdf") returned -1 [0074.215] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf") returned="Dynamic.pdf" [0074.215] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\" [0074.215] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\") returned="" [0074.215] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\HOW TO DECRYPT FILES.txt" [0074.215] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\how to decrypt files.txt")) returned 0x20 [0074.215] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", lpString2="SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf" [0074.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf", pszSpec="*.zip") returned 0 [0074.215] lstrlenA (lpString="*.zip") returned 5 [0074.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf", pszSpec="*.rar") returned 0 [0074.215] lstrlenA (lpString="*.rar") returned 5 [0074.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf", pszSpec="*.7z") returned 0 [0074.215] lstrlenA (lpString="*.7z") returned 4 [0074.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf", pszSpec="*.tar") returned 0 [0074.215] lstrlenA (lpString="*.tar") returned 5 [0074.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf", pszSpec="*.gzip") returned 0 [0074.215] lstrlenA (lpString="*.gzip") returned 6 [0074.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf", pszSpec="*.jpg") returned 0 [0074.215] lstrlenA (lpString="*.jpg") returned 5 [0074.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf", pszSpec="*.jpeg") returned 0 [0074.215] lstrlenA (lpString="*.jpeg") returned 6 [0074.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf", pszSpec="*.psd") returned 0 [0074.215] lstrlenA (lpString="*.psd") returned 5 [0074.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf", pszSpec="*.gif") returned 0 [0074.216] lstrlenA (lpString="*.gif") returned 5 [0074.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf", pszSpec="*.doc") returned 0 [0074.216] lstrlenA (lpString="*.doc") returned 5 [0074.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf", pszSpec="*.docx") returned 0 [0074.216] lstrlenA (lpString="*.docx") returned 6 [0074.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf", pszSpec="*.xls") returned 0 [0074.216] lstrlenA (lpString="*.xls") returned 5 [0074.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf", pszSpec="*.xlsx") returned 0 [0074.216] lstrlenA (lpString="*.xlsx") returned 6 [0074.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf", pszSpec="*.ppt") returned 0 [0074.216] lstrlenA (lpString="*.ppt") returned 5 [0074.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf", pszSpec="*.pptx") returned 0 [0074.216] lstrlenA (lpString="*.pptx") returned 6 [0074.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf", pszSpec="*.pdf") returned 1 [0074.216] lstrlenA (lpString="*.pdf") returned 5 [0074.216] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf" [0074.216] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf" [0074.216] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf." [0074.216] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf.wannacry" [0074.216] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.217] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9cbb [0074.217] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x7f82a560, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0074.217] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.217] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x9c3d, lpOverlapped=0x0) returned 1 [0074.220] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf") returned="SignHere.pdf" [0074.220] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.220] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x9c3d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x9c3d, lpOverlapped=0x0) returned 1 [0074.220] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.220] CloseHandle (hObject=0x9c) returned 1 [0074.220] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\signhere.pdf.wannacry")) returned 1 [0074.221] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x16f99, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0074.221] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.221] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StandardBusiness.pdf") returned -1 [0074.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StandardBusiness.pdf") returned -1 [0074.222] lstrcmpiA (lpString1="", lpString2="StandardBusiness.pdf") returned -1 [0074.222] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf") returned="SignHere.pdf" [0074.222] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\" [0074.222] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\") returned="" [0074.222] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\HOW TO DECRYPT FILES.txt" [0074.222] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\how to decrypt files.txt")) returned 0x20 [0074.222] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\", lpString2="StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf" [0074.222] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf", pszSpec="*.zip") returned 0 [0074.222] lstrlenA (lpString="*.zip") returned 5 [0074.222] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf", pszSpec="*.rar") returned 0 [0074.222] lstrlenA (lpString="*.rar") returned 5 [0074.222] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf", pszSpec="*.7z") returned 0 [0074.222] lstrlenA (lpString="*.7z") returned 4 [0074.222] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf", pszSpec="*.tar") returned 0 [0074.222] lstrlenA (lpString="*.tar") returned 5 [0074.222] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf", pszSpec="*.gzip") returned 0 [0074.222] lstrlenA (lpString="*.gzip") returned 6 [0074.222] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf", pszSpec="*.jpg") returned 0 [0074.222] lstrlenA (lpString="*.jpg") returned 5 [0074.222] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf", pszSpec="*.jpeg") returned 0 [0074.222] lstrlenA (lpString="*.jpeg") returned 6 [0074.222] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf", pszSpec="*.psd") returned 0 [0074.223] lstrlenA (lpString="*.psd") returned 5 [0074.223] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf", pszSpec="*.gif") returned 0 [0074.223] lstrlenA (lpString="*.gif") returned 5 [0074.223] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf", pszSpec="*.doc") returned 0 [0074.223] lstrlenA (lpString="*.doc") returned 5 [0074.223] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf", pszSpec="*.docx") returned 0 [0074.223] lstrlenA (lpString="*.docx") returned 6 [0074.223] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf", pszSpec="*.xls") returned 0 [0074.223] lstrlenA (lpString="*.xls") returned 5 [0074.223] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf", pszSpec="*.xlsx") returned 0 [0074.223] lstrlenA (lpString="*.xlsx") returned 6 [0074.223] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf", pszSpec="*.ppt") returned 0 [0074.223] lstrlenA (lpString="*.ppt") returned 5 [0074.223] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf", pszSpec="*.pptx") returned 0 [0074.223] lstrlenA (lpString="*.pptx") returned 6 [0074.223] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf", pszSpec="*.pdf") returned 1 [0074.223] lstrlenA (lpString="*.pdf") returned 5 [0074.223] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf" [0074.223] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf" [0074.223] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf." [0074.223] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf.wannacry" [0074.223] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.224] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16f99 [0074.224] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x7f804400, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0074.224] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.224] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x16f1b, lpOverlapped=0x0) returned 1 [0074.227] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf") returned="StandardBusiness.pdf" [0074.227] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.227] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x16f1b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x16f1b, lpOverlapped=0x0) returned 1 [0074.228] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.228] CloseHandle (hObject=0x9c) returned 1 [0074.228] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\standardbusiness.pdf.wannacry")) returned 1 [0074.229] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x16f99, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0074.229] FindClose (in: hFindFile=0x2e35b8 | out: hFindFile=0x2e35b8) returned 1 [0074.229] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73e8, dwReserved1=0x3, cFileName="SVE", cAlternateFileName="")) returned 1 [0074.229] lstrcmpA (lpString1=".", lpString2="SVE") returned -1 [0074.229] lstrcmpA (lpString1="..", lpString2="SVE") returned -1 [0074.229] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*.*") returned="*.*" [0074.229] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", lpString2="SVE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE" [0074.229] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE") returned 79 [0074.230] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0074.231] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.231] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0074.231] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.231] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.231] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe5af, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0074.231] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.231] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Dynamic.pdf") returned 1 [0074.231] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Dynamic.pdf") returned 1 [0074.231] lstrcmpiA (lpString1="", lpString2="Dynamic.pdf") returned -1 [0074.231] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\*.*") returned="*.*" [0074.231] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\" [0074.231] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\") returned="" [0074.231] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\HOW TO DECRYPT FILES.txt" [0074.231] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\how to decrypt files.txt")) returned 0xffffffff [0074.231] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.234] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0074.234] WriteFile (in: hFile=0x9c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0074.235] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.235] CloseHandle (hObject=0x9c) returned 1 [0074.235] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\", lpString2="Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf" [0074.236] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf", pszSpec="*.zip") returned 0 [0074.236] lstrlenA (lpString="*.zip") returned 5 [0074.236] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf", pszSpec="*.rar") returned 0 [0074.236] lstrlenA (lpString="*.rar") returned 5 [0074.236] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf", pszSpec="*.7z") returned 0 [0074.236] lstrlenA (lpString="*.7z") returned 4 [0074.236] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf", pszSpec="*.tar") returned 0 [0074.236] lstrlenA (lpString="*.tar") returned 5 [0074.236] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf", pszSpec="*.gzip") returned 0 [0074.236] lstrlenA (lpString="*.gzip") returned 6 [0074.236] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf", pszSpec="*.jpg") returned 0 [0074.236] lstrlenA (lpString="*.jpg") returned 5 [0074.236] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf", pszSpec="*.jpeg") returned 0 [0074.236] lstrlenA (lpString="*.jpeg") returned 6 [0074.236] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf", pszSpec="*.psd") returned 0 [0074.236] lstrlenA (lpString="*.psd") returned 5 [0074.236] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf", pszSpec="*.gif") returned 0 [0074.236] lstrlenA (lpString="*.gif") returned 5 [0074.236] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf", pszSpec="*.doc") returned 0 [0074.236] lstrlenA (lpString="*.doc") returned 5 [0074.236] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf", pszSpec="*.docx") returned 0 [0074.236] lstrlenA (lpString="*.docx") returned 6 [0074.236] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf", pszSpec="*.xls") returned 0 [0074.236] lstrlenA (lpString="*.xls") returned 5 [0074.237] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf", pszSpec="*.xlsx") returned 0 [0074.237] lstrlenA (lpString="*.xlsx") returned 6 [0074.237] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf", pszSpec="*.ppt") returned 0 [0074.237] lstrlenA (lpString="*.ppt") returned 5 [0074.237] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf", pszSpec="*.pptx") returned 0 [0074.237] lstrlenA (lpString="*.pptx") returned 6 [0074.237] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf", pszSpec="*.pdf") returned 1 [0074.237] lstrlenA (lpString="*.pdf") returned 5 [0074.237] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf" [0074.237] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf" [0074.237] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf." [0074.237] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf.wannacry" [0074.237] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.238] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe5af [0074.238] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x7ff024a0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0074.238] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.238] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xe531, lpOverlapped=0x0) returned 1 [0074.240] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf") returned="Dynamic.pdf" [0074.241] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.241] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xe531, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xe531, lpOverlapped=0x0) returned 1 [0074.241] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.241] CloseHandle (hObject=0x9c) returned 1 [0074.241] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\dynamic.pdf.wannacry")) returned 1 [0074.242] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa6a0, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0074.242] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.242] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SignHere.pdf") returned -1 [0074.243] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SignHere.pdf") returned -1 [0074.243] lstrcmpiA (lpString1="", lpString2="SignHere.pdf") returned -1 [0074.243] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf") returned="Dynamic.pdf" [0074.243] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\" [0074.243] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\") returned="" [0074.243] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\HOW TO DECRYPT FILES.txt" [0074.243] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\how to decrypt files.txt")) returned 0x20 [0074.243] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\", lpString2="SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf" [0074.243] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf", pszSpec="*.zip") returned 0 [0074.243] lstrlenA (lpString="*.zip") returned 5 [0074.243] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf", pszSpec="*.rar") returned 0 [0074.243] lstrlenA (lpString="*.rar") returned 5 [0074.243] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf", pszSpec="*.7z") returned 0 [0074.243] lstrlenA (lpString="*.7z") returned 4 [0074.243] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf", pszSpec="*.tar") returned 0 [0074.243] lstrlenA (lpString="*.tar") returned 5 [0074.243] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf", pszSpec="*.gzip") returned 0 [0074.243] lstrlenA (lpString="*.gzip") returned 6 [0074.243] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf", pszSpec="*.jpg") returned 0 [0074.243] lstrlenA (lpString="*.jpg") returned 5 [0074.243] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf", pszSpec="*.jpeg") returned 0 [0074.243] lstrlenA (lpString="*.jpeg") returned 6 [0074.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf", pszSpec="*.psd") returned 0 [0074.244] lstrlenA (lpString="*.psd") returned 5 [0074.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf", pszSpec="*.gif") returned 0 [0074.244] lstrlenA (lpString="*.gif") returned 5 [0074.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf", pszSpec="*.doc") returned 0 [0074.244] lstrlenA (lpString="*.doc") returned 5 [0074.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf", pszSpec="*.docx") returned 0 [0074.244] lstrlenA (lpString="*.docx") returned 6 [0074.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf", pszSpec="*.xls") returned 0 [0074.244] lstrlenA (lpString="*.xls") returned 5 [0074.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf", pszSpec="*.xlsx") returned 0 [0074.244] lstrlenA (lpString="*.xlsx") returned 6 [0074.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf", pszSpec="*.ppt") returned 0 [0074.244] lstrlenA (lpString="*.ppt") returned 5 [0074.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf", pszSpec="*.pptx") returned 0 [0074.244] lstrlenA (lpString="*.pptx") returned 6 [0074.244] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf", pszSpec="*.pdf") returned 1 [0074.244] lstrlenA (lpString="*.pdf") returned 5 [0074.244] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf" [0074.244] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf" [0074.244] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf." [0074.244] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf.wannacry" [0074.244] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.245] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa6a0 [0074.245] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x7ff024a0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0074.245] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.245] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xa622, lpOverlapped=0x0) returned 1 [0074.248] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf") returned="SignHere.pdf" [0074.248] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.248] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xa622, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xa622, lpOverlapped=0x0) returned 1 [0074.249] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.249] CloseHandle (hObject=0x9c) returned 1 [0074.249] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\signhere.pdf.wannacry")) returned 1 [0074.250] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18efb, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0074.250] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.250] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StandardBusiness.pdf") returned -1 [0074.250] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StandardBusiness.pdf") returned -1 [0074.250] lstrcmpiA (lpString1="", lpString2="StandardBusiness.pdf") returned -1 [0074.250] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf") returned="SignHere.pdf" [0074.250] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\" [0074.251] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\") returned="" [0074.251] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\HOW TO DECRYPT FILES.txt" [0074.251] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\how to decrypt files.txt")) returned 0x20 [0074.251] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\", lpString2="StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf" [0074.251] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf", pszSpec="*.zip") returned 0 [0074.251] lstrlenA (lpString="*.zip") returned 5 [0074.251] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf", pszSpec="*.rar") returned 0 [0074.251] lstrlenA (lpString="*.rar") returned 5 [0074.251] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf", pszSpec="*.7z") returned 0 [0074.251] lstrlenA (lpString="*.7z") returned 4 [0074.251] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf", pszSpec="*.tar") returned 0 [0074.251] lstrlenA (lpString="*.tar") returned 5 [0074.251] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf", pszSpec="*.gzip") returned 0 [0074.251] lstrlenA (lpString="*.gzip") returned 6 [0074.251] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf", pszSpec="*.jpg") returned 0 [0074.251] lstrlenA (lpString="*.jpg") returned 5 [0074.251] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf", pszSpec="*.jpeg") returned 0 [0074.251] lstrlenA (lpString="*.jpeg") returned 6 [0074.251] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf", pszSpec="*.psd") returned 0 [0074.251] lstrlenA (lpString="*.psd") returned 5 [0074.251] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf", pszSpec="*.gif") returned 0 [0074.251] lstrlenA (lpString="*.gif") returned 5 [0074.252] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf", pszSpec="*.doc") returned 0 [0074.252] lstrlenA (lpString="*.doc") returned 5 [0074.252] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf", pszSpec="*.docx") returned 0 [0074.252] lstrlenA (lpString="*.docx") returned 6 [0074.252] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf", pszSpec="*.xls") returned 0 [0074.252] lstrlenA (lpString="*.xls") returned 5 [0074.252] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf", pszSpec="*.xlsx") returned 0 [0074.252] lstrlenA (lpString="*.xlsx") returned 6 [0074.252] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf", pszSpec="*.ppt") returned 0 [0074.252] lstrlenA (lpString="*.ppt") returned 5 [0074.252] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf", pszSpec="*.pptx") returned 0 [0074.252] lstrlenA (lpString="*.pptx") returned 6 [0074.252] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf", pszSpec="*.pdf") returned 1 [0074.252] lstrlenA (lpString="*.pdf") returned 5 [0074.252] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf" [0074.252] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf" [0074.252] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf." [0074.252] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf.wannacry" [0074.252] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.253] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18efb [0074.253] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x7ff024a0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9640cd00, dwHighDateTime=0x1cb84b4)) returned 1 [0074.253] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.253] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x18e7d, lpOverlapped=0x0) returned 1 [0074.255] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf") returned="StandardBusiness.pdf" [0074.255] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.255] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x18e7d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x18e7d, lpOverlapped=0x0) returned 1 [0074.256] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.256] CloseHandle (hObject=0x9c) returned 1 [0074.256] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\standardbusiness.pdf.wannacry")) returned 1 [0074.257] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18efb, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0074.257] FindClose (in: hFindFile=0x2e35b8 | out: hFindFile=0x2e35b8) returned 1 [0074.257] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73e8, dwReserved1=0x3, cFileName="TUR", cAlternateFileName="")) returned 1 [0074.257] lstrcmpA (lpString1=".", lpString2="TUR") returned -1 [0074.257] lstrcmpA (lpString1="..", lpString2="TUR") returned -1 [0074.257] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*.*") returned="*.*" [0074.257] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", lpString2="TUR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR" [0074.257] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR") returned 79 [0074.257] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0074.262] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.262] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0074.262] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.262] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.262] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe27c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0074.262] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.262] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Dynamic.pdf") returned 1 [0074.262] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Dynamic.pdf") returned 1 [0074.262] lstrcmpiA (lpString1="", lpString2="Dynamic.pdf") returned -1 [0074.262] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\*.*") returned="*.*" [0074.262] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\" [0074.262] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\") returned="" [0074.262] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\HOW TO DECRYPT FILES.txt" [0074.262] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\how to decrypt files.txt")) returned 0xffffffff [0074.262] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.263] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0074.263] WriteFile (in: hFile=0x9c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0074.264] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.264] CloseHandle (hObject=0x9c) returned 1 [0074.264] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", lpString2="Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf" [0074.264] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf", pszSpec="*.zip") returned 0 [0074.264] lstrlenA (lpString="*.zip") returned 5 [0074.264] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf", pszSpec="*.rar") returned 0 [0074.264] lstrlenA (lpString="*.rar") returned 5 [0074.264] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf", pszSpec="*.7z") returned 0 [0074.264] lstrlenA (lpString="*.7z") returned 4 [0074.264] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf", pszSpec="*.tar") returned 0 [0074.264] lstrlenA (lpString="*.tar") returned 5 [0074.264] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf", pszSpec="*.gzip") returned 0 [0074.264] lstrlenA (lpString="*.gzip") returned 6 [0074.264] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf", pszSpec="*.jpg") returned 0 [0074.264] lstrlenA (lpString="*.jpg") returned 5 [0074.264] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf", pszSpec="*.jpeg") returned 0 [0074.264] lstrlenA (lpString="*.jpeg") returned 6 [0074.264] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf", pszSpec="*.psd") returned 0 [0074.264] lstrlenA (lpString="*.psd") returned 5 [0074.264] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf", pszSpec="*.gif") returned 0 [0074.264] lstrlenA (lpString="*.gif") returned 5 [0074.265] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf", pszSpec="*.doc") returned 0 [0074.265] lstrlenA (lpString="*.doc") returned 5 [0074.265] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf", pszSpec="*.docx") returned 0 [0074.265] lstrlenA (lpString="*.docx") returned 6 [0074.265] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf", pszSpec="*.xls") returned 0 [0074.265] lstrlenA (lpString="*.xls") returned 5 [0074.265] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf", pszSpec="*.xlsx") returned 0 [0074.265] lstrlenA (lpString="*.xlsx") returned 6 [0074.265] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf", pszSpec="*.ppt") returned 0 [0074.265] lstrlenA (lpString="*.ppt") returned 5 [0074.265] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf", pszSpec="*.pptx") returned 0 [0074.265] lstrlenA (lpString="*.pptx") returned 6 [0074.265] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf", pszSpec="*.pdf") returned 1 [0074.265] lstrlenA (lpString="*.pdf") returned 5 [0074.265] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf" [0074.265] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf" [0074.265] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf." [0074.265] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf.wannacry" [0074.265] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.266] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe27c [0074.266] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x8064c800, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0074.266] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.266] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xe1fe, lpOverlapped=0x0) returned 1 [0074.268] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf") returned="Dynamic.pdf" [0074.268] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.268] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xe1fe, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xe1fe, lpOverlapped=0x0) returned 1 [0074.269] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.269] CloseHandle (hObject=0x9c) returned 1 [0074.269] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\dynamic.pdf.wannacry")) returned 1 [0074.270] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0074.270] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.270] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Faces.pdf") returned -1 [0074.270] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Faces.pdf") returned 1 [0074.270] lstrcmpiA (lpString1="", lpString2="Faces.pdf") returned -1 [0074.270] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf") returned="Dynamic.pdf" [0074.270] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\" [0074.270] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\") returned="" [0074.270] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\HOW TO DECRYPT FILES.txt" [0074.270] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\how to decrypt files.txt")) returned 0x20 [0074.271] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", lpString2="Faces.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf" [0074.271] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf", pszSpec="*.zip") returned 0 [0074.271] lstrlenA (lpString="*.zip") returned 5 [0074.271] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf", pszSpec="*.rar") returned 0 [0074.271] lstrlenA (lpString="*.rar") returned 5 [0074.271] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf", pszSpec="*.7z") returned 0 [0074.271] lstrlenA (lpString="*.7z") returned 4 [0074.271] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf", pszSpec="*.tar") returned 0 [0074.271] lstrlenA (lpString="*.tar") returned 5 [0074.271] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf", pszSpec="*.gzip") returned 0 [0074.271] lstrlenA (lpString="*.gzip") returned 6 [0074.271] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf", pszSpec="*.jpg") returned 0 [0074.271] lstrlenA (lpString="*.jpg") returned 5 [0074.271] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf", pszSpec="*.jpeg") returned 0 [0074.271] lstrlenA (lpString="*.jpeg") returned 6 [0074.271] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf", pszSpec="*.psd") returned 0 [0074.271] lstrlenA (lpString="*.psd") returned 5 [0074.271] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf", pszSpec="*.gif") returned 0 [0074.271] lstrlenA (lpString="*.gif") returned 5 [0074.271] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf", pszSpec="*.doc") returned 0 [0074.271] lstrlenA (lpString="*.doc") returned 5 [0074.271] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf", pszSpec="*.docx") returned 0 [0074.271] lstrlenA (lpString="*.docx") returned 6 [0074.271] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf", pszSpec="*.xls") returned 0 [0074.271] lstrlenA (lpString="*.xls") returned 5 [0074.271] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf", pszSpec="*.xlsx") returned 0 [0074.271] lstrlenA (lpString="*.xlsx") returned 6 [0074.271] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf", pszSpec="*.ppt") returned 0 [0074.271] lstrlenA (lpString="*.ppt") returned 5 [0074.271] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf", pszSpec="*.pptx") returned 0 [0074.271] lstrlenA (lpString="*.pptx") returned 6 [0074.271] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf", pszSpec="*.pdf") returned 1 [0074.271] lstrlenA (lpString="*.pdf") returned 5 [0074.271] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf" [0074.272] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf" [0074.272] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf." [0074.272] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf.wannacry" [0074.272] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.272] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x80f5 [0074.272] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x8064c800, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0074.272] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.272] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x8077, lpOverlapped=0x0) returned 1 [0074.283] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf") returned="Faces.pdf" [0074.283] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.283] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x8077, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x8077, lpOverlapped=0x0) returned 1 [0074.283] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.283] CloseHandle (hObject=0x9c) returned 1 [0074.283] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\faces.pdf.wannacry")) returned 1 [0074.284] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb731, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0074.284] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.284] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Pointers.pdf") returned -1 [0074.284] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Pointers.pdf") returned -1 [0074.284] lstrcmpiA (lpString1="", lpString2="Pointers.pdf") returned -1 [0074.284] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf") returned="Faces.pdf" [0074.284] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\" [0074.285] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\") returned="" [0074.285] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\HOW TO DECRYPT FILES.txt" [0074.285] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\how to decrypt files.txt")) returned 0x20 [0074.285] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", lpString2="Pointers.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf" [0074.285] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf", pszSpec="*.zip") returned 0 [0074.285] lstrlenA (lpString="*.zip") returned 5 [0074.285] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf", pszSpec="*.rar") returned 0 [0074.285] lstrlenA (lpString="*.rar") returned 5 [0074.285] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf", pszSpec="*.7z") returned 0 [0074.285] lstrlenA (lpString="*.7z") returned 4 [0074.285] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf", pszSpec="*.tar") returned 0 [0074.285] lstrlenA (lpString="*.tar") returned 5 [0074.285] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf", pszSpec="*.gzip") returned 0 [0074.285] lstrlenA (lpString="*.gzip") returned 6 [0074.285] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf", pszSpec="*.jpg") returned 0 [0074.285] lstrlenA (lpString="*.jpg") returned 5 [0074.285] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf", pszSpec="*.jpeg") returned 0 [0074.285] lstrlenA (lpString="*.jpeg") returned 6 [0074.285] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf", pszSpec="*.psd") returned 0 [0074.285] lstrlenA (lpString="*.psd") returned 5 [0074.285] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf", pszSpec="*.gif") returned 0 [0074.285] lstrlenA (lpString="*.gif") returned 5 [0074.285] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf", pszSpec="*.doc") returned 0 [0074.285] lstrlenA (lpString="*.doc") returned 5 [0074.285] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf", pszSpec="*.docx") returned 0 [0074.285] lstrlenA (lpString="*.docx") returned 6 [0074.285] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf", pszSpec="*.xls") returned 0 [0074.285] lstrlenA (lpString="*.xls") returned 5 [0074.285] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf", pszSpec="*.xlsx") returned 0 [0074.285] lstrlenA (lpString="*.xlsx") returned 6 [0074.285] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf", pszSpec="*.ppt") returned 0 [0074.286] lstrlenA (lpString="*.ppt") returned 5 [0074.286] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf", pszSpec="*.pptx") returned 0 [0074.286] lstrlenA (lpString="*.pptx") returned 6 [0074.286] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf", pszSpec="*.pdf") returned 1 [0074.286] lstrlenA (lpString="*.pdf") returned 5 [0074.286] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf" [0074.286] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf" [0074.286] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf." [0074.286] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf.wannacry" [0074.286] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.286] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb731 [0074.287] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x806266a0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0074.287] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.287] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xb6b3, lpOverlapped=0x0) returned 1 [0074.289] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf") returned="Pointers.pdf" [0074.289] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.289] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xb6b3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xb6b3, lpOverlapped=0x0) returned 1 [0074.289] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.289] CloseHandle (hObject=0x9c) returned 1 [0074.289] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\pointers.pdf.wannacry")) returned 1 [0074.290] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x992b, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0074.290] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.290] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SignHere.pdf") returned -1 [0074.290] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SignHere.pdf") returned -1 [0074.290] lstrcmpiA (lpString1="", lpString2="SignHere.pdf") returned -1 [0074.290] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf") returned="Pointers.pdf" [0074.290] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\" [0074.290] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\") returned="" [0074.290] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\HOW TO DECRYPT FILES.txt" [0074.290] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\how to decrypt files.txt")) returned 0x20 [0074.290] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", lpString2="SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf" [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf", pszSpec="*.zip") returned 0 [0074.291] lstrlenA (lpString="*.zip") returned 5 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf", pszSpec="*.rar") returned 0 [0074.291] lstrlenA (lpString="*.rar") returned 5 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf", pszSpec="*.7z") returned 0 [0074.291] lstrlenA (lpString="*.7z") returned 4 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf", pszSpec="*.tar") returned 0 [0074.291] lstrlenA (lpString="*.tar") returned 5 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf", pszSpec="*.gzip") returned 0 [0074.291] lstrlenA (lpString="*.gzip") returned 6 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf", pszSpec="*.jpg") returned 0 [0074.291] lstrlenA (lpString="*.jpg") returned 5 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf", pszSpec="*.jpeg") returned 0 [0074.291] lstrlenA (lpString="*.jpeg") returned 6 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf", pszSpec="*.psd") returned 0 [0074.291] lstrlenA (lpString="*.psd") returned 5 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf", pszSpec="*.gif") returned 0 [0074.291] lstrlenA (lpString="*.gif") returned 5 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf", pszSpec="*.doc") returned 0 [0074.291] lstrlenA (lpString="*.doc") returned 5 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf", pszSpec="*.docx") returned 0 [0074.291] lstrlenA (lpString="*.docx") returned 6 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf", pszSpec="*.xls") returned 0 [0074.291] lstrlenA (lpString="*.xls") returned 5 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf", pszSpec="*.xlsx") returned 0 [0074.291] lstrlenA (lpString="*.xlsx") returned 6 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf", pszSpec="*.ppt") returned 0 [0074.291] lstrlenA (lpString="*.ppt") returned 5 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf", pszSpec="*.pptx") returned 0 [0074.291] lstrlenA (lpString="*.pptx") returned 6 [0074.291] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf", pszSpec="*.pdf") returned 1 [0074.291] lstrlenA (lpString="*.pdf") returned 5 [0074.291] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf" [0074.291] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf" [0074.291] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf." [0074.292] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf.wannacry" [0074.292] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.292] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x992b [0074.292] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x806266a0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0074.292] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.292] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x98ad, lpOverlapped=0x0) returned 1 [0074.295] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf") returned="SignHere.pdf" [0074.295] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.295] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x98ad, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x98ad, lpOverlapped=0x0) returned 1 [0074.295] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.295] CloseHandle (hObject=0x9c) returned 1 [0074.295] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\signhere.pdf.wannacry")) returned 1 [0074.297] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f5, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0074.297] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.297] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Standard.pdf") returned -1 [0074.297] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Standard.pdf") returned -1 [0074.297] lstrcmpiA (lpString1="", lpString2="Standard.pdf") returned -1 [0074.297] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf") returned="SignHere.pdf" [0074.297] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\" [0074.297] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\") returned="" [0074.297] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\HOW TO DECRYPT FILES.txt" [0074.297] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\how to decrypt files.txt")) returned 0x20 [0074.297] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", lpString2="Standard.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf" [0074.297] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf", pszSpec="*.zip") returned 0 [0074.297] lstrlenA (lpString="*.zip") returned 5 [0074.297] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf", pszSpec="*.rar") returned 0 [0074.297] lstrlenA (lpString="*.rar") returned 5 [0074.297] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf", pszSpec="*.7z") returned 0 [0074.297] lstrlenA (lpString="*.7z") returned 4 [0074.297] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf", pszSpec="*.tar") returned 0 [0074.298] lstrlenA (lpString="*.tar") returned 5 [0074.298] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf", pszSpec="*.gzip") returned 0 [0074.298] lstrlenA (lpString="*.gzip") returned 6 [0074.298] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf", pszSpec="*.jpg") returned 0 [0074.298] lstrlenA (lpString="*.jpg") returned 5 [0074.298] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf", pszSpec="*.jpeg") returned 0 [0074.298] lstrlenA (lpString="*.jpeg") returned 6 [0074.298] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf", pszSpec="*.psd") returned 0 [0074.298] lstrlenA (lpString="*.psd") returned 5 [0074.298] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf", pszSpec="*.gif") returned 0 [0074.298] lstrlenA (lpString="*.gif") returned 5 [0074.298] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf", pszSpec="*.doc") returned 0 [0074.298] lstrlenA (lpString="*.doc") returned 5 [0074.298] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf", pszSpec="*.docx") returned 0 [0074.298] lstrlenA (lpString="*.docx") returned 6 [0074.298] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf", pszSpec="*.xls") returned 0 [0074.298] lstrlenA (lpString="*.xls") returned 5 [0074.298] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf", pszSpec="*.xlsx") returned 0 [0074.298] lstrlenA (lpString="*.xlsx") returned 6 [0074.298] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf", pszSpec="*.ppt") returned 0 [0074.298] lstrlenA (lpString="*.ppt") returned 5 [0074.298] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf", pszSpec="*.pptx") returned 0 [0074.298] lstrlenA (lpString="*.pptx") returned 6 [0074.298] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf", pszSpec="*.pdf") returned 1 [0074.298] lstrlenA (lpString="*.pdf") returned 5 [0074.298] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf" [0074.298] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf" [0074.299] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf." [0074.299] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf.wannacry" [0074.299] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.299] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c4f5 [0074.299] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x8064c800, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0074.300] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.300] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1c477, lpOverlapped=0x0) returned 1 [0074.302] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf") returned="Standard.pdf" [0074.302] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.302] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1c477, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1c477, lpOverlapped=0x0) returned 1 [0074.303] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.303] CloseHandle (hObject=0x9c) returned 1 [0074.303] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standard.pdf.wannacry")) returned 1 [0074.304] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1804a, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0074.304] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.304] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StandardBusiness.pdf") returned -1 [0074.304] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StandardBusiness.pdf") returned -1 [0074.304] lstrcmpiA (lpString1="", lpString2="StandardBusiness.pdf") returned -1 [0074.304] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf") returned="Standard.pdf" [0074.304] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\" [0074.304] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\") returned="" [0074.304] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\HOW TO DECRYPT FILES.txt" [0074.304] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\how to decrypt files.txt")) returned 0x20 [0074.305] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\", lpString2="StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf" [0074.305] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf", pszSpec="*.zip") returned 0 [0074.305] lstrlenA (lpString="*.zip") returned 5 [0074.305] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf", pszSpec="*.rar") returned 0 [0074.305] lstrlenA (lpString="*.rar") returned 5 [0074.305] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf", pszSpec="*.7z") returned 0 [0074.305] lstrlenA (lpString="*.7z") returned 4 [0074.305] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf", pszSpec="*.tar") returned 0 [0074.305] lstrlenA (lpString="*.tar") returned 5 [0074.305] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf", pszSpec="*.gzip") returned 0 [0074.305] lstrlenA (lpString="*.gzip") returned 6 [0074.305] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf", pszSpec="*.jpg") returned 0 [0074.305] lstrlenA (lpString="*.jpg") returned 5 [0074.305] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf", pszSpec="*.jpeg") returned 0 [0074.305] lstrlenA (lpString="*.jpeg") returned 6 [0074.305] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf", pszSpec="*.psd") returned 0 [0074.305] lstrlenA (lpString="*.psd") returned 5 [0074.305] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf", pszSpec="*.gif") returned 0 [0074.305] lstrlenA (lpString="*.gif") returned 5 [0074.305] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf", pszSpec="*.doc") returned 0 [0074.305] lstrlenA (lpString="*.doc") returned 5 [0074.305] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf", pszSpec="*.docx") returned 0 [0074.305] lstrlenA (lpString="*.docx") returned 6 [0074.305] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf", pszSpec="*.xls") returned 0 [0074.305] lstrlenA (lpString="*.xls") returned 5 [0074.305] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf", pszSpec="*.xlsx") returned 0 [0074.306] lstrlenA (lpString="*.xlsx") returned 6 [0074.306] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf", pszSpec="*.ppt") returned 0 [0074.306] lstrlenA (lpString="*.ppt") returned 5 [0074.306] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf", pszSpec="*.pptx") returned 0 [0074.306] lstrlenA (lpString="*.pptx") returned 6 [0074.306] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf", pszSpec="*.pdf") returned 1 [0074.306] lstrlenA (lpString="*.pdf") returned 5 [0074.306] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf" [0074.306] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf" [0074.306] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf." [0074.306] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf.wannacry" [0074.306] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.307] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1804a [0074.307] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x806266a0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b058100, dwHighDateTime=0x1cb84b4)) returned 1 [0074.307] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.307] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x17fcc, lpOverlapped=0x0) returned 1 [0074.309] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf") returned="StandardBusiness.pdf" [0074.309] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.309] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x17fcc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x17fcc, lpOverlapped=0x0) returned 1 [0074.309] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.309] CloseHandle (hObject=0x9c) returned 1 [0074.310] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standardbusiness.pdf.wannacry")) returned 1 [0074.310] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1804a, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0074.310] FindClose (in: hFindFile=0x2e35b8 | out: hFindFile=0x2e35b8) returned 1 [0074.310] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73e8, dwReserved1=0x3, cFileName="UKR", cAlternateFileName="")) returned 1 [0074.310] lstrcmpA (lpString1=".", lpString2="UKR") returned -1 [0074.310] lstrcmpA (lpString1="..", lpString2="UKR") returned -1 [0074.310] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*.*") returned="*.*" [0074.311] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", lpString2="UKR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR" [0074.311] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR") returned 79 [0074.311] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0074.312] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.312] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0074.312] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.312] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.312] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18b15, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0074.312] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.312] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Dynamic.pdf") returned 1 [0074.312] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Dynamic.pdf") returned 1 [0074.312] lstrcmpiA (lpString1="", lpString2="Dynamic.pdf") returned -1 [0074.312] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\*.*") returned="*.*" [0074.312] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\" [0074.312] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\") returned="" [0074.312] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\HOW TO DECRYPT FILES.txt" [0074.312] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\how to decrypt files.txt")) returned 0xffffffff [0074.313] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.313] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0074.313] WriteFile (in: hFile=0x9c, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0074.314] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.314] CloseHandle (hObject=0x9c) returned 1 [0074.314] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", lpString2="Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf" [0074.314] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf", pszSpec="*.zip") returned 0 [0074.315] lstrlenA (lpString="*.zip") returned 5 [0074.315] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf", pszSpec="*.rar") returned 0 [0074.315] lstrlenA (lpString="*.rar") returned 5 [0074.315] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf", pszSpec="*.7z") returned 0 [0074.315] lstrlenA (lpString="*.7z") returned 4 [0074.315] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf", pszSpec="*.tar") returned 0 [0074.315] lstrlenA (lpString="*.tar") returned 5 [0074.315] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf", pszSpec="*.gzip") returned 0 [0074.315] lstrlenA (lpString="*.gzip") returned 6 [0074.315] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf", pszSpec="*.jpg") returned 0 [0074.315] lstrlenA (lpString="*.jpg") returned 5 [0074.315] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf", pszSpec="*.jpeg") returned 0 [0074.315] lstrlenA (lpString="*.jpeg") returned 6 [0074.315] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf", pszSpec="*.psd") returned 0 [0074.315] lstrlenA (lpString="*.psd") returned 5 [0074.315] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf", pszSpec="*.gif") returned 0 [0074.315] lstrlenA (lpString="*.gif") returned 5 [0074.315] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf", pszSpec="*.doc") returned 0 [0074.315] lstrlenA (lpString="*.doc") returned 5 [0074.315] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf", pszSpec="*.docx") returned 0 [0074.315] lstrlenA (lpString="*.docx") returned 6 [0074.315] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf", pszSpec="*.xls") returned 0 [0074.315] lstrlenA (lpString="*.xls") returned 5 [0074.315] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf", pszSpec="*.xlsx") returned 0 [0074.315] lstrlenA (lpString="*.xlsx") returned 6 [0074.315] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf", pszSpec="*.ppt") returned 0 [0074.315] lstrlenA (lpString="*.ppt") returned 5 [0074.315] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf", pszSpec="*.pptx") returned 0 [0074.315] lstrlenA (lpString="*.pptx") returned 6 [0074.315] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf", pszSpec="*.pdf") returned 1 [0074.316] lstrlenA (lpString="*.pdf") returned 5 [0074.316] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf" [0074.316] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf" [0074.316] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf." [0074.316] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf.wannacry" [0074.316] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\dynamic.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.317] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18b15 [0074.317] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x806266a0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4)) returned 1 [0074.317] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.317] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x18a97, lpOverlapped=0x0) returned 1 [0074.319] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf") returned="Dynamic.pdf" [0074.320] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.320] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x18a97, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x18a97, lpOverlapped=0x0) returned 1 [0074.320] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.320] CloseHandle (hObject=0x9c) returned 1 [0074.320] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\dynamic.pdf.wannacry")) returned 1 [0074.321] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0074.321] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.321] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Faces.pdf") returned -1 [0074.321] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Faces.pdf") returned 1 [0074.321] lstrcmpiA (lpString1="", lpString2="Faces.pdf") returned -1 [0074.321] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf") returned="Dynamic.pdf" [0074.321] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\" [0074.321] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\") returned="" [0074.321] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\HOW TO DECRYPT FILES.txt" [0074.321] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\how to decrypt files.txt")) returned 0x20 [0074.321] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", lpString2="Faces.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf" [0074.321] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf", pszSpec="*.zip") returned 0 [0074.321] lstrlenA (lpString="*.zip") returned 5 [0074.321] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf", pszSpec="*.rar") returned 0 [0074.321] lstrlenA (lpString="*.rar") returned 5 [0074.321] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf", pszSpec="*.7z") returned 0 [0074.321] lstrlenA (lpString="*.7z") returned 4 [0074.321] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf", pszSpec="*.tar") returned 0 [0074.321] lstrlenA (lpString="*.tar") returned 5 [0074.322] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf", pszSpec="*.gzip") returned 0 [0074.322] lstrlenA (lpString="*.gzip") returned 6 [0074.322] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf", pszSpec="*.jpg") returned 0 [0074.322] lstrlenA (lpString="*.jpg") returned 5 [0074.322] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf", pszSpec="*.jpeg") returned 0 [0074.322] lstrlenA (lpString="*.jpeg") returned 6 [0074.322] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf", pszSpec="*.psd") returned 0 [0074.322] lstrlenA (lpString="*.psd") returned 5 [0074.322] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf", pszSpec="*.gif") returned 0 [0074.322] lstrlenA (lpString="*.gif") returned 5 [0074.322] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf", pszSpec="*.doc") returned 0 [0074.322] lstrlenA (lpString="*.doc") returned 5 [0074.322] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf", pszSpec="*.docx") returned 0 [0074.322] lstrlenA (lpString="*.docx") returned 6 [0074.322] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf", pszSpec="*.xls") returned 0 [0074.322] lstrlenA (lpString="*.xls") returned 5 [0074.322] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf", pszSpec="*.xlsx") returned 0 [0074.322] lstrlenA (lpString="*.xlsx") returned 6 [0074.322] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf", pszSpec="*.ppt") returned 0 [0074.322] lstrlenA (lpString="*.ppt") returned 5 [0074.322] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf", pszSpec="*.pptx") returned 0 [0074.322] lstrlenA (lpString="*.pptx") returned 6 [0074.322] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf", pszSpec="*.pdf") returned 1 [0074.322] lstrlenA (lpString="*.pdf") returned 5 [0074.322] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf" [0074.322] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf" [0074.322] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf." [0074.322] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf.wannacry" [0074.322] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\faces.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.323] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x80f5 [0074.323] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x806266a0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4)) returned 1 [0074.323] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.323] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x8077, lpOverlapped=0x0) returned 1 [0074.326] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf") returned="Faces.pdf" [0074.326] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.326] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x8077, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x8077, lpOverlapped=0x0) returned 1 [0074.327] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.327] CloseHandle (hObject=0x9c) returned 1 [0074.327] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\faces.pdf.wannacry")) returned 1 [0074.327] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb731, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0074.328] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.328] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Pointers.pdf") returned -1 [0074.328] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Pointers.pdf") returned -1 [0074.328] lstrcmpiA (lpString1="", lpString2="Pointers.pdf") returned -1 [0074.328] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf") returned="Faces.pdf" [0074.328] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\" [0074.328] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\") returned="" [0074.328] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\HOW TO DECRYPT FILES.txt" [0074.328] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\how to decrypt files.txt")) returned 0x20 [0074.328] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", lpString2="Pointers.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf" [0074.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf", pszSpec="*.zip") returned 0 [0074.328] lstrlenA (lpString="*.zip") returned 5 [0074.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf", pszSpec="*.rar") returned 0 [0074.328] lstrlenA (lpString="*.rar") returned 5 [0074.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf", pszSpec="*.7z") returned 0 [0074.328] lstrlenA (lpString="*.7z") returned 4 [0074.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf", pszSpec="*.tar") returned 0 [0074.328] lstrlenA (lpString="*.tar") returned 5 [0074.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf", pszSpec="*.gzip") returned 0 [0074.328] lstrlenA (lpString="*.gzip") returned 6 [0074.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf", pszSpec="*.jpg") returned 0 [0074.328] lstrlenA (lpString="*.jpg") returned 5 [0074.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf", pszSpec="*.jpeg") returned 0 [0074.328] lstrlenA (lpString="*.jpeg") returned 6 [0074.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf", pszSpec="*.psd") returned 0 [0074.328] lstrlenA (lpString="*.psd") returned 5 [0074.328] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf", pszSpec="*.gif") returned 0 [0074.329] lstrlenA (lpString="*.gif") returned 5 [0074.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf", pszSpec="*.doc") returned 0 [0074.329] lstrlenA (lpString="*.doc") returned 5 [0074.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf", pszSpec="*.docx") returned 0 [0074.329] lstrlenA (lpString="*.docx") returned 6 [0074.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf", pszSpec="*.xls") returned 0 [0074.329] lstrlenA (lpString="*.xls") returned 5 [0074.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf", pszSpec="*.xlsx") returned 0 [0074.329] lstrlenA (lpString="*.xlsx") returned 6 [0074.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf", pszSpec="*.ppt") returned 0 [0074.329] lstrlenA (lpString="*.ppt") returned 5 [0074.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf", pszSpec="*.pptx") returned 0 [0074.329] lstrlenA (lpString="*.pptx") returned 6 [0074.329] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf", pszSpec="*.pdf") returned 1 [0074.329] lstrlenA (lpString="*.pdf") returned 5 [0074.329] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf" [0074.329] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf" [0074.329] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf." [0074.329] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf.wannacry" [0074.329] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\pointers.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.330] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb731 [0074.330] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x806266a0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4)) returned 1 [0074.330] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.330] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xb6b3, lpOverlapped=0x0) returned 1 [0074.343] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf") returned="Pointers.pdf" [0074.343] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.343] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xb6b3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xb6b3, lpOverlapped=0x0) returned 1 [0074.344] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.344] CloseHandle (hObject=0x9c) returned 1 [0074.344] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\pointers.pdf.wannacry")) returned 1 [0074.348] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb189, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0074.348] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.348] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SignHere.pdf") returned -1 [0074.348] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SignHere.pdf") returned -1 [0074.348] lstrcmpiA (lpString1="", lpString2="SignHere.pdf") returned -1 [0074.348] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf") returned="Pointers.pdf" [0074.348] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\" [0074.348] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\") returned="" [0074.348] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\HOW TO DECRYPT FILES.txt" [0074.349] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\how to decrypt files.txt")) returned 0x20 [0074.349] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", lpString2="SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf" [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf", pszSpec="*.zip") returned 0 [0074.349] lstrlenA (lpString="*.zip") returned 5 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf", pszSpec="*.rar") returned 0 [0074.349] lstrlenA (lpString="*.rar") returned 5 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf", pszSpec="*.7z") returned 0 [0074.349] lstrlenA (lpString="*.7z") returned 4 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf", pszSpec="*.tar") returned 0 [0074.349] lstrlenA (lpString="*.tar") returned 5 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf", pszSpec="*.gzip") returned 0 [0074.349] lstrlenA (lpString="*.gzip") returned 6 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf", pszSpec="*.jpg") returned 0 [0074.349] lstrlenA (lpString="*.jpg") returned 5 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf", pszSpec="*.jpeg") returned 0 [0074.349] lstrlenA (lpString="*.jpeg") returned 6 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf", pszSpec="*.psd") returned 0 [0074.349] lstrlenA (lpString="*.psd") returned 5 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf", pszSpec="*.gif") returned 0 [0074.349] lstrlenA (lpString="*.gif") returned 5 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf", pszSpec="*.doc") returned 0 [0074.349] lstrlenA (lpString="*.doc") returned 5 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf", pszSpec="*.docx") returned 0 [0074.349] lstrlenA (lpString="*.docx") returned 6 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf", pszSpec="*.xls") returned 0 [0074.349] lstrlenA (lpString="*.xls") returned 5 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf", pszSpec="*.xlsx") returned 0 [0074.349] lstrlenA (lpString="*.xlsx") returned 6 [0074.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf", pszSpec="*.ppt") returned 0 [0074.350] lstrlenA (lpString="*.ppt") returned 5 [0074.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf", pszSpec="*.pptx") returned 0 [0074.350] lstrlenA (lpString="*.pptx") returned 6 [0074.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf", pszSpec="*.pdf") returned 1 [0074.350] lstrlenA (lpString="*.pdf") returned 5 [0074.350] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf" [0074.350] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf" [0074.350] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf." [0074.350] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf.wannacry" [0074.350] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\signhere.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.351] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb189 [0074.351] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x806266a0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4)) returned 1 [0074.351] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.351] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xb10b, lpOverlapped=0x0) returned 1 [0074.354] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf") returned="SignHere.pdf" [0074.354] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.354] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xb10b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xb10b, lpOverlapped=0x0) returned 1 [0074.354] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.354] CloseHandle (hObject=0x9c) returned 1 [0074.354] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\signhere.pdf.wannacry")) returned 1 [0074.355] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f5, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0074.355] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.356] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Standard.pdf") returned -1 [0074.356] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Standard.pdf") returned -1 [0074.356] lstrcmpiA (lpString1="", lpString2="Standard.pdf") returned -1 [0074.356] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf") returned="SignHere.pdf" [0074.356] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\" [0074.356] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\") returned="" [0074.356] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\HOW TO DECRYPT FILES.txt" [0074.356] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\how to decrypt files.txt")) returned 0x20 [0074.356] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", lpString2="Standard.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf" [0074.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf", pszSpec="*.zip") returned 0 [0074.356] lstrlenA (lpString="*.zip") returned 5 [0074.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf", pszSpec="*.rar") returned 0 [0074.356] lstrlenA (lpString="*.rar") returned 5 [0074.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf", pszSpec="*.7z") returned 0 [0074.356] lstrlenA (lpString="*.7z") returned 4 [0074.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf", pszSpec="*.tar") returned 0 [0074.356] lstrlenA (lpString="*.tar") returned 5 [0074.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf", pszSpec="*.gzip") returned 0 [0074.356] lstrlenA (lpString="*.gzip") returned 6 [0074.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf", pszSpec="*.jpg") returned 0 [0074.356] lstrlenA (lpString="*.jpg") returned 5 [0074.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf", pszSpec="*.jpeg") returned 0 [0074.356] lstrlenA (lpString="*.jpeg") returned 6 [0074.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf", pszSpec="*.psd") returned 0 [0074.356] lstrlenA (lpString="*.psd") returned 5 [0074.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf", pszSpec="*.gif") returned 0 [0074.356] lstrlenA (lpString="*.gif") returned 5 [0074.356] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf", pszSpec="*.doc") returned 0 [0074.357] lstrlenA (lpString="*.doc") returned 5 [0074.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf", pszSpec="*.docx") returned 0 [0074.357] lstrlenA (lpString="*.docx") returned 6 [0074.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf", pszSpec="*.xls") returned 0 [0074.357] lstrlenA (lpString="*.xls") returned 5 [0074.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf", pszSpec="*.xlsx") returned 0 [0074.357] lstrlenA (lpString="*.xlsx") returned 6 [0074.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf", pszSpec="*.ppt") returned 0 [0074.357] lstrlenA (lpString="*.ppt") returned 5 [0074.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf", pszSpec="*.pptx") returned 0 [0074.357] lstrlenA (lpString="*.pptx") returned 6 [0074.357] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf", pszSpec="*.pdf") returned 1 [0074.357] lstrlenA (lpString="*.pdf") returned 5 [0074.357] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf" [0074.357] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf" [0074.357] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf." [0074.357] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf.wannacry" [0074.357] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standard.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.358] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c4f5 [0074.358] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x806266a0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4)) returned 1 [0074.358] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.358] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1c477, lpOverlapped=0x0) returned 1 [0074.361] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf") returned="Standard.pdf" [0074.361] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.361] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1c477, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1c477, lpOverlapped=0x0) returned 1 [0074.362] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.362] CloseHandle (hObject=0x9c) returned 1 [0074.362] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standard.pdf.wannacry")) returned 1 [0074.363] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x58891, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0074.363] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0074.363] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="StandardBusiness.pdf") returned -1 [0074.363] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StandardBusiness.pdf") returned -1 [0074.363] lstrcmpiA (lpString1="", lpString2="StandardBusiness.pdf") returned -1 [0074.363] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf") returned="Standard.pdf" [0074.363] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\" [0074.363] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\") returned="" [0074.364] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\HOW TO DECRYPT FILES.txt" [0074.364] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\how to decrypt files.txt")) returned 0x20 [0074.364] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\", lpString2="StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf" [0074.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf", pszSpec="*.zip") returned 0 [0074.364] lstrlenA (lpString="*.zip") returned 5 [0074.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf", pszSpec="*.rar") returned 0 [0074.364] lstrlenA (lpString="*.rar") returned 5 [0074.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf", pszSpec="*.7z") returned 0 [0074.364] lstrlenA (lpString="*.7z") returned 4 [0074.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf", pszSpec="*.tar") returned 0 [0074.364] lstrlenA (lpString="*.tar") returned 5 [0074.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf", pszSpec="*.gzip") returned 0 [0074.364] lstrlenA (lpString="*.gzip") returned 6 [0074.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf", pszSpec="*.jpg") returned 0 [0074.364] lstrlenA (lpString="*.jpg") returned 5 [0074.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf", pszSpec="*.jpeg") returned 0 [0074.364] lstrlenA (lpString="*.jpeg") returned 6 [0074.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf", pszSpec="*.psd") returned 0 [0074.364] lstrlenA (lpString="*.psd") returned 5 [0074.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf", pszSpec="*.gif") returned 0 [0074.364] lstrlenA (lpString="*.gif") returned 5 [0074.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf", pszSpec="*.doc") returned 0 [0074.364] lstrlenA (lpString="*.doc") returned 5 [0074.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf", pszSpec="*.docx") returned 0 [0074.364] lstrlenA (lpString="*.docx") returned 6 [0074.364] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf", pszSpec="*.xls") returned 0 [0074.365] lstrlenA (lpString="*.xls") returned 5 [0074.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf", pszSpec="*.xlsx") returned 0 [0074.365] lstrlenA (lpString="*.xlsx") returned 6 [0074.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf", pszSpec="*.ppt") returned 0 [0074.365] lstrlenA (lpString="*.ppt") returned 5 [0074.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf", pszSpec="*.pptx") returned 0 [0074.365] lstrlenA (lpString="*.pptx") returned 6 [0074.365] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf", pszSpec="*.pdf") returned 1 [0074.365] lstrlenA (lpString="*.pdf") returned 5 [0074.365] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf" [0074.365] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf" [0074.365] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf." [0074.365] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf.wannacry" [0074.365] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standardbusiness.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0074.365] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x58891 [0074.366] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x806266a0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9c36ae00, dwHighDateTime=0x1cb84b4)) returned 1 [0074.366] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.366] ReadFile (in: hFile=0x9c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x58813, lpOverlapped=0x0) returned 1 [0074.370] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf") returned="StandardBusiness.pdf" [0074.370] SetFilePointer (in: hFile=0x9c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.371] WriteFile (in: hFile=0x9c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x58813, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x58813, lpOverlapped=0x0) returned 1 [0074.372] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.372] CloseHandle (hObject=0x9c) returned 1 [0074.372] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standardbusiness.pdf.wannacry")) returned 1 [0074.373] FindNextFileA (in: hFindFile=0x2e35b8, lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x58891, dwReserved0=0x2000002, dwReserved1=0x2d8ef0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0074.373] FindClose (in: hFindFile=0x2e35b8 | out: hFindFile=0x2e35b8) returned 1 [0074.373] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe69f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b772, dwReserved0=0x2e73e8, dwReserved1=0x3, cFileName="Words.pdf", cAlternateFileName="")) returned 1 [0074.373] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.373] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Words.pdf") returned -1 [0074.373] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Words.pdf") returned -1 [0074.373] lstrcmpiA (lpString1="", lpString2="Words.pdf") returned -1 [0074.373] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*.*") returned="*.*" [0074.373] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0074.373] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="" [0074.373] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HOW TO DECRYPT FILES.txt" [0074.374] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\how to decrypt files.txt")) returned 0xffffffff [0074.374] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0074.374] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0074.374] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0074.375] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.375] CloseHandle (hObject=0x98) returned 1 [0074.375] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\", lpString2="Words.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf" [0074.375] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf", pszSpec="*.zip") returned 0 [0074.375] lstrlenA (lpString="*.zip") returned 5 [0074.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf", pszSpec="*.rar") returned 0 [0074.376] lstrlenA (lpString="*.rar") returned 5 [0074.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf", pszSpec="*.7z") returned 0 [0074.376] lstrlenA (lpString="*.7z") returned 4 [0074.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf", pszSpec="*.tar") returned 0 [0074.376] lstrlenA (lpString="*.tar") returned 5 [0074.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf", pszSpec="*.gzip") returned 0 [0074.376] lstrlenA (lpString="*.gzip") returned 6 [0074.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf", pszSpec="*.jpg") returned 0 [0074.376] lstrlenA (lpString="*.jpg") returned 5 [0074.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf", pszSpec="*.jpeg") returned 0 [0074.376] lstrlenA (lpString="*.jpeg") returned 6 [0074.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf", pszSpec="*.psd") returned 0 [0074.376] lstrlenA (lpString="*.psd") returned 5 [0074.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf", pszSpec="*.gif") returned 0 [0074.376] lstrlenA (lpString="*.gif") returned 5 [0074.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf", pszSpec="*.doc") returned 0 [0074.376] lstrlenA (lpString="*.doc") returned 5 [0074.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf", pszSpec="*.docx") returned 0 [0074.376] lstrlenA (lpString="*.docx") returned 6 [0074.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf", pszSpec="*.xls") returned 0 [0074.376] lstrlenA (lpString="*.xls") returned 5 [0074.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf", pszSpec="*.xlsx") returned 0 [0074.376] lstrlenA (lpString="*.xlsx") returned 6 [0074.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf", pszSpec="*.ppt") returned 0 [0074.376] lstrlenA (lpString="*.ppt") returned 5 [0074.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf", pszSpec="*.pptx") returned 0 [0074.376] lstrlenA (lpString="*.pptx") returned 6 [0074.376] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf", pszSpec="*.pdf") returned 1 [0074.376] lstrlenA (lpString="*.pdf") returned 5 [0074.376] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf" [0074.377] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf" [0074.377] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf." [0074.377] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf.wannacry" [0074.377] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\words.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0074.377] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b772 [0074.377] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x7fe69f20, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4)) returned 1 [0074.378] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.378] ReadFile (in: hFile=0x98, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1b6f4, lpOverlapped=0x0) returned 1 [0074.380] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf") returned="Words.pdf" [0074.380] SetFilePointer (in: hFile=0x98, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.380] WriteFile (in: hFile=0x98, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1b6f4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1b6f4, lpOverlapped=0x0) returned 1 [0074.381] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.381] CloseHandle (hObject=0x98) returned 1 [0074.381] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\words.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\words.pdf.wannacry")) returned 1 [0074.382] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe69f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b772, dwReserved0=0x2e73e8, dwReserved1=0x3, cFileName="Words.pdf", cAlternateFileName="")) returned 0 [0074.382] FindClose (in: hFindFile=0x2e3578 | out: hFindFile=0x2e3578) returned 1 [0074.382] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Stamps", cAlternateFileName="")) returned 0 [0074.382] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0074.382] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5dbe63, dwReserved0=0x6e0041, dwReserved1=0x3, cFileName="Annots.api", cAlternateFileName="")) returned 1 [0074.382] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.382] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Annots.api") returned 1 [0074.382] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Annots.api") returned 1 [0074.382] lstrcmpiA (lpString1="", lpString2="Annots.api") returned -1 [0074.382] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\*.*") returned="*.*" [0074.382] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0074.382] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="" [0074.382] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt" [0074.382] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\how to decrypt files.txt")) returned 0x20 [0074.382] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\", lpString2="Annots.api" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api" [0074.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.zip") returned 0 [0074.382] lstrlenA (lpString="*.zip") returned 5 [0074.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.rar") returned 0 [0074.382] lstrlenA (lpString="*.rar") returned 5 [0074.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.7z") returned 0 [0074.382] lstrlenA (lpString="*.7z") returned 4 [0074.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.tar") returned 0 [0074.382] lstrlenA (lpString="*.tar") returned 5 [0074.382] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.gzip") returned 0 [0074.383] lstrlenA (lpString="*.gzip") returned 6 [0074.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.jpg") returned 0 [0074.383] lstrlenA (lpString="*.jpg") returned 5 [0074.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.jpeg") returned 0 [0074.383] lstrlenA (lpString="*.jpeg") returned 6 [0074.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.psd") returned 0 [0074.383] lstrlenA (lpString="*.psd") returned 5 [0074.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.gif") returned 0 [0074.383] lstrlenA (lpString="*.gif") returned 5 [0074.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.doc") returned 0 [0074.383] lstrlenA (lpString="*.doc") returned 5 [0074.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.docx") returned 0 [0074.383] lstrlenA (lpString="*.docx") returned 6 [0074.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.xls") returned 0 [0074.383] lstrlenA (lpString="*.xls") returned 5 [0074.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.xlsx") returned 0 [0074.383] lstrlenA (lpString="*.xlsx") returned 6 [0074.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.ppt") returned 0 [0074.383] lstrlenA (lpString="*.ppt") returned 5 [0074.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.pptx") returned 0 [0074.383] lstrlenA (lpString="*.pptx") returned 6 [0074.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.pdf") returned 0 [0074.383] lstrlenA (lpString="*.pdf") returned 5 [0074.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.mov") returned 0 [0074.383] lstrlenA (lpString="*.mov") returned 5 [0074.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.m2v") returned 0 [0074.383] lstrlenA (lpString="*.m2v") returned 5 [0074.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.3gp") returned 0 [0074.383] lstrlenA (lpString="*.3gp") returned 5 [0074.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.mpeg") returned 0 [0074.383] lstrlenA (lpString="*.mpeg") returned 6 [0074.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.mpg") returned 0 [0074.383] lstrlenA (lpString="*.mpg") returned 5 [0074.383] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.flv") returned 0 [0074.384] lstrlenA (lpString="*.flv") returned 5 [0074.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.avi") returned 0 [0074.384] lstrlenA (lpString="*.avi") returned 5 [0074.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.mp4") returned 0 [0074.384] lstrlenA (lpString="*.mp4") returned 5 [0074.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.wmv") returned 0 [0074.384] lstrlenA (lpString="*.wmv") returned 5 [0074.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.divx") returned 0 [0074.384] lstrlenA (lpString="*.divx") returned 6 [0074.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.mkv") returned 0 [0074.384] lstrlenA (lpString="*.mkv") returned 5 [0074.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.mp3") returned 0 [0074.384] lstrlenA (lpString="*.mp3") returned 5 [0074.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.wav") returned 0 [0074.384] lstrlenA (lpString="*.wav") returned 5 [0074.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.flac") returned 0 [0074.384] lstrlenA (lpString="*.flac") returned 6 [0074.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.ape") returned 0 [0074.384] lstrlenA (lpString="*.ape") returned 5 [0074.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.wma") returned 0 [0074.384] lstrlenA (lpString="*.wma") returned 5 [0074.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.ac3") returned 0 [0074.384] lstrlenA (lpString="*.ac3") returned 5 [0074.384] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", pszSpec="*.mxf") returned 0 [0074.384] lstrlenA (lpString="*.mxf") returned 5 [0074.384] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd2463, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.api", cAlternateFileName="")) returned 1 [0074.384] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.384] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Checkers.api") returned 1 [0074.384] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Checkers.api") returned 1 [0074.384] lstrcmpiA (lpString1="", lpString2="Checkers.api") returned -1 [0074.384] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api") returned="Annots.api" [0074.384] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0074.384] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="" [0074.385] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt" [0074.385] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\how to decrypt files.txt")) returned 0x20 [0074.385] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\", lpString2="Checkers.api" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api" [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.zip") returned 0 [0074.385] lstrlenA (lpString="*.zip") returned 5 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.rar") returned 0 [0074.385] lstrlenA (lpString="*.rar") returned 5 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.7z") returned 0 [0074.385] lstrlenA (lpString="*.7z") returned 4 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.tar") returned 0 [0074.385] lstrlenA (lpString="*.tar") returned 5 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.gzip") returned 0 [0074.385] lstrlenA (lpString="*.gzip") returned 6 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.jpg") returned 0 [0074.385] lstrlenA (lpString="*.jpg") returned 5 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.jpeg") returned 0 [0074.385] lstrlenA (lpString="*.jpeg") returned 6 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.psd") returned 0 [0074.385] lstrlenA (lpString="*.psd") returned 5 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.gif") returned 0 [0074.385] lstrlenA (lpString="*.gif") returned 5 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.doc") returned 0 [0074.385] lstrlenA (lpString="*.doc") returned 5 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.docx") returned 0 [0074.385] lstrlenA (lpString="*.docx") returned 6 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.xls") returned 0 [0074.385] lstrlenA (lpString="*.xls") returned 5 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.xlsx") returned 0 [0074.385] lstrlenA (lpString="*.xlsx") returned 6 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.ppt") returned 0 [0074.385] lstrlenA (lpString="*.ppt") returned 5 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.pptx") returned 0 [0074.385] lstrlenA (lpString="*.pptx") returned 6 [0074.385] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.pdf") returned 0 [0074.386] lstrlenA (lpString="*.pdf") returned 5 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.mov") returned 0 [0074.386] lstrlenA (lpString="*.mov") returned 5 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.m2v") returned 0 [0074.386] lstrlenA (lpString="*.m2v") returned 5 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.3gp") returned 0 [0074.386] lstrlenA (lpString="*.3gp") returned 5 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.mpeg") returned 0 [0074.386] lstrlenA (lpString="*.mpeg") returned 6 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.mpg") returned 0 [0074.386] lstrlenA (lpString="*.mpg") returned 5 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.flv") returned 0 [0074.386] lstrlenA (lpString="*.flv") returned 5 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.avi") returned 0 [0074.386] lstrlenA (lpString="*.avi") returned 5 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.mp4") returned 0 [0074.386] lstrlenA (lpString="*.mp4") returned 5 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.wmv") returned 0 [0074.386] lstrlenA (lpString="*.wmv") returned 5 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.divx") returned 0 [0074.386] lstrlenA (lpString="*.divx") returned 6 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.mkv") returned 0 [0074.386] lstrlenA (lpString="*.mkv") returned 5 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.mp3") returned 0 [0074.386] lstrlenA (lpString="*.mp3") returned 5 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.wav") returned 0 [0074.386] lstrlenA (lpString="*.wav") returned 5 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.flac") returned 0 [0074.386] lstrlenA (lpString="*.flac") returned 6 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.ape") returned 0 [0074.386] lstrlenA (lpString="*.ape") returned 5 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.wma") returned 0 [0074.386] lstrlenA (lpString="*.wma") returned 5 [0074.386] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.ac3") returned 0 [0074.386] lstrlenA (lpString="*.ac3") returned 5 [0074.387] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", pszSpec="*.mxf") returned 0 [0074.387] lstrlenA (lpString="*.mxf") returned 5 [0074.387] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15de63, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.api", cAlternateFileName="")) returned 1 [0074.387] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.387] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DigSig.api") returned 1 [0074.387] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DigSig.api") returned 1 [0074.387] lstrcmpiA (lpString1="", lpString2="DigSig.api") returned -1 [0074.387] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api") returned="Checkers.api" [0074.387] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0074.387] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="" [0074.387] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt" [0074.387] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\how to decrypt files.txt")) returned 0x20 [0074.387] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\", lpString2="DigSig.api" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api" [0074.387] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.zip") returned 0 [0074.387] lstrlenA (lpString="*.zip") returned 5 [0074.387] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.rar") returned 0 [0074.387] lstrlenA (lpString="*.rar") returned 5 [0074.387] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.7z") returned 0 [0074.387] lstrlenA (lpString="*.7z") returned 4 [0074.387] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.tar") returned 0 [0074.387] lstrlenA (lpString="*.tar") returned 5 [0074.387] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.gzip") returned 0 [0074.387] lstrlenA (lpString="*.gzip") returned 6 [0074.387] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.jpg") returned 0 [0074.387] lstrlenA (lpString="*.jpg") returned 5 [0074.387] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.jpeg") returned 0 [0074.387] lstrlenA (lpString="*.jpeg") returned 6 [0074.387] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.psd") returned 0 [0074.387] lstrlenA (lpString="*.psd") returned 5 [0074.387] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.gif") returned 0 [0074.387] lstrlenA (lpString="*.gif") returned 5 [0074.387] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.doc") returned 0 [0074.387] lstrlenA (lpString="*.doc") returned 5 [0074.387] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.docx") returned 0 [0074.388] lstrlenA (lpString="*.docx") returned 6 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.xls") returned 0 [0074.388] lstrlenA (lpString="*.xls") returned 5 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.xlsx") returned 0 [0074.388] lstrlenA (lpString="*.xlsx") returned 6 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.ppt") returned 0 [0074.388] lstrlenA (lpString="*.ppt") returned 5 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.pptx") returned 0 [0074.388] lstrlenA (lpString="*.pptx") returned 6 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.pdf") returned 0 [0074.388] lstrlenA (lpString="*.pdf") returned 5 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.mov") returned 0 [0074.388] lstrlenA (lpString="*.mov") returned 5 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.m2v") returned 0 [0074.388] lstrlenA (lpString="*.m2v") returned 5 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.3gp") returned 0 [0074.388] lstrlenA (lpString="*.3gp") returned 5 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.mpeg") returned 0 [0074.388] lstrlenA (lpString="*.mpeg") returned 6 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.mpg") returned 0 [0074.388] lstrlenA (lpString="*.mpg") returned 5 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.flv") returned 0 [0074.388] lstrlenA (lpString="*.flv") returned 5 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.avi") returned 0 [0074.388] lstrlenA (lpString="*.avi") returned 5 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.mp4") returned 0 [0074.388] lstrlenA (lpString="*.mp4") returned 5 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.wmv") returned 0 [0074.388] lstrlenA (lpString="*.wmv") returned 5 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.divx") returned 0 [0074.388] lstrlenA (lpString="*.divx") returned 6 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.mkv") returned 0 [0074.388] lstrlenA (lpString="*.mkv") returned 5 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.mp3") returned 0 [0074.388] lstrlenA (lpString="*.mp3") returned 5 [0074.388] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.wav") returned 0 [0074.388] lstrlenA (lpString="*.wav") returned 5 [0074.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.flac") returned 0 [0074.389] lstrlenA (lpString="*.flac") returned 6 [0074.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.ape") returned 0 [0074.389] lstrlenA (lpString="*.ape") returned 5 [0074.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.wma") returned 0 [0074.389] lstrlenA (lpString="*.wma") returned 5 [0074.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.ac3") returned 0 [0074.389] lstrlenA (lpString="*.ac3") returned 5 [0074.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", pszSpec="*.mxf") returned 0 [0074.389] lstrlenA (lpString="*.mxf") returned 5 [0074.389] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x24a63, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.api", cAlternateFileName="")) returned 1 [0074.389] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.389] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DVA.api") returned 1 [0074.389] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DVA.api") returned 1 [0074.389] lstrcmpiA (lpString1="", lpString2="DVA.api") returned -1 [0074.389] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api") returned="DigSig.api" [0074.389] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0074.389] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="" [0074.389] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt" [0074.389] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\how to decrypt files.txt")) returned 0x20 [0074.389] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\", lpString2="DVA.api" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api" [0074.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.zip") returned 0 [0074.389] lstrlenA (lpString="*.zip") returned 5 [0074.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.rar") returned 0 [0074.389] lstrlenA (lpString="*.rar") returned 5 [0074.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.7z") returned 0 [0074.389] lstrlenA (lpString="*.7z") returned 4 [0074.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.tar") returned 0 [0074.389] lstrlenA (lpString="*.tar") returned 5 [0074.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.gzip") returned 0 [0074.389] lstrlenA (lpString="*.gzip") returned 6 [0074.389] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.jpg") returned 0 [0074.389] lstrlenA (lpString="*.jpg") returned 5 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.jpeg") returned 0 [0074.390] lstrlenA (lpString="*.jpeg") returned 6 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.psd") returned 0 [0074.390] lstrlenA (lpString="*.psd") returned 5 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.gif") returned 0 [0074.390] lstrlenA (lpString="*.gif") returned 5 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.doc") returned 0 [0074.390] lstrlenA (lpString="*.doc") returned 5 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.docx") returned 0 [0074.390] lstrlenA (lpString="*.docx") returned 6 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.xls") returned 0 [0074.390] lstrlenA (lpString="*.xls") returned 5 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.xlsx") returned 0 [0074.390] lstrlenA (lpString="*.xlsx") returned 6 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.ppt") returned 0 [0074.390] lstrlenA (lpString="*.ppt") returned 5 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.pptx") returned 0 [0074.390] lstrlenA (lpString="*.pptx") returned 6 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.pdf") returned 0 [0074.390] lstrlenA (lpString="*.pdf") returned 5 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.mov") returned 0 [0074.390] lstrlenA (lpString="*.mov") returned 5 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.m2v") returned 0 [0074.390] lstrlenA (lpString="*.m2v") returned 5 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.3gp") returned 0 [0074.390] lstrlenA (lpString="*.3gp") returned 5 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.mpeg") returned 0 [0074.390] lstrlenA (lpString="*.mpeg") returned 6 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.mpg") returned 0 [0074.390] lstrlenA (lpString="*.mpg") returned 5 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.flv") returned 0 [0074.390] lstrlenA (lpString="*.flv") returned 5 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.avi") returned 0 [0074.390] lstrlenA (lpString="*.avi") returned 5 [0074.390] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.mp4") returned 0 [0074.391] lstrlenA (lpString="*.mp4") returned 5 [0074.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.wmv") returned 0 [0074.391] lstrlenA (lpString="*.wmv") returned 5 [0074.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.divx") returned 0 [0074.391] lstrlenA (lpString="*.divx") returned 6 [0074.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.mkv") returned 0 [0074.391] lstrlenA (lpString="*.mkv") returned 5 [0074.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.mp3") returned 0 [0074.391] lstrlenA (lpString="*.mp3") returned 5 [0074.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.wav") returned 0 [0074.391] lstrlenA (lpString="*.wav") returned 5 [0074.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.flac") returned 0 [0074.391] lstrlenA (lpString="*.flac") returned 6 [0074.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.ape") returned 0 [0074.391] lstrlenA (lpString="*.ape") returned 5 [0074.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.wma") returned 0 [0074.391] lstrlenA (lpString="*.wma") returned 5 [0074.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.ac3") returned 0 [0074.391] lstrlenA (lpString="*.ac3") returned 5 [0074.391] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", pszSpec="*.mxf") returned 0 [0074.391] lstrlenA (lpString="*.mxf") returned 5 [0074.391] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd063, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.api", cAlternateFileName="")) returned 1 [0074.391] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.391] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="eBook.api") returned -1 [0074.391] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eBook.api") returned 1 [0074.391] lstrcmpiA (lpString1="", lpString2="eBook.api") returned -1 [0074.391] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api") returned="DVA.api" [0074.391] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0074.391] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="" [0074.391] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt" [0074.391] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\how to decrypt files.txt")) returned 0x20 [0074.392] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\", lpString2="eBook.api" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api" [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.zip") returned 0 [0074.392] lstrlenA (lpString="*.zip") returned 5 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.rar") returned 0 [0074.392] lstrlenA (lpString="*.rar") returned 5 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.7z") returned 0 [0074.392] lstrlenA (lpString="*.7z") returned 4 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.tar") returned 0 [0074.392] lstrlenA (lpString="*.tar") returned 5 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.gzip") returned 0 [0074.392] lstrlenA (lpString="*.gzip") returned 6 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.jpg") returned 0 [0074.392] lstrlenA (lpString="*.jpg") returned 5 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.jpeg") returned 0 [0074.392] lstrlenA (lpString="*.jpeg") returned 6 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.psd") returned 0 [0074.392] lstrlenA (lpString="*.psd") returned 5 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.gif") returned 0 [0074.392] lstrlenA (lpString="*.gif") returned 5 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.doc") returned 0 [0074.392] lstrlenA (lpString="*.doc") returned 5 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.docx") returned 0 [0074.392] lstrlenA (lpString="*.docx") returned 6 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.xls") returned 0 [0074.392] lstrlenA (lpString="*.xls") returned 5 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.xlsx") returned 0 [0074.392] lstrlenA (lpString="*.xlsx") returned 6 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.ppt") returned 0 [0074.392] lstrlenA (lpString="*.ppt") returned 5 [0074.392] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.pptx") returned 0 [0074.393] lstrlenA (lpString="*.pptx") returned 6 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.pdf") returned 0 [0074.393] lstrlenA (lpString="*.pdf") returned 5 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.mov") returned 0 [0074.393] lstrlenA (lpString="*.mov") returned 5 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.m2v") returned 0 [0074.393] lstrlenA (lpString="*.m2v") returned 5 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.3gp") returned 0 [0074.393] lstrlenA (lpString="*.3gp") returned 5 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.mpeg") returned 0 [0074.393] lstrlenA (lpString="*.mpeg") returned 6 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.mpg") returned 0 [0074.393] lstrlenA (lpString="*.mpg") returned 5 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.flv") returned 0 [0074.393] lstrlenA (lpString="*.flv") returned 5 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.avi") returned 0 [0074.393] lstrlenA (lpString="*.avi") returned 5 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.mp4") returned 0 [0074.393] lstrlenA (lpString="*.mp4") returned 5 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.wmv") returned 0 [0074.393] lstrlenA (lpString="*.wmv") returned 5 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.divx") returned 0 [0074.393] lstrlenA (lpString="*.divx") returned 6 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.mkv") returned 0 [0074.393] lstrlenA (lpString="*.mkv") returned 5 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.mp3") returned 0 [0074.393] lstrlenA (lpString="*.mp3") returned 5 [0074.393] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.wav") returned 0 [0074.393] lstrlenA (lpString="*.wav") returned 5 [0074.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.flac") returned 0 [0074.394] lstrlenA (lpString="*.flac") returned 6 [0074.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.ape") returned 0 [0074.394] lstrlenA (lpString="*.ape") returned 5 [0074.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.wma") returned 0 [0074.394] lstrlenA (lpString="*.wma") returned 5 [0074.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.ac3") returned 0 [0074.394] lstrlenA (lpString="*.ac3") returned 5 [0074.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", pszSpec="*.mxf") returned 0 [0074.394] lstrlenA (lpString="*.mxf") returned 5 [0074.394] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e2b880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1ab863, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.api", cAlternateFileName="")) returned 1 [0074.394] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.394] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="EScript.api") returned -1 [0074.394] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EScript.api") returned 1 [0074.394] lstrcmpiA (lpString1="", lpString2="EScript.api") returned -1 [0074.394] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api") returned="eBook.api" [0074.394] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0074.394] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="" [0074.394] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt" [0074.394] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\how to decrypt files.txt")) returned 0x20 [0074.394] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\", lpString2="EScript.api" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api" [0074.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.zip") returned 0 [0074.394] lstrlenA (lpString="*.zip") returned 5 [0074.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.rar") returned 0 [0074.394] lstrlenA (lpString="*.rar") returned 5 [0074.394] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.7z") returned 0 [0074.395] lstrlenA (lpString="*.7z") returned 4 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.tar") returned 0 [0074.395] lstrlenA (lpString="*.tar") returned 5 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.gzip") returned 0 [0074.395] lstrlenA (lpString="*.gzip") returned 6 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.jpg") returned 0 [0074.395] lstrlenA (lpString="*.jpg") returned 5 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.jpeg") returned 0 [0074.395] lstrlenA (lpString="*.jpeg") returned 6 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.psd") returned 0 [0074.395] lstrlenA (lpString="*.psd") returned 5 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.gif") returned 0 [0074.395] lstrlenA (lpString="*.gif") returned 5 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.doc") returned 0 [0074.395] lstrlenA (lpString="*.doc") returned 5 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.docx") returned 0 [0074.395] lstrlenA (lpString="*.docx") returned 6 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.xls") returned 0 [0074.395] lstrlenA (lpString="*.xls") returned 5 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.xlsx") returned 0 [0074.395] lstrlenA (lpString="*.xlsx") returned 6 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.ppt") returned 0 [0074.395] lstrlenA (lpString="*.ppt") returned 5 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.pptx") returned 0 [0074.395] lstrlenA (lpString="*.pptx") returned 6 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.pdf") returned 0 [0074.395] lstrlenA (lpString="*.pdf") returned 5 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.mov") returned 0 [0074.395] lstrlenA (lpString="*.mov") returned 5 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.m2v") returned 0 [0074.395] lstrlenA (lpString="*.m2v") returned 5 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.3gp") returned 0 [0074.395] lstrlenA (lpString="*.3gp") returned 5 [0074.395] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.mpeg") returned 0 [0074.396] lstrlenA (lpString="*.mpeg") returned 6 [0074.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.mpg") returned 0 [0074.396] lstrlenA (lpString="*.mpg") returned 5 [0074.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.flv") returned 0 [0074.396] lstrlenA (lpString="*.flv") returned 5 [0074.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.avi") returned 0 [0074.396] lstrlenA (lpString="*.avi") returned 5 [0074.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.mp4") returned 0 [0074.396] lstrlenA (lpString="*.mp4") returned 5 [0074.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.wmv") returned 0 [0074.396] lstrlenA (lpString="*.wmv") returned 5 [0074.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.divx") returned 0 [0074.396] lstrlenA (lpString="*.divx") returned 6 [0074.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.mkv") returned 0 [0074.396] lstrlenA (lpString="*.mkv") returned 5 [0074.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.mp3") returned 0 [0074.396] lstrlenA (lpString="*.mp3") returned 5 [0074.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.wav") returned 0 [0074.396] lstrlenA (lpString="*.wav") returned 5 [0074.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.flac") returned 0 [0074.396] lstrlenA (lpString="*.flac") returned 6 [0074.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.ape") returned 0 [0074.396] lstrlenA (lpString="*.ape") returned 5 [0074.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.wma") returned 0 [0074.396] lstrlenA (lpString="*.wma") returned 5 [0074.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.ac3") returned 0 [0074.396] lstrlenA (lpString="*.ac3") returned 5 [0074.396] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", pszSpec="*.mxf") returned 0 [0074.396] lstrlenA (lpString="*.mxf") returned 5 [0074.396] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18463, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.api", cAlternateFileName="")) returned 1 [0074.396] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.396] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="IA32.api") returned -1 [0074.396] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IA32.api") returned -1 [0074.396] lstrcmpiA (lpString1="", lpString2="IA32.api") returned -1 [0074.397] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api") returned="EScript.api" [0074.397] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0074.397] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="" [0074.397] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt" [0074.397] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\how to decrypt files.txt")) returned 0x20 [0074.397] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\", lpString2="IA32.api" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api" [0074.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.zip") returned 0 [0074.397] lstrlenA (lpString="*.zip") returned 5 [0074.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.rar") returned 0 [0074.397] lstrlenA (lpString="*.rar") returned 5 [0074.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.7z") returned 0 [0074.397] lstrlenA (lpString="*.7z") returned 4 [0074.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.tar") returned 0 [0074.397] lstrlenA (lpString="*.tar") returned 5 [0074.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.gzip") returned 0 [0074.397] lstrlenA (lpString="*.gzip") returned 6 [0074.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.jpg") returned 0 [0074.397] lstrlenA (lpString="*.jpg") returned 5 [0074.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.jpeg") returned 0 [0074.397] lstrlenA (lpString="*.jpeg") returned 6 [0074.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.psd") returned 0 [0074.397] lstrlenA (lpString="*.psd") returned 5 [0074.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.gif") returned 0 [0074.397] lstrlenA (lpString="*.gif") returned 5 [0074.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.doc") returned 0 [0074.397] lstrlenA (lpString="*.doc") returned 5 [0074.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.docx") returned 0 [0074.397] lstrlenA (lpString="*.docx") returned 6 [0074.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.xls") returned 0 [0074.397] lstrlenA (lpString="*.xls") returned 5 [0074.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.xlsx") returned 0 [0074.397] lstrlenA (lpString="*.xlsx") returned 6 [0074.397] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.ppt") returned 0 [0074.397] lstrlenA (lpString="*.ppt") returned 5 [0074.398] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.pptx") returned 0 [0074.398] lstrlenA (lpString="*.pptx") returned 6 [0074.398] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.pdf") returned 0 [0074.398] lstrlenA (lpString="*.pdf") returned 5 [0074.398] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.mov") returned 0 [0074.398] lstrlenA (lpString="*.mov") returned 5 [0074.398] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.m2v") returned 0 [0074.398] lstrlenA (lpString="*.m2v") returned 5 [0074.398] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.3gp") returned 0 [0074.398] lstrlenA (lpString="*.3gp") returned 5 [0074.398] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.mpeg") returned 0 [0074.398] lstrlenA (lpString="*.mpeg") returned 6 [0074.398] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.mpg") returned 0 [0074.398] lstrlenA (lpString="*.mpg") returned 5 [0074.398] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.flv") returned 0 [0074.398] lstrlenA (lpString="*.flv") returned 5 [0074.398] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.avi") returned 0 [0074.398] lstrlenA (lpString="*.avi") returned 5 [0074.398] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.mp4") returned 0 [0074.398] lstrlenA (lpString="*.mp4") returned 5 [0074.398] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.wmv") returned 0 [0074.398] lstrlenA (lpString="*.wmv") returned 5 [0074.398] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.divx") returned 0 [0074.398] lstrlenA (lpString="*.divx") returned 6 [0074.398] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.mkv") returned 0 [0074.398] lstrlenA (lpString="*.mkv") returned 5 [0074.398] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.mp3") returned 0 [0074.398] lstrlenA (lpString="*.mp3") returned 5 [0074.398] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.wav") returned 0 [0074.398] lstrlenA (lpString="*.wav") returned 5 [0074.398] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.flac") returned 0 [0074.398] lstrlenA (lpString="*.flac") returned 6 [0074.398] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.ape") returned 0 [0074.398] lstrlenA (lpString="*.ape") returned 5 [0074.398] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.wma") returned 0 [0074.399] lstrlenA (lpString="*.wma") returned 5 [0074.399] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.ac3") returned 0 [0074.399] lstrlenA (lpString="*.ac3") returned 5 [0074.399] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", pszSpec="*.mxf") returned 0 [0074.399] lstrlenA (lpString="*.mxf") returned 5 [0074.399] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x234a63, dwReserved0=0x0, dwReserved1=0x0, cFileName="MakeAccessible.api", cAlternateFileName="MAKEAC~1.API")) returned 1 [0074.399] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.399] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MakeAccessible.api") returned -1 [0074.399] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MakeAccessible.api") returned -1 [0074.399] lstrcmpiA (lpString1="", lpString2="MakeAccessible.api") returned -1 [0074.399] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api") returned="IA32.api" [0074.399] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0074.399] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="" [0074.399] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt" [0074.399] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\how to decrypt files.txt")) returned 0x20 [0074.399] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\", lpString2="MakeAccessible.api" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\MakeAccessible.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\MakeAccessible.api" [0074.399] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\MakeAccessible.api", pszSpec="*.zip") returned 0 [0074.399] lstrlenA (lpString="*.zip") returned 5 [0074.399] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\MakeAccessible.api", pszSpec="*.rar") returned 0 [0074.399] lstrlenA (lpString="*.rar") returned 5 [0074.399] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\MakeAccessible.api", pszSpec="*.7z") returned 0 [0074.399] lstrlenA (lpString="*.7z") returned 4 [0074.399] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\MakeAccessible.api", pszSpec="*.tar") returned 0 [0074.399] lstrlenA (lpString="*.tar") returned 5 [0074.399] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\MakeAccessible.api", pszSpec="*.gzip") returned 0 [0074.399] lstrlenA (lpString="*.gzip") returned 6 [0074.399] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\MakeAccessible.api", pszSpec="*.jpg") returned 0 [0074.400] lstrlenA (lpString="*.jpg") returned 5 [0074.400] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\MakeAccessible.api", pszSpec="*.jpeg") returned 0 [0074.400] lstrlenA (lpString="*.jpeg") returned 6 [0074.400] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\MakeAccessible.api", pszSpec="*.psd") returned 0 [0074.400] lstrlenA (lpString="*.psd") returned 5 [0074.400] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\MakeAccessible.api", pszSpec="*.gif") returned 0 [0074.400] lstrlenA (lpString="*.gif") returned 5 [0074.400] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\MakeAccessible.api", pszSpec="*.doc") returned 0 [0074.400] lstrlenA (lpString="*.doc") returned 5 [0074.400] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\MakeAccessible.api", pszSpec="*.docx") returned 0 [0074.400] lstrlenA (lpString="*.docx") returned 6 [0074.400] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia", cAlternateFileName="MULTIM~1")) returned 1 [0074.400] lstrcmpA (lpString1=".", lpString2="Multimedia") returned -1 [0074.400] lstrcmpA (lpString1="..", lpString2="Multimedia") returned -1 [0074.400] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\MakeAccessible.api") returned="MakeAccessible.api" [0074.400] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\", lpString2="Multimedia" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia" [0074.400] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2e246a, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0074.405] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.405] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0074.405] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.405] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.405] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MPP", cAlternateFileName="")) returned 1 [0074.405] lstrcmpA (lpString1=".", lpString2="MPP") returned -1 [0074.405] lstrcmpA (lpString1="..", lpString2="MPP") returned -1 [0074.405] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*.*") returned="*.*" [0074.405] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\", lpString2="MPP" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP" [0074.405] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0074.409] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.409] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0074.410] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.410] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.410] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Flash.CAT", cAlternateFileName="")) returned 1 [0074.411] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.411] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Flash.CAT") returned -1 [0074.411] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Flash.CAT") returned 1 [0074.411] lstrcmpiA (lpString1="", lpString2="Flash.CAT") returned -1 [0074.411] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\*.*") returned="*.*" [0074.411] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.411] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.411] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.411] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0xffffffff [0074.411] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0074.414] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.414] CloseHandle (hObject=0x98) returned 1 [0074.414] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="Flash.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.CAT" [0074.415] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6d7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.CHS", cAlternateFileName="")) returned 1 [0074.415] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.415] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Flash.CHS") returned -1 [0074.415] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Flash.CHS") returned 1 [0074.415] lstrcmpiA (lpString1="", lpString2="Flash.CHS") returned -1 [0074.415] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.CAT") returned="Flash.CAT" [0074.415] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.415] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.415] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.415] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.415] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="Flash.CHS" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.CHS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.CHS" [0074.415] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Flash.CHT", cAlternateFileName="")) returned 1 [0074.415] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.415] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Flash.CHT") returned -1 [0074.415] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Flash.CHT") returned 1 [0074.415] lstrcmpiA (lpString1="", lpString2="Flash.CHT") returned -1 [0074.415] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.CHS") returned="Flash.CHS" [0074.415] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.415] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.415] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.415] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.415] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="Flash.CHT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.CHT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.CHT" [0074.415] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d68aea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Flash.DAN", cAlternateFileName="")) returned 1 [0074.416] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.416] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Flash.DAN") returned -1 [0074.416] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Flash.DAN") returned 1 [0074.416] lstrcmpiA (lpString1="", lpString2="Flash.DAN") returned -1 [0074.416] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.CHT") returned="Flash.CHT" [0074.416] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.416] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.416] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.416] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.416] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="Flash.DAN" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.DAN" [0074.416] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d749580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Flash.DEU", cAlternateFileName="")) returned 1 [0074.416] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.416] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Flash.DEU") returned -1 [0074.416] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Flash.DEU") returned 1 [0074.416] lstrcmpiA (lpString1="", lpString2="Flash.DEU") returned -1 [0074.416] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.DAN") returned="Flash.DAN" [0074.416] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.416] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.416] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.416] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.416] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="Flash.DEU" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.DEU" [0074.416] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Flash.ESP", cAlternateFileName="")) returned 1 [0074.416] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.416] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Flash.ESP") returned -1 [0074.416] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Flash.ESP") returned 1 [0074.416] lstrcmpiA (lpString1="", lpString2="Flash.ESP") returned -1 [0074.416] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.DEU") returned="Flash.DEU" [0074.416] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.417] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.417] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.417] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.417] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="Flash.ESP" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.ESP" [0074.417] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Flash.EUQ", cAlternateFileName="")) returned 1 [0074.417] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.417] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Flash.EUQ") returned -1 [0074.417] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Flash.EUQ") returned 1 [0074.417] lstrcmpiA (lpString1="", lpString2="Flash.EUQ") returned -1 [0074.417] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.ESP") returned="Flash.ESP" [0074.417] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.417] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.417] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.417] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.417] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="Flash.EUQ" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.EUQ" [0074.417] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Flash.FRA", cAlternateFileName="")) returned 1 [0074.417] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.417] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Flash.FRA") returned -1 [0074.417] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Flash.FRA") returned 1 [0074.417] lstrcmpiA (lpString1="", lpString2="Flash.FRA") returned -1 [0074.417] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.EUQ") returned="Flash.EUQ" [0074.417] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.417] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.417] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.417] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.417] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="Flash.FRA" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.FRA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.FRA" [0074.418] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Flash.ITA", cAlternateFileName="")) returned 1 [0074.418] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.418] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Flash.ITA") returned -1 [0074.418] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Flash.ITA") returned 1 [0074.418] lstrcmpiA (lpString1="", lpString2="Flash.ITA") returned -1 [0074.418] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.FRA") returned="Flash.FRA" [0074.418] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.418] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.418] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.418] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.418] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="Flash.ITA" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.ITA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.ITA" [0074.418] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Flash.JPN", cAlternateFileName="")) returned 1 [0074.418] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.418] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Flash.JPN") returned -1 [0074.418] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Flash.JPN") returned 1 [0074.418] lstrcmpiA (lpString1="", lpString2="Flash.JPN") returned -1 [0074.418] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.ITA") returned="Flash.ITA" [0074.418] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.418] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.418] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.418] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.418] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="Flash.JPN" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.JPN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.JPN" [0074.418] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Flash.KOR", cAlternateFileName="")) returned 1 [0074.418] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.418] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Flash.KOR") returned -1 [0074.418] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Flash.KOR") returned 1 [0074.418] lstrcmpiA (lpString1="", lpString2="Flash.KOR") returned -1 [0074.418] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.JPN") returned="Flash.JPN" [0074.419] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.419] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.419] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.419] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.419] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="Flash.KOR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.KOR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.KOR" [0074.419] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d800, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Flash.mpp", cAlternateFileName="")) returned 1 [0074.419] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.419] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Flash.mpp") returned -1 [0074.419] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Flash.mpp") returned 1 [0074.419] lstrcmpiA (lpString1="", lpString2="Flash.mpp") returned -1 [0074.419] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.KOR") returned="Flash.KOR" [0074.419] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.419] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.419] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.419] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.419] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="Flash.mpp" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.mpp") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.mpp" [0074.419] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6b1000, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Flash.NLD", cAlternateFileName="")) returned 1 [0074.419] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.419] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Flash.NLD") returned -1 [0074.419] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Flash.NLD") returned 1 [0074.419] lstrcmpiA (lpString1="", lpString2="Flash.NLD") returned -1 [0074.419] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.mpp") returned="Flash.mpp" [0074.419] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.419] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.419] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.419] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.419] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="Flash.NLD" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.NLD") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.NLD" [0074.420] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d76f6e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Flash.NOR", cAlternateFileName="")) returned 1 [0074.420] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.420] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Flash.NOR") returned -1 [0074.420] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Flash.NOR") returned 1 [0074.420] lstrcmpiA (lpString1="", lpString2="Flash.NOR") returned -1 [0074.420] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.NLD") returned="Flash.NLD" [0074.420] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.420] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.420] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.420] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.420] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="Flash.NOR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.NOR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.NOR" [0074.420] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Flash.PTB", cAlternateFileName="")) returned 1 [0074.420] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.420] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Flash.PTB") returned -1 [0074.420] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Flash.PTB") returned 1 [0074.420] lstrcmpiA (lpString1="", lpString2="Flash.PTB") returned -1 [0074.420] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.NOR") returned="Flash.NOR" [0074.420] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.420] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.420] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.420] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.420] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="Flash.PTB" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.PTB") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.PTB" [0074.420] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Flash.SUO", cAlternateFileName="")) returned 1 [0074.420] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.420] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Flash.SUO") returned -1 [0074.421] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Flash.SUO") returned 1 [0074.421] lstrcmpiA (lpString1="", lpString2="Flash.SUO") returned -1 [0074.421] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.PTB") returned="Flash.PTB" [0074.421] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.421] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.421] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.421] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.421] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="Flash.SUO" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.SUO" [0074.421] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Flash.SVE", cAlternateFileName="")) returned 1 [0074.421] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.421] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Flash.SVE") returned -1 [0074.421] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Flash.SVE") returned 1 [0074.421] lstrcmpiA (lpString1="", lpString2="Flash.SVE") returned -1 [0074.421] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.SUO") returned="Flash.SUO" [0074.421] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.421] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.421] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.421] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.421] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="Flash.SVE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.SVE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.SVE" [0074.421] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Mcimpp.CAT", cAlternateFileName="")) returned 1 [0074.421] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.421] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Mcimpp.CAT") returned -1 [0074.422] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Mcimpp.CAT") returned -1 [0074.422] lstrcmpiA (lpString1="", lpString2="Mcimpp.CAT") returned -1 [0074.422] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.SVE") returned="Flash.SVE" [0074.422] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.422] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.422] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.422] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.422] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="Mcimpp.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.CAT" [0074.422] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6d7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="MCIMPP.CHS", cAlternateFileName="")) returned 1 [0074.422] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.422] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MCIMPP.CHS") returned -1 [0074.422] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MCIMPP.CHS") returned -1 [0074.422] lstrcmpiA (lpString1="", lpString2="MCIMPP.CHS") returned -1 [0074.422] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.CAT") returned="Mcimpp.CAT" [0074.422] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.422] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.422] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.422] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.422] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="MCIMPP.CHS" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS" [0074.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.zip") returned 0 [0074.423] lstrlenA (lpString="*.zip") returned 5 [0074.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.rar") returned 0 [0074.423] lstrlenA (lpString="*.rar") returned 5 [0074.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.7z") returned 0 [0074.423] lstrlenA (lpString="*.7z") returned 4 [0074.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.tar") returned 0 [0074.423] lstrlenA (lpString="*.tar") returned 5 [0074.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.gzip") returned 0 [0074.423] lstrlenA (lpString="*.gzip") returned 6 [0074.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.jpg") returned 0 [0074.423] lstrlenA (lpString="*.jpg") returned 5 [0074.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.jpeg") returned 0 [0074.423] lstrlenA (lpString="*.jpeg") returned 6 [0074.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.psd") returned 0 [0074.423] lstrlenA (lpString="*.psd") returned 5 [0074.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.gif") returned 0 [0074.423] lstrlenA (lpString="*.gif") returned 5 [0074.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.doc") returned 0 [0074.423] lstrlenA (lpString="*.doc") returned 5 [0074.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.docx") returned 0 [0074.423] lstrlenA (lpString="*.docx") returned 6 [0074.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.xls") returned 0 [0074.423] lstrlenA (lpString="*.xls") returned 5 [0074.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.xlsx") returned 0 [0074.423] lstrlenA (lpString="*.xlsx") returned 6 [0074.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.ppt") returned 0 [0074.423] lstrlenA (lpString="*.ppt") returned 5 [0074.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.pptx") returned 0 [0074.423] lstrlenA (lpString="*.pptx") returned 6 [0074.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.pdf") returned 0 [0074.423] lstrlenA (lpString="*.pdf") returned 5 [0074.423] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.mov") returned 0 [0074.424] lstrlenA (lpString="*.mov") returned 5 [0074.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.m2v") returned 0 [0074.424] lstrlenA (lpString="*.m2v") returned 5 [0074.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.3gp") returned 0 [0074.424] lstrlenA (lpString="*.3gp") returned 5 [0074.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.mpeg") returned 0 [0074.424] lstrlenA (lpString="*.mpeg") returned 6 [0074.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.mpg") returned 0 [0074.424] lstrlenA (lpString="*.mpg") returned 5 [0074.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.flv") returned 0 [0074.424] lstrlenA (lpString="*.flv") returned 5 [0074.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.avi") returned 0 [0074.424] lstrlenA (lpString="*.avi") returned 5 [0074.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.mp4") returned 0 [0074.424] lstrlenA (lpString="*.mp4") returned 5 [0074.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.wmv") returned 0 [0074.424] lstrlenA (lpString="*.wmv") returned 5 [0074.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.divx") returned 0 [0074.424] lstrlenA (lpString="*.divx") returned 6 [0074.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.mkv") returned 0 [0074.424] lstrlenA (lpString="*.mkv") returned 5 [0074.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.mp3") returned 0 [0074.424] lstrlenA (lpString="*.mp3") returned 5 [0074.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.wav") returned 0 [0074.424] lstrlenA (lpString="*.wav") returned 5 [0074.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.flac") returned 0 [0074.424] lstrlenA (lpString="*.flac") returned 6 [0074.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.ape") returned 0 [0074.424] lstrlenA (lpString="*.ape") returned 5 [0074.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.wma") returned 0 [0074.424] lstrlenA (lpString="*.wma") returned 5 [0074.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.ac3") returned 0 [0074.424] lstrlenA (lpString="*.ac3") returned 5 [0074.424] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS", pszSpec="*.mxf") returned 0 [0074.424] lstrlenA (lpString="*.mxf") returned 5 [0074.424] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="MCIMPP.CHT", cAlternateFileName="")) returned 1 [0074.425] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.425] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MCIMPP.CHT") returned -1 [0074.425] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MCIMPP.CHT") returned -1 [0074.425] lstrcmpiA (lpString1="", lpString2="MCIMPP.CHT") returned -1 [0074.425] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHS") returned="MCIMPP.CHS" [0074.425] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.425] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.425] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.425] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.425] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="MCIMPP.CHT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT" [0074.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.zip") returned 0 [0074.425] lstrlenA (lpString="*.zip") returned 5 [0074.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.rar") returned 0 [0074.425] lstrlenA (lpString="*.rar") returned 5 [0074.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.7z") returned 0 [0074.425] lstrlenA (lpString="*.7z") returned 4 [0074.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.tar") returned 0 [0074.425] lstrlenA (lpString="*.tar") returned 5 [0074.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.gzip") returned 0 [0074.425] lstrlenA (lpString="*.gzip") returned 6 [0074.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.jpg") returned 0 [0074.425] lstrlenA (lpString="*.jpg") returned 5 [0074.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.jpeg") returned 0 [0074.425] lstrlenA (lpString="*.jpeg") returned 6 [0074.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.psd") returned 0 [0074.425] lstrlenA (lpString="*.psd") returned 5 [0074.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.gif") returned 0 [0074.425] lstrlenA (lpString="*.gif") returned 5 [0074.425] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.doc") returned 0 [0074.425] lstrlenA (lpString="*.doc") returned 5 [0074.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.docx") returned 0 [0074.426] lstrlenA (lpString="*.docx") returned 6 [0074.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.xls") returned 0 [0074.426] lstrlenA (lpString="*.xls") returned 5 [0074.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.xlsx") returned 0 [0074.426] lstrlenA (lpString="*.xlsx") returned 6 [0074.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.ppt") returned 0 [0074.426] lstrlenA (lpString="*.ppt") returned 5 [0074.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.pptx") returned 0 [0074.426] lstrlenA (lpString="*.pptx") returned 6 [0074.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.pdf") returned 0 [0074.426] lstrlenA (lpString="*.pdf") returned 5 [0074.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.mov") returned 0 [0074.426] lstrlenA (lpString="*.mov") returned 5 [0074.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.m2v") returned 0 [0074.426] lstrlenA (lpString="*.m2v") returned 5 [0074.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.3gp") returned 0 [0074.426] lstrlenA (lpString="*.3gp") returned 5 [0074.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.mpeg") returned 0 [0074.426] lstrlenA (lpString="*.mpeg") returned 6 [0074.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.mpg") returned 0 [0074.426] lstrlenA (lpString="*.mpg") returned 5 [0074.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.flv") returned 0 [0074.426] lstrlenA (lpString="*.flv") returned 5 [0074.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.avi") returned 0 [0074.426] lstrlenA (lpString="*.avi") returned 5 [0074.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.mp4") returned 0 [0074.426] lstrlenA (lpString="*.mp4") returned 5 [0074.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.wmv") returned 0 [0074.426] lstrlenA (lpString="*.wmv") returned 5 [0074.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.divx") returned 0 [0074.426] lstrlenA (lpString="*.divx") returned 6 [0074.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.mkv") returned 0 [0074.426] lstrlenA (lpString="*.mkv") returned 5 [0074.426] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.mp3") returned 0 [0074.426] lstrlenA (lpString="*.mp3") returned 5 [0074.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.wav") returned 0 [0074.427] lstrlenA (lpString="*.wav") returned 5 [0074.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.flac") returned 0 [0074.427] lstrlenA (lpString="*.flac") returned 6 [0074.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.ape") returned 0 [0074.427] lstrlenA (lpString="*.ape") returned 5 [0074.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.wma") returned 0 [0074.427] lstrlenA (lpString="*.wma") returned 5 [0074.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.ac3") returned 0 [0074.427] lstrlenA (lpString="*.ac3") returned 5 [0074.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT", pszSpec="*.mxf") returned 0 [0074.427] lstrlenA (lpString="*.mxf") returned 5 [0074.427] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Mcimpp.DAN", cAlternateFileName="")) returned 1 [0074.427] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.427] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Mcimpp.DAN") returned -1 [0074.427] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Mcimpp.DAN") returned -1 [0074.427] lstrcmpiA (lpString1="", lpString2="Mcimpp.DAN") returned -1 [0074.427] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.CHT") returned="MCIMPP.CHT" [0074.427] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.427] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.427] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.427] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.427] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="Mcimpp.DAN" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN" [0074.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.zip") returned 0 [0074.427] lstrlenA (lpString="*.zip") returned 5 [0074.427] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.rar") returned 0 [0074.428] lstrlenA (lpString="*.rar") returned 5 [0074.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.7z") returned 0 [0074.428] lstrlenA (lpString="*.7z") returned 4 [0074.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.tar") returned 0 [0074.428] lstrlenA (lpString="*.tar") returned 5 [0074.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.gzip") returned 0 [0074.428] lstrlenA (lpString="*.gzip") returned 6 [0074.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.jpg") returned 0 [0074.428] lstrlenA (lpString="*.jpg") returned 5 [0074.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.jpeg") returned 0 [0074.428] lstrlenA (lpString="*.jpeg") returned 6 [0074.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.psd") returned 0 [0074.428] lstrlenA (lpString="*.psd") returned 5 [0074.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.gif") returned 0 [0074.428] lstrlenA (lpString="*.gif") returned 5 [0074.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.doc") returned 0 [0074.428] lstrlenA (lpString="*.doc") returned 5 [0074.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.docx") returned 0 [0074.428] lstrlenA (lpString="*.docx") returned 6 [0074.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.xls") returned 0 [0074.428] lstrlenA (lpString="*.xls") returned 5 [0074.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.xlsx") returned 0 [0074.428] lstrlenA (lpString="*.xlsx") returned 6 [0074.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.ppt") returned 0 [0074.428] lstrlenA (lpString="*.ppt") returned 5 [0074.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.pptx") returned 0 [0074.428] lstrlenA (lpString="*.pptx") returned 6 [0074.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.pdf") returned 0 [0074.428] lstrlenA (lpString="*.pdf") returned 5 [0074.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.mov") returned 0 [0074.428] lstrlenA (lpString="*.mov") returned 5 [0074.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.m2v") returned 0 [0074.428] lstrlenA (lpString="*.m2v") returned 5 [0074.428] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.3gp") returned 0 [0074.428] lstrlenA (lpString="*.3gp") returned 5 [0074.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.mpeg") returned 0 [0074.429] lstrlenA (lpString="*.mpeg") returned 6 [0074.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.mpg") returned 0 [0074.429] lstrlenA (lpString="*.mpg") returned 5 [0074.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.flv") returned 0 [0074.429] lstrlenA (lpString="*.flv") returned 5 [0074.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.avi") returned 0 [0074.429] lstrlenA (lpString="*.avi") returned 5 [0074.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.mp4") returned 0 [0074.429] lstrlenA (lpString="*.mp4") returned 5 [0074.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.wmv") returned 0 [0074.429] lstrlenA (lpString="*.wmv") returned 5 [0074.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.divx") returned 0 [0074.429] lstrlenA (lpString="*.divx") returned 6 [0074.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.mkv") returned 0 [0074.429] lstrlenA (lpString="*.mkv") returned 5 [0074.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.mp3") returned 0 [0074.429] lstrlenA (lpString="*.mp3") returned 5 [0074.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.wav") returned 0 [0074.429] lstrlenA (lpString="*.wav") returned 5 [0074.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.flac") returned 0 [0074.429] lstrlenA (lpString="*.flac") returned 6 [0074.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.ape") returned 0 [0074.429] lstrlenA (lpString="*.ape") returned 5 [0074.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.wma") returned 0 [0074.429] lstrlenA (lpString="*.wma") returned 5 [0074.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.ac3") returned 0 [0074.429] lstrlenA (lpString="*.ac3") returned 5 [0074.429] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN", pszSpec="*.mxf") returned 0 [0074.429] lstrlenA (lpString="*.mxf") returned 5 [0074.429] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d749580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Mcimpp.DEU", cAlternateFileName="")) returned 1 [0074.429] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.429] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Mcimpp.DEU") returned -1 [0074.429] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Mcimpp.DEU") returned -1 [0074.429] lstrcmpiA (lpString1="", lpString2="Mcimpp.DEU") returned -1 [0074.429] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DAN") returned="Mcimpp.DAN" [0074.430] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.430] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.430] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.430] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.430] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="Mcimpp.DEU" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU" [0074.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.zip") returned 0 [0074.430] lstrlenA (lpString="*.zip") returned 5 [0074.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.rar") returned 0 [0074.430] lstrlenA (lpString="*.rar") returned 5 [0074.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.7z") returned 0 [0074.430] lstrlenA (lpString="*.7z") returned 4 [0074.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.tar") returned 0 [0074.430] lstrlenA (lpString="*.tar") returned 5 [0074.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.gzip") returned 0 [0074.430] lstrlenA (lpString="*.gzip") returned 6 [0074.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.jpg") returned 0 [0074.430] lstrlenA (lpString="*.jpg") returned 5 [0074.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.jpeg") returned 0 [0074.430] lstrlenA (lpString="*.jpeg") returned 6 [0074.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.psd") returned 0 [0074.430] lstrlenA (lpString="*.psd") returned 5 [0074.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.gif") returned 0 [0074.430] lstrlenA (lpString="*.gif") returned 5 [0074.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.doc") returned 0 [0074.430] lstrlenA (lpString="*.doc") returned 5 [0074.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.docx") returned 0 [0074.430] lstrlenA (lpString="*.docx") returned 6 [0074.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.xls") returned 0 [0074.430] lstrlenA (lpString="*.xls") returned 5 [0074.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.xlsx") returned 0 [0074.430] lstrlenA (lpString="*.xlsx") returned 6 [0074.430] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.ppt") returned 0 [0074.431] lstrlenA (lpString="*.ppt") returned 5 [0074.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.pptx") returned 0 [0074.431] lstrlenA (lpString="*.pptx") returned 6 [0074.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.pdf") returned 0 [0074.431] lstrlenA (lpString="*.pdf") returned 5 [0074.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.mov") returned 0 [0074.431] lstrlenA (lpString="*.mov") returned 5 [0074.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.m2v") returned 0 [0074.431] lstrlenA (lpString="*.m2v") returned 5 [0074.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.3gp") returned 0 [0074.431] lstrlenA (lpString="*.3gp") returned 5 [0074.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.mpeg") returned 0 [0074.431] lstrlenA (lpString="*.mpeg") returned 6 [0074.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.mpg") returned 0 [0074.431] lstrlenA (lpString="*.mpg") returned 5 [0074.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.flv") returned 0 [0074.431] lstrlenA (lpString="*.flv") returned 5 [0074.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.avi") returned 0 [0074.431] lstrlenA (lpString="*.avi") returned 5 [0074.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.mp4") returned 0 [0074.431] lstrlenA (lpString="*.mp4") returned 5 [0074.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.wmv") returned 0 [0074.431] lstrlenA (lpString="*.wmv") returned 5 [0074.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.divx") returned 0 [0074.431] lstrlenA (lpString="*.divx") returned 6 [0074.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.mkv") returned 0 [0074.431] lstrlenA (lpString="*.mkv") returned 5 [0074.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.mp3") returned 0 [0074.431] lstrlenA (lpString="*.mp3") returned 5 [0074.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.wav") returned 0 [0074.431] lstrlenA (lpString="*.wav") returned 5 [0074.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.flac") returned 0 [0074.431] lstrlenA (lpString="*.flac") returned 6 [0074.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.ape") returned 0 [0074.431] lstrlenA (lpString="*.ape") returned 5 [0074.431] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.wma") returned 0 [0074.432] lstrlenA (lpString="*.wma") returned 5 [0074.432] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.ac3") returned 0 [0074.432] lstrlenA (lpString="*.ac3") returned 5 [0074.432] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU", pszSpec="*.mxf") returned 0 [0074.432] lstrlenA (lpString="*.mxf") returned 5 [0074.432] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Mcimpp.ESP", cAlternateFileName="")) returned 1 [0074.432] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.432] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Mcimpp.ESP") returned -1 [0074.432] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Mcimpp.ESP") returned -1 [0074.432] lstrcmpiA (lpString1="", lpString2="Mcimpp.ESP") returned -1 [0074.432] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU") returned="Mcimpp.DEU" [0074.432] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.432] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.432] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.432] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.432] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="Mcimpp.ESP" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP" [0074.432] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.zip") returned 0 [0074.432] lstrlenA (lpString="*.zip") returned 5 [0074.432] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.rar") returned 0 [0074.432] lstrlenA (lpString="*.rar") returned 5 [0074.432] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.7z") returned 0 [0074.432] lstrlenA (lpString="*.7z") returned 4 [0074.432] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.tar") returned 0 [0074.432] lstrlenA (lpString="*.tar") returned 5 [0074.432] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.gzip") returned 0 [0074.432] lstrlenA (lpString="*.gzip") returned 6 [0074.432] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.jpg") returned 0 [0074.432] lstrlenA (lpString="*.jpg") returned 5 [0074.432] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.jpeg") returned 0 [0074.432] lstrlenA (lpString="*.jpeg") returned 6 [0074.432] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.psd") returned 0 [0074.432] lstrlenA (lpString="*.psd") returned 5 [0074.432] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.gif") returned 0 [0074.433] lstrlenA (lpString="*.gif") returned 5 [0074.433] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.doc") returned 0 [0074.433] lstrlenA (lpString="*.doc") returned 5 [0074.433] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.docx") returned 0 [0074.433] lstrlenA (lpString="*.docx") returned 6 [0074.433] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.xls") returned 0 [0074.433] lstrlenA (lpString="*.xls") returned 5 [0074.433] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.xlsx") returned 0 [0074.433] lstrlenA (lpString="*.xlsx") returned 6 [0074.433] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.ppt") returned 0 [0074.433] lstrlenA (lpString="*.ppt") returned 5 [0074.433] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.pptx") returned 0 [0074.433] lstrlenA (lpString="*.pptx") returned 6 [0074.433] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.pdf") returned 0 [0074.433] lstrlenA (lpString="*.pdf") returned 5 [0074.433] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.mov") returned 0 [0074.433] lstrlenA (lpString="*.mov") returned 5 [0074.433] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.m2v") returned 0 [0074.433] lstrlenA (lpString="*.m2v") returned 5 [0074.433] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.3gp") returned 0 [0074.433] lstrlenA (lpString="*.3gp") returned 5 [0074.433] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.mpeg") returned 0 [0074.433] lstrlenA (lpString="*.mpeg") returned 6 [0074.433] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.mpg") returned 0 [0074.433] lstrlenA (lpString="*.mpg") returned 5 [0074.433] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.flv") returned 0 [0074.433] lstrlenA (lpString="*.flv") returned 5 [0074.433] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.avi") returned 0 [0074.433] lstrlenA (lpString="*.avi") returned 5 [0074.433] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.mp4") returned 0 [0074.433] lstrlenA (lpString="*.mp4") returned 5 [0074.433] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.wmv") returned 0 [0074.433] lstrlenA (lpString="*.wmv") returned 5 [0074.433] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.divx") returned 0 [0074.433] lstrlenA (lpString="*.divx") returned 6 [0074.433] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.mkv") returned 0 [0074.434] lstrlenA (lpString="*.mkv") returned 5 [0074.434] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.mp3") returned 0 [0074.434] lstrlenA (lpString="*.mp3") returned 5 [0074.434] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.wav") returned 0 [0074.434] lstrlenA (lpString="*.wav") returned 5 [0074.434] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.flac") returned 0 [0074.434] lstrlenA (lpString="*.flac") returned 6 [0074.434] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.ape") returned 0 [0074.434] lstrlenA (lpString="*.ape") returned 5 [0074.434] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.wma") returned 0 [0074.434] lstrlenA (lpString="*.wma") returned 5 [0074.434] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.ac3") returned 0 [0074.434] lstrlenA (lpString="*.ac3") returned 5 [0074.434] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", pszSpec="*.mxf") returned 0 [0074.434] lstrlenA (lpString="*.mxf") returned 5 [0074.434] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Mcimpp.EUQ", cAlternateFileName="")) returned 1 [0074.434] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.434] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Mcimpp.EUQ") returned -1 [0074.434] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Mcimpp.EUQ") returned -1 [0074.434] lstrcmpiA (lpString1="", lpString2="Mcimpp.EUQ") returned -1 [0074.434] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP") returned="Mcimpp.ESP" [0074.434] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.434] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.434] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.434] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.434] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="Mcimpp.EUQ" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ" [0074.434] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.zip") returned 0 [0074.434] lstrlenA (lpString="*.zip") returned 5 [0074.434] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.rar") returned 0 [0074.434] lstrlenA (lpString="*.rar") returned 5 [0074.434] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.7z") returned 0 [0074.434] lstrlenA (lpString="*.7z") returned 4 [0074.435] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.tar") returned 0 [0074.435] lstrlenA (lpString="*.tar") returned 5 [0074.435] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.gzip") returned 0 [0074.435] lstrlenA (lpString="*.gzip") returned 6 [0074.435] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.jpg") returned 0 [0074.435] lstrlenA (lpString="*.jpg") returned 5 [0074.435] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.jpeg") returned 0 [0074.435] lstrlenA (lpString="*.jpeg") returned 6 [0074.435] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.psd") returned 0 [0074.435] lstrlenA (lpString="*.psd") returned 5 [0074.435] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.gif") returned 0 [0074.435] lstrlenA (lpString="*.gif") returned 5 [0074.435] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.doc") returned 0 [0074.435] lstrlenA (lpString="*.doc") returned 5 [0074.435] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.docx") returned 0 [0074.435] lstrlenA (lpString="*.docx") returned 6 [0074.435] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.xls") returned 0 [0074.435] lstrlenA (lpString="*.xls") returned 5 [0074.435] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.xlsx") returned 0 [0074.435] lstrlenA (lpString="*.xlsx") returned 6 [0074.435] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.ppt") returned 0 [0074.435] lstrlenA (lpString="*.ppt") returned 5 [0074.435] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.pptx") returned 0 [0074.435] lstrlenA (lpString="*.pptx") returned 6 [0074.435] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.pdf") returned 0 [0074.435] lstrlenA (lpString="*.pdf") returned 5 [0074.435] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.mov") returned 0 [0074.435] lstrlenA (lpString="*.mov") returned 5 [0074.435] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.m2v") returned 0 [0074.435] lstrlenA (lpString="*.m2v") returned 5 [0074.435] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.3gp") returned 0 [0074.435] lstrlenA (lpString="*.3gp") returned 5 [0074.435] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.mpeg") returned 0 [0074.435] lstrlenA (lpString="*.mpeg") returned 6 [0074.435] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.mpg") returned 0 [0074.435] lstrlenA (lpString="*.mpg") returned 5 [0074.435] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.flv") returned 0 [0074.436] lstrlenA (lpString="*.flv") returned 5 [0074.436] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.avi") returned 0 [0074.436] lstrlenA (lpString="*.avi") returned 5 [0074.436] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.mp4") returned 0 [0074.436] lstrlenA (lpString="*.mp4") returned 5 [0074.436] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.wmv") returned 0 [0074.436] lstrlenA (lpString="*.wmv") returned 5 [0074.436] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.divx") returned 0 [0074.436] lstrlenA (lpString="*.divx") returned 6 [0074.436] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.mkv") returned 0 [0074.436] lstrlenA (lpString="*.mkv") returned 5 [0074.436] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.mp3") returned 0 [0074.436] lstrlenA (lpString="*.mp3") returned 5 [0074.436] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.wav") returned 0 [0074.436] lstrlenA (lpString="*.wav") returned 5 [0074.436] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.flac") returned 0 [0074.436] lstrlenA (lpString="*.flac") returned 6 [0074.436] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.ape") returned 0 [0074.436] lstrlenA (lpString="*.ape") returned 5 [0074.436] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.wma") returned 0 [0074.436] lstrlenA (lpString="*.wma") returned 5 [0074.436] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.ac3") returned 0 [0074.436] lstrlenA (lpString="*.ac3") returned 5 [0074.436] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", pszSpec="*.mxf") returned 0 [0074.436] lstrlenA (lpString="*.mxf") returned 5 [0074.436] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Mcimpp.FRA", cAlternateFileName="")) returned 1 [0074.436] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.436] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Mcimpp.FRA") returned -1 [0074.436] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Mcimpp.FRA") returned -1 [0074.436] lstrcmpiA (lpString1="", lpString2="Mcimpp.FRA") returned -1 [0074.436] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ") returned="Mcimpp.EUQ" [0074.436] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.436] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.436] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.437] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.437] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="Mcimpp.FRA" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA" [0074.437] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.zip") returned 0 [0074.437] lstrlenA (lpString="*.zip") returned 5 [0074.437] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.rar") returned 0 [0074.437] lstrlenA (lpString="*.rar") returned 5 [0074.437] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.7z") returned 0 [0074.437] lstrlenA (lpString="*.7z") returned 4 [0074.437] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.tar") returned 0 [0074.437] lstrlenA (lpString="*.tar") returned 5 [0074.437] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.gzip") returned 0 [0074.437] lstrlenA (lpString="*.gzip") returned 6 [0074.437] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.jpg") returned 0 [0074.437] lstrlenA (lpString="*.jpg") returned 5 [0074.437] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.jpeg") returned 0 [0074.437] lstrlenA (lpString="*.jpeg") returned 6 [0074.437] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.psd") returned 0 [0074.437] lstrlenA (lpString="*.psd") returned 5 [0074.437] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.gif") returned 0 [0074.437] lstrlenA (lpString="*.gif") returned 5 [0074.437] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.doc") returned 0 [0074.437] lstrlenA (lpString="*.doc") returned 5 [0074.437] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.docx") returned 0 [0074.437] lstrlenA (lpString="*.docx") returned 6 [0074.437] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.xls") returned 0 [0074.437] lstrlenA (lpString="*.xls") returned 5 [0074.437] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.xlsx") returned 0 [0074.437] lstrlenA (lpString="*.xlsx") returned 6 [0074.437] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.ppt") returned 0 [0074.437] lstrlenA (lpString="*.ppt") returned 5 [0074.437] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.pptx") returned 0 [0074.438] lstrlenA (lpString="*.pptx") returned 6 [0074.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.pdf") returned 0 [0074.438] lstrlenA (lpString="*.pdf") returned 5 [0074.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.mov") returned 0 [0074.438] lstrlenA (lpString="*.mov") returned 5 [0074.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.m2v") returned 0 [0074.438] lstrlenA (lpString="*.m2v") returned 5 [0074.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.3gp") returned 0 [0074.438] lstrlenA (lpString="*.3gp") returned 5 [0074.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.mpeg") returned 0 [0074.438] lstrlenA (lpString="*.mpeg") returned 6 [0074.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.mpg") returned 0 [0074.438] lstrlenA (lpString="*.mpg") returned 5 [0074.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.flv") returned 0 [0074.438] lstrlenA (lpString="*.flv") returned 5 [0074.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.avi") returned 0 [0074.438] lstrlenA (lpString="*.avi") returned 5 [0074.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.mp4") returned 0 [0074.438] lstrlenA (lpString="*.mp4") returned 5 [0074.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.wmv") returned 0 [0074.438] lstrlenA (lpString="*.wmv") returned 5 [0074.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.divx") returned 0 [0074.438] lstrlenA (lpString="*.divx") returned 6 [0074.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.mkv") returned 0 [0074.438] lstrlenA (lpString="*.mkv") returned 5 [0074.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.mp3") returned 0 [0074.438] lstrlenA (lpString="*.mp3") returned 5 [0074.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.wav") returned 0 [0074.438] lstrlenA (lpString="*.wav") returned 5 [0074.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.flac") returned 0 [0074.438] lstrlenA (lpString="*.flac") returned 6 [0074.438] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.ape") returned 0 [0074.439] lstrlenA (lpString="*.ape") returned 5 [0074.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.wma") returned 0 [0074.439] lstrlenA (lpString="*.wma") returned 5 [0074.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.ac3") returned 0 [0074.439] lstrlenA (lpString="*.ac3") returned 5 [0074.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", pszSpec="*.mxf") returned 0 [0074.439] lstrlenA (lpString="*.mxf") returned 5 [0074.439] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Mcimpp.ITA", cAlternateFileName="")) returned 1 [0074.439] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.439] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Mcimpp.ITA") returned -1 [0074.439] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Mcimpp.ITA") returned -1 [0074.439] lstrcmpiA (lpString1="", lpString2="Mcimpp.ITA") returned -1 [0074.439] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA") returned="Mcimpp.FRA" [0074.439] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.439] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.439] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.439] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.439] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="Mcimpp.ITA" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ITA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ITA" [0074.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ITA", pszSpec="*.zip") returned 0 [0074.439] lstrlenA (lpString="*.zip") returned 5 [0074.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ITA", pszSpec="*.rar") returned 0 [0074.439] lstrlenA (lpString="*.rar") returned 5 [0074.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ITA", pszSpec="*.7z") returned 0 [0074.439] lstrlenA (lpString="*.7z") returned 4 [0074.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ITA", pszSpec="*.tar") returned 0 [0074.439] lstrlenA (lpString="*.tar") returned 5 [0074.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ITA", pszSpec="*.gzip") returned 0 [0074.439] lstrlenA (lpString="*.gzip") returned 6 [0074.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ITA", pszSpec="*.jpg") returned 0 [0074.439] lstrlenA (lpString="*.jpg") returned 5 [0074.439] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ITA", pszSpec="*.jpeg") returned 0 [0074.440] lstrlenA (lpString="*.jpeg") returned 6 [0074.440] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ITA", pszSpec="*.psd") returned 0 [0074.440] lstrlenA (lpString="*.psd") returned 5 [0074.440] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ITA", pszSpec="*.gif") returned 0 [0074.440] lstrlenA (lpString="*.gif") returned 5 [0074.440] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ITA", pszSpec="*.doc") returned 0 [0074.440] lstrlenA (lpString="*.doc") returned 5 [0074.440] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ITA", pszSpec="*.docx") returned 0 [0074.440] lstrlenA (lpString="*.docx") returned 6 [0074.440] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Mcimpp.JPN", cAlternateFileName="")) returned 1 [0074.440] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.440] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Mcimpp.JPN") returned -1 [0074.440] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Mcimpp.JPN") returned -1 [0074.440] lstrcmpiA (lpString1="", lpString2="Mcimpp.JPN") returned -1 [0074.440] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ITA") returned="Mcimpp.ITA" [0074.440] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.440] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.440] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.440] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.440] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="Mcimpp.JPN" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.JPN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.JPN" [0074.441] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Mcimpp.KOR", cAlternateFileName="")) returned 1 [0074.441] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.441] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Mcimpp.KOR") returned -1 [0074.441] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Mcimpp.KOR") returned -1 [0074.441] lstrcmpiA (lpString1="", lpString2="Mcimpp.KOR") returned -1 [0074.441] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.JPN") returned="Mcimpp.JPN" [0074.441] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.441] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.441] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.441] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.441] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="Mcimpp.KOR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.KOR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.KOR" [0074.441] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="MCIMPP.mpp", cAlternateFileName="")) returned 1 [0074.441] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.441] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MCIMPP.mpp") returned -1 [0074.441] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MCIMPP.mpp") returned -1 [0074.441] lstrcmpiA (lpString1="", lpString2="MCIMPP.mpp") returned -1 [0074.441] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.KOR") returned="Mcimpp.KOR" [0074.441] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.441] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.441] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.441] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.442] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="MCIMPP.mpp" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.mpp") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.mpp" [0074.442] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d68aea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Mcimpp.NLD", cAlternateFileName="")) returned 1 [0074.442] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.442] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Mcimpp.NLD") returned -1 [0074.442] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Mcimpp.NLD") returned -1 [0074.442] lstrcmpiA (lpString1="", lpString2="Mcimpp.NLD") returned -1 [0074.442] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.mpp") returned="MCIMPP.mpp" [0074.442] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.442] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.442] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.442] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.442] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="Mcimpp.NLD" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.NLD") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.NLD" [0074.442] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d76f6e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Mcimpp.NOR", cAlternateFileName="")) returned 1 [0074.442] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.442] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Mcimpp.NOR") returned -1 [0074.442] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Mcimpp.NOR") returned -1 [0074.442] lstrcmpiA (lpString1="", lpString2="Mcimpp.NOR") returned -1 [0074.442] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.NLD") returned="Mcimpp.NLD" [0074.442] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.442] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.442] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.442] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.442] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="Mcimpp.NOR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.NOR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.NOR" [0074.443] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="MCIMPP.PTB", cAlternateFileName="")) returned 1 [0074.443] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.443] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MCIMPP.PTB") returned -1 [0074.443] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MCIMPP.PTB") returned -1 [0074.443] lstrcmpiA (lpString1="", lpString2="MCIMPP.PTB") returned -1 [0074.443] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.NOR") returned="Mcimpp.NOR" [0074.443] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.443] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.443] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.443] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.443] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="MCIMPP.PTB" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.PTB") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.PTB" [0074.443] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="Mcimpp.SUO", cAlternateFileName="")) returned 1 [0074.443] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.443] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Mcimpp.SUO") returned -1 [0074.443] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Mcimpp.SUO") returned -1 [0074.443] lstrcmpiA (lpString1="", lpString2="Mcimpp.SUO") returned -1 [0074.443] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.PTB") returned="MCIMPP.PTB" [0074.443] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.443] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.443] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.443] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.443] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="Mcimpp.SUO" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.SUO" [0074.443] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="MCIMPP.SVE", cAlternateFileName="")) returned 1 [0074.443] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.443] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MCIMPP.SVE") returned -1 [0074.443] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MCIMPP.SVE") returned -1 [0074.444] lstrcmpiA (lpString1="", lpString2="MCIMPP.SVE") returned -1 [0074.444] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.SUO") returned="Mcimpp.SUO" [0074.444] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.444] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.444] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.444] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.444] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="MCIMPP.SVE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.SVE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.SVE" [0074.444] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="QuickTime.CAT", cAlternateFileName="QUICKT~1.CAT")) returned 1 [0074.447] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.447] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QuickTime.CAT") returned -1 [0074.447] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuickTime.CAT") returned -1 [0074.447] lstrcmpiA (lpString1="", lpString2="QuickTime.CAT") returned -1 [0074.447] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.SVE") returned="MCIMPP.SVE" [0074.447] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.447] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.447] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.447] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.447] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="QuickTime.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.CAT" [0074.447] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6d7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="QuickTime.CHS", cAlternateFileName="QUICKT~1.CHS")) returned 1 [0074.447] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.448] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QuickTime.CHS") returned -1 [0074.448] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuickTime.CHS") returned -1 [0074.448] lstrcmpiA (lpString1="", lpString2="QuickTime.CHS") returned -1 [0074.448] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.CAT") returned="QuickTime.CAT" [0074.448] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.448] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.448] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.448] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.448] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="QuickTime.CHS" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.CHS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.CHS" [0074.448] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="QuickTime.CHT", cAlternateFileName="QUICKT~1.CHT")) returned 1 [0074.448] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.448] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QuickTime.CHT") returned -1 [0074.448] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuickTime.CHT") returned -1 [0074.448] lstrcmpiA (lpString1="", lpString2="QuickTime.CHT") returned -1 [0074.448] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.CHS") returned="QuickTime.CHS" [0074.448] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.448] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.448] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.448] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.448] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="QuickTime.CHT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.CHT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.CHT" [0074.448] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d68aea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="QuickTime.DAN", cAlternateFileName="QUICKT~1.DAN")) returned 1 [0074.448] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.448] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QuickTime.DAN") returned -1 [0074.448] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuickTime.DAN") returned -1 [0074.448] lstrcmpiA (lpString1="", lpString2="QuickTime.DAN") returned -1 [0074.448] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.CHT") returned="QuickTime.CHT" [0074.449] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.449] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.449] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.449] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.449] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="QuickTime.DAN" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.DAN" [0074.449] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d749580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="QuickTime.DEU", cAlternateFileName="QUICKT~1.DEU")) returned 1 [0074.449] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.449] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QuickTime.DEU") returned -1 [0074.449] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuickTime.DEU") returned -1 [0074.449] lstrcmpiA (lpString1="", lpString2="QuickTime.DEU") returned -1 [0074.449] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.DAN") returned="QuickTime.DAN" [0074.449] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.449] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.449] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.449] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.449] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="QuickTime.DEU" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.DEU" [0074.449] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="QuickTime.ESP", cAlternateFileName="QUICKT~1.ESP")) returned 1 [0074.449] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.449] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QuickTime.ESP") returned -1 [0074.449] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuickTime.ESP") returned -1 [0074.449] lstrcmpiA (lpString1="", lpString2="QuickTime.ESP") returned -1 [0074.449] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.DEU") returned="QuickTime.DEU" [0074.449] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.449] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.449] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.450] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.450] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="QuickTime.ESP" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.ESP" [0074.450] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="QuickTime.EUQ", cAlternateFileName="QUICKT~1.EUQ")) returned 1 [0074.450] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.450] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QuickTime.EUQ") returned -1 [0074.450] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuickTime.EUQ") returned -1 [0074.450] lstrcmpiA (lpString1="", lpString2="QuickTime.EUQ") returned -1 [0074.450] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.ESP") returned="QuickTime.ESP" [0074.450] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.450] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.450] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.450] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.450] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="QuickTime.EUQ" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.EUQ" [0074.450] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="QuickTime.FRA", cAlternateFileName="QUICKT~1.FRA")) returned 1 [0074.450] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.450] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QuickTime.FRA") returned -1 [0074.450] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuickTime.FRA") returned -1 [0074.450] lstrcmpiA (lpString1="", lpString2="QuickTime.FRA") returned -1 [0074.450] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.EUQ") returned="QuickTime.EUQ" [0074.450] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.450] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.450] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.450] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.450] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="QuickTime.FRA" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.FRA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.FRA" [0074.451] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="QuickTime.ITA", cAlternateFileName="QUICKT~1.ITA")) returned 1 [0074.451] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.451] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QuickTime.ITA") returned -1 [0074.451] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuickTime.ITA") returned -1 [0074.451] lstrcmpiA (lpString1="", lpString2="QuickTime.ITA") returned -1 [0074.451] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.FRA") returned="QuickTime.FRA" [0074.451] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.451] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.451] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.451] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.451] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="QuickTime.ITA" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.ITA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.ITA" [0074.451] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="QuickTime.JPN", cAlternateFileName="QUICKT~1.JPN")) returned 1 [0074.451] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.451] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QuickTime.JPN") returned -1 [0074.451] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuickTime.JPN") returned -1 [0074.451] lstrcmpiA (lpString1="", lpString2="QuickTime.JPN") returned -1 [0074.451] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.ITA") returned="QuickTime.ITA" [0074.451] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.451] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.451] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.451] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.451] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="QuickTime.JPN" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.JPN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.JPN" [0074.451] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="QuickTime.KOR", cAlternateFileName="QUICKT~1.KOR")) returned 1 [0074.451] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.451] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QuickTime.KOR") returned -1 [0074.451] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuickTime.KOR") returned -1 [0074.451] lstrcmpiA (lpString1="", lpString2="QuickTime.KOR") returned -1 [0074.451] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.JPN") returned="QuickTime.JPN" [0074.451] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.452] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.452] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.452] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.452] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="QuickTime.KOR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.KOR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.KOR" [0074.452] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x44000, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="QuickTime.mpp", cAlternateFileName="QUICKT~1.MPP")) returned 1 [0074.452] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.452] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QuickTime.mpp") returned -1 [0074.452] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuickTime.mpp") returned -1 [0074.452] lstrcmpiA (lpString1="", lpString2="QuickTime.mpp") returned -1 [0074.452] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.KOR") returned="QuickTime.KOR" [0074.452] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.452] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.452] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.452] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.452] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="QuickTime.mpp" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.mpp") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.mpp" [0074.452] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d68aea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="QuickTime.NLD", cAlternateFileName="QUICKT~1.NLD")) returned 1 [0074.452] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.452] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QuickTime.NLD") returned -1 [0074.452] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuickTime.NLD") returned -1 [0074.452] lstrcmpiA (lpString1="", lpString2="QuickTime.NLD") returned -1 [0074.452] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.mpp") returned="QuickTime.mpp" [0074.452] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.452] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.452] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.452] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.452] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="QuickTime.NLD" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.NLD") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.NLD" [0074.453] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d76f6e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="QuickTime.NOR", cAlternateFileName="QUICKT~1.NOR")) returned 1 [0074.453] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.453] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QuickTime.NOR") returned -1 [0074.453] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuickTime.NOR") returned -1 [0074.453] lstrcmpiA (lpString1="", lpString2="QuickTime.NOR") returned -1 [0074.453] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.NLD") returned="QuickTime.NLD" [0074.453] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.453] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.453] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.453] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.453] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="QuickTime.NOR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.NOR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.NOR" [0074.453] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="QuickTime.PTB", cAlternateFileName="QUICKT~1.PTB")) returned 1 [0074.453] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.453] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QuickTime.PTB") returned -1 [0074.453] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuickTime.PTB") returned -1 [0074.453] lstrcmpiA (lpString1="", lpString2="QuickTime.PTB") returned -1 [0074.453] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.NOR") returned="QuickTime.NOR" [0074.453] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.453] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.453] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.453] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.453] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="QuickTime.PTB" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.PTB") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.PTB" [0074.454] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="QuickTime.SUO", cAlternateFileName="QUICKT~1.SUO")) returned 1 [0074.454] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.454] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QuickTime.SUO") returned -1 [0074.454] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuickTime.SUO") returned -1 [0074.454] lstrcmpiA (lpString1="", lpString2="QuickTime.SUO") returned -1 [0074.454] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.PTB") returned="QuickTime.PTB" [0074.454] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.454] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.454] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.454] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.454] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="QuickTime.SUO" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.SUO" [0074.454] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="QuickTime.SVE", cAlternateFileName="QUICKT~1.SVE")) returned 1 [0074.454] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.454] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QuickTime.SVE") returned -1 [0074.454] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuickTime.SVE") returned -1 [0074.454] lstrcmpiA (lpString1="", lpString2="QuickTime.SVE") returned -1 [0074.454] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.SUO") returned="QuickTime.SUO" [0074.454] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.454] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.454] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.454] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.454] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="QuickTime.SVE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.SVE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.SVE" [0074.455] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="WindowsMedia.CAT", cAlternateFileName="WINDOW~1.CAT")) returned 1 [0074.455] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.455] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMedia.CAT") returned -1 [0074.455] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMedia.CAT") returned -1 [0074.455] lstrcmpiA (lpString1="", lpString2="WindowsMedia.CAT") returned -1 [0074.455] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.SVE") returned="QuickTime.SVE" [0074.455] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.455] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.455] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.455] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.455] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="WindowsMedia.CAT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.CAT" [0074.455] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6d7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="WindowsMedia.CHS", cAlternateFileName="WINDOW~1.CHS")) returned 1 [0074.455] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.455] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMedia.CHS") returned -1 [0074.455] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMedia.CHS") returned -1 [0074.455] lstrcmpiA (lpString1="", lpString2="WindowsMedia.CHS") returned -1 [0074.455] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.CAT") returned="WindowsMedia.CAT" [0074.455] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.455] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.455] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.455] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.455] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="WindowsMedia.CHS" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.CHS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.CHS" [0074.455] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="WindowsMedia.CHT", cAlternateFileName="WINDOW~1.CHT")) returned 1 [0074.456] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.456] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMedia.CHT") returned -1 [0074.456] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMedia.CHT") returned -1 [0074.456] lstrcmpiA (lpString1="", lpString2="WindowsMedia.CHT") returned -1 [0074.456] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.CHS") returned="WindowsMedia.CHS" [0074.456] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.456] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.456] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.456] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.456] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="WindowsMedia.CHT" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.CHT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.CHT" [0074.456] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d68aea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="WindowsMedia.DAN", cAlternateFileName="WINDOW~1.DAN")) returned 1 [0074.456] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.456] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMedia.DAN") returned -1 [0074.456] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMedia.DAN") returned -1 [0074.456] lstrcmpiA (lpString1="", lpString2="WindowsMedia.DAN") returned -1 [0074.456] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.CHT") returned="WindowsMedia.CHT" [0074.456] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.456] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.456] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.456] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.456] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="WindowsMedia.DAN" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.DAN" [0074.456] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d749580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="WindowsMedia.DEU", cAlternateFileName="WINDOW~1.DEU")) returned 1 [0074.457] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.457] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMedia.DEU") returned -1 [0074.457] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMedia.DEU") returned -1 [0074.457] lstrcmpiA (lpString1="", lpString2="WindowsMedia.DEU") returned -1 [0074.457] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.DAN") returned="WindowsMedia.DAN" [0074.457] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.457] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.457] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.457] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.457] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="WindowsMedia.DEU" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.DEU" [0074.457] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="WindowsMedia.ESP", cAlternateFileName="WINDOW~1.ESP")) returned 1 [0074.457] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.457] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMedia.ESP") returned -1 [0074.457] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMedia.ESP") returned -1 [0074.457] lstrcmpiA (lpString1="", lpString2="WindowsMedia.ESP") returned -1 [0074.457] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.DEU") returned="WindowsMedia.DEU" [0074.457] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.457] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.457] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.457] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.457] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="WindowsMedia.ESP" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.ESP" [0074.457] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="WindowsMedia.EUQ", cAlternateFileName="WINDOW~1.EUQ")) returned 1 [0074.457] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.457] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMedia.EUQ") returned -1 [0074.457] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMedia.EUQ") returned -1 [0074.457] lstrcmpiA (lpString1="", lpString2="WindowsMedia.EUQ") returned -1 [0074.457] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.ESP") returned="WindowsMedia.ESP" [0074.458] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.458] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.458] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.458] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.458] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="WindowsMedia.EUQ" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.EUQ" [0074.458] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="WindowsMedia.FRA", cAlternateFileName="WINDOW~1.FRA")) returned 1 [0074.458] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.458] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMedia.FRA") returned -1 [0074.458] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMedia.FRA") returned -1 [0074.458] lstrcmpiA (lpString1="", lpString2="WindowsMedia.FRA") returned -1 [0074.458] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.EUQ") returned="WindowsMedia.EUQ" [0074.458] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.458] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.458] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.458] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.458] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="WindowsMedia.FRA" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.FRA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.FRA" [0074.458] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="WindowsMedia.ITA", cAlternateFileName="WINDOW~1.ITA")) returned 1 [0074.458] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.458] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMedia.ITA") returned -1 [0074.458] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMedia.ITA") returned -1 [0074.458] lstrcmpiA (lpString1="", lpString2="WindowsMedia.ITA") returned -1 [0074.458] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.FRA") returned="WindowsMedia.FRA" [0074.458] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.458] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.458] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.458] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.458] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="WindowsMedia.ITA" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.ITA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.ITA" [0074.459] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="WindowsMedia.JPN", cAlternateFileName="WINDOW~1.JPN")) returned 1 [0074.459] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.459] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMedia.JPN") returned -1 [0074.459] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMedia.JPN") returned -1 [0074.459] lstrcmpiA (lpString1="", lpString2="WindowsMedia.JPN") returned -1 [0074.459] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.ITA") returned="WindowsMedia.ITA" [0074.459] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.459] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.459] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.459] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.459] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="WindowsMedia.JPN" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.JPN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.JPN" [0074.459] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6fd2c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="WindowsMedia.KOR", cAlternateFileName="WINDOW~1.KOR")) returned 1 [0074.459] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.459] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMedia.KOR") returned -1 [0074.459] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMedia.KOR") returned -1 [0074.459] lstrcmpiA (lpString1="", lpString2="WindowsMedia.KOR") returned -1 [0074.459] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.JPN") returned="WindowsMedia.JPN" [0074.459] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.459] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.459] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.459] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.459] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="WindowsMedia.KOR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.KOR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.KOR" [0074.459] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d723420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x35400, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="WindowsMedia.mpp", cAlternateFileName="WINDOW~1.MPP")) returned 1 [0074.459] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.459] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMedia.mpp") returned -1 [0074.459] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMedia.mpp") returned -1 [0074.459] lstrcmpiA (lpString1="", lpString2="WindowsMedia.mpp") returned -1 [0074.459] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.KOR") returned="WindowsMedia.KOR" [0074.459] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.460] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.460] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.460] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.460] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="WindowsMedia.mpp" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.mpp") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.mpp" [0074.460] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d6d7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="WindowsMedia.NLD", cAlternateFileName="WINDOW~1.NLD")) returned 1 [0074.460] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.460] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMedia.NLD") returned -1 [0074.460] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMedia.NLD") returned -1 [0074.460] lstrcmpiA (lpString1="", lpString2="WindowsMedia.NLD") returned -1 [0074.460] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.mpp") returned="WindowsMedia.mpp" [0074.460] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.460] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.460] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.460] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.460] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="WindowsMedia.NLD" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.NLD") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.NLD" [0074.460] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d76f6e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="WindowsMedia.NOR", cAlternateFileName="WINDOW~1.NOR")) returned 1 [0074.460] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.460] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMedia.NOR") returned -1 [0074.460] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMedia.NOR") returned -1 [0074.460] lstrcmpiA (lpString1="", lpString2="WindowsMedia.NOR") returned -1 [0074.460] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.NLD") returned="WindowsMedia.NLD" [0074.460] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.460] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.460] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.460] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.460] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="WindowsMedia.NOR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.NOR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.NOR" [0074.461] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="WindowsMedia.PTB", cAlternateFileName="WINDOW~1.PTB")) returned 1 [0074.461] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.461] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMedia.PTB") returned -1 [0074.461] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMedia.PTB") returned -1 [0074.461] lstrcmpiA (lpString1="", lpString2="WindowsMedia.PTB") returned -1 [0074.461] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.NOR") returned="WindowsMedia.NOR" [0074.461] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.461] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.461] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.461] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.461] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="WindowsMedia.PTB" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.PTB") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.PTB" [0074.461] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d664d40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="WindowsMedia.SUO", cAlternateFileName="WINDOW~1.SUO")) returned 1 [0074.461] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.461] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMedia.SUO") returned -1 [0074.461] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMedia.SUO") returned -1 [0074.461] lstrcmpiA (lpString1="", lpString2="WindowsMedia.SUO") returned -1 [0074.461] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.PTB") returned="WindowsMedia.PTB" [0074.461] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.461] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.461] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.461] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.461] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="WindowsMedia.SUO" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.SUO" [0074.462] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="WindowsMedia.SVE", cAlternateFileName="WINDOW~1.SVE")) returned 1 [0074.462] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.462] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMedia.SVE") returned -1 [0074.462] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMedia.SVE") returned -1 [0074.462] lstrcmpiA (lpString1="", lpString2="WindowsMedia.SVE") returned -1 [0074.462] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.SUO") returned="WindowsMedia.SUO" [0074.462] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0074.462] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="" [0074.462] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" [0074.462] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\how to decrypt files.txt")) returned 0x20 [0074.462] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\", lpString2="WindowsMedia.SVE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.SVE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.SVE" [0074.462] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d795840, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x540050, dwReserved1=0x460020, cFileName="WindowsMedia.SVE", cAlternateFileName="WINDOW~1.SVE")) returned 0 [0074.462] FindClose (in: hFindFile=0x2e3578 | out: hFindFile=0x2e3578) returned 1 [0074.462] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="MPP_CZE", cAlternateFileName="")) returned 1 [0074.462] lstrcmpA (lpString1=".", lpString2="MPP_CZE") returned -1 [0074.462] lstrcmpA (lpString1="..", lpString2="MPP_CZE") returned -1 [0074.462] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*.*") returned="*.*" [0074.462] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\", lpString2="MPP_CZE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE" [0074.462] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540050, dwReserved1=0x460020, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0074.474] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.475] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x460000, cFileName="..", cAlternateFileName="")) returned 1 [0074.475] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.475] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.477] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Flash.CZE", cAlternateFileName="")) returned 1 [0074.477] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.477] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Flash.CZE") returned -1 [0074.477] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Flash.CZE") returned 1 [0074.477] lstrcmpiA (lpString1="", lpString2="Flash.CZE") returned -1 [0074.478] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\*.*") returned="*.*" [0074.478] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\" [0074.478] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\") returned="" [0074.478] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\HOW TO DECRYPT FILES.txt" [0074.478] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\how to decrypt files.txt")) returned 0xffffffff [0074.480] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0074.487] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.487] CloseHandle (hObject=0x98) returned 1 [0074.487] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\", lpString2="Flash.CZE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\Flash.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\Flash.CZE" [0074.487] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.CZE", cAlternateFileName="")) returned 1 [0074.488] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.488] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Mcimpp.CZE") returned -1 [0074.488] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Mcimpp.CZE") returned -1 [0074.488] lstrcmpiA (lpString1="", lpString2="Mcimpp.CZE") returned -1 [0074.488] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\Flash.CZE") returned="Flash.CZE" [0074.488] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\" [0074.488] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\") returned="" [0074.488] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\HOW TO DECRYPT FILES.txt" [0074.488] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\how to decrypt files.txt")) returned 0x20 [0074.488] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\", lpString2="Mcimpp.CZE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\Mcimpp.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\Mcimpp.CZE" [0074.488] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="QuickTime.CZE", cAlternateFileName="QUICKT~1.CZE")) returned 1 [0074.488] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.488] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QuickTime.CZE") returned -1 [0074.488] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuickTime.CZE") returned -1 [0074.488] lstrcmpiA (lpString1="", lpString2="QuickTime.CZE") returned -1 [0074.488] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\Mcimpp.CZE") returned="Mcimpp.CZE" [0074.488] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\" [0074.488] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\") returned="" [0074.488] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\HOW TO DECRYPT FILES.txt" [0074.488] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\how to decrypt files.txt")) returned 0x20 [0074.488] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\", lpString2="QuickTime.CZE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\QuickTime.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\QuickTime.CZE" [0074.488] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="WindowsMedia.CZE", cAlternateFileName="WINDOW~1.CZE")) returned 1 [0074.488] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.488] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMedia.CZE") returned -1 [0074.488] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMedia.CZE") returned -1 [0074.489] lstrcmpiA (lpString1="", lpString2="WindowsMedia.CZE") returned -1 [0074.489] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\QuickTime.CZE") returned="QuickTime.CZE" [0074.489] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\" [0074.489] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\") returned="" [0074.489] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\HOW TO DECRYPT FILES.txt" [0074.489] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_cze\\how to decrypt files.txt")) returned 0x20 [0074.489] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\", lpString2="WindowsMedia.CZE" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\WindowsMedia.CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\WindowsMedia.CZE" [0074.489] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="WindowsMedia.CZE", cAlternateFileName="WINDOW~1.CZE")) returned 0 [0074.489] FindClose (in: hFindFile=0x2e3578 | out: hFindFile=0x2e3578) returned 1 [0074.489] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="MPP_HRV", cAlternateFileName="")) returned 1 [0074.489] lstrcmpA (lpString1=".", lpString2="MPP_HRV") returned -1 [0074.489] lstrcmpA (lpString1="..", lpString2="MPP_HRV") returned -1 [0074.489] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*.*") returned="*.*" [0074.489] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\", lpString2="MPP_HRV" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV" [0074.489] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0074.496] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.496] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x590000, cFileName="..", cAlternateFileName="")) returned 1 [0074.496] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.496] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.496] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Flash.HRV", cAlternateFileName="")) returned 1 [0074.496] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.496] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Flash.HRV") returned -1 [0074.497] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Flash.HRV") returned 1 [0074.497] lstrcmpiA (lpString1="", lpString2="Flash.HRV") returned -1 [0074.497] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\*.*") returned="*.*" [0074.497] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\" [0074.497] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\") returned="" [0074.497] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\HOW TO DECRYPT FILES.txt" [0074.497] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\how to decrypt files.txt")) returned 0xffffffff [0074.497] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0074.518] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.518] CloseHandle (hObject=0x98) returned 1 [0074.518] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\", lpString2="Flash.HRV" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\Flash.HRV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\Flash.HRV" [0074.518] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIMPP.HRV", cAlternateFileName="")) returned 1 [0074.518] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.518] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MCIMPP.HRV") returned -1 [0074.518] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MCIMPP.HRV") returned -1 [0074.518] lstrcmpiA (lpString1="", lpString2="MCIMPP.HRV") returned -1 [0074.518] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\Flash.HRV") returned="Flash.HRV" [0074.518] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\" [0074.518] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\") returned="" [0074.518] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\HOW TO DECRYPT FILES.txt" [0074.518] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\how to decrypt files.txt")) returned 0x20 [0074.518] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\", lpString2="MCIMPP.HRV" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\MCIMPP.HRV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\MCIMPP.HRV" [0074.519] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="QuickTime.HRV", cAlternateFileName="QUICKT~1.HRV")) returned 1 [0074.519] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.519] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QuickTime.HRV") returned -1 [0074.519] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuickTime.HRV") returned -1 [0074.519] lstrcmpiA (lpString1="", lpString2="QuickTime.HRV") returned -1 [0074.519] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\MCIMPP.HRV") returned="MCIMPP.HRV" [0074.519] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\" [0074.519] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\") returned="" [0074.519] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\HOW TO DECRYPT FILES.txt" [0074.519] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\how to decrypt files.txt")) returned 0x20 [0074.519] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\", lpString2="QuickTime.HRV" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\QuickTime.HRV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\QuickTime.HRV" [0074.519] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="WindowsMedia.HRV", cAlternateFileName="WINDOW~1.HRV")) returned 1 [0074.519] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.519] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\QuickTime.HRV") returned="QuickTime.HRV" [0074.519] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\" [0074.519] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\") returned="" [0074.519] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\HOW TO DECRYPT FILES.txt" [0074.519] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hrv\\how to decrypt files.txt")) returned 0x20 [0074.519] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\", lpString2="WindowsMedia.HRV" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\WindowsMedia.HRV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\WindowsMedia.HRV" [0074.519] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="WindowsMedia.HRV", cAlternateFileName="WINDOW~1.HRV")) returned 0 [0074.519] FindClose (in: hFindFile=0x2e3578 | out: hFindFile=0x2e3578) returned 1 [0074.519] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="MPP_HUN", cAlternateFileName="")) returned 1 [0074.520] lstrcmpA (lpString1=".", lpString2="MPP_HUN") returned -1 [0074.520] lstrcmpA (lpString1="..", lpString2="MPP_HUN") returned -1 [0074.520] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*.*") returned="*.*" [0074.520] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\", lpString2="MPP_HUN" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN" [0074.520] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0074.523] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.523] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x590000, cFileName="..", cAlternateFileName="")) returned 1 [0074.523] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.523] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.523] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Flash.HUN", cAlternateFileName="")) returned 1 [0074.523] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.523] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\*.*") returned="*.*" [0074.523] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\" [0074.523] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\") returned="" [0074.523] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\HOW TO DECRYPT FILES.txt" [0074.523] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\how to decrypt files.txt")) returned 0xffffffff [0074.523] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0074.527] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.527] CloseHandle (hObject=0x98) returned 1 [0074.527] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\", lpString2="Flash.HUN" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\Flash.HUN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\Flash.HUN" [0074.527] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.HUN", cAlternateFileName="")) returned 1 [0074.527] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.527] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\Flash.HUN") returned="Flash.HUN" [0074.527] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\" [0074.527] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\") returned="" [0074.527] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\HOW TO DECRYPT FILES.txt" [0074.527] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\how to decrypt files.txt")) returned 0x20 [0074.527] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\", lpString2="Mcimpp.HUN" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\Mcimpp.HUN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\Mcimpp.HUN" [0074.527] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="QuickTime.HUN", cAlternateFileName="QUICKT~1.HUN")) returned 1 [0074.528] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.528] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\Mcimpp.HUN") returned="Mcimpp.HUN" [0074.528] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\" [0074.528] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\") returned="" [0074.528] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\HOW TO DECRYPT FILES.txt" [0074.528] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\how to decrypt files.txt")) returned 0x20 [0074.528] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\", lpString2="QuickTime.HUN" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\QuickTime.HUN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\QuickTime.HUN" [0074.528] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="WindowsMedia.HUN", cAlternateFileName="WINDOW~1.HUN")) returned 1 [0074.528] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.528] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\QuickTime.HUN") returned="QuickTime.HUN" [0074.528] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\" [0074.528] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\") returned="" [0074.528] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\HOW TO DECRYPT FILES.txt" [0074.528] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\how to decrypt files.txt")) returned 0x20 [0074.528] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\", lpString2="WindowsMedia.HUN" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\WindowsMedia.HUN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\WindowsMedia.HUN" [0074.528] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="WindowsMedia.HUN", cAlternateFileName="WINDOW~1.HUN")) returned 0 [0074.528] FindClose (in: hFindFile=0x2e3578 | out: hFindFile=0x2e3578) returned 1 [0074.528] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="MPP_POL", cAlternateFileName="")) returned 1 [0074.528] lstrcmpA (lpString1=".", lpString2="MPP_POL") returned -1 [0074.528] lstrcmpA (lpString1="..", lpString2="MPP_POL") returned -1 [0074.528] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*.*") returned="*.*" [0074.528] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\", lpString2="MPP_POL" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL" [0074.528] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0074.530] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.530] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x590000, cFileName="..", cAlternateFileName="")) returned 1 [0074.530] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.530] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.530] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Flash.POL", cAlternateFileName="")) returned 1 [0074.530] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.531] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\*.*") returned="*.*" [0074.531] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\" [0074.531] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\") returned="" [0074.532] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\HOW TO DECRYPT FILES.txt" [0074.532] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\how to decrypt files.txt")) returned 0xffffffff [0074.532] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0074.537] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.537] CloseHandle (hObject=0x98) returned 1 [0074.538] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\", lpString2="Flash.POL" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Flash.POL") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Flash.POL" [0074.538] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.POL", cAlternateFileName="")) returned 1 [0074.538] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.538] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Flash.POL") returned="Flash.POL" [0074.538] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\" [0074.538] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\") returned="" [0074.538] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\HOW TO DECRYPT FILES.txt" [0074.538] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\how to decrypt files.txt")) returned 0x20 [0074.538] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\", lpString2="Mcimpp.POL" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL" [0074.538] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.zip") returned 0 [0074.538] lstrlenA (lpString="*.zip") returned 5 [0074.538] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.rar") returned 0 [0074.538] lstrlenA (lpString="*.rar") returned 5 [0074.538] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.7z") returned 0 [0074.539] lstrlenA (lpString="*.7z") returned 4 [0074.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.tar") returned 0 [0074.539] lstrlenA (lpString="*.tar") returned 5 [0074.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.gzip") returned 0 [0074.539] lstrlenA (lpString="*.gzip") returned 6 [0074.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.jpg") returned 0 [0074.539] lstrlenA (lpString="*.jpg") returned 5 [0074.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.jpeg") returned 0 [0074.539] lstrlenA (lpString="*.jpeg") returned 6 [0074.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.psd") returned 0 [0074.539] lstrlenA (lpString="*.psd") returned 5 [0074.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.gif") returned 0 [0074.539] lstrlenA (lpString="*.gif") returned 5 [0074.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.doc") returned 0 [0074.539] lstrlenA (lpString="*.doc") returned 5 [0074.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.docx") returned 0 [0074.539] lstrlenA (lpString="*.docx") returned 6 [0074.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.xls") returned 0 [0074.539] lstrlenA (lpString="*.xls") returned 5 [0074.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.xlsx") returned 0 [0074.539] lstrlenA (lpString="*.xlsx") returned 6 [0074.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.ppt") returned 0 [0074.539] lstrlenA (lpString="*.ppt") returned 5 [0074.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.pptx") returned 0 [0074.539] lstrlenA (lpString="*.pptx") returned 6 [0074.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.pdf") returned 0 [0074.539] lstrlenA (lpString="*.pdf") returned 5 [0074.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.mov") returned 0 [0074.539] lstrlenA (lpString="*.mov") returned 5 [0074.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.m2v") returned 0 [0074.539] lstrlenA (lpString="*.m2v") returned 5 [0074.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.3gp") returned 0 [0074.539] lstrlenA (lpString="*.3gp") returned 5 [0074.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.mpeg") returned 0 [0074.539] lstrlenA (lpString="*.mpeg") returned 6 [0074.539] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.mpg") returned 0 [0074.540] lstrlenA (lpString="*.mpg") returned 5 [0074.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.flv") returned 0 [0074.540] lstrlenA (lpString="*.flv") returned 5 [0074.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.avi") returned 0 [0074.540] lstrlenA (lpString="*.avi") returned 5 [0074.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.mp4") returned 0 [0074.540] lstrlenA (lpString="*.mp4") returned 5 [0074.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.wmv") returned 0 [0074.540] lstrlenA (lpString="*.wmv") returned 5 [0074.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.divx") returned 0 [0074.540] lstrlenA (lpString="*.divx") returned 6 [0074.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.mkv") returned 0 [0074.540] lstrlenA (lpString="*.mkv") returned 5 [0074.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.mp3") returned 0 [0074.540] lstrlenA (lpString="*.mp3") returned 5 [0074.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.wav") returned 0 [0074.540] lstrlenA (lpString="*.wav") returned 5 [0074.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.flac") returned 0 [0074.540] lstrlenA (lpString="*.flac") returned 6 [0074.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.ape") returned 0 [0074.540] lstrlenA (lpString="*.ape") returned 5 [0074.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.wma") returned 0 [0074.540] lstrlenA (lpString="*.wma") returned 5 [0074.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.ac3") returned 0 [0074.540] lstrlenA (lpString="*.ac3") returned 5 [0074.540] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL", pszSpec="*.mxf") returned 0 [0074.540] lstrlenA (lpString="*.mxf") returned 5 [0074.540] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="QuickTime.POL", cAlternateFileName="QUICKT~1.POL")) returned 1 [0074.540] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.540] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QuickTime.POL") returned -1 [0074.540] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuickTime.POL") returned -1 [0074.540] lstrcmpiA (lpString1="", lpString2="QuickTime.POL") returned -1 [0074.540] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\Mcimpp.POL") returned="Mcimpp.POL" [0074.540] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\" [0074.540] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\") returned="" [0074.540] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\HOW TO DECRYPT FILES.txt" [0074.541] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\how to decrypt files.txt")) returned 0x20 [0074.541] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\", lpString2="QuickTime.POL" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL" [0074.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.zip") returned 0 [0074.541] lstrlenA (lpString="*.zip") returned 5 [0074.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.rar") returned 0 [0074.541] lstrlenA (lpString="*.rar") returned 5 [0074.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.7z") returned 0 [0074.541] lstrlenA (lpString="*.7z") returned 4 [0074.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.tar") returned 0 [0074.541] lstrlenA (lpString="*.tar") returned 5 [0074.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.gzip") returned 0 [0074.541] lstrlenA (lpString="*.gzip") returned 6 [0074.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.jpg") returned 0 [0074.541] lstrlenA (lpString="*.jpg") returned 5 [0074.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.jpeg") returned 0 [0074.541] lstrlenA (lpString="*.jpeg") returned 6 [0074.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.psd") returned 0 [0074.541] lstrlenA (lpString="*.psd") returned 5 [0074.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.gif") returned 0 [0074.541] lstrlenA (lpString="*.gif") returned 5 [0074.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.doc") returned 0 [0074.541] lstrlenA (lpString="*.doc") returned 5 [0074.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.docx") returned 0 [0074.541] lstrlenA (lpString="*.docx") returned 6 [0074.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.xls") returned 0 [0074.541] lstrlenA (lpString="*.xls") returned 5 [0074.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.xlsx") returned 0 [0074.541] lstrlenA (lpString="*.xlsx") returned 6 [0074.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.ppt") returned 0 [0074.541] lstrlenA (lpString="*.ppt") returned 5 [0074.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.pptx") returned 0 [0074.541] lstrlenA (lpString="*.pptx") returned 6 [0074.541] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.pdf") returned 0 [0074.542] lstrlenA (lpString="*.pdf") returned 5 [0074.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.mov") returned 0 [0074.542] lstrlenA (lpString="*.mov") returned 5 [0074.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.m2v") returned 0 [0074.542] lstrlenA (lpString="*.m2v") returned 5 [0074.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.3gp") returned 0 [0074.542] lstrlenA (lpString="*.3gp") returned 5 [0074.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.mpeg") returned 0 [0074.542] lstrlenA (lpString="*.mpeg") returned 6 [0074.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.mpg") returned 0 [0074.542] lstrlenA (lpString="*.mpg") returned 5 [0074.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.flv") returned 0 [0074.542] lstrlenA (lpString="*.flv") returned 5 [0074.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.avi") returned 0 [0074.542] lstrlenA (lpString="*.avi") returned 5 [0074.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.mp4") returned 0 [0074.542] lstrlenA (lpString="*.mp4") returned 5 [0074.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.wmv") returned 0 [0074.542] lstrlenA (lpString="*.wmv") returned 5 [0074.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.divx") returned 0 [0074.542] lstrlenA (lpString="*.divx") returned 6 [0074.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.mkv") returned 0 [0074.542] lstrlenA (lpString="*.mkv") returned 5 [0074.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.mp3") returned 0 [0074.542] lstrlenA (lpString="*.mp3") returned 5 [0074.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.wav") returned 0 [0074.542] lstrlenA (lpString="*.wav") returned 5 [0074.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.flac") returned 0 [0074.542] lstrlenA (lpString="*.flac") returned 6 [0074.542] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.ape") returned 0 [0074.542] lstrlenA (lpString="*.ape") returned 5 [0074.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.wma") returned 0 [0074.543] lstrlenA (lpString="*.wma") returned 5 [0074.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.ac3") returned 0 [0074.543] lstrlenA (lpString="*.ac3") returned 5 [0074.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL", pszSpec="*.mxf") returned 0 [0074.543] lstrlenA (lpString="*.mxf") returned 5 [0074.543] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="WindowsMedia.POL", cAlternateFileName="WINDOW~1.POL")) returned 1 [0074.543] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.543] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMedia.POL") returned -1 [0074.543] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMedia.POL") returned -1 [0074.543] lstrcmpiA (lpString1="", lpString2="WindowsMedia.POL") returned -1 [0074.543] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\QuickTime.POL") returned="QuickTime.POL" [0074.543] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\" [0074.543] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\") returned="" [0074.543] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\HOW TO DECRYPT FILES.txt" [0074.543] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_pol\\how to decrypt files.txt")) returned 0x20 [0074.543] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\", lpString2="WindowsMedia.POL" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL" [0074.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.zip") returned 0 [0074.543] lstrlenA (lpString="*.zip") returned 5 [0074.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.rar") returned 0 [0074.543] lstrlenA (lpString="*.rar") returned 5 [0074.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.7z") returned 0 [0074.543] lstrlenA (lpString="*.7z") returned 4 [0074.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.tar") returned 0 [0074.543] lstrlenA (lpString="*.tar") returned 5 [0074.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.gzip") returned 0 [0074.543] lstrlenA (lpString="*.gzip") returned 6 [0074.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.jpg") returned 0 [0074.543] lstrlenA (lpString="*.jpg") returned 5 [0074.543] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.jpeg") returned 0 [0074.544] lstrlenA (lpString="*.jpeg") returned 6 [0074.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.psd") returned 0 [0074.544] lstrlenA (lpString="*.psd") returned 5 [0074.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.gif") returned 0 [0074.544] lstrlenA (lpString="*.gif") returned 5 [0074.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.doc") returned 0 [0074.544] lstrlenA (lpString="*.doc") returned 5 [0074.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.docx") returned 0 [0074.544] lstrlenA (lpString="*.docx") returned 6 [0074.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.xls") returned 0 [0074.544] lstrlenA (lpString="*.xls") returned 5 [0074.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.xlsx") returned 0 [0074.544] lstrlenA (lpString="*.xlsx") returned 6 [0074.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.ppt") returned 0 [0074.544] lstrlenA (lpString="*.ppt") returned 5 [0074.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.pptx") returned 0 [0074.544] lstrlenA (lpString="*.pptx") returned 6 [0074.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.pdf") returned 0 [0074.544] lstrlenA (lpString="*.pdf") returned 5 [0074.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.mov") returned 0 [0074.544] lstrlenA (lpString="*.mov") returned 5 [0074.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.m2v") returned 0 [0074.544] lstrlenA (lpString="*.m2v") returned 5 [0074.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.3gp") returned 0 [0074.544] lstrlenA (lpString="*.3gp") returned 5 [0074.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.mpeg") returned 0 [0074.544] lstrlenA (lpString="*.mpeg") returned 6 [0074.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.mpg") returned 0 [0074.544] lstrlenA (lpString="*.mpg") returned 5 [0074.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.flv") returned 0 [0074.544] lstrlenA (lpString="*.flv") returned 5 [0074.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.avi") returned 0 [0074.544] lstrlenA (lpString="*.avi") returned 5 [0074.544] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.mp4") returned 0 [0074.545] lstrlenA (lpString="*.mp4") returned 5 [0074.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.wmv") returned 0 [0074.545] lstrlenA (lpString="*.wmv") returned 5 [0074.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.divx") returned 0 [0074.545] lstrlenA (lpString="*.divx") returned 6 [0074.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.mkv") returned 0 [0074.545] lstrlenA (lpString="*.mkv") returned 5 [0074.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.mp3") returned 0 [0074.545] lstrlenA (lpString="*.mp3") returned 5 [0074.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.wav") returned 0 [0074.545] lstrlenA (lpString="*.wav") returned 5 [0074.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.flac") returned 0 [0074.545] lstrlenA (lpString="*.flac") returned 6 [0074.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.ape") returned 0 [0074.545] lstrlenA (lpString="*.ape") returned 5 [0074.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.wma") returned 0 [0074.545] lstrlenA (lpString="*.wma") returned 5 [0074.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.ac3") returned 0 [0074.545] lstrlenA (lpString="*.ac3") returned 5 [0074.545] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\WindowsMedia.POL", pszSpec="*.mxf") returned 0 [0074.545] lstrlenA (lpString="*.mxf") returned 5 [0074.545] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="WindowsMedia.POL", cAlternateFileName="WINDOW~1.POL")) returned 0 [0074.545] FindClose (in: hFindFile=0x2e3578 | out: hFindFile=0x2e3578) returned 1 [0074.545] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="MPP_RUM", cAlternateFileName="")) returned 1 [0074.545] lstrcmpA (lpString1=".", lpString2="MPP_RUM") returned -1 [0074.545] lstrcmpA (lpString1="..", lpString2="MPP_RUM") returned -1 [0074.545] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*.*") returned="*.*" [0074.545] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\", lpString2="MPP_RUM" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM" [0074.545] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM") returned 75 [0074.545] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0074.548] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.548] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x590000, cFileName="..", cAlternateFileName="")) returned 1 [0074.548] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.548] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.548] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Flash.RUM", cAlternateFileName="")) returned 1 [0074.548] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.548] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Flash.RUM") returned -1 [0074.548] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Flash.RUM") returned 1 [0074.548] lstrcmpiA (lpString1="", lpString2="Flash.RUM") returned -1 [0074.548] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\*.*") returned="*.*" [0074.548] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\" [0074.548] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\") returned="" [0074.548] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\HOW TO DECRYPT FILES.txt" [0074.548] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\how to decrypt files.txt")) returned 0xffffffff [0074.548] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0074.551] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0074.551] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0074.552] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.553] CloseHandle (hObject=0x98) returned 1 [0074.553] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\", lpString2="Flash.RUM" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM" [0074.553] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.zip") returned 0 [0074.553] lstrlenA (lpString="*.zip") returned 5 [0074.553] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.rar") returned 0 [0074.553] lstrlenA (lpString="*.rar") returned 5 [0074.553] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.7z") returned 0 [0074.553] lstrlenA (lpString="*.7z") returned 4 [0074.553] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.tar") returned 0 [0074.553] lstrlenA (lpString="*.tar") returned 5 [0074.553] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.gzip") returned 0 [0074.553] lstrlenA (lpString="*.gzip") returned 6 [0074.553] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.jpg") returned 0 [0074.553] lstrlenA (lpString="*.jpg") returned 5 [0074.553] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.jpeg") returned 0 [0074.553] lstrlenA (lpString="*.jpeg") returned 6 [0074.553] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.psd") returned 0 [0074.553] lstrlenA (lpString="*.psd") returned 5 [0074.553] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.gif") returned 0 [0074.553] lstrlenA (lpString="*.gif") returned 5 [0074.553] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.doc") returned 0 [0074.553] lstrlenA (lpString="*.doc") returned 5 [0074.553] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.docx") returned 0 [0074.553] lstrlenA (lpString="*.docx") returned 6 [0074.553] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.xls") returned 0 [0074.553] lstrlenA (lpString="*.xls") returned 5 [0074.553] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.xlsx") returned 0 [0074.554] lstrlenA (lpString="*.xlsx") returned 6 [0074.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.ppt") returned 0 [0074.554] lstrlenA (lpString="*.ppt") returned 5 [0074.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.pptx") returned 0 [0074.554] lstrlenA (lpString="*.pptx") returned 6 [0074.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.pdf") returned 0 [0074.554] lstrlenA (lpString="*.pdf") returned 5 [0074.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.mov") returned 0 [0074.554] lstrlenA (lpString="*.mov") returned 5 [0074.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.m2v") returned 0 [0074.554] lstrlenA (lpString="*.m2v") returned 5 [0074.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.3gp") returned 0 [0074.554] lstrlenA (lpString="*.3gp") returned 5 [0074.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.mpeg") returned 0 [0074.554] lstrlenA (lpString="*.mpeg") returned 6 [0074.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.mpg") returned 0 [0074.554] lstrlenA (lpString="*.mpg") returned 5 [0074.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.flv") returned 0 [0074.554] lstrlenA (lpString="*.flv") returned 5 [0074.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.avi") returned 0 [0074.554] lstrlenA (lpString="*.avi") returned 5 [0074.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.mp4") returned 0 [0074.554] lstrlenA (lpString="*.mp4") returned 5 [0074.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.wmv") returned 0 [0074.554] lstrlenA (lpString="*.wmv") returned 5 [0074.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.divx") returned 0 [0074.554] lstrlenA (lpString="*.divx") returned 6 [0074.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.mkv") returned 0 [0074.554] lstrlenA (lpString="*.mkv") returned 5 [0074.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.mp3") returned 0 [0074.554] lstrlenA (lpString="*.mp3") returned 5 [0074.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.wav") returned 0 [0074.554] lstrlenA (lpString="*.wav") returned 5 [0074.554] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.flac") returned 0 [0074.554] lstrlenA (lpString="*.flac") returned 6 [0074.555] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.ape") returned 0 [0074.555] lstrlenA (lpString="*.ape") returned 5 [0074.555] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.wma") returned 0 [0074.555] lstrlenA (lpString="*.wma") returned 5 [0074.555] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.ac3") returned 0 [0074.555] lstrlenA (lpString="*.ac3") returned 5 [0074.555] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM", pszSpec="*.mxf") returned 0 [0074.555] lstrlenA (lpString="*.mxf") returned 5 [0074.555] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIMPP.RUM", cAlternateFileName="")) returned 1 [0074.555] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.555] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MCIMPP.RUM") returned -1 [0074.555] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MCIMPP.RUM") returned -1 [0074.555] lstrcmpiA (lpString1="", lpString2="MCIMPP.RUM") returned -1 [0074.555] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\Flash.RUM") returned="Flash.RUM" [0074.555] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\" [0074.555] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\") returned="" [0074.555] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\HOW TO DECRYPT FILES.txt" [0074.555] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\how to decrypt files.txt")) returned 0x20 [0074.555] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\", lpString2="MCIMPP.RUM" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM" [0074.555] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.zip") returned 0 [0074.555] lstrlenA (lpString="*.zip") returned 5 [0074.555] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.rar") returned 0 [0074.555] lstrlenA (lpString="*.rar") returned 5 [0074.555] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.7z") returned 0 [0074.555] lstrlenA (lpString="*.7z") returned 4 [0074.555] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.tar") returned 0 [0074.555] lstrlenA (lpString="*.tar") returned 5 [0074.555] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.gzip") returned 0 [0074.555] lstrlenA (lpString="*.gzip") returned 6 [0074.556] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.jpg") returned 0 [0074.556] lstrlenA (lpString="*.jpg") returned 5 [0074.556] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.jpeg") returned 0 [0074.556] lstrlenA (lpString="*.jpeg") returned 6 [0074.556] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.psd") returned 0 [0074.556] lstrlenA (lpString="*.psd") returned 5 [0074.556] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.gif") returned 0 [0074.556] lstrlenA (lpString="*.gif") returned 5 [0074.556] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.doc") returned 0 [0074.556] lstrlenA (lpString="*.doc") returned 5 [0074.556] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.docx") returned 0 [0074.556] lstrlenA (lpString="*.docx") returned 6 [0074.556] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.xls") returned 0 [0074.556] lstrlenA (lpString="*.xls") returned 5 [0074.556] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.xlsx") returned 0 [0074.556] lstrlenA (lpString="*.xlsx") returned 6 [0074.556] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.ppt") returned 0 [0074.556] lstrlenA (lpString="*.ppt") returned 5 [0074.556] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.pptx") returned 0 [0074.556] lstrlenA (lpString="*.pptx") returned 6 [0074.556] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.pdf") returned 0 [0074.556] lstrlenA (lpString="*.pdf") returned 5 [0074.556] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.mov") returned 0 [0074.556] lstrlenA (lpString="*.mov") returned 5 [0074.556] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.m2v") returned 0 [0074.556] lstrlenA (lpString="*.m2v") returned 5 [0074.556] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.3gp") returned 0 [0074.556] lstrlenA (lpString="*.3gp") returned 5 [0074.556] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.mpeg") returned 0 [0074.556] lstrlenA (lpString="*.mpeg") returned 6 [0074.556] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.mpg") returned 0 [0074.556] lstrlenA (lpString="*.mpg") returned 5 [0074.556] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.flv") returned 0 [0074.556] lstrlenA (lpString="*.flv") returned 5 [0074.556] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.avi") returned 0 [0074.557] lstrlenA (lpString="*.avi") returned 5 [0074.557] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.mp4") returned 0 [0074.557] lstrlenA (lpString="*.mp4") returned 5 [0074.557] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.wmv") returned 0 [0074.557] lstrlenA (lpString="*.wmv") returned 5 [0074.557] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.divx") returned 0 [0074.557] lstrlenA (lpString="*.divx") returned 6 [0074.557] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.mkv") returned 0 [0074.557] lstrlenA (lpString="*.mkv") returned 5 [0074.557] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.mp3") returned 0 [0074.557] lstrlenA (lpString="*.mp3") returned 5 [0074.557] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.wav") returned 0 [0074.557] lstrlenA (lpString="*.wav") returned 5 [0074.557] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.flac") returned 0 [0074.557] lstrlenA (lpString="*.flac") returned 6 [0074.557] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.ape") returned 0 [0074.557] lstrlenA (lpString="*.ape") returned 5 [0074.557] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.wma") returned 0 [0074.557] lstrlenA (lpString="*.wma") returned 5 [0074.557] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.ac3") returned 0 [0074.557] lstrlenA (lpString="*.ac3") returned 5 [0074.557] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM", pszSpec="*.mxf") returned 0 [0074.557] lstrlenA (lpString="*.mxf") returned 5 [0074.557] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="QuickTime.RUM", cAlternateFileName="QUICKT~1.RUM")) returned 1 [0074.557] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.557] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QuickTime.RUM") returned -1 [0074.557] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuickTime.RUM") returned -1 [0074.557] lstrcmpiA (lpString1="", lpString2="QuickTime.RUM") returned -1 [0074.557] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\MCIMPP.RUM") returned="MCIMPP.RUM" [0074.557] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\" [0074.557] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\") returned="" [0074.557] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\HOW TO DECRYPT FILES.txt" [0074.557] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\how to decrypt files.txt")) returned 0x20 [0074.558] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\", lpString2="QuickTime.RUM" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM" [0074.558] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.zip") returned 0 [0074.558] lstrlenA (lpString="*.zip") returned 5 [0074.558] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.rar") returned 0 [0074.558] lstrlenA (lpString="*.rar") returned 5 [0074.558] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.7z") returned 0 [0074.558] lstrlenA (lpString="*.7z") returned 4 [0074.558] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.tar") returned 0 [0074.558] lstrlenA (lpString="*.tar") returned 5 [0074.558] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.gzip") returned 0 [0074.558] lstrlenA (lpString="*.gzip") returned 6 [0074.558] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.jpg") returned 0 [0074.558] lstrlenA (lpString="*.jpg") returned 5 [0074.558] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.jpeg") returned 0 [0074.558] lstrlenA (lpString="*.jpeg") returned 6 [0074.558] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.psd") returned 0 [0074.558] lstrlenA (lpString="*.psd") returned 5 [0074.558] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.gif") returned 0 [0074.558] lstrlenA (lpString="*.gif") returned 5 [0074.558] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.doc") returned 0 [0074.558] lstrlenA (lpString="*.doc") returned 5 [0074.558] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.docx") returned 0 [0074.558] lstrlenA (lpString="*.docx") returned 6 [0074.558] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.xls") returned 0 [0074.558] lstrlenA (lpString="*.xls") returned 5 [0074.558] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.xlsx") returned 0 [0074.558] lstrlenA (lpString="*.xlsx") returned 6 [0074.558] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.ppt") returned 0 [0074.558] lstrlenA (lpString="*.ppt") returned 5 [0074.558] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.pptx") returned 0 [0074.558] lstrlenA (lpString="*.pptx") returned 6 [0074.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.pdf") returned 0 [0074.559] lstrlenA (lpString="*.pdf") returned 5 [0074.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.mov") returned 0 [0074.559] lstrlenA (lpString="*.mov") returned 5 [0074.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.m2v") returned 0 [0074.559] lstrlenA (lpString="*.m2v") returned 5 [0074.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.3gp") returned 0 [0074.559] lstrlenA (lpString="*.3gp") returned 5 [0074.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.mpeg") returned 0 [0074.559] lstrlenA (lpString="*.mpeg") returned 6 [0074.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.mpg") returned 0 [0074.559] lstrlenA (lpString="*.mpg") returned 5 [0074.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.flv") returned 0 [0074.559] lstrlenA (lpString="*.flv") returned 5 [0074.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.avi") returned 0 [0074.559] lstrlenA (lpString="*.avi") returned 5 [0074.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.mp4") returned 0 [0074.559] lstrlenA (lpString="*.mp4") returned 5 [0074.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.wmv") returned 0 [0074.559] lstrlenA (lpString="*.wmv") returned 5 [0074.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.divx") returned 0 [0074.559] lstrlenA (lpString="*.divx") returned 6 [0074.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.mkv") returned 0 [0074.559] lstrlenA (lpString="*.mkv") returned 5 [0074.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.mp3") returned 0 [0074.559] lstrlenA (lpString="*.mp3") returned 5 [0074.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.wav") returned 0 [0074.559] lstrlenA (lpString="*.wav") returned 5 [0074.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.flac") returned 0 [0074.559] lstrlenA (lpString="*.flac") returned 6 [0074.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.ape") returned 0 [0074.559] lstrlenA (lpString="*.ape") returned 5 [0074.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.wma") returned 0 [0074.559] lstrlenA (lpString="*.wma") returned 5 [0074.559] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.ac3") returned 0 [0074.560] lstrlenA (lpString="*.ac3") returned 5 [0074.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM", pszSpec="*.mxf") returned 0 [0074.560] lstrlenA (lpString="*.mxf") returned 5 [0074.560] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="WindowsMedia.RUM", cAlternateFileName="WINDOW~1.RUM")) returned 1 [0074.560] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.560] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMedia.RUM") returned -1 [0074.560] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMedia.RUM") returned -1 [0074.560] lstrcmpiA (lpString1="", lpString2="WindowsMedia.RUM") returned -1 [0074.560] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\QuickTime.RUM") returned="QuickTime.RUM" [0074.560] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\" [0074.560] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\") returned="" [0074.560] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\HOW TO DECRYPT FILES.txt" [0074.560] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rum\\how to decrypt files.txt")) returned 0x20 [0074.560] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\", lpString2="WindowsMedia.RUM" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM" [0074.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.zip") returned 0 [0074.560] lstrlenA (lpString="*.zip") returned 5 [0074.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.rar") returned 0 [0074.560] lstrlenA (lpString="*.rar") returned 5 [0074.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.7z") returned 0 [0074.560] lstrlenA (lpString="*.7z") returned 4 [0074.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.tar") returned 0 [0074.560] lstrlenA (lpString="*.tar") returned 5 [0074.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.gzip") returned 0 [0074.560] lstrlenA (lpString="*.gzip") returned 6 [0074.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.jpg") returned 0 [0074.560] lstrlenA (lpString="*.jpg") returned 5 [0074.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.jpeg") returned 0 [0074.560] lstrlenA (lpString="*.jpeg") returned 6 [0074.560] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.psd") returned 0 [0074.560] lstrlenA (lpString="*.psd") returned 5 [0074.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.gif") returned 0 [0074.561] lstrlenA (lpString="*.gif") returned 5 [0074.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.doc") returned 0 [0074.561] lstrlenA (lpString="*.doc") returned 5 [0074.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.docx") returned 0 [0074.561] lstrlenA (lpString="*.docx") returned 6 [0074.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.xls") returned 0 [0074.561] lstrlenA (lpString="*.xls") returned 5 [0074.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.xlsx") returned 0 [0074.561] lstrlenA (lpString="*.xlsx") returned 6 [0074.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.ppt") returned 0 [0074.561] lstrlenA (lpString="*.ppt") returned 5 [0074.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.pptx") returned 0 [0074.561] lstrlenA (lpString="*.pptx") returned 6 [0074.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.pdf") returned 0 [0074.561] lstrlenA (lpString="*.pdf") returned 5 [0074.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.mov") returned 0 [0074.561] lstrlenA (lpString="*.mov") returned 5 [0074.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.m2v") returned 0 [0074.561] lstrlenA (lpString="*.m2v") returned 5 [0074.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.3gp") returned 0 [0074.561] lstrlenA (lpString="*.3gp") returned 5 [0074.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.mpeg") returned 0 [0074.561] lstrlenA (lpString="*.mpeg") returned 6 [0074.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.mpg") returned 0 [0074.561] lstrlenA (lpString="*.mpg") returned 5 [0074.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.flv") returned 0 [0074.561] lstrlenA (lpString="*.flv") returned 5 [0074.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.avi") returned 0 [0074.561] lstrlenA (lpString="*.avi") returned 5 [0074.561] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.mp4") returned 0 [0074.561] lstrlenA (lpString="*.mp4") returned 5 [0074.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.wmv") returned 0 [0074.562] lstrlenA (lpString="*.wmv") returned 5 [0074.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.divx") returned 0 [0074.562] lstrlenA (lpString="*.divx") returned 6 [0074.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.mkv") returned 0 [0074.562] lstrlenA (lpString="*.mkv") returned 5 [0074.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.mp3") returned 0 [0074.562] lstrlenA (lpString="*.mp3") returned 5 [0074.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.wav") returned 0 [0074.562] lstrlenA (lpString="*.wav") returned 5 [0074.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.flac") returned 0 [0074.562] lstrlenA (lpString="*.flac") returned 6 [0074.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.ape") returned 0 [0074.562] lstrlenA (lpString="*.ape") returned 5 [0074.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.wma") returned 0 [0074.562] lstrlenA (lpString="*.wma") returned 5 [0074.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.ac3") returned 0 [0074.562] lstrlenA (lpString="*.ac3") returned 5 [0074.562] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\WindowsMedia.RUM", pszSpec="*.mxf") returned 0 [0074.562] lstrlenA (lpString="*.mxf") returned 5 [0074.562] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="WindowsMedia.RUM", cAlternateFileName="WINDOW~1.RUM")) returned 0 [0074.562] FindClose (in: hFindFile=0x2e3578 | out: hFindFile=0x2e3578) returned 1 [0074.562] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="MPP_RUS", cAlternateFileName="")) returned 1 [0074.562] lstrcmpA (lpString1=".", lpString2="MPP_RUS") returned -1 [0074.562] lstrcmpA (lpString1="..", lpString2="MPP_RUS") returned -1 [0074.562] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*.*") returned="*.*" [0074.562] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\", lpString2="MPP_RUS" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS" [0074.562] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS") returned 75 [0074.562] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0074.565] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.565] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x590000, cFileName="..", cAlternateFileName="")) returned 1 [0074.565] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.565] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.565] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Flash.RUS", cAlternateFileName="")) returned 1 [0074.565] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.565] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Flash.RUS") returned -1 [0074.565] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Flash.RUS") returned 1 [0074.565] lstrcmpiA (lpString1="", lpString2="Flash.RUS") returned -1 [0074.565] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\*.*") returned="*.*" [0074.565] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\" [0074.565] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\") returned="" [0074.565] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\HOW TO DECRYPT FILES.txt" [0074.565] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\how to decrypt files.txt")) returned 0xffffffff [0074.565] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0074.569] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0074.569] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0074.570] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.570] CloseHandle (hObject=0x98) returned 1 [0074.570] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\", lpString2="Flash.RUS" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS" [0074.570] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.zip") returned 0 [0074.570] lstrlenA (lpString="*.zip") returned 5 [0074.570] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.rar") returned 0 [0074.570] lstrlenA (lpString="*.rar") returned 5 [0074.570] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.7z") returned 0 [0074.570] lstrlenA (lpString="*.7z") returned 4 [0074.570] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.tar") returned 0 [0074.571] lstrlenA (lpString="*.tar") returned 5 [0074.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.gzip") returned 0 [0074.571] lstrlenA (lpString="*.gzip") returned 6 [0074.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.jpg") returned 0 [0074.571] lstrlenA (lpString="*.jpg") returned 5 [0074.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.jpeg") returned 0 [0074.571] lstrlenA (lpString="*.jpeg") returned 6 [0074.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.psd") returned 0 [0074.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.gif") returned 0 [0074.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.doc") returned 0 [0074.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.docx") returned 0 [0074.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.xls") returned 0 [0074.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.xlsx") returned 0 [0074.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.ppt") returned 0 [0074.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.pptx") returned 0 [0074.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.pdf") returned 0 [0074.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.mov") returned 0 [0074.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.m2v") returned 0 [0074.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.3gp") returned 0 [0074.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.mpeg") returned 0 [0074.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.mpg") returned 0 [0074.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.flv") returned 0 [0074.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.avi") returned 0 [0074.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.mp4") returned 0 [0074.571] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.wmv") returned 0 [0074.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.divx") returned 0 [0074.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.mkv") returned 0 [0074.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.mp3") returned 0 [0074.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.wav") returned 0 [0074.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.flac") returned 0 [0074.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.ape") returned 0 [0074.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.wma") returned 0 [0074.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.ac3") returned 0 [0074.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", pszSpec="*.mxf") returned 0 [0074.572] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIMPP.RUS", cAlternateFileName="")) returned 1 [0074.572] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.572] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MCIMPP.RUS") returned -1 [0074.572] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MCIMPP.RUS") returned -1 [0074.572] lstrcmpiA (lpString1="", lpString2="MCIMPP.RUS") returned -1 [0074.572] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS") returned="Flash.RUS" [0074.572] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\" [0074.572] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\") returned="" [0074.572] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\HOW TO DECRYPT FILES.txt" [0074.572] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\how to decrypt files.txt")) returned 0x20 [0074.572] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\", lpString2="MCIMPP.RUS" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS" [0074.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.zip") returned 0 [0074.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.rar") returned 0 [0074.572] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.7z") returned 0 [0074.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.tar") returned 0 [0074.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.gzip") returned 0 [0074.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.jpg") returned 0 [0074.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.jpeg") returned 0 [0074.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.psd") returned 0 [0074.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.gif") returned 0 [0074.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.doc") returned 0 [0074.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.docx") returned 0 [0074.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.xls") returned 0 [0074.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.xlsx") returned 0 [0074.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.ppt") returned 0 [0074.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.pptx") returned 0 [0074.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.pdf") returned 0 [0074.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.mov") returned 0 [0074.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.m2v") returned 0 [0074.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.3gp") returned 0 [0074.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.mpeg") returned 0 [0074.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.mpg") returned 0 [0074.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.flv") returned 0 [0074.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.avi") returned 0 [0074.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.mp4") returned 0 [0074.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.wmv") returned 0 [0074.573] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.divx") returned 0 [0074.574] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.mkv") returned 0 [0074.574] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.mp3") returned 0 [0074.574] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.wav") returned 0 [0074.574] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.flac") returned 0 [0074.574] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.ape") returned 0 [0074.574] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.wma") returned 0 [0074.574] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.ac3") returned 0 [0074.574] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", pszSpec="*.mxf") returned 0 [0074.574] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="QuickTime.RUS", cAlternateFileName="QUICKT~1.RUS")) returned 1 [0074.574] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.574] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QuickTime.RUS") returned -1 [0074.574] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuickTime.RUS") returned -1 [0074.574] lstrcmpiA (lpString1="", lpString2="QuickTime.RUS") returned -1 [0074.574] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS") returned="MCIMPP.RUS" [0074.574] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\" [0074.574] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\") returned="" [0074.574] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\HOW TO DECRYPT FILES.txt" [0074.574] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\how to decrypt files.txt")) returned 0x20 [0074.574] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\", lpString2="QuickTime.RUS" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS" [0074.574] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.zip") returned 0 [0074.574] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.rar") returned 0 [0074.574] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.7z") returned 0 [0074.574] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.tar") returned 0 [0074.574] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.gzip") returned 0 [0074.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.jpg") returned 0 [0074.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.jpeg") returned 0 [0074.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.psd") returned 0 [0074.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.gif") returned 0 [0074.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.doc") returned 0 [0074.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.docx") returned 0 [0074.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.xls") returned 0 [0074.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.xlsx") returned 0 [0074.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.ppt") returned 0 [0074.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.pptx") returned 0 [0074.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.pdf") returned 0 [0074.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.mov") returned 0 [0074.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.m2v") returned 0 [0074.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.3gp") returned 0 [0074.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.mpeg") returned 0 [0074.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.mpg") returned 0 [0074.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.flv") returned 0 [0074.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.avi") returned 0 [0074.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.mp4") returned 0 [0074.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.wmv") returned 0 [0074.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.divx") returned 0 [0074.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.mkv") returned 0 [0074.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.mp3") returned 0 [0074.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.wav") returned 0 [0074.575] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.flac") returned 0 [0074.576] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.ape") returned 0 [0074.576] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.wma") returned 0 [0074.576] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.ac3") returned 0 [0074.576] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS", pszSpec="*.mxf") returned 0 [0074.576] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="WindowsMedia.RUS", cAlternateFileName="WINDOW~1.RUS")) returned 1 [0074.576] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.576] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMedia.RUS") returned -1 [0074.576] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMedia.RUS") returned -1 [0074.576] lstrcmpiA (lpString1="", lpString2="WindowsMedia.RUS") returned -1 [0074.576] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\QuickTime.RUS") returned="QuickTime.RUS" [0074.576] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\" [0074.576] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\") returned="" [0074.576] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\HOW TO DECRYPT FILES.txt" [0074.576] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\how to decrypt files.txt")) returned 0x20 [0074.576] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\", lpString2="WindowsMedia.RUS" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS" [0074.576] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.zip") returned 0 [0074.576] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.rar") returned 0 [0074.576] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.7z") returned 0 [0074.576] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.tar") returned 0 [0074.576] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.gzip") returned 0 [0074.576] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.jpg") returned 0 [0074.576] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.jpeg") returned 0 [0074.576] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.psd") returned 0 [0074.576] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.gif") returned 0 [0074.576] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.doc") returned 0 [0074.576] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.docx") returned 0 [0074.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.xls") returned 0 [0074.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.xlsx") returned 0 [0074.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.ppt") returned 0 [0074.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.pptx") returned 0 [0074.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.pdf") returned 0 [0074.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.mov") returned 0 [0074.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.m2v") returned 0 [0074.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.3gp") returned 0 [0074.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.mpeg") returned 0 [0074.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.mpg") returned 0 [0074.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.flv") returned 0 [0074.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.avi") returned 0 [0074.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.mp4") returned 0 [0074.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.wmv") returned 0 [0074.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.divx") returned 0 [0074.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.mkv") returned 0 [0074.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.mp3") returned 0 [0074.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.wav") returned 0 [0074.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.flac") returned 0 [0074.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.ape") returned 0 [0074.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.wma") returned 0 [0074.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.ac3") returned 0 [0074.577] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\WindowsMedia.RUS", pszSpec="*.mxf") returned 0 [0074.577] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="WindowsMedia.RUS", cAlternateFileName="WINDOW~1.RUS")) returned 0 [0074.577] FindClose (in: hFindFile=0x2e3578 | out: hFindFile=0x2e3578) returned 1 [0074.578] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="MPP_SKY", cAlternateFileName="")) returned 1 [0074.578] lstrcmpA (lpString1=".", lpString2="MPP_SKY") returned -1 [0074.578] lstrcmpA (lpString1="..", lpString2="MPP_SKY") returned -1 [0074.578] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*.*") returned="*.*" [0074.578] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\", lpString2="MPP_SKY" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY" [0074.578] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0074.580] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.580] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x590000, cFileName="..", cAlternateFileName="")) returned 1 [0074.580] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.580] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.580] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Flash.SKY", cAlternateFileName="")) returned 1 [0074.580] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.580] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Flash.SKY") returned -1 [0074.580] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Flash.SKY") returned 1 [0074.580] lstrcmpiA (lpString1="", lpString2="Flash.SKY") returned -1 [0074.580] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\*.*") returned="*.*" [0074.580] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\" [0074.580] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\") returned="" [0074.580] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\HOW TO DECRYPT FILES.txt" [0074.580] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\how to decrypt files.txt")) returned 0xffffffff [0074.580] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0074.583] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0074.584] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.584] CloseHandle (hObject=0x98) returned 1 [0074.584] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\", lpString2="Flash.SKY" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY" [0074.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.zip") returned 0 [0074.584] lstrlenA (lpString="*.zip") returned 5 [0074.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.rar") returned 0 [0074.584] lstrlenA (lpString="*.rar") returned 5 [0074.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.7z") returned 0 [0074.584] lstrlenA (lpString="*.7z") returned 4 [0074.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.tar") returned 0 [0074.584] lstrlenA (lpString="*.tar") returned 5 [0074.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.gzip") returned 0 [0074.584] lstrlenA (lpString="*.gzip") returned 6 [0074.584] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.jpg") returned 0 [0074.585] lstrlenA (lpString="*.jpg") returned 5 [0074.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.jpeg") returned 0 [0074.585] lstrlenA (lpString="*.jpeg") returned 6 [0074.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.psd") returned 0 [0074.585] lstrlenA (lpString="*.psd") returned 5 [0074.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.gif") returned 0 [0074.585] lstrlenA (lpString="*.gif") returned 5 [0074.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.doc") returned 0 [0074.585] lstrlenA (lpString="*.doc") returned 5 [0074.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.docx") returned 0 [0074.585] lstrlenA (lpString="*.docx") returned 6 [0074.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.xls") returned 0 [0074.585] lstrlenA (lpString="*.xls") returned 5 [0074.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.xlsx") returned 0 [0074.585] lstrlenA (lpString="*.xlsx") returned 6 [0074.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.ppt") returned 0 [0074.585] lstrlenA (lpString="*.ppt") returned 5 [0074.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.pptx") returned 0 [0074.585] lstrlenA (lpString="*.pptx") returned 6 [0074.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.pdf") returned 0 [0074.585] lstrlenA (lpString="*.pdf") returned 5 [0074.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.mov") returned 0 [0074.585] lstrlenA (lpString="*.mov") returned 5 [0074.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.m2v") returned 0 [0074.585] lstrlenA (lpString="*.m2v") returned 5 [0074.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.3gp") returned 0 [0074.585] lstrlenA (lpString="*.3gp") returned 5 [0074.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.mpeg") returned 0 [0074.585] lstrlenA (lpString="*.mpeg") returned 6 [0074.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.mpg") returned 0 [0074.585] lstrlenA (lpString="*.mpg") returned 5 [0074.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.flv") returned 0 [0074.585] lstrlenA (lpString="*.flv") returned 5 [0074.585] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.avi") returned 0 [0074.586] lstrlenA (lpString="*.avi") returned 5 [0074.586] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.mp4") returned 0 [0074.586] lstrlenA (lpString="*.mp4") returned 5 [0074.586] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.wmv") returned 0 [0074.586] lstrlenA (lpString="*.wmv") returned 5 [0074.586] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.divx") returned 0 [0074.586] lstrlenA (lpString="*.divx") returned 6 [0074.586] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.mkv") returned 0 [0074.586] lstrlenA (lpString="*.mkv") returned 5 [0074.586] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.mp3") returned 0 [0074.586] lstrlenA (lpString="*.mp3") returned 5 [0074.586] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.wav") returned 0 [0074.586] lstrlenA (lpString="*.wav") returned 5 [0074.586] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.flac") returned 0 [0074.586] lstrlenA (lpString="*.flac") returned 6 [0074.586] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.ape") returned 0 [0074.586] lstrlenA (lpString="*.ape") returned 5 [0074.586] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.wma") returned 0 [0074.586] lstrlenA (lpString="*.wma") returned 5 [0074.586] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.ac3") returned 0 [0074.586] lstrlenA (lpString="*.ac3") returned 5 [0074.586] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY", pszSpec="*.mxf") returned 0 [0074.586] lstrlenA (lpString="*.mxf") returned 5 [0074.586] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mcimpp.SKY", cAlternateFileName="")) returned 1 [0074.586] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.586] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Mcimpp.SKY") returned -1 [0074.586] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Mcimpp.SKY") returned -1 [0074.586] lstrcmpiA (lpString1="", lpString2="Mcimpp.SKY") returned -1 [0074.586] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Flash.SKY") returned="Flash.SKY" [0074.586] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\" [0074.586] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\") returned="" [0074.586] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\HOW TO DECRYPT FILES.txt" [0074.587] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\how to decrypt files.txt")) returned 0x20 [0074.587] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\", lpString2="Mcimpp.SKY" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY" [0074.587] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.zip") returned 0 [0074.587] lstrlenA (lpString="*.zip") returned 5 [0074.587] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.rar") returned 0 [0074.587] lstrlenA (lpString="*.rar") returned 5 [0074.587] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.7z") returned 0 [0074.587] lstrlenA (lpString="*.7z") returned 4 [0074.587] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.tar") returned 0 [0074.587] lstrlenA (lpString="*.tar") returned 5 [0074.587] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.gzip") returned 0 [0074.587] lstrlenA (lpString="*.gzip") returned 6 [0074.587] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.jpg") returned 0 [0074.587] lstrlenA (lpString="*.jpg") returned 5 [0074.587] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.jpeg") returned 0 [0074.587] lstrlenA (lpString="*.jpeg") returned 6 [0074.587] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.psd") returned 0 [0074.587] lstrlenA (lpString="*.psd") returned 5 [0074.587] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.gif") returned 0 [0074.587] lstrlenA (lpString="*.gif") returned 5 [0074.587] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.doc") returned 0 [0074.587] lstrlenA (lpString="*.doc") returned 5 [0074.587] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.docx") returned 0 [0074.587] lstrlenA (lpString="*.docx") returned 6 [0074.587] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.xls") returned 0 [0074.587] lstrlenA (lpString="*.xls") returned 5 [0074.587] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.xlsx") returned 0 [0074.587] lstrlenA (lpString="*.xlsx") returned 6 [0074.587] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.ppt") returned 0 [0074.587] lstrlenA (lpString="*.ppt") returned 5 [0074.587] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.pptx") returned 0 [0074.587] lstrlenA (lpString="*.pptx") returned 6 [0074.587] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.pdf") returned 0 [0074.587] lstrlenA (lpString="*.pdf") returned 5 [0074.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.mov") returned 0 [0074.588] lstrlenA (lpString="*.mov") returned 5 [0074.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.m2v") returned 0 [0074.588] lstrlenA (lpString="*.m2v") returned 5 [0074.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.3gp") returned 0 [0074.588] lstrlenA (lpString="*.3gp") returned 5 [0074.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.mpeg") returned 0 [0074.588] lstrlenA (lpString="*.mpeg") returned 6 [0074.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.mpg") returned 0 [0074.588] lstrlenA (lpString="*.mpg") returned 5 [0074.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.flv") returned 0 [0074.588] lstrlenA (lpString="*.flv") returned 5 [0074.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.avi") returned 0 [0074.588] lstrlenA (lpString="*.avi") returned 5 [0074.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.mp4") returned 0 [0074.588] lstrlenA (lpString="*.mp4") returned 5 [0074.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.wmv") returned 0 [0074.588] lstrlenA (lpString="*.wmv") returned 5 [0074.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.divx") returned 0 [0074.588] lstrlenA (lpString="*.divx") returned 6 [0074.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.mkv") returned 0 [0074.588] lstrlenA (lpString="*.mkv") returned 5 [0074.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.mp3") returned 0 [0074.588] lstrlenA (lpString="*.mp3") returned 5 [0074.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.wav") returned 0 [0074.588] lstrlenA (lpString="*.wav") returned 5 [0074.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.flac") returned 0 [0074.588] lstrlenA (lpString="*.flac") returned 6 [0074.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.ape") returned 0 [0074.588] lstrlenA (lpString="*.ape") returned 5 [0074.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.wma") returned 0 [0074.588] lstrlenA (lpString="*.wma") returned 5 [0074.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.ac3") returned 0 [0074.588] lstrlenA (lpString="*.ac3") returned 5 [0074.588] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY", pszSpec="*.mxf") returned 0 [0074.589] lstrlenA (lpString="*.mxf") returned 5 [0074.589] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="QuickTime.SKY", cAlternateFileName="QUICKT~1.SKY")) returned 1 [0074.589] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.589] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QuickTime.SKY") returned -1 [0074.589] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuickTime.SKY") returned -1 [0074.589] lstrcmpiA (lpString1="", lpString2="QuickTime.SKY") returned -1 [0074.589] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\Mcimpp.SKY") returned="Mcimpp.SKY" [0074.589] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\" [0074.589] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\") returned="" [0074.589] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\HOW TO DECRYPT FILES.txt" [0074.589] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\how to decrypt files.txt")) returned 0x20 [0074.589] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\", lpString2="QuickTime.SKY" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY" [0074.589] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.zip") returned 0 [0074.589] lstrlenA (lpString="*.zip") returned 5 [0074.589] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.rar") returned 0 [0074.589] lstrlenA (lpString="*.rar") returned 5 [0074.589] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.7z") returned 0 [0074.589] lstrlenA (lpString="*.7z") returned 4 [0074.589] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.tar") returned 0 [0074.589] lstrlenA (lpString="*.tar") returned 5 [0074.589] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.gzip") returned 0 [0074.589] lstrlenA (lpString="*.gzip") returned 6 [0074.589] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.jpg") returned 0 [0074.589] lstrlenA (lpString="*.jpg") returned 5 [0074.589] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.jpeg") returned 0 [0074.589] lstrlenA (lpString="*.jpeg") returned 6 [0074.589] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.psd") returned 0 [0074.589] lstrlenA (lpString="*.psd") returned 5 [0074.589] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.gif") returned 0 [0074.589] lstrlenA (lpString="*.gif") returned 5 [0074.589] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.doc") returned 0 [0074.589] lstrlenA (lpString="*.doc") returned 5 [0074.590] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.docx") returned 0 [0074.590] lstrlenA (lpString="*.docx") returned 6 [0074.590] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.xls") returned 0 [0074.590] lstrlenA (lpString="*.xls") returned 5 [0074.590] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.xlsx") returned 0 [0074.590] lstrlenA (lpString="*.xlsx") returned 6 [0074.590] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.ppt") returned 0 [0074.590] lstrlenA (lpString="*.ppt") returned 5 [0074.590] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.pptx") returned 0 [0074.590] lstrlenA (lpString="*.pptx") returned 6 [0074.590] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.pdf") returned 0 [0074.590] lstrlenA (lpString="*.pdf") returned 5 [0074.590] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.mov") returned 0 [0074.590] lstrlenA (lpString="*.mov") returned 5 [0074.590] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.m2v") returned 0 [0074.590] lstrlenA (lpString="*.m2v") returned 5 [0074.590] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.3gp") returned 0 [0074.590] lstrlenA (lpString="*.3gp") returned 5 [0074.590] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.mpeg") returned 0 [0074.590] lstrlenA (lpString="*.mpeg") returned 6 [0074.590] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.mpg") returned 0 [0074.590] lstrlenA (lpString="*.mpg") returned 5 [0074.590] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.flv") returned 0 [0074.590] lstrlenA (lpString="*.flv") returned 5 [0074.590] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.avi") returned 0 [0074.590] lstrlenA (lpString="*.avi") returned 5 [0074.590] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.mp4") returned 0 [0074.590] lstrlenA (lpString="*.mp4") returned 5 [0074.590] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.wmv") returned 0 [0074.590] lstrlenA (lpString="*.wmv") returned 5 [0074.590] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.divx") returned 0 [0074.590] lstrlenA (lpString="*.divx") returned 6 [0074.590] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.mkv") returned 0 [0074.591] lstrlenA (lpString="*.mkv") returned 5 [0074.591] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.mp3") returned 0 [0074.591] lstrlenA (lpString="*.mp3") returned 5 [0074.591] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.wav") returned 0 [0074.591] lstrlenA (lpString="*.wav") returned 5 [0074.591] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.flac") returned 0 [0074.591] lstrlenA (lpString="*.flac") returned 6 [0074.591] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.ape") returned 0 [0074.591] lstrlenA (lpString="*.ape") returned 5 [0074.591] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.wma") returned 0 [0074.591] lstrlenA (lpString="*.wma") returned 5 [0074.591] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.ac3") returned 0 [0074.591] lstrlenA (lpString="*.ac3") returned 5 [0074.591] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY", pszSpec="*.mxf") returned 0 [0074.591] lstrlenA (lpString="*.mxf") returned 5 [0074.591] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="WindowsMedia.SKY", cAlternateFileName="WINDOW~1.SKY")) returned 1 [0074.591] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.591] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMedia.SKY") returned -1 [0074.591] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMedia.SKY") returned -1 [0074.591] lstrcmpiA (lpString1="", lpString2="WindowsMedia.SKY") returned -1 [0074.591] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\QuickTime.SKY") returned="QuickTime.SKY" [0074.591] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\" [0074.591] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\") returned="" [0074.591] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\HOW TO DECRYPT FILES.txt" [0074.591] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_sky\\how to decrypt files.txt")) returned 0x20 [0074.591] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\", lpString2="WindowsMedia.SKY" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\WindowsMedia.SKY") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\WindowsMedia.SKY" [0074.591] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\WindowsMedia.SKY", pszSpec="*.zip") returned 0 [0074.591] lstrlenA (lpString="*.zip") returned 5 [0074.591] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\WindowsMedia.SKY", pszSpec="*.rar") returned 0 [0074.591] lstrlenA (lpString="*.rar") returned 5 [0074.591] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\WindowsMedia.SKY", pszSpec="*.7z") returned 0 [0074.591] lstrlenA (lpString="*.7z") returned 4 [0074.592] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\WindowsMedia.SKY", pszSpec="*.tar") returned 0 [0074.592] lstrlenA (lpString="*.tar") returned 5 [0074.592] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\WindowsMedia.SKY", pszSpec="*.gzip") returned 0 [0074.592] lstrlenA (lpString="*.gzip") returned 6 [0074.592] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\WindowsMedia.SKY", pszSpec="*.jpg") returned 0 [0074.592] lstrlenA (lpString="*.jpg") returned 5 [0074.592] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\WindowsMedia.SKY", pszSpec="*.jpeg") returned 0 [0074.592] lstrlenA (lpString="*.jpeg") returned 6 [0074.592] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\WindowsMedia.SKY", pszSpec="*.psd") returned 0 [0074.592] lstrlenA (lpString="*.psd") returned 5 [0074.592] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\WindowsMedia.SKY", pszSpec="*.gif") returned 0 [0074.592] lstrlenA (lpString="*.gif") returned 5 [0074.592] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\WindowsMedia.SKY", pszSpec="*.doc") returned 0 [0074.592] lstrlenA (lpString="*.doc") returned 5 [0074.592] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\WindowsMedia.SKY", pszSpec="*.docx") returned 0 [0074.592] lstrlenA (lpString="*.docx") returned 6 [0074.592] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="WindowsMedia.SKY", cAlternateFileName="WINDOW~1.SKY")) returned 0 [0074.592] FindClose (in: hFindFile=0x2e3578 | out: hFindFile=0x2e3578) returned 1 [0074.592] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="MPP_SLV", cAlternateFileName="")) returned 1 [0074.592] lstrcmpA (lpString1=".", lpString2="MPP_SLV") returned -1 [0074.593] lstrcmpA (lpString1="..", lpString2="MPP_SLV") returned -1 [0074.593] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*.*") returned="*.*" [0074.593] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\", lpString2="MPP_SLV" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV" [0074.593] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV") returned 75 [0074.593] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0074.595] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.595] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x590000, cFileName="..", cAlternateFileName="")) returned 1 [0074.595] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.595] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.595] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Flash.SLV", cAlternateFileName="")) returned 1 [0074.595] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.595] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Flash.SLV") returned -1 [0074.595] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Flash.SLV") returned 1 [0074.595] lstrcmpiA (lpString1="", lpString2="Flash.SLV") returned -1 [0074.595] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\*.*") returned="*.*" [0074.595] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\" [0074.595] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\") returned="" [0074.595] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\HOW TO DECRYPT FILES.txt" [0074.595] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\how to decrypt files.txt")) returned 0xffffffff [0074.595] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0074.598] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0074.598] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0074.599] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.599] CloseHandle (hObject=0x98) returned 1 [0074.599] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\", lpString2="Flash.SLV" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV" [0074.599] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.zip") returned 0 [0074.599] lstrlenA (lpString="*.zip") returned 5 [0074.599] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.rar") returned 0 [0074.599] lstrlenA (lpString="*.rar") returned 5 [0074.599] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.7z") returned 0 [0074.599] lstrlenA (lpString="*.7z") returned 4 [0074.599] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.tar") returned 0 [0074.599] lstrlenA (lpString="*.tar") returned 5 [0074.599] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.gzip") returned 0 [0074.599] lstrlenA (lpString="*.gzip") returned 6 [0074.599] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.jpg") returned 0 [0074.599] lstrlenA (lpString="*.jpg") returned 5 [0074.599] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.jpeg") returned 0 [0074.599] lstrlenA (lpString="*.jpeg") returned 6 [0074.599] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.psd") returned 0 [0074.599] lstrlenA (lpString="*.psd") returned 5 [0074.599] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.gif") returned 0 [0074.600] lstrlenA (lpString="*.gif") returned 5 [0074.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.doc") returned 0 [0074.600] lstrlenA (lpString="*.doc") returned 5 [0074.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.docx") returned 0 [0074.600] lstrlenA (lpString="*.docx") returned 6 [0074.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.xls") returned 0 [0074.600] lstrlenA (lpString="*.xls") returned 5 [0074.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.xlsx") returned 0 [0074.600] lstrlenA (lpString="*.xlsx") returned 6 [0074.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.ppt") returned 0 [0074.600] lstrlenA (lpString="*.ppt") returned 5 [0074.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.pptx") returned 0 [0074.600] lstrlenA (lpString="*.pptx") returned 6 [0074.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.pdf") returned 0 [0074.600] lstrlenA (lpString="*.pdf") returned 5 [0074.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.mov") returned 0 [0074.600] lstrlenA (lpString="*.mov") returned 5 [0074.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.m2v") returned 0 [0074.600] lstrlenA (lpString="*.m2v") returned 5 [0074.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.3gp") returned 0 [0074.600] lstrlenA (lpString="*.3gp") returned 5 [0074.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.mpeg") returned 0 [0074.600] lstrlenA (lpString="*.mpeg") returned 6 [0074.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.mpg") returned 0 [0074.600] lstrlenA (lpString="*.mpg") returned 5 [0074.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.flv") returned 0 [0074.600] lstrlenA (lpString="*.flv") returned 5 [0074.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.avi") returned 0 [0074.600] lstrlenA (lpString="*.avi") returned 5 [0074.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.mp4") returned 0 [0074.600] lstrlenA (lpString="*.mp4") returned 5 [0074.600] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.wmv") returned 0 [0074.601] lstrlenA (lpString="*.wmv") returned 5 [0074.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.divx") returned 0 [0074.601] lstrlenA (lpString="*.divx") returned 6 [0074.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.mkv") returned 0 [0074.601] lstrlenA (lpString="*.mkv") returned 5 [0074.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.mp3") returned 0 [0074.601] lstrlenA (lpString="*.mp3") returned 5 [0074.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.wav") returned 0 [0074.601] lstrlenA (lpString="*.wav") returned 5 [0074.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.flac") returned 0 [0074.601] lstrlenA (lpString="*.flac") returned 6 [0074.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.ape") returned 0 [0074.601] lstrlenA (lpString="*.ape") returned 5 [0074.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.wma") returned 0 [0074.601] lstrlenA (lpString="*.wma") returned 5 [0074.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.ac3") returned 0 [0074.601] lstrlenA (lpString="*.ac3") returned 5 [0074.601] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", pszSpec="*.mxf") returned 0 [0074.601] lstrlenA (lpString="*.mxf") returned 5 [0074.601] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIMPP.SLV", cAlternateFileName="")) returned 1 [0074.601] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.601] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MCIMPP.SLV") returned -1 [0074.601] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MCIMPP.SLV") returned -1 [0074.601] lstrcmpiA (lpString1="", lpString2="MCIMPP.SLV") returned -1 [0074.601] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV") returned="Flash.SLV" [0074.601] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\" [0074.601] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\") returned="" [0074.601] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\HOW TO DECRYPT FILES.txt" [0074.602] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\how to decrypt files.txt")) returned 0x20 [0074.602] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\", lpString2="MCIMPP.SLV" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV" [0074.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.zip") returned 0 [0074.602] lstrlenA (lpString="*.zip") returned 5 [0074.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.rar") returned 0 [0074.602] lstrlenA (lpString="*.rar") returned 5 [0074.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.7z") returned 0 [0074.602] lstrlenA (lpString="*.7z") returned 4 [0074.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.tar") returned 0 [0074.602] lstrlenA (lpString="*.tar") returned 5 [0074.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.gzip") returned 0 [0074.602] lstrlenA (lpString="*.gzip") returned 6 [0074.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.jpg") returned 0 [0074.602] lstrlenA (lpString="*.jpg") returned 5 [0074.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.jpeg") returned 0 [0074.602] lstrlenA (lpString="*.jpeg") returned 6 [0074.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.psd") returned 0 [0074.602] lstrlenA (lpString="*.psd") returned 5 [0074.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.gif") returned 0 [0074.602] lstrlenA (lpString="*.gif") returned 5 [0074.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.doc") returned 0 [0074.602] lstrlenA (lpString="*.doc") returned 5 [0074.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.docx") returned 0 [0074.602] lstrlenA (lpString="*.docx") returned 6 [0074.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.xls") returned 0 [0074.602] lstrlenA (lpString="*.xls") returned 5 [0074.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.xlsx") returned 0 [0074.602] lstrlenA (lpString="*.xlsx") returned 6 [0074.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.ppt") returned 0 [0074.602] lstrlenA (lpString="*.ppt") returned 5 [0074.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.pptx") returned 0 [0074.602] lstrlenA (lpString="*.pptx") returned 6 [0074.602] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.pdf") returned 0 [0074.603] lstrlenA (lpString="*.pdf") returned 5 [0074.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.mov") returned 0 [0074.603] lstrlenA (lpString="*.mov") returned 5 [0074.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.m2v") returned 0 [0074.603] lstrlenA (lpString="*.m2v") returned 5 [0074.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.3gp") returned 0 [0074.603] lstrlenA (lpString="*.3gp") returned 5 [0074.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.mpeg") returned 0 [0074.603] lstrlenA (lpString="*.mpeg") returned 6 [0074.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.mpg") returned 0 [0074.603] lstrlenA (lpString="*.mpg") returned 5 [0074.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.flv") returned 0 [0074.603] lstrlenA (lpString="*.flv") returned 5 [0074.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.avi") returned 0 [0074.603] lstrlenA (lpString="*.avi") returned 5 [0074.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.mp4") returned 0 [0074.603] lstrlenA (lpString="*.mp4") returned 5 [0074.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.wmv") returned 0 [0074.603] lstrlenA (lpString="*.wmv") returned 5 [0074.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.divx") returned 0 [0074.603] lstrlenA (lpString="*.divx") returned 6 [0074.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.mkv") returned 0 [0074.603] lstrlenA (lpString="*.mkv") returned 5 [0074.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.mp3") returned 0 [0074.603] lstrlenA (lpString="*.mp3") returned 5 [0074.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.wav") returned 0 [0074.603] lstrlenA (lpString="*.wav") returned 5 [0074.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.flac") returned 0 [0074.603] lstrlenA (lpString="*.flac") returned 6 [0074.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.ape") returned 0 [0074.603] lstrlenA (lpString="*.ape") returned 5 [0074.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.wma") returned 0 [0074.603] lstrlenA (lpString="*.wma") returned 5 [0074.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.ac3") returned 0 [0074.603] lstrlenA (lpString="*.ac3") returned 5 [0074.603] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV", pszSpec="*.mxf") returned 0 [0074.603] lstrlenA (lpString="*.mxf") returned 5 [0074.604] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="QuickTime.SLV", cAlternateFileName="QUICKT~1.SLV")) returned 1 [0074.604] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.604] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QuickTime.SLV") returned -1 [0074.604] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuickTime.SLV") returned -1 [0074.604] lstrcmpiA (lpString1="", lpString2="QuickTime.SLV") returned -1 [0074.604] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\MCIMPP.SLV") returned="MCIMPP.SLV" [0074.604] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\" [0074.604] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\") returned="" [0074.604] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\HOW TO DECRYPT FILES.txt" [0074.604] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\how to decrypt files.txt")) returned 0x20 [0074.604] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\", lpString2="QuickTime.SLV" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV" [0074.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.zip") returned 0 [0074.604] lstrlenA (lpString="*.zip") returned 5 [0074.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.rar") returned 0 [0074.604] lstrlenA (lpString="*.rar") returned 5 [0074.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.7z") returned 0 [0074.604] lstrlenA (lpString="*.7z") returned 4 [0074.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.tar") returned 0 [0074.604] lstrlenA (lpString="*.tar") returned 5 [0074.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.gzip") returned 0 [0074.604] lstrlenA (lpString="*.gzip") returned 6 [0074.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.jpg") returned 0 [0074.604] lstrlenA (lpString="*.jpg") returned 5 [0074.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.jpeg") returned 0 [0074.604] lstrlenA (lpString="*.jpeg") returned 6 [0074.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.psd") returned 0 [0074.604] lstrlenA (lpString="*.psd") returned 5 [0074.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.gif") returned 0 [0074.604] lstrlenA (lpString="*.gif") returned 5 [0074.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.doc") returned 0 [0074.604] lstrlenA (lpString="*.doc") returned 5 [0074.604] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.docx") returned 0 [0074.604] lstrlenA (lpString="*.docx") returned 6 [0074.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.xls") returned 0 [0074.605] lstrlenA (lpString="*.xls") returned 5 [0074.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.xlsx") returned 0 [0074.605] lstrlenA (lpString="*.xlsx") returned 6 [0074.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.ppt") returned 0 [0074.605] lstrlenA (lpString="*.ppt") returned 5 [0074.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.pptx") returned 0 [0074.605] lstrlenA (lpString="*.pptx") returned 6 [0074.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.pdf") returned 0 [0074.605] lstrlenA (lpString="*.pdf") returned 5 [0074.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.mov") returned 0 [0074.605] lstrlenA (lpString="*.mov") returned 5 [0074.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.m2v") returned 0 [0074.605] lstrlenA (lpString="*.m2v") returned 5 [0074.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.3gp") returned 0 [0074.605] lstrlenA (lpString="*.3gp") returned 5 [0074.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.mpeg") returned 0 [0074.605] lstrlenA (lpString="*.mpeg") returned 6 [0074.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.mpg") returned 0 [0074.605] lstrlenA (lpString="*.mpg") returned 5 [0074.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.flv") returned 0 [0074.605] lstrlenA (lpString="*.flv") returned 5 [0074.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.avi") returned 0 [0074.605] lstrlenA (lpString="*.avi") returned 5 [0074.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.mp4") returned 0 [0074.605] lstrlenA (lpString="*.mp4") returned 5 [0074.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.wmv") returned 0 [0074.605] lstrlenA (lpString="*.wmv") returned 5 [0074.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.divx") returned 0 [0074.605] lstrlenA (lpString="*.divx") returned 6 [0074.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.mkv") returned 0 [0074.605] lstrlenA (lpString="*.mkv") returned 5 [0074.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.mp3") returned 0 [0074.605] lstrlenA (lpString="*.mp3") returned 5 [0074.605] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.wav") returned 0 [0074.606] lstrlenA (lpString="*.wav") returned 5 [0074.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.flac") returned 0 [0074.606] lstrlenA (lpString="*.flac") returned 6 [0074.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.ape") returned 0 [0074.606] lstrlenA (lpString="*.ape") returned 5 [0074.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.wma") returned 0 [0074.606] lstrlenA (lpString="*.wma") returned 5 [0074.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.ac3") returned 0 [0074.606] lstrlenA (lpString="*.ac3") returned 5 [0074.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV", pszSpec="*.mxf") returned 0 [0074.606] lstrlenA (lpString="*.mxf") returned 5 [0074.606] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="WindowsMedia.SLV", cAlternateFileName="WINDOW~1.SLV")) returned 1 [0074.606] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.606] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMedia.SLV") returned -1 [0074.606] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMedia.SLV") returned -1 [0074.606] lstrcmpiA (lpString1="", lpString2="WindowsMedia.SLV") returned -1 [0074.606] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\QuickTime.SLV") returned="QuickTime.SLV" [0074.606] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\" [0074.606] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\") returned="" [0074.606] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\HOW TO DECRYPT FILES.txt" [0074.606] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\how to decrypt files.txt")) returned 0x20 [0074.606] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\", lpString2="WindowsMedia.SLV" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV" [0074.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.zip") returned 0 [0074.606] lstrlenA (lpString="*.zip") returned 5 [0074.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.rar") returned 0 [0074.606] lstrlenA (lpString="*.rar") returned 5 [0074.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.7z") returned 0 [0074.606] lstrlenA (lpString="*.7z") returned 4 [0074.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.tar") returned 0 [0074.606] lstrlenA (lpString="*.tar") returned 5 [0074.606] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.gzip") returned 0 [0074.607] lstrlenA (lpString="*.gzip") returned 6 [0074.607] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.jpg") returned 0 [0074.607] lstrlenA (lpString="*.jpg") returned 5 [0074.607] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.jpeg") returned 0 [0074.607] lstrlenA (lpString="*.jpeg") returned 6 [0074.607] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.psd") returned 0 [0074.607] lstrlenA (lpString="*.psd") returned 5 [0074.607] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.gif") returned 0 [0074.607] lstrlenA (lpString="*.gif") returned 5 [0074.607] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.doc") returned 0 [0074.607] lstrlenA (lpString="*.doc") returned 5 [0074.607] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.docx") returned 0 [0074.607] lstrlenA (lpString="*.docx") returned 6 [0074.607] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.xls") returned 0 [0074.607] lstrlenA (lpString="*.xls") returned 5 [0074.607] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.xlsx") returned 0 [0074.607] lstrlenA (lpString="*.xlsx") returned 6 [0074.607] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.ppt") returned 0 [0074.607] lstrlenA (lpString="*.ppt") returned 5 [0074.607] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.pptx") returned 0 [0074.607] lstrlenA (lpString="*.pptx") returned 6 [0074.607] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.pdf") returned 0 [0074.607] lstrlenA (lpString="*.pdf") returned 5 [0074.607] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.mov") returned 0 [0074.607] lstrlenA (lpString="*.mov") returned 5 [0074.607] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.m2v") returned 0 [0074.607] lstrlenA (lpString="*.m2v") returned 5 [0074.607] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.3gp") returned 0 [0074.607] lstrlenA (lpString="*.3gp") returned 5 [0074.607] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.mpeg") returned 0 [0074.607] lstrlenA (lpString="*.mpeg") returned 6 [0074.607] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.mpg") returned 0 [0074.607] lstrlenA (lpString="*.mpg") returned 5 [0074.607] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.flv") returned 0 [0074.608] lstrlenA (lpString="*.flv") returned 5 [0074.608] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.avi") returned 0 [0074.608] lstrlenA (lpString="*.avi") returned 5 [0074.608] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.mp4") returned 0 [0074.608] lstrlenA (lpString="*.mp4") returned 5 [0074.608] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.wmv") returned 0 [0074.608] lstrlenA (lpString="*.wmv") returned 5 [0074.608] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.divx") returned 0 [0074.608] lstrlenA (lpString="*.divx") returned 6 [0074.608] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.mkv") returned 0 [0074.608] lstrlenA (lpString="*.mkv") returned 5 [0074.608] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.mp3") returned 0 [0074.608] lstrlenA (lpString="*.mp3") returned 5 [0074.608] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.wav") returned 0 [0074.608] lstrlenA (lpString="*.wav") returned 5 [0074.608] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.flac") returned 0 [0074.608] lstrlenA (lpString="*.flac") returned 6 [0074.608] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.ape") returned 0 [0074.608] lstrlenA (lpString="*.ape") returned 5 [0074.608] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.wma") returned 0 [0074.608] lstrlenA (lpString="*.wma") returned 5 [0074.608] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.ac3") returned 0 [0074.608] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\WindowsMedia.SLV", pszSpec="*.mxf") returned 0 [0074.608] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="WindowsMedia.SLV", cAlternateFileName="WINDOW~1.SLV")) returned 0 [0074.608] FindClose (in: hFindFile=0x2e3578 | out: hFindFile=0x2e3578) returned 1 [0074.608] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="MPP_TUR", cAlternateFileName="")) returned 1 [0074.608] lstrcmpA (lpString1=".", lpString2="MPP_TUR") returned -1 [0074.608] lstrcmpA (lpString1="..", lpString2="MPP_TUR") returned -1 [0074.608] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*.*") returned="*.*" [0074.608] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\", lpString2="MPP_TUR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR" [0074.609] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0074.610] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.610] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x590000, cFileName="..", cAlternateFileName="")) returned 1 [0074.610] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.610] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.610] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Flash.TUR", cAlternateFileName="")) returned 1 [0074.610] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.610] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Flash.TUR") returned -1 [0074.610] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Flash.TUR") returned 1 [0074.610] lstrcmpiA (lpString1="", lpString2="Flash.TUR") returned -1 [0074.610] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\*.*") returned="*.*" [0074.610] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\" [0074.610] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\") returned="" [0074.610] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\HOW TO DECRYPT FILES.txt" [0074.611] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\how to decrypt files.txt")) returned 0xffffffff [0074.611] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0074.620] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0074.628] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.628] CloseHandle (hObject=0x98) returned 1 [0074.628] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\", lpString2="Flash.TUR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR" [0074.628] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.zip") returned 0 [0074.628] lstrlenA (lpString="*.zip") returned 5 [0074.628] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.rar") returned 0 [0074.628] lstrlenA (lpString="*.rar") returned 5 [0074.628] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.7z") returned 0 [0074.628] lstrlenA (lpString="*.7z") returned 4 [0074.628] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.tar") returned 0 [0074.628] lstrlenA (lpString="*.tar") returned 5 [0074.628] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.gzip") returned 0 [0074.628] lstrlenA (lpString="*.gzip") returned 6 [0074.628] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.jpg") returned 0 [0074.628] lstrlenA (lpString="*.jpg") returned 5 [0074.628] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.jpeg") returned 0 [0074.628] lstrlenA (lpString="*.jpeg") returned 6 [0074.628] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.psd") returned 0 [0074.628] lstrlenA (lpString="*.psd") returned 5 [0074.628] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.gif") returned 0 [0074.628] lstrlenA (lpString="*.gif") returned 5 [0074.628] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.doc") returned 0 [0074.628] lstrlenA (lpString="*.doc") returned 5 [0074.628] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.docx") returned 0 [0074.629] lstrlenA (lpString="*.docx") returned 6 [0074.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.xls") returned 0 [0074.629] lstrlenA (lpString="*.xls") returned 5 [0074.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.xlsx") returned 0 [0074.629] lstrlenA (lpString="*.xlsx") returned 6 [0074.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.ppt") returned 0 [0074.629] lstrlenA (lpString="*.ppt") returned 5 [0074.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.pptx") returned 0 [0074.629] lstrlenA (lpString="*.pptx") returned 6 [0074.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.pdf") returned 0 [0074.629] lstrlenA (lpString="*.pdf") returned 5 [0074.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.mov") returned 0 [0074.629] lstrlenA (lpString="*.mov") returned 5 [0074.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.m2v") returned 0 [0074.629] lstrlenA (lpString="*.m2v") returned 5 [0074.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.3gp") returned 0 [0074.629] lstrlenA (lpString="*.3gp") returned 5 [0074.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.mpeg") returned 0 [0074.629] lstrlenA (lpString="*.mpeg") returned 6 [0074.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.mpg") returned 0 [0074.629] lstrlenA (lpString="*.mpg") returned 5 [0074.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.flv") returned 0 [0074.629] lstrlenA (lpString="*.flv") returned 5 [0074.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.avi") returned 0 [0074.629] lstrlenA (lpString="*.avi") returned 5 [0074.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.mp4") returned 0 [0074.629] lstrlenA (lpString="*.mp4") returned 5 [0074.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.wmv") returned 0 [0074.629] lstrlenA (lpString="*.wmv") returned 5 [0074.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.divx") returned 0 [0074.629] lstrlenA (lpString="*.divx") returned 6 [0074.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.mkv") returned 0 [0074.629] lstrlenA (lpString="*.mkv") returned 5 [0074.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.mp3") returned 0 [0074.629] lstrlenA (lpString="*.mp3") returned 5 [0074.629] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.wav") returned 0 [0074.629] lstrlenA (lpString="*.wav") returned 5 [0074.630] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.flac") returned 0 [0074.630] lstrlenA (lpString="*.flac") returned 6 [0074.630] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.ape") returned 0 [0074.630] lstrlenA (lpString="*.ape") returned 5 [0074.630] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.wma") returned 0 [0074.630] lstrlenA (lpString="*.wma") returned 5 [0074.630] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.ac3") returned 0 [0074.630] lstrlenA (lpString="*.ac3") returned 5 [0074.630] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR", pszSpec="*.mxf") returned 0 [0074.630] lstrlenA (lpString="*.mxf") returned 5 [0074.630] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIMPP.TUR", cAlternateFileName="")) returned 1 [0074.630] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.630] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MCIMPP.TUR") returned -1 [0074.630] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MCIMPP.TUR") returned -1 [0074.630] lstrcmpiA (lpString1="", lpString2="MCIMPP.TUR") returned -1 [0074.630] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\Flash.TUR") returned="Flash.TUR" [0074.630] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\" [0074.630] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\") returned="" [0074.630] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\HOW TO DECRYPT FILES.txt" [0074.630] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\how to decrypt files.txt")) returned 0x20 [0074.630] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\", lpString2="MCIMPP.TUR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR" [0074.630] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.zip") returned 0 [0074.630] lstrlenA (lpString="*.zip") returned 5 [0074.630] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.rar") returned 0 [0074.630] lstrlenA (lpString="*.rar") returned 5 [0074.630] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.7z") returned 0 [0074.630] lstrlenA (lpString="*.7z") returned 4 [0074.630] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.tar") returned 0 [0074.630] lstrlenA (lpString="*.tar") returned 5 [0074.630] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.gzip") returned 0 [0074.631] lstrlenA (lpString="*.gzip") returned 6 [0074.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.jpg") returned 0 [0074.631] lstrlenA (lpString="*.jpg") returned 5 [0074.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.jpeg") returned 0 [0074.631] lstrlenA (lpString="*.jpeg") returned 6 [0074.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.psd") returned 0 [0074.631] lstrlenA (lpString="*.psd") returned 5 [0074.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.gif") returned 0 [0074.631] lstrlenA (lpString="*.gif") returned 5 [0074.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.doc") returned 0 [0074.631] lstrlenA (lpString="*.doc") returned 5 [0074.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.docx") returned 0 [0074.631] lstrlenA (lpString="*.docx") returned 6 [0074.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.xls") returned 0 [0074.631] lstrlenA (lpString="*.xls") returned 5 [0074.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.xlsx") returned 0 [0074.631] lstrlenA (lpString="*.xlsx") returned 6 [0074.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.ppt") returned 0 [0074.631] lstrlenA (lpString="*.ppt") returned 5 [0074.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.pptx") returned 0 [0074.631] lstrlenA (lpString="*.pptx") returned 6 [0074.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.pdf") returned 0 [0074.631] lstrlenA (lpString="*.pdf") returned 5 [0074.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.mov") returned 0 [0074.631] lstrlenA (lpString="*.mov") returned 5 [0074.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.m2v") returned 0 [0074.631] lstrlenA (lpString="*.m2v") returned 5 [0074.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.3gp") returned 0 [0074.631] lstrlenA (lpString="*.3gp") returned 5 [0074.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.mpeg") returned 0 [0074.631] lstrlenA (lpString="*.mpeg") returned 6 [0074.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.mpg") returned 0 [0074.631] lstrlenA (lpString="*.mpg") returned 5 [0074.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.flv") returned 0 [0074.631] lstrlenA (lpString="*.flv") returned 5 [0074.631] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.avi") returned 0 [0074.631] lstrlenA (lpString="*.avi") returned 5 [0074.632] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.mp4") returned 0 [0074.632] lstrlenA (lpString="*.mp4") returned 5 [0074.632] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.wmv") returned 0 [0074.632] lstrlenA (lpString="*.wmv") returned 5 [0074.632] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.divx") returned 0 [0074.632] lstrlenA (lpString="*.divx") returned 6 [0074.632] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.mkv") returned 0 [0074.632] lstrlenA (lpString="*.mkv") returned 5 [0074.632] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.mp3") returned 0 [0074.632] lstrlenA (lpString="*.mp3") returned 5 [0074.632] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.wav") returned 0 [0074.632] lstrlenA (lpString="*.wav") returned 5 [0074.632] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.flac") returned 0 [0074.632] lstrlenA (lpString="*.flac") returned 6 [0074.632] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.ape") returned 0 [0074.632] lstrlenA (lpString="*.ape") returned 5 [0074.632] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.wma") returned 0 [0074.632] lstrlenA (lpString="*.wma") returned 5 [0074.632] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.ac3") returned 0 [0074.632] lstrlenA (lpString="*.ac3") returned 5 [0074.632] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR", pszSpec="*.mxf") returned 0 [0074.632] lstrlenA (lpString="*.mxf") returned 5 [0074.632] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="QuickTime.TUR", cAlternateFileName="QUICKT~1.TUR")) returned 1 [0074.632] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.632] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QuickTime.TUR") returned -1 [0074.632] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuickTime.TUR") returned -1 [0074.632] lstrcmpiA (lpString1="", lpString2="QuickTime.TUR") returned -1 [0074.632] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\MCIMPP.TUR") returned="MCIMPP.TUR" [0074.632] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\" [0074.632] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\") returned="" [0074.632] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\HOW TO DECRYPT FILES.txt" [0074.632] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\how to decrypt files.txt")) returned 0x20 [0074.633] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\", lpString2="QuickTime.TUR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR" [0074.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.zip") returned 0 [0074.633] lstrlenA (lpString="*.zip") returned 5 [0074.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.rar") returned 0 [0074.633] lstrlenA (lpString="*.rar") returned 5 [0074.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.7z") returned 0 [0074.633] lstrlenA (lpString="*.7z") returned 4 [0074.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.tar") returned 0 [0074.633] lstrlenA (lpString="*.tar") returned 5 [0074.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.gzip") returned 0 [0074.633] lstrlenA (lpString="*.gzip") returned 6 [0074.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.jpg") returned 0 [0074.633] lstrlenA (lpString="*.jpg") returned 5 [0074.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.jpeg") returned 0 [0074.633] lstrlenA (lpString="*.jpeg") returned 6 [0074.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.psd") returned 0 [0074.633] lstrlenA (lpString="*.psd") returned 5 [0074.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.gif") returned 0 [0074.633] lstrlenA (lpString="*.gif") returned 5 [0074.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.doc") returned 0 [0074.633] lstrlenA (lpString="*.doc") returned 5 [0074.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.docx") returned 0 [0074.633] lstrlenA (lpString="*.docx") returned 6 [0074.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.xls") returned 0 [0074.633] lstrlenA (lpString="*.xls") returned 5 [0074.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.xlsx") returned 0 [0074.633] lstrlenA (lpString="*.xlsx") returned 6 [0074.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.ppt") returned 0 [0074.633] lstrlenA (lpString="*.ppt") returned 5 [0074.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.pptx") returned 0 [0074.633] lstrlenA (lpString="*.pptx") returned 6 [0074.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.pdf") returned 0 [0074.633] lstrlenA (lpString="*.pdf") returned 5 [0074.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.mov") returned 0 [0074.633] lstrlenA (lpString="*.mov") returned 5 [0074.633] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.m2v") returned 0 [0074.634] lstrlenA (lpString="*.m2v") returned 5 [0074.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.3gp") returned 0 [0074.634] lstrlenA (lpString="*.3gp") returned 5 [0074.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.mpeg") returned 0 [0074.634] lstrlenA (lpString="*.mpeg") returned 6 [0074.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.mpg") returned 0 [0074.634] lstrlenA (lpString="*.mpg") returned 5 [0074.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.flv") returned 0 [0074.634] lstrlenA (lpString="*.flv") returned 5 [0074.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.avi") returned 0 [0074.634] lstrlenA (lpString="*.avi") returned 5 [0074.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.mp4") returned 0 [0074.634] lstrlenA (lpString="*.mp4") returned 5 [0074.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.wmv") returned 0 [0074.634] lstrlenA (lpString="*.wmv") returned 5 [0074.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.divx") returned 0 [0074.634] lstrlenA (lpString="*.divx") returned 6 [0074.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.mkv") returned 0 [0074.634] lstrlenA (lpString="*.mkv") returned 5 [0074.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.mp3") returned 0 [0074.634] lstrlenA (lpString="*.mp3") returned 5 [0074.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.wav") returned 0 [0074.634] lstrlenA (lpString="*.wav") returned 5 [0074.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.flac") returned 0 [0074.634] lstrlenA (lpString="*.flac") returned 6 [0074.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.ape") returned 0 [0074.634] lstrlenA (lpString="*.ape") returned 5 [0074.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.wma") returned 0 [0074.634] lstrlenA (lpString="*.wma") returned 5 [0074.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.ac3") returned 0 [0074.634] lstrlenA (lpString="*.ac3") returned 5 [0074.634] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR", pszSpec="*.mxf") returned 0 [0074.634] lstrlenA (lpString="*.mxf") returned 5 [0074.634] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="WindowsMedia.TUR", cAlternateFileName="WINDOW~1.TUR")) returned 1 [0074.634] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.635] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMedia.TUR") returned -1 [0074.635] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMedia.TUR") returned -1 [0074.635] lstrcmpiA (lpString1="", lpString2="WindowsMedia.TUR") returned -1 [0074.635] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\QuickTime.TUR") returned="QuickTime.TUR" [0074.635] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\" [0074.635] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\") returned="" [0074.635] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\HOW TO DECRYPT FILES.txt" [0074.635] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_tur\\how to decrypt files.txt")) returned 0x20 [0074.635] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\", lpString2="WindowsMedia.TUR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\WindowsMedia.TUR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\WindowsMedia.TUR" [0074.635] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\WindowsMedia.TUR", pszSpec="*.zip") returned 0 [0074.635] lstrlenA (lpString="*.zip") returned 5 [0074.635] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\WindowsMedia.TUR", pszSpec="*.rar") returned 0 [0074.635] lstrlenA (lpString="*.rar") returned 5 [0074.635] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\WindowsMedia.TUR", pszSpec="*.7z") returned 0 [0074.635] lstrlenA (lpString="*.7z") returned 4 [0074.635] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\WindowsMedia.TUR", pszSpec="*.tar") returned 0 [0074.635] lstrlenA (lpString="*.tar") returned 5 [0074.635] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\WindowsMedia.TUR", pszSpec="*.gzip") returned 0 [0074.635] lstrlenA (lpString="*.gzip") returned 6 [0074.635] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\WindowsMedia.TUR", pszSpec="*.jpg") returned 0 [0074.635] lstrlenA (lpString="*.jpg") returned 5 [0074.635] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\WindowsMedia.TUR", pszSpec="*.jpeg") returned 0 [0074.635] lstrlenA (lpString="*.jpeg") returned 6 [0074.635] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\WindowsMedia.TUR", pszSpec="*.psd") returned 0 [0074.635] lstrlenA (lpString="*.psd") returned 5 [0074.635] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\WindowsMedia.TUR", pszSpec="*.gif") returned 0 [0074.635] lstrlenA (lpString="*.gif") returned 5 [0074.635] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\WindowsMedia.TUR", pszSpec="*.doc") returned 0 [0074.635] lstrlenA (lpString="*.doc") returned 5 [0074.635] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\WindowsMedia.TUR", pszSpec="*.docx") returned 0 [0074.635] lstrlenA (lpString="*.docx") returned 6 [0074.636] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="WindowsMedia.TUR", cAlternateFileName="WINDOW~1.TUR")) returned 0 [0074.636] FindClose (in: hFindFile=0x2e3578 | out: hFindFile=0x2e3578) returned 1 [0074.636] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="MPP_UKR", cAlternateFileName="")) returned 1 [0074.636] lstrcmpA (lpString1=".", lpString2="MPP_UKR") returned -1 [0074.636] lstrcmpA (lpString1="..", lpString2="MPP_UKR") returned -1 [0074.636] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*.*") returned="*.*" [0074.636] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\", lpString2="MPP_UKR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR" [0074.636] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR") returned 75 [0074.636] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0074.638] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.638] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x590000, cFileName="..", cAlternateFileName="")) returned 1 [0074.638] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.638] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.638] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Flash.UKR", cAlternateFileName="")) returned 1 [0074.638] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.638] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Flash.UKR") returned -1 [0074.639] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Flash.UKR") returned 1 [0074.639] lstrcmpiA (lpString1="", lpString2="Flash.UKR") returned -1 [0074.639] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\*.*") returned="*.*" [0074.639] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\" [0074.639] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\") returned="" [0074.639] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\HOW TO DECRYPT FILES.txt" [0074.639] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\how to decrypt files.txt")) returned 0xffffffff [0074.639] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0074.642] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0074.642] WriteFile (in: hFile=0x98, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0074.643] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.643] CloseHandle (hObject=0x98) returned 1 [0074.643] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\", lpString2="Flash.UKR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR" [0074.643] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.zip") returned 0 [0074.643] lstrlenA (lpString="*.zip") returned 5 [0074.643] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.rar") returned 0 [0074.643] lstrlenA (lpString="*.rar") returned 5 [0074.643] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.7z") returned 0 [0074.643] lstrlenA (lpString="*.7z") returned 4 [0074.643] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.tar") returned 0 [0074.643] lstrlenA (lpString="*.tar") returned 5 [0074.643] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.gzip") returned 0 [0074.643] lstrlenA (lpString="*.gzip") returned 6 [0074.643] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.jpg") returned 0 [0074.643] lstrlenA (lpString="*.jpg") returned 5 [0074.643] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.jpeg") returned 0 [0074.644] lstrlenA (lpString="*.jpeg") returned 6 [0074.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.psd") returned 0 [0074.644] lstrlenA (lpString="*.psd") returned 5 [0074.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.gif") returned 0 [0074.644] lstrlenA (lpString="*.gif") returned 5 [0074.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.doc") returned 0 [0074.644] lstrlenA (lpString="*.doc") returned 5 [0074.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.docx") returned 0 [0074.644] lstrlenA (lpString="*.docx") returned 6 [0074.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.xls") returned 0 [0074.644] lstrlenA (lpString="*.xls") returned 5 [0074.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.xlsx") returned 0 [0074.644] lstrlenA (lpString="*.xlsx") returned 6 [0074.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.ppt") returned 0 [0074.644] lstrlenA (lpString="*.ppt") returned 5 [0074.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.pptx") returned 0 [0074.644] lstrlenA (lpString="*.pptx") returned 6 [0074.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.pdf") returned 0 [0074.644] lstrlenA (lpString="*.pdf") returned 5 [0074.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.mov") returned 0 [0074.644] lstrlenA (lpString="*.mov") returned 5 [0074.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.m2v") returned 0 [0074.644] lstrlenA (lpString="*.m2v") returned 5 [0074.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.3gp") returned 0 [0074.644] lstrlenA (lpString="*.3gp") returned 5 [0074.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.mpeg") returned 0 [0074.644] lstrlenA (lpString="*.mpeg") returned 6 [0074.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.mpg") returned 0 [0074.644] lstrlenA (lpString="*.mpg") returned 5 [0074.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.flv") returned 0 [0074.644] lstrlenA (lpString="*.flv") returned 5 [0074.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.avi") returned 0 [0074.644] lstrlenA (lpString="*.avi") returned 5 [0074.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.mp4") returned 0 [0074.644] lstrlenA (lpString="*.mp4") returned 5 [0074.644] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.wmv") returned 0 [0074.645] lstrlenA (lpString="*.wmv") returned 5 [0074.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.divx") returned 0 [0074.645] lstrlenA (lpString="*.divx") returned 6 [0074.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.mkv") returned 0 [0074.645] lstrlenA (lpString="*.mkv") returned 5 [0074.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.mp3") returned 0 [0074.645] lstrlenA (lpString="*.mp3") returned 5 [0074.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.wav") returned 0 [0074.645] lstrlenA (lpString="*.wav") returned 5 [0074.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.flac") returned 0 [0074.645] lstrlenA (lpString="*.flac") returned 6 [0074.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.ape") returned 0 [0074.645] lstrlenA (lpString="*.ape") returned 5 [0074.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.wma") returned 0 [0074.645] lstrlenA (lpString="*.wma") returned 5 [0074.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.ac3") returned 0 [0074.645] lstrlenA (lpString="*.ac3") returned 5 [0074.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", pszSpec="*.mxf") returned 0 [0074.645] lstrlenA (lpString="*.mxf") returned 5 [0074.645] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCIMPP.UKR", cAlternateFileName="")) returned 1 [0074.645] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.645] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MCIMPP.UKR") returned -1 [0074.645] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MCIMPP.UKR") returned -1 [0074.645] lstrcmpiA (lpString1="", lpString2="MCIMPP.UKR") returned -1 [0074.645] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR") returned="Flash.UKR" [0074.645] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\" [0074.645] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\") returned="" [0074.645] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\HOW TO DECRYPT FILES.txt" [0074.645] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\how to decrypt files.txt")) returned 0x20 [0074.645] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\", lpString2="MCIMPP.UKR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR" [0074.645] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.zip") returned 0 [0074.646] lstrlenA (lpString="*.zip") returned 5 [0074.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.rar") returned 0 [0074.646] lstrlenA (lpString="*.rar") returned 5 [0074.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.7z") returned 0 [0074.646] lstrlenA (lpString="*.7z") returned 4 [0074.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.tar") returned 0 [0074.646] lstrlenA (lpString="*.tar") returned 5 [0074.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.gzip") returned 0 [0074.646] lstrlenA (lpString="*.gzip") returned 6 [0074.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.jpg") returned 0 [0074.646] lstrlenA (lpString="*.jpg") returned 5 [0074.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.jpeg") returned 0 [0074.646] lstrlenA (lpString="*.jpeg") returned 6 [0074.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.psd") returned 0 [0074.646] lstrlenA (lpString="*.psd") returned 5 [0074.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.gif") returned 0 [0074.646] lstrlenA (lpString="*.gif") returned 5 [0074.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.doc") returned 0 [0074.646] lstrlenA (lpString="*.doc") returned 5 [0074.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.docx") returned 0 [0074.646] lstrlenA (lpString="*.docx") returned 6 [0074.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.xls") returned 0 [0074.646] lstrlenA (lpString="*.xls") returned 5 [0074.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.xlsx") returned 0 [0074.646] lstrlenA (lpString="*.xlsx") returned 6 [0074.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.ppt") returned 0 [0074.646] lstrlenA (lpString="*.ppt") returned 5 [0074.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.pptx") returned 0 [0074.646] lstrlenA (lpString="*.pptx") returned 6 [0074.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.pdf") returned 0 [0074.646] lstrlenA (lpString="*.pdf") returned 5 [0074.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.mov") returned 0 [0074.646] lstrlenA (lpString="*.mov") returned 5 [0074.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.m2v") returned 0 [0074.646] lstrlenA (lpString="*.m2v") returned 5 [0074.646] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.3gp") returned 0 [0074.647] lstrlenA (lpString="*.3gp") returned 5 [0074.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.mpeg") returned 0 [0074.647] lstrlenA (lpString="*.mpeg") returned 6 [0074.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.mpg") returned 0 [0074.647] lstrlenA (lpString="*.mpg") returned 5 [0074.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.flv") returned 0 [0074.647] lstrlenA (lpString="*.flv") returned 5 [0074.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.avi") returned 0 [0074.647] lstrlenA (lpString="*.avi") returned 5 [0074.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.mp4") returned 0 [0074.647] lstrlenA (lpString="*.mp4") returned 5 [0074.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.wmv") returned 0 [0074.647] lstrlenA (lpString="*.wmv") returned 5 [0074.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.divx") returned 0 [0074.647] lstrlenA (lpString="*.divx") returned 6 [0074.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.mkv") returned 0 [0074.647] lstrlenA (lpString="*.mkv") returned 5 [0074.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.mp3") returned 0 [0074.647] lstrlenA (lpString="*.mp3") returned 5 [0074.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.wav") returned 0 [0074.647] lstrlenA (lpString="*.wav") returned 5 [0074.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.flac") returned 0 [0074.647] lstrlenA (lpString="*.flac") returned 6 [0074.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.ape") returned 0 [0074.647] lstrlenA (lpString="*.ape") returned 5 [0074.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.wma") returned 0 [0074.647] lstrlenA (lpString="*.wma") returned 5 [0074.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.ac3") returned 0 [0074.647] lstrlenA (lpString="*.ac3") returned 5 [0074.647] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", pszSpec="*.mxf") returned 0 [0074.647] lstrlenA (lpString="*.mxf") returned 5 [0074.647] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="QuickTime.UKR", cAlternateFileName="QUICKT~1.UKR")) returned 1 [0074.647] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.647] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="QuickTime.UKR") returned -1 [0074.647] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuickTime.UKR") returned -1 [0074.647] lstrcmpiA (lpString1="", lpString2="QuickTime.UKR") returned -1 [0074.648] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR") returned="MCIMPP.UKR" [0074.648] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\" [0074.648] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\") returned="" [0074.648] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\HOW TO DECRYPT FILES.txt" [0074.648] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\how to decrypt files.txt")) returned 0x20 [0074.648] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\", lpString2="QuickTime.UKR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR" [0074.648] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.zip") returned 0 [0074.648] lstrlenA (lpString="*.zip") returned 5 [0074.648] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.rar") returned 0 [0074.648] lstrlenA (lpString="*.rar") returned 5 [0074.648] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.7z") returned 0 [0074.648] lstrlenA (lpString="*.7z") returned 4 [0074.648] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.tar") returned 0 [0074.648] lstrlenA (lpString="*.tar") returned 5 [0074.648] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.gzip") returned 0 [0074.648] lstrlenA (lpString="*.gzip") returned 6 [0074.648] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.jpg") returned 0 [0074.648] lstrlenA (lpString="*.jpg") returned 5 [0074.648] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.jpeg") returned 0 [0074.648] lstrlenA (lpString="*.jpeg") returned 6 [0074.648] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.psd") returned 0 [0074.648] lstrlenA (lpString="*.psd") returned 5 [0074.648] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.gif") returned 0 [0074.648] lstrlenA (lpString="*.gif") returned 5 [0074.648] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.doc") returned 0 [0074.648] lstrlenA (lpString="*.doc") returned 5 [0074.648] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.docx") returned 0 [0074.648] lstrlenA (lpString="*.docx") returned 6 [0074.648] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.xls") returned 0 [0074.648] lstrlenA (lpString="*.xls") returned 5 [0074.648] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.xlsx") returned 0 [0074.648] lstrlenA (lpString="*.xlsx") returned 6 [0074.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.ppt") returned 0 [0074.649] lstrlenA (lpString="*.ppt") returned 5 [0074.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.pptx") returned 0 [0074.649] lstrlenA (lpString="*.pptx") returned 6 [0074.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.pdf") returned 0 [0074.649] lstrlenA (lpString="*.pdf") returned 5 [0074.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.mov") returned 0 [0074.649] lstrlenA (lpString="*.mov") returned 5 [0074.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.m2v") returned 0 [0074.649] lstrlenA (lpString="*.m2v") returned 5 [0074.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.3gp") returned 0 [0074.649] lstrlenA (lpString="*.3gp") returned 5 [0074.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.mpeg") returned 0 [0074.649] lstrlenA (lpString="*.mpeg") returned 6 [0074.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.mpg") returned 0 [0074.649] lstrlenA (lpString="*.mpg") returned 5 [0074.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.flv") returned 0 [0074.649] lstrlenA (lpString="*.flv") returned 5 [0074.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.avi") returned 0 [0074.649] lstrlenA (lpString="*.avi") returned 5 [0074.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.mp4") returned 0 [0074.649] lstrlenA (lpString="*.mp4") returned 5 [0074.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.wmv") returned 0 [0074.649] lstrlenA (lpString="*.wmv") returned 5 [0074.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.divx") returned 0 [0074.649] lstrlenA (lpString="*.divx") returned 6 [0074.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.mkv") returned 0 [0074.649] lstrlenA (lpString="*.mkv") returned 5 [0074.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.mp3") returned 0 [0074.649] lstrlenA (lpString="*.mp3") returned 5 [0074.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.wav") returned 0 [0074.649] lstrlenA (lpString="*.wav") returned 5 [0074.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.flac") returned 0 [0074.649] lstrlenA (lpString="*.flac") returned 6 [0074.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.ape") returned 0 [0074.649] lstrlenA (lpString="*.ape") returned 5 [0074.649] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.wma") returned 0 [0074.650] lstrlenA (lpString="*.wma") returned 5 [0074.650] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.ac3") returned 0 [0074.650] lstrlenA (lpString="*.ac3") returned 5 [0074.650] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", pszSpec="*.mxf") returned 0 [0074.650] lstrlenA (lpString="*.mxf") returned 5 [0074.650] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="WindowsMedia.UKR", cAlternateFileName="WINDOW~1.UKR")) returned 1 [0074.650] PeekMessageA (in: lpMsg=0x18f4e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f4e4) returned 0 [0074.650] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="WindowsMedia.UKR") returned -1 [0074.650] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMedia.UKR") returned -1 [0074.650] lstrcmpiA (lpString1="", lpString2="WindowsMedia.UKR") returned -1 [0074.650] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR") returned="QuickTime.UKR" [0074.650] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\" [0074.650] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\") returned="" [0074.650] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\HOW TO DECRYPT FILES.txt" [0074.650] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\how to decrypt files.txt")) returned 0x20 [0074.650] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\", lpString2="WindowsMedia.UKR" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR" [0074.650] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.zip") returned 0 [0074.650] lstrlenA (lpString="*.zip") returned 5 [0074.650] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.rar") returned 0 [0074.650] lstrlenA (lpString="*.rar") returned 5 [0074.650] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.7z") returned 0 [0074.650] lstrlenA (lpString="*.7z") returned 4 [0074.650] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.tar") returned 0 [0074.650] lstrlenA (lpString="*.tar") returned 5 [0074.650] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.gzip") returned 0 [0074.650] lstrlenA (lpString="*.gzip") returned 6 [0074.650] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.jpg") returned 0 [0074.650] lstrlenA (lpString="*.jpg") returned 5 [0074.650] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.jpeg") returned 0 [0074.650] lstrlenA (lpString="*.jpeg") returned 6 [0074.650] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.psd") returned 0 [0074.650] lstrlenA (lpString="*.psd") returned 5 [0074.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.gif") returned 0 [0074.651] lstrlenA (lpString="*.gif") returned 5 [0074.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.doc") returned 0 [0074.651] lstrlenA (lpString="*.doc") returned 5 [0074.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.docx") returned 0 [0074.651] lstrlenA (lpString="*.docx") returned 6 [0074.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.xls") returned 0 [0074.651] lstrlenA (lpString="*.xls") returned 5 [0074.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.xlsx") returned 0 [0074.651] lstrlenA (lpString="*.xlsx") returned 6 [0074.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.ppt") returned 0 [0074.651] lstrlenA (lpString="*.ppt") returned 5 [0074.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.pptx") returned 0 [0074.651] lstrlenA (lpString="*.pptx") returned 6 [0074.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.pdf") returned 0 [0074.651] lstrlenA (lpString="*.pdf") returned 5 [0074.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.mov") returned 0 [0074.651] lstrlenA (lpString="*.mov") returned 5 [0074.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.m2v") returned 0 [0074.651] lstrlenA (lpString="*.m2v") returned 5 [0074.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.3gp") returned 0 [0074.651] lstrlenA (lpString="*.3gp") returned 5 [0074.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.mpeg") returned 0 [0074.651] lstrlenA (lpString="*.mpeg") returned 6 [0074.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.mpg") returned 0 [0074.651] lstrlenA (lpString="*.mpg") returned 5 [0074.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.flv") returned 0 [0074.651] lstrlenA (lpString="*.flv") returned 5 [0074.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.avi") returned 0 [0074.651] lstrlenA (lpString="*.avi") returned 5 [0074.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.mp4") returned 0 [0074.651] lstrlenA (lpString="*.mp4") returned 5 [0074.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.wmv") returned 0 [0074.651] lstrlenA (lpString="*.wmv") returned 5 [0074.651] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.divx") returned 0 [0074.651] lstrlenA (lpString="*.divx") returned 6 [0074.652] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.mkv") returned 0 [0074.652] lstrlenA (lpString="*.mkv") returned 5 [0074.652] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.mp3") returned 0 [0074.652] lstrlenA (lpString="*.mp3") returned 5 [0074.652] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.wav") returned 0 [0074.652] lstrlenA (lpString="*.wav") returned 5 [0074.652] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.flac") returned 0 [0074.652] lstrlenA (lpString="*.flac") returned 6 [0074.652] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.ape") returned 0 [0074.652] lstrlenA (lpString="*.ape") returned 5 [0074.652] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.wma") returned 0 [0074.652] lstrlenA (lpString="*.wma") returned 5 [0074.652] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.ac3") returned 0 [0074.652] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", pszSpec="*.mxf") returned 0 [0074.652] FindNextFileA (in: hFindFile=0x2e3578, lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x430045, dwReserved1=0x590052, cFileName="WindowsMedia.UKR", cAlternateFileName="WINDOW~1.UKR")) returned 0 [0074.652] FindClose (in: hFindFile=0x2e3578 | out: hFindFile=0x2e3578) returned 1 [0074.652] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="MPP_UKR", cAlternateFileName="")) returned 0 [0074.652] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0074.652] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x174c63, dwReserved0=0x75004d, dwReserved1=0x3, cFileName="Multimedia.api", cAlternateFileName="MULTIM~1.API")) returned 1 [0074.652] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.652] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Multimedia.api") returned -1 [0074.652] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Multimedia.api") returned -1 [0074.652] lstrcmpiA (lpString1="", lpString2="Multimedia.api") returned -1 [0074.652] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\*.*") returned="*.*" [0074.653] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0074.653] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="" [0074.653] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt" [0074.653] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\how to decrypt files.txt")) returned 0x20 [0074.653] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\", lpString2="Multimedia.api" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api" [0074.653] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.zip") returned 0 [0074.653] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.rar") returned 0 [0074.653] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.7z") returned 0 [0074.653] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.tar") returned 0 [0074.653] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.gzip") returned 0 [0074.653] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.jpg") returned 0 [0074.653] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.jpeg") returned 0 [0074.653] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.psd") returned 0 [0074.653] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.gif") returned 0 [0074.653] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.doc") returned 0 [0074.653] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.docx") returned 0 [0074.653] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.xls") returned 0 [0074.653] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.xlsx") returned 0 [0074.653] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.ppt") returned 0 [0074.653] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.pptx") returned 0 [0074.653] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.pdf") returned 0 [0074.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.mov") returned 0 [0074.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.m2v") returned 0 [0074.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.3gp") returned 0 [0074.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.mpeg") returned 0 [0074.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.mpg") returned 0 [0074.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.flv") returned 0 [0074.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.avi") returned 0 [0074.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.mp4") returned 0 [0074.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.wmv") returned 0 [0074.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.divx") returned 0 [0074.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.mkv") returned 0 [0074.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.mp3") returned 0 [0074.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.wav") returned 0 [0074.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.flac") returned 0 [0074.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.ape") returned 0 [0074.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.wma") returned 0 [0074.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.ac3") returned 0 [0074.654] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", pszSpec="*.mxf") returned 0 [0074.654] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x69263, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDDom.api", cAlternateFileName="")) returned 1 [0074.654] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.654] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PDDom.api") returned -1 [0074.654] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PDDom.api") returned -1 [0074.655] lstrcmpiA (lpString1="", lpString2="PDDom.api") returned -1 [0074.655] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api") returned="Multimedia.api" [0074.655] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0074.655] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="" [0074.655] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt" [0074.655] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\how to decrypt files.txt")) returned 0x20 [0074.655] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\", lpString2="PDDom.api" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api" [0074.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.zip") returned 0 [0074.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.rar") returned 0 [0074.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.7z") returned 0 [0074.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.tar") returned 0 [0074.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.gzip") returned 0 [0074.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.jpg") returned 0 [0074.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.jpeg") returned 0 [0074.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.psd") returned 0 [0074.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.gif") returned 0 [0074.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.doc") returned 0 [0074.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.docx") returned 0 [0074.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.xls") returned 0 [0074.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.xlsx") returned 0 [0074.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.ppt") returned 0 [0074.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.pptx") returned 0 [0074.655] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.pdf") returned 0 [0074.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.mov") returned 0 [0074.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.m2v") returned 0 [0074.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.3gp") returned 0 [0074.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.mpeg") returned 0 [0074.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.mpg") returned 0 [0074.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.flv") returned 0 [0074.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.avi") returned 0 [0074.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.mp4") returned 0 [0074.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.wmv") returned 0 [0074.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.divx") returned 0 [0074.656] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.mkv") returned 0 [0074.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.mp3") returned 0 [0074.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.wav") returned 0 [0074.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.flac") returned 0 [0074.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.ape") returned 0 [0074.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.wma") returned 0 [0074.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.ac3") returned 0 [0074.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", pszSpec="*.mxf") returned 0 [0074.657] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x73f263, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLite.api", cAlternateFileName="")) returned 1 [0074.657] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.657] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="PPKLite.api") returned -1 [0074.657] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PPKLite.api") returned -1 [0074.657] lstrcmpiA (lpString1="", lpString2="PPKLite.api") returned -1 [0074.657] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api") returned="PDDom.api" [0074.657] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0074.657] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="" [0074.657] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt" [0074.657] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\how to decrypt files.txt")) returned 0x20 [0074.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.zip") returned 0 [0074.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.rar") returned 0 [0074.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.7z") returned 0 [0074.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.tar") returned 0 [0074.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.gzip") returned 0 [0074.657] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.jpg") returned 0 [0074.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.jpeg") returned 0 [0074.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.psd") returned 0 [0074.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.gif") returned 0 [0074.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.doc") returned 0 [0074.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.docx") returned 0 [0074.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.xls") returned 0 [0074.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.xlsx") returned 0 [0074.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.ppt") returned 0 [0074.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.pptx") returned 0 [0074.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.pdf") returned 0 [0074.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.mov") returned 0 [0074.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.m2v") returned 0 [0074.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.3gp") returned 0 [0074.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.mpeg") returned 0 [0074.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.mpg") returned 0 [0074.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.flv") returned 0 [0074.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.avi") returned 0 [0074.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.mp4") returned 0 [0074.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.wmv") returned 0 [0074.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.divx") returned 0 [0074.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.mkv") returned 0 [0074.658] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.mp3") returned 0 [0074.659] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.wav") returned 0 [0074.659] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.flac") returned 0 [0074.659] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.ape") returned 0 [0074.659] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.wma") returned 0 [0074.659] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.ac3") returned 0 [0074.659] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", pszSpec="*.mxf") returned 0 [0074.659] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b663, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.api", cAlternateFileName="READOU~1.API")) returned 1 [0074.659] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.659] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ReadOutLoud.api") returned -1 [0074.659] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ReadOutLoud.api") returned -1 [0074.659] lstrcmpiA (lpString1="", lpString2="ReadOutLoud.api") returned -1 [0074.659] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api") returned="PPKLite.api" [0074.659] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0074.659] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="" [0074.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ReadOutLoud.api", pszSpec="*.zip") returned 0 [0074.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ReadOutLoud.api", pszSpec="*.rar") returned 0 [0074.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ReadOutLoud.api", pszSpec="*.7z") returned 0 [0074.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ReadOutLoud.api", pszSpec="*.tar") returned 0 [0074.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ReadOutLoud.api", pszSpec="*.gzip") returned 0 [0074.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ReadOutLoud.api", pszSpec="*.jpg") returned 0 [0074.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ReadOutLoud.api", pszSpec="*.jpeg") returned 0 [0074.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ReadOutLoud.api", pszSpec="*.psd") returned 0 [0074.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ReadOutLoud.api", pszSpec="*.gif") returned 0 [0074.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ReadOutLoud.api", pszSpec="*.doc") returned 0 [0074.661] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ReadOutLoud.api", pszSpec="*.docx") returned 0 [0074.662] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dab5520, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x54e63, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.api", cAlternateFileName="")) returned 1 [0074.662] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.662] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="reflow.api") returned -1 [0074.662] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="reflow.api") returned -1 [0074.662] lstrcmpiA (lpString1="", lpString2="reflow.api") returned -1 [0074.662] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ReadOutLoud.api") returned="ReadOutLoud.api" [0074.662] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0074.662] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="" [0074.662] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da43100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x63263, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.api", cAlternateFileName="SAVEAS~1.API")) returned 1 [0074.662] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.662] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SaveAsRTF.api") returned -1 [0074.662] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SaveAsRTF.api") returned -1 [0074.662] lstrcmpiA (lpString1="", lpString2="SaveAsRTF.api") returned -1 [0074.662] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\reflow.api") returned="reflow.api" [0074.662] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0074.662] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="" [0074.662] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d618a80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x69063, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.api", cAlternateFileName="")) returned 1 [0074.662] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.662] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Search.api") returned -1 [0074.662] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Search.api") returned -1 [0074.662] lstrcmpiA (lpString1="", lpString2="Search.api") returned -1 [0074.662] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\SaveAsRTF.api") returned="SaveAsRTF.api" [0074.662] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0074.662] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="" [0074.663] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e05720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25c63, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.api", cAlternateFileName="")) returned 1 [0074.663] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.663] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SendMail.api") returned -1 [0074.663] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SendMail.api") returned -1 [0074.663] lstrcmpiA (lpString1="", lpString2="SendMail.api") returned -1 [0074.663] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Search.api") returned="Search.api" [0074.663] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0074.663] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="" [0074.663] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43a63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.api", cAlternateFileName="")) returned 1 [0074.663] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.663] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Spelling.api") returned -1 [0074.663] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Spelling.api") returned -1 [0074.663] lstrcmpiA (lpString1="", lpString2="Spelling.api") returned -1 [0074.663] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\SendMail.api") returned="SendMail.api" [0074.663] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0074.663] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="" [0074.663] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f498460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x29463, dwReserved0=0x0, dwReserved1=0x0, cFileName="Updater.api", cAlternateFileName="")) returned 1 [0074.663] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.663] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Updater.api") returned -1 [0074.663] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Updater.api") returned -1 [0074.663] lstrcmpiA (lpString1="", lpString2="Updater.api") returned -1 [0074.663] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Spelling.api") returned="Spelling.api" [0074.663] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0074.663] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="" [0074.663] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4ac63, dwReserved0=0x0, dwReserved1=0x0, cFileName="weblink.api", cAlternateFileName="")) returned 1 [0074.663] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.663] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="weblink.api") returned -1 [0074.664] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="weblink.api") returned -1 [0074.664] lstrcmpiA (lpString1="", lpString2="weblink.api") returned -1 [0074.664] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Updater.api") returned="Updater.api" [0074.664] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0074.664] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="" [0074.664] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4ac63, dwReserved0=0x0, dwReserved1=0x0, cFileName="weblink.api", cAlternateFileName="")) returned 0 [0074.664] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0074.664] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="plug_ins3d", cAlternateFileName="PLUG_I~1")) returned 1 [0074.664] lstrcmpA (lpString1=".", lpString2="plug_ins3d") returned -1 [0074.664] lstrcmpA (lpString1="..", lpString2="plug_ins3d") returned -1 [0074.664] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\*.*") returned="*.*" [0074.664] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0074.671] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.671] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.671] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.671] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.675] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc0c180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x86988, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="2d.x3d", cAlternateFileName="")) returned 1 [0074.675] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.675] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="2d.x3d") returned 1 [0074.675] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="2d.x3d") returned 1 [0074.676] lstrcmpiA (lpString1="", lpString2="2d.x3d") returned -1 [0074.676] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\*.*") returned="*.*" [0074.676] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" [0074.678] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="" [0074.702] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.702] CloseHandle (hObject=0x90) returned 1 [0074.702] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbe6020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="3difr.x3d", cAlternateFileName="")) returned 1 [0074.702] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.702] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="3difr.x3d") returned 1 [0074.702] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="3difr.x3d") returned 1 [0074.702] lstrcmpiA (lpString1="", lpString2="3difr.x3d") returned -1 [0074.702] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\2d.x3d") returned="2d.x3d" [0074.703] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" [0074.703] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="" [0074.720] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbe6020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6a590, dwReserved0=0x0, dwReserved1=0x0, cFileName="drvDX8.x3d", cAlternateFileName="")) returned 1 [0074.720] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.720] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="drvDX8.x3d") returned 1 [0074.720] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="drvDX8.x3d") returned 1 [0074.720] lstrcmpiA (lpString1="", lpString2="drvDX8.x3d") returned -1 [0074.720] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\3difr.x3d") returned="3difr.x3d" [0074.720] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" [0074.720] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="" [0074.721] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbe6020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc6f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="drvDX9.x3d", cAlternateFileName="")) returned 1 [0074.721] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.721] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="drvDX9.x3d") returned 1 [0074.721] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="drvDX9.x3d") returned 1 [0074.721] lstrcmpiA (lpString1="", lpString2="drvDX9.x3d") returned -1 [0074.721] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvDX8.x3d") returned="drvDX8.x3d" [0074.721] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" [0074.721] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="" [0074.721] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x35190, dwReserved0=0x0, dwReserved1=0x0, cFileName="drvSOFT.x3d", cAlternateFileName="")) returned 1 [0074.721] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.721] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="drvSOFT.x3d") returned 1 [0074.721] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="drvSOFT.x3d") returned 1 [0074.721] lstrcmpiA (lpString1="", lpString2="drvSOFT.x3d") returned -1 [0074.721] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvDX9.x3d") returned="drvDX9.x3d" [0074.721] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" [0074.721] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="" [0074.721] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dbbfec0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="prc", cAlternateFileName="")) returned 1 [0074.721] lstrcmpA (lpString1=".", lpString2="prc") returned -1 [0074.721] lstrcmpA (lpString1="..", lpString2="prc") returned -1 [0074.721] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvSOFT.x3d") returned="drvSOFT.x3d" [0074.721] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dbbfec0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2e246e, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0074.738] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.738] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dbbfec0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0074.738] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.738] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.738] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x131c4, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MyriadCAD.otf", cAlternateFileName="MYRIAD~1.OTF")) returned 1 [0074.739] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0074.739] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MyriadCAD.otf") returned -1 [0074.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MyriadCAD.otf") returned -1 [0074.739] lstrcmpiA (lpString1="", lpString2="MyriadCAD.otf") returned -1 [0074.739] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\*.*") returned="*.*" [0074.739] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\" [0074.739] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\") returned="" [0074.742] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.742] CloseHandle (hObject=0x94) returned 1 [0074.742] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x131c4, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="MyriadCAD.otf", cAlternateFileName="MYRIAD~1.OTF")) returned 0 [0074.743] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0074.743] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc58440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x301190, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="prcr.x3d", cAlternateFileName="")) returned 1 [0074.743] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.743] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="prcr.x3d") returned -1 [0074.743] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="prcr.x3d") returned -1 [0074.743] lstrcmpiA (lpString1="", lpString2="prcr.x3d") returned -1 [0074.743] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\*.*") returned="*.*" [0074.743] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" [0074.743] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="" [0074.743] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5798, dwReserved0=0x0, dwReserved1=0x0, cFileName="tesselate.x3d", cAlternateFileName="TESSEL~1.X3D")) returned 1 [0074.743] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.743] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tesselate.x3d") returned -1 [0074.743] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tesselate.x3d") returned -1 [0074.743] lstrcmpiA (lpString1="", lpString2="tesselate.x3d") returned -1 [0074.743] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prcr.x3d") returned="prcr.x3d" [0074.743] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" [0074.743] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="" [0074.743] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5798, dwReserved0=0x0, dwReserved1=0x0, cFileName="tesselate.x3d", cAlternateFileName="TESSEL~1.X3D")) returned 0 [0074.743] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0074.744] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="pmd.cer", cAlternateFileName="")) returned 1 [0074.744] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0074.744] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="pmd.cer") returned -1 [0074.744] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pmd.cer") returned -1 [0074.744] lstrcmpiA (lpString1="", lpString2="pmd.cer") returned -1 [0074.744] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\*.*") returned="*.*" [0074.744] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0074.744] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="" [0074.744] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8b98, dwReserved0=0x0, dwReserved1=0x0, cFileName="reader_sl.exe", cAlternateFileName="READER~1.EXE")) returned 1 [0074.744] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0074.744] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="reader_sl.exe") returned -1 [0074.744] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="reader_sl.exe") returned -1 [0074.744] lstrcmpiA (lpString1="", lpString2="reader_sl.exe") returned -1 [0074.744] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pmd.cer") returned="pmd.cer" [0074.744] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0074.744] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="" [0074.744] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x21af90, dwReserved0=0x0, dwReserved1=0x0, cFileName="rt3d.dll", cAlternateFileName="")) returned 1 [0074.744] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0074.744] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rt3d.dll") returned -1 [0074.744] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rt3d.dll") returned -1 [0074.744] lstrcmpiA (lpString1="", lpString2="rt3d.dll") returned -1 [0074.744] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\reader_sl.exe") returned="reader_sl.exe" [0074.744] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0074.745] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="" [0074.745] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="RTC.der", cAlternateFileName="")) returned 1 [0074.745] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0074.745] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="RTC.der") returned -1 [0074.745] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RTC.der") returned -1 [0074.745] lstrcmpiA (lpString1="", lpString2="RTC.der") returned -1 [0074.745] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\rt3d.dll") returned="rt3d.dll" [0074.745] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0074.745] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="" [0074.745] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8ff90, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScCore.dll", cAlternateFileName="")) returned 1 [0074.745] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0074.745] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ScCore.dll") returned -1 [0074.745] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ScCore.dll") returned -1 [0074.745] lstrcmpiA (lpString1="", lpString2="ScCore.dll") returned -1 [0074.745] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\RTC.der") returned="RTC.der" [0074.745] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0074.745] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="" [0074.745] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x820095e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x820095e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0074.745] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0074.745] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0074.745] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ScCore.dll") returned="ScCore.dll" [0074.746] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x820095e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x820095e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2df450, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0074.750] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.750] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x820095e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x820095e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0074.750] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.751] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.751] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8202f740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x101bc5, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DEXShare.spi", cAlternateFileName="")) returned 1 [0074.751] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.751] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DEXShare.spi") returned 1 [0074.752] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DEXShare.spi") returned 1 [0074.752] lstrcmpiA (lpString1="", lpString2="DEXShare.spi") returned -1 [0074.758] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\*.*") returned="*.*" [0074.758] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\" [0074.758] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\") returned="" [0074.774] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.774] CloseHandle (hObject=0x90) returned 1 [0074.774] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.cfg", cAlternateFileName="")) returned 1 [0074.774] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.774] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Services.cfg") returned -1 [0074.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Services.cfg") returned -1 [0074.774] lstrcmpiA (lpString1="", lpString2="Services.cfg") returned -1 [0074.774] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\DEXShare.spi") returned="DEXShare.spi" [0074.774] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\" [0074.774] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\") returned="" [0074.774] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.cfg", cAlternateFileName="")) returned 0 [0074.775] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0074.775] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffc0b80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffc0b80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="SPPlugins", cAlternateFileName="SPPLUG~1")) returned 1 [0074.775] lstrcmpA (lpString1=".", lpString2="SPPlugins") returned -1 [0074.775] lstrcmpA (lpString1="..", lpString2="SPPlugins") returned -1 [0074.775] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\*.*") returned="*.*" [0074.775] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffc0b80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffc0b80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0074.787] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.787] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffc0b80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffc0b80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.788] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.788] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.788] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x154e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ADMPlugin.apl", cAlternateFileName="ADMPLU~1.APL")) returned 1 [0074.790] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.790] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ADMPlugin.apl") returned 1 [0074.790] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADMPlugin.apl") returned 1 [0074.790] lstrcmpiA (lpString1="", lpString2="ADMPlugin.apl") returned -1 [0074.790] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\*.*") returned="*.*" [0074.790] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\" [0074.790] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\") returned="" [0074.790] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\HOW TO DECRYPT FILES.txt" [0074.790] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\spplugins\\how to decrypt files.txt")) returned 0xffffffff [0074.791] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\spplugins\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0074.792] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0074.792] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0074.793] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.793] CloseHandle (hObject=0x90) returned 1 [0074.793] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\", lpString2="ADMPlugin.apl" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl" [0074.793] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.zip") returned 0 [0074.793] lstrlenA (lpString="*.zip") returned 5 [0074.793] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.rar") returned 0 [0074.793] lstrlenA (lpString="*.rar") returned 5 [0074.793] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.7z") returned 0 [0074.794] lstrlenA (lpString="*.7z") returned 4 [0074.794] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.tar") returned 0 [0074.794] lstrlenA (lpString="*.tar") returned 5 [0074.794] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.gzip") returned 0 [0074.794] lstrlenA (lpString="*.gzip") returned 6 [0074.794] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.jpg") returned 0 [0074.794] lstrlenA (lpString="*.jpg") returned 5 [0074.794] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.jpeg") returned 0 [0074.794] lstrlenA (lpString="*.jpeg") returned 6 [0074.794] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.psd") returned 0 [0074.794] lstrlenA (lpString="*.psd") returned 5 [0074.794] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.gif") returned 0 [0074.794] lstrlenA (lpString="*.gif") returned 5 [0074.794] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.doc") returned 0 [0074.794] lstrlenA (lpString="*.doc") returned 5 [0074.794] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.docx") returned 0 [0074.794] lstrlenA (lpString="*.docx") returned 6 [0074.794] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.xls") returned 0 [0074.794] lstrlenA (lpString="*.xls") returned 5 [0074.794] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.xlsx") returned 0 [0074.794] lstrlenA (lpString="*.xlsx") returned 6 [0074.794] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.ppt") returned 0 [0074.794] lstrlenA (lpString="*.ppt") returned 5 [0074.794] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.pptx") returned 0 [0074.794] lstrlenA (lpString="*.pptx") returned 6 [0074.794] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.pdf") returned 0 [0074.794] lstrlenA (lpString="*.pdf") returned 5 [0074.795] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.mov") returned 0 [0074.795] lstrlenA (lpString="*.mov") returned 5 [0074.795] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.m2v") returned 0 [0074.795] lstrlenA (lpString="*.m2v") returned 5 [0074.795] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.3gp") returned 0 [0074.795] lstrlenA (lpString="*.3gp") returned 5 [0074.795] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.mpeg") returned 0 [0074.795] lstrlenA (lpString="*.mpeg") returned 6 [0074.795] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.mpg") returned 0 [0074.795] lstrlenA (lpString="*.mpg") returned 5 [0074.795] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.flv") returned 0 [0074.795] lstrlenA (lpString="*.flv") returned 5 [0074.795] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.avi") returned 0 [0074.795] lstrlenA (lpString="*.avi") returned 5 [0074.795] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.mp4") returned 0 [0074.795] lstrlenA (lpString="*.mp4") returned 5 [0074.795] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.wmv") returned 0 [0074.795] lstrlenA (lpString="*.wmv") returned 5 [0074.795] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.divx") returned 0 [0074.795] lstrlenA (lpString="*.divx") returned 6 [0074.795] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.mkv") returned 0 [0074.795] lstrlenA (lpString="*.mkv") returned 5 [0074.795] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.mp3") returned 0 [0074.795] lstrlenA (lpString="*.mp3") returned 5 [0074.795] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.wav") returned 0 [0074.795] lstrlenA (lpString="*.wav") returned 5 [0074.795] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.flac") returned 0 [0074.795] lstrlenA (lpString="*.flac") returned 6 [0074.796] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.ape") returned 0 [0074.796] lstrlenA (lpString="*.ape") returned 5 [0074.796] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.wma") returned 0 [0074.796] lstrlenA (lpString="*.wma") returned 5 [0074.796] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.ac3") returned 0 [0074.796] lstrlenA (lpString="*.ac3") returned 5 [0074.796] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl", pszSpec="*.mxf") returned 0 [0074.796] lstrlenA (lpString="*.mxf") returned 5 [0074.796] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x154e00, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ADMPlugin.apl", cAlternateFileName="ADMPLU~1.APL")) returned 0 [0074.796] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0074.796] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3cd90, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="sqlite.dll", cAlternateFileName="")) returned 1 [0074.796] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0074.796] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="sqlite.dll") returned -1 [0074.796] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sqlite.dll") returned -1 [0074.796] lstrcmpiA (lpString1="", lpString2="sqlite.dll") returned -1 [0074.796] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\*.*") returned="*.*" [0074.796] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0074.796] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="" [0074.796] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\HOW TO DECRYPT FILES.txt" [0074.796] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\how to decrypt files.txt")) returned 0x20 [0074.796] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\", lpString2="sqlite.dll" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll" [0074.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.zip") returned 0 [0074.797] lstrlenA (lpString="*.zip") returned 5 [0074.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.rar") returned 0 [0074.797] lstrlenA (lpString="*.rar") returned 5 [0074.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.7z") returned 0 [0074.797] lstrlenA (lpString="*.7z") returned 4 [0074.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.tar") returned 0 [0074.797] lstrlenA (lpString="*.tar") returned 5 [0074.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.gzip") returned 0 [0074.797] lstrlenA (lpString="*.gzip") returned 6 [0074.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.jpg") returned 0 [0074.797] lstrlenA (lpString="*.jpg") returned 5 [0074.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.jpeg") returned 0 [0074.797] lstrlenA (lpString="*.jpeg") returned 6 [0074.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.psd") returned 0 [0074.797] lstrlenA (lpString="*.psd") returned 5 [0074.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.gif") returned 0 [0074.797] lstrlenA (lpString="*.gif") returned 5 [0074.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.doc") returned 0 [0074.797] lstrlenA (lpString="*.doc") returned 5 [0074.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.docx") returned 0 [0074.797] lstrlenA (lpString="*.docx") returned 6 [0074.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.xls") returned 0 [0074.797] lstrlenA (lpString="*.xls") returned 5 [0074.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.xlsx") returned 0 [0074.797] lstrlenA (lpString="*.xlsx") returned 6 [0074.797] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.ppt") returned 0 [0074.797] lstrlenA (lpString="*.ppt") returned 5 [0074.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.pptx") returned 0 [0074.798] lstrlenA (lpString="*.pptx") returned 6 [0074.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.pdf") returned 0 [0074.798] lstrlenA (lpString="*.pdf") returned 5 [0074.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.mov") returned 0 [0074.798] lstrlenA (lpString="*.mov") returned 5 [0074.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.m2v") returned 0 [0074.798] lstrlenA (lpString="*.m2v") returned 5 [0074.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.3gp") returned 0 [0074.798] lstrlenA (lpString="*.3gp") returned 5 [0074.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.mpeg") returned 0 [0074.798] lstrlenA (lpString="*.mpeg") returned 6 [0074.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.mpg") returned 0 [0074.798] lstrlenA (lpString="*.mpg") returned 5 [0074.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.flv") returned 0 [0074.798] lstrlenA (lpString="*.flv") returned 5 [0074.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.avi") returned 0 [0074.798] lstrlenA (lpString="*.avi") returned 5 [0074.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.mp4") returned 0 [0074.798] lstrlenA (lpString="*.mp4") returned 5 [0074.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.wmv") returned 0 [0074.798] lstrlenA (lpString="*.wmv") returned 5 [0074.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.divx") returned 0 [0074.798] lstrlenA (lpString="*.divx") returned 6 [0074.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.mkv") returned 0 [0074.798] lstrlenA (lpString="*.mkv") returned 5 [0074.798] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.mp3") returned 0 [0074.798] lstrlenA (lpString="*.mp3") returned 5 [0074.799] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.wav") returned 0 [0074.799] lstrlenA (lpString="*.wav") returned 5 [0074.799] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.flac") returned 0 [0074.799] lstrlenA (lpString="*.flac") returned 6 [0074.799] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.ape") returned 0 [0074.799] lstrlenA (lpString="*.ape") returned 5 [0074.799] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.wma") returned 0 [0074.799] lstrlenA (lpString="*.wma") returned 5 [0074.799] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.ac3") returned 0 [0074.799] lstrlenA (lpString="*.ac3") returned 5 [0074.799] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll", pszSpec="*.mxf") returned 0 [0074.799] lstrlenA (lpString="*.mxf") returned 5 [0074.799] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801fc020, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8026e440, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tracker", cAlternateFileName="")) returned 1 [0074.799] lstrcmpA (lpString1=".", lpString2="Tracker") returned -1 [0074.799] lstrcmpA (lpString1="..", lpString2="Tracker") returned -1 [0074.799] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\sqlite.dll") returned="sqlite.dll" [0074.799] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\", lpString2="Tracker" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0074.799] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned 55 [0074.799] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801fc020, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8026e440, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2df450, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0074.820] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0074.820] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801fc020, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8026e440, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0074.847] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0074.847] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0074.847] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="add_reviewer.gif", cAlternateFileName="ADD_RE~1.GIF")) returned 1 [0074.847] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.847] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="add_reviewer.gif") returned 1 [0074.847] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="add_reviewer.gif") returned 1 [0074.847] lstrcmpiA (lpString1="", lpString2="add_reviewer.gif") returned -1 [0074.847] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\*.*") returned="*.*" [0074.848] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0074.848] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0074.848] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0074.848] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0xffffffff [0074.848] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0074.849] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0074.849] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0074.850] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0074.851] CloseHandle (hObject=0x90) returned 1 [0074.851] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="add_reviewer.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif" [0074.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif", pszSpec="*.zip") returned 0 [0074.851] lstrlenA (lpString="*.zip") returned 5 [0074.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif", pszSpec="*.rar") returned 0 [0074.851] lstrlenA (lpString="*.rar") returned 5 [0074.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif", pszSpec="*.7z") returned 0 [0074.851] lstrlenA (lpString="*.7z") returned 4 [0074.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif", pszSpec="*.tar") returned 0 [0074.851] lstrlenA (lpString="*.tar") returned 5 [0074.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif", pszSpec="*.gzip") returned 0 [0074.851] lstrlenA (lpString="*.gzip") returned 6 [0074.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif", pszSpec="*.jpg") returned 0 [0074.851] lstrlenA (lpString="*.jpg") returned 5 [0074.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif", pszSpec="*.jpeg") returned 0 [0074.851] lstrlenA (lpString="*.jpeg") returned 6 [0074.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif", pszSpec="*.psd") returned 0 [0074.851] lstrlenA (lpString="*.psd") returned 5 [0074.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif", pszSpec="*.gif") returned 1 [0074.851] lstrlenA (lpString="*.gif") returned 5 [0074.851] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif" [0074.851] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif" [0074.852] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif." [0074.852] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif.wannacry" [0074.852] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\add_reviewer.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0074.856] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x53a [0074.856] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80222180, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0074.856] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.856] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4bc, lpOverlapped=0x0) returned 1 [0074.860] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif") returned="add_reviewer.gif" [0074.860] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.860] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4bc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4bc, lpOverlapped=0x0) returned 1 [0074.860] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.860] CloseHandle (hObject=0x90) returned 1 [0074.861] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\add_reviewer.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\add_reviewer.gif.wannacry")) returned 1 [0074.862] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0xd80001d9, dwReserved1=0x2c00c4, cFileName="bl.gif", cAlternateFileName="")) returned 1 [0074.862] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.862] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bl.gif") returned 1 [0074.862] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bl.gif") returned 1 [0074.862] lstrcmpiA (lpString1="", lpString2="bl.gif") returned -1 [0074.862] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif") returned="add_reviewer.gif" [0074.862] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0074.862] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0074.862] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0074.862] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0074.862] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="bl.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif" [0074.863] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif", pszSpec="*.zip") returned 0 [0074.863] lstrlenA (lpString="*.zip") returned 5 [0074.863] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif", pszSpec="*.rar") returned 0 [0074.863] lstrlenA (lpString="*.rar") returned 5 [0074.863] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif", pszSpec="*.7z") returned 0 [0074.863] lstrlenA (lpString="*.7z") returned 4 [0074.863] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif", pszSpec="*.tar") returned 0 [0074.863] lstrlenA (lpString="*.tar") returned 5 [0074.863] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif", pszSpec="*.gzip") returned 0 [0074.863] lstrlenA (lpString="*.gzip") returned 6 [0074.863] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif", pszSpec="*.jpg") returned 0 [0074.863] lstrlenA (lpString="*.jpg") returned 5 [0074.863] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif", pszSpec="*.jpeg") returned 0 [0074.863] lstrlenA (lpString="*.jpeg") returned 6 [0074.863] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif", pszSpec="*.psd") returned 0 [0074.863] lstrlenA (lpString="*.psd") returned 5 [0074.863] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif", pszSpec="*.gif") returned 1 [0074.863] lstrlenA (lpString="*.gif") returned 5 [0074.863] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif" [0074.863] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif" [0074.863] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif." [0074.863] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif.wannacry" [0074.863] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\bl.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0074.865] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x53 [0074.865] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x801fc020, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4)) returned 1 [0074.865] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.865] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0074.865] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.865] CloseHandle (hObject=0x90) returned 1 [0074.865] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\bl.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\bl.gif.wannacry")) returned 1 [0074.866] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0xde0001df, dwReserved1=0x2c00c4, cFileName="br.gif", cAlternateFileName="")) returned 1 [0074.866] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.867] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="br.gif") returned 1 [0074.867] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="br.gif") returned 1 [0074.867] lstrcmpiA (lpString1="", lpString2="br.gif") returned -1 [0074.867] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif") returned="bl.gif" [0074.867] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0074.867] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0074.867] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0074.867] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0074.867] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="br.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif" [0074.867] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif", pszSpec="*.zip") returned 0 [0074.867] lstrlenA (lpString="*.zip") returned 5 [0074.867] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif", pszSpec="*.rar") returned 0 [0074.867] lstrlenA (lpString="*.rar") returned 5 [0074.867] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif", pszSpec="*.7z") returned 0 [0074.867] lstrlenA (lpString="*.7z") returned 4 [0074.867] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif", pszSpec="*.tar") returned 0 [0074.867] lstrlenA (lpString="*.tar") returned 5 [0074.867] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif", pszSpec="*.gzip") returned 0 [0074.867] lstrlenA (lpString="*.gzip") returned 6 [0074.867] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif", pszSpec="*.jpg") returned 0 [0074.867] lstrlenA (lpString="*.jpg") returned 5 [0074.867] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif", pszSpec="*.jpeg") returned 0 [0074.867] lstrlenA (lpString="*.jpeg") returned 6 [0074.868] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif", pszSpec="*.psd") returned 0 [0074.868] lstrlenA (lpString="*.psd") returned 5 [0074.868] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif", pszSpec="*.gif") returned 1 [0074.868] lstrlenA (lpString="*.gif") returned 5 [0074.868] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif" [0074.868] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif" [0074.868] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif." [0074.868] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif.wannacry" [0074.868] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\br.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0074.869] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x52 [0074.869] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80222180, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4)) returned 1 [0074.869] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.869] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0074.870] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.870] CloseHandle (hObject=0x90) returned 1 [0074.870] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\br.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\br.gif.wannacry")) returned 1 [0074.871] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4aa, dwReserved0=0xde0001df, dwReserved1=0x2c00c4, cFileName="create_form.gif", cAlternateFileName="CREATE~1.GIF")) returned 1 [0074.871] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.871] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="create_form.gif") returned 1 [0074.871] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="create_form.gif") returned 1 [0074.871] lstrcmpiA (lpString1="", lpString2="create_form.gif") returned -1 [0074.871] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif") returned="br.gif" [0074.871] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0074.871] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0074.871] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0074.871] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0074.871] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="create_form.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif" [0074.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif", pszSpec="*.zip") returned 0 [0074.871] lstrlenA (lpString="*.zip") returned 5 [0074.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif", pszSpec="*.rar") returned 0 [0074.871] lstrlenA (lpString="*.rar") returned 5 [0074.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif", pszSpec="*.7z") returned 0 [0074.871] lstrlenA (lpString="*.7z") returned 4 [0074.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif", pszSpec="*.tar") returned 0 [0074.871] lstrlenA (lpString="*.tar") returned 5 [0074.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif", pszSpec="*.gzip") returned 0 [0074.871] lstrlenA (lpString="*.gzip") returned 6 [0074.871] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif", pszSpec="*.jpg") returned 0 [0074.872] lstrlenA (lpString="*.jpg") returned 5 [0074.872] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif", pszSpec="*.jpeg") returned 0 [0074.872] lstrlenA (lpString="*.jpeg") returned 6 [0074.872] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif", pszSpec="*.psd") returned 0 [0074.872] lstrlenA (lpString="*.psd") returned 5 [0074.872] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif", pszSpec="*.gif") returned 1 [0074.872] lstrlenA (lpString="*.gif") returned 5 [0074.872] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif" [0074.872] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif" [0074.872] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif." [0074.872] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif.wannacry" [0074.872] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\create_form.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0074.873] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4aa [0074.873] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80222180, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0074.873] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.873] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x42c, lpOverlapped=0x0) returned 1 [0074.874] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif") returned="create_form.gif" [0074.874] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.875] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x42c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x42c, lpOverlapped=0x0) returned 1 [0074.875] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.875] CloseHandle (hObject=0x90) returned 1 [0074.875] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\create_form.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\create_form.gif.wannacry")) returned 1 [0074.876] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x335, dwReserved0=0x2c0244, dwReserved1=0x2c0000, cFileName="distribute_form.gif", cAlternateFileName="DISTRI~1.GIF")) returned 1 [0074.876] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.876] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="distribute_form.gif") returned 1 [0074.876] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="distribute_form.gif") returned 1 [0074.876] lstrcmpiA (lpString1="", lpString2="distribute_form.gif") returned -1 [0074.876] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif") returned="create_form.gif" [0074.876] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0074.876] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0074.876] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0074.876] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0074.876] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="distribute_form.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif" [0074.876] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif", pszSpec="*.zip") returned 0 [0074.876] lstrlenA (lpString="*.zip") returned 5 [0074.876] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif", pszSpec="*.rar") returned 0 [0074.877] lstrlenA (lpString="*.rar") returned 5 [0074.877] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif", pszSpec="*.7z") returned 0 [0074.877] lstrlenA (lpString="*.7z") returned 4 [0074.877] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif", pszSpec="*.tar") returned 0 [0074.877] lstrlenA (lpString="*.tar") returned 5 [0074.877] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif", pszSpec="*.gzip") returned 0 [0074.877] lstrlenA (lpString="*.gzip") returned 6 [0074.877] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif", pszSpec="*.jpg") returned 0 [0074.877] lstrlenA (lpString="*.jpg") returned 5 [0074.877] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif", pszSpec="*.jpeg") returned 0 [0074.877] lstrlenA (lpString="*.jpeg") returned 6 [0074.877] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif", pszSpec="*.psd") returned 0 [0074.877] lstrlenA (lpString="*.psd") returned 5 [0074.877] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif", pszSpec="*.gif") returned 1 [0074.877] lstrlenA (lpString="*.gif") returned 5 [0074.877] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif" [0074.877] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif" [0074.877] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif." [0074.877] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif.wannacry" [0074.877] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\distribute_form.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0074.879] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x335 [0074.879] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x8026e440, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0074.879] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.879] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2b7, lpOverlapped=0x0) returned 1 [0074.881] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif") returned="distribute_form.gif" [0074.881] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.881] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2b7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2b7, lpOverlapped=0x0) returned 1 [0074.881] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.881] CloseHandle (hObject=0x90) returned 1 [0074.881] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\distribute_form.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\distribute_form.gif.wannacry")) returned 1 [0074.882] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5a3, dwReserved0=0xee0001ef, dwReserved1=0x2c00c4, cFileName="email_all.gif", cAlternateFileName="EMAIL_~2.GIF")) returned 1 [0074.882] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.882] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="email_all.gif") returned -1 [0074.882] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="email_all.gif") returned 1 [0074.882] lstrcmpiA (lpString1="", lpString2="email_all.gif") returned -1 [0074.882] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif") returned="distribute_form.gif" [0074.882] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0074.882] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0074.882] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0074.882] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0074.882] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="email_all.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif" [0074.883] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif", pszSpec="*.zip") returned 0 [0074.883] lstrlenA (lpString="*.zip") returned 5 [0074.883] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif", pszSpec="*.rar") returned 0 [0074.883] lstrlenA (lpString="*.rar") returned 5 [0074.883] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif", pszSpec="*.7z") returned 0 [0074.883] lstrlenA (lpString="*.7z") returned 4 [0074.883] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif", pszSpec="*.tar") returned 0 [0074.883] lstrlenA (lpString="*.tar") returned 5 [0074.883] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif", pszSpec="*.gzip") returned 0 [0074.883] lstrlenA (lpString="*.gzip") returned 6 [0074.883] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif", pszSpec="*.jpg") returned 0 [0074.883] lstrlenA (lpString="*.jpg") returned 5 [0074.883] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif", pszSpec="*.jpeg") returned 0 [0074.883] lstrlenA (lpString="*.jpeg") returned 6 [0074.883] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif", pszSpec="*.psd") returned 0 [0074.883] lstrlenA (lpString="*.psd") returned 5 [0074.883] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif", pszSpec="*.gif") returned 1 [0074.883] lstrlenA (lpString="*.gif") returned 5 [0074.883] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif" [0074.883] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif" [0074.883] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif." [0074.883] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif.wannacry" [0074.883] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\email_all.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0074.884] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5a3 [0074.884] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80222180, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0074.884] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.884] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x525, lpOverlapped=0x0) returned 1 [0074.886] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif") returned="email_all.gif" [0074.886] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.886] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x525, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x525, lpOverlapped=0x0) returned 1 [0074.886] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.886] CloseHandle (hObject=0x90) returned 1 [0074.886] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\email_all.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\email_all.gif.wannacry")) returned 1 [0074.887] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x550, dwReserved0=0x2c0244, dwReserved1=0x2c0000, cFileName="email_initiator.gif", cAlternateFileName="EMAIL_~1.GIF")) returned 1 [0074.888] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.888] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="email_initiator.gif") returned -1 [0074.888] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="email_initiator.gif") returned 1 [0074.888] lstrcmpiA (lpString1="", lpString2="email_initiator.gif") returned -1 [0074.888] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif") returned="email_all.gif" [0074.888] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0074.888] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0074.888] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0074.888] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0074.888] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="email_initiator.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif" [0074.888] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif", pszSpec="*.zip") returned 0 [0074.888] lstrlenA (lpString="*.zip") returned 5 [0074.888] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif", pszSpec="*.rar") returned 0 [0074.888] lstrlenA (lpString="*.rar") returned 5 [0074.888] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif", pszSpec="*.7z") returned 0 [0074.888] lstrlenA (lpString="*.7z") returned 4 [0074.888] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif", pszSpec="*.tar") returned 0 [0074.888] lstrlenA (lpString="*.tar") returned 5 [0074.888] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif", pszSpec="*.gzip") returned 0 [0074.888] lstrlenA (lpString="*.gzip") returned 6 [0074.888] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif", pszSpec="*.jpg") returned 0 [0074.888] lstrlenA (lpString="*.jpg") returned 5 [0074.888] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif", pszSpec="*.jpeg") returned 0 [0074.888] lstrlenA (lpString="*.jpeg") returned 6 [0074.888] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif", pszSpec="*.psd") returned 0 [0074.888] lstrlenA (lpString="*.psd") returned 5 [0074.888] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif", pszSpec="*.gif") returned 1 [0074.888] lstrlenA (lpString="*.gif") returned 5 [0074.888] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif" [0074.888] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif" [0074.888] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif." [0074.888] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif.wannacry" [0074.889] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\email_initiator.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0074.889] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x550 [0074.889] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x801fc020, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4)) returned 1 [0074.889] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.889] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4d2, lpOverlapped=0x0) returned 1 [0074.891] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif") returned="email_initiator.gif" [0074.891] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.891] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4d2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4d2, lpOverlapped=0x0) returned 1 [0074.891] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.891] CloseHandle (hObject=0x90) returned 1 [0074.892] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\email_initiator.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\email_initiator.gif.wannacry")) returned 1 [0074.893] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0xee0001ef, dwReserved1=0x2c00c4, cFileName="ended_review_or_form.gif", cAlternateFileName="ENDED_~1.GIF")) returned 1 [0074.893] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.893] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ended_review_or_form.gif") returned -1 [0074.893] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ended_review_or_form.gif") returned 1 [0074.893] lstrcmpiA (lpString1="", lpString2="ended_review_or_form.gif") returned -1 [0074.893] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif") returned="email_initiator.gif" [0074.893] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0074.893] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0074.893] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0074.893] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0074.893] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="ended_review_or_form.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif" [0074.893] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif", pszSpec="*.zip") returned 0 [0074.893] lstrlenA (lpString="*.zip") returned 5 [0074.893] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif", pszSpec="*.rar") returned 0 [0074.893] lstrlenA (lpString="*.rar") returned 5 [0074.893] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif", pszSpec="*.7z") returned 0 [0074.893] lstrlenA (lpString="*.7z") returned 4 [0074.893] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif", pszSpec="*.tar") returned 0 [0074.893] lstrlenA (lpString="*.tar") returned 5 [0074.893] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif", pszSpec="*.gzip") returned 0 [0074.894] lstrlenA (lpString="*.gzip") returned 6 [0074.894] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif", pszSpec="*.jpg") returned 0 [0074.894] lstrlenA (lpString="*.jpg") returned 5 [0074.894] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif", pszSpec="*.jpeg") returned 0 [0074.894] lstrlenA (lpString="*.jpeg") returned 6 [0074.894] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif", pszSpec="*.psd") returned 0 [0074.894] lstrlenA (lpString="*.psd") returned 5 [0074.894] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif", pszSpec="*.gif") returned 1 [0074.894] lstrlenA (lpString="*.gif") returned 5 [0074.894] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif" [0074.894] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif" [0074.894] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif." [0074.894] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif.wannacry" [0074.894] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\ended_review_or_form.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0074.895] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x327 [0074.895] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x8026e440, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0074.895] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.895] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2a9, lpOverlapped=0x0) returned 1 [0074.903] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif") returned="ended_review_or_form.gif" [0074.903] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.903] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2a9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2a9, lpOverlapped=0x0) returned 1 [0074.903] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.903] CloseHandle (hObject=0x90) returned 1 [0074.903] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\ended_review_or_form.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\ended_review_or_form.gif.wannacry")) returned 1 [0074.905] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0xec0001ed, dwReserved1=0x2c00c4, cFileName="end_review.gif", cAlternateFileName="END_RE~1.GIF")) returned 1 [0074.905] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.905] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="end_review.gif") returned -1 [0074.905] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="end_review.gif") returned 1 [0074.905] lstrcmpiA (lpString1="", lpString2="end_review.gif") returned -1 [0074.905] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif") returned="ended_review_or_form.gif" [0074.905] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0074.905] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0074.905] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0074.905] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0074.905] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="end_review.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif" [0074.905] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif", pszSpec="*.zip") returned 0 [0074.906] lstrlenA (lpString="*.zip") returned 5 [0074.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif", pszSpec="*.rar") returned 0 [0074.906] lstrlenA (lpString="*.rar") returned 5 [0074.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif", pszSpec="*.7z") returned 0 [0074.906] lstrlenA (lpString="*.7z") returned 4 [0074.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif", pszSpec="*.tar") returned 0 [0074.906] lstrlenA (lpString="*.tar") returned 5 [0074.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif", pszSpec="*.gzip") returned 0 [0074.906] lstrlenA (lpString="*.gzip") returned 6 [0074.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif", pszSpec="*.jpg") returned 0 [0074.906] lstrlenA (lpString="*.jpg") returned 5 [0074.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif", pszSpec="*.jpeg") returned 0 [0074.906] lstrlenA (lpString="*.jpeg") returned 6 [0074.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif", pszSpec="*.psd") returned 0 [0074.906] lstrlenA (lpString="*.psd") returned 5 [0074.906] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif", pszSpec="*.gif") returned 1 [0074.906] lstrlenA (lpString="*.gif") returned 5 [0074.907] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif" [0074.907] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif" [0074.907] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif." [0074.907] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif.wannacry" [0074.907] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\end_review.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0074.911] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x384 [0074.912] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80222180, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0074.912] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.912] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x306, lpOverlapped=0x0) returned 1 [0074.913] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif") returned="end_review.gif" [0074.913] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.914] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x306, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x306, lpOverlapped=0x0) returned 1 [0074.914] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.914] CloseHandle (hObject=0x90) returned 1 [0074.914] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\end_review.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\end_review.gif.wannacry")) returned 1 [0074.915] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x2c0244, dwReserved1=0x2c0000, cFileName="forms_distributed.gif", cAlternateFileName="FORMS_~1.GIF")) returned 1 [0074.915] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.916] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="forms_distributed.gif") returned -1 [0074.916] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="forms_distributed.gif") returned 1 [0074.916] lstrcmpiA (lpString1="", lpString2="forms_distributed.gif") returned -1 [0074.916] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif") returned="end_review.gif" [0074.916] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0074.916] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0074.916] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0074.916] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0074.916] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="forms_distributed.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif" [0074.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif", pszSpec="*.zip") returned 0 [0074.916] lstrlenA (lpString="*.zip") returned 5 [0074.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif", pszSpec="*.rar") returned 0 [0074.916] lstrlenA (lpString="*.rar") returned 5 [0074.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif", pszSpec="*.7z") returned 0 [0074.916] lstrlenA (lpString="*.7z") returned 4 [0074.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif", pszSpec="*.tar") returned 0 [0074.916] lstrlenA (lpString="*.tar") returned 5 [0074.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif", pszSpec="*.gzip") returned 0 [0074.916] lstrlenA (lpString="*.gzip") returned 6 [0074.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif", pszSpec="*.jpg") returned 0 [0074.916] lstrlenA (lpString="*.jpg") returned 5 [0074.916] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif", pszSpec="*.jpeg") returned 0 [0074.916] lstrlenA (lpString="*.jpeg") returned 6 [0074.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif", pszSpec="*.psd") returned 0 [0074.917] lstrlenA (lpString="*.psd") returned 5 [0074.917] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif", pszSpec="*.gif") returned 1 [0074.917] lstrlenA (lpString="*.gif") returned 5 [0074.917] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif" [0074.917] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif" [0074.917] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif." [0074.917] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif.wannacry" [0074.917] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_distributed.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0074.918] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x265 [0074.918] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80222180, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0074.918] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.918] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1e7, lpOverlapped=0x0) returned 1 [0074.920] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif") returned="forms_distributed.gif" [0074.920] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.920] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1e7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1e7, lpOverlapped=0x0) returned 1 [0074.920] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.923] CloseHandle (hObject=0x90) returned 1 [0074.923] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_distributed.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_distributed.gif.wannacry")) returned 1 [0074.925] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0xef0001ee, dwReserved1=0x2c00c4, cFileName="forms_received.gif", cAlternateFileName="FORMS_~3.GIF")) returned 1 [0074.925] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.925] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="forms_received.gif") returned -1 [0074.925] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="forms_received.gif") returned 1 [0074.925] lstrcmpiA (lpString1="", lpString2="forms_received.gif") returned -1 [0074.925] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif") returned="forms_distributed.gif" [0074.925] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0074.925] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0074.925] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0074.925] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0074.925] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="forms_received.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif" [0074.925] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif", pszSpec="*.zip") returned 0 [0074.925] lstrlenA (lpString="*.zip") returned 5 [0074.925] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif", pszSpec="*.rar") returned 0 [0074.925] lstrlenA (lpString="*.rar") returned 5 [0074.925] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif", pszSpec="*.7z") returned 0 [0074.925] lstrlenA (lpString="*.7z") returned 4 [0074.925] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif", pszSpec="*.tar") returned 0 [0074.926] lstrlenA (lpString="*.tar") returned 5 [0074.926] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif", pszSpec="*.gzip") returned 0 [0074.926] lstrlenA (lpString="*.gzip") returned 6 [0074.926] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif", pszSpec="*.jpg") returned 0 [0074.926] lstrlenA (lpString="*.jpg") returned 5 [0074.926] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif", pszSpec="*.jpeg") returned 0 [0074.926] lstrlenA (lpString="*.jpeg") returned 6 [0074.926] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif", pszSpec="*.psd") returned 0 [0074.926] lstrlenA (lpString="*.psd") returned 5 [0074.926] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif", pszSpec="*.gif") returned 1 [0074.926] lstrlenA (lpString="*.gif") returned 5 [0074.926] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif" [0074.926] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif" [0074.926] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif." [0074.926] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif.wannacry" [0074.926] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_received.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0074.927] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x267 [0074.927] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x8026e440, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0074.927] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.927] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1e9, lpOverlapped=0x0) returned 1 [0074.929] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif") returned="forms_received.gif" [0074.929] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.929] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1e9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1e9, lpOverlapped=0x0) returned 1 [0074.929] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.929] CloseHandle (hObject=0x90) returned 1 [0074.930] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_received.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_received.gif.wannacry")) returned 1 [0074.931] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0xd80001d9, dwReserved1=0x2c00c4, cFileName="forms_super.gif", cAlternateFileName="FORMS_~2.GIF")) returned 1 [0074.931] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.931] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="forms_super.gif") returned -1 [0074.931] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="forms_super.gif") returned 1 [0074.931] lstrcmpiA (lpString1="", lpString2="forms_super.gif") returned -1 [0074.931] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif") returned="forms_received.gif" [0074.931] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0074.931] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0074.931] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0074.931] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0074.931] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="forms_super.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif" [0074.931] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif", pszSpec="*.zip") returned 0 [0074.931] lstrlenA (lpString="*.zip") returned 5 [0074.931] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif", pszSpec="*.rar") returned 0 [0074.931] lstrlenA (lpString="*.rar") returned 5 [0074.931] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif", pszSpec="*.7z") returned 0 [0074.931] lstrlenA (lpString="*.7z") returned 4 [0074.931] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif", pszSpec="*.tar") returned 0 [0074.931] lstrlenA (lpString="*.tar") returned 5 [0074.931] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif", pszSpec="*.gzip") returned 0 [0074.931] lstrlenA (lpString="*.gzip") returned 6 [0074.931] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif", pszSpec="*.jpg") returned 0 [0074.931] lstrlenA (lpString="*.jpg") returned 5 [0074.931] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif", pszSpec="*.jpeg") returned 0 [0074.931] lstrlenA (lpString="*.jpeg") returned 6 [0074.931] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif", pszSpec="*.psd") returned 0 [0074.931] lstrlenA (lpString="*.psd") returned 5 [0074.932] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif", pszSpec="*.gif") returned 1 [0074.932] lstrlenA (lpString="*.gif") returned 5 [0074.932] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif" [0074.932] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif" [0074.932] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif." [0074.932] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif.wannacry" [0074.932] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_super.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0074.932] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x228 [0074.932] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x8026e440, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0074.933] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.933] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1aa, lpOverlapped=0x0) returned 1 [0074.934] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif") returned="forms_super.gif" [0074.934] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.934] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1aa, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1aa, lpOverlapped=0x0) returned 1 [0074.934] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.934] CloseHandle (hObject=0x90) returned 1 [0074.934] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_super.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_super.gif.wannacry")) returned 1 [0074.935] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c9, dwReserved0=0x2c0244, dwReserved1=0x2c0000, cFileName="form_responses.gif", cAlternateFileName="FORM_R~1.GIF")) returned 1 [0074.935] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.935] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="form_responses.gif") returned -1 [0074.935] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="form_responses.gif") returned 1 [0074.935] lstrcmpiA (lpString1="", lpString2="form_responses.gif") returned -1 [0074.935] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif") returned="forms_super.gif" [0074.935] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0074.935] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0074.936] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0074.936] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0074.936] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="form_responses.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif" [0074.936] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif", pszSpec="*.zip") returned 0 [0074.936] lstrlenA (lpString="*.zip") returned 5 [0074.936] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif", pszSpec="*.rar") returned 0 [0074.936] lstrlenA (lpString="*.rar") returned 5 [0074.936] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif", pszSpec="*.7z") returned 0 [0074.936] lstrlenA (lpString="*.7z") returned 4 [0074.936] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif", pszSpec="*.tar") returned 0 [0074.936] lstrlenA (lpString="*.tar") returned 5 [0074.936] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif", pszSpec="*.gzip") returned 0 [0074.936] lstrlenA (lpString="*.gzip") returned 6 [0074.936] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif", pszSpec="*.jpg") returned 0 [0074.936] lstrlenA (lpString="*.jpg") returned 5 [0074.936] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif", pszSpec="*.jpeg") returned 0 [0074.936] lstrlenA (lpString="*.jpeg") returned 6 [0074.936] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif", pszSpec="*.psd") returned 0 [0074.936] lstrlenA (lpString="*.psd") returned 5 [0074.936] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif", pszSpec="*.gif") returned 1 [0074.936] lstrlenA (lpString="*.gif") returned 5 [0074.936] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif" [0074.936] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif" [0074.937] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif." [0074.937] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif.wannacry" [0074.937] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\form_responses.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0074.941] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c9 [0074.941] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80222180, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0074.941] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.941] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x34b, lpOverlapped=0x0) returned 1 [0074.943] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif") returned="form_responses.gif" [0074.943] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.943] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x34b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x34b, lpOverlapped=0x0) returned 1 [0074.944] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.944] CloseHandle (hObject=0x90) returned 1 [0074.944] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\form_responses.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\form_responses.gif.wannacry")) returned 1 [0074.945] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0xd80001d9, dwReserved1=0x2c00c4, cFileName="info.gif", cAlternateFileName="")) returned 1 [0074.945] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.945] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="info.gif") returned -1 [0074.945] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="info.gif") returned -1 [0074.945] lstrcmpiA (lpString1="", lpString2="info.gif") returned -1 [0074.945] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif") returned="form_responses.gif" [0074.945] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0074.945] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0074.946] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0074.946] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0074.946] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="info.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif" [0074.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif", pszSpec="*.zip") returned 0 [0074.946] lstrlenA (lpString="*.zip") returned 5 [0074.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif", pszSpec="*.rar") returned 0 [0074.946] lstrlenA (lpString="*.rar") returned 5 [0074.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif", pszSpec="*.7z") returned 0 [0074.946] lstrlenA (lpString="*.7z") returned 4 [0074.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif", pszSpec="*.tar") returned 0 [0074.946] lstrlenA (lpString="*.tar") returned 5 [0074.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif", pszSpec="*.gzip") returned 0 [0074.946] lstrlenA (lpString="*.gzip") returned 6 [0074.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif", pszSpec="*.jpg") returned 0 [0074.946] lstrlenA (lpString="*.jpg") returned 5 [0074.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif", pszSpec="*.jpeg") returned 0 [0074.946] lstrlenA (lpString="*.jpeg") returned 6 [0074.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif", pszSpec="*.psd") returned 0 [0074.946] lstrlenA (lpString="*.psd") returned 5 [0074.946] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif", pszSpec="*.gif") returned 1 [0074.946] lstrlenA (lpString="*.gif") returned 5 [0074.946] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif" [0074.946] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif" [0074.947] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif." [0074.947] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif.wannacry" [0074.947] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\info.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0074.947] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x242 [0074.947] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x801fc020, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0074.948] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.948] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1c4, lpOverlapped=0x0) returned 1 [0074.949] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif") returned="info.gif" [0074.949] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.949] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1c4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1c4, lpOverlapped=0x0) returned 1 [0074.949] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.949] CloseHandle (hObject=0x90) returned 1 [0074.949] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\info.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\info.gif.wannacry")) returned 1 [0074.950] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e9a, dwReserved0=0x2c023c, dwReserved1=0x2c0000, cFileName="main.css", cAlternateFileName="")) returned 1 [0074.950] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.950] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="main.css") returned -1 [0074.950] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="main.css") returned -1 [0074.950] lstrcmpiA (lpString1="", lpString2="main.css") returned -1 [0074.951] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif") returned="info.gif" [0074.951] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0074.951] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0074.951] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0074.951] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0074.951] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="main.css" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css" [0074.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.zip") returned 0 [0074.951] lstrlenA (lpString="*.zip") returned 5 [0074.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.rar") returned 0 [0074.951] lstrlenA (lpString="*.rar") returned 5 [0074.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.7z") returned 0 [0074.951] lstrlenA (lpString="*.7z") returned 4 [0074.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.tar") returned 0 [0074.951] lstrlenA (lpString="*.tar") returned 5 [0074.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.gzip") returned 0 [0074.951] lstrlenA (lpString="*.gzip") returned 6 [0074.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.jpg") returned 0 [0074.951] lstrlenA (lpString="*.jpg") returned 5 [0074.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.jpeg") returned 0 [0074.951] lstrlenA (lpString="*.jpeg") returned 6 [0074.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.psd") returned 0 [0074.951] lstrlenA (lpString="*.psd") returned 5 [0074.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.gif") returned 0 [0074.951] lstrlenA (lpString="*.gif") returned 5 [0074.951] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.doc") returned 0 [0074.952] lstrlenA (lpString="*.doc") returned 5 [0074.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.docx") returned 0 [0074.952] lstrlenA (lpString="*.docx") returned 6 [0074.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.xls") returned 0 [0074.952] lstrlenA (lpString="*.xls") returned 5 [0074.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.xlsx") returned 0 [0074.952] lstrlenA (lpString="*.xlsx") returned 6 [0074.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.ppt") returned 0 [0074.952] lstrlenA (lpString="*.ppt") returned 5 [0074.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.pptx") returned 0 [0074.952] lstrlenA (lpString="*.pptx") returned 6 [0074.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.pdf") returned 0 [0074.952] lstrlenA (lpString="*.pdf") returned 5 [0074.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.mov") returned 0 [0074.952] lstrlenA (lpString="*.mov") returned 5 [0074.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.m2v") returned 0 [0074.952] lstrlenA (lpString="*.m2v") returned 5 [0074.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.3gp") returned 0 [0074.952] lstrlenA (lpString="*.3gp") returned 5 [0074.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.mpeg") returned 0 [0074.952] lstrlenA (lpString="*.mpeg") returned 6 [0074.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.mpg") returned 0 [0074.952] lstrlenA (lpString="*.mpg") returned 5 [0074.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.flv") returned 0 [0074.952] lstrlenA (lpString="*.flv") returned 5 [0074.952] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.avi") returned 0 [0074.952] lstrlenA (lpString="*.avi") returned 5 [0074.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.mp4") returned 0 [0074.953] lstrlenA (lpString="*.mp4") returned 5 [0074.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.wmv") returned 0 [0074.953] lstrlenA (lpString="*.wmv") returned 5 [0074.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.divx") returned 0 [0074.953] lstrlenA (lpString="*.divx") returned 6 [0074.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.mkv") returned 0 [0074.953] lstrlenA (lpString="*.mkv") returned 5 [0074.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.mp3") returned 0 [0074.953] lstrlenA (lpString="*.mp3") returned 5 [0074.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.wav") returned 0 [0074.953] lstrlenA (lpString="*.wav") returned 5 [0074.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.flac") returned 0 [0074.953] lstrlenA (lpString="*.flac") returned 6 [0074.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.ape") returned 0 [0074.953] lstrlenA (lpString="*.ape") returned 5 [0074.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.wma") returned 0 [0074.953] lstrlenA (lpString="*.wma") returned 5 [0074.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.ac3") returned 0 [0074.953] lstrlenA (lpString="*.ac3") returned 5 [0074.953] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css", pszSpec="*.mxf") returned 0 [0074.953] lstrlenA (lpString="*.mxf") returned 5 [0074.953] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="open_original_form.gif", cAlternateFileName="OPEN_O~1.GIF")) returned 1 [0074.953] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.953] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="open_original_form.gif") returned -1 [0074.953] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="open_original_form.gif") returned -1 [0074.953] lstrcmpiA (lpString1="", lpString2="open_original_form.gif") returned -1 [0074.953] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css") returned="main.css" [0074.954] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0074.954] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0074.954] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0074.954] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0074.954] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="open_original_form.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif" [0074.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif", pszSpec="*.zip") returned 0 [0074.954] lstrlenA (lpString="*.zip") returned 5 [0074.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif", pszSpec="*.rar") returned 0 [0074.954] lstrlenA (lpString="*.rar") returned 5 [0074.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif", pszSpec="*.7z") returned 0 [0074.954] lstrlenA (lpString="*.7z") returned 4 [0074.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif", pszSpec="*.tar") returned 0 [0074.954] lstrlenA (lpString="*.tar") returned 5 [0074.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif", pszSpec="*.gzip") returned 0 [0074.954] lstrlenA (lpString="*.gzip") returned 6 [0074.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif", pszSpec="*.jpg") returned 0 [0074.954] lstrlenA (lpString="*.jpg") returned 5 [0074.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif", pszSpec="*.jpeg") returned 0 [0074.954] lstrlenA (lpString="*.jpeg") returned 6 [0074.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif", pszSpec="*.psd") returned 0 [0074.954] lstrlenA (lpString="*.psd") returned 5 [0074.954] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif", pszSpec="*.gif") returned 1 [0074.954] lstrlenA (lpString="*.gif") returned 5 [0074.954] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif" [0074.955] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif" [0074.955] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif." [0074.955] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif.wannacry" [0074.955] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\open_original_form.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0074.956] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x326 [0074.956] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x8026e440, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0074.956] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.957] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2a8, lpOverlapped=0x0) returned 1 [0074.959] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif") returned="open_original_form.gif" [0074.959] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.959] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2a8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2a8, lpOverlapped=0x0) returned 1 [0074.959] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.959] CloseHandle (hObject=0x90) returned 1 [0074.959] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\open_original_form.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\open_original_form.gif.wannacry")) returned 1 [0074.961] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0xef0001ee, dwReserved1=0x2c00c4, cFileName="pdf.gif", cAlternateFileName="")) returned 1 [0074.961] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.961] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="pdf.gif") returned -1 [0074.961] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pdf.gif") returned -1 [0074.961] lstrcmpiA (lpString1="", lpString2="pdf.gif") returned -1 [0074.961] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif") returned="open_original_form.gif" [0074.961] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0074.961] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0074.961] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0074.961] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0074.961] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="pdf.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif" [0074.961] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif", pszSpec="*.zip") returned 0 [0074.961] lstrlenA (lpString="*.zip") returned 5 [0074.961] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif", pszSpec="*.rar") returned 0 [0074.961] lstrlenA (lpString="*.rar") returned 5 [0074.961] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif", pszSpec="*.7z") returned 0 [0074.961] lstrlenA (lpString="*.7z") returned 4 [0074.961] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif", pszSpec="*.tar") returned 0 [0074.961] lstrlenA (lpString="*.tar") returned 5 [0074.961] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif", pszSpec="*.gzip") returned 0 [0074.961] lstrlenA (lpString="*.gzip") returned 6 [0074.962] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif", pszSpec="*.jpg") returned 0 [0074.962] lstrlenA (lpString="*.jpg") returned 5 [0074.962] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif", pszSpec="*.jpeg") returned 0 [0074.962] lstrlenA (lpString="*.jpeg") returned 6 [0074.962] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif", pszSpec="*.psd") returned 0 [0074.962] lstrlenA (lpString="*.psd") returned 5 [0074.962] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif", pszSpec="*.gif") returned 1 [0074.962] lstrlenA (lpString="*.gif") returned 5 [0074.962] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif" [0074.962] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif" [0074.962] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif." [0074.962] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif.wannacry" [0074.962] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\pdf.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0074.964] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e0 [0074.964] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x802482e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0074.964] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.964] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x162, lpOverlapped=0x0) returned 1 [0074.965] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif") returned="pdf.gif" [0074.965] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.965] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x162, lpOverlapped=0x0) returned 1 [0074.965] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.965] CloseHandle (hObject=0x90) returned 1 [0074.966] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\pdf.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\pdf.gif.wannacry")) returned 1 [0074.967] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0xdf0001de, dwReserved1=0x2c00c4, cFileName="reviewers.gif", cAlternateFileName="REVIEW~4.GIF")) returned 1 [0074.967] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.967] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="reviewers.gif") returned -1 [0074.967] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="reviewers.gif") returned -1 [0074.967] lstrcmpiA (lpString1="", lpString2="reviewers.gif") returned -1 [0074.967] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif") returned="pdf.gif" [0074.967] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0074.967] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0074.967] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0074.967] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0074.967] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="reviewers.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif" [0074.967] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif", pszSpec="*.zip") returned 0 [0074.967] lstrlenA (lpString="*.zip") returned 5 [0074.967] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif", pszSpec="*.rar") returned 0 [0074.967] lstrlenA (lpString="*.rar") returned 5 [0074.967] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif", pszSpec="*.7z") returned 0 [0074.968] lstrlenA (lpString="*.7z") returned 4 [0074.968] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif", pszSpec="*.tar") returned 0 [0074.968] lstrlenA (lpString="*.tar") returned 5 [0074.968] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif", pszSpec="*.gzip") returned 0 [0074.968] lstrlenA (lpString="*.gzip") returned 6 [0074.968] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif", pszSpec="*.jpg") returned 0 [0074.968] lstrlenA (lpString="*.jpg") returned 5 [0074.968] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif", pszSpec="*.jpeg") returned 0 [0074.968] lstrlenA (lpString="*.jpeg") returned 6 [0074.968] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif", pszSpec="*.psd") returned 0 [0074.968] lstrlenA (lpString="*.psd") returned 5 [0074.968] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif", pszSpec="*.gif") returned 1 [0074.968] lstrlenA (lpString="*.gif") returned 5 [0074.968] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif" [0074.968] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif" [0074.968] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif." [0074.968] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif.wannacry" [0074.968] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviewers.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0074.969] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5ac [0074.969] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80222180, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0074.969] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.969] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x52e, lpOverlapped=0x0) returned 1 [0074.971] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif") returned="reviewers.gif" [0074.971] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.971] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x52e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x52e, lpOverlapped=0x0) returned 1 [0074.971] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.972] CloseHandle (hObject=0x90) returned 1 [0074.972] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviewers.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviewers.gif.wannacry")) returned 1 [0074.973] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x392, dwReserved0=0x2c0244, dwReserved1=0x2c0000, cFileName="reviews_joined.gif", cAlternateFileName="RE99D5~1.GIF")) returned 1 [0074.973] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.973] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="reviews_joined.gif") returned -1 [0074.973] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="reviews_joined.gif") returned -1 [0074.973] lstrcmpiA (lpString1="", lpString2="reviews_joined.gif") returned -1 [0074.973] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif") returned="reviewers.gif" [0074.973] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0074.973] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0074.973] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0074.973] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0074.973] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="reviews_joined.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif" [0074.973] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif", pszSpec="*.zip") returned 0 [0074.973] lstrlenA (lpString="*.zip") returned 5 [0074.973] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif", pszSpec="*.rar") returned 0 [0074.973] lstrlenA (lpString="*.rar") returned 5 [0074.973] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif", pszSpec="*.7z") returned 0 [0074.974] lstrlenA (lpString="*.7z") returned 4 [0074.974] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif", pszSpec="*.tar") returned 0 [0074.974] lstrlenA (lpString="*.tar") returned 5 [0074.974] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif", pszSpec="*.gzip") returned 0 [0074.974] lstrlenA (lpString="*.gzip") returned 6 [0074.974] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif", pszSpec="*.jpg") returned 0 [0074.974] lstrlenA (lpString="*.jpg") returned 5 [0074.974] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif", pszSpec="*.jpeg") returned 0 [0074.974] lstrlenA (lpString="*.jpeg") returned 6 [0074.974] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif", pszSpec="*.psd") returned 0 [0074.974] lstrlenA (lpString="*.psd") returned 5 [0074.974] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif", pszSpec="*.gif") returned 1 [0074.974] lstrlenA (lpString="*.gif") returned 5 [0074.974] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif" [0074.974] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif" [0074.974] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif." [0074.974] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif.wannacry" [0074.974] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_joined.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0074.975] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x392 [0074.975] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x802482e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0074.975] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.975] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x314, lpOverlapped=0x0) returned 1 [0074.979] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif") returned="reviews_joined.gif" [0074.979] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.979] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x314, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x314, lpOverlapped=0x0) returned 1 [0074.979] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.979] CloseHandle (hObject=0x90) returned 1 [0074.979] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_joined.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_joined.gif.wannacry")) returned 1 [0074.980] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x38d, dwReserved0=0xd80001d9, dwReserved1=0x2c00c4, cFileName="reviews_sent.gif", cAlternateFileName="RECDE7~1.GIF")) returned 1 [0074.980] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.980] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="reviews_sent.gif") returned -1 [0074.980] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="reviews_sent.gif") returned -1 [0074.980] lstrcmpiA (lpString1="", lpString2="reviews_sent.gif") returned -1 [0074.980] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif") returned="reviews_joined.gif" [0074.980] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0074.981] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0074.981] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0074.981] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0074.981] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="reviews_sent.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif" [0074.981] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif", pszSpec="*.zip") returned 0 [0074.981] lstrlenA (lpString="*.zip") returned 5 [0074.981] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif", pszSpec="*.rar") returned 0 [0074.981] lstrlenA (lpString="*.rar") returned 5 [0074.981] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif", pszSpec="*.7z") returned 0 [0074.981] lstrlenA (lpString="*.7z") returned 4 [0074.981] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif", pszSpec="*.tar") returned 0 [0074.981] lstrlenA (lpString="*.tar") returned 5 [0074.981] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif", pszSpec="*.gzip") returned 0 [0074.981] lstrlenA (lpString="*.gzip") returned 6 [0074.981] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif", pszSpec="*.jpg") returned 0 [0074.981] lstrlenA (lpString="*.jpg") returned 5 [0074.981] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif", pszSpec="*.jpeg") returned 0 [0074.981] lstrlenA (lpString="*.jpeg") returned 6 [0074.981] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif", pszSpec="*.psd") returned 0 [0074.981] lstrlenA (lpString="*.psd") returned 5 [0074.981] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif", pszSpec="*.gif") returned 1 [0074.981] lstrlenA (lpString="*.gif") returned 5 [0074.981] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif" [0074.981] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif" [0074.982] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif." [0074.982] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif.wannacry" [0074.982] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_sent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0074.983] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38d [0074.983] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x802482e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0074.983] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.983] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x30f, lpOverlapped=0x0) returned 1 [0074.985] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif") returned="reviews_sent.gif" [0074.985] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.985] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x30f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x30f, lpOverlapped=0x0) returned 1 [0074.985] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.985] CloseHandle (hObject=0x90) returned 1 [0074.985] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_sent.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_sent.gif.wannacry")) returned 1 [0074.986] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x32e, dwReserved0=0xd80001d9, dwReserved1=0x2c00c4, cFileName="reviews_super.gif", cAlternateFileName="RE1558~1.GIF")) returned 1 [0074.986] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.986] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="reviews_super.gif") returned -1 [0074.986] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="reviews_super.gif") returned -1 [0074.987] lstrcmpiA (lpString1="", lpString2="reviews_super.gif") returned -1 [0074.987] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif") returned="reviews_sent.gif" [0074.987] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0074.987] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0074.987] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0074.987] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0074.987] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="reviews_super.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif" [0074.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif", pszSpec="*.zip") returned 0 [0074.987] lstrlenA (lpString="*.zip") returned 5 [0074.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif", pszSpec="*.rar") returned 0 [0074.987] lstrlenA (lpString="*.rar") returned 5 [0074.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif", pszSpec="*.7z") returned 0 [0074.987] lstrlenA (lpString="*.7z") returned 4 [0074.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif", pszSpec="*.tar") returned 0 [0074.987] lstrlenA (lpString="*.tar") returned 5 [0074.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif", pszSpec="*.gzip") returned 0 [0074.987] lstrlenA (lpString="*.gzip") returned 6 [0074.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif", pszSpec="*.jpg") returned 0 [0074.987] lstrlenA (lpString="*.jpg") returned 5 [0074.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif", pszSpec="*.jpeg") returned 0 [0074.987] lstrlenA (lpString="*.jpeg") returned 6 [0074.987] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif", pszSpec="*.psd") returned 0 [0074.987] lstrlenA (lpString="*.psd") returned 5 [0074.988] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif", pszSpec="*.gif") returned 1 [0074.988] lstrlenA (lpString="*.gif") returned 5 [0074.988] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif" [0074.988] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif" [0074.988] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif." [0074.988] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif.wannacry" [0074.988] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_super.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0074.989] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x32e [0074.989] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x802482e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0074.989] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.989] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2b0, lpOverlapped=0x0) returned 1 [0074.991] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif") returned="reviews_super.gif" [0074.991] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.991] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2b0, lpOverlapped=0x0) returned 1 [0074.991] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.991] CloseHandle (hObject=0x90) returned 1 [0074.991] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_super.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_super.gif.wannacry")) returned 1 [0074.992] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x47f, dwReserved0=0xd80001d9, dwReserved1=0x2c00c4, cFileName="review_browser.gif", cAlternateFileName="REVIEW~3.GIF")) returned 1 [0074.992] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.992] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="review_browser.gif") returned -1 [0074.992] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="review_browser.gif") returned -1 [0074.993] lstrcmpiA (lpString1="", lpString2="review_browser.gif") returned -1 [0074.993] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif") returned="reviews_super.gif" [0074.993] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0074.993] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0074.993] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0074.993] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0074.993] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="review_browser.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif" [0074.993] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif", pszSpec="*.zip") returned 0 [0074.993] lstrlenA (lpString="*.zip") returned 5 [0074.993] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif", pszSpec="*.rar") returned 0 [0074.993] lstrlenA (lpString="*.rar") returned 5 [0074.993] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif", pszSpec="*.7z") returned 0 [0074.993] lstrlenA (lpString="*.7z") returned 4 [0074.993] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif", pszSpec="*.tar") returned 0 [0074.993] lstrlenA (lpString="*.tar") returned 5 [0074.993] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif", pszSpec="*.gzip") returned 0 [0074.993] lstrlenA (lpString="*.gzip") returned 6 [0074.993] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif", pszSpec="*.jpg") returned 0 [0074.993] lstrlenA (lpString="*.jpg") returned 5 [0074.993] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif", pszSpec="*.jpeg") returned 0 [0074.993] lstrlenA (lpString="*.jpeg") returned 6 [0074.993] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif", pszSpec="*.psd") returned 0 [0074.993] lstrlenA (lpString="*.psd") returned 5 [0074.993] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif", pszSpec="*.gif") returned 1 [0074.994] lstrlenA (lpString="*.gif") returned 5 [0074.994] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif" [0074.994] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif" [0074.994] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif." [0074.994] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif.wannacry" [0074.994] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_browser.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0074.995] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x47f [0074.995] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x801fc020, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4)) returned 1 [0074.995] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.995] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x401, lpOverlapped=0x0) returned 1 [0074.996] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif") returned="review_browser.gif" [0074.996] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0074.997] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x401, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x401, lpOverlapped=0x0) returned 1 [0074.997] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0074.997] CloseHandle (hObject=0x90) returned 1 [0074.997] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_browser.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_browser.gif.wannacry")) returned 1 [0074.998] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x57d, dwReserved0=0xd80001d9, dwReserved1=0x2c00c4, cFileName="review_email.gif", cAlternateFileName="REVIEW~2.GIF")) returned 1 [0074.998] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0074.998] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="review_email.gif") returned -1 [0074.998] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="review_email.gif") returned -1 [0074.998] lstrcmpiA (lpString1="", lpString2="review_email.gif") returned -1 [0074.998] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif") returned="review_browser.gif" [0074.998] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0074.998] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0074.998] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0074.998] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0074.998] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="review_email.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif" [0074.998] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif", pszSpec="*.zip") returned 0 [0074.998] lstrlenA (lpString="*.zip") returned 5 [0074.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif", pszSpec="*.rar") returned 0 [0074.999] lstrlenA (lpString="*.rar") returned 5 [0074.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif", pszSpec="*.7z") returned 0 [0074.999] lstrlenA (lpString="*.7z") returned 4 [0074.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif", pszSpec="*.tar") returned 0 [0074.999] lstrlenA (lpString="*.tar") returned 5 [0074.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif", pszSpec="*.gzip") returned 0 [0074.999] lstrlenA (lpString="*.gzip") returned 6 [0074.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif", pszSpec="*.jpg") returned 0 [0074.999] lstrlenA (lpString="*.jpg") returned 5 [0074.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif", pszSpec="*.jpeg") returned 0 [0074.999] lstrlenA (lpString="*.jpeg") returned 6 [0074.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif", pszSpec="*.psd") returned 0 [0074.999] lstrlenA (lpString="*.psd") returned 5 [0074.999] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif", pszSpec="*.gif") returned 1 [0074.999] lstrlenA (lpString="*.gif") returned 5 [0074.999] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif" [0074.999] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif" [0074.999] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif." [0074.999] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif.wannacry" [0074.999] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_email.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0075.000] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x57d [0075.000] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x801fc020, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4)) returned 1 [0075.000] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.000] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4ff, lpOverlapped=0x0) returned 1 [0075.002] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif") returned="review_email.gif" [0075.002] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.002] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4ff, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4ff, lpOverlapped=0x0) returned 1 [0075.002] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0075.003] CloseHandle (hObject=0x90) returned 1 [0075.003] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_email.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_email.gif.wannacry")) returned 1 [0075.004] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0xd80001d9, dwReserved1=0x2c00c4, cFileName="review_same_reviewers.gif", cAlternateFileName="RE78D9~1.GIF")) returned 1 [0075.004] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.004] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="review_same_reviewers.gif") returned -1 [0075.004] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="review_same_reviewers.gif") returned -1 [0075.004] lstrcmpiA (lpString1="", lpString2="review_same_reviewers.gif") returned -1 [0075.004] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif") returned="review_email.gif" [0075.004] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0075.004] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0075.004] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0075.004] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0075.004] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="review_same_reviewers.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif" [0075.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif", pszSpec="*.zip") returned 0 [0075.004] lstrlenA (lpString="*.zip") returned 5 [0075.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif", pszSpec="*.rar") returned 0 [0075.004] lstrlenA (lpString="*.rar") returned 5 [0075.004] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif", pszSpec="*.7z") returned 0 [0075.005] lstrlenA (lpString="*.7z") returned 4 [0075.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif", pszSpec="*.tar") returned 0 [0075.005] lstrlenA (lpString="*.tar") returned 5 [0075.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif", pszSpec="*.gzip") returned 0 [0075.005] lstrlenA (lpString="*.gzip") returned 6 [0075.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif", pszSpec="*.jpg") returned 0 [0075.005] lstrlenA (lpString="*.jpg") returned 5 [0075.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif", pszSpec="*.jpeg") returned 0 [0075.005] lstrlenA (lpString="*.jpeg") returned 6 [0075.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif", pszSpec="*.psd") returned 0 [0075.005] lstrlenA (lpString="*.psd") returned 5 [0075.005] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif", pszSpec="*.gif") returned 1 [0075.005] lstrlenA (lpString="*.gif") returned 5 [0075.005] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif" [0075.005] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif" [0075.005] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif." [0075.005] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif.wannacry" [0075.005] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_same_reviewers.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0075.006] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c2 [0075.006] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x8026e440, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0075.006] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.006] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x344, lpOverlapped=0x0) returned 1 [0075.008] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif") returned="review_same_reviewers.gif" [0075.008] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.008] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x344, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x344, lpOverlapped=0x0) returned 1 [0075.008] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0075.008] CloseHandle (hObject=0x90) returned 1 [0075.008] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_same_reviewers.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_same_reviewers.gif.wannacry")) returned 1 [0075.010] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x555, dwReserved0=0xec0001ed, dwReserved1=0x2c00c4, cFileName="review_shared.gif", cAlternateFileName="REVIEW~1.GIF")) returned 1 [0075.010] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.010] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="review_shared.gif") returned -1 [0075.010] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="review_shared.gif") returned -1 [0075.010] lstrcmpiA (lpString1="", lpString2="review_shared.gif") returned -1 [0075.010] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif") returned="review_same_reviewers.gif" [0075.010] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0075.010] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0075.010] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0075.010] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0075.010] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="review_shared.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif" [0075.010] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif", pszSpec="*.zip") returned 0 [0075.010] lstrlenA (lpString="*.zip") returned 5 [0075.010] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif", pszSpec="*.rar") returned 0 [0075.010] lstrlenA (lpString="*.rar") returned 5 [0075.010] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif", pszSpec="*.7z") returned 0 [0075.010] lstrlenA (lpString="*.7z") returned 4 [0075.010] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif", pszSpec="*.tar") returned 0 [0075.010] lstrlenA (lpString="*.tar") returned 5 [0075.010] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif", pszSpec="*.gzip") returned 0 [0075.010] lstrlenA (lpString="*.gzip") returned 6 [0075.010] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif", pszSpec="*.jpg") returned 0 [0075.011] lstrlenA (lpString="*.jpg") returned 5 [0075.011] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif", pszSpec="*.jpeg") returned 0 [0075.011] lstrlenA (lpString="*.jpeg") returned 6 [0075.011] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif", pszSpec="*.psd") returned 0 [0075.011] lstrlenA (lpString="*.psd") returned 5 [0075.011] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif", pszSpec="*.gif") returned 1 [0075.011] lstrlenA (lpString="*.gif") returned 5 [0075.011] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif" [0075.011] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif" [0075.011] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif." [0075.011] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif.wannacry" [0075.011] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_shared.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0075.012] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x555 [0075.012] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x801fc020, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0075.012] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.012] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x4d7, lpOverlapped=0x0) returned 1 [0075.015] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif") returned="review_shared.gif" [0075.015] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.015] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x4d7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x4d7, lpOverlapped=0x0) returned 1 [0075.015] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0075.015] CloseHandle (hObject=0x90) returned 1 [0075.016] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_shared.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_shared.gif.wannacry")) returned 1 [0075.017] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0xd80001d9, dwReserved1=0x2c00c4, cFileName="rss.gif", cAlternateFileName="")) returned 1 [0075.017] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.017] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="rss.gif") returned -1 [0075.017] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rss.gif") returned -1 [0075.017] lstrcmpiA (lpString1="", lpString2="rss.gif") returned -1 [0075.017] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif") returned="review_shared.gif" [0075.017] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0075.017] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0075.017] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0075.017] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0075.017] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="rss.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif" [0075.017] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif", pszSpec="*.zip") returned 0 [0075.017] lstrlenA (lpString="*.zip") returned 5 [0075.017] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif", pszSpec="*.rar") returned 0 [0075.017] lstrlenA (lpString="*.rar") returned 5 [0075.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif", pszSpec="*.7z") returned 0 [0075.018] lstrlenA (lpString="*.7z") returned 4 [0075.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif", pszSpec="*.tar") returned 0 [0075.018] lstrlenA (lpString="*.tar") returned 5 [0075.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif", pszSpec="*.gzip") returned 0 [0075.018] lstrlenA (lpString="*.gzip") returned 6 [0075.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif", pszSpec="*.jpg") returned 0 [0075.018] lstrlenA (lpString="*.jpg") returned 5 [0075.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif", pszSpec="*.jpeg") returned 0 [0075.018] lstrlenA (lpString="*.jpeg") returned 6 [0075.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif", pszSpec="*.psd") returned 0 [0075.018] lstrlenA (lpString="*.psd") returned 5 [0075.018] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif", pszSpec="*.gif") returned 1 [0075.018] lstrlenA (lpString="*.gif") returned 5 [0075.018] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif" [0075.018] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif" [0075.018] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif." [0075.018] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif.wannacry" [0075.018] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\rss.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0075.019] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0075.019] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x802482e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0075.019] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.019] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x60, lpOverlapped=0x0) returned 1 [0075.020] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif") returned="rss.gif" [0075.020] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.020] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x60, lpOverlapped=0x0) returned 1 [0075.020] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0075.020] CloseHandle (hObject=0x90) returned 1 [0075.021] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\rss.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\rss.gif.wannacry")) returned 1 [0075.022] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0xdf0001de, dwReserved1=0x2c00c4, cFileName="server_issue.gif", cAlternateFileName="SERVER~3.GIF")) returned 1 [0075.022] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.022] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="server_issue.gif") returned -1 [0075.022] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="server_issue.gif") returned -1 [0075.022] lstrcmpiA (lpString1="", lpString2="server_issue.gif") returned -1 [0075.022] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif") returned="rss.gif" [0075.022] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0075.022] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0075.022] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0075.022] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0075.022] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="server_issue.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif" [0075.022] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif", pszSpec="*.zip") returned 0 [0075.022] lstrlenA (lpString="*.zip") returned 5 [0075.022] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif", pszSpec="*.rar") returned 0 [0075.022] lstrlenA (lpString="*.rar") returned 5 [0075.022] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif", pszSpec="*.7z") returned 0 [0075.022] lstrlenA (lpString="*.7z") returned 4 [0075.022] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif", pszSpec="*.tar") returned 0 [0075.022] lstrlenA (lpString="*.tar") returned 5 [0075.022] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif", pszSpec="*.gzip") returned 0 [0075.022] lstrlenA (lpString="*.gzip") returned 6 [0075.022] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif", pszSpec="*.jpg") returned 0 [0075.023] lstrlenA (lpString="*.jpg") returned 5 [0075.023] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif", pszSpec="*.jpeg") returned 0 [0075.023] lstrlenA (lpString="*.jpeg") returned 6 [0075.023] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif", pszSpec="*.psd") returned 0 [0075.023] lstrlenA (lpString="*.psd") returned 5 [0075.023] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif", pszSpec="*.gif") returned 1 [0075.023] lstrlenA (lpString="*.gif") returned 5 [0075.023] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif" [0075.023] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif" [0075.023] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif." [0075.023] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif.wannacry" [0075.023] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_issue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0075.024] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x240 [0075.024] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x802482e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4)) returned 1 [0075.024] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.024] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1c2, lpOverlapped=0x0) returned 1 [0075.025] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif") returned="server_issue.gif" [0075.025] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.025] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1c2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1c2, lpOverlapped=0x0) returned 1 [0075.025] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0075.025] CloseHandle (hObject=0x90) returned 1 [0075.025] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_issue.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_issue.gif.wannacry")) returned 1 [0075.027] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4e7, dwReserved0=0xd80001d9, dwReserved1=0x2c00c4, cFileName="server_lg.gif", cAlternateFileName="SERVER~1.GIF")) returned 1 [0075.027] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.027] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="server_lg.gif") returned -1 [0075.027] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="server_lg.gif") returned -1 [0075.027] lstrcmpiA (lpString1="", lpString2="server_lg.gif") returned -1 [0075.027] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif") returned="server_issue.gif" [0075.027] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0075.027] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0075.027] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0075.027] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0075.027] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="server_lg.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif" [0075.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif", pszSpec="*.zip") returned 0 [0075.027] lstrlenA (lpString="*.zip") returned 5 [0075.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif", pszSpec="*.rar") returned 0 [0075.027] lstrlenA (lpString="*.rar") returned 5 [0075.027] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif", pszSpec="*.7z") returned 0 [0075.027] lstrlenA (lpString="*.7z") returned 4 [0075.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif", pszSpec="*.tar") returned 0 [0075.028] lstrlenA (lpString="*.tar") returned 5 [0075.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif", pszSpec="*.gzip") returned 0 [0075.028] lstrlenA (lpString="*.gzip") returned 6 [0075.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif", pszSpec="*.jpg") returned 0 [0075.028] lstrlenA (lpString="*.jpg") returned 5 [0075.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif", pszSpec="*.jpeg") returned 0 [0075.028] lstrlenA (lpString="*.jpeg") returned 6 [0075.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif", pszSpec="*.psd") returned 0 [0075.028] lstrlenA (lpString="*.psd") returned 5 [0075.028] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif", pszSpec="*.gif") returned 1 [0075.028] lstrlenA (lpString="*.gif") returned 5 [0075.028] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif" [0075.028] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif" [0075.028] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif." [0075.028] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif.wannacry" [0075.028] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_lg.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0075.029] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4e7 [0075.029] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80222180, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4)) returned 1 [0075.029] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.029] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x469, lpOverlapped=0x0) returned 1 [0075.031] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif") returned="server_lg.gif" [0075.031] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.031] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x469, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x469, lpOverlapped=0x0) returned 1 [0075.031] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0075.031] CloseHandle (hObject=0x90) returned 1 [0075.031] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_lg.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_lg.gif.wannacry")) returned 1 [0075.033] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x2c0244, dwReserved1=0x2c0000, cFileName="server_ok.gif", cAlternateFileName="SERVER~2.GIF")) returned 1 [0075.033] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.033] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="server_ok.gif") returned -1 [0075.033] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="server_ok.gif") returned -1 [0075.033] lstrcmpiA (lpString1="", lpString2="server_ok.gif") returned -1 [0075.033] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif") returned="server_lg.gif" [0075.033] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0075.033] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0075.033] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0075.033] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0075.033] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="server_ok.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif" [0075.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif", pszSpec="*.zip") returned 0 [0075.033] lstrlenA (lpString="*.zip") returned 5 [0075.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif", pszSpec="*.rar") returned 0 [0075.033] lstrlenA (lpString="*.rar") returned 5 [0075.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif", pszSpec="*.7z") returned 0 [0075.033] lstrlenA (lpString="*.7z") returned 4 [0075.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif", pszSpec="*.tar") returned 0 [0075.033] lstrlenA (lpString="*.tar") returned 5 [0075.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif", pszSpec="*.gzip") returned 0 [0075.033] lstrlenA (lpString="*.gzip") returned 6 [0075.033] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif", pszSpec="*.jpg") returned 0 [0075.034] lstrlenA (lpString="*.jpg") returned 5 [0075.034] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif", pszSpec="*.jpeg") returned 0 [0075.034] lstrlenA (lpString="*.jpeg") returned 6 [0075.034] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif", pszSpec="*.psd") returned 0 [0075.034] lstrlenA (lpString="*.psd") returned 5 [0075.034] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif", pszSpec="*.gif") returned 1 [0075.034] lstrlenA (lpString="*.gif") returned 5 [0075.034] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif" [0075.034] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_ok.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0075.036] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe1 [0075.036] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x802482e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0075.036] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.036] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x63, lpOverlapped=0x0) returned 1 [0075.037] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif") returned="server_ok.gif" [0075.037] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.037] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x63, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x63, lpOverlapped=0x0) returned 1 [0075.037] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0075.037] CloseHandle (hObject=0x90) returned 1 [0075.037] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_ok.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_ok.gif.wannacry")) returned 1 [0075.038] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x393, dwReserved0=0x2c0244, dwReserved1=0x2c0000, cFileName="stop_collection_data.gif", cAlternateFileName="STOP_C~1.GIF")) returned 1 [0075.039] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.039] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="stop_collection_data.gif") returned -1 [0075.039] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="stop_collection_data.gif") returned -1 [0075.039] lstrcmpiA (lpString1="", lpString2="stop_collection_data.gif") returned -1 [0075.039] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif") returned="server_ok.gif" [0075.039] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0075.039] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0075.039] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0075.039] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="stop_collection_data.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif" [0075.039] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif", pszSpec="*.zip") returned 0 [0075.039] lstrlenA (lpString="*.zip") returned 5 [0075.039] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif", pszSpec="*.rar") returned 0 [0075.039] lstrlenA (lpString="*.rar") returned 5 [0075.041] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif", pszSpec="*.7z") returned 0 [0075.041] lstrlenA (lpString="*.7z") returned 4 [0075.041] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif", pszSpec="*.tar") returned 0 [0075.041] lstrlenA (lpString="*.tar") returned 5 [0075.041] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif", pszSpec="*.gzip") returned 0 [0075.041] lstrlenA (lpString="*.gzip") returned 6 [0075.041] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif", pszSpec="*.jpg") returned 0 [0075.041] lstrlenA (lpString="*.jpg") returned 5 [0075.041] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif", pszSpec="*.jpeg") returned 0 [0075.041] lstrlenA (lpString="*.jpeg") returned 6 [0075.041] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif", pszSpec="*.psd") returned 0 [0075.041] lstrlenA (lpString="*.psd") returned 5 [0075.041] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif", pszSpec="*.gif") returned 1 [0075.041] lstrlenA (lpString="*.gif") returned 5 [0075.041] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif" [0075.041] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif" [0075.041] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif." [0075.042] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif.wannacry" [0075.042] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\stop_collection_data.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0075.042] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x393 [0075.042] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x802482e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0075.043] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.043] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x315, lpOverlapped=0x0) returned 1 [0075.044] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif") returned="stop_collection_data.gif" [0075.044] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.044] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x315, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x315, lpOverlapped=0x0) returned 1 [0075.045] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0075.045] CloseHandle (hObject=0x90) returned 1 [0075.045] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\stop_collection_data.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\stop_collection_data.gif.wannacry")) returned 1 [0075.046] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x38a, dwReserved0=0xec0001ed, dwReserved1=0x2c00c4, cFileName="submission_history.gif", cAlternateFileName="SUBMIS~1.GIF")) returned 1 [0075.046] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.046] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="submission_history.gif") returned -1 [0075.046] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="submission_history.gif") returned -1 [0075.046] lstrcmpiA (lpString1="", lpString2="submission_history.gif") returned -1 [0075.046] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif") returned="stop_collection_data.gif" [0075.046] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0075.046] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0075.046] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0075.046] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0075.046] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="submission_history.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif" [0075.047] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif", pszSpec="*.zip") returned 0 [0075.047] lstrlenA (lpString="*.zip") returned 5 [0075.047] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif", pszSpec="*.rar") returned 0 [0075.047] lstrlenA (lpString="*.rar") returned 5 [0075.047] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif", pszSpec="*.7z") returned 0 [0075.047] lstrlenA (lpString="*.7z") returned 4 [0075.047] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif", pszSpec="*.tar") returned 0 [0075.047] lstrlenA (lpString="*.tar") returned 5 [0075.047] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif", pszSpec="*.gzip") returned 0 [0075.047] lstrlenA (lpString="*.gzip") returned 6 [0075.047] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif", pszSpec="*.jpg") returned 0 [0075.047] lstrlenA (lpString="*.jpg") returned 5 [0075.047] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif", pszSpec="*.jpeg") returned 0 [0075.047] lstrlenA (lpString="*.jpeg") returned 6 [0075.047] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif", pszSpec="*.psd") returned 0 [0075.047] lstrlenA (lpString="*.psd") returned 5 [0075.047] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif", pszSpec="*.gif") returned 1 [0075.047] lstrlenA (lpString="*.gif") returned 5 [0075.047] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif" [0075.047] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif" [0075.047] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif." [0075.047] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif.wannacry" [0075.047] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\submission_history.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0075.048] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38a [0075.048] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x802482e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0075.048] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.048] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x30c, lpOverlapped=0x0) returned 1 [0075.050] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif") returned="submission_history.gif" [0075.050] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.050] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x30c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x30c, lpOverlapped=0x0) returned 1 [0075.051] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0075.051] CloseHandle (hObject=0x90) returned 1 [0075.051] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\submission_history.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\submission_history.gif.wannacry")) returned 1 [0075.052] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0xef0001ee, dwReserved1=0x2c00c4, cFileName="tl.gif", cAlternateFileName="")) returned 1 [0075.052] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.052] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tl.gif") returned -1 [0075.052] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tl.gif") returned -1 [0075.052] lstrcmpiA (lpString1="", lpString2="tl.gif") returned -1 [0075.052] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif") returned="submission_history.gif" [0075.052] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0075.052] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0075.052] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0075.052] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0075.053] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="tl.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif" [0075.053] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif", pszSpec="*.zip") returned 0 [0075.053] lstrlenA (lpString="*.zip") returned 5 [0075.053] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif", pszSpec="*.rar") returned 0 [0075.053] lstrlenA (lpString="*.rar") returned 5 [0075.053] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif", pszSpec="*.7z") returned 0 [0075.053] lstrlenA (lpString="*.7z") returned 4 [0075.053] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif", pszSpec="*.tar") returned 0 [0075.053] lstrlenA (lpString="*.tar") returned 5 [0075.053] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif", pszSpec="*.gzip") returned 0 [0075.053] lstrlenA (lpString="*.gzip") returned 6 [0075.053] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif", pszSpec="*.jpg") returned 0 [0075.053] lstrlenA (lpString="*.jpg") returned 5 [0075.053] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif", pszSpec="*.jpeg") returned 0 [0075.053] lstrlenA (lpString="*.jpeg") returned 6 [0075.053] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif", pszSpec="*.psd") returned 0 [0075.053] lstrlenA (lpString="*.psd") returned 5 [0075.053] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif", pszSpec="*.gif") returned 1 [0075.053] lstrlenA (lpString="*.gif") returned 5 [0075.053] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif" [0075.053] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif" [0075.053] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif." [0075.053] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif.wannacry" [0075.053] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\tl.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0075.073] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x55 [0075.073] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80222180, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0075.073] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.073] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0075.074] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0075.074] CloseHandle (hObject=0x90) returned 1 [0075.074] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\tl.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\tl.gif.wannacry")) returned 1 [0075.075] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0xde0001df, dwReserved1=0x2c00c4, cFileName="tr.gif", cAlternateFileName="")) returned 1 [0075.075] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.075] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tr.gif") returned -1 [0075.075] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tr.gif") returned -1 [0075.075] lstrcmpiA (lpString1="", lpString2="tr.gif") returned -1 [0075.075] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif") returned="tl.gif" [0075.075] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0075.076] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0075.076] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0075.076] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0075.076] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="tr.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif" [0075.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif", pszSpec="*.zip") returned 0 [0075.076] lstrlenA (lpString="*.zip") returned 5 [0075.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif", pszSpec="*.rar") returned 0 [0075.076] lstrlenA (lpString="*.rar") returned 5 [0075.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif", pszSpec="*.7z") returned 0 [0075.076] lstrlenA (lpString="*.7z") returned 4 [0075.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif", pszSpec="*.tar") returned 0 [0075.076] lstrlenA (lpString="*.tar") returned 5 [0075.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif", pszSpec="*.gzip") returned 0 [0075.076] lstrlenA (lpString="*.gzip") returned 6 [0075.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif", pszSpec="*.jpg") returned 0 [0075.076] lstrlenA (lpString="*.jpg") returned 5 [0075.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif", pszSpec="*.jpeg") returned 0 [0075.076] lstrlenA (lpString="*.jpeg") returned 6 [0075.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif", pszSpec="*.psd") returned 0 [0075.076] lstrlenA (lpString="*.psd") returned 5 [0075.076] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif", pszSpec="*.gif") returned 1 [0075.076] lstrlenA (lpString="*.gif") returned 5 [0075.076] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif" [0075.077] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif" [0075.077] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif." [0075.077] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif.wannacry" [0075.077] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\tr.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0075.078] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x55 [0075.078] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80222180, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0075.078] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.078] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0075.078] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0075.078] CloseHandle (hObject=0x90) returned 1 [0075.078] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\tr.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\tr.gif.wannacry")) returned 1 [0075.079] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x489, dwReserved0=0xde0001df, dwReserved1=0x2c00c4, cFileName="trash.gif", cAlternateFileName="")) returned 1 [0075.079] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.079] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="trash.gif") returned -1 [0075.079] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="trash.gif") returned -1 [0075.079] lstrcmpiA (lpString1="", lpString2="trash.gif") returned -1 [0075.079] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif") returned="tr.gif" [0075.079] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0075.079] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0075.079] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0075.079] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0075.080] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="trash.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif" [0075.080] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif", pszSpec="*.zip") returned 0 [0075.080] lstrlenA (lpString="*.zip") returned 5 [0075.080] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif", pszSpec="*.rar") returned 0 [0075.080] lstrlenA (lpString="*.rar") returned 5 [0075.080] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif", pszSpec="*.7z") returned 0 [0075.080] lstrlenA (lpString="*.7z") returned 4 [0075.080] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif", pszSpec="*.tar") returned 0 [0075.080] lstrlenA (lpString="*.tar") returned 5 [0075.080] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif", pszSpec="*.gzip") returned 0 [0075.080] lstrlenA (lpString="*.gzip") returned 6 [0075.080] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif", pszSpec="*.jpg") returned 0 [0075.080] lstrlenA (lpString="*.jpg") returned 5 [0075.080] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif", pszSpec="*.jpeg") returned 0 [0075.080] lstrlenA (lpString="*.jpeg") returned 6 [0075.080] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif", pszSpec="*.psd") returned 0 [0075.080] lstrlenA (lpString="*.psd") returned 5 [0075.080] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif", pszSpec="*.gif") returned 1 [0075.080] lstrlenA (lpString="*.gif") returned 5 [0075.080] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif" [0075.080] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif" [0075.080] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif." [0075.080] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif.wannacry" [0075.080] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\trash.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0075.081] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x489 [0075.081] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80222180, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0075.081] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.081] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x40b, lpOverlapped=0x0) returned 1 [0075.083] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif") returned="trash.gif" [0075.083] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.083] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x40b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x40b, lpOverlapped=0x0) returned 1 [0075.083] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0075.083] CloseHandle (hObject=0x90) returned 1 [0075.084] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\trash.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\trash.gif.wannacry")) returned 1 [0075.084] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x338, dwReserved0=0x2c023c, dwReserved1=0x2c0000, cFileName="turnOffNotificationInAcrobat.gif", cAlternateFileName="TURNOF~2.GIF")) returned 1 [0075.085] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.085] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="turnOffNotificationInAcrobat.gif") returned -1 [0075.085] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="turnOffNotificationInAcrobat.gif") returned -1 [0075.085] lstrcmpiA (lpString1="", lpString2="turnOffNotificationInAcrobat.gif") returned -1 [0075.085] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif") returned="trash.gif" [0075.085] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0075.085] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0075.085] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0075.085] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0075.085] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="turnOffNotificationInAcrobat.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif" [0075.085] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif", pszSpec="*.zip") returned 0 [0075.085] lstrlenA (lpString="*.zip") returned 5 [0075.085] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif", pszSpec="*.rar") returned 0 [0075.085] lstrlenA (lpString="*.rar") returned 5 [0075.085] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif", pszSpec="*.7z") returned 0 [0075.085] lstrlenA (lpString="*.7z") returned 4 [0075.085] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif", pszSpec="*.tar") returned 0 [0075.085] lstrlenA (lpString="*.tar") returned 5 [0075.085] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif", pszSpec="*.gzip") returned 0 [0075.085] lstrlenA (lpString="*.gzip") returned 6 [0075.085] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif", pszSpec="*.jpg") returned 0 [0075.085] lstrlenA (lpString="*.jpg") returned 5 [0075.086] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif", pszSpec="*.jpeg") returned 0 [0075.086] lstrlenA (lpString="*.jpeg") returned 6 [0075.086] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif", pszSpec="*.psd") returned 0 [0075.086] lstrlenA (lpString="*.psd") returned 5 [0075.086] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif", pszSpec="*.gif") returned 1 [0075.086] lstrlenA (lpString="*.gif") returned 5 [0075.086] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif" [0075.086] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif" [0075.086] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif." [0075.086] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif.wannacry" [0075.086] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationinacrobat.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0075.087] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x338 [0075.087] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x802482e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4)) returned 1 [0075.087] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.087] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2ba, lpOverlapped=0x0) returned 1 [0075.088] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif") returned="turnOffNotificationInAcrobat.gif" [0075.088] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.088] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2ba, lpOverlapped=0x0) returned 1 [0075.089] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0075.089] CloseHandle (hObject=0x90) returned 1 [0075.089] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationinacrobat.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationinacrobat.gif.wannacry")) returned 1 [0075.090] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0xe80001e9, dwReserved1=0x2c00c4, cFileName="turnOffNotificationInTray.gif", cAlternateFileName="TURNOF~1.GIF")) returned 1 [0075.090] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.090] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="turnOffNotificationInTray.gif") returned -1 [0075.090] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="turnOffNotificationInTray.gif") returned -1 [0075.090] lstrcmpiA (lpString1="", lpString2="turnOffNotificationInTray.gif") returned -1 [0075.090] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif") returned="turnOffNotificationInAcrobat.gif" [0075.090] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0075.090] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0075.090] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0075.090] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0075.090] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="turnOffNotificationInTray.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif" [0075.091] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif", pszSpec="*.zip") returned 0 [0075.091] lstrlenA (lpString="*.zip") returned 5 [0075.091] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif", pszSpec="*.rar") returned 0 [0075.091] lstrlenA (lpString="*.rar") returned 5 [0075.091] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif", pszSpec="*.7z") returned 0 [0075.091] lstrlenA (lpString="*.7z") returned 4 [0075.091] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif", pszSpec="*.tar") returned 0 [0075.091] lstrlenA (lpString="*.tar") returned 5 [0075.091] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif", pszSpec="*.gzip") returned 0 [0075.091] lstrlenA (lpString="*.gzip") returned 6 [0075.091] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif", pszSpec="*.jpg") returned 0 [0075.091] lstrlenA (lpString="*.jpg") returned 5 [0075.091] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif", pszSpec="*.jpeg") returned 0 [0075.091] lstrlenA (lpString="*.jpeg") returned 6 [0075.091] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif", pszSpec="*.psd") returned 0 [0075.091] lstrlenA (lpString="*.psd") returned 5 [0075.091] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif", pszSpec="*.gif") returned 1 [0075.091] lstrlenA (lpString="*.gif") returned 5 [0075.091] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif" [0075.091] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif" [0075.091] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif." [0075.091] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif.wannacry" [0075.091] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationintray.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0075.092] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e3 [0075.092] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x802482e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0075.092] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.092] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x365, lpOverlapped=0x0) returned 1 [0075.095] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif") returned="turnOffNotificationInTray.gif" [0075.095] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.095] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x365, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x365, lpOverlapped=0x0) returned 1 [0075.096] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0075.096] CloseHandle (hObject=0x90) returned 1 [0075.096] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationintray.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationintray.gif.wannacry")) returned 1 [0075.097] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x33f, dwReserved0=0xeb0001ea, dwReserved1=0x2c00c4, cFileName="turnOnNotificationInAcrobat.gif", cAlternateFileName="TURNON~2.GIF")) returned 1 [0075.097] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.097] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="turnOnNotificationInAcrobat.gif") returned -1 [0075.097] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="turnOnNotificationInAcrobat.gif") returned -1 [0075.097] lstrcmpiA (lpString1="", lpString2="turnOnNotificationInAcrobat.gif") returned -1 [0075.097] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif") returned="turnOffNotificationInTray.gif" [0075.097] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0075.097] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0075.097] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0075.097] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0075.097] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="turnOnNotificationInAcrobat.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif" [0075.097] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif", pszSpec="*.zip") returned 0 [0075.097] lstrlenA (lpString="*.zip") returned 5 [0075.098] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif", pszSpec="*.rar") returned 0 [0075.098] lstrlenA (lpString="*.rar") returned 5 [0075.098] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif", pszSpec="*.7z") returned 0 [0075.098] lstrlenA (lpString="*.7z") returned 4 [0075.098] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif", pszSpec="*.tar") returned 0 [0075.098] lstrlenA (lpString="*.tar") returned 5 [0075.098] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif", pszSpec="*.gzip") returned 0 [0075.098] lstrlenA (lpString="*.gzip") returned 6 [0075.098] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif", pszSpec="*.jpg") returned 0 [0075.098] lstrlenA (lpString="*.jpg") returned 5 [0075.098] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif", pszSpec="*.jpeg") returned 0 [0075.098] lstrlenA (lpString="*.jpeg") returned 6 [0075.098] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif", pszSpec="*.psd") returned 0 [0075.098] lstrlenA (lpString="*.psd") returned 5 [0075.098] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif", pszSpec="*.gif") returned 1 [0075.098] lstrlenA (lpString="*.gif") returned 5 [0075.098] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif" [0075.098] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif" [0075.098] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif." [0075.098] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif.wannacry" [0075.098] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationinacrobat.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0075.099] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x33f [0075.099] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x802482e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4)) returned 1 [0075.099] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.099] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x2c1, lpOverlapped=0x0) returned 1 [0075.101] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif") returned="turnOnNotificationInAcrobat.gif" [0075.101] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.101] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x2c1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x2c1, lpOverlapped=0x0) returned 1 [0075.101] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0075.101] CloseHandle (hObject=0x90) returned 1 [0075.101] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationinacrobat.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationinacrobat.gif.wannacry")) returned 1 [0075.102] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3ea, dwReserved0=0xe80001e9, dwReserved1=0x2c00c4, cFileName="turnOnNotificationInTray.gif", cAlternateFileName="TURNON~1.GIF")) returned 1 [0075.102] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.103] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="turnOnNotificationInTray.gif") returned -1 [0075.103] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="turnOnNotificationInTray.gif") returned -1 [0075.103] lstrcmpiA (lpString1="", lpString2="turnOnNotificationInTray.gif") returned -1 [0075.103] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif") returned="turnOnNotificationInAcrobat.gif" [0075.103] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0075.103] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0075.103] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0075.103] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0075.103] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="turnOnNotificationInTray.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif" [0075.103] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif", pszSpec="*.zip") returned 0 [0075.103] lstrlenA (lpString="*.zip") returned 5 [0075.103] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif", pszSpec="*.rar") returned 0 [0075.103] lstrlenA (lpString="*.rar") returned 5 [0075.103] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif", pszSpec="*.7z") returned 0 [0075.103] lstrlenA (lpString="*.7z") returned 4 [0075.103] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif", pszSpec="*.tar") returned 0 [0075.103] lstrlenA (lpString="*.tar") returned 5 [0075.103] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif", pszSpec="*.gzip") returned 0 [0075.103] lstrlenA (lpString="*.gzip") returned 6 [0075.103] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif", pszSpec="*.jpg") returned 0 [0075.103] lstrlenA (lpString="*.jpg") returned 5 [0075.103] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif", pszSpec="*.jpeg") returned 0 [0075.104] lstrlenA (lpString="*.jpeg") returned 6 [0075.104] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif", pszSpec="*.psd") returned 0 [0075.104] lstrlenA (lpString="*.psd") returned 5 [0075.104] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif", pszSpec="*.gif") returned 1 [0075.104] lstrlenA (lpString="*.gif") returned 5 [0075.104] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif" [0075.104] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif" [0075.104] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif." [0075.104] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif.wannacry" [0075.104] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationintray.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0075.105] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ea [0075.105] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80222180, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0075.105] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.105] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x36c, lpOverlapped=0x0) returned 1 [0075.108] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif") returned="turnOnNotificationInTray.gif" [0075.108] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.108] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x36c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x36c, lpOverlapped=0x0) returned 1 [0075.108] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0075.108] CloseHandle (hObject=0x90) returned 1 [0075.108] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationintray.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationintray.gif.wannacry")) returned 1 [0075.109] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0xeb0001ea, dwReserved1=0x2c00c4, cFileName="warning.gif", cAlternateFileName="")) returned 1 [0075.109] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.109] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="warning.gif") returned -1 [0075.110] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="warning.gif") returned -1 [0075.110] lstrcmpiA (lpString1="", lpString2="warning.gif") returned -1 [0075.110] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif") returned="turnOnNotificationInTray.gif" [0075.110] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0075.110] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="" [0075.110] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" [0075.110] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\how to decrypt files.txt")) returned 0x20 [0075.110] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\", lpString2="warning.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif" [0075.110] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif", pszSpec="*.zip") returned 0 [0075.110] lstrlenA (lpString="*.zip") returned 5 [0075.110] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif", pszSpec="*.rar") returned 0 [0075.110] lstrlenA (lpString="*.rar") returned 5 [0075.110] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif", pszSpec="*.7z") returned 0 [0075.110] lstrlenA (lpString="*.7z") returned 4 [0075.110] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif", pszSpec="*.tar") returned 0 [0075.110] lstrlenA (lpString="*.tar") returned 5 [0075.111] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif", pszSpec="*.gzip") returned 0 [0075.111] lstrlenA (lpString="*.gzip") returned 6 [0075.111] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif", pszSpec="*.jpg") returned 0 [0075.111] lstrlenA (lpString="*.jpg") returned 5 [0075.111] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif", pszSpec="*.jpeg") returned 0 [0075.111] lstrlenA (lpString="*.jpeg") returned 6 [0075.111] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif", pszSpec="*.psd") returned 0 [0075.111] lstrlenA (lpString="*.psd") returned 5 [0075.111] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif", pszSpec="*.gif") returned 1 [0075.111] lstrlenA (lpString="*.gif") returned 5 [0075.111] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif" [0075.111] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif" [0075.111] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif", lpString2="." | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif.") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif." [0075.111] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif.", lpString2="wannacry" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif.wannacry") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif.wannacry" [0075.111] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\warning.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0075.112] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x171 [0075.112] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x80222180, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x93de7300, dwHighDateTime=0x1cb84b4)) returned 1 [0075.112] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.112] ReadFile (in: hFile=0x90, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0xf3, lpOverlapped=0x0) returned 1 [0075.113] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif") returned="warning.gif" [0075.113] SetFilePointer (in: hFile=0x90, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.113] WriteFile (in: hFile=0x90, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0xf3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0xf3, lpOverlapped=0x0) returned 1 [0075.113] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0075.113] CloseHandle (hObject=0x90) returned 1 [0075.114] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\warning.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\warning.gif.wannacry")) returned 1 [0075.115] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0xeb0001ea, dwReserved1=0x2c00c4, cFileName="warning.gif", cAlternateFileName="")) returned 0 [0075.115] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.115] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4398, dwReserved0=0x2e23c8, dwReserved1=0x3, cFileName="ViewerPS.dll", cAlternateFileName="")) returned 1 [0075.115] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0075.115] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ViewerPS.dll") returned -1 [0075.115] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ViewerPS.dll") returned -1 [0075.115] lstrcmpiA (lpString1="", lpString2="ViewerPS.dll") returned -1 [0075.115] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\*.*") returned="*.*" [0075.115] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0075.115] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="" [0075.115] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\HOW TO DECRYPT FILES.txt" [0075.115] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\how to decrypt files.txt")) returned 0x20 [0075.115] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\", lpString2="ViewerPS.dll" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll" [0075.115] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.zip") returned 0 [0075.115] lstrlenA (lpString="*.zip") returned 5 [0075.115] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.rar") returned 0 [0075.115] lstrlenA (lpString="*.rar") returned 5 [0075.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.7z") returned 0 [0075.116] lstrlenA (lpString="*.7z") returned 4 [0075.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.tar") returned 0 [0075.116] lstrlenA (lpString="*.tar") returned 5 [0075.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.gzip") returned 0 [0075.116] lstrlenA (lpString="*.gzip") returned 6 [0075.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.jpg") returned 0 [0075.116] lstrlenA (lpString="*.jpg") returned 5 [0075.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.jpeg") returned 0 [0075.116] lstrlenA (lpString="*.jpeg") returned 6 [0075.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.psd") returned 0 [0075.116] lstrlenA (lpString="*.psd") returned 5 [0075.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.gif") returned 0 [0075.116] lstrlenA (lpString="*.gif") returned 5 [0075.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.doc") returned 0 [0075.116] lstrlenA (lpString="*.doc") returned 5 [0075.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.docx") returned 0 [0075.116] lstrlenA (lpString="*.docx") returned 6 [0075.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.xls") returned 0 [0075.116] lstrlenA (lpString="*.xls") returned 5 [0075.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.xlsx") returned 0 [0075.116] lstrlenA (lpString="*.xlsx") returned 6 [0075.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.ppt") returned 0 [0075.116] lstrlenA (lpString="*.ppt") returned 5 [0075.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.pptx") returned 0 [0075.116] lstrlenA (lpString="*.pptx") returned 6 [0075.116] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.pdf") returned 0 [0075.117] lstrlenA (lpString="*.pdf") returned 5 [0075.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.mov") returned 0 [0075.117] lstrlenA (lpString="*.mov") returned 5 [0075.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.m2v") returned 0 [0075.117] lstrlenA (lpString="*.m2v") returned 5 [0075.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.3gp") returned 0 [0075.117] lstrlenA (lpString="*.3gp") returned 5 [0075.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.mpeg") returned 0 [0075.117] lstrlenA (lpString="*.mpeg") returned 6 [0075.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.mpg") returned 0 [0075.117] lstrlenA (lpString="*.mpg") returned 5 [0075.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.flv") returned 0 [0075.117] lstrlenA (lpString="*.flv") returned 5 [0075.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.avi") returned 0 [0075.117] lstrlenA (lpString="*.avi") returned 5 [0075.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.mp4") returned 0 [0075.117] lstrlenA (lpString="*.mp4") returned 5 [0075.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.wmv") returned 0 [0075.117] lstrlenA (lpString="*.wmv") returned 5 [0075.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.divx") returned 0 [0075.117] lstrlenA (lpString="*.divx") returned 6 [0075.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.mkv") returned 0 [0075.117] lstrlenA (lpString="*.mkv") returned 5 [0075.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.mp3") returned 0 [0075.117] lstrlenA (lpString="*.mp3") returned 5 [0075.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.wav") returned 0 [0075.117] lstrlenA (lpString="*.wav") returned 5 [0075.117] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.flac") returned 0 [0075.118] lstrlenA (lpString="*.flac") returned 6 [0075.118] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.ape") returned 0 [0075.118] lstrlenA (lpString="*.ape") returned 5 [0075.118] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.wma") returned 0 [0075.118] lstrlenA (lpString="*.wma") returned 5 [0075.118] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.ac3") returned 0 [0075.118] lstrlenA (lpString="*.ac3") returned 5 [0075.118] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll", pszSpec="*.mxf") returned 0 [0075.118] lstrlenA (lpString="*.mxf") returned 5 [0075.118] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8202f740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11f98, dwReserved0=0x0, dwReserved1=0x0, cFileName="wow_helper.exe", cAlternateFileName="WOW_HE~1.EXE")) returned 1 [0075.118] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0075.118] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="wow_helper.exe") returned -1 [0075.118] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wow_helper.exe") returned -1 [0075.118] lstrcmpiA (lpString1="", lpString2="wow_helper.exe") returned -1 [0075.118] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ViewerPS.dll") returned="ViewerPS.dll" [0075.118] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0075.118] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="" [0075.118] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\HOW TO DECRYPT FILES.txt" [0075.118] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\how to decrypt files.txt")) returned 0x20 [0075.118] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\", lpString2="wow_helper.exe" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe" [0075.118] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.zip") returned 0 [0075.118] lstrlenA (lpString="*.zip") returned 5 [0075.118] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.rar") returned 0 [0075.118] lstrlenA (lpString="*.rar") returned 5 [0075.119] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.7z") returned 0 [0075.119] lstrlenA (lpString="*.7z") returned 4 [0075.119] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.tar") returned 0 [0075.119] lstrlenA (lpString="*.tar") returned 5 [0075.119] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.gzip") returned 0 [0075.119] lstrlenA (lpString="*.gzip") returned 6 [0075.119] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.jpg") returned 0 [0075.119] lstrlenA (lpString="*.jpg") returned 5 [0075.119] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.jpeg") returned 0 [0075.119] lstrlenA (lpString="*.jpeg") returned 6 [0075.119] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.psd") returned 0 [0075.119] lstrlenA (lpString="*.psd") returned 5 [0075.119] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.gif") returned 0 [0075.119] lstrlenA (lpString="*.gif") returned 5 [0075.119] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.doc") returned 0 [0075.119] lstrlenA (lpString="*.doc") returned 5 [0075.119] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.docx") returned 0 [0075.119] lstrlenA (lpString="*.docx") returned 6 [0075.119] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.xls") returned 0 [0075.119] lstrlenA (lpString="*.xls") returned 5 [0075.119] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.xlsx") returned 0 [0075.119] lstrlenA (lpString="*.xlsx") returned 6 [0075.119] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.ppt") returned 0 [0075.119] lstrlenA (lpString="*.ppt") returned 5 [0075.119] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.pptx") returned 0 [0075.119] lstrlenA (lpString="*.pptx") returned 6 [0075.119] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.pdf") returned 0 [0075.119] lstrlenA (lpString="*.pdf") returned 5 [0075.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.mov") returned 0 [0075.120] lstrlenA (lpString="*.mov") returned 5 [0075.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.m2v") returned 0 [0075.120] lstrlenA (lpString="*.m2v") returned 5 [0075.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.3gp") returned 0 [0075.120] lstrlenA (lpString="*.3gp") returned 5 [0075.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.mpeg") returned 0 [0075.120] lstrlenA (lpString="*.mpeg") returned 6 [0075.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.mpg") returned 0 [0075.120] lstrlenA (lpString="*.mpg") returned 5 [0075.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.flv") returned 0 [0075.120] lstrlenA (lpString="*.flv") returned 5 [0075.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.avi") returned 0 [0075.120] lstrlenA (lpString="*.avi") returned 5 [0075.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.mp4") returned 0 [0075.120] lstrlenA (lpString="*.mp4") returned 5 [0075.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.wmv") returned 0 [0075.120] lstrlenA (lpString="*.wmv") returned 5 [0075.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.divx") returned 0 [0075.120] lstrlenA (lpString="*.divx") returned 6 [0075.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.mkv") returned 0 [0075.120] lstrlenA (lpString="*.mkv") returned 5 [0075.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.mp3") returned 0 [0075.120] lstrlenA (lpString="*.mp3") returned 5 [0075.120] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.wav") returned 0 [0075.120] lstrlenA (lpString="*.wav") returned 5 [0075.121] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.flac") returned 0 [0075.121] lstrlenA (lpString="*.flac") returned 6 [0075.121] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.ape") returned 0 [0075.121] lstrlenA (lpString="*.ape") returned 5 [0075.121] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.wma") returned 0 [0075.121] lstrlenA (lpString="*.wma") returned 5 [0075.121] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.ac3") returned 0 [0075.121] lstrlenA (lpString="*.ac3") returned 5 [0075.121] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\wow_helper.exe", pszSpec="*.mxf") returned 0 [0075.121] lstrlenA (lpString="*.mxf") returned 5 [0075.121] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8202f740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11f98, dwReserved0=0x0, dwReserved1=0x0, cFileName="wow_helper.exe", cAlternateFileName="WOW_HE~1.EXE")) returned 0 [0075.121] FindClose (in: hFindFile=0x2e34b8 | out: hFindFile=0x2e34b8) returned 1 [0075.121] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4176, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ReadMe.htm", cAlternateFileName="")) returned 1 [0075.121] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0075.121] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ReadMe.htm") returned -1 [0075.121] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ReadMe.htm") returned -1 [0075.121] lstrcmpiA (lpString1="", lpString2="ReadMe.htm") returned -1 [0075.121] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\*.*") returned="*.*" [0075.121] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0075.121] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="" [0075.121] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt" [0075.121] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\how to decrypt files.txt")) returned 0x20 [0075.122] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\", lpString2="ReadMe.htm" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm" [0075.122] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.zip") returned 0 [0075.122] lstrlenA (lpString="*.zip") returned 5 [0075.122] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.rar") returned 0 [0075.122] lstrlenA (lpString="*.rar") returned 5 [0075.122] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.7z") returned 0 [0075.122] lstrlenA (lpString="*.7z") returned 4 [0075.122] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.tar") returned 0 [0075.122] lstrlenA (lpString="*.tar") returned 5 [0075.122] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.gzip") returned 0 [0075.122] lstrlenA (lpString="*.gzip") returned 6 [0075.122] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.jpg") returned 0 [0075.122] lstrlenA (lpString="*.jpg") returned 5 [0075.122] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.jpeg") returned 0 [0075.122] lstrlenA (lpString="*.jpeg") returned 6 [0075.122] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.psd") returned 0 [0075.122] lstrlenA (lpString="*.psd") returned 5 [0075.122] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.gif") returned 0 [0075.122] lstrlenA (lpString="*.gif") returned 5 [0075.122] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.doc") returned 0 [0075.122] lstrlenA (lpString="*.doc") returned 5 [0075.122] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.docx") returned 0 [0075.122] lstrlenA (lpString="*.docx") returned 6 [0075.122] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.xls") returned 0 [0075.123] lstrlenA (lpString="*.xls") returned 5 [0075.123] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.xlsx") returned 0 [0075.123] lstrlenA (lpString="*.xlsx") returned 6 [0075.123] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.ppt") returned 0 [0075.123] lstrlenA (lpString="*.ppt") returned 5 [0075.123] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.pptx") returned 0 [0075.123] lstrlenA (lpString="*.pptx") returned 6 [0075.123] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.pdf") returned 0 [0075.123] lstrlenA (lpString="*.pdf") returned 5 [0075.123] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.mov") returned 0 [0075.123] lstrlenA (lpString="*.mov") returned 5 [0075.123] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.m2v") returned 0 [0075.123] lstrlenA (lpString="*.m2v") returned 5 [0075.123] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.3gp") returned 0 [0075.123] lstrlenA (lpString="*.3gp") returned 5 [0075.123] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.mpeg") returned 0 [0075.123] lstrlenA (lpString="*.mpeg") returned 6 [0075.123] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.mpg") returned 0 [0075.123] lstrlenA (lpString="*.mpg") returned 5 [0075.123] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.flv") returned 0 [0075.123] lstrlenA (lpString="*.flv") returned 5 [0075.123] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.avi") returned 0 [0075.123] lstrlenA (lpString="*.avi") returned 5 [0075.123] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.mp4") returned 0 [0075.123] lstrlenA (lpString="*.mp4") returned 5 [0075.124] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.wmv") returned 0 [0075.124] lstrlenA (lpString="*.wmv") returned 5 [0075.124] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.divx") returned 0 [0075.124] lstrlenA (lpString="*.divx") returned 6 [0075.124] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.mkv") returned 0 [0075.124] lstrlenA (lpString="*.mkv") returned 5 [0075.124] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.mp3") returned 0 [0075.124] lstrlenA (lpString="*.mp3") returned 5 [0075.124] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.wav") returned 0 [0075.124] lstrlenA (lpString="*.wav") returned 5 [0075.124] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.flac") returned 0 [0075.124] lstrlenA (lpString="*.flac") returned 6 [0075.124] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.ape") returned 0 [0075.124] lstrlenA (lpString="*.ape") returned 5 [0075.125] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.wma") returned 0 [0075.125] lstrlenA (lpString="*.wma") returned 5 [0075.125] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.ac3") returned 0 [0075.125] lstrlenA (lpString="*.ac3") returned 5 [0075.125] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", pszSpec="*.mxf") returned 0 [0075.125] lstrlenA (lpString="*.mxf") returned 5 [0075.125] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3f71, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeCS.htm", cAlternateFileName="")) returned 1 [0075.125] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0075.125] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ReadMeCS.htm") returned -1 [0075.125] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ReadMeCS.htm") returned -1 [0075.125] lstrcmpiA (lpString1="", lpString2="ReadMeCS.htm") returned -1 [0075.125] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm") returned="ReadMe.htm" [0075.125] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0075.125] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="" [0075.125] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt" [0075.125] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\how to decrypt files.txt")) returned 0x20 [0075.125] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\", lpString2="ReadMeCS.htm" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm" [0075.125] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.zip") returned 0 [0075.125] lstrlenA (lpString="*.zip") returned 5 [0075.125] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.rar") returned 0 [0075.125] lstrlenA (lpString="*.rar") returned 5 [0075.125] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.7z") returned 0 [0075.126] lstrlenA (lpString="*.7z") returned 4 [0075.126] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.tar") returned 0 [0075.126] lstrlenA (lpString="*.tar") returned 5 [0075.126] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.gzip") returned 0 [0075.126] lstrlenA (lpString="*.gzip") returned 6 [0075.126] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.jpg") returned 0 [0075.126] lstrlenA (lpString="*.jpg") returned 5 [0075.126] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.jpeg") returned 0 [0075.126] lstrlenA (lpString="*.jpeg") returned 6 [0075.126] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.psd") returned 0 [0075.126] lstrlenA (lpString="*.psd") returned 5 [0075.126] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.gif") returned 0 [0075.126] lstrlenA (lpString="*.gif") returned 5 [0075.126] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.doc") returned 0 [0075.126] lstrlenA (lpString="*.doc") returned 5 [0075.126] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.docx") returned 0 [0075.126] lstrlenA (lpString="*.docx") returned 6 [0075.126] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.xls") returned 0 [0075.126] lstrlenA (lpString="*.xls") returned 5 [0075.126] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.xlsx") returned 0 [0075.126] lstrlenA (lpString="*.xlsx") returned 6 [0075.126] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.ppt") returned 0 [0075.126] lstrlenA (lpString="*.ppt") returned 5 [0075.126] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.pptx") returned 0 [0075.126] lstrlenA (lpString="*.pptx") returned 6 [0075.126] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.pdf") returned 0 [0075.127] lstrlenA (lpString="*.pdf") returned 5 [0075.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.mov") returned 0 [0075.127] lstrlenA (lpString="*.mov") returned 5 [0075.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.m2v") returned 0 [0075.127] lstrlenA (lpString="*.m2v") returned 5 [0075.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.3gp") returned 0 [0075.127] lstrlenA (lpString="*.3gp") returned 5 [0075.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.mpeg") returned 0 [0075.127] lstrlenA (lpString="*.mpeg") returned 6 [0075.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.mpg") returned 0 [0075.127] lstrlenA (lpString="*.mpg") returned 5 [0075.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.flv") returned 0 [0075.127] lstrlenA (lpString="*.flv") returned 5 [0075.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.avi") returned 0 [0075.127] lstrlenA (lpString="*.avi") returned 5 [0075.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.mp4") returned 0 [0075.127] lstrlenA (lpString="*.mp4") returned 5 [0075.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.wmv") returned 0 [0075.127] lstrlenA (lpString="*.wmv") returned 5 [0075.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.divx") returned 0 [0075.127] lstrlenA (lpString="*.divx") returned 6 [0075.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.mkv") returned 0 [0075.127] lstrlenA (lpString="*.mkv") returned 5 [0075.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.mp3") returned 0 [0075.127] lstrlenA (lpString="*.mp3") returned 5 [0075.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.wav") returned 0 [0075.127] lstrlenA (lpString="*.wav") returned 5 [0075.127] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.flac") returned 0 [0075.127] lstrlenA (lpString="*.flac") returned 6 [0075.128] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.ape") returned 0 [0075.128] lstrlenA (lpString="*.ape") returned 5 [0075.128] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.wma") returned 0 [0075.128] lstrlenA (lpString="*.wma") returned 5 [0075.128] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.ac3") returned 0 [0075.128] lstrlenA (lpString="*.ac3") returned 5 [0075.128] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", pszSpec="*.mxf") returned 0 [0075.128] lstrlenA (lpString="*.mxf") returned 5 [0075.128] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3fa1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeCT.htm", cAlternateFileName="")) returned 1 [0075.128] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0075.132] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ReadMeCT.htm") returned -1 [0075.132] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ReadMeCT.htm") returned -1 [0075.132] lstrcmpiA (lpString1="", lpString2="ReadMeCT.htm") returned -1 [0075.132] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm") returned="ReadMeCS.htm" [0075.132] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0075.132] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="" [0075.132] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt" [0075.132] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\how to decrypt files.txt")) returned 0x20 [0075.132] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\", lpString2="ReadMeCT.htm" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm" [0075.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.zip") returned 0 [0075.132] lstrlenA (lpString="*.zip") returned 5 [0075.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.rar") returned 0 [0075.132] lstrlenA (lpString="*.rar") returned 5 [0075.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.7z") returned 0 [0075.132] lstrlenA (lpString="*.7z") returned 4 [0075.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.tar") returned 0 [0075.132] lstrlenA (lpString="*.tar") returned 5 [0075.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.gzip") returned 0 [0075.132] lstrlenA (lpString="*.gzip") returned 6 [0075.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.jpg") returned 0 [0075.132] lstrlenA (lpString="*.jpg") returned 5 [0075.132] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.jpeg") returned 0 [0075.132] lstrlenA (lpString="*.jpeg") returned 6 [0075.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.psd") returned 0 [0075.133] lstrlenA (lpString="*.psd") returned 5 [0075.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.gif") returned 0 [0075.133] lstrlenA (lpString="*.gif") returned 5 [0075.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.doc") returned 0 [0075.133] lstrlenA (lpString="*.doc") returned 5 [0075.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.docx") returned 0 [0075.133] lstrlenA (lpString="*.docx") returned 6 [0075.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.xls") returned 0 [0075.133] lstrlenA (lpString="*.xls") returned 5 [0075.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.xlsx") returned 0 [0075.133] lstrlenA (lpString="*.xlsx") returned 6 [0075.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.ppt") returned 0 [0075.133] lstrlenA (lpString="*.ppt") returned 5 [0075.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.pptx") returned 0 [0075.133] lstrlenA (lpString="*.pptx") returned 6 [0075.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.pdf") returned 0 [0075.133] lstrlenA (lpString="*.pdf") returned 5 [0075.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.mov") returned 0 [0075.133] lstrlenA (lpString="*.mov") returned 5 [0075.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.m2v") returned 0 [0075.133] lstrlenA (lpString="*.m2v") returned 5 [0075.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.3gp") returned 0 [0075.133] lstrlenA (lpString="*.3gp") returned 5 [0075.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.mpeg") returned 0 [0075.133] lstrlenA (lpString="*.mpeg") returned 6 [0075.133] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.mpg") returned 0 [0075.133] lstrlenA (lpString="*.mpg") returned 5 [0075.134] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.flv") returned 0 [0075.134] lstrlenA (lpString="*.flv") returned 5 [0075.134] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.avi") returned 0 [0075.134] lstrlenA (lpString="*.avi") returned 5 [0075.134] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.mp4") returned 0 [0075.134] lstrlenA (lpString="*.mp4") returned 5 [0075.134] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.wmv") returned 0 [0075.134] lstrlenA (lpString="*.wmv") returned 5 [0075.134] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.divx") returned 0 [0075.134] lstrlenA (lpString="*.divx") returned 6 [0075.134] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.mkv") returned 0 [0075.134] lstrlenA (lpString="*.mkv") returned 5 [0075.134] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.mp3") returned 0 [0075.134] lstrlenA (lpString="*.mp3") returned 5 [0075.134] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.wav") returned 0 [0075.134] lstrlenA (lpString="*.wav") returned 5 [0075.134] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.flac") returned 0 [0075.134] lstrlenA (lpString="*.flac") returned 6 [0075.134] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.ape") returned 0 [0075.134] lstrlenA (lpString="*.ape") returned 5 [0075.134] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.wma") returned 0 [0075.134] lstrlenA (lpString="*.wma") returned 5 [0075.134] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.ac3") returned 0 [0075.134] lstrlenA (lpString="*.ac3") returned 5 [0075.134] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", pszSpec="*.mxf") returned 0 [0075.134] lstrlenA (lpString="*.mxf") returned 5 [0075.134] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80815880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4623, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeCZE.htm", cAlternateFileName="REE3F7~1.HTM")) returned 1 [0075.134] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0075.135] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ReadMeCZE.htm") returned -1 [0075.135] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ReadMeCZE.htm") returned -1 [0075.135] lstrcmpiA (lpString1="", lpString2="ReadMeCZE.htm") returned -1 [0075.135] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm") returned="ReadMeCT.htm" [0075.135] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0075.135] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="" [0075.135] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt" [0075.135] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\how to decrypt files.txt")) returned 0x20 [0075.135] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\", lpString2="ReadMeCZE.htm" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm" [0075.135] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.zip") returned 0 [0075.135] lstrlenA (lpString="*.zip") returned 5 [0075.135] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.rar") returned 0 [0075.135] lstrlenA (lpString="*.rar") returned 5 [0075.135] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.7z") returned 0 [0075.135] lstrlenA (lpString="*.7z") returned 4 [0075.135] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.tar") returned 0 [0075.135] lstrlenA (lpString="*.tar") returned 5 [0075.135] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.gzip") returned 0 [0075.135] lstrlenA (lpString="*.gzip") returned 6 [0075.135] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.jpg") returned 0 [0075.135] lstrlenA (lpString="*.jpg") returned 5 [0075.135] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.jpeg") returned 0 [0075.135] lstrlenA (lpString="*.jpeg") returned 6 [0075.135] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.psd") returned 0 [0075.135] lstrlenA (lpString="*.psd") returned 5 [0075.135] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.gif") returned 0 [0075.135] lstrlenA (lpString="*.gif") returned 5 [0075.135] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.doc") returned 0 [0075.135] lstrlenA (lpString="*.doc") returned 5 [0075.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.docx") returned 0 [0075.136] lstrlenA (lpString="*.docx") returned 6 [0075.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.xls") returned 0 [0075.136] lstrlenA (lpString="*.xls") returned 5 [0075.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.xlsx") returned 0 [0075.136] lstrlenA (lpString="*.xlsx") returned 6 [0075.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.ppt") returned 0 [0075.136] lstrlenA (lpString="*.ppt") returned 5 [0075.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.pptx") returned 0 [0075.136] lstrlenA (lpString="*.pptx") returned 6 [0075.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.pdf") returned 0 [0075.136] lstrlenA (lpString="*.pdf") returned 5 [0075.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.mov") returned 0 [0075.136] lstrlenA (lpString="*.mov") returned 5 [0075.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.m2v") returned 0 [0075.136] lstrlenA (lpString="*.m2v") returned 5 [0075.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.3gp") returned 0 [0075.136] lstrlenA (lpString="*.3gp") returned 5 [0075.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.mpeg") returned 0 [0075.136] lstrlenA (lpString="*.mpeg") returned 6 [0075.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.mpg") returned 0 [0075.136] lstrlenA (lpString="*.mpg") returned 5 [0075.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.flv") returned 0 [0075.136] lstrlenA (lpString="*.flv") returned 5 [0075.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.avi") returned 0 [0075.136] lstrlenA (lpString="*.avi") returned 5 [0075.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.mp4") returned 0 [0075.136] lstrlenA (lpString="*.mp4") returned 5 [0075.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.wmv") returned 0 [0075.136] lstrlenA (lpString="*.wmv") returned 5 [0075.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.divx") returned 0 [0075.136] lstrlenA (lpString="*.divx") returned 6 [0075.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.mkv") returned 0 [0075.136] lstrlenA (lpString="*.mkv") returned 5 [0075.136] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.mp3") returned 0 [0075.136] lstrlenA (lpString="*.mp3") returned 5 [0075.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.wav") returned 0 [0075.137] lstrlenA (lpString="*.wav") returned 5 [0075.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.flac") returned 0 [0075.137] lstrlenA (lpString="*.flac") returned 6 [0075.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.ape") returned 0 [0075.137] lstrlenA (lpString="*.ape") returned 5 [0075.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.wma") returned 0 [0075.137] lstrlenA (lpString="*.wma") returned 5 [0075.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.ac3") returned 0 [0075.137] lstrlenA (lpString="*.ac3") returned 5 [0075.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", pszSpec="*.mxf") returned 0 [0075.137] lstrlenA (lpString="*.mxf") returned 5 [0075.137] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80861b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x42aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeHRV.htm", cAlternateFileName="RE2D2E~1.HTM")) returned 1 [0075.137] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0075.137] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ReadMeHRV.htm") returned -1 [0075.137] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ReadMeHRV.htm") returned -1 [0075.137] lstrcmpiA (lpString1="", lpString2="ReadMeHRV.htm") returned -1 [0075.137] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm") returned="ReadMeCZE.htm" [0075.137] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0075.137] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="" [0075.137] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt" [0075.137] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\how to decrypt files.txt")) returned 0x20 [0075.137] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\", lpString2="ReadMeHRV.htm" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm" [0075.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.zip") returned 0 [0075.137] lstrlenA (lpString="*.zip") returned 5 [0075.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.rar") returned 0 [0075.137] lstrlenA (lpString="*.rar") returned 5 [0075.137] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.7z") returned 0 [0075.138] lstrlenA (lpString="*.7z") returned 4 [0075.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.tar") returned 0 [0075.138] lstrlenA (lpString="*.tar") returned 5 [0075.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.gzip") returned 0 [0075.138] lstrlenA (lpString="*.gzip") returned 6 [0075.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.jpg") returned 0 [0075.138] lstrlenA (lpString="*.jpg") returned 5 [0075.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.jpeg") returned 0 [0075.138] lstrlenA (lpString="*.jpeg") returned 6 [0075.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.psd") returned 0 [0075.138] lstrlenA (lpString="*.psd") returned 5 [0075.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.gif") returned 0 [0075.138] lstrlenA (lpString="*.gif") returned 5 [0075.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.doc") returned 0 [0075.138] lstrlenA (lpString="*.doc") returned 5 [0075.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.docx") returned 0 [0075.138] lstrlenA (lpString="*.docx") returned 6 [0075.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.xls") returned 0 [0075.138] lstrlenA (lpString="*.xls") returned 5 [0075.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.xlsx") returned 0 [0075.138] lstrlenA (lpString="*.xlsx") returned 6 [0075.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.ppt") returned 0 [0075.138] lstrlenA (lpString="*.ppt") returned 5 [0075.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.pptx") returned 0 [0075.138] lstrlenA (lpString="*.pptx") returned 6 [0075.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.pdf") returned 0 [0075.138] lstrlenA (lpString="*.pdf") returned 5 [0075.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.mov") returned 0 [0075.138] lstrlenA (lpString="*.mov") returned 5 [0075.138] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.m2v") returned 0 [0075.139] lstrlenA (lpString="*.m2v") returned 5 [0075.139] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.3gp") returned 0 [0075.139] lstrlenA (lpString="*.3gp") returned 5 [0075.139] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.mpeg") returned 0 [0075.139] lstrlenA (lpString="*.mpeg") returned 6 [0075.139] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.mpg") returned 0 [0075.139] lstrlenA (lpString="*.mpg") returned 5 [0075.139] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.flv") returned 0 [0075.139] lstrlenA (lpString="*.flv") returned 5 [0075.139] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.avi") returned 0 [0075.139] lstrlenA (lpString="*.avi") returned 5 [0075.139] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.mp4") returned 0 [0075.139] lstrlenA (lpString="*.mp4") returned 5 [0075.139] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.wmv") returned 0 [0075.139] lstrlenA (lpString="*.wmv") returned 5 [0075.139] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.divx") returned 0 [0075.139] lstrlenA (lpString="*.divx") returned 6 [0075.139] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.mkv") returned 0 [0075.139] lstrlenA (lpString="*.mkv") returned 5 [0075.139] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.mp3") returned 0 [0075.139] lstrlenA (lpString="*.mp3") returned 5 [0075.139] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.wav") returned 0 [0075.139] lstrlenA (lpString="*.wav") returned 5 [0075.139] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.flac") returned 0 [0075.139] lstrlenA (lpString="*.flac") returned 6 [0075.139] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.ape") returned 0 [0075.139] lstrlenA (lpString="*.ape") returned 5 [0075.139] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.wma") returned 0 [0075.139] lstrlenA (lpString="*.wma") returned 5 [0075.139] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.ac3") returned 0 [0075.140] lstrlenA (lpString="*.ac3") returned 5 [0075.140] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", pszSpec="*.mxf") returned 0 [0075.140] lstrlenA (lpString="*.mxf") returned 5 [0075.140] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4274, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeHUN.htm", cAlternateFileName="RE50AF~1.HTM")) returned 1 [0075.140] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0075.140] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ReadMeHUN.htm") returned -1 [0075.140] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ReadMeHUN.htm") returned -1 [0075.140] lstrcmpiA (lpString1="", lpString2="ReadMeHUN.htm") returned -1 [0075.140] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm") returned="ReadMeHRV.htm" [0075.140] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0075.140] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="" [0075.140] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt" [0075.140] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\how to decrypt files.txt")) returned 0x20 [0075.140] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\", lpString2="ReadMeHUN.htm" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm" [0075.140] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm", pszSpec="*.zip") returned 0 [0075.140] lstrlenA (lpString="*.zip") returned 5 [0075.140] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm", pszSpec="*.rar") returned 0 [0075.140] lstrlenA (lpString="*.rar") returned 5 [0075.140] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm", pszSpec="*.7z") returned 0 [0075.140] lstrlenA (lpString="*.7z") returned 4 [0075.140] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm", pszSpec="*.tar") returned 0 [0075.140] lstrlenA (lpString="*.tar") returned 5 [0075.140] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm", pszSpec="*.gzip") returned 0 [0075.140] lstrlenA (lpString="*.gzip") returned 6 [0075.140] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm", pszSpec="*.jpg") returned 0 [0075.141] lstrlenA (lpString="*.jpg") returned 5 [0075.141] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm", pszSpec="*.jpeg") returned 0 [0075.141] lstrlenA (lpString="*.jpeg") returned 6 [0075.141] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm", pszSpec="*.psd") returned 0 [0075.141] lstrlenA (lpString="*.psd") returned 5 [0075.141] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm", pszSpec="*.gif") returned 0 [0075.141] lstrlenA (lpString="*.gif") returned 5 [0075.141] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm", pszSpec="*.doc") returned 0 [0075.141] lstrlenA (lpString="*.doc") returned 5 [0075.141] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm", pszSpec="*.docx") returned 0 [0075.141] lstrlenA (lpString="*.docx") returned 6 [0075.141] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeJ.htm", cAlternateFileName="")) returned 1 [0075.141] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0075.141] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ReadMeJ.htm") returned -1 [0075.141] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ReadMeJ.htm") returned -1 [0075.141] lstrcmpiA (lpString1="", lpString2="ReadMeJ.htm") returned -1 [0075.141] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm") returned="ReadMeHUN.htm" [0075.141] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0075.141] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="" [0075.142] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt" [0075.142] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\how to decrypt files.txt")) returned 0x20 [0075.142] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\", lpString2="ReadMeJ.htm" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm" [0075.142] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeK.htm", cAlternateFileName="")) returned 1 [0075.142] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0075.142] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ReadMeK.htm") returned -1 [0075.142] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ReadMeK.htm") returned -1 [0075.142] lstrcmpiA (lpString1="", lpString2="ReadMeK.htm") returned -1 [0075.142] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm") returned="ReadMeJ.htm" [0075.142] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0075.142] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="" [0075.142] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt" [0075.142] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\how to decrypt files.txt")) returned 0x20 [0075.142] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\", lpString2="ReadMeK.htm" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm" [0075.142] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4444, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMePOL.htm", cAlternateFileName="RECE99~1.HTM")) returned 1 [0075.142] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0075.142] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ReadMePOL.htm") returned -1 [0075.142] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ReadMePOL.htm") returned -1 [0075.142] lstrcmpiA (lpString1="", lpString2="ReadMePOL.htm") returned -1 [0075.142] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm") returned="ReadMeK.htm" [0075.143] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0075.143] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="" [0075.143] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt" [0075.143] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\how to decrypt files.txt")) returned 0x20 [0075.143] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\", lpString2="ReadMePOL.htm" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm" [0075.143] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4318, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeRUM.htm", cAlternateFileName="README~4.HTM")) returned 1 [0075.143] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0075.143] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ReadMeRUM.htm") returned -1 [0075.143] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ReadMeRUM.htm") returned -1 [0075.143] lstrcmpiA (lpString1="", lpString2="ReadMeRUM.htm") returned -1 [0075.143] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm") returned="ReadMePOL.htm" [0075.143] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0075.143] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="" [0075.143] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt" [0075.143] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\how to decrypt files.txt")) returned 0x20 [0075.143] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\", lpString2="ReadMeRUM.htm" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm" [0075.143] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4872, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeRUS.htm", cAlternateFileName="README~3.HTM")) returned 1 [0075.143] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0075.143] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ReadMeRUS.htm") returned -1 [0075.143] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ReadMeRUS.htm") returned -1 [0075.143] lstrcmpiA (lpString1="", lpString2="ReadMeRUS.htm") returned -1 [0075.144] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm") returned="ReadMeRUM.htm" [0075.144] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0075.144] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="" [0075.144] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt" [0075.144] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\how to decrypt files.txt")) returned 0x20 [0075.144] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\", lpString2="ReadMeRUS.htm" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm" [0075.144] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeSKY.htm", cAlternateFileName="README~2.HTM")) returned 1 [0075.144] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0075.144] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ReadMeSKY.htm") returned -1 [0075.144] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ReadMeSKY.htm") returned -1 [0075.144] lstrcmpiA (lpString1="", lpString2="ReadMeSKY.htm") returned -1 [0075.144] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm") returned="ReadMeRUS.htm" [0075.144] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0075.144] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="" [0075.144] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt" [0075.144] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\how to decrypt files.txt")) returned 0x20 [0075.144] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\", lpString2="ReadMeSKY.htm" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm" [0075.144] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4995, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeUKR.htm", cAlternateFileName="README~1.HTM")) returned 1 [0075.144] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0075.144] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ReadMeUKR.htm") returned -1 [0075.144] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ReadMeUKR.htm") returned -1 [0075.144] lstrcmpiA (lpString1="", lpString2="ReadMeUKR.htm") returned -1 [0075.144] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm") returned="ReadMeSKY.htm" [0075.145] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0075.145] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="" [0075.145] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt" [0075.145] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\how to decrypt files.txt")) returned 0x20 [0075.145] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\", lpString2="ReadMeUKR.htm" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm" [0075.145] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resource", cAlternateFileName="")) returned 1 [0075.145] lstrcmpA (lpString1=".", lpString2="Resource") returned -1 [0075.145] lstrcmpA (lpString1="..", lpString2="Resource") returned -1 [0075.145] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm") returned="ReadMeUKR.htm" [0075.145] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\", lpString2="Resource" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" [0075.145] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2df442, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0075.148] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.148] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0075.148] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.148] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.148] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f934f00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80163aa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80163aa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="CIDFont", cAlternateFileName="")) returned 1 [0075.149] lstrcmpA (lpString1=".", lpString2="CIDFont") returned -1 [0075.149] lstrcmpA (lpString1="..", lpString2="CIDFont") returned -1 [0075.149] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\*.*") returned="*.*" [0075.149] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\", lpString2="CIDFont" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" [0075.149] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f934f00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80163aa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80163aa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df3c0, dwReserved1=0x2df3bb, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.151] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.151] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f934f00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80163aa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80163aa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0075.151] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.152] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.152] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53e434, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeFanHeitiStd-Bold.otf", cAlternateFileName="ADOBEF~1.OTF")) returned 1 [0075.152] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.152] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeFanHeitiStd-Bold.otf") returned 1 [0075.152] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeFanHeitiStd-Bold.otf") returned 1 [0075.152] lstrcmpiA (lpString1="", lpString2="AdobeFanHeitiStd-Bold.otf") returned -1 [0075.152] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\*.*") returned="*.*" [0075.152] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" [0075.152] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="" [0075.152] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\HOW TO DECRYPT FILES.txt" [0075.152] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\how to decrypt files.txt")) returned 0xffffffff [0075.152] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0075.157] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.157] CloseHandle (hObject=0x90) returned 1 [0075.157] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\", lpString2="AdobeFanHeitiStd-Bold.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeFanHeitiStd-Bold.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeFanHeitiStd-Bold.otf" [0075.157] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c0638, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeGothicStd-Bold.otf", cAlternateFileName="ADOBEG~1.OTF")) returned 1 [0075.157] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.157] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeGothicStd-Bold.otf") returned 1 [0075.157] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeGothicStd-Bold.otf") returned 1 [0075.157] lstrcmpiA (lpString1="", lpString2="AdobeGothicStd-Bold.otf") returned -1 [0075.157] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeFanHeitiStd-Bold.otf") returned="AdobeFanHeitiStd-Bold.otf" [0075.157] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" [0075.157] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="" [0075.157] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\HOW TO DECRYPT FILES.txt" [0075.157] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\how to decrypt files.txt")) returned 0x20 [0075.157] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\", lpString2="AdobeGothicStd-Bold.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeGothicStd-Bold.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeGothicStd-Bold.otf" [0075.158] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fd132c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbb27d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeHeitiStd-Regular.otf", cAlternateFileName="ADOBEH~1.OTF")) returned 1 [0075.158] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.158] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeHeitiStd-Regular.otf") returned 1 [0075.158] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeHeitiStd-Regular.otf") returned 1 [0075.158] lstrcmpiA (lpString1="", lpString2="AdobeHeitiStd-Regular.otf") returned -1 [0075.158] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeGothicStd-Bold.otf") returned="AdobeGothicStd-Bold.otf" [0075.158] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" [0075.158] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="" [0075.158] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\HOW TO DECRYPT FILES.txt" [0075.158] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\how to decrypt files.txt")) returned 0x20 [0075.158] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\", lpString2="AdobeHeitiStd-Regular.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeHeitiStd-Regular.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeHeitiStd-Regular.otf" [0075.158] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8013d940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9b3508, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeMingStd-Light.otf", cAlternateFileName="ADOBEM~2.OTF")) returned 1 [0075.158] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.158] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeMingStd-Light.otf") returned 1 [0075.158] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeMingStd-Light.otf") returned 1 [0075.158] lstrcmpiA (lpString1="", lpString2="AdobeMingStd-Light.otf") returned -1 [0075.158] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeHeitiStd-Regular.otf") returned="AdobeHeitiStd-Regular.otf" [0075.158] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" [0075.158] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="" [0075.159] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\HOW TO DECRYPT FILES.txt" [0075.159] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\how to decrypt files.txt")) returned 0x20 [0075.159] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\", lpString2="AdobeMingStd-Light.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMingStd-Light.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMingStd-Light.otf" [0075.159] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb4a240, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e93f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeMyungjoStd-Medium.otf", cAlternateFileName="ADOBEM~1.OTF")) returned 1 [0075.159] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.159] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeMyungjoStd-Medium.otf") returned 1 [0075.159] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeMyungjoStd-Medium.otf") returned 1 [0075.159] lstrcmpiA (lpString1="", lpString2="AdobeMyungjoStd-Medium.otf") returned -1 [0075.159] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMingStd-Light.otf") returned="AdobeMingStd-Light.otf" [0075.159] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" [0075.159] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="" [0075.159] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\HOW TO DECRYPT FILES.txt" [0075.159] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\how to decrypt files.txt")) returned 0x20 [0075.159] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\", lpString2="AdobeMyungjoStd-Medium.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMyungjoStd-Medium.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMyungjoStd-Medium.otf" [0075.159] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe69f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xedd564, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeSongStd-Light.otf", cAlternateFileName="ADOBES~1.OTF")) returned 1 [0075.159] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.159] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeSongStd-Light.otf") returned 1 [0075.159] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeSongStd-Light.otf") returned 1 [0075.160] lstrcmpiA (lpString1="", lpString2="AdobeSongStd-Light.otf") returned -1 [0075.160] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMyungjoStd-Medium.otf") returned="AdobeMyungjoStd-Medium.otf" [0075.160] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" [0075.160] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="" [0075.160] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\HOW TO DECRYPT FILES.txt" [0075.160] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\how to decrypt files.txt")) returned 0x20 [0075.160] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\", lpString2="AdobeSongStd-Light.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeSongStd-Light.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeSongStd-Light.otf" [0075.160] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f9a7320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53e91c, dwReserved0=0x0, dwReserved1=0x0, cFileName="KozGoPr6N-Medium.otf", cAlternateFileName="KOZGOP~1.OTF")) returned 1 [0075.160] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.160] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="KozGoPr6N-Medium.otf") returned -1 [0075.160] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="KozGoPr6N-Medium.otf") returned -1 [0075.160] lstrcmpiA (lpString1="", lpString2="KozGoPr6N-Medium.otf") returned -1 [0075.160] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeSongStd-Light.otf") returned="AdobeSongStd-Light.otf" [0075.160] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" [0075.160] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="" [0075.160] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\HOW TO DECRYPT FILES.txt" [0075.160] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\how to decrypt files.txt")) returned 0x20 [0075.160] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\", lpString2="KozGoPr6N-Medium.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozGoPr6N-Medium.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozGoPr6N-Medium.otf" [0075.161] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa3f8a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7c205c, dwReserved0=0x0, dwReserved1=0x0, cFileName="KozMinPr6N-Regular.otf", cAlternateFileName="KOZMIN~1.OTF")) returned 1 [0075.161] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.161] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="KozMinPr6N-Regular.otf") returned -1 [0075.161] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="KozMinPr6N-Regular.otf") returned -1 [0075.161] lstrcmpiA (lpString1="", lpString2="KozMinPr6N-Regular.otf") returned -1 [0075.161] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozGoPr6N-Medium.otf") returned="KozGoPr6N-Medium.otf" [0075.161] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" [0075.161] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="" [0075.161] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\HOW TO DECRYPT FILES.txt" [0075.161] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\how to decrypt files.txt")) returned 0x20 [0075.161] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\", lpString2="KozMinPr6N-Regular.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozMinPr6N-Regular.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozMinPr6N-Regular.otf" [0075.161] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa3f8a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7c205c, dwReserved0=0x0, dwReserved1=0x0, cFileName="KozMinPr6N-Regular.otf", cAlternateFileName="KOZMIN~1.OTF")) returned 0 [0075.161] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.161] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x800a53c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="CMap", cAlternateFileName="")) returned 1 [0075.161] lstrcmpA (lpString1=".", lpString2="CMap") returned -1 [0075.161] lstrcmpA (lpString1="..", lpString2="CMap") returned -1 [0075.161] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\*.*") returned="*.*" [0075.161] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\", lpString2="CMap" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0075.161] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x800a53c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.166] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.166] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x800a53c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.174] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.174] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.174] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d27, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="83pv-RKSJ-H", cAlternateFileName="83PV-R~1")) returned 1 [0075.174] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.174] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="83pv-RKSJ-H") returned 1 [0075.174] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="83pv-RKSJ-H") returned 1 [0075.174] lstrcmpiA (lpString1="", lpString2="83pv-RKSJ-H") returned -1 [0075.174] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\*.*") returned="*.*" [0075.174] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.175] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.175] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.175] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.176] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.176] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.176] CloseHandle (hObject=0xffffffff) returned 0 [0075.176] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="83pv-RKSJ-H" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\83pv-RKSJ-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\83pv-RKSJ-H" [0075.177] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="90ms-RKSJ-H", cAlternateFileName="90MS-R~1")) returned 1 [0075.177] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.177] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="90ms-RKSJ-H") returned 1 [0075.177] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="90ms-RKSJ-H") returned 1 [0075.177] lstrcmpiA (lpString1="", lpString2="90ms-RKSJ-H") returned -1 [0075.177] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\83pv-RKSJ-H") returned="83pv-RKSJ-H" [0075.177] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.177] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.177] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.177] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.177] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.177] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.177] CloseHandle (hObject=0xffffffff) returned 0 [0075.177] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="90ms-RKSJ-H" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-H" [0075.178] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b5fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="90ms-RKSJ-UCS2", cAlternateFileName="90MS-R~2")) returned 1 [0075.178] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.178] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="90ms-RKSJ-UCS2") returned 1 [0075.178] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="90ms-RKSJ-UCS2") returned 1 [0075.178] lstrcmpiA (lpString1="", lpString2="90ms-RKSJ-UCS2") returned -1 [0075.178] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-H") returned="90ms-RKSJ-H" [0075.178] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.178] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.178] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.178] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.178] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.178] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.178] CloseHandle (hObject=0xffffffff) returned 0 [0075.178] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="90ms-RKSJ-UCS2" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-UCS2" [0075.179] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1166, dwReserved0=0x0, dwReserved1=0x0, cFileName="90ms-RKSJ-V", cAlternateFileName="90MS-R~3")) returned 1 [0075.179] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.179] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="90ms-RKSJ-V") returned 1 [0075.179] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="90ms-RKSJ-V") returned 1 [0075.179] lstrcmpiA (lpString1="", lpString2="90ms-RKSJ-V") returned -1 [0075.179] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-UCS2") returned="90ms-RKSJ-UCS2" [0075.179] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.179] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.179] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.179] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.179] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.179] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.179] CloseHandle (hObject=0xffffffff) returned 0 [0075.179] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="90ms-RKSJ-V" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-V" [0075.180] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="90msp-RKSJ-H", cAlternateFileName="90MSP-~1")) returned 1 [0075.180] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.180] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="90msp-RKSJ-H") returned 1 [0075.180] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="90msp-RKSJ-H") returned 1 [0075.180] lstrcmpiA (lpString1="", lpString2="90msp-RKSJ-H") returned -1 [0075.180] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-V") returned="90ms-RKSJ-V" [0075.180] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.180] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.180] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.180] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.180] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.180] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.180] CloseHandle (hObject=0xffffffff) returned 0 [0075.180] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="90msp-RKSJ-H" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-H" [0075.181] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1154, dwReserved0=0x0, dwReserved1=0x0, cFileName="90msp-RKSJ-V", cAlternateFileName="90MSP-~2")) returned 1 [0075.181] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.181] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="90msp-RKSJ-V") returned 1 [0075.181] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="90msp-RKSJ-V") returned 1 [0075.181] lstrcmpiA (lpString1="", lpString2="90msp-RKSJ-V") returned -1 [0075.181] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-H") returned="90msp-RKSJ-H" [0075.181] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.181] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.181] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.181] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.181] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.181] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.181] CloseHandle (hObject=0xffffffff) returned 0 [0075.181] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="90msp-RKSJ-V" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-V" [0075.181] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x202f, dwReserved0=0x0, dwReserved1=0x0, cFileName="90pv-RKSJ-H", cAlternateFileName="90PV-R~1")) returned 1 [0075.181] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.182] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="90pv-RKSJ-H") returned 1 [0075.182] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="90pv-RKSJ-H") returned 1 [0075.182] lstrcmpiA (lpString1="", lpString2="90pv-RKSJ-H") returned -1 [0075.182] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-V") returned="90msp-RKSJ-V" [0075.182] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.182] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.182] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.182] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.182] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.182] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.182] CloseHandle (hObject=0xffffffff) returned 0 [0075.182] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="90pv-RKSJ-H" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-H" [0075.182] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x73e, dwReserved0=0x0, dwReserved1=0x0, cFileName="90pv-RKSJ-UCS2", cAlternateFileName="90PV-R~2")) returned 1 [0075.182] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.183] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="90pv-RKSJ-UCS2") returned 1 [0075.183] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="90pv-RKSJ-UCS2") returned 1 [0075.183] lstrcmpiA (lpString1="", lpString2="90pv-RKSJ-UCS2") returned -1 [0075.183] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-H") returned="90pv-RKSJ-H" [0075.183] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.183] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.183] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.183] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.183] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.183] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.183] CloseHandle (hObject=0xffffffff) returned 0 [0075.183] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="90pv-RKSJ-UCS2" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2" [0075.183] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x190bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="90pv-RKSJ-UCS2C", cAlternateFileName="90PV-R~3")) returned 1 [0075.183] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.183] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="90pv-RKSJ-UCS2C") returned 1 [0075.184] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="90pv-RKSJ-UCS2C") returned 1 [0075.184] lstrcmpiA (lpString1="", lpString2="90pv-RKSJ-UCS2C") returned -1 [0075.184] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2") returned="90pv-RKSJ-UCS2" [0075.184] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.184] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.184] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.184] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.184] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.184] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.184] CloseHandle (hObject=0xffffffff) returned 0 [0075.184] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="90pv-RKSJ-UCS2C" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2C") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2C" [0075.184] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3de5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Add-RKSJ-H", cAlternateFileName="ADD-RK~1")) returned 1 [0075.184] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.184] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Add-RKSJ-H") returned 1 [0075.184] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Add-RKSJ-H") returned 1 [0075.184] lstrcmpiA (lpString1="", lpString2="Add-RKSJ-H") returned -1 [0075.185] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2C") returned="90pv-RKSJ-UCS2C" [0075.185] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.185] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.185] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.185] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.185] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.185] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.185] CloseHandle (hObject=0xffffffff) returned 0 [0075.185] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Add-RKSJ-H" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-H" [0075.185] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Add-RKSJ-V", cAlternateFileName="ADD-RK~2")) returned 1 [0075.185] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.185] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Add-RKSJ-V") returned 1 [0075.185] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Add-RKSJ-V") returned 1 [0075.185] lstrcmpiA (lpString1="", lpString2="Add-RKSJ-V") returned -1 [0075.185] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-H") returned="Add-RKSJ-H" [0075.186] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.186] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.186] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.186] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.186] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.186] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.186] CloseHandle (hObject=0xffffffff) returned 0 [0075.186] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Add-RKSJ-V" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-V" [0075.186] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-0", cAlternateFileName="ADFD7E~1")) returned 1 [0075.186] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.186] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-CNS1-0") returned 1 [0075.186] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-CNS1-0") returned 1 [0075.186] lstrcmpiA (lpString1="", lpString2="Adobe-CNS1-0") returned -1 [0075.187] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-V") returned="Add-RKSJ-V" [0075.187] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.187] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.187] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.187] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.187] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.187] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.187] CloseHandle (hObject=0xffffffff) returned 0 [0075.187] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-CNS1-0" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-0" [0075.187] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x107a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-1", cAlternateFileName="AD1410~1")) returned 1 [0075.187] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.187] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-CNS1-1") returned 1 [0075.187] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-CNS1-1") returned 1 [0075.187] lstrcmpiA (lpString1="", lpString2="Adobe-CNS1-1") returned -1 [0075.187] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-0") returned="Adobe-CNS1-0" [0075.188] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.188] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.188] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.188] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.188] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.188] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.188] CloseHandle (hObject=0xffffffff) returned 0 [0075.188] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-CNS1-1" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-1") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-1" [0075.188] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x108f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-2", cAlternateFileName="ADC905~1")) returned 1 [0075.188] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.188] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-CNS1-2") returned 1 [0075.188] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-CNS1-2") returned 1 [0075.188] lstrcmpiA (lpString1="", lpString2="Adobe-CNS1-2") returned -1 [0075.188] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-1") returned="Adobe-CNS1-1" [0075.188] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.189] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.189] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.189] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.189] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.189] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.189] CloseHandle (hObject=0xffffffff) returned 0 [0075.189] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-CNS1-2" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-2" [0075.189] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-3", cAlternateFileName="AD7FF9~1")) returned 1 [0075.189] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.189] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-CNS1-3") returned 1 [0075.189] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-CNS1-3") returned 1 [0075.189] lstrcmpiA (lpString1="", lpString2="Adobe-CNS1-3") returned -1 [0075.189] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-2") returned="Adobe-CNS1-2" [0075.189] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.189] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.190] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.190] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.190] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.190] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.190] CloseHandle (hObject=0xffffffff) returned 0 [0075.190] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-CNS1-3" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-3") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-3" [0075.190] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x110d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-4", cAlternateFileName="ADEA01~1")) returned 1 [0075.190] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.190] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-CNS1-4") returned 1 [0075.190] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-CNS1-4") returned 1 [0075.190] lstrcmpiA (lpString1="", lpString2="Adobe-CNS1-4") returned -1 [0075.190] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-3") returned="Adobe-CNS1-3" [0075.190] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.190] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.190] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.191] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.191] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.191] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.191] CloseHandle (hObject=0xffffffff) returned 0 [0075.191] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-CNS1-4" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-4") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-4" [0075.191] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x110d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-5", cAlternateFileName="AD351C~1")) returned 1 [0075.191] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.191] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-CNS1-5") returned 1 [0075.191] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-CNS1-5") returned 1 [0075.191] lstrcmpiA (lpString1="", lpString2="Adobe-CNS1-5") returned -1 [0075.191] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-4") returned="Adobe-CNS1-4" [0075.191] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.191] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.191] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.192] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.192] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.192] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.192] CloseHandle (hObject=0xffffffff) returned 0 [0075.192] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-CNS1-5" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-5") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-5" [0075.192] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f13, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-B5pc", cAlternateFileName="ADOBE-~1")) returned 1 [0075.192] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.192] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-CNS1-B5pc") returned 1 [0075.192] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-CNS1-B5pc") returned 1 [0075.192] lstrcmpiA (lpString1="", lpString2="Adobe-CNS1-B5pc") returned -1 [0075.192] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-5") returned="Adobe-CNS1-5" [0075.192] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.192] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.192] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.192] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.193] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.193] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.193] CloseHandle (hObject=0xffffffff) returned 0 [0075.193] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-CNS1-B5pc" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-B5pc") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-B5pc" [0075.193] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-ETen-B5", cAlternateFileName="ADOBE-~2")) returned 1 [0075.193] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.193] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-CNS1-ETen-B5") returned 1 [0075.193] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-CNS1-ETen-B5") returned 1 [0075.193] lstrcmpiA (lpString1="", lpString2="Adobe-CNS1-ETen-B5") returned -1 [0075.193] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-B5pc") returned="Adobe-CNS1-B5pc" [0075.193] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.193] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.193] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.193] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.194] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.194] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.194] CloseHandle (hObject=0xffffffff) returned 0 [0075.194] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-CNS1-ETen-B5" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-ETen-B5") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-ETen-B5" [0075.194] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-H-CID", cAlternateFileName="ADOBE-~3")) returned 1 [0075.194] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.194] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-CNS1-H-CID") returned 1 [0075.194] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-CNS1-H-CID") returned 1 [0075.194] lstrcmpiA (lpString1="", lpString2="Adobe-CNS1-H-CID") returned -1 [0075.194] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-ETen-B5") returned="Adobe-CNS1-ETen-B5" [0075.194] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.194] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.194] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.194] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.195] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.195] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.195] CloseHandle (hObject=0xffffffff) returned 0 [0075.195] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-CNS1-H-CID" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-CID") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-CID" [0075.195] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x212a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-H-Host", cAlternateFileName="ADOBE-~4")) returned 1 [0075.195] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.195] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-CNS1-H-Host") returned 1 [0075.195] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-CNS1-H-Host") returned 1 [0075.195] lstrcmpiA (lpString1="", lpString2="Adobe-CNS1-H-Host") returned -1 [0075.195] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-CID") returned="Adobe-CNS1-H-CID" [0075.195] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.195] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.195] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.195] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.195] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.196] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.196] CloseHandle (hObject=0xffffffff) returned 0 [0075.196] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-CNS1-H-Host" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Host") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Host" [0075.196] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f56, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-H-Mac", cAlternateFileName="AD9A15~1")) returned 1 [0075.196] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.196] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-CNS1-H-Mac") returned 1 [0075.196] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-CNS1-H-Mac") returned 1 [0075.196] lstrcmpiA (lpString1="", lpString2="Adobe-CNS1-H-Mac") returned -1 [0075.196] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Host") returned="Adobe-CNS1-H-Host" [0075.196] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.196] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.196] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.196] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.196] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.197] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.197] CloseHandle (hObject=0xffffffff) returned 0 [0075.197] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-CNS1-H-Mac" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Mac") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Mac" [0075.197] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x44cc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-UCS2", cAlternateFileName="ADD444~1")) returned 1 [0075.197] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.197] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-CNS1-UCS2") returned 1 [0075.197] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-CNS1-UCS2") returned 1 [0075.197] lstrcmpiA (lpString1="", lpString2="Adobe-CNS1-UCS2") returned -1 [0075.197] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Mac") returned="Adobe-CNS1-H-Mac" [0075.197] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.197] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.197] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.197] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.197] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.198] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.198] CloseHandle (hObject=0xffffffff) returned 0 [0075.198] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-CNS1-UCS2" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-UCS2" [0075.198] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-0", cAlternateFileName="ADD8F8~1")) returned 1 [0075.198] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.198] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-GB1-0") returned 1 [0075.198] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-GB1-0") returned 1 [0075.198] lstrcmpiA (lpString1="", lpString2="Adobe-GB1-0") returned -1 [0075.198] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-UCS2") returned="Adobe-CNS1-UCS2" [0075.198] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.198] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.198] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.198] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.198] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.199] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.199] CloseHandle (hObject=0xffffffff) returned 0 [0075.199] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-GB1-0" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-0" [0075.199] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe32, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-1", cAlternateFileName="AD9B16~1")) returned 1 [0075.199] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.199] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-GB1-1") returned 1 [0075.199] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-GB1-1") returned 1 [0075.199] lstrcmpiA (lpString1="", lpString2="Adobe-GB1-1") returned -1 [0075.199] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-0") returned="Adobe-GB1-0" [0075.199] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.199] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.199] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.199] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.199] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.200] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.200] CloseHandle (hObject=0xffffffff) returned 0 [0075.200] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-GB1-1" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-1") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-1" [0075.200] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-2", cAlternateFileName="AD411B~1")) returned 1 [0075.200] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.200] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-GB1-2") returned 1 [0075.200] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-GB1-2") returned 1 [0075.200] lstrcmpiA (lpString1="", lpString2="Adobe-GB1-2") returned -1 [0075.200] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-1") returned="Adobe-GB1-1" [0075.200] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.200] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.200] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.200] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.200] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.201] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.201] CloseHandle (hObject=0xffffffff) returned 0 [0075.201] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-GB1-2" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-2" [0075.201] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x121b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-3", cAlternateFileName="ADF600~1")) returned 1 [0075.201] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.201] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-GB1-3") returned 1 [0075.201] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-GB1-3") returned 1 [0075.201] lstrcmpiA (lpString1="", lpString2="Adobe-GB1-3") returned -1 [0075.201] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-2") returned="Adobe-GB1-2" [0075.201] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.201] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.201] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.201] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.201] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.202] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.202] CloseHandle (hObject=0xffffffff) returned 0 [0075.202] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-GB1-3" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-3") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-3" [0075.202] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1461, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-4", cAlternateFileName="AD1D91~1")) returned 1 [0075.202] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.202] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-GB1-4") returned 1 [0075.202] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-GB1-4") returned 1 [0075.202] lstrcmpiA (lpString1="", lpString2="Adobe-GB1-4") returned -1 [0075.202] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-3") returned="Adobe-GB1-3" [0075.202] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.202] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.202] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.202] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.203] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.203] WriteFile (in: hFile=0xffffffff, lpBuffer=0x2d49a0, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0075.203] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.203] CloseHandle (hObject=0xffffffff) returned 0 [0075.203] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-GB1-4" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4" [0075.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.zip") returned 0 [0075.203] lstrlenA (lpString="*.zip") returned 5 [0075.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.rar") returned 0 [0075.203] lstrlenA (lpString="*.rar") returned 5 [0075.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.7z") returned 0 [0075.203] lstrlenA (lpString="*.7z") returned 4 [0075.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.tar") returned 0 [0075.203] lstrlenA (lpString="*.tar") returned 5 [0075.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.gzip") returned 0 [0075.203] lstrlenA (lpString="*.gzip") returned 6 [0075.203] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.jpg") returned 0 [0075.203] lstrlenA (lpString="*.jpg") returned 5 [0075.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.jpeg") returned 0 [0075.204] lstrlenA (lpString="*.jpeg") returned 6 [0075.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.psd") returned 0 [0075.204] lstrlenA (lpString="*.psd") returned 5 [0075.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.gif") returned 0 [0075.204] lstrlenA (lpString="*.gif") returned 5 [0075.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.doc") returned 0 [0075.204] lstrlenA (lpString="*.doc") returned 5 [0075.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.docx") returned 0 [0075.204] lstrlenA (lpString="*.docx") returned 6 [0075.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.xls") returned 0 [0075.204] lstrlenA (lpString="*.xls") returned 5 [0075.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.xlsx") returned 0 [0075.204] lstrlenA (lpString="*.xlsx") returned 6 [0075.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.ppt") returned 0 [0075.204] lstrlenA (lpString="*.ppt") returned 5 [0075.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.pptx") returned 0 [0075.204] lstrlenA (lpString="*.pptx") returned 6 [0075.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.pdf") returned 0 [0075.204] lstrlenA (lpString="*.pdf") returned 5 [0075.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.mov") returned 0 [0075.204] lstrlenA (lpString="*.mov") returned 5 [0075.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.m2v") returned 0 [0075.204] lstrlenA (lpString="*.m2v") returned 5 [0075.204] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.3gp") returned 0 [0075.204] lstrlenA (lpString="*.3gp") returned 5 [0075.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.mpeg") returned 0 [0075.205] lstrlenA (lpString="*.mpeg") returned 6 [0075.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.mpg") returned 0 [0075.205] lstrlenA (lpString="*.mpg") returned 5 [0075.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.flv") returned 0 [0075.205] lstrlenA (lpString="*.flv") returned 5 [0075.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.avi") returned 0 [0075.205] lstrlenA (lpString="*.avi") returned 5 [0075.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.mp4") returned 0 [0075.205] lstrlenA (lpString="*.mp4") returned 5 [0075.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.wmv") returned 0 [0075.205] lstrlenA (lpString="*.wmv") returned 5 [0075.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.divx") returned 0 [0075.205] lstrlenA (lpString="*.divx") returned 6 [0075.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.mkv") returned 0 [0075.205] lstrlenA (lpString="*.mkv") returned 5 [0075.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.mp3") returned 0 [0075.205] lstrlenA (lpString="*.mp3") returned 5 [0075.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.wav") returned 0 [0075.205] lstrlenA (lpString="*.wav") returned 5 [0075.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.flac") returned 0 [0075.205] lstrlenA (lpString="*.flac") returned 6 [0075.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.ape") returned 0 [0075.205] lstrlenA (lpString="*.ape") returned 5 [0075.205] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.wma") returned 0 [0075.206] lstrlenA (lpString="*.wma") returned 5 [0075.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.ac3") returned 0 [0075.206] lstrlenA (lpString="*.ac3") returned 5 [0075.206] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", pszSpec="*.mxf") returned 0 [0075.206] lstrlenA (lpString="*.mxf") returned 5 [0075.206] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-5", cAlternateFileName="ADC296~1")) returned 1 [0075.206] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.206] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-GB1-5") returned 1 [0075.206] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-GB1-5") returned 1 [0075.206] lstrcmpiA (lpString1="", lpString2="Adobe-GB1-5") returned -1 [0075.206] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4") returned="Adobe-GB1-4" [0075.206] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.206] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.206] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.206] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.206] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.206] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0075.207] WriteFile (in: hFile=0xffffffff, lpBuffer=0x2d49a0, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0075.207] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.207] CloseHandle (hObject=0xffffffff) returned 0 [0075.207] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-GB1-5" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5" [0075.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.zip") returned 0 [0075.207] lstrlenA (lpString="*.zip") returned 5 [0075.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.rar") returned 0 [0075.207] lstrlenA (lpString="*.rar") returned 5 [0075.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.7z") returned 0 [0075.207] lstrlenA (lpString="*.7z") returned 4 [0075.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.tar") returned 0 [0075.207] lstrlenA (lpString="*.tar") returned 5 [0075.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.gzip") returned 0 [0075.207] lstrlenA (lpString="*.gzip") returned 6 [0075.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.jpg") returned 0 [0075.207] lstrlenA (lpString="*.jpg") returned 5 [0075.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.jpeg") returned 0 [0075.207] lstrlenA (lpString="*.jpeg") returned 6 [0075.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.psd") returned 0 [0075.207] lstrlenA (lpString="*.psd") returned 5 [0075.207] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.gif") returned 0 [0075.208] lstrlenA (lpString="*.gif") returned 5 [0075.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.doc") returned 0 [0075.208] lstrlenA (lpString="*.doc") returned 5 [0075.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.docx") returned 0 [0075.208] lstrlenA (lpString="*.docx") returned 6 [0075.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.xls") returned 0 [0075.208] lstrlenA (lpString="*.xls") returned 5 [0075.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.xlsx") returned 0 [0075.208] lstrlenA (lpString="*.xlsx") returned 6 [0075.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.ppt") returned 0 [0075.208] lstrlenA (lpString="*.ppt") returned 5 [0075.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.pptx") returned 0 [0075.208] lstrlenA (lpString="*.pptx") returned 6 [0075.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.pdf") returned 0 [0075.208] lstrlenA (lpString="*.pdf") returned 5 [0075.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.mov") returned 0 [0075.208] lstrlenA (lpString="*.mov") returned 5 [0075.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.m2v") returned 0 [0075.208] lstrlenA (lpString="*.m2v") returned 5 [0075.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.3gp") returned 0 [0075.208] lstrlenA (lpString="*.3gp") returned 5 [0075.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.mpeg") returned 0 [0075.208] lstrlenA (lpString="*.mpeg") returned 6 [0075.208] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.mpg") returned 0 [0075.208] lstrlenA (lpString="*.mpg") returned 5 [0075.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.flv") returned 0 [0075.209] lstrlenA (lpString="*.flv") returned 5 [0075.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.avi") returned 0 [0075.209] lstrlenA (lpString="*.avi") returned 5 [0075.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.mp4") returned 0 [0075.209] lstrlenA (lpString="*.mp4") returned 5 [0075.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.wmv") returned 0 [0075.209] lstrlenA (lpString="*.wmv") returned 5 [0075.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.divx") returned 0 [0075.209] lstrlenA (lpString="*.divx") returned 6 [0075.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.mkv") returned 0 [0075.209] lstrlenA (lpString="*.mkv") returned 5 [0075.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.mp3") returned 0 [0075.209] lstrlenA (lpString="*.mp3") returned 5 [0075.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.wav") returned 0 [0075.209] lstrlenA (lpString="*.wav") returned 5 [0075.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.flac") returned 0 [0075.209] lstrlenA (lpString="*.flac") returned 6 [0075.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.ape") returned 0 [0075.209] lstrlenA (lpString="*.ape") returned 5 [0075.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.wma") returned 0 [0075.209] lstrlenA (lpString="*.wma") returned 5 [0075.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.ac3") returned 0 [0075.209] lstrlenA (lpString="*.ac3") returned 5 [0075.209] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", pszSpec="*.mxf") returned 0 [0075.210] lstrlenA (lpString="*.mxf") returned 5 [0075.210] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x16e86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-GBK-EUC", cAlternateFileName="ADFBCB~1")) returned 1 [0075.210] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.210] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-GB1-GBK-EUC") returned 1 [0075.210] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-GB1-GBK-EUC") returned 1 [0075.210] lstrcmpiA (lpString1="", lpString2="Adobe-GB1-GBK-EUC") returned -1 [0075.210] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5") returned="Adobe-GB1-5" [0075.210] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.210] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.210] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.210] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.210] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.210] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0075.210] WriteFile (in: hFile=0xffffffff, lpBuffer=0x2d49a0, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0075.210] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.211] CloseHandle (hObject=0xffffffff) returned 0 [0075.211] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-GB1-GBK-EUC" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC" [0075.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.zip") returned 0 [0075.211] lstrlenA (lpString="*.zip") returned 5 [0075.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.rar") returned 0 [0075.211] lstrlenA (lpString="*.rar") returned 5 [0075.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.7z") returned 0 [0075.211] lstrlenA (lpString="*.7z") returned 4 [0075.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.tar") returned 0 [0075.211] lstrlenA (lpString="*.tar") returned 5 [0075.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.gzip") returned 0 [0075.211] lstrlenA (lpString="*.gzip") returned 6 [0075.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.jpg") returned 0 [0075.211] lstrlenA (lpString="*.jpg") returned 5 [0075.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.jpeg") returned 0 [0075.211] lstrlenA (lpString="*.jpeg") returned 6 [0075.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.psd") returned 0 [0075.211] lstrlenA (lpString="*.psd") returned 5 [0075.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.gif") returned 0 [0075.211] lstrlenA (lpString="*.gif") returned 5 [0075.211] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.doc") returned 0 [0075.211] lstrlenA (lpString="*.doc") returned 5 [0075.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.docx") returned 0 [0075.212] lstrlenA (lpString="*.docx") returned 6 [0075.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.xls") returned 0 [0075.212] lstrlenA (lpString="*.xls") returned 5 [0075.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.xlsx") returned 0 [0075.212] lstrlenA (lpString="*.xlsx") returned 6 [0075.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.ppt") returned 0 [0075.212] lstrlenA (lpString="*.ppt") returned 5 [0075.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.pptx") returned 0 [0075.212] lstrlenA (lpString="*.pptx") returned 6 [0075.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.pdf") returned 0 [0075.212] lstrlenA (lpString="*.pdf") returned 5 [0075.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.mov") returned 0 [0075.212] lstrlenA (lpString="*.mov") returned 5 [0075.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.m2v") returned 0 [0075.212] lstrlenA (lpString="*.m2v") returned 5 [0075.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.3gp") returned 0 [0075.212] lstrlenA (lpString="*.3gp") returned 5 [0075.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.mpeg") returned 0 [0075.212] lstrlenA (lpString="*.mpeg") returned 6 [0075.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.mpg") returned 0 [0075.212] lstrlenA (lpString="*.mpg") returned 5 [0075.212] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.flv") returned 0 [0075.212] lstrlenA (lpString="*.flv") returned 5 [0075.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.avi") returned 0 [0075.213] lstrlenA (lpString="*.avi") returned 5 [0075.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.mp4") returned 0 [0075.213] lstrlenA (lpString="*.mp4") returned 5 [0075.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.wmv") returned 0 [0075.213] lstrlenA (lpString="*.wmv") returned 5 [0075.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.divx") returned 0 [0075.213] lstrlenA (lpString="*.divx") returned 6 [0075.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.mkv") returned 0 [0075.213] lstrlenA (lpString="*.mkv") returned 5 [0075.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.mp3") returned 0 [0075.213] lstrlenA (lpString="*.mp3") returned 5 [0075.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.wav") returned 0 [0075.213] lstrlenA (lpString="*.wav") returned 5 [0075.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.flac") returned 0 [0075.213] lstrlenA (lpString="*.flac") returned 6 [0075.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.ape") returned 0 [0075.213] lstrlenA (lpString="*.ape") returned 5 [0075.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.wma") returned 0 [0075.213] lstrlenA (lpString="*.wma") returned 5 [0075.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.ac3") returned 0 [0075.213] lstrlenA (lpString="*.ac3") returned 5 [0075.213] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", pszSpec="*.mxf") returned 0 [0075.213] lstrlenA (lpString="*.mxf") returned 5 [0075.214] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1082, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-GBpc-EUC", cAlternateFileName="AD2E3A~1")) returned 1 [0075.214] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.214] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-GB1-GBpc-EUC") returned 1 [0075.214] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-GB1-GBpc-EUC") returned 1 [0075.214] lstrcmpiA (lpString1="", lpString2="Adobe-GB1-GBpc-EUC") returned -1 [0075.214] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC") returned="Adobe-GB1-GBK-EUC" [0075.214] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.214] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.214] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.214] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.214] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.214] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0075.214] WriteFile (in: hFile=0xffffffff, lpBuffer=0x2d49a0, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0075.214] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.215] CloseHandle (hObject=0xffffffff) returned 0 [0075.215] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-GB1-GBpc-EUC" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC" [0075.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.zip") returned 0 [0075.215] lstrlenA (lpString="*.zip") returned 5 [0075.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.rar") returned 0 [0075.215] lstrlenA (lpString="*.rar") returned 5 [0075.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.7z") returned 0 [0075.215] lstrlenA (lpString="*.7z") returned 4 [0075.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.tar") returned 0 [0075.215] lstrlenA (lpString="*.tar") returned 5 [0075.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.gzip") returned 0 [0075.215] lstrlenA (lpString="*.gzip") returned 6 [0075.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.jpg") returned 0 [0075.215] lstrlenA (lpString="*.jpg") returned 5 [0075.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.jpeg") returned 0 [0075.215] lstrlenA (lpString="*.jpeg") returned 6 [0075.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.psd") returned 0 [0075.215] lstrlenA (lpString="*.psd") returned 5 [0075.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.gif") returned 0 [0075.215] lstrlenA (lpString="*.gif") returned 5 [0075.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.doc") returned 0 [0075.215] lstrlenA (lpString="*.doc") returned 5 [0075.215] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.docx") returned 0 [0075.215] lstrlenA (lpString="*.docx") returned 6 [0075.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.xls") returned 0 [0075.216] lstrlenA (lpString="*.xls") returned 5 [0075.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.xlsx") returned 0 [0075.216] lstrlenA (lpString="*.xlsx") returned 6 [0075.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.ppt") returned 0 [0075.216] lstrlenA (lpString="*.ppt") returned 5 [0075.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.pptx") returned 0 [0075.216] lstrlenA (lpString="*.pptx") returned 6 [0075.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.pdf") returned 0 [0075.216] lstrlenA (lpString="*.pdf") returned 5 [0075.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.mov") returned 0 [0075.216] lstrlenA (lpString="*.mov") returned 5 [0075.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.m2v") returned 0 [0075.216] lstrlenA (lpString="*.m2v") returned 5 [0075.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.3gp") returned 0 [0075.216] lstrlenA (lpString="*.3gp") returned 5 [0075.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.mpeg") returned 0 [0075.216] lstrlenA (lpString="*.mpeg") returned 6 [0075.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.mpg") returned 0 [0075.216] lstrlenA (lpString="*.mpg") returned 5 [0075.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.flv") returned 0 [0075.216] lstrlenA (lpString="*.flv") returned 5 [0075.216] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.avi") returned 0 [0075.216] lstrlenA (lpString="*.avi") returned 5 [0075.217] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.mp4") returned 0 [0075.217] lstrlenA (lpString="*.mp4") returned 5 [0075.217] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.wmv") returned 0 [0075.217] lstrlenA (lpString="*.wmv") returned 5 [0075.217] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.divx") returned 0 [0075.217] lstrlenA (lpString="*.divx") returned 6 [0075.217] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.mkv") returned 0 [0075.217] lstrlenA (lpString="*.mkv") returned 5 [0075.217] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.mp3") returned 0 [0075.217] lstrlenA (lpString="*.mp3") returned 5 [0075.217] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.wav") returned 0 [0075.217] lstrlenA (lpString="*.wav") returned 5 [0075.217] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.flac") returned 0 [0075.217] lstrlenA (lpString="*.flac") returned 6 [0075.217] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.ape") returned 0 [0075.217] lstrlenA (lpString="*.ape") returned 5 [0075.217] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.wma") returned 0 [0075.217] lstrlenA (lpString="*.wma") returned 5 [0075.217] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.ac3") returned 0 [0075.217] lstrlenA (lpString="*.ac3") returned 5 [0075.217] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", pszSpec="*.mxf") returned 0 [0075.217] lstrlenA (lpString="*.mxf") returned 5 [0075.217] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x82c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-H-CID", cAlternateFileName="AD43DF~1")) returned 1 [0075.217] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.218] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-GB1-H-CID") returned 1 [0075.218] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-GB1-H-CID") returned 1 [0075.218] lstrcmpiA (lpString1="", lpString2="Adobe-GB1-H-CID") returned -1 [0075.219] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC") returned="Adobe-GB1-GBpc-EUC" [0075.219] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.219] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.219] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.219] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.219] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.219] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0075.219] WriteFile (in: hFile=0xffffffff, lpBuffer=0x2d49a0, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0075.219] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.219] CloseHandle (hObject=0xffffffff) returned 0 [0075.219] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-GB1-H-CID" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID" [0075.219] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.zip") returned 0 [0075.219] lstrlenA (lpString="*.zip") returned 5 [0075.219] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.rar") returned 0 [0075.219] lstrlenA (lpString="*.rar") returned 5 [0075.220] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.7z") returned 0 [0075.220] lstrlenA (lpString="*.7z") returned 4 [0075.220] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.tar") returned 0 [0075.220] lstrlenA (lpString="*.tar") returned 5 [0075.220] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.gzip") returned 0 [0075.220] lstrlenA (lpString="*.gzip") returned 6 [0075.220] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.jpg") returned 0 [0075.220] lstrlenA (lpString="*.jpg") returned 5 [0075.220] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.jpeg") returned 0 [0075.220] lstrlenA (lpString="*.jpeg") returned 6 [0075.220] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.psd") returned 0 [0075.220] lstrlenA (lpString="*.psd") returned 5 [0075.220] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.gif") returned 0 [0075.220] lstrlenA (lpString="*.gif") returned 5 [0075.220] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.doc") returned 0 [0075.220] lstrlenA (lpString="*.doc") returned 5 [0075.220] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.docx") returned 0 [0075.220] lstrlenA (lpString="*.docx") returned 6 [0075.220] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.xls") returned 0 [0075.220] lstrlenA (lpString="*.xls") returned 5 [0075.220] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.xlsx") returned 0 [0075.220] lstrlenA (lpString="*.xlsx") returned 6 [0075.220] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.ppt") returned 0 [0075.220] lstrlenA (lpString="*.ppt") returned 5 [0075.220] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.pptx") returned 0 [0075.220] lstrlenA (lpString="*.pptx") returned 6 [0075.221] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.pdf") returned 0 [0075.221] lstrlenA (lpString="*.pdf") returned 5 [0075.221] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.mov") returned 0 [0075.221] lstrlenA (lpString="*.mov") returned 5 [0075.221] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.m2v") returned 0 [0075.221] lstrlenA (lpString="*.m2v") returned 5 [0075.221] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.3gp") returned 0 [0075.221] lstrlenA (lpString="*.3gp") returned 5 [0075.221] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.mpeg") returned 0 [0075.221] lstrlenA (lpString="*.mpeg") returned 6 [0075.221] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.mpg") returned 0 [0075.221] lstrlenA (lpString="*.mpg") returned 5 [0075.221] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.flv") returned 0 [0075.221] lstrlenA (lpString="*.flv") returned 5 [0075.221] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.avi") returned 0 [0075.221] lstrlenA (lpString="*.avi") returned 5 [0075.221] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.mp4") returned 0 [0075.221] lstrlenA (lpString="*.mp4") returned 5 [0075.221] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.wmv") returned 0 [0075.221] lstrlenA (lpString="*.wmv") returned 5 [0075.221] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.divx") returned 0 [0075.221] lstrlenA (lpString="*.divx") returned 6 [0075.221] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.mkv") returned 0 [0075.222] lstrlenA (lpString="*.mkv") returned 5 [0075.222] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.mp3") returned 0 [0075.222] lstrlenA (lpString="*.mp3") returned 5 [0075.222] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.wav") returned 0 [0075.222] lstrlenA (lpString="*.wav") returned 5 [0075.222] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.flac") returned 0 [0075.222] lstrlenA (lpString="*.flac") returned 6 [0075.222] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.ape") returned 0 [0075.222] lstrlenA (lpString="*.ape") returned 5 [0075.222] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.wma") returned 0 [0075.222] lstrlenA (lpString="*.wma") returned 5 [0075.222] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.ac3") returned 0 [0075.222] lstrlenA (lpString="*.ac3") returned 5 [0075.222] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", pszSpec="*.mxf") returned 0 [0075.222] lstrlenA (lpString="*.mxf") returned 5 [0075.222] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x170e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-H-Host", cAlternateFileName="AD3180~1")) returned 1 [0075.223] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.224] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-GB1-H-Host") returned 1 [0075.224] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-GB1-H-Host") returned 1 [0075.224] lstrcmpiA (lpString1="", lpString2="Adobe-GB1-H-Host") returned -1 [0075.224] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID") returned="Adobe-GB1-H-CID" [0075.224] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.224] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.224] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.224] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.224] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.224] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0075.224] WriteFile (in: hFile=0xffffffff, lpBuffer=0x2d49a0, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0075.224] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.224] CloseHandle (hObject=0xffffffff) returned 0 [0075.224] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-GB1-H-Host" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host" [0075.224] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.zip") returned 0 [0075.225] lstrlenA (lpString="*.zip") returned 5 [0075.225] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.rar") returned 0 [0075.225] lstrlenA (lpString="*.rar") returned 5 [0075.225] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.7z") returned 0 [0075.225] lstrlenA (lpString="*.7z") returned 4 [0075.225] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.tar") returned 0 [0075.225] lstrlenA (lpString="*.tar") returned 5 [0075.225] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.gzip") returned 0 [0075.225] lstrlenA (lpString="*.gzip") returned 6 [0075.225] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.jpg") returned 0 [0075.225] lstrlenA (lpString="*.jpg") returned 5 [0075.225] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.jpeg") returned 0 [0075.225] lstrlenA (lpString="*.jpeg") returned 6 [0075.225] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.psd") returned 0 [0075.225] lstrlenA (lpString="*.psd") returned 5 [0075.225] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.gif") returned 0 [0075.225] lstrlenA (lpString="*.gif") returned 5 [0075.225] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.doc") returned 0 [0075.225] lstrlenA (lpString="*.doc") returned 5 [0075.225] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.docx") returned 0 [0075.225] lstrlenA (lpString="*.docx") returned 6 [0075.225] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.xls") returned 0 [0075.225] lstrlenA (lpString="*.xls") returned 5 [0075.225] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.xlsx") returned 0 [0075.225] lstrlenA (lpString="*.xlsx") returned 6 [0075.226] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.ppt") returned 0 [0075.226] lstrlenA (lpString="*.ppt") returned 5 [0075.226] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.pptx") returned 0 [0075.226] lstrlenA (lpString="*.pptx") returned 6 [0075.226] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.pdf") returned 0 [0075.226] lstrlenA (lpString="*.pdf") returned 5 [0075.226] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.mov") returned 0 [0075.226] lstrlenA (lpString="*.mov") returned 5 [0075.226] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.m2v") returned 0 [0075.226] lstrlenA (lpString="*.m2v") returned 5 [0075.226] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.3gp") returned 0 [0075.226] lstrlenA (lpString="*.3gp") returned 5 [0075.226] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.mpeg") returned 0 [0075.226] lstrlenA (lpString="*.mpeg") returned 6 [0075.226] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.mpg") returned 0 [0075.226] lstrlenA (lpString="*.mpg") returned 5 [0075.226] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.flv") returned 0 [0075.226] lstrlenA (lpString="*.flv") returned 5 [0075.226] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.avi") returned 0 [0075.226] lstrlenA (lpString="*.avi") returned 5 [0075.226] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.mp4") returned 0 [0075.226] lstrlenA (lpString="*.mp4") returned 5 [0075.226] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.wmv") returned 0 [0075.226] lstrlenA (lpString="*.wmv") returned 5 [0075.226] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.divx") returned 0 [0075.227] lstrlenA (lpString="*.divx") returned 6 [0075.227] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.mkv") returned 0 [0075.227] lstrlenA (lpString="*.mkv") returned 5 [0075.227] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.mp3") returned 0 [0075.227] lstrlenA (lpString="*.mp3") returned 5 [0075.227] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.wav") returned 0 [0075.227] lstrlenA (lpString="*.wav") returned 5 [0075.227] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.flac") returned 0 [0075.227] lstrlenA (lpString="*.flac") returned 6 [0075.227] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.ape") returned 0 [0075.227] lstrlenA (lpString="*.ape") returned 5 [0075.227] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.wma") returned 0 [0075.227] lstrlenA (lpString="*.wma") returned 5 [0075.227] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.ac3") returned 0 [0075.227] lstrlenA (lpString="*.ac3") returned 5 [0075.227] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host", pszSpec="*.mxf") returned 0 [0075.227] lstrlenA (lpString="*.mxf") returned 5 [0075.227] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-H-Mac", cAlternateFileName="ADAB0B~1")) returned 1 [0075.227] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.227] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-GB1-H-Mac") returned 1 [0075.227] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-GB1-H-Mac") returned 1 [0075.227] lstrcmpiA (lpString1="", lpString2="Adobe-GB1-H-Mac") returned -1 [0075.227] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host") returned="Adobe-GB1-H-Host" [0075.227] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.227] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.227] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.228] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.228] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.228] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0075.228] WriteFile (in: hFile=0xffffffff, lpBuffer=0x2d49a0, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0075.228] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.228] CloseHandle (hObject=0xffffffff) returned 0 [0075.228] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-GB1-H-Mac" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac" [0075.228] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.zip") returned 0 [0075.228] lstrlenA (lpString="*.zip") returned 5 [0075.228] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.rar") returned 0 [0075.228] lstrlenA (lpString="*.rar") returned 5 [0075.228] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.7z") returned 0 [0075.228] lstrlenA (lpString="*.7z") returned 4 [0075.228] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.tar") returned 0 [0075.228] lstrlenA (lpString="*.tar") returned 5 [0075.229] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.gzip") returned 0 [0075.229] lstrlenA (lpString="*.gzip") returned 6 [0075.229] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.jpg") returned 0 [0075.229] lstrlenA (lpString="*.jpg") returned 5 [0075.229] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.jpeg") returned 0 [0075.229] lstrlenA (lpString="*.jpeg") returned 6 [0075.229] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.psd") returned 0 [0075.229] lstrlenA (lpString="*.psd") returned 5 [0075.229] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.gif") returned 0 [0075.229] lstrlenA (lpString="*.gif") returned 5 [0075.229] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.doc") returned 0 [0075.229] lstrlenA (lpString="*.doc") returned 5 [0075.229] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.docx") returned 0 [0075.229] lstrlenA (lpString="*.docx") returned 6 [0075.229] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.xls") returned 0 [0075.229] lstrlenA (lpString="*.xls") returned 5 [0075.229] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.xlsx") returned 0 [0075.229] lstrlenA (lpString="*.xlsx") returned 6 [0075.229] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.ppt") returned 0 [0075.229] lstrlenA (lpString="*.ppt") returned 5 [0075.229] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.pptx") returned 0 [0075.229] lstrlenA (lpString="*.pptx") returned 6 [0075.229] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.pdf") returned 0 [0075.229] lstrlenA (lpString="*.pdf") returned 5 [0075.229] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.mov") returned 0 [0075.229] lstrlenA (lpString="*.mov") returned 5 [0075.229] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.m2v") returned 0 [0075.230] lstrlenA (lpString="*.m2v") returned 5 [0075.230] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.3gp") returned 0 [0075.230] lstrlenA (lpString="*.3gp") returned 5 [0075.230] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.mpeg") returned 0 [0075.230] lstrlenA (lpString="*.mpeg") returned 6 [0075.230] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.mpg") returned 0 [0075.230] lstrlenA (lpString="*.mpg") returned 5 [0075.230] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.flv") returned 0 [0075.230] lstrlenA (lpString="*.flv") returned 5 [0075.230] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.avi") returned 0 [0075.230] lstrlenA (lpString="*.avi") returned 5 [0075.230] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.mp4") returned 0 [0075.230] lstrlenA (lpString="*.mp4") returned 5 [0075.230] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.wmv") returned 0 [0075.230] lstrlenA (lpString="*.wmv") returned 5 [0075.230] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.divx") returned 0 [0075.230] lstrlenA (lpString="*.divx") returned 6 [0075.230] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.mkv") returned 0 [0075.230] lstrlenA (lpString="*.mkv") returned 5 [0075.230] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.mp3") returned 0 [0075.230] lstrlenA (lpString="*.mp3") returned 5 [0075.230] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.wav") returned 0 [0075.230] lstrlenA (lpString="*.wav") returned 5 [0075.230] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.flac") returned 0 [0075.230] lstrlenA (lpString="*.flac") returned 6 [0075.231] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.ape") returned 0 [0075.231] lstrlenA (lpString="*.ape") returned 5 [0075.231] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.wma") returned 0 [0075.231] lstrlenA (lpString="*.wma") returned 5 [0075.231] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.ac3") returned 0 [0075.231] lstrlenA (lpString="*.ac3") returned 5 [0075.231] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac", pszSpec="*.mxf") returned 0 [0075.231] lstrlenA (lpString="*.mxf") returned 5 [0075.231] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3bb8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-UCS2", cAlternateFileName="AD0115~1")) returned 1 [0075.231] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.231] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-GB1-UCS2") returned 1 [0075.231] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-GB1-UCS2") returned 1 [0075.231] lstrcmpiA (lpString1="", lpString2="Adobe-GB1-UCS2") returned -1 [0075.231] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac") returned="Adobe-GB1-H-Mac" [0075.231] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.231] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.231] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.231] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.231] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.232] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0075.232] WriteFile (in: hFile=0xffffffff, lpBuffer=0x2d49a0, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0) returned 0 [0075.232] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.232] CloseHandle (hObject=0xffffffff) returned 0 [0075.232] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-GB1-UCS2" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-UCS2" [0075.232] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-UCS2", pszSpec="*.zip") returned 0 [0075.232] lstrlenA (lpString="*.zip") returned 5 [0075.232] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-UCS2", pszSpec="*.rar") returned 0 [0075.232] lstrlenA (lpString="*.rar") returned 5 [0075.232] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-UCS2", pszSpec="*.7z") returned 0 [0075.232] lstrlenA (lpString="*.7z") returned 4 [0075.232] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-UCS2", pszSpec="*.tar") returned 0 [0075.232] lstrlenA (lpString="*.tar") returned 5 [0075.232] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-UCS2", pszSpec="*.gzip") returned 0 [0075.232] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-UCS2", pszSpec="*.jpg") returned 0 [0075.232] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-UCS2", pszSpec="*.jpeg") returned 0 [0075.233] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-UCS2", pszSpec="*.psd") returned 0 [0075.233] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-UCS2", pszSpec="*.gif") returned 0 [0075.233] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-UCS2", pszSpec="*.doc") returned 0 [0075.233] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-UCS2", pszSpec="*.docx") returned 0 [0075.233] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xdc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-0", cAlternateFileName="AD276E~1")) returned 1 [0075.233] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.233] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-Japan1-0") returned 1 [0075.233] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-Japan1-0") returned 1 [0075.233] lstrcmpiA (lpString1="", lpString2="Adobe-Japan1-0") returned -1 [0075.233] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-UCS2") returned="Adobe-GB1-UCS2" [0075.233] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.233] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.233] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.234] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.234] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.234] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.234] CloseHandle (hObject=0xffffffff) returned 0 [0075.234] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-Japan1-0" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-0" [0075.234] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-1", cAlternateFileName="AD4DFF~1")) returned 1 [0075.234] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.234] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-Japan1-1") returned 1 [0075.234] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-Japan1-1") returned 1 [0075.234] lstrcmpiA (lpString1="", lpString2="Adobe-Japan1-1") returned -1 [0075.235] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-0") returned="Adobe-Japan1-0" [0075.235] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.235] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.235] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.235] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.235] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.235] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.235] CloseHandle (hObject=0xffffffff) returned 0 [0075.235] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-Japan1-1" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-1") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-1" [0075.235] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xdec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-2", cAlternateFileName="ADF2F4~1")) returned 1 [0075.235] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.235] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-Japan1-2") returned 1 [0075.235] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-Japan1-2") returned 1 [0075.235] lstrcmpiA (lpString1="", lpString2="Adobe-Japan1-2") returned -1 [0075.235] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-1") returned="Adobe-Japan1-1" [0075.235] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.235] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.235] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.235] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.236] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.236] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.236] CloseHandle (hObject=0xffffffff) returned 0 [0075.236] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-Japan1-2" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-2" [0075.236] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xdf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-3", cAlternateFileName="ADA8E9~1")) returned 1 [0075.236] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.236] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-Japan1-3") returned 1 [0075.236] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-Japan1-3") returned 1 [0075.236] lstrcmpiA (lpString1="", lpString2="Adobe-Japan1-3") returned -1 [0075.236] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-2") returned="Adobe-Japan1-2" [0075.236] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.236] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.236] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.236] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.236] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.236] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.237] CloseHandle (hObject=0xffffffff) returned 0 [0075.237] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-Japan1-3" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-3") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-3" [0075.237] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-4", cAlternateFileName="ADCE7B~1")) returned 1 [0075.237] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.237] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-Japan1-4") returned 1 [0075.237] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-Japan1-4") returned 1 [0075.237] lstrcmpiA (lpString1="", lpString2="Adobe-Japan1-4") returned -1 [0075.237] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-3") returned="Adobe-Japan1-3" [0075.237] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.237] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.237] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.237] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.237] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.237] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.237] CloseHandle (hObject=0xffffffff) returned 0 [0075.237] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-Japan1-4" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-4") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-4" [0075.237] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x117c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-5", cAlternateFileName="AD7470~1")) returned 1 [0075.237] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.237] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-Japan1-5") returned 1 [0075.237] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-Japan1-5") returned 1 [0075.238] lstrcmpiA (lpString1="", lpString2="Adobe-Japan1-5") returned -1 [0075.238] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-4") returned="Adobe-Japan1-4" [0075.238] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.238] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.238] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.238] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.238] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.238] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.238] CloseHandle (hObject=0xffffffff) returned 0 [0075.238] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-Japan1-5" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-5") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-5" [0075.238] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1263, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-6", cAlternateFileName="AD2A65~1")) returned 1 [0075.238] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.238] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-Japan1-6") returned 1 [0075.238] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-Japan1-6") returned 1 [0075.238] lstrcmpiA (lpString1="", lpString2="Adobe-Japan1-6") returned -1 [0075.238] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-5") returned="Adobe-Japan1-5" [0075.238] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.238] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.238] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.238] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.239] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.239] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.239] CloseHandle (hObject=0xffffffff) returned 0 [0075.239] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-Japan1-6" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-6") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-6" [0075.239] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-90ms-RKSJ", cAlternateFileName="AD02A2~1")) returned 1 [0075.239] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.239] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-Japan1-90ms-RKSJ") returned 1 [0075.239] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-Japan1-90ms-RKSJ") returned 1 [0075.239] lstrcmpiA (lpString1="", lpString2="Adobe-Japan1-90ms-RKSJ") returned -1 [0075.239] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-6") returned="Adobe-Japan1-6" [0075.239] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.239] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.239] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.239] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.239] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.239] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.239] CloseHandle (hObject=0xffffffff) returned 0 [0075.239] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-Japan1-90ms-RKSJ" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90ms-RKSJ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90ms-RKSJ" [0075.240] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-90pv-RKSJ", cAlternateFileName="ADE5F6~1")) returned 1 [0075.240] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.240] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-Japan1-90pv-RKSJ") returned 1 [0075.240] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-Japan1-90pv-RKSJ") returned 1 [0075.240] lstrcmpiA (lpString1="", lpString2="Adobe-Japan1-90pv-RKSJ") returned -1 [0075.240] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90ms-RKSJ") returned="Adobe-Japan1-90ms-RKSJ" [0075.240] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.240] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.240] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.240] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.240] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.240] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.240] CloseHandle (hObject=0xffffffff) returned 0 [0075.240] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-Japan1-90pv-RKSJ" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90pv-RKSJ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90pv-RKSJ" [0075.240] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-H-CID", cAlternateFileName="AD8921~1")) returned 1 [0075.240] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.240] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-Japan1-H-CID") returned 1 [0075.240] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-Japan1-H-CID") returned 1 [0075.240] lstrcmpiA (lpString1="", lpString2="Adobe-Japan1-H-CID") returned -1 [0075.240] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90pv-RKSJ") returned="Adobe-Japan1-90pv-RKSJ" [0075.240] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.240] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.240] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.241] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.241] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.241] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.241] CloseHandle (hObject=0xffffffff) returned 0 [0075.241] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-Japan1-H-CID" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-CID") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-CID" [0075.241] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x19e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-H-Host", cAlternateFileName="ADD587~1")) returned 1 [0075.241] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.241] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-Japan1-H-Host") returned 1 [0075.241] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-Japan1-H-Host") returned 1 [0075.241] lstrcmpiA (lpString1="", lpString2="Adobe-Japan1-H-Host") returned -1 [0075.241] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-CID") returned="Adobe-Japan1-H-CID" [0075.241] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.241] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.241] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.241] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.241] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.242] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.242] CloseHandle (hObject=0xffffffff) returned 0 [0075.242] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-Japan1-H-Host" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Host") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Host" [0075.242] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1574, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-H-Mac", cAlternateFileName="ADF41D~1")) returned 1 [0075.242] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.242] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-Japan1-H-Mac") returned 1 [0075.242] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-Japan1-H-Mac") returned 1 [0075.242] lstrcmpiA (lpString1="", lpString2="Adobe-Japan1-H-Mac") returned -1 [0075.242] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Host") returned="Adobe-Japan1-H-Host" [0075.242] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.242] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.242] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.242] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.242] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.242] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.242] CloseHandle (hObject=0xffffffff) returned 0 [0075.242] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-Japan1-H-Mac" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Mac") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Mac" [0075.242] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49a9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-UCS2", cAlternateFileName="AD1CC0~1")) returned 1 [0075.242] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.242] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-Japan1-UCS2") returned 1 [0075.242] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-Japan1-UCS2") returned 1 [0075.243] lstrcmpiA (lpString1="", lpString2="Adobe-Japan1-UCS2") returned -1 [0075.243] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Mac") returned="Adobe-Japan1-H-Mac" [0075.243] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.243] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.243] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.243] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.243] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.243] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.243] CloseHandle (hObject=0xffffffff) returned 0 [0075.243] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-Japan1-UCS2" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-UCS2" [0075.243] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe22, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-0", cAlternateFileName="AD0C77~1")) returned 1 [0075.243] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.243] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-Korea1-0") returned 1 [0075.243] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-Korea1-0") returned 1 [0075.243] lstrcmpiA (lpString1="", lpString2="Adobe-Korea1-0") returned -1 [0075.243] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-UCS2") returned="Adobe-Japan1-UCS2" [0075.243] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.243] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.243] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.243] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.244] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.244] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.244] CloseHandle (hObject=0xffffffff) returned 0 [0075.244] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-Korea1-0" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-0" [0075.244] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-1", cAlternateFileName="ADE5E5~1")) returned 1 [0075.244] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.244] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-Korea1-1") returned 1 [0075.244] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-Korea1-1") returned 1 [0075.244] lstrcmpiA (lpString1="", lpString2="Adobe-Korea1-1") returned -1 [0075.244] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-0") returned="Adobe-Korea1-0" [0075.244] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.244] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.244] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.244] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.244] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.244] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.244] CloseHandle (hObject=0xffffffff) returned 0 [0075.244] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-Korea1-1" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-1") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-1" [0075.245] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-2", cAlternateFileName="AD30F0~1")) returned 1 [0075.245] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.245] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-Korea1-2") returned 1 [0075.245] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-Korea1-2") returned 1 [0075.245] lstrcmpiA (lpString1="", lpString2="Adobe-Korea1-2") returned -1 [0075.245] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-1") returned="Adobe-Korea1-1" [0075.245] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.245] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.245] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.245] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.245] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.245] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.245] CloseHandle (hObject=0xffffffff) returned 0 [0075.245] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-Korea1-2" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-2" [0075.245] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x66a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-H-CID", cAlternateFileName="AD15A3~1")) returned 1 [0075.245] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.245] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-Korea1-H-CID") returned 1 [0075.245] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-Korea1-H-CID") returned 1 [0075.246] lstrcmpiA (lpString1="", lpString2="Adobe-Korea1-H-CID") returned -1 [0075.246] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-2") returned="Adobe-Korea1-2" [0075.246] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.246] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.246] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.246] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.246] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.246] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.246] CloseHandle (hObject=0xffffffff) returned 0 [0075.246] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-Korea1-H-CID" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-CID") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-CID" [0075.246] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-H-Host", cAlternateFileName="ADCDCC~1")) returned 1 [0075.246] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.246] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-Korea1-H-Host") returned 1 [0075.246] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-Korea1-H-Host") returned 1 [0075.246] lstrcmpiA (lpString1="", lpString2="Adobe-Korea1-H-Host") returned -1 [0075.246] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-CID") returned="Adobe-Korea1-H-CID" [0075.246] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.246] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.246] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.246] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.247] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.247] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.247] CloseHandle (hObject=0xffffffff) returned 0 [0075.247] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-Korea1-H-Host" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-Host") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-Host" [0075.247] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2ca3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-H-Mac", cAlternateFileName="ADF8FD~1")) returned 1 [0075.247] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.247] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-Korea1-H-Mac") returned 1 [0075.247] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-Korea1-H-Mac") returned 1 [0075.247] lstrcmpiA (lpString1="", lpString2="Adobe-Korea1-H-Mac") returned -1 [0075.247] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-Host") returned="Adobe-Korea1-H-Host" [0075.247] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.247] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.247] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.247] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.248] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.248] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.248] CloseHandle (hObject=0xffffffff) returned 0 [0075.248] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-Korea1-H-Mac" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-Mac") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-Mac" [0075.248] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3df2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-KSCms-UHC", cAlternateFileName="ADF15E~1")) returned 1 [0075.248] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.248] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-Korea1-KSCms-UHC") returned 1 [0075.248] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-Korea1-KSCms-UHC") returned 1 [0075.248] lstrcmpiA (lpString1="", lpString2="Adobe-Korea1-KSCms-UHC") returned -1 [0075.248] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-Mac") returned="Adobe-Korea1-H-Mac" [0075.248] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.248] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.248] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.248] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.248] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.248] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.249] CloseHandle (hObject=0xffffffff) returned 0 [0075.249] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-Korea1-KSCms-UHC" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-KSCms-UHC") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-KSCms-UHC" [0075.249] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2cf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-KSCpc-EUC", cAlternateFileName="AD662F~1")) returned 1 [0075.249] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.249] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-Korea1-KSCpc-EUC") returned 1 [0075.249] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-Korea1-KSCpc-EUC") returned 1 [0075.249] lstrcmpiA (lpString1="", lpString2="Adobe-Korea1-KSCpc-EUC") returned -1 [0075.249] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-KSCms-UHC") returned="Adobe-Korea1-KSCms-UHC" [0075.249] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.249] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.249] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.249] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.249] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.249] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.249] CloseHandle (hObject=0xffffffff) returned 0 [0075.250] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-Korea1-KSCpc-EUC" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-KSCpc-EUC") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-KSCpc-EUC" [0075.250] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25bda, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-UCS2", cAlternateFileName="AD8F7C~1")) returned 1 [0075.250] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.250] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="Adobe-Korea1-UCS2") returned 1 [0075.250] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe-Korea1-UCS2") returned 1 [0075.250] lstrcmpiA (lpString1="", lpString2="Adobe-Korea1-UCS2") returned -1 [0075.250] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-KSCpc-EUC") returned="Adobe-Korea1-KSCpc-EUC" [0075.250] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.250] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.250] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.250] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.250] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.250] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.250] CloseHandle (hObject=0xffffffff) returned 0 [0075.250] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Adobe-Korea1-UCS2" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-UCS2" [0075.250] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f11, dwReserved0=0x0, dwReserved1=0x0, cFileName="B5pc-H", cAlternateFileName="")) returned 1 [0075.250] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.250] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="B5pc-H") returned 1 [0075.250] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="B5pc-H") returned 1 [0075.250] lstrcmpiA (lpString1="", lpString2="B5pc-H") returned -1 [0075.250] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-UCS2") returned="Adobe-Korea1-UCS2" [0075.251] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.251] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.251] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.251] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.251] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.251] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.251] CloseHandle (hObject=0xffffffff) returned 0 [0075.251] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="B5pc-H" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-H" [0075.251] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="B5pc-UCS2", cAlternateFileName="B5PC-U~1")) returned 1 [0075.251] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.251] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="B5pc-UCS2") returned 1 [0075.251] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="B5pc-UCS2") returned 1 [0075.251] lstrcmpiA (lpString1="", lpString2="B5pc-UCS2") returned -1 [0075.251] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-H") returned="B5pc-H" [0075.251] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.251] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.251] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.251] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.251] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.252] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.252] CloseHandle (hObject=0xffffffff) returned 0 [0075.252] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="B5pc-UCS2" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2" [0075.252] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x457be, dwReserved0=0x0, dwReserved1=0x0, cFileName="B5pc-UCS2C", cAlternateFileName="B5PC-U~2")) returned 1 [0075.252] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.252] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="B5pc-UCS2C") returned 1 [0075.252] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="B5pc-UCS2C") returned 1 [0075.252] lstrcmpiA (lpString1="", lpString2="B5pc-UCS2C") returned -1 [0075.252] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2") returned="B5pc-UCS2" [0075.252] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.252] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.252] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.252] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.252] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.252] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.252] CloseHandle (hObject=0xffffffff) returned 0 [0075.252] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="B5pc-UCS2C" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2C") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2C" [0075.253] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc17, dwReserved0=0x0, dwReserved1=0x0, cFileName="B5pc-V", cAlternateFileName="")) returned 1 [0075.253] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.253] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2C") returned="B5pc-UCS2C" [0075.253] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.253] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.253] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.253] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.253] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.253] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.253] CloseHandle (hObject=0xffffffff) returned 0 [0075.253] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="B5pc-V" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-V" [0075.253] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3205, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNS-EUC-H", cAlternateFileName="CNS-EU~1")) returned 1 [0075.253] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.253] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-V") returned="B5pc-V" [0075.253] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.253] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.253] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.253] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.254] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.254] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.254] CloseHandle (hObject=0xffffffff) returned 0 [0075.254] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="CNS-EUC-H" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-H" [0075.254] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x363d, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNS-EUC-V", cAlternateFileName="CNS-EU~2")) returned 1 [0075.254] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.254] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-H") returned="CNS-EUC-H" [0075.254] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.254] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.254] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.254] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.254] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.254] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.254] CloseHandle (hObject=0xffffffff) returned 0 [0075.254] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="CNS-EUC-V" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-V" [0075.255] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1fb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETen-B5-H", cAlternateFileName="ETEN-B~1")) returned 1 [0075.256] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.256] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-V") returned="CNS-EUC-V" [0075.256] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.256] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.256] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.256] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.256] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.257] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.257] CloseHandle (hObject=0xffffffff) returned 0 [0075.257] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="ETen-B5-H" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-H" [0075.257] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x466cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETen-B5-UCS2", cAlternateFileName="ETEN-B~2")) returned 1 [0075.257] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.257] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-H") returned="ETen-B5-H" [0075.257] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.257] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.257] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.257] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.257] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.257] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.257] CloseHandle (hObject=0xffffffff) returned 0 [0075.257] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="ETen-B5-UCS2" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-UCS2" [0075.257] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETen-B5-V", cAlternateFileName="ETEN-B~3")) returned 1 [0075.257] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.257] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-UCS2") returned="ETen-B5-UCS2" [0075.257] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.257] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.258] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.258] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.258] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.258] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.258] CloseHandle (hObject=0xffffffff) returned 0 [0075.258] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="ETen-B5-V" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-V" [0075.258] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETenms-B5-H", cAlternateFileName="ETENMS~1")) returned 1 [0075.258] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.258] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-V") returned="ETen-B5-V" [0075.258] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.258] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.258] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.258] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.258] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.259] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.259] CloseHandle (hObject=0xffffffff) returned 0 [0075.259] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="ETenms-B5-H" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-H" [0075.259] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc89, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETenms-B5-V", cAlternateFileName="ETENMS~2")) returned 1 [0075.259] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.259] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-H") returned="ETenms-B5-H" [0075.259] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.259] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.259] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.259] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.259] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.259] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.259] CloseHandle (hObject=0xffffffff) returned 0 [0075.259] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="ETenms-B5-V" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-V" [0075.259] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6017, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETHK-B5-H", cAlternateFileName="ETHK-B~1")) returned 1 [0075.259] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.259] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-V") returned="ETenms-B5-V" [0075.259] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.259] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.259] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.260] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.260] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.260] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.260] CloseHandle (hObject=0xffffffff) returned 0 [0075.260] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="ETHK-B5-H" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-H" [0075.260] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETHK-B5-V", cAlternateFileName="ETHK-B~2")) returned 1 [0075.260] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.260] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-H") returned="ETHK-B5-H" [0075.260] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.260] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.260] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.260] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.260] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.260] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.260] CloseHandle (hObject=0xffffffff) returned 0 [0075.260] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="ETHK-B5-V" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-V" [0075.260] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUC-H", cAlternateFileName="")) returned 1 [0075.261] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.261] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-V") returned="ETHK-B5-V" [0075.261] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.261] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.261] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.261] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.261] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.261] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.261] CloseHandle (hObject=0xffffffff) returned 0 [0075.261] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="EUC-H" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-H" [0075.261] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd45, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUC-V", cAlternateFileName="")) returned 1 [0075.261] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.261] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-H") returned="EUC-H" [0075.261] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.261] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.261] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.261] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.261] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.262] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.262] CloseHandle (hObject=0xffffffff) returned 0 [0075.262] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="EUC-V" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-V" [0075.262] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x403c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ext-RKSJ-H", cAlternateFileName="EXT-RK~1")) returned 1 [0075.262] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.262] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-V") returned="EUC-V" [0075.262] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.262] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.262] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.262] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.262] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.262] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.262] CloseHandle (hObject=0xffffffff) returned 0 [0075.262] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Ext-RKSJ-H" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-H" [0075.262] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe53, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ext-RKSJ-V", cAlternateFileName="EXT-RK~2")) returned 1 [0075.262] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.262] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-H") returned="Ext-RKSJ-H" [0075.262] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.263] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.263] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.263] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.263] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.263] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.263] CloseHandle (hObject=0xffffffff) returned 0 [0075.263] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="Ext-RKSJ-V" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-V" [0075.263] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x123d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GB-EUC-H", cAlternateFileName="")) returned 1 [0075.263] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.263] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-V") returned="Ext-RKSJ-V" [0075.263] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.263] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.263] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.263] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.263] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.263] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.264] CloseHandle (hObject=0xffffffff) returned 0 [0075.264] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="GB-EUC-H" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-H" [0075.264] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="GB-EUC-V", cAlternateFileName="")) returned 1 [0075.264] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.264] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-H") returned="GB-EUC-H" [0075.264] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.264] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.264] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.264] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.264] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.264] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.264] CloseHandle (hObject=0xffffffff) returned 0 [0075.264] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="GB-EUC-V" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-V" [0075.264] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15594, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBK-EUC-H", cAlternateFileName="GBK-EU~1")) returned 1 [0075.264] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.264] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-V") returned="GB-EUC-V" [0075.265] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.265] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.265] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.265] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.265] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.265] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.265] CloseHandle (hObject=0xffffffff) returned 0 [0075.265] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="GBK-EUC-H" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-H" [0075.265] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x39050, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBK-EUC-UCS2", cAlternateFileName="GBK-EU~2")) returned 1 [0075.265] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.265] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-H") returned="GBK-EUC-H" [0075.265] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.265] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.265] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.265] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.265] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.266] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.266] CloseHandle (hObject=0xffffffff) returned 0 [0075.266] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="GBK-EUC-UCS2" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-UCS2" [0075.266] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBK-EUC-V", cAlternateFileName="GBK-EU~3")) returned 1 [0075.266] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.266] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-UCS2") returned="GBK-EUC-UCS2" [0075.266] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.266] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.266] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.266] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.266] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.266] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.267] CloseHandle (hObject=0xffffffff) returned 0 [0075.267] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="GBK-EUC-V" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-V" [0075.267] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17840, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBK2K-H", cAlternateFileName="")) returned 1 [0075.267] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.267] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-V") returned="GBK-EUC-V" [0075.267] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.267] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.267] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.267] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.267] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.267] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.267] CloseHandle (hObject=0xffffffff) returned 0 [0075.267] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="GBK2K-H" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-H" [0075.267] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe55, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBK2K-V", cAlternateFileName="")) returned 1 [0075.267] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.268] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-H") returned="GBK2K-H" [0075.268] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.268] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.268] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.268] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.268] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.268] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.268] CloseHandle (hObject=0xffffffff) returned 0 [0075.268] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="GBK2K-V" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-V" [0075.268] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15580, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBKp-EUC-H", cAlternateFileName="GBKP-E~1")) returned 1 [0075.268] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.269] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-V") returned="GBK2K-V" [0075.269] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.269] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.269] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.269] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.269] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.269] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.269] CloseHandle (hObject=0xffffffff) returned 0 [0075.269] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="GBKp-EUC-H" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-H" [0075.269] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBKp-EUC-V", cAlternateFileName="GBKP-E~2")) returned 1 [0075.269] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.269] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-H") returned="GBKp-EUC-H" [0075.269] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.269] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.269] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.269] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.269] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.270] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.270] CloseHandle (hObject=0xffffffff) returned 0 [0075.270] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="GBKp-EUC-V" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-V" [0075.270] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x125b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBpc-EUC-H", cAlternateFileName="GBPC-E~1")) returned 1 [0075.270] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.270] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-V") returned="GBKp-EUC-V" [0075.270] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.270] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.270] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.270] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.270] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.270] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.270] CloseHandle (hObject=0xffffffff) returned 0 [0075.270] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="GBpc-EUC-H" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-H" [0075.270] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x520, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBpc-EUC-UCS2", cAlternateFileName="GBPC-E~2")) returned 1 [0075.270] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.271] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-H") returned="GBpc-EUC-H" [0075.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.271] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.271] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.271] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.271] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.271] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.271] CloseHandle (hObject=0xffffffff) returned 0 [0075.271] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="GBpc-EUC-UCS2" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2" [0075.271] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x24296, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBpc-EUC-UCS2C", cAlternateFileName="GBPC-E~3")) returned 1 [0075.271] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.271] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2") returned="GBpc-EUC-UCS2" [0075.271] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.271] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.271] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.271] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.271] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.271] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.272] CloseHandle (hObject=0xffffffff) returned 0 [0075.272] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="GBpc-EUC-UCS2C" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2C") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2C" [0075.272] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xccf, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBpc-EUC-V", cAlternateFileName="GBPC-E~4")) returned 1 [0075.272] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.272] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2C") returned="GBpc-EUC-UCS2C" [0075.272] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.272] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.272] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.272] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.272] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.272] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.272] CloseHandle (hObject=0xffffffff) returned 0 [0075.272] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="GBpc-EUC-V" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-V" [0075.272] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc07a, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBT-EUC-H", cAlternateFileName="GBT-EU~1")) returned 1 [0075.272] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.272] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-V") returned="GBpc-EUC-V" [0075.272] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.272] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.272] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.272] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.273] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.273] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.273] CloseHandle (hObject=0xffffffff) returned 0 [0075.273] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="GBT-EUC-H" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-H" [0075.273] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xccb, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBT-EUC-V", cAlternateFileName="GBT-EU~2")) returned 1 [0075.273] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.273] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-H") returned="GBT-EUC-H" [0075.273] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.273] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.273] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.273] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.273] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.273] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.273] CloseHandle (hObject=0xffffffff) returned 0 [0075.273] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="GBT-EUC-V" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-V" [0075.274] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x145a, dwReserved0=0x0, dwReserved1=0x0, cFileName="H", cAlternateFileName="")) returned 1 [0075.274] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.274] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-V") returned="GBT-EUC-V" [0075.274] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.274] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.274] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.274] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.274] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.274] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.274] CloseHandle (hObject=0xffffffff) returned 0 [0075.274] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="H" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\H" [0075.274] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5f97, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKdla-B5-H", cAlternateFileName="HKDLA-~1")) returned 1 [0075.274] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.274] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\H") returned="H" [0075.274] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.274] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.274] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.274] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.274] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.275] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.275] CloseHandle (hObject=0xffffffff) returned 0 [0075.275] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HKdla-B5-H" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-H" [0075.275] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKdla-B5-V", cAlternateFileName="HKDLA-~2")) returned 1 [0075.275] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.275] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-H") returned="HKdla-B5-H" [0075.275] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.275] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.275] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.275] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.275] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.275] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.275] CloseHandle (hObject=0xffffffff) returned 0 [0075.275] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HKdla-B5-V" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-V" [0075.275] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x55fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKdlb-B5-H", cAlternateFileName="HKDLB-~1")) returned 1 [0075.275] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.275] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-V") returned="HKdla-B5-V" [0075.275] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.275] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.276] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.276] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.276] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.276] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.276] CloseHandle (hObject=0xffffffff) returned 0 [0075.276] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HKdlb-B5-H" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-H" [0075.276] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKdlb-B5-V", cAlternateFileName="HKDLB-~2")) returned 1 [0075.276] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.276] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-H") returned="HKdlb-B5-H" [0075.276] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.276] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.276] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.276] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.276] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.276] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.276] CloseHandle (hObject=0xffffffff) returned 0 [0075.276] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HKdlb-B5-V" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-V" [0075.277] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x386a, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKgccs-B5-H", cAlternateFileName="HKGCCS~1")) returned 1 [0075.277] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.277] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-V") returned="HKdlb-B5-V" [0075.277] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.277] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.277] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.277] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.277] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.277] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.277] CloseHandle (hObject=0xffffffff) returned 0 [0075.277] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HKgccs-B5-H" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-H" [0075.277] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc21, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKgccs-B5-V", cAlternateFileName="HKGCCS~2")) returned 1 [0075.277] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.277] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-H") returned="HKgccs-B5-H" [0075.277] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.277] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.277] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.277] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.277] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.278] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.278] CloseHandle (hObject=0xffffffff) returned 0 [0075.278] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HKgccs-B5-V" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-V" [0075.278] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x37a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKm314-B5-H", cAlternateFileName="HKM314~1")) returned 1 [0075.278] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.278] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-V") returned="HKgccs-B5-V" [0075.278] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.278] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.278] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.278] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.278] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.278] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.278] CloseHandle (hObject=0xffffffff) returned 0 [0075.278] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HKm314-B5-H" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-H" [0075.278] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc21, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKm314-B5-V", cAlternateFileName="HKM314~2")) returned 1 [0075.278] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.278] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-H") returned="HKm314-B5-H" [0075.279] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.279] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.279] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.279] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.279] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.279] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.279] CloseHandle (hObject=0xffffffff) returned 0 [0075.279] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HKm314-B5-V" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-V" [0075.279] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKm471-B5-H", cAlternateFileName="HKM471~1")) returned 1 [0075.283] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.283] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-V") returned="HKm314-B5-V" [0075.283] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.283] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.283] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.283] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.283] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.283] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.283] CloseHandle (hObject=0xffffffff) returned 0 [0075.283] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HKm471-B5-H" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-H" [0075.283] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc21, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKm471-B5-V", cAlternateFileName="HKM471~2")) returned 1 [0075.283] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.283] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-H") returned="HKm471-B5-H" [0075.283] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.284] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.284] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" [0075.284] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt")) returned 0xffffffff [0075.284] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.284] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.284] CloseHandle (hObject=0xffffffff) returned 0 [0075.284] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\", lpString2="HKm471-B5-V" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-V" [0075.284] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x604d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKscs-B5-H", cAlternateFileName="HKSCS-~1")) returned 1 [0075.284] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.284] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-V") returned="HKm471-B5-V" [0075.284] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.284] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.286] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.286] CloseHandle (hObject=0xffffffff) returned 0 [0075.286] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc30, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKscs-B5-V", cAlternateFileName="HKSCS-~2")) returned 1 [0075.286] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.286] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-H") returned="HKscs-B5-H" [0075.286] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.286] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.286] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.286] CloseHandle (hObject=0xffffffff) returned 0 [0075.287] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2024, dwReserved0=0x0, dwReserved1=0x0, cFileName="Identity-H", cAlternateFileName="IDENTI~1")) returned 1 [0075.287] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.287] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-V") returned="HKscs-B5-V" [0075.287] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.287] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.287] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.287] CloseHandle (hObject=0xffffffff) returned 0 [0075.287] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Identity-V", cAlternateFileName="IDENTI~2")) returned 1 [0075.287] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.287] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-H") returned="Identity-H" [0075.287] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.287] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.287] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.287] CloseHandle (hObject=0xffffffff) returned 0 [0075.287] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3047, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSC-EUC-H", cAlternateFileName="KSC-EU~1")) returned 1 [0075.287] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.287] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-V") returned="Identity-V" [0075.287] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.287] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.288] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.288] CloseHandle (hObject=0xffffffff) returned 0 [0075.288] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSC-EUC-V", cAlternateFileName="KSC-EU~2")) returned 1 [0075.288] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.288] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-H") returned="KSC-EUC-H" [0075.288] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.288] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.288] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.288] CloseHandle (hObject=0xffffffff) returned 0 [0075.288] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4191, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCms-UHC-H", cAlternateFileName="KSCMS-~1")) returned 1 [0075.288] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.288] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-V") returned="KSC-EUC-V" [0075.288] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.288] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.288] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.288] CloseHandle (hObject=0xffffffff) returned 0 [0075.288] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x418c, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCms-UHC-HW-H", cAlternateFileName="KSCMS-~2")) returned 1 [0075.288] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.288] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-H") returned="KSCms-UHC-H" [0075.289] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.289] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.289] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.289] CloseHandle (hObject=0xffffffff) returned 0 [0075.289] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCms-UHC-HW-V", cAlternateFileName="KSCMS-~3")) returned 1 [0075.289] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.289] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-H") returned="KSCms-UHC-HW-H" [0075.289] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.289] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.289] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.289] CloseHandle (hObject=0xffffffff) returned 0 [0075.289] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e597, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCms-UHC-UCS2", cAlternateFileName="KSCMS-~4")) returned 1 [0075.289] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.289] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-V") returned="KSCms-UHC-HW-V" [0075.289] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.289] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.289] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.289] CloseHandle (hObject=0xffffffff) returned 0 [0075.290] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCms-UHC-V", cAlternateFileName="KS3FF3~1")) returned 1 [0075.290] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.290] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-UCS2") returned="KSCms-UHC-UCS2" [0075.290] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.290] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.290] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.290] CloseHandle (hObject=0xffffffff) returned 0 [0075.290] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x33b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCpc-EUC-H", cAlternateFileName="KSCPC-~1")) returned 1 [0075.290] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.290] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-V") returned="KSCms-UHC-V" [0075.290] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.290] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.290] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.290] CloseHandle (hObject=0xffffffff) returned 0 [0075.290] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCpc-EUC-UCS2", cAlternateFileName="KSCPC-~2")) returned 1 [0075.290] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.290] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-H") returned="KSCpc-EUC-H" [0075.290] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.290] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.291] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.291] CloseHandle (hObject=0xffffffff) returned 0 [0075.291] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x26499, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCpc-EUC-UCS2C", cAlternateFileName="KSCPC-~3")) returned 1 [0075.291] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.291] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2") returned="KSCpc-EUC-UCS2" [0075.291] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.291] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.291] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.291] CloseHandle (hObject=0xffffffff) returned 0 [0075.291] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25f07, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-90ms-RKSJ", cAlternateFileName="UCS2-9~1")) returned 1 [0075.291] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.291] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2C") returned="KSCpc-EUC-UCS2C" [0075.291] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.291] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.291] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.291] CloseHandle (hObject=0xffffffff) returned 0 [0075.291] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x24373, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-90pv-RKSJ", cAlternateFileName="UCS2-9~2")) returned 1 [0075.291] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.291] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90ms-RKSJ") returned="UCS2-90ms-RKSJ" [0075.291] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.292] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.292] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.292] CloseHandle (hObject=0xffffffff) returned 0 [0075.292] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x45903, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-B5pc", cAlternateFileName="UCS2-B~1")) returned 1 [0075.292] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.292] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90pv-RKSJ") returned="UCS2-90pv-RKSJ" [0075.292] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.292] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.292] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.292] CloseHandle (hObject=0xffffffff) returned 0 [0075.292] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49113, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-ETen-B5", cAlternateFileName="UCS2-E~1")) returned 1 [0075.292] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.292] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-B5pc") returned="UCS2-B5pc" [0075.292] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.292] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.292] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.292] CloseHandle (hObject=0xffffffff) returned 0 [0075.292] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3b87b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-GBK-EUC", cAlternateFileName="UCS2-G~1")) returned 1 [0075.293] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.293] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-ETen-B5") returned="UCS2-ETen-B5" [0075.293] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.293] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.293] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.293] CloseHandle (hObject=0xffffffff) returned 0 [0075.293] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3022b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-GBpc-EUC", cAlternateFileName="UCS2-G~2")) returned 1 [0075.293] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.293] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBK-EUC") returned="UCS2-GBK-EUC" [0075.293] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.293] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.293] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.293] CloseHandle (hObject=0xffffffff) returned 0 [0075.293] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2ff61, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-KSCms-UHC", cAlternateFileName="UCS2-K~2")) returned 1 [0075.293] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.293] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBpc-EUC") returned="UCS2-GBpc-EUC" [0075.293] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.293] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.293] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.294] CloseHandle (hObject=0xffffffff) returned 0 [0075.294] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25737, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-KSCpc-EUC", cAlternateFileName="UCS2-K~1")) returned 1 [0075.294] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.294] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCms-UHC") returned="UCS2-KSCms-UHC" [0075.294] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.294] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.294] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.294] CloseHandle (hObject=0xffffffff) returned 0 [0075.294] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53d72, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniCNS-UCS2-H", cAlternateFileName="UNICNS~2")) returned 1 [0075.294] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.294] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCpc-EUC") returned="UCS2-KSCpc-EUC" [0075.294] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.294] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.294] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.294] CloseHandle (hObject=0xffffffff) returned 0 [0075.294] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniCNS-UCS2-V", cAlternateFileName="UNICNS~1")) returned 1 [0075.294] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.294] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UCS2-H") returned="UniCNS-UCS2-H" [0075.294] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.295] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.295] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.295] CloseHandle (hObject=0xffffffff) returned 0 [0075.295] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x425e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniCNS-UTF16-H", cAlternateFileName="UNICNS~4")) returned 1 [0075.295] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.295] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UCS2-V") returned="UniCNS-UCS2-V" [0075.295] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.295] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.295] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.295] CloseHandle (hObject=0xffffffff) returned 0 [0075.295] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc33, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniCNS-UTF16-V", cAlternateFileName="UNICNS~3")) returned 1 [0075.295] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.295] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-H") returned="UniCNS-UTF16-H" [0075.295] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.295] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.295] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.295] CloseHandle (hObject=0xffffffff) returned 0 [0075.296] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x46805, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniGB-UCS2-H", cAlternateFileName="UNIGB-~2")) returned 1 [0075.296] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.296] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-V") returned="UniCNS-UTF16-V" [0075.296] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.296] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.296] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.296] CloseHandle (hObject=0xffffffff) returned 0 [0075.296] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd09, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniGB-UCS2-V", cAlternateFileName="UNIGB-~1")) returned 1 [0075.296] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.296] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UCS2-H") returned="UniGB-UCS2-H" [0075.296] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.296] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.296] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.296] CloseHandle (hObject=0xffffffff) returned 0 [0075.296] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3453e, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniGB-UTF16-H", cAlternateFileName="UNIGB-~4")) returned 1 [0075.296] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.296] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UCS2-V") returned="UniGB-UCS2-V" [0075.296] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.297] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.297] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.297] CloseHandle (hObject=0xffffffff) returned 0 [0075.297] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xca2, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniGB-UTF16-V", cAlternateFileName="UNIGB-~3")) returned 1 [0075.297] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.297] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UTF16-H") returned="UniGB-UTF16-H" [0075.297] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.297] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.297] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.297] CloseHandle (hObject=0xffffffff) returned 0 [0075.297] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2b580, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UCS2-H", cAlternateFileName="UNIJIS~1")) returned 1 [0075.297] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.297] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UTF16-V") returned="UniGB-UTF16-V" [0075.297] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.297] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.297] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.297] CloseHandle (hObject=0xffffffff) returned 0 [0075.298] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UCS2-HW-H", cAlternateFileName="UNIJIS~2")) returned 1 [0075.298] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.298] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-H") returned="UniJIS-UCS2-H" [0075.298] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.298] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.298] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.298] CloseHandle (hObject=0xffffffff) returned 0 [0075.298] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UCS2-HW-V", cAlternateFileName="UNIJIS~3")) returned 1 [0075.298] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.298] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-HW-H") returned="UniJIS-UCS2-HW-H" [0075.298] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.298] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.298] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.298] CloseHandle (hObject=0xffffffff) returned 0 [0075.298] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1ac5, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UCS2-V", cAlternateFileName="UNIJIS~4")) returned 1 [0075.298] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.298] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-HW-V") returned="UniJIS-UCS2-HW-V" [0075.299] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.299] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.299] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.299] CloseHandle (hObject=0xffffffff) returned 0 [0075.299] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x315bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UTF16-H", cAlternateFileName="UN87E6~1")) returned 1 [0075.299] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.299] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-V") returned="UniJIS-UCS2-V" [0075.299] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.299] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.299] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.299] CloseHandle (hObject=0xffffffff) returned 0 [0075.299] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UTF16-V", cAlternateFileName="UN275C~1")) returned 1 [0075.299] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.299] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UTF16-H") returned="UniJIS-UTF16-H" [0075.299] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.299] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.300] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.300] CloseHandle (hObject=0xffffffff) returned 0 [0075.300] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x31610, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS2004-UTF16-H", cAlternateFileName="UN288D~1")) returned 1 [0075.300] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.300] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UTF16-V") returned="UniJIS-UTF16-V" [0075.300] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.300] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.300] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.300] CloseHandle (hObject=0xffffffff) returned 0 [0075.300] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS2004-UTF16-V", cAlternateFileName="UNC565~1")) returned 1 [0075.300] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.300] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS2004-UTF16-H") returned="UniJIS2004-UTF16-H" [0075.300] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.300] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.301] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.301] CloseHandle (hObject=0xffffffff) returned 0 [0075.301] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2aad3, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniKS-UCS2-H", cAlternateFileName="UNIKS-~4")) returned 1 [0075.301] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.301] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS2004-UTF16-V") returned="UniJIS2004-UTF16-V" [0075.301] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.301] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.301] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.301] CloseHandle (hObject=0xffffffff) returned 0 [0075.301] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniKS-UCS2-V", cAlternateFileName="UNIKS-~3")) returned 1 [0075.301] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.301] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UCS2-H") returned="UniKS-UCS2-H" [0075.301] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.301] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.301] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.301] CloseHandle (hObject=0xffffffff) returned 0 [0075.302] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2031a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniKS-UTF16-H", cAlternateFileName="UNIKS-~2")) returned 1 [0075.302] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.302] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UCS2-V") returned="UniKS-UCS2-V" [0075.302] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.302] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.302] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.302] CloseHandle (hObject=0xffffffff) returned 0 [0075.302] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniKS-UTF16-V", cAlternateFileName="UNIKS-~1")) returned 1 [0075.302] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.302] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UTF16-H") returned="UniKS-UTF16-H" [0075.302] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.302] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.302] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.302] CloseHandle (hObject=0xffffffff) returned 0 [0075.302] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="V", cAlternateFileName="")) returned 1 [0075.302] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.302] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UTF16-V") returned="UniKS-UTF16-V" [0075.302] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0075.302] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="" [0075.303] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.303] CloseHandle (hObject=0xffffffff) returned 0 [0075.303] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="V", cAlternateFileName="")) returned 0 [0075.303] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.304] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d9e, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ENUtxt.pdf", cAlternateFileName="")) returned 1 [0075.304] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0075.304] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\*.*") returned="*.*" [0075.304] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\" [0075.304] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\") returned="" [0075.307] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.307] CloseHandle (hObject=0x8c) returned 1 [0075.310] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d9e [0075.310] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4), lpLastAccessTime=0x407536*(dwLowDateTime=0x7feb61e0, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0x950fa000, dwHighDateTime=0x1cb84b4)) returned 1 [0075.310] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.310] ReadFile (in: hFile=0x8c, lpBuffer=0x2260020, nNumberOfBytesToRead=0x1e3f6d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesRead=0x40655d*=0x1d20, lpOverlapped=0x0) returned 1 [0075.312] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf") returned="ENUtxt.pdf" [0075.312] SetFilePointer (in: hFile=0x8c, lDistanceToMove=126, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7e [0075.312] WriteFile (in: hFile=0x8c, lpBuffer=0x2260020*, nNumberOfBytesToWrite=0x1d20, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2260020*, lpNumberOfBytesWritten=0x406561*=0x1d20, lpOverlapped=0x0) returned 1 [0075.313] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0075.313] CloseHandle (hObject=0x8c) returned 1 [0075.313] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\enutxt.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf.wannacry" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\enutxt.pdf.wannacry")) returned 1 [0075.314] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xde0001df, dwReserved1=0x2c00c4, cFileName="Font", cAlternateFileName="")) returned 1 [0075.314] lstrcmpA (lpString1=".", lpString2="Font") returned -1 [0075.314] lstrcmpA (lpString1="..", lpString2="Font") returned -1 [0075.314] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf") returned="ENUtxt.pdf" [0075.314] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned 54 [0075.314] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0069, dwReserved1=0x730065, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.328] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.328] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x730000, cFileName="..", cAlternateFileName="")) returned 1 [0075.333] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.333] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.333] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x835c1ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x37e7c, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AdobeArabic-Bold.otf", cAlternateFileName="ADOBEA~2.OTF")) returned 1 [0075.333] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.333] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeArabic-Bold.otf") returned 1 [0075.333] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeArabic-Bold.otf") returned 1 [0075.333] lstrcmpiA (lpString1="", lpString2="AdobeArabic-Bold.otf") returned -1 [0075.333] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\*.*") returned="*.*" [0075.333] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0075.333] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="" [0075.333] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" [0075.333] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\how to decrypt files.txt")) returned 0xffffffff [0075.333] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0075.334] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0075.334] WriteFile (in: hFile=0x90, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0075.335] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.335] CloseHandle (hObject=0x90) returned 1 [0075.335] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="AdobeArabic-Bold.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf" [0075.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.zip") returned 0 [0075.335] lstrlenA (lpString="*.zip") returned 5 [0075.335] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.rar") returned 0 [0075.335] lstrlenA (lpString="*.rar") returned 5 [0075.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.7z") returned 0 [0075.336] lstrlenA (lpString="*.7z") returned 4 [0075.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.tar") returned 0 [0075.336] lstrlenA (lpString="*.tar") returned 5 [0075.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.gzip") returned 0 [0075.336] lstrlenA (lpString="*.gzip") returned 6 [0075.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.jpg") returned 0 [0075.336] lstrlenA (lpString="*.jpg") returned 5 [0075.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.jpeg") returned 0 [0075.336] lstrlenA (lpString="*.jpeg") returned 6 [0075.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.psd") returned 0 [0075.336] lstrlenA (lpString="*.psd") returned 5 [0075.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.gif") returned 0 [0075.336] lstrlenA (lpString="*.gif") returned 5 [0075.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.doc") returned 0 [0075.336] lstrlenA (lpString="*.doc") returned 5 [0075.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.docx") returned 0 [0075.336] lstrlenA (lpString="*.docx") returned 6 [0075.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.xls") returned 0 [0075.336] lstrlenA (lpString="*.xls") returned 5 [0075.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.xlsx") returned 0 [0075.336] lstrlenA (lpString="*.xlsx") returned 6 [0075.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.ppt") returned 0 [0075.336] lstrlenA (lpString="*.ppt") returned 5 [0075.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.pptx") returned 0 [0075.336] lstrlenA (lpString="*.pptx") returned 6 [0075.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.pdf") returned 0 [0075.336] lstrlenA (lpString="*.pdf") returned 5 [0075.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.mov") returned 0 [0075.336] lstrlenA (lpString="*.mov") returned 5 [0075.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.m2v") returned 0 [0075.336] lstrlenA (lpString="*.m2v") returned 5 [0075.336] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.3gp") returned 0 [0075.337] lstrlenA (lpString="*.3gp") returned 5 [0075.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.mpeg") returned 0 [0075.337] lstrlenA (lpString="*.mpeg") returned 6 [0075.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.mpg") returned 0 [0075.337] lstrlenA (lpString="*.mpg") returned 5 [0075.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.flv") returned 0 [0075.337] lstrlenA (lpString="*.flv") returned 5 [0075.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.avi") returned 0 [0075.337] lstrlenA (lpString="*.avi") returned 5 [0075.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.mp4") returned 0 [0075.337] lstrlenA (lpString="*.mp4") returned 5 [0075.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.wmv") returned 0 [0075.337] lstrlenA (lpString="*.wmv") returned 5 [0075.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.divx") returned 0 [0075.337] lstrlenA (lpString="*.divx") returned 6 [0075.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.mkv") returned 0 [0075.337] lstrlenA (lpString="*.mkv") returned 5 [0075.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.mp3") returned 0 [0075.337] lstrlenA (lpString="*.mp3") returned 5 [0075.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.wav") returned 0 [0075.337] lstrlenA (lpString="*.wav") returned 5 [0075.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.flac") returned 0 [0075.337] lstrlenA (lpString="*.flac") returned 6 [0075.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.ape") returned 0 [0075.337] lstrlenA (lpString="*.ape") returned 5 [0075.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.wma") returned 0 [0075.337] lstrlenA (lpString="*.wma") returned 5 [0075.337] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.ac3") returned 0 [0075.338] lstrlenA (lpString="*.ac3") returned 5 [0075.338] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf", pszSpec="*.mxf") returned 0 [0075.338] lstrlenA (lpString="*.mxf") returned 5 [0075.338] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x835c1ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3d9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeArabic-BoldItalic.otf", cAlternateFileName="ADOBEA~3.OTF")) returned 1 [0075.338] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.338] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeArabic-BoldItalic.otf") returned 1 [0075.338] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeArabic-BoldItalic.otf") returned 1 [0075.338] lstrcmpiA (lpString1="", lpString2="AdobeArabic-BoldItalic.otf") returned -1 [0075.338] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf") returned="AdobeArabic-Bold.otf" [0075.338] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0075.338] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="" [0075.338] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" [0075.338] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\how to decrypt files.txt")) returned 0x20 [0075.338] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="AdobeArabic-BoldItalic.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf" [0075.338] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.zip") returned 0 [0075.338] lstrlenA (lpString="*.zip") returned 5 [0075.338] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.rar") returned 0 [0075.338] lstrlenA (lpString="*.rar") returned 5 [0075.338] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.7z") returned 0 [0075.338] lstrlenA (lpString="*.7z") returned 4 [0075.338] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.tar") returned 0 [0075.338] lstrlenA (lpString="*.tar") returned 5 [0075.338] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.gzip") returned 0 [0075.338] lstrlenA (lpString="*.gzip") returned 6 [0075.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.jpg") returned 0 [0075.339] lstrlenA (lpString="*.jpg") returned 5 [0075.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.jpeg") returned 0 [0075.339] lstrlenA (lpString="*.jpeg") returned 6 [0075.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.psd") returned 0 [0075.339] lstrlenA (lpString="*.psd") returned 5 [0075.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.gif") returned 0 [0075.339] lstrlenA (lpString="*.gif") returned 5 [0075.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.doc") returned 0 [0075.339] lstrlenA (lpString="*.doc") returned 5 [0075.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.docx") returned 0 [0075.339] lstrlenA (lpString="*.docx") returned 6 [0075.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.xls") returned 0 [0075.339] lstrlenA (lpString="*.xls") returned 5 [0075.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.xlsx") returned 0 [0075.339] lstrlenA (lpString="*.xlsx") returned 6 [0075.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.ppt") returned 0 [0075.339] lstrlenA (lpString="*.ppt") returned 5 [0075.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.pptx") returned 0 [0075.339] lstrlenA (lpString="*.pptx") returned 6 [0075.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.pdf") returned 0 [0075.339] lstrlenA (lpString="*.pdf") returned 5 [0075.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.mov") returned 0 [0075.339] lstrlenA (lpString="*.mov") returned 5 [0075.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.m2v") returned 0 [0075.339] lstrlenA (lpString="*.m2v") returned 5 [0075.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.3gp") returned 0 [0075.339] lstrlenA (lpString="*.3gp") returned 5 [0075.339] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.mpeg") returned 0 [0075.339] lstrlenA (lpString="*.mpeg") returned 6 [0075.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.mpg") returned 0 [0075.340] lstrlenA (lpString="*.mpg") returned 5 [0075.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.flv") returned 0 [0075.340] lstrlenA (lpString="*.flv") returned 5 [0075.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.avi") returned 0 [0075.340] lstrlenA (lpString="*.avi") returned 5 [0075.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.mp4") returned 0 [0075.340] lstrlenA (lpString="*.mp4") returned 5 [0075.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.wmv") returned 0 [0075.340] lstrlenA (lpString="*.wmv") returned 5 [0075.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.divx") returned 0 [0075.340] lstrlenA (lpString="*.divx") returned 6 [0075.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.mkv") returned 0 [0075.340] lstrlenA (lpString="*.mkv") returned 5 [0075.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.mp3") returned 0 [0075.340] lstrlenA (lpString="*.mp3") returned 5 [0075.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.wav") returned 0 [0075.340] lstrlenA (lpString="*.wav") returned 5 [0075.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.flac") returned 0 [0075.340] lstrlenA (lpString="*.flac") returned 6 [0075.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.ape") returned 0 [0075.340] lstrlenA (lpString="*.ape") returned 5 [0075.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.wma") returned 0 [0075.340] lstrlenA (lpString="*.wma") returned 5 [0075.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.ac3") returned 0 [0075.340] lstrlenA (lpString="*.ac3") returned 5 [0075.340] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf", pszSpec="*.mxf") returned 0 [0075.340] lstrlenA (lpString="*.mxf") returned 5 [0075.340] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8359bd40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3dce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeArabic-Italic.otf", cAlternateFileName="ADOBEA~1.OTF")) returned 1 [0075.340] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.340] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeArabic-Italic.otf") returned 1 [0075.340] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeArabic-Italic.otf") returned 1 [0075.340] lstrcmpiA (lpString1="", lpString2="AdobeArabic-Italic.otf") returned -1 [0075.340] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf") returned="AdobeArabic-BoldItalic.otf" [0075.341] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0075.341] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="" [0075.341] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" [0075.341] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\how to decrypt files.txt")) returned 0x20 [0075.341] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="AdobeArabic-Italic.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf" [0075.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.zip") returned 0 [0075.341] lstrlenA (lpString="*.zip") returned 5 [0075.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.rar") returned 0 [0075.341] lstrlenA (lpString="*.rar") returned 5 [0075.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.7z") returned 0 [0075.341] lstrlenA (lpString="*.7z") returned 4 [0075.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.tar") returned 0 [0075.341] lstrlenA (lpString="*.tar") returned 5 [0075.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.gzip") returned 0 [0075.341] lstrlenA (lpString="*.gzip") returned 6 [0075.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.jpg") returned 0 [0075.341] lstrlenA (lpString="*.jpg") returned 5 [0075.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.jpeg") returned 0 [0075.341] lstrlenA (lpString="*.jpeg") returned 6 [0075.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.psd") returned 0 [0075.341] lstrlenA (lpString="*.psd") returned 5 [0075.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.gif") returned 0 [0075.341] lstrlenA (lpString="*.gif") returned 5 [0075.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.doc") returned 0 [0075.341] lstrlenA (lpString="*.doc") returned 5 [0075.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.docx") returned 0 [0075.341] lstrlenA (lpString="*.docx") returned 6 [0075.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.xls") returned 0 [0075.341] lstrlenA (lpString="*.xls") returned 5 [0075.341] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.xlsx") returned 0 [0075.341] lstrlenA (lpString="*.xlsx") returned 6 [0075.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.ppt") returned 0 [0075.342] lstrlenA (lpString="*.ppt") returned 5 [0075.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.pptx") returned 0 [0075.342] lstrlenA (lpString="*.pptx") returned 6 [0075.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.pdf") returned 0 [0075.342] lstrlenA (lpString="*.pdf") returned 5 [0075.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.mov") returned 0 [0075.342] lstrlenA (lpString="*.mov") returned 5 [0075.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.m2v") returned 0 [0075.342] lstrlenA (lpString="*.m2v") returned 5 [0075.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.3gp") returned 0 [0075.342] lstrlenA (lpString="*.3gp") returned 5 [0075.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.mpeg") returned 0 [0075.342] lstrlenA (lpString="*.mpeg") returned 6 [0075.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.mpg") returned 0 [0075.342] lstrlenA (lpString="*.mpg") returned 5 [0075.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.flv") returned 0 [0075.342] lstrlenA (lpString="*.flv") returned 5 [0075.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.avi") returned 0 [0075.342] lstrlenA (lpString="*.avi") returned 5 [0075.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.mp4") returned 0 [0075.342] lstrlenA (lpString="*.mp4") returned 5 [0075.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.wmv") returned 0 [0075.342] lstrlenA (lpString="*.wmv") returned 5 [0075.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.divx") returned 0 [0075.342] lstrlenA (lpString="*.divx") returned 6 [0075.342] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.mkv") returned 0 [0075.342] lstrlenA (lpString="*.mkv") returned 5 [0075.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.mp3") returned 0 [0075.343] lstrlenA (lpString="*.mp3") returned 5 [0075.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.wav") returned 0 [0075.343] lstrlenA (lpString="*.wav") returned 5 [0075.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.flac") returned 0 [0075.343] lstrlenA (lpString="*.flac") returned 6 [0075.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.ape") returned 0 [0075.343] lstrlenA (lpString="*.ape") returned 5 [0075.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.wma") returned 0 [0075.343] lstrlenA (lpString="*.wma") returned 5 [0075.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.ac3") returned 0 [0075.343] lstrlenA (lpString="*.ac3") returned 5 [0075.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf", pszSpec="*.mxf") returned 0 [0075.343] lstrlenA (lpString="*.mxf") returned 5 [0075.343] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x37c34, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeArabic-Regular.otf", cAlternateFileName="ADOBEA~4.OTF")) returned 1 [0075.343] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.343] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeArabic-Regular.otf") returned 1 [0075.343] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeArabic-Regular.otf") returned 1 [0075.343] lstrcmpiA (lpString1="", lpString2="AdobeArabic-Regular.otf") returned -1 [0075.343] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf") returned="AdobeArabic-Italic.otf" [0075.343] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0075.343] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="" [0075.343] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" [0075.343] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\how to decrypt files.txt")) returned 0x20 [0075.343] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="AdobeArabic-Regular.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf" [0075.343] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.zip") returned 0 [0075.343] lstrlenA (lpString="*.zip") returned 5 [0075.344] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.rar") returned 0 [0075.344] lstrlenA (lpString="*.rar") returned 5 [0075.344] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.7z") returned 0 [0075.344] lstrlenA (lpString="*.7z") returned 4 [0075.344] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.tar") returned 0 [0075.344] lstrlenA (lpString="*.tar") returned 5 [0075.344] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.gzip") returned 0 [0075.344] lstrlenA (lpString="*.gzip") returned 6 [0075.344] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.jpg") returned 0 [0075.344] lstrlenA (lpString="*.jpg") returned 5 [0075.344] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.jpeg") returned 0 [0075.344] lstrlenA (lpString="*.jpeg") returned 6 [0075.344] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.psd") returned 0 [0075.344] lstrlenA (lpString="*.psd") returned 5 [0075.344] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.gif") returned 0 [0075.344] lstrlenA (lpString="*.gif") returned 5 [0075.344] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.doc") returned 0 [0075.344] lstrlenA (lpString="*.doc") returned 5 [0075.344] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.docx") returned 0 [0075.344] lstrlenA (lpString="*.docx") returned 6 [0075.344] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.xls") returned 0 [0075.344] lstrlenA (lpString="*.xls") returned 5 [0075.344] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.xlsx") returned 0 [0075.344] lstrlenA (lpString="*.xlsx") returned 6 [0075.344] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.ppt") returned 0 [0075.344] lstrlenA (lpString="*.ppt") returned 5 [0075.344] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.pptx") returned 0 [0075.344] lstrlenA (lpString="*.pptx") returned 6 [0075.344] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.pdf") returned 0 [0075.345] lstrlenA (lpString="*.pdf") returned 5 [0075.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.mov") returned 0 [0075.345] lstrlenA (lpString="*.mov") returned 5 [0075.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.m2v") returned 0 [0075.345] lstrlenA (lpString="*.m2v") returned 5 [0075.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.3gp") returned 0 [0075.345] lstrlenA (lpString="*.3gp") returned 5 [0075.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.mpeg") returned 0 [0075.345] lstrlenA (lpString="*.mpeg") returned 6 [0075.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.mpg") returned 0 [0075.345] lstrlenA (lpString="*.mpg") returned 5 [0075.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.flv") returned 0 [0075.345] lstrlenA (lpString="*.flv") returned 5 [0075.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.avi") returned 0 [0075.345] lstrlenA (lpString="*.avi") returned 5 [0075.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.mp4") returned 0 [0075.345] lstrlenA (lpString="*.mp4") returned 5 [0075.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.wmv") returned 0 [0075.345] lstrlenA (lpString="*.wmv") returned 5 [0075.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.divx") returned 0 [0075.345] lstrlenA (lpString="*.divx") returned 6 [0075.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.mkv") returned 0 [0075.345] lstrlenA (lpString="*.mkv") returned 5 [0075.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.mp3") returned 0 [0075.345] lstrlenA (lpString="*.mp3") returned 5 [0075.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.wav") returned 0 [0075.345] lstrlenA (lpString="*.wav") returned 5 [0075.345] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.flac") returned 0 [0075.346] lstrlenA (lpString="*.flac") returned 6 [0075.346] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.ape") returned 0 [0075.346] lstrlenA (lpString="*.ape") returned 5 [0075.346] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.wma") returned 0 [0075.346] lstrlenA (lpString="*.wma") returned 5 [0075.346] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.ac3") returned 0 [0075.346] lstrlenA (lpString="*.ac3") returned 5 [0075.346] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf", pszSpec="*.mxf") returned 0 [0075.346] lstrlenA (lpString="*.mxf") returned 5 [0075.346] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8359bd40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10e4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeHebrew-Bold.otf", cAlternateFileName="ADOBEH~4.OTF")) returned 1 [0075.346] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.346] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeHebrew-Bold.otf") returned 1 [0075.346] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeHebrew-Bold.otf") returned 1 [0075.346] lstrcmpiA (lpString1="", lpString2="AdobeHebrew-Bold.otf") returned -1 [0075.346] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf") returned="AdobeArabic-Regular.otf" [0075.346] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0075.346] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="" [0075.346] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" [0075.346] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\how to decrypt files.txt")) returned 0x20 [0075.346] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="AdobeHebrew-Bold.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf" [0075.346] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.zip") returned 0 [0075.346] lstrlenA (lpString="*.zip") returned 5 [0075.346] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.rar") returned 0 [0075.346] lstrlenA (lpString="*.rar") returned 5 [0075.346] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.7z") returned 0 [0075.346] lstrlenA (lpString="*.7z") returned 4 [0075.346] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.tar") returned 0 [0075.346] lstrlenA (lpString="*.tar") returned 5 [0075.347] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.gzip") returned 0 [0075.347] lstrlenA (lpString="*.gzip") returned 6 [0075.347] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.jpg") returned 0 [0075.347] lstrlenA (lpString="*.jpg") returned 5 [0075.347] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.jpeg") returned 0 [0075.347] lstrlenA (lpString="*.jpeg") returned 6 [0075.347] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.psd") returned 0 [0075.347] lstrlenA (lpString="*.psd") returned 5 [0075.347] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.gif") returned 0 [0075.347] lstrlenA (lpString="*.gif") returned 5 [0075.347] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.doc") returned 0 [0075.347] lstrlenA (lpString="*.doc") returned 5 [0075.347] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.docx") returned 0 [0075.347] lstrlenA (lpString="*.docx") returned 6 [0075.347] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.xls") returned 0 [0075.347] lstrlenA (lpString="*.xls") returned 5 [0075.347] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.xlsx") returned 0 [0075.347] lstrlenA (lpString="*.xlsx") returned 6 [0075.347] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.ppt") returned 0 [0075.347] lstrlenA (lpString="*.ppt") returned 5 [0075.347] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.pptx") returned 0 [0075.347] lstrlenA (lpString="*.pptx") returned 6 [0075.347] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.pdf") returned 0 [0075.347] lstrlenA (lpString="*.pdf") returned 5 [0075.347] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.mov") returned 0 [0075.347] lstrlenA (lpString="*.mov") returned 5 [0075.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.m2v") returned 0 [0075.348] lstrlenA (lpString="*.m2v") returned 5 [0075.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.3gp") returned 0 [0075.348] lstrlenA (lpString="*.3gp") returned 5 [0075.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.mpeg") returned 0 [0075.348] lstrlenA (lpString="*.mpeg") returned 6 [0075.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.mpg") returned 0 [0075.348] lstrlenA (lpString="*.mpg") returned 5 [0075.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.flv") returned 0 [0075.348] lstrlenA (lpString="*.flv") returned 5 [0075.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.avi") returned 0 [0075.348] lstrlenA (lpString="*.avi") returned 5 [0075.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.mp4") returned 0 [0075.348] lstrlenA (lpString="*.mp4") returned 5 [0075.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.wmv") returned 0 [0075.348] lstrlenA (lpString="*.wmv") returned 5 [0075.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.divx") returned 0 [0075.348] lstrlenA (lpString="*.divx") returned 6 [0075.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.mkv") returned 0 [0075.348] lstrlenA (lpString="*.mkv") returned 5 [0075.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.mp3") returned 0 [0075.348] lstrlenA (lpString="*.mp3") returned 5 [0075.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.wav") returned 0 [0075.348] lstrlenA (lpString="*.wav") returned 5 [0075.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.flac") returned 0 [0075.348] lstrlenA (lpString="*.flac") returned 6 [0075.348] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.ape") returned 0 [0075.348] lstrlenA (lpString="*.ape") returned 5 [0075.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.wma") returned 0 [0075.349] lstrlenA (lpString="*.wma") returned 5 [0075.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.ac3") returned 0 [0075.349] lstrlenA (lpString="*.ac3") returned 5 [0075.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf", pszSpec="*.mxf") returned 0 [0075.349] lstrlenA (lpString="*.mxf") returned 5 [0075.349] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83529920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11ad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeHebrew-BoldItalic.otf", cAlternateFileName="ADOBEH~1.OTF")) returned 1 [0075.349] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.349] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeHebrew-BoldItalic.otf") returned 1 [0075.349] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeHebrew-BoldItalic.otf") returned 1 [0075.349] lstrcmpiA (lpString1="", lpString2="AdobeHebrew-BoldItalic.otf") returned -1 [0075.349] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf") returned="AdobeHebrew-Bold.otf" [0075.349] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0075.349] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="" [0075.349] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" [0075.349] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\how to decrypt files.txt")) returned 0x20 [0075.349] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="AdobeHebrew-BoldItalic.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf" [0075.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.zip") returned 0 [0075.349] lstrlenA (lpString="*.zip") returned 5 [0075.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.rar") returned 0 [0075.349] lstrlenA (lpString="*.rar") returned 5 [0075.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.7z") returned 0 [0075.349] lstrlenA (lpString="*.7z") returned 4 [0075.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.tar") returned 0 [0075.349] lstrlenA (lpString="*.tar") returned 5 [0075.349] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.gzip") returned 0 [0075.349] lstrlenA (lpString="*.gzip") returned 6 [0075.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.jpg") returned 0 [0075.350] lstrlenA (lpString="*.jpg") returned 5 [0075.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.jpeg") returned 0 [0075.350] lstrlenA (lpString="*.jpeg") returned 6 [0075.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.psd") returned 0 [0075.350] lstrlenA (lpString="*.psd") returned 5 [0075.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.gif") returned 0 [0075.350] lstrlenA (lpString="*.gif") returned 5 [0075.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.doc") returned 0 [0075.350] lstrlenA (lpString="*.doc") returned 5 [0075.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.docx") returned 0 [0075.350] lstrlenA (lpString="*.docx") returned 6 [0075.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.xls") returned 0 [0075.350] lstrlenA (lpString="*.xls") returned 5 [0075.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.xlsx") returned 0 [0075.350] lstrlenA (lpString="*.xlsx") returned 6 [0075.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.ppt") returned 0 [0075.350] lstrlenA (lpString="*.ppt") returned 5 [0075.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.pptx") returned 0 [0075.350] lstrlenA (lpString="*.pptx") returned 6 [0075.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.pdf") returned 0 [0075.350] lstrlenA (lpString="*.pdf") returned 5 [0075.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.mov") returned 0 [0075.350] lstrlenA (lpString="*.mov") returned 5 [0075.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.m2v") returned 0 [0075.350] lstrlenA (lpString="*.m2v") returned 5 [0075.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.3gp") returned 0 [0075.350] lstrlenA (lpString="*.3gp") returned 5 [0075.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.mpeg") returned 0 [0075.350] lstrlenA (lpString="*.mpeg") returned 6 [0075.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.mpg") returned 0 [0075.350] lstrlenA (lpString="*.mpg") returned 5 [0075.350] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.flv") returned 0 [0075.350] lstrlenA (lpString="*.flv") returned 5 [0075.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.avi") returned 0 [0075.351] lstrlenA (lpString="*.avi") returned 5 [0075.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.mp4") returned 0 [0075.351] lstrlenA (lpString="*.mp4") returned 5 [0075.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.wmv") returned 0 [0075.351] lstrlenA (lpString="*.wmv") returned 5 [0075.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.divx") returned 0 [0075.351] lstrlenA (lpString="*.divx") returned 6 [0075.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.mkv") returned 0 [0075.351] lstrlenA (lpString="*.mkv") returned 5 [0075.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.mp3") returned 0 [0075.351] lstrlenA (lpString="*.mp3") returned 5 [0075.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.wav") returned 0 [0075.351] lstrlenA (lpString="*.wav") returned 5 [0075.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.flac") returned 0 [0075.351] lstrlenA (lpString="*.flac") returned 6 [0075.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.ape") returned 0 [0075.351] lstrlenA (lpString="*.ape") returned 5 [0075.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.wma") returned 0 [0075.351] lstrlenA (lpString="*.wma") returned 5 [0075.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.ac3") returned 0 [0075.351] lstrlenA (lpString="*.ac3") returned 5 [0075.351] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf", pszSpec="*.mxf") returned 0 [0075.351] lstrlenA (lpString="*.mxf") returned 5 [0075.351] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83575be0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11a6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeHebrew-Italic.otf", cAlternateFileName="ADOBEH~2.OTF")) returned 1 [0075.351] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.351] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeHebrew-Italic.otf") returned 1 [0075.351] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeHebrew-Italic.otf") returned 1 [0075.351] lstrcmpiA (lpString1="", lpString2="AdobeHebrew-Italic.otf") returned -1 [0075.351] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf") returned="AdobeHebrew-BoldItalic.otf" [0075.351] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0075.351] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="" [0075.351] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" [0075.352] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\how to decrypt files.txt")) returned 0x20 [0075.352] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="AdobeHebrew-Italic.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf" [0075.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.zip") returned 0 [0075.352] lstrlenA (lpString="*.zip") returned 5 [0075.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.rar") returned 0 [0075.352] lstrlenA (lpString="*.rar") returned 5 [0075.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.7z") returned 0 [0075.352] lstrlenA (lpString="*.7z") returned 4 [0075.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.tar") returned 0 [0075.352] lstrlenA (lpString="*.tar") returned 5 [0075.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.gzip") returned 0 [0075.352] lstrlenA (lpString="*.gzip") returned 6 [0075.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.jpg") returned 0 [0075.352] lstrlenA (lpString="*.jpg") returned 5 [0075.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.jpeg") returned 0 [0075.352] lstrlenA (lpString="*.jpeg") returned 6 [0075.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.psd") returned 0 [0075.352] lstrlenA (lpString="*.psd") returned 5 [0075.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.gif") returned 0 [0075.352] lstrlenA (lpString="*.gif") returned 5 [0075.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.doc") returned 0 [0075.352] lstrlenA (lpString="*.doc") returned 5 [0075.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.docx") returned 0 [0075.352] lstrlenA (lpString="*.docx") returned 6 [0075.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.xls") returned 0 [0075.352] lstrlenA (lpString="*.xls") returned 5 [0075.352] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.xlsx") returned 0 [0075.352] lstrlenA (lpString="*.xlsx") returned 6 [0075.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.ppt") returned 0 [0075.353] lstrlenA (lpString="*.ppt") returned 5 [0075.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.pptx") returned 0 [0075.353] lstrlenA (lpString="*.pptx") returned 6 [0075.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.pdf") returned 0 [0075.353] lstrlenA (lpString="*.pdf") returned 5 [0075.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.mov") returned 0 [0075.353] lstrlenA (lpString="*.mov") returned 5 [0075.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.m2v") returned 0 [0075.353] lstrlenA (lpString="*.m2v") returned 5 [0075.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.3gp") returned 0 [0075.353] lstrlenA (lpString="*.3gp") returned 5 [0075.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.mpeg") returned 0 [0075.353] lstrlenA (lpString="*.mpeg") returned 6 [0075.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.mpg") returned 0 [0075.353] lstrlenA (lpString="*.mpg") returned 5 [0075.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.flv") returned 0 [0075.353] lstrlenA (lpString="*.flv") returned 5 [0075.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.avi") returned 0 [0075.353] lstrlenA (lpString="*.avi") returned 5 [0075.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.mp4") returned 0 [0075.353] lstrlenA (lpString="*.mp4") returned 5 [0075.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.wmv") returned 0 [0075.353] lstrlenA (lpString="*.wmv") returned 5 [0075.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.divx") returned 0 [0075.353] lstrlenA (lpString="*.divx") returned 6 [0075.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.mkv") returned 0 [0075.353] lstrlenA (lpString="*.mkv") returned 5 [0075.353] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.mp3") returned 0 [0075.353] lstrlenA (lpString="*.mp3") returned 5 [0075.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.wav") returned 0 [0075.354] lstrlenA (lpString="*.wav") returned 5 [0075.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.flac") returned 0 [0075.354] lstrlenA (lpString="*.flac") returned 6 [0075.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.ape") returned 0 [0075.354] lstrlenA (lpString="*.ape") returned 5 [0075.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.wma") returned 0 [0075.354] lstrlenA (lpString="*.wma") returned 5 [0075.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.ac3") returned 0 [0075.354] lstrlenA (lpString="*.ac3") returned 5 [0075.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf", pszSpec="*.mxf") returned 0 [0075.354] lstrlenA (lpString="*.mxf") returned 5 [0075.354] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8359bd40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11380, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeHebrew-Regular.otf", cAlternateFileName="ADOBEH~3.OTF")) returned 1 [0075.354] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.354] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeHebrew-Regular.otf") returned 1 [0075.354] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeHebrew-Regular.otf") returned 1 [0075.354] lstrcmpiA (lpString1="", lpString2="AdobeHebrew-Regular.otf") returned -1 [0075.354] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf") returned="AdobeHebrew-Italic.otf" [0075.354] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0075.354] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="" [0075.354] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" [0075.354] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\how to decrypt files.txt")) returned 0x20 [0075.354] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="AdobeHebrew-Regular.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Regular.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Regular.otf" [0075.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Regular.otf", pszSpec="*.zip") returned 0 [0075.354] lstrlenA (lpString="*.zip") returned 5 [0075.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Regular.otf", pszSpec="*.rar") returned 0 [0075.354] lstrlenA (lpString="*.rar") returned 5 [0075.354] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Regular.otf", pszSpec="*.7z") returned 0 [0075.355] lstrlenA (lpString="*.7z") returned 4 [0075.355] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Regular.otf", pszSpec="*.tar") returned 0 [0075.355] lstrlenA (lpString="*.tar") returned 5 [0075.355] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Regular.otf", pszSpec="*.gzip") returned 0 [0075.355] lstrlenA (lpString="*.gzip") returned 6 [0075.355] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Regular.otf", pszSpec="*.jpg") returned 0 [0075.355] lstrlenA (lpString="*.jpg") returned 5 [0075.355] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Regular.otf", pszSpec="*.jpeg") returned 0 [0075.355] lstrlenA (lpString="*.jpeg") returned 6 [0075.355] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Regular.otf", pszSpec="*.psd") returned 0 [0075.355] lstrlenA (lpString="*.psd") returned 5 [0075.355] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Regular.otf", pszSpec="*.gif") returned 0 [0075.355] lstrlenA (lpString="*.gif") returned 5 [0075.355] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Regular.otf", pszSpec="*.doc") returned 0 [0075.355] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Regular.otf", pszSpec="*.docx") returned 0 [0075.355] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15e3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobePiStd.otf", cAlternateFileName="ADOBEP~1.OTF")) returned 1 [0075.355] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.355] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobePiStd.otf") returned 1 [0075.355] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobePiStd.otf") returned 1 [0075.355] lstrcmpiA (lpString1="", lpString2="AdobePiStd.otf") returned -1 [0075.355] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Regular.otf") returned="AdobeHebrew-Regular.otf" [0075.355] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0075.356] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="" [0075.356] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" [0075.356] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\how to decrypt files.txt")) returned 0x20 [0075.356] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="AdobePiStd.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobePiStd.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobePiStd.otf" [0075.356] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83529920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10658, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeThai-Bold.otf", cAlternateFileName="ADOBET~1.OTF")) returned 1 [0075.356] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.356] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeThai-Bold.otf") returned 1 [0075.356] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeThai-Bold.otf") returned 1 [0075.356] lstrcmpiA (lpString1="", lpString2="AdobeThai-Bold.otf") returned -1 [0075.356] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobePiStd.otf") returned="AdobePiStd.otf" [0075.356] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0075.356] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="" [0075.356] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" [0075.356] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\how to decrypt files.txt")) returned 0x20 [0075.356] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="AdobeThai-Bold.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Bold.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Bold.otf" [0075.356] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x835e8000, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x112a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeThai-BoldItalic.otf", cAlternateFileName="ADOBET~3.OTF")) returned 1 [0075.356] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.356] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeThai-BoldItalic.otf") returned 1 [0075.356] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeThai-BoldItalic.otf") returned 1 [0075.356] lstrcmpiA (lpString1="", lpString2="AdobeThai-BoldItalic.otf") returned -1 [0075.356] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Bold.otf") returned="AdobeThai-Bold.otf" [0075.356] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0075.356] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="" [0075.356] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" [0075.356] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\how to decrypt files.txt")) returned 0x20 [0075.357] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="AdobeThai-BoldItalic.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-BoldItalic.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-BoldItalic.otf" [0075.357] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x113b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeThai-Italic.otf", cAlternateFileName="ADOBET~4.OTF")) returned 1 [0075.357] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.357] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeThai-Italic.otf") returned 1 [0075.357] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeThai-Italic.otf") returned 1 [0075.357] lstrcmpiA (lpString1="", lpString2="AdobeThai-Italic.otf") returned -1 [0075.357] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-BoldItalic.otf") returned="AdobeThai-BoldItalic.otf" [0075.357] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0075.357] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="" [0075.357] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" [0075.357] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\how to decrypt files.txt")) returned 0x20 [0075.357] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="AdobeThai-Italic.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Italic.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Italic.otf" [0075.357] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x835c1ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10530, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeThai-Regular.otf", cAlternateFileName="ADOBET~2.OTF")) returned 1 [0075.357] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.357] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="AdobeThai-Regular.otf") returned 1 [0075.357] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeThai-Regular.otf") returned 1 [0075.357] lstrcmpiA (lpString1="", lpString2="AdobeThai-Regular.otf") returned -1 [0075.357] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Italic.otf") returned="AdobeThai-Italic.otf" [0075.357] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0075.357] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="" [0075.357] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" [0075.357] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\how to decrypt files.txt")) returned 0x20 [0075.357] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="AdobeThai-Regular.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Regular.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Regular.otf" [0075.358] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5a2e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8b9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="CourierStd-Bold.otf", cAlternateFileName="COURIE~3.OTF")) returned 1 [0075.358] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.358] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CourierStd-Bold.otf") returned 1 [0075.358] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CourierStd-Bold.otf") returned 1 [0075.358] lstrcmpiA (lpString1="", lpString2="CourierStd-Bold.otf") returned -1 [0075.358] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Regular.otf") returned="AdobeThai-Regular.otf" [0075.358] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0075.358] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="" [0075.358] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" [0075.376] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\how to decrypt files.txt")) returned 0x20 [0075.376] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="CourierStd-Bold.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-Bold.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-Bold.otf" [0075.376] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x90dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="CourierStd-BoldOblique.otf", cAlternateFileName="COURIE~2.OTF")) returned 1 [0075.376] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.376] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CourierStd-BoldOblique.otf") returned 1 [0075.376] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CourierStd-BoldOblique.otf") returned 1 [0075.376] lstrcmpiA (lpString1="", lpString2="CourierStd-BoldOblique.otf") returned -1 [0075.376] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-Bold.otf") returned="CourierStd-Bold.otf" [0075.376] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0075.376] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="" [0075.376] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" [0075.376] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\how to decrypt files.txt")) returned 0x20 [0075.376] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="CourierStd-BoldOblique.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-BoldOblique.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-BoldOblique.otf" [0075.376] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5a2e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9238, dwReserved0=0x0, dwReserved1=0x0, cFileName="CourierStd-Oblique.otf", cAlternateFileName="COURIE~4.OTF")) returned 1 [0075.376] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.377] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CourierStd-Oblique.otf") returned 1 [0075.377] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CourierStd-Oblique.otf") returned 1 [0075.377] lstrcmpiA (lpString1="", lpString2="CourierStd-Oblique.otf") returned -1 [0075.377] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-BoldOblique.otf") returned="CourierStd-BoldOblique.otf" [0075.377] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0075.377] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="" [0075.377] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" [0075.377] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\how to decrypt files.txt")) returned 0x20 [0075.377] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="CourierStd-Oblique.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-Oblique.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-Oblique.otf" [0075.377] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8c8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="CourierStd.otf", cAlternateFileName="COURIE~1.OTF")) returned 1 [0075.377] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.377] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="CourierStd.otf") returned 1 [0075.377] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CourierStd.otf") returned 1 [0075.377] lstrcmpiA (lpString1="", lpString2="CourierStd.otf") returned -1 [0075.377] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-Oblique.otf") returned="CourierStd-Oblique.otf" [0075.377] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0075.377] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="" [0075.377] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" [0075.377] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\how to decrypt files.txt")) returned 0x20 [0075.377] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="CourierStd.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd.otf" [0075.377] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f7b8140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x38600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MinionPro-Bold.otf", cAlternateFileName="MINION~4.OTF")) returned 1 [0075.377] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.377] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MinionPro-Bold.otf") returned -1 [0075.377] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MinionPro-Bold.otf") returned -1 [0075.377] lstrcmpiA (lpString1="", lpString2="MinionPro-Bold.otf") returned -1 [0075.377] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd.otf") returned="CourierStd.otf" [0075.378] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0075.378] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="" [0075.378] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" [0075.378] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\how to decrypt files.txt")) returned 0x20 [0075.378] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="MinionPro-Bold.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-Bold.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-Bold.otf" [0075.378] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f7b8140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43898, dwReserved0=0x0, dwReserved1=0x0, cFileName="MinionPro-BoldIt.otf", cAlternateFileName="MINION~3.OTF")) returned 1 [0075.378] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.378] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MinionPro-BoldIt.otf") returned -1 [0075.378] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MinionPro-BoldIt.otf") returned -1 [0075.378] lstrcmpiA (lpString1="", lpString2="MinionPro-BoldIt.otf") returned -1 [0075.378] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-Bold.otf") returned="MinionPro-Bold.otf" [0075.378] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0075.378] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="" [0075.378] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" [0075.378] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\how to decrypt files.txt")) returned 0x20 [0075.378] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="MinionPro-BoldIt.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-BoldIt.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-BoldIt.otf" [0075.378] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f7b8140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x436ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="MinionPro-It.otf", cAlternateFileName="MINION~2.OTF")) returned 1 [0075.378] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.378] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MinionPro-It.otf") returned -1 [0075.378] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MinionPro-It.otf") returned -1 [0075.378] lstrcmpiA (lpString1="", lpString2="MinionPro-It.otf") returned -1 [0075.378] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-BoldIt.otf") returned="MinionPro-BoldIt.otf" [0075.378] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0075.378] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="" [0075.378] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" [0075.379] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\how to decrypt files.txt")) returned 0x20 [0075.379] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="MinionPro-It.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-It.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-It.otf" [0075.379] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f615220, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x38790, dwReserved0=0x0, dwReserved1=0x0, cFileName="MinionPro-Regular.otf", cAlternateFileName="MINION~1.OTF")) returned 1 [0075.379] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.379] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MinionPro-Regular.otf") returned -1 [0075.379] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MinionPro-Regular.otf") returned -1 [0075.379] lstrcmpiA (lpString1="", lpString2="MinionPro-Regular.otf") returned -1 [0075.379] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-It.otf") returned="MinionPro-It.otf" [0075.379] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0075.379] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="" [0075.379] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" [0075.379] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\how to decrypt files.txt")) returned 0x20 [0075.379] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="MinionPro-Regular.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-Regular.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-Regular.otf" [0075.379] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5a2e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x175c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadPro-Bold.otf", cAlternateFileName="MYRIAD~3.OTF")) returned 1 [0075.379] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.379] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MyriadPro-Bold.otf") returned -1 [0075.379] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MyriadPro-Bold.otf") returned -1 [0075.379] lstrcmpiA (lpString1="", lpString2="MyriadPro-Bold.otf") returned -1 [0075.379] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-Regular.otf") returned="MinionPro-Regular.otf" [0075.379] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0075.379] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="" [0075.379] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" [0075.379] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\how to decrypt files.txt")) returned 0x20 [0075.379] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="MyriadPro-Bold.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-Bold.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-Bold.otf" [0075.379] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5a2e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1879c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadPro-BoldIt.otf", cAlternateFileName="MYRIAD~2.OTF")) returned 1 [0075.380] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.380] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MyriadPro-BoldIt.otf") returned -1 [0075.380] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MyriadPro-BoldIt.otf") returned -1 [0075.380] lstrcmpiA (lpString1="", lpString2="MyriadPro-BoldIt.otf") returned -1 [0075.380] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-Bold.otf") returned="MyriadPro-Bold.otf" [0075.380] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0075.380] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="" [0075.380] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" [0075.380] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\how to decrypt files.txt")) returned 0x20 [0075.380] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="MyriadPro-BoldIt.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-BoldIt.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-BoldIt.otf" [0075.380] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5a2e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17f10, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadPro-It.otf", cAlternateFileName="MYRIAD~1.OTF")) returned 1 [0075.380] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.380] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MyriadPro-It.otf") returned -1 [0075.380] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MyriadPro-It.otf") returned -1 [0075.380] lstrcmpiA (lpString1="", lpString2="MyriadPro-It.otf") returned -1 [0075.380] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-BoldIt.otf") returned="MyriadPro-BoldIt.otf" [0075.380] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0075.380] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="" [0075.380] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" [0075.380] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\how to decrypt files.txt")) returned 0x20 [0075.380] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="MyriadPro-It.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-It.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-It.otf" [0075.380] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f7b8140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17098, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadPro-Regular.otf", cAlternateFileName="MYRIAD~4.OTF")) returned 1 [0075.380] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.380] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="MyriadPro-Regular.otf") returned -1 [0075.380] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MyriadPro-Regular.otf") returned -1 [0075.380] lstrcmpiA (lpString1="", lpString2="MyriadPro-Regular.otf") returned -1 [0075.380] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-It.otf") returned="MyriadPro-It.otf" [0075.381] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0075.381] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="" [0075.381] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" [0075.381] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\how to decrypt files.txt")) returned 0x20 [0075.381] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="MyriadPro-Regular.otf" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-Regular.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-Regular.otf" [0075.381] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f556b40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PFM", cAlternateFileName="")) returned 1 [0075.381] lstrcmpA (lpString1=".", lpString2="PFM") returned -1 [0075.381] lstrcmpA (lpString1="..", lpString2="PFM") returned -1 [0075.381] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-Regular.otf") returned="MyriadPro-Regular.otf" [0075.381] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="PFM" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM" [0075.381] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f556b40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d6f7e, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0075.381] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.381] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f556b40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0075.381] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.381] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.381] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="SY______.PFM", cAlternateFileName="")) returned 1 [0075.381] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.381] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SY______.PFM") returned -1 [0075.381] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SY______.PFM") returned -1 [0075.381] lstrcmpiA (lpString1="", lpString2="SY______.PFM") returned -1 [0075.382] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\*.*") returned="*.*" [0075.382] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\" [0075.382] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\") returned="" [0075.382] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\HOW TO DECRYPT FILES.txt" [0075.382] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\how to decrypt files.txt")) returned 0xffffffff [0075.382] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0075.385] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.385] CloseHandle (hObject=0x94) returned 1 [0075.385] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\", lpString2="SY______.PFM" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\SY______.PFM") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\SY______.PFM" [0075.385] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="zx______.pfm", cAlternateFileName="")) returned 1 [0075.385] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.386] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="zx______.pfm") returned -1 [0075.386] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="zx______.pfm") returned -1 [0075.386] lstrcmpiA (lpString1="", lpString2="zx______.pfm") returned -1 [0075.386] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\SY______.PFM") returned="SY______.PFM" [0075.386] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\" [0075.386] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\") returned="" [0075.386] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\HOW TO DECRYPT FILES.txt" [0075.386] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\how to decrypt files.txt")) returned 0x20 [0075.386] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\", lpString2="zx______.pfm" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\zx______.pfm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\zx______.pfm" [0075.386] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="zy______.pfm", cAlternateFileName="")) returned 1 [0075.386] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.386] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="zy______.pfm") returned -1 [0075.386] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="zy______.pfm") returned -1 [0075.386] lstrcmpiA (lpString1="", lpString2="zy______.pfm") returned -1 [0075.386] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\zx______.pfm") returned="zx______.pfm" [0075.386] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\" [0075.386] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\") returned="" [0075.386] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\HOW TO DECRYPT FILES.txt" [0075.386] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\how to decrypt files.txt")) returned 0x20 [0075.386] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\", lpString2="zy______.pfm" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\zy______.pfm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\zy______.pfm" [0075.386] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="zy______.pfm", cAlternateFileName="")) returned 0 [0075.386] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0075.387] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8791, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="SY______.PFB", cAlternateFileName="")) returned 1 [0075.387] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.387] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="SY______.PFB") returned -1 [0075.387] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SY______.PFB") returned -1 [0075.387] lstrcmpiA (lpString1="", lpString2="SY______.PFB") returned -1 [0075.387] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\*.*") returned="*.*" [0075.387] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0075.387] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="" [0075.387] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" [0075.387] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\how to decrypt files.txt")) returned 0x20 [0075.387] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="SY______.PFB" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\SY______.PFB") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\SY______.PFB" [0075.387] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12735, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZX______.PFB", cAlternateFileName="")) returned 1 [0075.387] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.387] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZX______.PFB") returned -1 [0075.387] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZX______.PFB") returned -1 [0075.387] lstrcmpiA (lpString1="", lpString2="ZX______.PFB") returned -1 [0075.387] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\SY______.PFB") returned="SY______.PFB" [0075.387] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0075.387] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="" [0075.387] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" [0075.387] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\how to decrypt files.txt")) returned 0x20 [0075.387] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="ZX______.PFB" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\ZX______.PFB") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\ZX______.PFB" [0075.388] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x178a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZY______.PFB", cAlternateFileName="")) returned 1 [0075.388] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0075.388] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ZY______.PFB") returned -1 [0075.388] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZY______.PFB") returned -1 [0075.388] lstrcmpiA (lpString1="", lpString2="ZY______.PFB") returned -1 [0075.388] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\ZX______.PFB") returned="ZX______.PFB" [0075.388] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0075.388] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="" [0075.388] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" [0075.388] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\how to decrypt files.txt")) returned 0x20 [0075.388] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\", lpString2="ZY______.PFB" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\ZY______.PFB") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\ZY______.PFB" [0075.388] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x178a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZY______.PFB", cAlternateFileName="")) returned 0 [0075.388] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.388] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dcf09c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0075.388] lstrcmpA (lpString1=".", lpString2="Linguistics") returned -1 [0075.388] lstrcmpA (lpString1="..", lpString2="Linguistics") returned -1 [0075.388] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\*.*") returned="*.*" [0075.388] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\", lpString2="Linguistics" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics" [0075.388] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics") returned 61 [0075.388] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dcf09c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.389] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.389] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dcf09c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.389] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.389] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.389] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dcf09c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f472300, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="LanguageNames2", cAlternateFileName="LANGUA~1")) returned 1 [0075.389] lstrcmpA (lpString1=".", lpString2="LanguageNames2") returned -1 [0075.389] lstrcmpA (lpString1="..", lpString2="LanguageNames2") returned -1 [0075.389] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\*.*") returned="*.*" [0075.389] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\", lpString2="LanguageNames2" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0075.389] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned 76 [0075.389] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dcf09c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f472300, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0075.394] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.394] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dcf09c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f472300, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0075.397] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.397] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.397] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c88, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar.txt", cAlternateFileName="DICAC9~1.TXT")) returned 1 [0075.397] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.397] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.ar.txt") returned 1 [0075.397] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.ar.txt") returned 1 [0075.397] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.ar.txt") returned -1 [0075.397] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\*.*") returned="*.*" [0075.397] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.397] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.397] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.397] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0xffffffff [0075.398] CreateFileA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94 [0075.399] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0075.399] WriteFile (in: hFile=0x94, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0075.400] SetFileTime (hFile=0x94, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.400] CloseHandle (hObject=0x94) returned 1 [0075.400] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.ar.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt" [0075.400] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.zip") returned 0 [0075.400] lstrlenA (lpString="*.zip") returned 5 [0075.400] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.rar") returned 0 [0075.400] lstrlenA (lpString="*.rar") returned 5 [0075.401] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.7z") returned 0 [0075.401] lstrlenA (lpString="*.7z") returned 4 [0075.401] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.tar") returned 0 [0075.401] lstrlenA (lpString="*.tar") returned 5 [0075.401] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.gzip") returned 0 [0075.401] lstrlenA (lpString="*.gzip") returned 6 [0075.401] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.jpg") returned 0 [0075.401] lstrlenA (lpString="*.jpg") returned 5 [0075.401] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.jpeg") returned 0 [0075.401] lstrlenA (lpString="*.jpeg") returned 6 [0075.401] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.psd") returned 0 [0075.401] lstrlenA (lpString="*.psd") returned 5 [0075.401] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.gif") returned 0 [0075.401] lstrlenA (lpString="*.gif") returned 5 [0075.401] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.doc") returned 0 [0075.401] lstrlenA (lpString="*.doc") returned 5 [0075.401] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.docx") returned 0 [0075.401] lstrlenA (lpString="*.docx") returned 6 [0075.401] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.xls") returned 0 [0075.401] lstrlenA (lpString="*.xls") returned 5 [0075.401] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.xlsx") returned 0 [0075.401] lstrlenA (lpString="*.xlsx") returned 6 [0075.401] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.ppt") returned 0 [0075.401] lstrlenA (lpString="*.ppt") returned 5 [0075.401] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.pptx") returned 0 [0075.401] lstrlenA (lpString="*.pptx") returned 6 [0075.401] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.pdf") returned 0 [0075.401] lstrlenA (lpString="*.pdf") returned 5 [0075.401] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.mov") returned 0 [0075.401] lstrlenA (lpString="*.mov") returned 5 [0075.401] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.m2v") returned 0 [0075.401] lstrlenA (lpString="*.m2v") returned 5 [0075.401] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.3gp") returned 0 [0075.401] lstrlenA (lpString="*.3gp") returned 5 [0075.402] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.mpeg") returned 0 [0075.402] lstrlenA (lpString="*.mpeg") returned 6 [0075.402] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.mpg") returned 0 [0075.402] lstrlenA (lpString="*.mpg") returned 5 [0075.402] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.flv") returned 0 [0075.402] lstrlenA (lpString="*.flv") returned 5 [0075.402] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.avi") returned 0 [0075.402] lstrlenA (lpString="*.avi") returned 5 [0075.402] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.mp4") returned 0 [0075.402] lstrlenA (lpString="*.mp4") returned 5 [0075.402] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.wmv") returned 0 [0075.402] lstrlenA (lpString="*.wmv") returned 5 [0075.402] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.divx") returned 0 [0075.402] lstrlenA (lpString="*.divx") returned 6 [0075.402] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.mkv") returned 0 [0075.402] lstrlenA (lpString="*.mkv") returned 5 [0075.402] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.mp3") returned 0 [0075.402] lstrlenA (lpString="*.mp3") returned 5 [0075.402] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.wav") returned 0 [0075.402] lstrlenA (lpString="*.wav") returned 5 [0075.402] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.flac") returned 0 [0075.402] lstrlenA (lpString="*.flac") returned 6 [0075.402] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.ape") returned 0 [0075.402] lstrlenA (lpString="*.ape") returned 5 [0075.402] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.wma") returned 0 [0075.402] lstrlenA (lpString="*.wma") returned 5 [0075.402] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.ac3") returned 0 [0075.402] lstrlenA (lpString="*.ac3") returned 5 [0075.402] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", pszSpec="*.mxf") returned 0 [0075.402] lstrlenA (lpString="*.mxf") returned 5 [0075.402] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_AE.txt", cAlternateFileName="DI3495~1.TXT")) returned 1 [0075.402] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.402] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.ar_AE.txt") returned 1 [0075.403] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.ar_AE.txt") returned 1 [0075.403] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.ar_AE.txt") returned -1 [0075.403] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt") returned="DisplayLanguageNames.ar.txt" [0075.403] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.403] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.403] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.403] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.403] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.ar_AE.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt" [0075.403] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.zip") returned 0 [0075.403] lstrlenA (lpString="*.zip") returned 5 [0075.403] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.rar") returned 0 [0075.403] lstrlenA (lpString="*.rar") returned 5 [0075.403] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.7z") returned 0 [0075.403] lstrlenA (lpString="*.7z") returned 4 [0075.403] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.tar") returned 0 [0075.403] lstrlenA (lpString="*.tar") returned 5 [0075.403] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.gzip") returned 0 [0075.403] lstrlenA (lpString="*.gzip") returned 6 [0075.403] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.jpg") returned 0 [0075.403] lstrlenA (lpString="*.jpg") returned 5 [0075.403] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.jpeg") returned 0 [0075.403] lstrlenA (lpString="*.jpeg") returned 6 [0075.403] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.psd") returned 0 [0075.403] lstrlenA (lpString="*.psd") returned 5 [0075.403] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.gif") returned 0 [0075.403] lstrlenA (lpString="*.gif") returned 5 [0075.403] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.doc") returned 0 [0075.403] lstrlenA (lpString="*.doc") returned 5 [0075.403] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.docx") returned 0 [0075.403] lstrlenA (lpString="*.docx") returned 6 [0075.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.xls") returned 0 [0075.404] lstrlenA (lpString="*.xls") returned 5 [0075.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.xlsx") returned 0 [0075.404] lstrlenA (lpString="*.xlsx") returned 6 [0075.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.ppt") returned 0 [0075.404] lstrlenA (lpString="*.ppt") returned 5 [0075.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.pptx") returned 0 [0075.404] lstrlenA (lpString="*.pptx") returned 6 [0075.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.pdf") returned 0 [0075.404] lstrlenA (lpString="*.pdf") returned 5 [0075.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.mov") returned 0 [0075.404] lstrlenA (lpString="*.mov") returned 5 [0075.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.m2v") returned 0 [0075.404] lstrlenA (lpString="*.m2v") returned 5 [0075.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.3gp") returned 0 [0075.404] lstrlenA (lpString="*.3gp") returned 5 [0075.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.mpeg") returned 0 [0075.404] lstrlenA (lpString="*.mpeg") returned 6 [0075.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.mpg") returned 0 [0075.404] lstrlenA (lpString="*.mpg") returned 5 [0075.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.flv") returned 0 [0075.404] lstrlenA (lpString="*.flv") returned 5 [0075.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.avi") returned 0 [0075.404] lstrlenA (lpString="*.avi") returned 5 [0075.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.mp4") returned 0 [0075.404] lstrlenA (lpString="*.mp4") returned 5 [0075.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.wmv") returned 0 [0075.404] lstrlenA (lpString="*.wmv") returned 5 [0075.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.divx") returned 0 [0075.404] lstrlenA (lpString="*.divx") returned 6 [0075.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.mkv") returned 0 [0075.404] lstrlenA (lpString="*.mkv") returned 5 [0075.404] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.mp3") returned 0 [0075.404] lstrlenA (lpString="*.mp3") returned 5 [0075.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.wav") returned 0 [0075.405] lstrlenA (lpString="*.wav") returned 5 [0075.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.flac") returned 0 [0075.405] lstrlenA (lpString="*.flac") returned 6 [0075.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.ape") returned 0 [0075.405] lstrlenA (lpString="*.ape") returned 5 [0075.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.wma") returned 0 [0075.405] lstrlenA (lpString="*.wma") returned 5 [0075.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.ac3") returned 0 [0075.405] lstrlenA (lpString="*.ac3") returned 5 [0075.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", pszSpec="*.mxf") returned 0 [0075.405] lstrlenA (lpString="*.mxf") returned 5 [0075.405] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DisplayLanguageNames.ar_BH.txt", cAlternateFileName="DI7F79~1.TXT")) returned 1 [0075.405] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.405] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.ar_BH.txt") returned 1 [0075.405] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.ar_BH.txt") returned 1 [0075.405] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.ar_BH.txt") returned -1 [0075.405] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt") returned="DisplayLanguageNames.ar_AE.txt" [0075.405] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.405] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.405] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.405] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.405] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.ar_BH.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt" [0075.405] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.zip") returned 0 [0075.406] lstrlenA (lpString="*.zip") returned 5 [0075.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.rar") returned 0 [0075.406] lstrlenA (lpString="*.rar") returned 5 [0075.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.7z") returned 0 [0075.406] lstrlenA (lpString="*.7z") returned 4 [0075.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.tar") returned 0 [0075.406] lstrlenA (lpString="*.tar") returned 5 [0075.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.gzip") returned 0 [0075.406] lstrlenA (lpString="*.gzip") returned 6 [0075.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.jpg") returned 0 [0075.406] lstrlenA (lpString="*.jpg") returned 5 [0075.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.jpeg") returned 0 [0075.406] lstrlenA (lpString="*.jpeg") returned 6 [0075.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.psd") returned 0 [0075.406] lstrlenA (lpString="*.psd") returned 5 [0075.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.gif") returned 0 [0075.406] lstrlenA (lpString="*.gif") returned 5 [0075.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.doc") returned 0 [0075.406] lstrlenA (lpString="*.doc") returned 5 [0075.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.docx") returned 0 [0075.406] lstrlenA (lpString="*.docx") returned 6 [0075.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.xls") returned 0 [0075.406] lstrlenA (lpString="*.xls") returned 5 [0075.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.xlsx") returned 0 [0075.406] lstrlenA (lpString="*.xlsx") returned 6 [0075.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.ppt") returned 0 [0075.406] lstrlenA (lpString="*.ppt") returned 5 [0075.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.pptx") returned 0 [0075.406] lstrlenA (lpString="*.pptx") returned 6 [0075.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.pdf") returned 0 [0075.406] lstrlenA (lpString="*.pdf") returned 5 [0075.406] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.mov") returned 0 [0075.406] lstrlenA (lpString="*.mov") returned 5 [0075.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.m2v") returned 0 [0075.407] lstrlenA (lpString="*.m2v") returned 5 [0075.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.3gp") returned 0 [0075.407] lstrlenA (lpString="*.3gp") returned 5 [0075.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.mpeg") returned 0 [0075.407] lstrlenA (lpString="*.mpeg") returned 6 [0075.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.mpg") returned 0 [0075.407] lstrlenA (lpString="*.mpg") returned 5 [0075.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.flv") returned 0 [0075.407] lstrlenA (lpString="*.flv") returned 5 [0075.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.avi") returned 0 [0075.407] lstrlenA (lpString="*.avi") returned 5 [0075.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.mp4") returned 0 [0075.407] lstrlenA (lpString="*.mp4") returned 5 [0075.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.wmv") returned 0 [0075.407] lstrlenA (lpString="*.wmv") returned 5 [0075.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.divx") returned 0 [0075.407] lstrlenA (lpString="*.divx") returned 6 [0075.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.mkv") returned 0 [0075.407] lstrlenA (lpString="*.mkv") returned 5 [0075.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.mp3") returned 0 [0075.407] lstrlenA (lpString="*.mp3") returned 5 [0075.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.wav") returned 0 [0075.407] lstrlenA (lpString="*.wav") returned 5 [0075.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.flac") returned 0 [0075.407] lstrlenA (lpString="*.flac") returned 6 [0075.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.ape") returned 0 [0075.407] lstrlenA (lpString="*.ape") returned 5 [0075.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.wma") returned 0 [0075.407] lstrlenA (lpString="*.wma") returned 5 [0075.407] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.ac3") returned 0 [0075.407] lstrlenA (lpString="*.ac3") returned 5 [0075.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", pszSpec="*.mxf") returned 0 [0075.408] lstrlenA (lpString="*.mxf") returned 5 [0075.408] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DisplayLanguageNames.ar_DZ.txt", cAlternateFileName="DIF61A~1.TXT")) returned 1 [0075.408] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.408] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.ar_DZ.txt") returned 1 [0075.408] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.ar_DZ.txt") returned 1 [0075.408] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.ar_DZ.txt") returned -1 [0075.408] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt") returned="DisplayLanguageNames.ar_BH.txt" [0075.408] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.408] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.408] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.408] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.408] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.ar_DZ.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt" [0075.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.zip") returned 0 [0075.408] lstrlenA (lpString="*.zip") returned 5 [0075.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.rar") returned 0 [0075.408] lstrlenA (lpString="*.rar") returned 5 [0075.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.7z") returned 0 [0075.408] lstrlenA (lpString="*.7z") returned 4 [0075.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.tar") returned 0 [0075.408] lstrlenA (lpString="*.tar") returned 5 [0075.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.gzip") returned 0 [0075.408] lstrlenA (lpString="*.gzip") returned 6 [0075.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.jpg") returned 0 [0075.408] lstrlenA (lpString="*.jpg") returned 5 [0075.408] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.jpeg") returned 0 [0075.408] lstrlenA (lpString="*.jpeg") returned 6 [0075.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.psd") returned 0 [0075.409] lstrlenA (lpString="*.psd") returned 5 [0075.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.gif") returned 0 [0075.409] lstrlenA (lpString="*.gif") returned 5 [0075.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.doc") returned 0 [0075.409] lstrlenA (lpString="*.doc") returned 5 [0075.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.docx") returned 0 [0075.409] lstrlenA (lpString="*.docx") returned 6 [0075.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.xls") returned 0 [0075.409] lstrlenA (lpString="*.xls") returned 5 [0075.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.xlsx") returned 0 [0075.409] lstrlenA (lpString="*.xlsx") returned 6 [0075.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.ppt") returned 0 [0075.409] lstrlenA (lpString="*.ppt") returned 5 [0075.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.pptx") returned 0 [0075.409] lstrlenA (lpString="*.pptx") returned 6 [0075.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.pdf") returned 0 [0075.409] lstrlenA (lpString="*.pdf") returned 5 [0075.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.mov") returned 0 [0075.409] lstrlenA (lpString="*.mov") returned 5 [0075.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.m2v") returned 0 [0075.409] lstrlenA (lpString="*.m2v") returned 5 [0075.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.3gp") returned 0 [0075.409] lstrlenA (lpString="*.3gp") returned 5 [0075.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.mpeg") returned 0 [0075.409] lstrlenA (lpString="*.mpeg") returned 6 [0075.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.mpg") returned 0 [0075.409] lstrlenA (lpString="*.mpg") returned 5 [0075.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.flv") returned 0 [0075.409] lstrlenA (lpString="*.flv") returned 5 [0075.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.avi") returned 0 [0075.409] lstrlenA (lpString="*.avi") returned 5 [0075.409] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.mp4") returned 0 [0075.410] lstrlenA (lpString="*.mp4") returned 5 [0075.410] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.wmv") returned 0 [0075.410] lstrlenA (lpString="*.wmv") returned 5 [0075.410] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.divx") returned 0 [0075.410] lstrlenA (lpString="*.divx") returned 6 [0075.410] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.mkv") returned 0 [0075.410] lstrlenA (lpString="*.mkv") returned 5 [0075.410] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.mp3") returned 0 [0075.410] lstrlenA (lpString="*.mp3") returned 5 [0075.410] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.wav") returned 0 [0075.410] lstrlenA (lpString="*.wav") returned 5 [0075.410] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.flac") returned 0 [0075.410] lstrlenA (lpString="*.flac") returned 6 [0075.410] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.ape") returned 0 [0075.410] lstrlenA (lpString="*.ape") returned 5 [0075.410] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.wma") returned 0 [0075.410] lstrlenA (lpString="*.wma") returned 5 [0075.410] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.ac3") returned 0 [0075.410] lstrlenA (lpString="*.ac3") returned 5 [0075.410] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", pszSpec="*.mxf") returned 0 [0075.410] lstrlenA (lpString="*.mxf") returned 5 [0075.410] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DisplayLanguageNames.ar_EG.txt", cAlternateFileName="DIC7FA~1.TXT")) returned 1 [0075.410] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.410] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.ar_EG.txt") returned 1 [0075.410] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.ar_EG.txt") returned 1 [0075.410] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.ar_EG.txt") returned -1 [0075.410] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt") returned="DisplayLanguageNames.ar_DZ.txt" [0075.410] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.410] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.410] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.410] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.411] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.ar_EG.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt" [0075.411] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.zip") returned 0 [0075.411] lstrlenA (lpString="*.zip") returned 5 [0075.411] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.rar") returned 0 [0075.411] lstrlenA (lpString="*.rar") returned 5 [0075.411] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.7z") returned 0 [0075.411] lstrlenA (lpString="*.7z") returned 4 [0075.411] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.tar") returned 0 [0075.411] lstrlenA (lpString="*.tar") returned 5 [0075.411] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.gzip") returned 0 [0075.411] lstrlenA (lpString="*.gzip") returned 6 [0075.411] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.jpg") returned 0 [0075.411] lstrlenA (lpString="*.jpg") returned 5 [0075.411] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.jpeg") returned 0 [0075.411] lstrlenA (lpString="*.jpeg") returned 6 [0075.411] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.psd") returned 0 [0075.411] lstrlenA (lpString="*.psd") returned 5 [0075.411] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.gif") returned 0 [0075.411] lstrlenA (lpString="*.gif") returned 5 [0075.411] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.doc") returned 0 [0075.411] lstrlenA (lpString="*.doc") returned 5 [0075.411] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.docx") returned 0 [0075.411] lstrlenA (lpString="*.docx") returned 6 [0075.411] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.xls") returned 0 [0075.411] lstrlenA (lpString="*.xls") returned 5 [0075.411] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.xlsx") returned 0 [0075.411] lstrlenA (lpString="*.xlsx") returned 6 [0075.411] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.ppt") returned 0 [0075.411] lstrlenA (lpString="*.ppt") returned 5 [0075.411] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.pptx") returned 0 [0075.411] lstrlenA (lpString="*.pptx") returned 6 [0075.412] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.pdf") returned 0 [0075.412] lstrlenA (lpString="*.pdf") returned 5 [0075.412] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.mov") returned 0 [0075.412] lstrlenA (lpString="*.mov") returned 5 [0075.412] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.m2v") returned 0 [0075.412] lstrlenA (lpString="*.m2v") returned 5 [0075.412] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.3gp") returned 0 [0075.412] lstrlenA (lpString="*.3gp") returned 5 [0075.412] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.mpeg") returned 0 [0075.412] lstrlenA (lpString="*.mpeg") returned 6 [0075.412] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.mpg") returned 0 [0075.412] lstrlenA (lpString="*.mpg") returned 5 [0075.412] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.flv") returned 0 [0075.412] lstrlenA (lpString="*.flv") returned 5 [0075.412] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.avi") returned 0 [0075.412] lstrlenA (lpString="*.avi") returned 5 [0075.412] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.mp4") returned 0 [0075.412] lstrlenA (lpString="*.mp4") returned 5 [0075.412] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.wmv") returned 0 [0075.412] lstrlenA (lpString="*.wmv") returned 5 [0075.412] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.divx") returned 0 [0075.412] lstrlenA (lpString="*.divx") returned 6 [0075.412] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.mkv") returned 0 [0075.412] lstrlenA (lpString="*.mkv") returned 5 [0075.412] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.mp3") returned 0 [0075.412] lstrlenA (lpString="*.mp3") returned 5 [0075.412] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.wav") returned 0 [0075.412] lstrlenA (lpString="*.wav") returned 5 [0075.413] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.flac") returned 0 [0075.413] lstrlenA (lpString="*.flac") returned 6 [0075.413] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.ape") returned 0 [0075.413] lstrlenA (lpString="*.ape") returned 5 [0075.413] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.wma") returned 0 [0075.413] lstrlenA (lpString="*.wma") returned 5 [0075.413] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.ac3") returned 0 [0075.413] lstrlenA (lpString="*.ac3") returned 5 [0075.413] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt", pszSpec="*.mxf") returned 0 [0075.413] lstrlenA (lpString="*.mxf") returned 5 [0075.413] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DisplayLanguageNames.ar_IN.txt", cAlternateFileName="DI4FA4~1.TXT")) returned 1 [0075.413] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.413] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.ar_IN.txt") returned 1 [0075.413] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.ar_IN.txt") returned 1 [0075.413] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.ar_IN.txt") returned -1 [0075.413] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt") returned="DisplayLanguageNames.ar_EG.txt" [0075.413] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.413] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.413] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.413] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.413] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.ar_IN.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt" [0075.413] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.zip") returned 0 [0075.413] lstrlenA (lpString="*.zip") returned 5 [0075.413] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.rar") returned 0 [0075.413] lstrlenA (lpString="*.rar") returned 5 [0075.414] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.7z") returned 0 [0075.414] lstrlenA (lpString="*.7z") returned 4 [0075.414] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.tar") returned 0 [0075.414] lstrlenA (lpString="*.tar") returned 5 [0075.414] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.gzip") returned 0 [0075.414] lstrlenA (lpString="*.gzip") returned 6 [0075.414] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.jpg") returned 0 [0075.414] lstrlenA (lpString="*.jpg") returned 5 [0075.414] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.jpeg") returned 0 [0075.414] lstrlenA (lpString="*.jpeg") returned 6 [0075.414] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.psd") returned 0 [0075.414] lstrlenA (lpString="*.psd") returned 5 [0075.414] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.gif") returned 0 [0075.414] lstrlenA (lpString="*.gif") returned 5 [0075.414] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.doc") returned 0 [0075.414] lstrlenA (lpString="*.doc") returned 5 [0075.414] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.docx") returned 0 [0075.414] lstrlenA (lpString="*.docx") returned 6 [0075.414] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.xls") returned 0 [0075.414] lstrlenA (lpString="*.xls") returned 5 [0075.414] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.xlsx") returned 0 [0075.414] lstrlenA (lpString="*.xlsx") returned 6 [0075.414] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.ppt") returned 0 [0075.414] lstrlenA (lpString="*.ppt") returned 5 [0075.414] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.pptx") returned 0 [0075.414] lstrlenA (lpString="*.pptx") returned 6 [0075.414] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.pdf") returned 0 [0075.414] lstrlenA (lpString="*.pdf") returned 5 [0075.414] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.mov") returned 0 [0075.414] lstrlenA (lpString="*.mov") returned 5 [0075.415] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.m2v") returned 0 [0075.415] lstrlenA (lpString="*.m2v") returned 5 [0075.415] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.3gp") returned 0 [0075.415] lstrlenA (lpString="*.3gp") returned 5 [0075.415] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.mpeg") returned 0 [0075.415] lstrlenA (lpString="*.mpeg") returned 6 [0075.415] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.mpg") returned 0 [0075.415] lstrlenA (lpString="*.mpg") returned 5 [0075.415] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.flv") returned 0 [0075.415] lstrlenA (lpString="*.flv") returned 5 [0075.415] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.avi") returned 0 [0075.415] lstrlenA (lpString="*.avi") returned 5 [0075.415] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.mp4") returned 0 [0075.415] lstrlenA (lpString="*.mp4") returned 5 [0075.415] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.wmv") returned 0 [0075.415] lstrlenA (lpString="*.wmv") returned 5 [0075.415] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.divx") returned 0 [0075.415] lstrlenA (lpString="*.divx") returned 6 [0075.415] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.mkv") returned 0 [0075.415] lstrlenA (lpString="*.mkv") returned 5 [0075.415] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.mp3") returned 0 [0075.415] lstrlenA (lpString="*.mp3") returned 5 [0075.415] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.wav") returned 0 [0075.415] lstrlenA (lpString="*.wav") returned 5 [0075.415] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.flac") returned 0 [0075.415] lstrlenA (lpString="*.flac") returned 6 [0075.415] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.ape") returned 0 [0075.415] lstrlenA (lpString="*.ape") returned 5 [0075.415] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.wma") returned 0 [0075.415] lstrlenA (lpString="*.wma") returned 5 [0075.415] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.ac3") returned 0 [0075.415] lstrlenA (lpString="*.ac3") returned 5 [0075.415] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt", pszSpec="*.mxf") returned 0 [0075.415] lstrlenA (lpString="*.mxf") returned 5 [0075.415] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DisplayLanguageNames.ar_IQ.txt", cAlternateFileName="DI3F41~1.TXT")) returned 1 [0075.416] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.416] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.ar_IQ.txt") returned 1 [0075.416] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.ar_IQ.txt") returned 1 [0075.416] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.ar_IQ.txt") returned -1 [0075.416] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt") returned="DisplayLanguageNames.ar_IN.txt" [0075.416] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.416] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.416] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.416] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.416] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.ar_IQ.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt" [0075.416] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.zip") returned 0 [0075.416] lstrlenA (lpString="*.zip") returned 5 [0075.416] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.rar") returned 0 [0075.416] lstrlenA (lpString="*.rar") returned 5 [0075.416] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.7z") returned 0 [0075.416] lstrlenA (lpString="*.7z") returned 4 [0075.416] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.tar") returned 0 [0075.416] lstrlenA (lpString="*.tar") returned 5 [0075.416] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.gzip") returned 0 [0075.416] lstrlenA (lpString="*.gzip") returned 6 [0075.416] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.jpg") returned 0 [0075.416] lstrlenA (lpString="*.jpg") returned 5 [0075.416] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.jpeg") returned 0 [0075.416] lstrlenA (lpString="*.jpeg") returned 6 [0075.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.psd") returned 0 [0075.417] lstrlenA (lpString="*.psd") returned 5 [0075.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.gif") returned 0 [0075.417] lstrlenA (lpString="*.gif") returned 5 [0075.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.doc") returned 0 [0075.417] lstrlenA (lpString="*.doc") returned 5 [0075.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.docx") returned 0 [0075.417] lstrlenA (lpString="*.docx") returned 6 [0075.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.xls") returned 0 [0075.417] lstrlenA (lpString="*.xls") returned 5 [0075.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.xlsx") returned 0 [0075.417] lstrlenA (lpString="*.xlsx") returned 6 [0075.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.ppt") returned 0 [0075.417] lstrlenA (lpString="*.ppt") returned 5 [0075.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.pptx") returned 0 [0075.417] lstrlenA (lpString="*.pptx") returned 6 [0075.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.pdf") returned 0 [0075.417] lstrlenA (lpString="*.pdf") returned 5 [0075.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.mov") returned 0 [0075.417] lstrlenA (lpString="*.mov") returned 5 [0075.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.m2v") returned 0 [0075.417] lstrlenA (lpString="*.m2v") returned 5 [0075.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.3gp") returned 0 [0075.417] lstrlenA (lpString="*.3gp") returned 5 [0075.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.mpeg") returned 0 [0075.417] lstrlenA (lpString="*.mpeg") returned 6 [0075.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.mpg") returned 0 [0075.417] lstrlenA (lpString="*.mpg") returned 5 [0075.417] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.flv") returned 0 [0075.417] lstrlenA (lpString="*.flv") returned 5 [0075.418] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.avi") returned 0 [0075.418] lstrlenA (lpString="*.avi") returned 5 [0075.418] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.mp4") returned 0 [0075.418] lstrlenA (lpString="*.mp4") returned 5 [0075.418] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.wmv") returned 0 [0075.418] lstrlenA (lpString="*.wmv") returned 5 [0075.418] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.divx") returned 0 [0075.418] lstrlenA (lpString="*.divx") returned 6 [0075.418] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.mkv") returned 0 [0075.418] lstrlenA (lpString="*.mkv") returned 5 [0075.418] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.mp3") returned 0 [0075.418] lstrlenA (lpString="*.mp3") returned 5 [0075.418] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.wav") returned 0 [0075.418] lstrlenA (lpString="*.wav") returned 5 [0075.418] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.flac") returned 0 [0075.418] lstrlenA (lpString="*.flac") returned 6 [0075.418] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.ape") returned 0 [0075.418] lstrlenA (lpString="*.ape") returned 5 [0075.418] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.wma") returned 0 [0075.418] lstrlenA (lpString="*.wma") returned 5 [0075.418] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.ac3") returned 0 [0075.418] lstrlenA (lpString="*.ac3") returned 5 [0075.418] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt", pszSpec="*.mxf") returned 0 [0075.418] lstrlenA (lpString="*.mxf") returned 5 [0075.418] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f44c1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DisplayLanguageNames.ar_JO.txt", cAlternateFileName="DI0622~1.TXT")) returned 1 [0075.418] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.418] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.ar_JO.txt") returned 1 [0075.418] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.ar_JO.txt") returned 1 [0075.418] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.ar_JO.txt") returned -1 [0075.418] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt") returned="DisplayLanguageNames.ar_IQ.txt" [0075.418] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.418] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.418] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.419] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.419] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.ar_JO.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt" [0075.419] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt", pszSpec="*.zip") returned 0 [0075.419] lstrlenA (lpString="*.zip") returned 5 [0075.419] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt", pszSpec="*.rar") returned 0 [0075.419] lstrlenA (lpString="*.rar") returned 5 [0075.419] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt", pszSpec="*.7z") returned 0 [0075.419] lstrlenA (lpString="*.7z") returned 4 [0075.419] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt", pszSpec="*.tar") returned 0 [0075.419] lstrlenA (lpString="*.tar") returned 5 [0075.419] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt", pszSpec="*.gzip") returned 0 [0075.419] lstrlenA (lpString="*.gzip") returned 6 [0075.419] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt", pszSpec="*.jpg") returned 0 [0075.419] lstrlenA (lpString="*.jpg") returned 5 [0075.419] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt", pszSpec="*.jpeg") returned 0 [0075.419] lstrlenA (lpString="*.jpeg") returned 6 [0075.419] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt", pszSpec="*.psd") returned 0 [0075.419] lstrlenA (lpString="*.psd") returned 5 [0075.419] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt", pszSpec="*.gif") returned 0 [0075.419] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt", pszSpec="*.doc") returned 0 [0075.419] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt", pszSpec="*.docx") returned 0 [0075.420] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f44c1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DisplayLanguageNames.ar_KW.txt", cAlternateFileName="DIF6C4~1.TXT")) returned 1 [0075.420] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.420] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.ar_KW.txt") returned 1 [0075.420] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.ar_KW.txt") returned 1 [0075.420] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.ar_KW.txt") returned -1 [0075.420] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt") returned="DisplayLanguageNames.ar_JO.txt" [0075.420] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.420] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.420] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.420] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.420] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.ar_KW.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_KW.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_KW.txt" [0075.420] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f44c1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DisplayLanguageNames.ar_LB.txt", cAlternateFileName="DI621E~1.TXT")) returned 1 [0075.420] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.420] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.ar_LB.txt") returned 1 [0075.420] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.ar_LB.txt") returned 1 [0075.420] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.ar_LB.txt") returned -1 [0075.420] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_KW.txt") returned="DisplayLanguageNames.ar_KW.txt" [0075.420] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.420] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.420] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.420] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.420] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.ar_LB.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt" [0075.421] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f44c1a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DisplayLanguageNames.ar_LY.txt", cAlternateFileName="DID7B2~1.TXT")) returned 1 [0075.421] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.421] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.ar_LY.txt") returned 1 [0075.421] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.ar_LY.txt") returned 1 [0075.421] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.ar_LY.txt") returned -1 [0075.421] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt") returned="DisplayLanguageNames.ar_LB.txt" [0075.421] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.421] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.421] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.421] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.421] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.ar_LY.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LY.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LY.txt" [0075.421] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3d9d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DisplayLanguageNames.ar_MA.txt", cAlternateFileName="DIEC69~1.TXT")) returned 1 [0075.421] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.421] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.ar_MA.txt") returned 1 [0075.421] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.ar_MA.txt") returned 1 [0075.421] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.ar_MA.txt") returned -1 [0075.421] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LY.txt") returned="DisplayLanguageNames.ar_LY.txt" [0075.421] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.421] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.421] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.421] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.421] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.ar_MA.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_MA.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_MA.txt" [0075.421] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3b3c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DisplayLanguageNames.ar_OM.txt", cAlternateFileName="DIC553~1.TXT")) returned 1 [0075.421] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.421] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.ar_OM.txt") returned 1 [0075.421] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.ar_OM.txt") returned 1 [0075.422] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.ar_OM.txt") returned -1 [0075.422] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_MA.txt") returned="DisplayLanguageNames.ar_MA.txt" [0075.422] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.422] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.422] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.422] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.422] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.ar_OM.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt" [0075.422] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3b3c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DisplayLanguageNames.ar_QA.txt", cAlternateFileName="DI2F38~1.TXT")) returned 1 [0075.422] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.422] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.ar_QA.txt") returned 1 [0075.422] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.ar_QA.txt") returned 1 [0075.422] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.ar_QA.txt") returned -1 [0075.422] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt") returned="DisplayLanguageNames.ar_OM.txt" [0075.422] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.422] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.422] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.422] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.422] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.ar_QA.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_QA.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_QA.txt" [0075.422] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3b3c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DisplayLanguageNames.ar_SA.txt", cAlternateFileName="DI48AF~1.TXT")) returned 1 [0075.422] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.422] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.ar_SA.txt") returned 1 [0075.422] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.ar_SA.txt") returned 1 [0075.422] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.ar_SA.txt") returned -1 [0075.422] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_QA.txt") returned="DisplayLanguageNames.ar_QA.txt" [0075.422] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.423] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.423] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.423] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.423] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.ar_SA.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SA.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SA.txt" [0075.423] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3b3c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DisplayLanguageNames.ar_SD.txt", cAlternateFileName="DIC7AF~1.TXT")) returned 1 [0075.423] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.423] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.ar_SD.txt") returned 1 [0075.423] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.ar_SD.txt") returned 1 [0075.423] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.ar_SD.txt") returned -1 [0075.423] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SA.txt") returned="DisplayLanguageNames.ar_SA.txt" [0075.423] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.423] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.423] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.423] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.423] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.ar_SD.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SD.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SD.txt" [0075.423] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3b3c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DisplayLanguageNames.ar_SY.txt", cAlternateFileName="DID7BE~1.TXT")) returned 1 [0075.423] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.423] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.ar_SY.txt") returned 1 [0075.423] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.ar_SY.txt") returned 1 [0075.423] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.ar_SY.txt") returned -1 [0075.423] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SD.txt") returned="DisplayLanguageNames.ar_SD.txt" [0075.423] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.423] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.423] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.424] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.424] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.ar_SY.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SY.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SY.txt" [0075.424] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f3b3c20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DisplayLanguageNames.ar_TN.txt", cAlternateFileName="DI7175~1.TXT")) returned 1 [0075.424] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.424] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.ar_TN.txt") returned 1 [0075.424] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.ar_TN.txt") returned 1 [0075.424] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.ar_TN.txt") returned -1 [0075.424] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SY.txt") returned="DisplayLanguageNames.ar_SY.txt" [0075.424] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.424] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.424] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.424] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.424] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.ar_TN.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_TN.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_TN.txt" [0075.424] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c96, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DisplayLanguageNames.ar_YE.txt", cAlternateFileName="DIE8B6~1.TXT")) returned 1 [0075.424] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.424] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.ar_YE.txt") returned 1 [0075.424] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.ar_YE.txt") returned 1 [0075.424] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.ar_YE.txt") returned -1 [0075.424] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_TN.txt") returned="DisplayLanguageNames.ar_TN.txt" [0075.424] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.424] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.424] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.424] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.424] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.ar_YE.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_YE.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_YE.txt" [0075.425] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f38dac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6cde, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DisplayLanguageNames.bg.txt", cAlternateFileName="DI8E5A~1.TXT")) returned 1 [0075.425] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.425] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.bg.txt") returned 1 [0075.425] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.bg.txt") returned 1 [0075.425] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.bg.txt") returned -1 [0075.425] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_YE.txt") returned="DisplayLanguageNames.ar_YE.txt" [0075.425] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.425] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.425] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.425] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.425] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.bg.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg.txt" [0075.425] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f38dac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6cde, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DisplayLanguageNames.bg_BG.txt", cAlternateFileName="DIC784~1.TXT")) returned 1 [0075.425] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.425] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.bg_BG.txt") returned 1 [0075.425] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.bg_BG.txt") returned 1 [0075.425] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.bg_BG.txt") returned -1 [0075.425] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg.txt") returned="DisplayLanguageNames.bg.txt" [0075.425] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.425] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.425] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.425] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.425] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.bg_BG.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg_BG.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg_BG.txt" [0075.425] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f38dac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6cdc, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DisplayLanguageNames.ca.txt", cAlternateFileName="DIFBE9~1.TXT")) returned 1 [0075.425] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.425] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.ca.txt") returned 1 [0075.425] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.ca.txt") returned 1 [0075.426] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.ca.txt") returned -1 [0075.426] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg_BG.txt") returned="DisplayLanguageNames.bg_BG.txt" [0075.426] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.426] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.426] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.426] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.426] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.ca.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca.txt" [0075.426] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f38dac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6cdc, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DisplayLanguageNames.ca_ES.txt", cAlternateFileName="DI0E62~1.TXT")) returned 1 [0075.426] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.426] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.ca_ES.txt") returned 1 [0075.426] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.ca_ES.txt") returned 1 [0075.426] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.ca_ES.txt") returned -1 [0075.426] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca.txt") returned="DisplayLanguageNames.ca.txt" [0075.426] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.426] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.426] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.426] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.426] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.ca_ES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES.txt" [0075.426] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f38dac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6cdc, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DisplayLanguageNames.ca_ES_PREEURO.txt", cAlternateFileName="DIFFE0~1.TXT")) returned 1 [0075.426] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.426] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.ca_ES_PREEURO.txt") returned 1 [0075.426] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.ca_ES_PREEURO.txt") returned 1 [0075.426] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.ca_ES_PREEURO.txt") returned -1 [0075.426] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES.txt") returned="DisplayLanguageNames.ca_ES.txt" [0075.426] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.426] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.427] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.427] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.427] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.ca_ES_PREEURO.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES_PREEURO.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES_PREEURO.txt" [0075.427] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f367960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x74c0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DisplayLanguageNames.cs.txt", cAlternateFileName="DI5C2E~1.TXT")) returned 1 [0075.427] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.427] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.cs.txt") returned 1 [0075.427] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.cs.txt") returned 1 [0075.427] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.cs.txt") returned -1 [0075.427] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES_PREEURO.txt") returned="DisplayLanguageNames.ca_ES_PREEURO.txt" [0075.427] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.427] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.427] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.427] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.427] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.cs.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs.txt" [0075.427] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f367960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x74c0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DisplayLanguageNames.cs_CZ.txt", cAlternateFileName="DICA81~1.TXT")) returned 1 [0075.428] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.428] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.cs_CZ.txt") returned 1 [0075.428] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.cs_CZ.txt") returned 1 [0075.428] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.cs_CZ.txt") returned -1 [0075.428] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs.txt") returned="DisplayLanguageNames.cs.txt" [0075.428] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.428] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.428] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.428] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.429] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.cs_CZ.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs_CZ.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs_CZ.txt" [0075.429] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6d72, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DisplayLanguageNames.da.txt", cAlternateFileName="DI3825~1.TXT")) returned 1 [0075.429] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.429] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.da.txt") returned 1 [0075.429] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.da.txt") returned 1 [0075.429] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.da.txt") returned -1 [0075.429] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs_CZ.txt") returned="DisplayLanguageNames.cs_CZ.txt" [0075.429] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.429] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.429] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.429] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.429] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.da.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt" [0075.429] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6d72, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DisplayLanguageNames.da_DK.txt", cAlternateFileName="DID241~1.TXT")) returned 1 [0075.429] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.429] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.da_DK.txt") returned 1 [0075.429] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.da_DK.txt") returned 1 [0075.429] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.da_DK.txt") returned -1 [0075.429] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt") returned="DisplayLanguageNames.da.txt" [0075.429] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.429] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.429] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.429] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.429] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.da_DK.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da_DK.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da_DK.txt" [0075.429] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x72d6, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DisplayLanguageNames.de_CH.txt", cAlternateFileName="DI26AE~1.TXT")) returned 1 [0075.430] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.430] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.de_CH.txt") returned 1 [0075.430] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.de_CH.txt") returned 1 [0075.430] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.de_CH.txt") returned -1 [0075.430] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da_DK.txt") returned="DisplayLanguageNames.da_DK.txt" [0075.430] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.430] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.430] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.430] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.430] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.de_CH.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_CH.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_CH.txt" [0075.430] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddaf0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7328, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DisplayLanguageNames.de_DE.txt", cAlternateFileName="DID4A5~1.TXT")) returned 1 [0075.430] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.430] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.de_DE.txt") returned 1 [0075.430] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.de_DE.txt") returned 1 [0075.430] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.de_DE.txt") returned -1 [0075.430] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_CH.txt") returned="DisplayLanguageNames.de_CH.txt" [0075.430] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.430] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.430] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.430] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.430] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.de_DE.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE.txt" [0075.430] FindNextFileA (in: hFindFile=0x2e3538, lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7326, dwReserved0=0x450044, dwReserved1=0x520043, cFileName="DisplayLanguageNames.de_DE_PREEURO.txt", cAlternateFileName="DI06A0~1.TXT")) returned 1 [0075.430] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.430] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.de_DE_PREEURO.txt") returned 1 [0075.430] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.de_DE_PREEURO.txt") returned 1 [0075.430] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.de_DE_PREEURO.txt") returned -1 [0075.431] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE.txt") returned="DisplayLanguageNames.de_DE.txt" [0075.431] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.431] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.431] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.431] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.431] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.de_DE_PREEURO.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE_PREEURO.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE_PREEURO.txt" [0075.431] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.431] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.el.txt") returned 1 [0075.431] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.el.txt") returned 1 [0075.431] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.el.txt") returned -1 [0075.431] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.431] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.431] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.431] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.431] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.el.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el.txt" [0075.431] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.431] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.el_GR.txt") returned 1 [0075.431] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.el_GR.txt") returned 1 [0075.431] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.el_GR.txt") returned -1 [0075.431] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.431] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.431] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.431] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.432] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.el_GR.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR.txt" [0075.432] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.432] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.el_GR_PREEURO.txt") returned 1 [0075.432] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.el_GR_PREEURO.txt") returned 1 [0075.432] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.el_GR_PREEURO.txt") returned -1 [0075.432] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.432] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.432] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.432] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.432] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.el_GR_PREEURO.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR_PREEURO.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR_PREEURO.txt" [0075.432] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.432] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.en_CA.txt") returned 1 [0075.432] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.en_CA.txt") returned 1 [0075.432] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.en_CA.txt") returned -1 [0075.432] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.432] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.432] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.432] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.432] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.en_CA.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt" [0075.432] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.432] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.en_GB.txt") returned 1 [0075.432] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.en_GB.txt") returned 1 [0075.433] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.en_GB.txt") returned -1 [0075.433] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.433] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.433] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.433] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.433] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.en_GB.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt" [0075.433] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.433] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.en_GB_EURO.txt") returned 1 [0075.433] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.en_GB_EURO.txt") returned 1 [0075.433] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.en_GB_EURO.txt") returned -1 [0075.433] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.433] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.433] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.433] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.433] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.en_GB_EURO.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt" [0075.433] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.433] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.en_US.txt") returned 1 [0075.433] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.en_US.txt") returned 1 [0075.433] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.en_US.txt") returned -1 [0075.433] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.433] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.433] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.434] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.434] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.en_US.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt" [0075.434] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.434] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.en_US_POSIX.txt") returned 1 [0075.434] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.en_US_POSIX.txt") returned 1 [0075.434] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.en_US_POSIX.txt") returned -1 [0075.434] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.434] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.434] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.434] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.434] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.en_US_POSIX.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt" [0075.434] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.434] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.es.txt") returned 1 [0075.434] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.es.txt") returned 1 [0075.434] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.es.txt") returned -1 [0075.434] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.434] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.434] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.434] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.434] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.es.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es.txt" [0075.434] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.434] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.es_AR.txt") returned 1 [0075.435] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.es_AR.txt") returned 1 [0075.435] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.es_AR.txt") returned -1 [0075.435] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.435] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.435] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.435] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.435] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.es_AR.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_AR.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_AR.txt" [0075.435] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.435] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.es_BO.txt") returned 1 [0075.435] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.es_BO.txt") returned 1 [0075.435] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.es_BO.txt") returned -1 [0075.435] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.435] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.435] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.435] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.435] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.es_BO.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_BO.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_BO.txt" [0075.435] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.435] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.es_CL.txt") returned 1 [0075.435] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.es_CL.txt") returned 1 [0075.435] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.es_CL.txt") returned -1 [0075.435] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.435] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.435] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.436] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.436] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.es_CL.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CL.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CL.txt" [0075.436] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.436] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.es_CO.txt") returned 1 [0075.436] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.es_CO.txt") returned 1 [0075.436] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.es_CO.txt") returned -1 [0075.436] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.436] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.436] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.436] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.436] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.es_CO.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CO.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CO.txt" [0075.436] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.436] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.es_CR.txt") returned 1 [0075.436] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.es_CR.txt") returned 1 [0075.436] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.es_CR.txt") returned -1 [0075.436] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.436] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.436] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.436] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.436] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.es_CR.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CR.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CR.txt" [0075.437] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.437] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.es_DO.txt") returned 1 [0075.437] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.es_DO.txt") returned 1 [0075.437] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.es_DO.txt") returned -1 [0075.437] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.437] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.437] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.437] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.437] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.es_DO.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_DO.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_DO.txt" [0075.437] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.437] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.es_EC.txt") returned 1 [0075.437] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.es_EC.txt") returned 1 [0075.437] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.es_EC.txt") returned -1 [0075.437] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.437] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.437] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.437] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.437] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.es_EC.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_EC.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_EC.txt" [0075.437] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.437] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.es_ES.txt") returned 1 [0075.437] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.es_ES.txt") returned 1 [0075.437] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.es_ES.txt") returned -1 [0075.437] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.437] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.438] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.438] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.438] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.es_ES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES.txt" [0075.438] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.438] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.es_ES_PREEURO.txt") returned 1 [0075.438] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.es_ES_PREEURO.txt") returned 1 [0075.438] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.es_ES_PREEURO.txt") returned -1 [0075.438] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.438] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.438] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.438] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.438] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.es_ES_PREEURO.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES_PREEURO.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES_PREEURO.txt" [0075.438] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.438] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.es_GT.txt") returned 1 [0075.438] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.es_GT.txt") returned 1 [0075.438] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.es_GT.txt") returned -1 [0075.438] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.438] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.438] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.439] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.439] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.es_GT.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_GT.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_GT.txt" [0075.444] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0075.444] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.es_HN.txt") returned 1 [0075.444] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.es_HN.txt") returned 1 [0075.444] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.es_HN.txt") returned -1 [0075.444] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.444] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.444] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.444] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.444] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.es_HN.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_HN.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_HN.txt" [0075.444] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="DisplayLanguageNames.es_MX.txt") returned 1 [0075.444] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DisplayLanguageNames.es_MX.txt") returned 1 [0075.444] lstrcmpiA (lpString1="", lpString2="DisplayLanguageNames.es_MX.txt") returned -1 [0075.444] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.444] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.445] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.445] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.445] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.es_MX.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt" [0075.445] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.445] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.445] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.445] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.445] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.es_NI.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_NI.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_NI.txt" [0075.445] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.445] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.446] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.446] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.446] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.es_PA.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PA.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PA.txt" [0075.446] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.446] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.446] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.446] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.446] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.es_PE.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PE.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PE.txt" [0075.446] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.446] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.446] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.446] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.447] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.es_PR.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PR.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PR.txt" [0075.447] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.447] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.447] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.447] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.447] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.es_PY.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PY.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PY.txt" [0075.447] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.447] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.447] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.447] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.447] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.es_SV.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_SV.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_SV.txt" [0075.447] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.447] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.447] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.448] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.448] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.es_US.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_US.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_US.txt" [0075.448] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.448] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.448] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.448] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.448] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.es_UY.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_UY.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_UY.txt" [0075.448] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.448] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.448] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.448] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.448] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.es_VE.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_VE.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_VE.txt" [0075.448] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.449] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.449] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.449] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.449] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.es__TRADITIONAL.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es__TRADITIONAL.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es__TRADITIONAL.txt" [0075.449] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.449] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.449] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.449] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.449] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.et.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et.txt" [0075.449] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.449] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.449] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.449] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.449] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.et_EE.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et_EE.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et_EE.txt" [0075.450] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.450] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.450] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.450] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.450] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.fi.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi.txt" [0075.450] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.450] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.450] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.450] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.450] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.fi_FI.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI.txt" [0075.450] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.450] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.450] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.450] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.451] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.fi_FI_PREEURO.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI_PREEURO.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI_PREEURO.txt" [0075.451] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.451] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.451] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.451] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.451] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.fr_CA.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_CA.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_CA.txt" [0075.451] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.451] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.451] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.451] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.451] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.fr_FR.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR.txt" [0075.451] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.451] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.451] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.452] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.452] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.fr_FR_PREEURO.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR_PREEURO.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR_PREEURO.txt" [0075.452] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.452] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.452] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.452] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.452] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.he.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he.txt" [0075.452] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.452] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.452] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.452] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.452] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.he_IL.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he_IL.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he_IL.txt" [0075.453] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.453] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.453] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.453] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.453] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.hr.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr.txt" [0075.453] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.453] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.453] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.453] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.453] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.hr_HR.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr_HR.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr_HR.txt" [0075.453] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.453] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.453] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.453] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.454] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.hu.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu.txt" [0075.454] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.454] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.454] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.454] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.454] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.hu_HU.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu_HU.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu_HU.txt" [0075.454] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.455] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.455] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.455] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.455] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.it.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it.txt" [0075.455] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.455] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.455] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.455] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.455] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.it_CH.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_CH.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_CH.txt" [0075.455] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.455] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.455] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.455] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.455] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.it_IT.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT.txt" [0075.456] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.456] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.456] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.456] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.456] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.it_IT_PREEURO.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT_PREEURO.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT_PREEURO.txt" [0075.456] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.456] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.456] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.456] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.456] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.ja.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja.txt" [0075.456] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.456] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.456] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.456] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.457] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.ja_JP.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP.txt" [0075.457] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.457] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.457] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.457] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.457] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.ja_JP_TRADITIONAL.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP_TRADITIONAL.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP_TRADITIONAL.txt" [0075.457] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.457] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.457] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.457] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.457] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.ko.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko.txt" [0075.457] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.458] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.458] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.458] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.458] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.ko_KR.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko_KR.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko_KR.txt" [0075.458] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.458] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.458] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.458] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.458] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.lt.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt.txt" [0075.458] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.458] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.458] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.458] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.459] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.lt_LT.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt_LT.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt_LT.txt" [0075.459] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.459] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.459] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.459] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.459] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.lv.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv.txt" [0075.459] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.459] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.459] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.459] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.459] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.lv_LV.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv_LV.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv_LV.txt" [0075.459] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.459] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.460] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.460] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.460] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.nb.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb.txt" [0075.460] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.460] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.460] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.460] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.460] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.nb_NO.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb_NO.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb_NO.txt" [0075.460] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.460] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.460] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="HOW TO DECRYPT FILES.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" [0075.460] GetFileAttributesA (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\HOW TO DECRYPT FILES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\how to decrypt files.txt")) returned 0x20 [0075.460] lstrcatA (in: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\", lpString2="DisplayLanguageNames.nl.txt" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl.txt" [0075.461] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" [0075.461] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\") returned="" [0075.465] FindClose (in: hFindFile=0x2e3538 | out: hFindFile=0x2e3538) returned 1 [0075.466] lstrcmpA (lpString1=".", lpString2="Providers") returned -1 [0075.466] lstrcmpA (lpString1="..", lpString2="Providers") returned -1 [0075.466] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f51c, dwReserved1=0x4f0048, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0075.466] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.466] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.466] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.466] lstrcmpA (lpString1=".", lpString2="Proximity") returned -1 [0075.466] lstrcmpA (lpString1="..", lpString2="Proximity") returned -1 [0075.466] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d6ee0, dwReserved1=0x2d6edb, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0075.467] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.467] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.467] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.467] lstrcmpA (lpString1=".", lpString2="11.00") returned -1 [0075.467] lstrcmpA (lpString1="..", lpString2="11.00") returned -1 [0075.467] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7e414bc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d7ee8, dwReserved1=0x2d7ee3, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0075.470] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.471] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.471] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.476] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.476] CloseHandle (hObject=0x9c) returned 1 [0075.490] lstrcmpA (lpString1=".", lpString2="SaslPrep") returned -1 [0075.490] lstrcmpA (lpString1="..", lpString2="SaslPrep") returned -1 [0075.491] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d5bd20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d5bd20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720050, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.492] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.492] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.492] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.494] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.494] CloseHandle (hObject=0x90) returned 1 [0075.494] lstrcmpA (lpString1=".", lpString2="TypeSupport") returned -1 [0075.494] lstrcmpA (lpString1="..", lpString2="TypeSupport") returned -1 [0075.494] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.502] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.502] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.502] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.502] lstrcmpA (lpString1=".", lpString2="Unicode") returned -1 [0075.502] lstrcmpA (lpString1="..", lpString2="Unicode") returned -1 [0075.502] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834dd660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834dd660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0075.503] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.503] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.503] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.503] lstrcmpA (lpString1=".", lpString2="ICU") returned -1 [0075.503] lstrcmpA (lpString1="..", lpString2="ICU") returned -1 [0075.503] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834dd660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x838234a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x838234a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d6ee0, dwReserved1=0x2d6edb, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0075.504] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.504] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.504] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.505] SetFileTime (hFile=0x98, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.505] CloseHandle (hObject=0x98) returned 1 [0075.505] lstrcmpA (lpString1=".", lpString2="Mappings") returned -1 [0075.505] lstrcmpA (lpString1="..", lpString2="Mappings") returned -1 [0075.505] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834450e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834450e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x590052, dwReserved1=0x540050, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0075.506] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.506] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.506] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.506] lstrcmpA (lpString1=".", lpString2="Adobe") returned -1 [0075.506] lstrcmpA (lpString1="..", lpString2="Adobe") returned -1 [0075.506] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d7ee8, dwReserved1=0x2d7ee3, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0075.508] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.508] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.508] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.509] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.512] CloseHandle (hObject=0x9c) returned 1 [0075.513] lstrcmpA (lpString1=".", lpString2="Mac") returned -1 [0075.513] lstrcmpA (lpString1="..", lpString2="Mac") returned -1 [0075.513] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48005c, dwReserved1=0x57004f, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0075.622] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.622] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.622] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.624] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.624] CloseHandle (hObject=0x9c) returned 1 [0075.625] lstrcmpA (lpString1=".", lpString2="win") returned -1 [0075.625] lstrcmpA (lpString1="..", lpString2="win") returned -1 [0075.625] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0075.789] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.789] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.789] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.821] SetFileTime (hFile=0x9c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.821] CloseHandle (hObject=0x9c) returned 1 [0075.825] lstrcmpA (lpString1=".", lpString2="Setup Files") returned -1 [0075.825] lstrcmpA (lpString1="..", lpString2="Setup Files") returned -1 [0075.825] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf66ca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf66ca0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x790054, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0075.826] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.826] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.826] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.826] lstrcmpA (lpString1=".", lpString2="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}") returned -1 [0075.826] lstrcmpA (lpString1="..", lpString2="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}") returned -1 [0075.826] lstrlenA (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}") returned 91 [0075.826] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df3c0, dwReserved1=0x2df3bb, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.830] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.830] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.830] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.830] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.832] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.832] CloseHandle (hObject=0x90) returned 1 [0075.832] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.zip") returned 0 [0075.832] lstrlenA (lpString="*.zip") returned 5 [0075.832] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.rar") returned 0 [0075.832] lstrlenA (lpString="*.rar") returned 5 [0075.832] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.7z") returned 0 [0075.832] lstrlenA (lpString="*.7z") returned 4 [0075.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.tar") returned 0 [0075.833] lstrlenA (lpString="*.tar") returned 5 [0075.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.gzip") returned 0 [0075.833] lstrlenA (lpString="*.gzip") returned 6 [0075.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.jpg") returned 0 [0075.833] lstrlenA (lpString="*.jpg") returned 5 [0075.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.jpeg") returned 0 [0075.833] lstrlenA (lpString="*.jpeg") returned 6 [0075.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.psd") returned 0 [0075.833] lstrlenA (lpString="*.psd") returned 5 [0075.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.gif") returned 0 [0075.833] lstrlenA (lpString="*.gif") returned 5 [0075.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.doc") returned 0 [0075.833] lstrlenA (lpString="*.doc") returned 5 [0075.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.docx") returned 0 [0075.833] lstrlenA (lpString="*.docx") returned 6 [0075.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.xls") returned 0 [0075.833] lstrlenA (lpString="*.xls") returned 5 [0075.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.xlsx") returned 0 [0075.833] lstrlenA (lpString="*.xlsx") returned 6 [0075.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.ppt") returned 0 [0075.833] lstrlenA (lpString="*.ppt") returned 5 [0075.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.pptx") returned 0 [0075.833] lstrlenA (lpString="*.pptx") returned 6 [0075.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.pdf") returned 0 [0075.833] lstrlenA (lpString="*.pdf") returned 5 [0075.833] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.mov") returned 0 [0075.833] lstrlenA (lpString="*.mov") returned 5 [0075.834] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.m2v") returned 0 [0075.834] lstrlenA (lpString="*.m2v") returned 5 [0075.834] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.3gp") returned 0 [0075.834] lstrlenA (lpString="*.3gp") returned 5 [0075.834] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.mpeg") returned 0 [0075.834] lstrlenA (lpString="*.mpeg") returned 6 [0075.834] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.mpg") returned 0 [0075.834] lstrlenA (lpString="*.mpg") returned 5 [0075.834] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.flv") returned 0 [0075.834] lstrlenA (lpString="*.flv") returned 5 [0075.834] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.avi") returned 0 [0075.834] lstrlenA (lpString="*.avi") returned 5 [0075.834] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.mp4") returned 0 [0075.834] lstrlenA (lpString="*.mp4") returned 5 [0075.834] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.wmv") returned 0 [0075.834] lstrlenA (lpString="*.wmv") returned 5 [0075.834] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.divx") returned 0 [0075.834] lstrlenA (lpString="*.divx") returned 6 [0075.834] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.mkv") returned 0 [0075.834] lstrlenA (lpString="*.mkv") returned 5 [0075.834] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.mp3") returned 0 [0075.834] lstrlenA (lpString="*.mp3") returned 5 [0075.834] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.wav") returned 0 [0075.834] lstrlenA (lpString="*.wav") returned 5 [0075.834] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.flac") returned 0 [0075.834] lstrlenA (lpString="*.flac") returned 6 [0075.834] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.ape") returned 0 [0075.834] lstrlenA (lpString="*.ape") returned 5 [0075.835] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.wma") returned 0 [0075.835] lstrlenA (lpString="*.wma") returned 5 [0075.835] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.ac3") returned 0 [0075.835] lstrlenA (lpString="*.ac3") returned 5 [0075.835] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", pszSpec="*.mxf") returned 0 [0075.835] lstrlenA (lpString="*.mxf") returned 5 [0075.835] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x8800, dwReserved0=0x0, dwReserved1=0x0, cFileName="1028.mst", cAlternateFileName="")) returned 1 [0075.835] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst") returned="1027.mst" [0075.835] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.835] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.837] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.zip") returned 0 [0075.837] lstrlenA (lpString="*.zip") returned 5 [0075.837] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.rar") returned 0 [0075.837] lstrlenA (lpString="*.rar") returned 5 [0075.837] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.7z") returned 0 [0075.837] lstrlenA (lpString="*.7z") returned 4 [0075.837] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.tar") returned 0 [0075.837] lstrlenA (lpString="*.tar") returned 5 [0075.837] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.gzip") returned 0 [0075.837] lstrlenA (lpString="*.gzip") returned 6 [0075.837] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.jpg") returned 0 [0075.837] lstrlenA (lpString="*.jpg") returned 5 [0075.837] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.jpeg") returned 0 [0075.837] lstrlenA (lpString="*.jpeg") returned 6 [0075.837] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.psd") returned 0 [0075.837] lstrlenA (lpString="*.psd") returned 5 [0075.837] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.gif") returned 0 [0075.837] lstrlenA (lpString="*.gif") returned 5 [0075.837] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.doc") returned 0 [0075.837] lstrlenA (lpString="*.doc") returned 5 [0075.837] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.docx") returned 0 [0075.838] lstrlenA (lpString="*.docx") returned 6 [0075.838] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.xls") returned 0 [0075.838] lstrlenA (lpString="*.xls") returned 5 [0075.838] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.xlsx") returned 0 [0075.838] lstrlenA (lpString="*.xlsx") returned 6 [0075.838] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.ppt") returned 0 [0075.838] lstrlenA (lpString="*.ppt") returned 5 [0075.838] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.pptx") returned 0 [0075.838] lstrlenA (lpString="*.pptx") returned 6 [0075.838] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.pdf") returned 0 [0075.838] lstrlenA (lpString="*.pdf") returned 5 [0075.838] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.mov") returned 0 [0075.838] lstrlenA (lpString="*.mov") returned 5 [0075.838] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.m2v") returned 0 [0075.838] lstrlenA (lpString="*.m2v") returned 5 [0075.838] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.3gp") returned 0 [0075.838] lstrlenA (lpString="*.3gp") returned 5 [0075.838] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.mpeg") returned 0 [0075.838] lstrlenA (lpString="*.mpeg") returned 6 [0075.838] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.mpg") returned 0 [0075.838] lstrlenA (lpString="*.mpg") returned 5 [0075.838] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.flv") returned 0 [0075.838] lstrlenA (lpString="*.flv") returned 5 [0075.838] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.avi") returned 0 [0075.838] lstrlenA (lpString="*.avi") returned 5 [0075.838] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.mp4") returned 0 [0075.838] lstrlenA (lpString="*.mp4") returned 5 [0075.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.wmv") returned 0 [0075.839] lstrlenA (lpString="*.wmv") returned 5 [0075.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.divx") returned 0 [0075.839] lstrlenA (lpString="*.divx") returned 6 [0075.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.mkv") returned 0 [0075.839] lstrlenA (lpString="*.mkv") returned 5 [0075.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.mp3") returned 0 [0075.839] lstrlenA (lpString="*.mp3") returned 5 [0075.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.wav") returned 0 [0075.839] lstrlenA (lpString="*.wav") returned 5 [0075.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.flac") returned 0 [0075.839] lstrlenA (lpString="*.flac") returned 6 [0075.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.ape") returned 0 [0075.839] lstrlenA (lpString="*.ape") returned 5 [0075.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.wma") returned 0 [0075.839] lstrlenA (lpString="*.wma") returned 5 [0075.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.ac3") returned 0 [0075.839] lstrlenA (lpString="*.ac3") returned 5 [0075.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", pszSpec="*.mxf") returned 0 [0075.839] lstrlenA (lpString="*.mxf") returned 5 [0075.839] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="1029.mst", cAlternateFileName="")) returned 1 [0075.839] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst") returned="1028.mst" [0075.839] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.839] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.839] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.zip") returned 0 [0075.839] lstrlenA (lpString="*.zip") returned 5 [0075.840] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.rar") returned 0 [0075.840] lstrlenA (lpString="*.rar") returned 5 [0075.840] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.7z") returned 0 [0075.840] lstrlenA (lpString="*.7z") returned 4 [0075.840] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.tar") returned 0 [0075.840] lstrlenA (lpString="*.tar") returned 5 [0075.840] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.gzip") returned 0 [0075.840] lstrlenA (lpString="*.gzip") returned 6 [0075.840] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.jpg") returned 0 [0075.840] lstrlenA (lpString="*.jpg") returned 5 [0075.840] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.jpeg") returned 0 [0075.840] lstrlenA (lpString="*.jpeg") returned 6 [0075.840] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.psd") returned 0 [0075.840] lstrlenA (lpString="*.psd") returned 5 [0075.840] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.gif") returned 0 [0075.840] lstrlenA (lpString="*.gif") returned 5 [0075.840] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.doc") returned 0 [0075.840] lstrlenA (lpString="*.doc") returned 5 [0075.840] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.docx") returned 0 [0075.840] lstrlenA (lpString="*.docx") returned 6 [0075.840] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.xls") returned 0 [0075.840] lstrlenA (lpString="*.xls") returned 5 [0075.840] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.xlsx") returned 0 [0075.840] lstrlenA (lpString="*.xlsx") returned 6 [0075.840] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.ppt") returned 0 [0075.840] lstrlenA (lpString="*.ppt") returned 5 [0075.840] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.pptx") returned 0 [0075.840] lstrlenA (lpString="*.pptx") returned 6 [0075.841] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.pdf") returned 0 [0075.841] lstrlenA (lpString="*.pdf") returned 5 [0075.841] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.mov") returned 0 [0075.841] lstrlenA (lpString="*.mov") returned 5 [0075.841] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.m2v") returned 0 [0075.841] lstrlenA (lpString="*.m2v") returned 5 [0075.841] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.3gp") returned 0 [0075.841] lstrlenA (lpString="*.3gp") returned 5 [0075.841] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.mpeg") returned 0 [0075.841] lstrlenA (lpString="*.mpeg") returned 6 [0075.841] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.mpg") returned 0 [0075.841] lstrlenA (lpString="*.mpg") returned 5 [0075.841] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.flv") returned 0 [0075.841] lstrlenA (lpString="*.flv") returned 5 [0075.841] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.avi") returned 0 [0075.841] lstrlenA (lpString="*.avi") returned 5 [0075.841] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.mp4") returned 0 [0075.841] lstrlenA (lpString="*.mp4") returned 5 [0075.841] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.wmv") returned 0 [0075.841] lstrlenA (lpString="*.wmv") returned 5 [0075.841] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.divx") returned 0 [0075.841] lstrlenA (lpString="*.divx") returned 6 [0075.841] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.mkv") returned 0 [0075.841] lstrlenA (lpString="*.mkv") returned 5 [0075.841] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.mp3") returned 0 [0075.841] lstrlenA (lpString="*.mp3") returned 5 [0075.841] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.wav") returned 0 [0075.842] lstrlenA (lpString="*.wav") returned 5 [0075.842] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.flac") returned 0 [0075.842] lstrlenA (lpString="*.flac") returned 6 [0075.842] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.ape") returned 0 [0075.842] lstrlenA (lpString="*.ape") returned 5 [0075.842] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.wma") returned 0 [0075.842] lstrlenA (lpString="*.wma") returned 5 [0075.842] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.ac3") returned 0 [0075.842] lstrlenA (lpString="*.ac3") returned 5 [0075.842] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", pszSpec="*.mxf") returned 0 [0075.842] lstrlenA (lpString="*.mxf") returned 5 [0075.842] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d55a3a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="1030.mst", cAlternateFileName="")) returned 1 [0075.842] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst") returned="1029.mst" [0075.842] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.842] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.842] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.zip") returned 0 [0075.842] lstrlenA (lpString="*.zip") returned 5 [0075.842] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.rar") returned 0 [0075.843] lstrlenA (lpString="*.rar") returned 5 [0075.843] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.7z") returned 0 [0075.843] lstrlenA (lpString="*.7z") returned 4 [0075.843] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.tar") returned 0 [0075.843] lstrlenA (lpString="*.tar") returned 5 [0075.843] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.gzip") returned 0 [0075.843] lstrlenA (lpString="*.gzip") returned 6 [0075.843] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.jpg") returned 0 [0075.843] lstrlenA (lpString="*.jpg") returned 5 [0075.843] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.jpeg") returned 0 [0075.843] lstrlenA (lpString="*.jpeg") returned 6 [0075.843] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.psd") returned 0 [0075.843] lstrlenA (lpString="*.psd") returned 5 [0075.843] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.gif") returned 0 [0075.843] lstrlenA (lpString="*.gif") returned 5 [0075.843] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.doc") returned 0 [0075.843] lstrlenA (lpString="*.doc") returned 5 [0075.843] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.docx") returned 0 [0075.843] lstrlenA (lpString="*.docx") returned 6 [0075.843] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.xls") returned 0 [0075.843] lstrlenA (lpString="*.xls") returned 5 [0075.843] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.xlsx") returned 0 [0075.843] lstrlenA (lpString="*.xlsx") returned 6 [0075.843] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.ppt") returned 0 [0075.843] lstrlenA (lpString="*.ppt") returned 5 [0075.843] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.pptx") returned 0 [0075.843] lstrlenA (lpString="*.pptx") returned 6 [0075.843] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.pdf") returned 0 [0075.844] lstrlenA (lpString="*.pdf") returned 5 [0075.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.mov") returned 0 [0075.844] lstrlenA (lpString="*.mov") returned 5 [0075.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.m2v") returned 0 [0075.844] lstrlenA (lpString="*.m2v") returned 5 [0075.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.3gp") returned 0 [0075.844] lstrlenA (lpString="*.3gp") returned 5 [0075.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.mpeg") returned 0 [0075.844] lstrlenA (lpString="*.mpeg") returned 6 [0075.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.mpg") returned 0 [0075.844] lstrlenA (lpString="*.mpg") returned 5 [0075.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.flv") returned 0 [0075.844] lstrlenA (lpString="*.flv") returned 5 [0075.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.avi") returned 0 [0075.844] lstrlenA (lpString="*.avi") returned 5 [0075.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.mp4") returned 0 [0075.844] lstrlenA (lpString="*.mp4") returned 5 [0075.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.wmv") returned 0 [0075.844] lstrlenA (lpString="*.wmv") returned 5 [0075.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.divx") returned 0 [0075.844] lstrlenA (lpString="*.divx") returned 6 [0075.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.mkv") returned 0 [0075.844] lstrlenA (lpString="*.mkv") returned 5 [0075.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.mp3") returned 0 [0075.844] lstrlenA (lpString="*.mp3") returned 5 [0075.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.wav") returned 0 [0075.844] lstrlenA (lpString="*.wav") returned 5 [0075.844] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.flac") returned 0 [0075.845] lstrlenA (lpString="*.flac") returned 6 [0075.845] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.ape") returned 0 [0075.845] lstrlenA (lpString="*.ape") returned 5 [0075.845] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.wma") returned 0 [0075.845] lstrlenA (lpString="*.wma") returned 5 [0075.845] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.ac3") returned 0 [0075.845] lstrlenA (lpString="*.ac3") returned 5 [0075.845] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", pszSpec="*.mxf") returned 0 [0075.845] lstrlenA (lpString="*.mxf") returned 5 [0075.845] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d55a3a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="1031.mst", cAlternateFileName="")) returned 1 [0075.845] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst") returned="1030.mst" [0075.845] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.845] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.845] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.zip") returned 0 [0075.845] lstrlenA (lpString="*.zip") returned 5 [0075.845] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.rar") returned 0 [0075.845] lstrlenA (lpString="*.rar") returned 5 [0075.845] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.7z") returned 0 [0075.845] lstrlenA (lpString="*.7z") returned 4 [0075.845] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.tar") returned 0 [0075.845] lstrlenA (lpString="*.tar") returned 5 [0075.845] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.gzip") returned 0 [0075.845] lstrlenA (lpString="*.gzip") returned 6 [0075.845] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.jpg") returned 0 [0075.845] lstrlenA (lpString="*.jpg") returned 5 [0075.845] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.jpeg") returned 0 [0075.846] lstrlenA (lpString="*.jpeg") returned 6 [0075.846] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.psd") returned 0 [0075.846] lstrlenA (lpString="*.psd") returned 5 [0075.846] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.gif") returned 0 [0075.846] lstrlenA (lpString="*.gif") returned 5 [0075.846] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.doc") returned 0 [0075.846] lstrlenA (lpString="*.doc") returned 5 [0075.846] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.docx") returned 0 [0075.846] lstrlenA (lpString="*.docx") returned 6 [0075.846] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.xls") returned 0 [0075.846] lstrlenA (lpString="*.xls") returned 5 [0075.846] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.xlsx") returned 0 [0075.846] lstrlenA (lpString="*.xlsx") returned 6 [0075.846] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.ppt") returned 0 [0075.846] lstrlenA (lpString="*.ppt") returned 5 [0075.846] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.pptx") returned 0 [0075.846] lstrlenA (lpString="*.pptx") returned 6 [0075.846] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.pdf") returned 0 [0075.846] lstrlenA (lpString="*.pdf") returned 5 [0075.846] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.mov") returned 0 [0075.846] lstrlenA (lpString="*.mov") returned 5 [0075.846] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.m2v") returned 0 [0075.846] lstrlenA (lpString="*.m2v") returned 5 [0075.846] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.3gp") returned 0 [0075.846] lstrlenA (lpString="*.3gp") returned 5 [0075.846] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.mpeg") returned 0 [0075.846] lstrlenA (lpString="*.mpeg") returned 6 [0075.846] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.mpg") returned 0 [0075.847] lstrlenA (lpString="*.mpg") returned 5 [0075.847] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.flv") returned 0 [0075.847] lstrlenA (lpString="*.flv") returned 5 [0075.847] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.avi") returned 0 [0075.847] lstrlenA (lpString="*.avi") returned 5 [0075.847] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.mp4") returned 0 [0075.847] lstrlenA (lpString="*.mp4") returned 5 [0075.847] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.wmv") returned 0 [0075.847] lstrlenA (lpString="*.wmv") returned 5 [0075.847] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.divx") returned 0 [0075.847] lstrlenA (lpString="*.divx") returned 6 [0075.847] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.mkv") returned 0 [0075.847] lstrlenA (lpString="*.mkv") returned 5 [0075.847] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.mp3") returned 0 [0075.847] lstrlenA (lpString="*.mp3") returned 5 [0075.847] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.wav") returned 0 [0075.847] lstrlenA (lpString="*.wav") returned 5 [0075.847] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.flac") returned 0 [0075.847] lstrlenA (lpString="*.flac") returned 6 [0075.847] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.ape") returned 0 [0075.847] lstrlenA (lpString="*.ape") returned 5 [0075.847] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.wma") returned 0 [0075.847] lstrlenA (lpString="*.wma") returned 5 [0075.847] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.ac3") returned 0 [0075.847] lstrlenA (lpString="*.ac3") returned 5 [0075.847] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", pszSpec="*.mxf") returned 0 [0075.847] lstrlenA (lpString="*.mxf") returned 5 [0075.847] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d55a3a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="1033.mst", cAlternateFileName="")) returned 1 [0075.848] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst") returned="1031.mst" [0075.848] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.848] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.848] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.zip") returned 0 [0075.848] lstrlenA (lpString="*.zip") returned 5 [0075.848] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.rar") returned 0 [0075.848] lstrlenA (lpString="*.rar") returned 5 [0075.848] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.7z") returned 0 [0075.848] lstrlenA (lpString="*.7z") returned 4 [0075.848] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.tar") returned 0 [0075.848] lstrlenA (lpString="*.tar") returned 5 [0075.848] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.gzip") returned 0 [0075.848] lstrlenA (lpString="*.gzip") returned 6 [0075.848] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.jpg") returned 0 [0075.848] lstrlenA (lpString="*.jpg") returned 5 [0075.848] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.jpeg") returned 0 [0075.848] lstrlenA (lpString="*.jpeg") returned 6 [0075.848] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.psd") returned 0 [0075.848] lstrlenA (lpString="*.psd") returned 5 [0075.848] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.gif") returned 0 [0075.848] lstrlenA (lpString="*.gif") returned 5 [0075.848] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.doc") returned 0 [0075.848] lstrlenA (lpString="*.doc") returned 5 [0075.848] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.docx") returned 0 [0075.848] lstrlenA (lpString="*.docx") returned 6 [0075.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.xls") returned 0 [0075.849] lstrlenA (lpString="*.xls") returned 5 [0075.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.xlsx") returned 0 [0075.849] lstrlenA (lpString="*.xlsx") returned 6 [0075.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.ppt") returned 0 [0075.849] lstrlenA (lpString="*.ppt") returned 5 [0075.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.pptx") returned 0 [0075.849] lstrlenA (lpString="*.pptx") returned 6 [0075.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.pdf") returned 0 [0075.849] lstrlenA (lpString="*.pdf") returned 5 [0075.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.mov") returned 0 [0075.849] lstrlenA (lpString="*.mov") returned 5 [0075.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.m2v") returned 0 [0075.849] lstrlenA (lpString="*.m2v") returned 5 [0075.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.3gp") returned 0 [0075.849] lstrlenA (lpString="*.3gp") returned 5 [0075.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.mpeg") returned 0 [0075.849] lstrlenA (lpString="*.mpeg") returned 6 [0075.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.mpg") returned 0 [0075.849] lstrlenA (lpString="*.mpg") returned 5 [0075.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.flv") returned 0 [0075.849] lstrlenA (lpString="*.flv") returned 5 [0075.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.avi") returned 0 [0075.849] lstrlenA (lpString="*.avi") returned 5 [0075.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.mp4") returned 0 [0075.849] lstrlenA (lpString="*.mp4") returned 5 [0075.849] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.wmv") returned 0 [0075.849] lstrlenA (lpString="*.wmv") returned 5 [0075.850] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.divx") returned 0 [0075.850] lstrlenA (lpString="*.divx") returned 6 [0075.850] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.mkv") returned 0 [0075.850] lstrlenA (lpString="*.mkv") returned 5 [0075.850] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.mp3") returned 0 [0075.850] lstrlenA (lpString="*.mp3") returned 5 [0075.850] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.wav") returned 0 [0075.850] lstrlenA (lpString="*.wav") returned 5 [0075.850] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.flac") returned 0 [0075.850] lstrlenA (lpString="*.flac") returned 6 [0075.850] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.ape") returned 0 [0075.850] lstrlenA (lpString="*.ape") returned 5 [0075.850] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.wma") returned 0 [0075.850] lstrlenA (lpString="*.wma") returned 5 [0075.850] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.ac3") returned 0 [0075.850] lstrlenA (lpString="*.ac3") returned 5 [0075.850] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", pszSpec="*.mxf") returned 0 [0075.850] lstrlenA (lpString="*.mxf") returned 5 [0075.850] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d55a3a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0xc400, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="1034.mst", cAlternateFileName="")) returned 1 [0075.850] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst") returned="1033.mst" [0075.850] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.850] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.850] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.zip") returned 0 [0075.850] lstrlenA (lpString="*.zip") returned 5 [0075.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.rar") returned 0 [0075.851] lstrlenA (lpString="*.rar") returned 5 [0075.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.7z") returned 0 [0075.851] lstrlenA (lpString="*.7z") returned 4 [0075.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.tar") returned 0 [0075.851] lstrlenA (lpString="*.tar") returned 5 [0075.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.gzip") returned 0 [0075.851] lstrlenA (lpString="*.gzip") returned 6 [0075.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.jpg") returned 0 [0075.851] lstrlenA (lpString="*.jpg") returned 5 [0075.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.jpeg") returned 0 [0075.851] lstrlenA (lpString="*.jpeg") returned 6 [0075.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.psd") returned 0 [0075.851] lstrlenA (lpString="*.psd") returned 5 [0075.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.gif") returned 0 [0075.851] lstrlenA (lpString="*.gif") returned 5 [0075.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.doc") returned 0 [0075.851] lstrlenA (lpString="*.doc") returned 5 [0075.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.docx") returned 0 [0075.851] lstrlenA (lpString="*.docx") returned 6 [0075.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.xls") returned 0 [0075.851] lstrlenA (lpString="*.xls") returned 5 [0075.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.xlsx") returned 0 [0075.851] lstrlenA (lpString="*.xlsx") returned 6 [0075.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.ppt") returned 0 [0075.851] lstrlenA (lpString="*.ppt") returned 5 [0075.851] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.pptx") returned 0 [0075.851] lstrlenA (lpString="*.pptx") returned 6 [0075.852] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.pdf") returned 0 [0075.852] lstrlenA (lpString="*.pdf") returned 5 [0075.852] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.mov") returned 0 [0075.852] lstrlenA (lpString="*.mov") returned 5 [0075.852] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.m2v") returned 0 [0075.852] lstrlenA (lpString="*.m2v") returned 5 [0075.852] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.3gp") returned 0 [0075.852] lstrlenA (lpString="*.3gp") returned 5 [0075.852] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.mpeg") returned 0 [0075.852] lstrlenA (lpString="*.mpeg") returned 6 [0075.852] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.mpg") returned 0 [0075.852] lstrlenA (lpString="*.mpg") returned 5 [0075.852] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.flv") returned 0 [0075.852] lstrlenA (lpString="*.flv") returned 5 [0075.852] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.avi") returned 0 [0075.852] lstrlenA (lpString="*.avi") returned 5 [0075.852] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.mp4") returned 0 [0075.852] lstrlenA (lpString="*.mp4") returned 5 [0075.852] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.wmv") returned 0 [0075.852] lstrlenA (lpString="*.wmv") returned 5 [0075.852] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.divx") returned 0 [0075.852] lstrlenA (lpString="*.divx") returned 6 [0075.852] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.mkv") returned 0 [0075.852] lstrlenA (lpString="*.mkv") returned 5 [0075.852] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.mp3") returned 0 [0075.852] lstrlenA (lpString="*.mp3") returned 5 [0075.852] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.wav") returned 0 [0075.852] lstrlenA (lpString="*.wav") returned 5 [0075.852] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.flac") returned 0 [0075.853] lstrlenA (lpString="*.flac") returned 6 [0075.853] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.ape") returned 0 [0075.853] lstrlenA (lpString="*.ape") returned 5 [0075.853] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.wma") returned 0 [0075.853] lstrlenA (lpString="*.wma") returned 5 [0075.853] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.ac3") returned 0 [0075.853] lstrlenA (lpString="*.ac3") returned 5 [0075.853] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst", pszSpec="*.mxf") returned 0 [0075.853] lstrlenA (lpString="*.mxf") returned 5 [0075.853] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d534240, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0xb600, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="1035.mst", cAlternateFileName="")) returned 1 [0075.853] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1034.mst") returned="1034.mst" [0075.853] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.853] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.853] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1035.mst", pszSpec="*.zip") returned 0 [0075.853] lstrlenA (lpString="*.zip") returned 5 [0075.853] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1035.mst", pszSpec="*.rar") returned 0 [0075.853] lstrlenA (lpString="*.rar") returned 5 [0075.853] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1035.mst", pszSpec="*.7z") returned 0 [0075.853] lstrlenA (lpString="*.7z") returned 4 [0075.853] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1035.mst", pszSpec="*.tar") returned 0 [0075.853] lstrlenA (lpString="*.tar") returned 5 [0075.853] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1035.mst", pszSpec="*.gzip") returned 0 [0075.853] lstrlenA (lpString="*.gzip") returned 6 [0075.853] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1035.mst", pszSpec="*.jpg") returned 0 [0075.853] lstrlenA (lpString="*.jpg") returned 5 [0075.854] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1035.mst", pszSpec="*.jpeg") returned 0 [0075.854] lstrlenA (lpString="*.jpeg") returned 6 [0075.854] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1035.mst", pszSpec="*.psd") returned 0 [0075.854] lstrlenA (lpString="*.psd") returned 5 [0075.854] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1035.mst", pszSpec="*.gif") returned 0 [0075.854] lstrlenA (lpString="*.gif") returned 5 [0075.854] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1035.mst", pszSpec="*.doc") returned 0 [0075.854] lstrlenA (lpString="*.doc") returned 5 [0075.854] PathMatchSpecA (pszFile="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1035.mst", pszSpec="*.docx") returned 0 [0075.854] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d534240, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="1036.mst", cAlternateFileName="")) returned 1 [0075.854] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1035.mst") returned="1035.mst" [0075.854] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.854] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.854] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d534240, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="1038.mst", cAlternateFileName="")) returned 1 [0075.854] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1036.mst") returned="1036.mst" [0075.854] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.854] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.855] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d534240, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0xcc00, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="1040.mst", cAlternateFileName="")) returned 1 [0075.855] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1038.mst") returned="1038.mst" [0075.855] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.855] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.855] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d534240, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="1041.mst", cAlternateFileName="")) returned 1 [0075.855] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1040.mst") returned="1040.mst" [0075.855] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.855] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.855] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d534240, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0xae00, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="1042.mst", cAlternateFileName="")) returned 1 [0075.855] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1041.mst") returned="1041.mst" [0075.855] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.855] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.855] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d534240, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="1043.mst", cAlternateFileName="")) returned 1 [0075.855] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1042.mst") returned="1042.mst" [0075.855] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.855] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.856] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d50e0e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0xb400, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="1044.mst", cAlternateFileName="")) returned 1 [0075.856] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1043.mst") returned="1043.mst" [0075.856] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.856] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.856] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d50e0e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x9400, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="1045.mst", cAlternateFileName="")) returned 1 [0075.856] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1044.mst") returned="1044.mst" [0075.856] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.856] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.856] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d50e0e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0xbe00, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="1046.mst", cAlternateFileName="")) returned 1 [0075.856] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1045.mst") returned="1045.mst" [0075.856] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.856] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.856] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d50e0e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="1048.mst", cAlternateFileName="")) returned 1 [0075.856] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1046.mst") returned="1046.mst" [0075.856] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.857] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.857] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d50e0e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x9400, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="1049.mst", cAlternateFileName="")) returned 1 [0075.857] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1048.mst") returned="1048.mst" [0075.857] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.857] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.857] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d50e0e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x9600, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="1050.mst", cAlternateFileName="")) returned 1 [0075.857] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1049.mst") returned="1049.mst" [0075.857] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.857] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.857] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d50e0e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x9600, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="1051.mst", cAlternateFileName="")) returned 1 [0075.858] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1050.mst") returned="1050.mst" [0075.858] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.858] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.858] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d50e0e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0xb400, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="1053.mst", cAlternateFileName="")) returned 1 [0075.858] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1051.mst") returned="1051.mst" [0075.858] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.858] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.858] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d50e0e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x9200, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="1055.mst", cAlternateFileName="")) returned 1 [0075.858] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1053.mst") returned="1053.mst" [0075.858] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.858] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.858] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d4e7f80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x9200, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="1058.mst", cAlternateFileName="")) returned 1 [0075.858] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1055.mst") returned="1055.mst" [0075.858] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.858] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.859] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d4e7f80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x9600, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="1060.mst", cAlternateFileName="")) returned 1 [0075.859] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1058.mst") returned="1058.mst" [0075.859] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.859] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.859] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d4e7f80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="1069.mst", cAlternateFileName="")) returned 1 [0075.859] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1060.mst") returned="1060.mst" [0075.859] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.859] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.859] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d4e7f80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x8c00, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="2052.mst", cAlternateFileName="")) returned 1 [0075.859] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1069.mst") returned="1069.mst" [0075.859] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.859] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.859] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d4e7f80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x6c1, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="ABCPY.INI", cAlternateFileName="")) returned 1 [0075.859] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\2052.mst") returned="2052.mst" [0075.859] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.859] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.860] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d4e7f80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x268000, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="AcroRead.msi", cAlternateFileName="")) returned 1 [0075.860] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\ABCPY.INI") returned="ABCPY.INI" [0075.860] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.860] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.860] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc69b0a00, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7d4c1e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc69b0a00, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x7a3f7f7, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="Data1.cab", cAlternateFileName="")) returned 1 [0075.860] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\AcroRead.msi") returned="AcroRead.msi" [0075.860] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.860] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.860] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7cfd90c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x525c8, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0075.860] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\Data1.cab") returned="Data1.cab" [0075.860] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.860] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.860] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7cfd90c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="setup.ini", cAlternateFileName="")) returned 1 [0075.860] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\Setup.exe") returned="Setup.exe" [0075.861] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" [0075.861] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\") returned="" [0075.861] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xc438b000, ftCreationTime.dwHighDateTime=0x1d0cebb, ftLastAccessTime.dwLowDateTime=0x7cfd90c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xc438b000, ftLastWriteTime.dwHighDateTime=0x1d0cebb, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x300030, dwReserved1=0x300030, cFileName="setup.ini", cAlternateFileName="")) returned 0 [0075.861] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.861] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", cAlternateFileName="{AC76B~1")) returned 0 [0075.861] FindClose (in: hFindFile=0x2e34b8 | out: hFindFile=0x2e34b8) returned 1 [0075.861] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41c1, dwReserved0=0x650053, dwReserved1=0x3, cFileName="Vigtigt.htm", cAlternateFileName="")) returned 1 [0075.861] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\*.*") returned="*.*" [0075.861] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0075.861] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="" [0075.861] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Viktig.htm", cAlternateFileName="")) returned 1 [0075.861] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm") returned="Vigtigt.htm" [0075.861] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0075.861] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="" [0075.861] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4214, dwReserved0=0x0, dwReserved1=0x0, cFileName="Viktigt.htm", cAlternateFileName="")) returned 1 [0075.862] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm") returned="Viktig.htm" [0075.862] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0075.862] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="" [0075.862] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4214, dwReserved0=0x0, dwReserved1=0x0, cFileName="Viktigt.htm", cAlternateFileName="")) returned 0 [0075.862] FindClose (in: hFindFile=0x2e3478 | out: hFindFile=0x2e3478) returned 1 [0075.862] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7107fc50, ftCreationTime.dwHighDateTime=0x1d59a69, ftLastAccessTime.dwLowDateTime=0xf838c0f0, ftLastAccessTime.dwHighDateTime=0x1d5cf2b, ftLastWriteTime.dwLowDateTime=0xf838c0f0, ftLastWriteTime.dwHighDateTime=0x1d5cf2b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="trillian.exe", cAlternateFileName="")) returned 1 [0075.862] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Adobe\\*.*") returned="*.*" [0075.862] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Adobe\\" | out: lpString1="C:\\Program Files (x86)\\Adobe\\") returned="C:\\Program Files (x86)\\Adobe\\" [0075.862] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Adobe\\" | out: pszPath="C:\\Program Files (x86)\\Adobe\\") returned="" [0075.862] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7107fc50, ftCreationTime.dwHighDateTime=0x1d59a69, ftLastAccessTime.dwLowDateTime=0xf838c0f0, ftLastAccessTime.dwHighDateTime=0x1d5cf2b, ftLastWriteTime.dwLowDateTime=0xf838c0f0, ftLastWriteTime.dwHighDateTime=0x1d5cf2b, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="trillian.exe", cAlternateFileName="")) returned 0 [0075.862] FindClose (in: hFindFile=0x2e33f8 | out: hFindFile=0x2e33f8) returned 1 [0075.862] FindNextFileA (in: hFindFile=0x2e3438, lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdd8a8960, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd8a8960, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0075.862] lstrcmpA (lpString1=".", lpString2="Common Files") returned -1 [0075.862] lstrcmpA (lpString1="..", lpString2="Common Files") returned -1 [0075.862] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\*.*") returned="*.*" [0075.862] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdd8a8960, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd8a8960, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0075.863] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.863] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdd8a8960, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd8a8960, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.863] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.863] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.863] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0075.863] lstrcmpA (lpString1=".", lpString2="Adobe") returned -1 [0075.863] lstrcmpA (lpString1="..", lpString2="Adobe") returned -1 [0075.863] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\*.*") returned="*.*" [0075.863] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0075.863] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.863] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0075.863] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.863] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.863] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf1a9e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf1a9e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0075.863] lstrcmpA (lpString1=".", lpString2="Acrobat") returned -1 [0075.863] lstrcmpA (lpString1="..", lpString2="Acrobat") returned -1 [0075.863] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\*.*") returned="*.*" [0075.864] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf1a9e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf1a9e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df3c0, dwReserved1=0x2df3bb, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0075.864] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.864] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf1a9e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf1a9e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0075.864] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.864] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.864] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ActiveX", cAlternateFileName="")) returned 1 [0075.864] lstrcmpA (lpString1=".", lpString2="ActiveX") returned -1 [0075.864] lstrcmpA (lpString1="..", lpString2="ActiveX") returned -1 [0075.864] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\*.*") returned="*.*" [0075.864] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.865] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.865] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0075.866] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.866] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.866] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d912600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfda0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AcroIEHelper.dll", cAlternateFileName="ACROIE~1.DLL")) returned 1 [0075.866] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\*.*") returned="*.*" [0075.866] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.867] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.868] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.868] CloseHandle (hObject=0xffffffff) returned 0 [0075.868] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xf3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroIEHelperShim.dll", cAlternateFileName="ACROIE~2.DLL")) returned 1 [0075.868] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelper.dll") returned="AcroIEHelper.dll" [0075.868] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.868] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.868] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.868] CloseHandle (hObject=0xffffffff) returned 0 [0075.868] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.CAT", cAlternateFileName="")) returned 1 [0075.868] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroIEHelperShim.dll") returned="AcroIEHelperShim.dll" [0075.868] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.868] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.868] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.868] CloseHandle (hObject=0xffffffff) returned 0 [0075.869] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8ec4a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.CHS", cAlternateFileName="")) returned 1 [0075.869] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CAT") returned="AcroPDF.CAT" [0075.869] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.869] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.869] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.869] CloseHandle (hObject=0xffffffff) returned 0 [0075.869] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8ec4a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.CHT", cAlternateFileName="")) returned 1 [0075.869] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CHS") returned="AcroPDF.CHS" [0075.869] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.869] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.869] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.869] CloseHandle (hObject=0xffffffff) returned 0 [0075.869] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.CZE", cAlternateFileName="")) returned 1 [0075.870] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CHT") returned="AcroPDF.CHT" [0075.870] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.870] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.870] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.870] CloseHandle (hObject=0xffffffff) returned 0 [0075.870] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8ec4a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.DAN", cAlternateFileName="")) returned 1 [0075.870] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CZE") returned="AcroPDF.CZE" [0075.870] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.870] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.870] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.870] CloseHandle (hObject=0xffffffff) returned 0 [0075.870] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8ec4a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.DEU", cAlternateFileName="")) returned 1 [0075.870] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.DAN") returned="AcroPDF.DAN" [0075.870] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.870] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.871] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.871] CloseHandle (hObject=0xffffffff) returned 0 [0075.871] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d912600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xab790, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.dll", cAlternateFileName="")) returned 1 [0075.871] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.DEU") returned="AcroPDF.DEU" [0075.871] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.871] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.871] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.871] CloseHandle (hObject=0xffffffff) returned 0 [0075.871] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8ec4a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.ESP", cAlternateFileName="")) returned 1 [0075.871] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.dll") returned="AcroPDF.dll" [0075.871] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.871] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.871] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.872] CloseHandle (hObject=0xffffffff) returned 0 [0075.872] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.EUQ", cAlternateFileName="")) returned 1 [0075.872] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.ESP") returned="AcroPDF.ESP" [0075.872] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.872] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.872] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.872] CloseHandle (hObject=0xffffffff) returned 0 [0075.872] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8ec4a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.FRA", cAlternateFileName="")) returned 1 [0075.872] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.EUQ") returned="AcroPDF.EUQ" [0075.872] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.872] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.872] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.872] CloseHandle (hObject=0xffffffff) returned 0 [0075.873] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.HRV", cAlternateFileName="")) returned 1 [0075.873] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.FRA") returned="AcroPDF.FRA" [0075.873] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.873] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.873] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.873] CloseHandle (hObject=0xffffffff) returned 0 [0075.873] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.HUN", cAlternateFileName="")) returned 1 [0075.873] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.HRV") returned="AcroPDF.HRV" [0075.873] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.873] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.873] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.873] CloseHandle (hObject=0xffffffff) returned 0 [0075.873] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8c6340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.ITA", cAlternateFileName="")) returned 1 [0075.874] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.HUN") returned="AcroPDF.HUN" [0075.874] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.874] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.874] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.874] CloseHandle (hObject=0xffffffff) returned 0 [0075.874] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8c6340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4be00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.JPN", cAlternateFileName="")) returned 1 [0075.874] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.ITA") returned="AcroPDF.ITA" [0075.874] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.874] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.874] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.874] CloseHandle (hObject=0xffffffff) returned 0 [0075.874] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8c6340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4be00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.KOR", cAlternateFileName="")) returned 1 [0075.874] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.JPN") returned="AcroPDF.JPN" [0075.874] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.875] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.875] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.875] CloseHandle (hObject=0xffffffff) returned 0 [0075.875] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8c6340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.NLD", cAlternateFileName="")) returned 1 [0075.875] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.KOR") returned="AcroPDF.KOR" [0075.875] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.875] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.875] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.875] CloseHandle (hObject=0xffffffff) returned 0 [0075.875] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8c6340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.NOR", cAlternateFileName="")) returned 1 [0075.875] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.NLD") returned="AcroPDF.NLD" [0075.875] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.875] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.876] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.876] CloseHandle (hObject=0xffffffff) returned 0 [0075.876] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.POL", cAlternateFileName="")) returned 1 [0075.876] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.NOR") returned="AcroPDF.NOR" [0075.876] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.876] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.876] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.876] CloseHandle (hObject=0xffffffff) returned 0 [0075.876] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8c6340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.PTB", cAlternateFileName="")) returned 1 [0075.876] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.POL") returned="AcroPDF.POL" [0075.876] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.876] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.876] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.876] CloseHandle (hObject=0xffffffff) returned 0 [0075.877] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.RUM", cAlternateFileName="")) returned 1 [0075.877] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.PTB") returned="AcroPDF.PTB" [0075.877] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.877] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.877] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.877] CloseHandle (hObject=0xffffffff) returned 0 [0075.877] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.RUS", cAlternateFileName="")) returned 1 [0075.877] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.RUM") returned="AcroPDF.RUM" [0075.877] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.877] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.877] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.877] CloseHandle (hObject=0xffffffff) returned 0 [0075.877] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.SKY", cAlternateFileName="")) returned 1 [0075.877] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.RUS") returned="AcroPDF.RUS" [0075.878] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.878] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.878] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.878] CloseHandle (hObject=0xffffffff) returned 0 [0075.878] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.SLV", cAlternateFileName="")) returned 1 [0075.878] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SKY") returned="AcroPDF.SKY" [0075.878] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.878] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.878] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.878] CloseHandle (hObject=0xffffffff) returned 0 [0075.878] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8c6340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.SUO", cAlternateFileName="")) returned 1 [0075.878] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SLV") returned="AcroPDF.SLV" [0075.878] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.878] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.879] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.879] CloseHandle (hObject=0xffffffff) returned 0 [0075.879] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8a01e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.SVE", cAlternateFileName="")) returned 1 [0075.879] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SUO") returned="AcroPDF.SUO" [0075.879] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.879] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.879] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.879] CloseHandle (hObject=0xffffffff) returned 0 [0075.879] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.TUR", cAlternateFileName="")) returned 1 [0075.879] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SVE") returned="AcroPDF.SVE" [0075.879] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.879] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.879] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.880] CloseHandle (hObject=0xffffffff) returned 0 [0075.880] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.UKR", cAlternateFileName="")) returned 1 [0075.880] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.TUR") returned="AcroPDF.TUR" [0075.880] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.880] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.880] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.880] CloseHandle (hObject=0xffffffff) returned 0 [0075.880] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.CAT", cAlternateFileName="")) returned 1 [0075.880] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.UKR") returned="AcroPDF.UKR" [0075.880] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.880] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.880] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.880] CloseHandle (hObject=0xffffffff) returned 0 [0075.881] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.CHS", cAlternateFileName="")) returned 1 [0075.881] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CAT") returned="PDFShell.CAT" [0075.881] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.881] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.881] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.881] CloseHandle (hObject=0xffffffff) returned 0 [0075.881] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.CHT", cAlternateFileName="")) returned 1 [0075.881] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHS") returned="PDFShell.CHS" [0075.881] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.881] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.881] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.881] CloseHandle (hObject=0xffffffff) returned 0 [0075.881] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.CZE", cAlternateFileName="")) returned 1 [0075.881] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHT") returned="PDFShell.CHT" [0075.882] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.882] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.882] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.882] CloseHandle (hObject=0xffffffff) returned 0 [0075.882] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.DAN", cAlternateFileName="")) returned 1 [0075.883] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CZE") returned="PDFShell.CZE" [0075.883] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.883] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.883] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.883] CloseHandle (hObject=0xffffffff) returned 0 [0075.883] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.DEU", cAlternateFileName="")) returned 1 [0075.883] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.DAN") returned="PDFShell.DAN" [0075.884] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.884] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.884] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.884] CloseHandle (hObject=0xffffffff) returned 0 [0075.884] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8051bd00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5f598, dwReserved0=0x0, dwReserved1=0x0, cFileName="pdfshell.dll", cAlternateFileName="")) returned 1 [0075.884] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.DEU") returned="PDFShell.DEU" [0075.884] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.884] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.884] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.884] CloseHandle (hObject=0xffffffff) returned 0 [0075.884] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80567fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.ESP", cAlternateFileName="")) returned 1 [0075.884] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\pdfshell.dll") returned="pdfshell.dll" [0075.884] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.884] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.885] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.885] CloseHandle (hObject=0xffffffff) returned 0 [0075.885] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.EUQ", cAlternateFileName="")) returned 1 [0075.885] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.ESP") returned="PDFShell.ESP" [0075.885] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.885] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.885] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.885] CloseHandle (hObject=0xffffffff) returned 0 [0075.885] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80567fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.FRA", cAlternateFileName="")) returned 1 [0075.885] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.EUQ") returned="PDFShell.EUQ" [0075.885] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.885] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.886] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.886] CloseHandle (hObject=0xffffffff) returned 0 [0075.886] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.HRV", cAlternateFileName="")) returned 1 [0075.886] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.FRA") returned="PDFShell.FRA" [0075.886] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.886] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.886] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.886] CloseHandle (hObject=0xffffffff) returned 0 [0075.886] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.HUN", cAlternateFileName="")) returned 1 [0075.886] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.HRV") returned="PDFShell.HRV" [0075.886] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.886] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.886] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.887] CloseHandle (hObject=0xffffffff) returned 0 [0075.887] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80567fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.ITA", cAlternateFileName="")) returned 1 [0075.887] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.HUN") returned="PDFShell.HUN" [0075.887] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.887] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.887] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.887] CloseHandle (hObject=0xffffffff) returned 0 [0075.887] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80567fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.JPN", cAlternateFileName="")) returned 1 [0075.887] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.ITA") returned="PDFShell.ITA" [0075.887] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.887] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.887] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.887] CloseHandle (hObject=0xffffffff) returned 0 [0075.888] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80567fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.KOR", cAlternateFileName="")) returned 1 [0075.888] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.JPN") returned="PDFShell.JPN" [0075.888] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.888] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.888] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.888] CloseHandle (hObject=0xffffffff) returned 0 [0075.888] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80567fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.NLD", cAlternateFileName="")) returned 1 [0075.888] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.KOR") returned="PDFShell.KOR" [0075.888] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.888] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.888] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.888] CloseHandle (hObject=0xffffffff) returned 0 [0075.888] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80567fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.NOR", cAlternateFileName="")) returned 1 [0075.889] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.NLD") returned="PDFShell.NLD" [0075.889] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.889] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.889] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.889] CloseHandle (hObject=0xffffffff) returned 0 [0075.889] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.POL", cAlternateFileName="")) returned 1 [0075.889] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.NOR") returned="PDFShell.NOR" [0075.889] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.889] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.889] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.889] CloseHandle (hObject=0xffffffff) returned 0 [0075.889] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80541e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.PTB", cAlternateFileName="")) returned 1 [0075.889] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.POL") returned="PDFShell.POL" [0075.890] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.890] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.890] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.890] CloseHandle (hObject=0xffffffff) returned 0 [0075.890] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.RUM", cAlternateFileName="")) returned 1 [0075.890] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.PTB") returned="PDFShell.PTB" [0075.890] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.890] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.890] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.890] CloseHandle (hObject=0xffffffff) returned 0 [0075.890] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d35bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.RUS", cAlternateFileName="")) returned 1 [0075.890] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.RUM") returned="PDFShell.RUM" [0075.890] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.890] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.891] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.891] CloseHandle (hObject=0xffffffff) returned 0 [0075.891] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d35bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.SKY", cAlternateFileName="")) returned 1 [0075.891] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.RUS") returned="PDFShell.RUS" [0075.891] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.891] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.891] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.891] CloseHandle (hObject=0xffffffff) returned 0 [0075.891] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d35bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.SLV", cAlternateFileName="")) returned 1 [0075.891] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SKY") returned="PDFShell.SKY" [0075.891] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.891] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.892] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.892] CloseHandle (hObject=0xffffffff) returned 0 [0075.892] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.SUO", cAlternateFileName="")) returned 1 [0075.892] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SLV") returned="PDFShell.SLV" [0075.892] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.892] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.892] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.892] CloseHandle (hObject=0xffffffff) returned 0 [0075.892] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.SVE", cAlternateFileName="")) returned 1 [0075.892] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SUO") returned="PDFShell.SUO" [0075.892] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.892] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.892] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.893] CloseHandle (hObject=0xffffffff) returned 0 [0075.893] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d35bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.TUR", cAlternateFileName="")) returned 1 [0075.893] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SVE") returned="PDFShell.SVE" [0075.893] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.893] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.893] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.893] CloseHandle (hObject=0xffffffff) returned 0 [0075.893] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d35bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.UKR", cAlternateFileName="")) returned 1 [0075.894] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.TUR") returned="PDFShell.TUR" [0075.894] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0075.894] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="" [0075.894] SetFileTime (hFile=0xffffffff, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 0 [0075.894] CloseHandle (hObject=0xffffffff) returned 0 [0075.894] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d35bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.UKR", cAlternateFileName="")) returned 0 [0075.894] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.895] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ActiveX", cAlternateFileName="")) returned 0 [0075.895] FindClose (in: hFindFile=0x2e34b8 | out: hFindFile=0x2e34b8) returned 1 [0075.895] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630041, dwReserved1=0x3, cFileName="ARM", cAlternateFileName="")) returned 1 [0075.895] lstrcmpA (lpString1=".", lpString2="ARM") returned -1 [0075.895] lstrcmpA (lpString1="..", lpString2="ARM") returned -1 [0075.895] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\*.*") returned="*.*" [0075.896] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0075.896] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.896] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.896] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.896] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.896] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 1 [0075.896] lstrcmpA (lpString1=".", lpString2="1.0") returned -1 [0075.896] lstrcmpA (lpString1="..", lpString2="1.0") returned -1 [0075.896] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\*.*") returned="*.*" [0075.896] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.896] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.896] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0075.896] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.896] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.896] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x838958c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x52ba8, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="AcrobatUpdater.exe", cAlternateFileName="ACROBA~1.EXE")) returned 1 [0075.897] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\*.*") returned="*.*" [0075.897] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\" [0075.897] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\") returned="" [0075.900] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.900] CloseHandle (hObject=0x90) returned 1 [0075.900] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe39c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeARM.exe", cAlternateFileName="")) returned 1 [0075.900] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AcrobatUpdater.exe") returned="AcrobatUpdater.exe" [0075.900] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\" [0075.900] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\") returned="" [0075.900] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x113b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeExtractFiles.dll", cAlternateFileName="ADOBEE~1.DLL")) returned 1 [0075.900] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe") returned="AdobeARM.exe" [0075.900] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\" [0075.901] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\") returned="" [0075.901] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x52ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReaderUpdater.exe", cAlternateFileName="READER~1.EXE")) returned 1 [0075.901] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeExtractFiles.dll") returned="AdobeExtractFiles.dll" [0075.901] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\" [0075.901] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\") returned="" [0075.901] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x52ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReaderUpdater.exe", cAlternateFileName="READER~1.EXE")) returned 0 [0075.901] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.901] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 0 [0075.901] FindClose (in: hFindFile=0x2e34b8 | out: hFindFile=0x2e34b8) returned 1 [0075.901] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520041, dwReserved1=0x3, cFileName="HelpCfg", cAlternateFileName="")) returned 1 [0075.901] lstrcmpA (lpString1=".", lpString2="HelpCfg") returned -1 [0075.901] lstrcmpA (lpString1="..", lpString2="HelpCfg") returned -1 [0075.901] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\*.*") returned="*.*" [0075.901] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0075.904] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.904] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.904] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.904] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.904] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="ca_ES", cAlternateFileName="")) returned 1 [0075.905] lstrcmpA (lpString1=".", lpString2="ca_ES") returned -1 [0075.905] lstrcmpA (lpString1="..", lpString2="ca_ES") returned -1 [0075.905] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*") returned="*.*" [0075.905] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.906] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.906] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0075.906] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.906] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.906] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0075.906] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\*.*") returned="*.*" [0075.906] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\" [0075.906] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\") returned="" [0075.908] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.908] CloseHandle (hObject=0x90) returned 1 [0075.908] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0075.908] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.908] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="cs_CZ", cAlternateFileName="")) returned 1 [0075.908] lstrcmpA (lpString1=".", lpString2="cs_CZ") returned -1 [0075.908] lstrcmpA (lpString1="..", lpString2="cs_CZ") returned -1 [0075.908] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*") returned="*.*" [0075.908] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.909] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.909] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.909] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.909] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.909] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0075.909] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\*.*") returned="*.*" [0075.909] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\" [0075.910] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\") returned="" [0075.911] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.911] CloseHandle (hObject=0x90) returned 1 [0075.911] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0075.911] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.911] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="da_DK", cAlternateFileName="")) returned 1 [0075.911] lstrcmpA (lpString1=".", lpString2="da_DK") returned -1 [0075.911] lstrcmpA (lpString1="..", lpString2="da_DK") returned -1 [0075.911] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*") returned="*.*" [0075.911] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.912] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.913] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.913] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.913] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.913] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0075.913] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\*.*") returned="*.*" [0075.913] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\" [0075.913] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\") returned="" [0075.914] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.914] CloseHandle (hObject=0x90) returned 1 [0075.914] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0075.915] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.915] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="de_DE", cAlternateFileName="")) returned 1 [0075.915] lstrcmpA (lpString1=".", lpString2="de_DE") returned -1 [0075.915] lstrcmpA (lpString1="..", lpString2="de_DE") returned -1 [0075.915] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*") returned="*.*" [0075.915] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.916] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.916] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.916] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.916] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.916] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0075.916] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\*.*") returned="*.*" [0075.916] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\" [0075.916] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\") returned="" [0075.917] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.918] CloseHandle (hObject=0x90) returned 1 [0075.918] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0075.918] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.918] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="en_US", cAlternateFileName="")) returned 1 [0075.918] lstrcmpA (lpString1=".", lpString2="en_US") returned -1 [0075.918] lstrcmpA (lpString1="..", lpString2="en_US") returned -1 [0075.918] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*") returned="*.*" [0075.918] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.918] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.918] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.918] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.918] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.918] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0075.919] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\*.*") returned="*.*" [0075.919] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\" [0075.919] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\") returned="" [0075.921] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.921] CloseHandle (hObject=0x90) returned 1 [0075.921] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0075.921] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.921] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="es_ES", cAlternateFileName="")) returned 1 [0075.921] lstrcmpA (lpString1=".", lpString2="es_ES") returned -1 [0075.921] lstrcmpA (lpString1="..", lpString2="es_ES") returned -1 [0075.921] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*") returned="*.*" [0075.921] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.923] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.923] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.923] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.923] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.923] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0075.923] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\*.*") returned="*.*" [0075.923] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\" [0075.923] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\") returned="" [0075.925] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.925] CloseHandle (hObject=0x90) returned 1 [0075.925] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0075.925] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.925] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="eu_ES", cAlternateFileName="")) returned 1 [0075.925] lstrcmpA (lpString1=".", lpString2="eu_ES") returned -1 [0075.925] lstrcmpA (lpString1="..", lpString2="eu_ES") returned -1 [0075.925] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*") returned="*.*" [0075.925] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.925] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.925] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.925] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.926] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.926] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0075.926] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\*.*") returned="*.*" [0075.926] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\" [0075.926] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\") returned="" [0075.927] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.927] CloseHandle (hObject=0x90) returned 1 [0075.927] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0075.927] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.927] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="fi_FI", cAlternateFileName="")) returned 1 [0075.927] lstrcmpA (lpString1=".", lpString2="fi_FI") returned -1 [0075.927] lstrcmpA (lpString1="..", lpString2="fi_FI") returned -1 [0075.927] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*") returned="*.*" [0075.928] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.929] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.929] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.929] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.929] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.929] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0075.929] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\*.*") returned="*.*" [0075.929] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\" [0075.929] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\") returned="" [0075.930] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.930] CloseHandle (hObject=0x90) returned 1 [0075.930] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0075.930] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.931] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="fr_FR", cAlternateFileName="")) returned 1 [0075.931] lstrcmpA (lpString1=".", lpString2="fr_FR") returned -1 [0075.931] lstrcmpA (lpString1="..", lpString2="fr_FR") returned -1 [0075.931] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*") returned="*.*" [0075.931] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.932] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.932] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.932] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.932] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.932] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0075.932] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\*.*") returned="*.*" [0075.932] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\" [0075.932] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\") returned="" [0075.933] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.933] CloseHandle (hObject=0x90) returned 1 [0075.934] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0075.934] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.934] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="hr_HR", cAlternateFileName="")) returned 1 [0075.934] lstrcmpA (lpString1=".", lpString2="hr_HR") returned -1 [0075.934] lstrcmpA (lpString1="..", lpString2="hr_HR") returned -1 [0075.934] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*") returned="*.*" [0075.934] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.934] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.934] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.934] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.934] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.934] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0075.934] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\*.*") returned="*.*" [0075.935] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\" [0075.935] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\") returned="" [0075.936] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.936] CloseHandle (hObject=0x90) returned 1 [0075.936] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0075.936] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.936] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="hu_HU", cAlternateFileName="")) returned 1 [0075.936] lstrcmpA (lpString1=".", lpString2="hu_HU") returned -1 [0075.936] lstrcmpA (lpString1="..", lpString2="hu_HU") returned -1 [0075.936] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*") returned="*.*" [0075.936] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.937] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.937] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.937] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.938] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.938] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0075.938] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\*.*") returned="*.*" [0075.938] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\" [0075.938] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\") returned="" [0075.939] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.939] CloseHandle (hObject=0x90) returned 1 [0075.939] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0075.939] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.939] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="it_IT", cAlternateFileName="")) returned 1 [0075.939] lstrcmpA (lpString1=".", lpString2="it_IT") returned -1 [0075.939] lstrcmpA (lpString1="..", lpString2="it_IT") returned -1 [0075.940] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*") returned="*.*" [0075.940] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.941] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.941] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.941] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.941] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.941] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0075.941] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\*.*") returned="*.*" [0075.941] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\" [0075.941] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\") returned="" [0075.942] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.942] CloseHandle (hObject=0x90) returned 1 [0075.942] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0075.943] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.943] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ja_JP", cAlternateFileName="")) returned 1 [0075.943] lstrcmpA (lpString1=".", lpString2="ja_JP") returned -1 [0075.943] lstrcmpA (lpString1="..", lpString2="ja_JP") returned -1 [0075.943] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*") returned="*.*" [0075.943] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.943] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.943] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.943] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.943] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.943] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0075.943] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\*.*") returned="*.*" [0075.943] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\" [0075.943] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\") returned="" [0075.945] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.945] CloseHandle (hObject=0x90) returned 1 [0075.945] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0075.945] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.945] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ko_KR", cAlternateFileName="")) returned 1 [0075.945] lstrcmpA (lpString1=".", lpString2="ko_KR") returned -1 [0075.945] lstrcmpA (lpString1="..", lpString2="ko_KR") returned -1 [0075.945] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*") returned="*.*" [0075.945] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.946] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.946] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.946] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.946] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.946] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0075.946] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\*.*") returned="*.*" [0075.946] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\" [0075.947] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\") returned="" [0075.948] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.948] CloseHandle (hObject=0x90) returned 1 [0075.948] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0075.948] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.948] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="nb_NO", cAlternateFileName="")) returned 1 [0075.948] lstrcmpA (lpString1=".", lpString2="nb_NO") returned -1 [0075.948] lstrcmpA (lpString1="..", lpString2="nb_NO") returned -1 [0075.948] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*") returned="*.*" [0075.949] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.949] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.949] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.949] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.949] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.949] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0075.949] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\*.*") returned="*.*" [0075.949] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\" [0075.949] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\") returned="" [0075.950] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.951] CloseHandle (hObject=0x90) returned 1 [0075.951] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0075.951] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.951] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="nl_NL", cAlternateFileName="")) returned 1 [0075.951] lstrcmpA (lpString1=".", lpString2="nl_NL") returned -1 [0075.951] lstrcmpA (lpString1="..", lpString2="nl_NL") returned -1 [0075.951] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*") returned="*.*" [0075.951] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.951] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.951] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.951] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.951] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.952] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0075.952] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\*.*") returned="*.*" [0075.952] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\" [0075.952] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\") returned="" [0075.953] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.953] CloseHandle (hObject=0x90) returned 1 [0075.953] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0075.953] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.953] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="pl_PL", cAlternateFileName="")) returned 1 [0075.953] lstrcmpA (lpString1=".", lpString2="pl_PL") returned -1 [0075.953] lstrcmpA (lpString1="..", lpString2="pl_PL") returned -1 [0075.953] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*") returned="*.*" [0075.954] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.954] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.954] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.954] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.954] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.954] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0075.954] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\*.*") returned="*.*" [0075.954] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\" [0075.954] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\") returned="" [0075.955] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.955] CloseHandle (hObject=0x90) returned 1 [0075.955] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0075.955] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.955] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0075.955] lstrcmpA (lpString1=".", lpString2="pt_BR") returned -1 [0075.955] lstrcmpA (lpString1="..", lpString2="pt_BR") returned -1 [0075.955] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*") returned="*.*" [0075.955] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.956] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.956] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.956] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.956] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.956] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0075.956] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\*.*") returned="*.*" [0075.956] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\" [0075.956] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\") returned="" [0075.957] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.957] CloseHandle (hObject=0x90) returned 1 [0075.957] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0075.957] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.957] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ro_RO", cAlternateFileName="")) returned 1 [0075.957] lstrcmpA (lpString1=".", lpString2="ro_RO") returned -1 [0075.957] lstrcmpA (lpString1="..", lpString2="ro_RO") returned -1 [0075.957] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*") returned="*.*" [0075.958] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.958] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.958] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.959] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.959] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.959] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0075.959] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\*.*") returned="*.*" [0075.959] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\" [0075.959] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\") returned="" [0075.960] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.960] CloseHandle (hObject=0x90) returned 1 [0075.960] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0075.960] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.960] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="ru_RU", cAlternateFileName="")) returned 1 [0075.960] lstrcmpA (lpString1=".", lpString2="ru_RU") returned -1 [0075.960] lstrcmpA (lpString1="..", lpString2="ru_RU") returned -1 [0075.960] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*") returned="*.*" [0075.960] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.960] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.961] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.961] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.961] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.961] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0075.961] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\*.*") returned="*.*" [0075.961] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\" [0075.961] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\") returned="" [0075.962] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.962] CloseHandle (hObject=0x90) returned 1 [0075.962] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0075.962] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.962] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="sk_SK", cAlternateFileName="")) returned 1 [0075.962] lstrcmpA (lpString1=".", lpString2="sk_SK") returned -1 [0075.962] lstrcmpA (lpString1="..", lpString2="sk_SK") returned -1 [0075.962] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*") returned="*.*" [0075.962] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.963] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.963] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.963] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.963] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.963] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0075.963] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\*.*") returned="*.*" [0075.964] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\" [0075.964] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\") returned="" [0075.965] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.965] CloseHandle (hObject=0x90) returned 1 [0075.965] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0075.965] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.965] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="sl_SI", cAlternateFileName="")) returned 1 [0075.965] lstrcmpA (lpString1=".", lpString2="sl_SI") returned -1 [0075.965] lstrcmpA (lpString1="..", lpString2="sl_SI") returned -1 [0075.965] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*") returned="*.*" [0075.965] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.965] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.965] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.965] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.965] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.965] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0075.966] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\*.*") returned="*.*" [0075.966] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\" [0075.966] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\") returned="" [0075.967] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.967] CloseHandle (hObject=0x90) returned 1 [0075.967] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0075.967] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.967] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="sv_SE", cAlternateFileName="")) returned 1 [0075.967] lstrcmpA (lpString1=".", lpString2="sv_SE") returned -1 [0075.967] lstrcmpA (lpString1="..", lpString2="sv_SE") returned -1 [0075.967] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*") returned="*.*" [0075.967] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.968] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.968] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.968] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.968] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.968] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0075.968] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\*.*") returned="*.*" [0075.968] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\" [0075.968] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\") returned="" [0075.969] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.969] CloseHandle (hObject=0x90) returned 1 [0075.969] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0075.969] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.969] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="tr_TR", cAlternateFileName="")) returned 1 [0075.970] lstrcmpA (lpString1=".", lpString2="tr_TR") returned -1 [0075.970] lstrcmpA (lpString1="..", lpString2="tr_TR") returned -1 [0075.970] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*") returned="*.*" [0075.970] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.970] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.971] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.971] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.971] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.971] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0075.971] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\*.*") returned="*.*" [0075.971] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\" [0075.971] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\") returned="" [0075.972] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.972] CloseHandle (hObject=0x90) returned 1 [0075.972] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0075.972] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.972] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="uk_UA", cAlternateFileName="")) returned 1 [0075.972] lstrcmpA (lpString1=".", lpString2="uk_UA") returned -1 [0075.972] lstrcmpA (lpString1="..", lpString2="uk_UA") returned -1 [0075.973] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*") returned="*.*" [0075.973] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.973] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.973] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.973] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.973] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.973] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0075.973] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\*.*") returned="*.*" [0075.973] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\" [0075.973] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\") returned="" [0075.974] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.975] CloseHandle (hObject=0x90) returned 1 [0075.975] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0075.975] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.975] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0075.975] lstrcmpA (lpString1=".", lpString2="zh_CN") returned -1 [0075.975] lstrcmpA (lpString1="..", lpString2="zh_CN") returned -1 [0075.975] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*") returned="*.*" [0075.975] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.975] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.975] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.975] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.975] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.975] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0075.975] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\*.*") returned="*.*" [0075.975] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\" [0075.976] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\") returned="" [0075.977] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.977] CloseHandle (hObject=0x90) returned 1 [0075.977] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0075.977] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.977] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0075.977] lstrcmpA (lpString1=".", lpString2="zh_TW") returned -1 [0075.977] lstrcmpA (lpString1="..", lpString2="zh_TW") returned -1 [0075.977] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*") returned="*.*" [0075.977] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.978] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.978] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.978] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.978] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.978] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0075.978] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\*.*") returned="*.*" [0075.978] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\" [0075.978] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\") returned="" [0075.979] SetFileTime (hFile=0x90, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.979] CloseHandle (hObject=0x90) returned 1 [0075.979] FindNextFileA (in: hFindFile=0x2e34f8, lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0075.979] FindClose (in: hFindFile=0x2e34f8 | out: hFindFile=0x2e34f8) returned 1 [0075.980] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0075.980] FindClose (in: hFindFile=0x2e34b8 | out: hFindFile=0x2e34b8) returned 1 [0075.980] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520041, dwReserved1=0x3, cFileName="HelpCfg", cAlternateFileName="")) returned 0 [0075.980] FindClose (in: hFindFile=0x2e3478 | out: hFindFile=0x2e3478) returned 1 [0075.980] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8172df80, ftCreationTime.dwHighDateTime=0x1d59e27, ftLastAccessTime.dwLowDateTime=0x15c520a0, ftLastAccessTime.dwHighDateTime=0x1d5dca6, ftLastWriteTime.dwLowDateTime=0x15c520a0, ftLastWriteTime.dwHighDateTime=0x1d5dca6, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x640041, dwReserved1=0x3, cFileName="ccv_server.exe", cAlternateFileName="CCV_SE~1.EXE")) returned 1 [0075.980] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\*.*") returned="*.*" [0075.980] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\") returned="C:\\Program Files (x86)\\Common Files\\" [0075.980] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\") returned="" [0075.981] SetFileTime (hFile=0x84, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.981] CloseHandle (hObject=0x84) returned 1 [0075.981] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801ae160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x801d42c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x801d42c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0075.982] lstrcmpA (lpString1=".", lpString2="Java") returned -1 [0075.982] lstrcmpA (lpString1="..", lpString2="Java") returned -1 [0075.982] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\ccv_server.exe") returned="ccv_server.exe" [0075.982] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801ae160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x801d42c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x801d42c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2df438, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0075.982] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.982] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801ae160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x801d42c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x801d42c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0075.982] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.982] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.982] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801d42c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80220580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 1 [0075.983] lstrcmpA (lpString1=".", lpString2="Java Update") returned -1 [0075.983] lstrcmpA (lpString1="..", lpString2="Java Update") returned -1 [0075.983] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Java\\*.*") returned="*.*" [0075.983] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801d42c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80220580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df3c0, dwReserved1=0x2df3bb, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0075.984] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.984] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801d42c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80220580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0075.984] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.984] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0075.984] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa1fc00, ftCreationTime.dwHighDateTime=0x1ce76b1, ftLastAccessTime.dwLowDateTime=0x801fa420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xaa1fc00, ftLastWriteTime.dwHighDateTime=0x1ce76b1, nFileSizeHigh=0x0, nFileSizeLow=0x3cb80, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="jaucheck.exe", cAlternateFileName="")) returned 1 [0075.984] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\*.*") returned="*.*" [0075.984] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" [0075.984] PathAddBackslashA (in: pszPath="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" | out: pszPath="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\") returned="" [0075.985] SetFileTime (hFile=0x8c, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0075.985] CloseHandle (hObject=0x8c) returned 1 [0075.986] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83fa200, ftCreationTime.dwHighDateTime=0x1ce76b1, ftLastAccessTime.dwLowDateTime=0x801fa420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83fa200, ftLastWriteTime.dwHighDateTime=0x1ce76b1, nFileSizeHigh=0x0, nFileSizeLow=0x39780, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaureg.exe", cAlternateFileName="")) returned 1 [0075.986] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaucheck.exe") returned="jaucheck.exe" [0075.986] lstrcpyA (in: lpString1=0x407019, lpString2="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" | out: lpString1="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" [0075.986] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dd4800, ftCreationTime.dwHighDateTime=0x1ce76b1, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x5dd4800, ftLastWriteTime.dwHighDateTime=0x1ce76b1, nFileSizeHigh=0x0, nFileSizeLow=0x7bd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="jucheck.exe", cAlternateFileName="")) returned 1 [0075.986] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jaureg.exe") returned="jaureg.exe" [0075.986] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x249c100, ftCreationTime.dwHighDateTime=0x1ce76b1, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x249c100, ftLastWriteTime.dwHighDateTime=0x1ce76b1, nFileSizeHigh=0x0, nFileSizeLow=0x3e180, dwReserved0=0x0, dwReserved1=0x0, cFileName="jusched.exe", cAlternateFileName="")) returned 1 [0075.986] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jucheck.exe") returned="jucheck.exe" [0075.986] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb63a00, ftCreationTime.dwHighDateTime=0x1ce76b0, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xfeb63a00, ftLastWriteTime.dwHighDateTime=0x1ce76b0, nFileSizeHigh=0x0, nFileSizeLow=0x583, dwReserved0=0x0, dwReserved1=0x0, cFileName="task.xml", cAlternateFileName="")) returned 1 [0075.986] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jusched.exe") returned="jusched.exe" [0075.986] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb63a00, ftCreationTime.dwHighDateTime=0x1ce76b0, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xfeb63a00, ftLastWriteTime.dwHighDateTime=0x1ce76b0, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="task64.xml", cAlternateFileName="")) returned 1 [0075.986] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task.xml") returned="task.xml" [0075.987] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb63a00, ftCreationTime.dwHighDateTime=0x1ce76b0, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xfeb63a00, ftLastWriteTime.dwHighDateTime=0x1ce76b0, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="task64.xml", cAlternateFileName="")) returned 0 [0075.987] FindClose (in: hFindFile=0x2e34b8 | out: hFindFile=0x2e34b8) returned 1 [0075.987] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801d42c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80220580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 0 [0075.987] FindClose (in: hFindFile=0x2e3478 | out: hFindFile=0x2e3478) returned 1 [0075.987] FindNextFileA (in: hFindFile=0x2e33f8, lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61004a, dwReserved1=0x3, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0075.987] lstrcmpA (lpString1=".", lpString2="microsoft shared") returned -1 [0075.987] lstrcmpA (lpString1="..", lpString2="microsoft shared") returned -1 [0075.987] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\*.*") returned="*.*" [0075.987] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0075.987] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0075.987] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.987] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0075.987] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="DAO", cAlternateFileName="")) returned 1 [0075.987] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\*.*") returned="*.*" [0075.987] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\DAO\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df3c0, dwReserved1=0x2df3bb, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0075.988] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x2d0000, cFileName="..", cAlternateFileName="")) returned 1 [0075.988] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b309dbc, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0x5b309dbc, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0x872c4350, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x95000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="dao360.dll", cAlternateFileName="")) returned 1 [0075.988] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\DAO\\*.*") returned="*.*" [0075.989] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b309dbc, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0x5b309dbc, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0x872c4350, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x95000, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="dao360.dll", cAlternateFileName="")) returned 0 [0075.989] FindClose (in: hFindFile=0x2e34b8 | out: hFindFile=0x2e34b8) returned 1 [0075.990] FindNextFileA (in: hFindFile=0x2e3478, lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60d54030, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="Help", cAlternateFileName="")) returned 1 [0075.990] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\*.*") returned="*.*" [0075.990] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60d54030, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0075.993] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60d54030, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.993] FindNextFileA (in: hFindFile=0x2e34b8, lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="1028", cAlternateFileName="")) returned 1 [0075.993] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*.*") returned="*.*" [0075.993] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1028\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.994] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1028\\*.*") returned="*.*" [0075.995] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*.*") returned="*.*" [0075.995] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1031\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.996] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1031\\*.*") returned="*.*" [0075.997] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*.*") returned="*.*" [0075.997] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0075.998] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1033\\*.*") returned="*.*" [0076.000] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*.*") returned="*.*" [0076.000] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1036\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.001] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1036\\*.*") returned="*.*" [0076.002] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*.*") returned="*.*" [0076.002] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1040\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.003] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1040\\*.*") returned="*.*" [0076.005] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*.*") returned="*.*" [0076.005] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1041\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.006] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1041\\*.*") returned="*.*" [0076.010] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*.*") returned="*.*" [0076.010] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1042\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.011] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1042\\*.*") returned="*.*" [0076.012] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*.*") returned="*.*" [0076.012] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1046\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.013] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1046\\*.*") returned="*.*" [0076.015] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*.*") returned="*.*" [0076.015] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1049\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.015] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1049\\*.*") returned="*.*" [0076.016] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*.*") returned="*.*" [0076.017] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\2052\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed5e6b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed5e6b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.017] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\2052\\*.*") returned="*.*" [0076.018] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*.*") returned="*.*" [0076.018] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\3082\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed84810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed84810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed84810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.019] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\3082\\*.*") returned="*.*" [0076.020] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*.*") returned="*.*" [0076.021] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\Hx.HxC") returned="Hx.HxC" [0076.022] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\Hx.HxT") returned="Hx.HxT" [0076.022] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\HxRuntime.HxS") returned="HxRuntime.HxS" [0076.022] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\Keywords.HxK") returned="Keywords.HxK" [0076.022] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\*.*") returned="*.*" [0076.022] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa21d9876, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0076.025] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0076.025] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.026] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.0\\*.*") returned="*.*" [0076.027] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0076.027] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.7\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.028] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.7\\*.*") returned="*.*" [0076.029] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0076.029] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa21b3607, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21b3607, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.031] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\*.*") returned="*.*" [0076.033] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned="InkObj.dll.mui" [0076.033] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned="micaut.dll.mui" [0076.033] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned="mip.exe.mui" [0076.033] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned="mshwLatin.dll.mui" [0076.033] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui") returned="rtscom.dll.mui" [0076.033] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\TipBand.dll.mui") returned="TipBand.dll.mui" [0076.033] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui") returned="TipRes.dll.mui" [0076.033] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0076.034] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d9876, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa060a95, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa21d9876, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.034] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\*.*") returned="*.*" [0076.035] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\InkDiv.dll") returned="InkDiv.dll" [0076.035] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned="InkObj.dll" [0076.035] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\journal.dll") returned="journal.dll" [0076.036] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\micaut.dll") returned="micaut.dll" [0076.036] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned="Microsoft.Ink.dll" [0076.036] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\mip.exe") returned="mip.exe" [0076.036] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\mraut.dll") returned="mraut.dll" [0076.036] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned="mshwgst.dll" [0076.036] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\mshwLatin.dll") returned="mshwLatin.dll" [0076.036] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\penchs.dll") returned="penchs.dll" [0076.036] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\pencht.dll") returned="pencht.dll" [0076.036] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\penjpn.dll") returned="penjpn.dll" [0076.037] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\penkor.dll") returned="penkor.dll" [0076.037] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\penusa.dll") returned="penusa.dll" [0076.037] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\pipanel.dll") returned="pipanel.dll" [0076.037] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\pipanel.exe") returned="pipanel.exe" [0076.037] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\pipres.dll") returned="pipres.dll" [0076.037] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\rtscom.dll") returned="rtscom.dll" [0076.037] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\skchobj.dll") returned="skchobj.dll" [0076.037] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\skchui.dll") returned="skchui.dll" [0076.037] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\TabTip32.exe") returned="TabTip32.exe" [0076.037] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\tiptsf.dll") returned="tiptsf.dll" [0076.038] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\*.*") returned="*.*" [0076.038] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0076.039] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\*.*") returned="*.*" [0076.039] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.040] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\*.*") returned="*.*" [0076.041] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\*.*") returned="*.*" [0076.041] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0076.043] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\*.*") returned="*.*" [0076.043] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22894196, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.043] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\*.*") returned="*.*" [0076.044] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\*.*") returned="*.*" [0076.046] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\*.*") returned="*.*" [0076.046] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7a735b0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xb30acfc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb30acfc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0076.046] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\*.*") returned="*.*" [0076.046] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b36970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xba7b1bc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xba7b1bc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.047] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\*.*") returned="*.*" [0076.051] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\MSOINTL.DLL") returned="MSOINTL.DLL" [0076.051] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned="MSOINTL.DLL.IDX_DLL" [0076.052] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\*.*") returned="*.*" [0076.053] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Csi.dll") returned="Csi.dll" [0076.053] PathFindFileNameA (pszPath="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\CsiSoap.dll") returned="CsiSoap.dll" [0076.053] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad3651a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xad3651a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xad3651a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2e048c, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.056] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7ae59d0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xbe284040, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbe284040, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2e048c, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.056] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeefe5e10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xadf4bfa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xadf4bfa0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740078, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0076.072] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeefe5e10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeefe5e10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.075] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8132bc53, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8132bc53, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0076.085] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\TextConv\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd6e32460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6e32460, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0076.087] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\TextConv\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.088] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\TextConv\\WksConv\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6e32460, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xd6e32460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6e32460, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.091] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Triedit\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0076.091] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Triedit\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.092] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VBA\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec355540, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e0065, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0076.093] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VBA\\VBA6\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec355540, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.095] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f61b1a0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xcc379b80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xcc379b80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0076.096] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\amd64\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3e46d20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xa3e46d20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa3e46d20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.100] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VGX\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81305af3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81305af3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0076.101] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f4696f0, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0076.102] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52622770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x617be070, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.105] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\x86\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5272d110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x617be070, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2e048c, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0076.109] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\AppInfoDocument\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5707cc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5707cc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.113] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\AppInfoDocument\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d6fa4, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0076.116] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20323f10, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x69acfbd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69acfbd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.116] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5863dfb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd3478ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd3478ee0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5ed8, dwReserved1=0x2d5ed3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0076.119] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInViews\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69acfbd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd60a8740, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd60a8740, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x700061, dwReserved1=0x650074, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0076.122] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52328bf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd33e0960, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd33e0960, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f0048, dwReserved1=0x200057, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0076.125] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x583906f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd60f4a00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd60f4a00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x57004f, dwReserved1=0x540020, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0076.130] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x274de510, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd6d01960, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d01960, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0076.132] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x274de510, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd6d73d80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d73d80, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.135] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5279f530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5ed8, dwReserved1=0x2d5ed3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0076.142] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21a6a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21a6a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21a6a110, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0076.142] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\14\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21a6a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21a6a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21a6a110, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.143] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\14\\BIN\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21a6a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xad0454c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xad0454c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5ed8, dwReserved1=0x2d5ed3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0076.145] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Services\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650057, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0076.147] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0076.147] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df3c0, dwReserved1=0x2df3bb, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0076.148] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.148] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5ed8, dwReserved1=0x2d5ed3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0076.150] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d6ee0, dwReserved1=0x2d6edb, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0076.155] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9c11cf80, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0x9c11cf80, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69004d, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0076.157] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\ado\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df3c0, dwReserved1=0x2df3bb, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0076.160] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\ado\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d5f66, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.165] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e244e, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0076.170] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\msadc\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0076.173] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d5f6a, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.178] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f34af90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0076.180] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.188] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xdd91ad80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd91ad80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2da416, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0076.191] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7aa9d740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e0ead20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7e0ead20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2df42c, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0076.192] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df3c0, dwReserved1=0x2df3bb, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0076.192] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.195] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2e048e, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0076.199] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2e048e, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0076.202] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2e048e, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0076.252] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrome.7z" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\chrome.7z"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrome.7z.wannacry" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\chrome.7z.wannacry")) returned 1 [0076.257] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.257] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="setup.exe") returned -1 [0076.257] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="setup.exe") returned -1 [0076.257] lstrcmpiA (lpString1="", lpString2="setup.exe") returned -1 [0076.257] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.257] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="libegl.dll") returned -1 [0076.258] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="libegl.dll") returned -1 [0076.258] lstrcmpiA (lpString1="", lpString2="libegl.dll") returned -1 [0076.258] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.258] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="libglesv2.dll") returned -1 [0076.258] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="libglesv2.dll") returned -1 [0076.258] lstrcmpiA (lpString1="", lpString2="libglesv2.dll") returned -1 [0076.258] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d86fec0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2e048e, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0076.262] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.262] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="am.pak") returned 1 [0076.262] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="am.pak") returned 1 [0076.262] lstrcmpiA (lpString1="", lpString2="am.pak") returned -1 [0076.264] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.264] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ar.pak") returned 1 [0076.264] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ar.pak") returned 1 [0076.264] lstrcmpiA (lpString1="", lpString2="ar.pak") returned -1 [0076.264] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.264] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bg.pak") returned 1 [0076.264] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg.pak") returned 1 [0076.264] lstrcmpiA (lpString1="", lpString2="bg.pak") returned -1 [0076.264] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.264] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="bn.pak") returned 1 [0076.264] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bn.pak") returned 1 [0076.264] lstrcmpiA (lpString1="", lpString2="bn.pak") returned -1 [0076.264] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.264] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ca.pak") returned 1 [0076.264] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ca.pak") returned 1 [0076.264] lstrcmpiA (lpString1="", lpString2="ca.pak") returned -1 [0076.264] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.264] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="cs.pak") returned 1 [0076.264] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cs.pak") returned 1 [0076.264] lstrcmpiA (lpString1="", lpString2="cs.pak") returned -1 [0076.265] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.265] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="da.pak") returned 1 [0076.265] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="da.pak") returned 1 [0076.265] lstrcmpiA (lpString1="", lpString2="da.pak") returned -1 [0076.265] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.265] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="de.pak") returned 1 [0076.265] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="de.pak") returned 1 [0076.265] lstrcmpiA (lpString1="", lpString2="de.pak") returned -1 [0076.265] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.265] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="el.pak") returned -1 [0076.265] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="el.pak") returned 1 [0076.265] lstrcmpiA (lpString1="", lpString2="el.pak") returned -1 [0076.265] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.266] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="en-GB.pak") returned -1 [0076.266] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="en-GB.pak") returned 1 [0076.266] lstrcmpiA (lpString1="", lpString2="en-GB.pak") returned -1 [0076.266] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.266] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="en-US.pak") returned -1 [0076.266] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="en-US.pak") returned 1 [0076.266] lstrcmpiA (lpString1="", lpString2="en-US.pak") returned -1 [0076.266] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.266] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="es-419.pak") returned -1 [0076.266] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="es-419.pak") returned 1 [0076.266] lstrcmpiA (lpString1="", lpString2="es-419.pak") returned -1 [0076.266] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.266] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="es.pak") returned -1 [0076.266] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="es.pak") returned 1 [0076.266] lstrcmpiA (lpString1="", lpString2="es.pak") returned -1 [0076.267] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.267] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="et.pak") returned -1 [0076.267] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="et.pak") returned 1 [0076.267] lstrcmpiA (lpString1="", lpString2="et.pak") returned -1 [0076.267] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.267] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="fa.pak") returned -1 [0076.267] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="fa.pak") returned 1 [0076.267] lstrcmpiA (lpString1="", lpString2="fa.pak") returned -1 [0076.267] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.267] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="fi.pak") returned -1 [0076.267] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="fi.pak") returned 1 [0076.267] lstrcmpiA (lpString1="", lpString2="fi.pak") returned -1 [0076.267] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.267] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="fil.pak") returned -1 [0076.267] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="fil.pak") returned 1 [0076.267] lstrcmpiA (lpString1="", lpString2="fil.pak") returned -1 [0076.268] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.268] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="fr.pak") returned -1 [0076.268] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="fr.pak") returned 1 [0076.268] lstrcmpiA (lpString1="", lpString2="fr.pak") returned -1 [0076.268] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.268] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="gu.pak") returned -1 [0076.268] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="gu.pak") returned 1 [0076.268] lstrcmpiA (lpString1="", lpString2="gu.pak") returned -1 [0076.268] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.268] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="he.pak") returned -1 [0076.268] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="he.pak") returned 1 [0076.268] lstrcmpiA (lpString1="", lpString2="he.pak") returned -1 [0076.268] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.269] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hi.pak") returned -1 [0076.269] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hi.pak") returned 1 [0076.269] lstrcmpiA (lpString1="", lpString2="hi.pak") returned -1 [0076.269] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.269] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hr.pak") returned -1 [0076.269] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hr.pak") returned -1 [0076.269] lstrcmpiA (lpString1="", lpString2="hr.pak") returned -1 [0076.269] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.269] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hu.pak") returned -1 [0076.269] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hu.pak") returned -1 [0076.269] lstrcmpiA (lpString1="", lpString2="hu.pak") returned -1 [0076.269] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.269] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="id.pak") returned -1 [0076.269] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="id.pak") returned -1 [0076.270] lstrcmpiA (lpString1="", lpString2="id.pak") returned -1 [0076.270] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.270] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="it.pak") returned -1 [0076.270] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="it.pak") returned -1 [0076.270] lstrcmpiA (lpString1="", lpString2="it.pak") returned -1 [0076.270] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.270] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ja.pak") returned -1 [0076.270] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ja.pak") returned -1 [0076.270] lstrcmpiA (lpString1="", lpString2="ja.pak") returned -1 [0076.270] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.270] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="kn.pak") returned -1 [0076.270] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="kn.pak") returned -1 [0076.270] lstrcmpiA (lpString1="", lpString2="kn.pak") returned -1 [0076.271] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.271] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ko.pak") returned -1 [0076.271] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ko.pak") returned -1 [0076.271] lstrcmpiA (lpString1="", lpString2="ko.pak") returned -1 [0076.271] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.271] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="lt.pak") returned -1 [0076.271] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="lt.pak") returned -1 [0076.271] lstrcmpiA (lpString1="", lpString2="lt.pak") returned -1 [0076.271] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.271] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="lv.pak") returned -1 [0076.271] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="lv.pak") returned -1 [0076.271] lstrcmpiA (lpString1="", lpString2="lv.pak") returned -1 [0076.271] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.272] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ml.pak") returned -1 [0076.272] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ml.pak") returned -1 [0076.272] lstrcmpiA (lpString1="", lpString2="ml.pak") returned -1 [0076.272] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.272] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="mr.pak") returned -1 [0076.272] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mr.pak") returned -1 [0076.272] lstrcmpiA (lpString1="", lpString2="mr.pak") returned -1 [0076.272] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.272] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ms.pak") returned -1 [0076.272] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ms.pak") returned -1 [0076.272] lstrcmpiA (lpString1="", lpString2="ms.pak") returned -1 [0076.272] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.272] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="nb.pak") returned -1 [0076.272] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="nb.pak") returned -1 [0076.272] lstrcmpiA (lpString1="", lpString2="nb.pak") returned -1 [0076.273] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.273] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="nl.pak") returned -1 [0076.273] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="nl.pak") returned -1 [0076.273] lstrcmpiA (lpString1="", lpString2="nl.pak") returned -1 [0076.273] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.273] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="pl.pak") returned -1 [0076.273] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pl.pak") returned -1 [0076.273] lstrcmpiA (lpString1="", lpString2="pl.pak") returned -1 [0076.273] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.273] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="pt-BR.pak") returned -1 [0076.273] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pt-BR.pak") returned -1 [0076.273] lstrcmpiA (lpString1="", lpString2="pt-BR.pak") returned -1 [0076.273] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.273] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="pt-PT.pak") returned -1 [0076.273] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pt-PT.pak") returned -1 [0076.273] lstrcmpiA (lpString1="", lpString2="pt-PT.pak") returned -1 [0076.273] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.274] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ro.pak") returned -1 [0076.274] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ro.pak") returned -1 [0076.274] lstrcmpiA (lpString1="", lpString2="ro.pak") returned -1 [0076.274] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.274] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ru.pak") returned -1 [0076.274] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ru.pak") returned -1 [0076.274] lstrcmpiA (lpString1="", lpString2="ru.pak") returned -1 [0076.274] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.274] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="sk.pak") returned -1 [0076.274] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sk.pak") returned -1 [0076.274] lstrcmpiA (lpString1="", lpString2="sk.pak") returned -1 [0076.274] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.274] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="sl.pak") returned -1 [0076.274] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sl.pak") returned -1 [0076.274] lstrcmpiA (lpString1="", lpString2="sl.pak") returned -1 [0076.274] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.274] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="sr.pak") returned -1 [0076.275] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sr.pak") returned -1 [0076.275] lstrcmpiA (lpString1="", lpString2="sr.pak") returned -1 [0076.275] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.275] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="sv.pak") returned -1 [0076.275] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sv.pak") returned -1 [0076.275] lstrcmpiA (lpString1="", lpString2="sv.pak") returned -1 [0076.275] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.275] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="sw.pak") returned -1 [0076.275] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="sw.pak") returned -1 [0076.275] lstrcmpiA (lpString1="", lpString2="sw.pak") returned -1 [0076.275] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.275] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ta.pak") returned -1 [0076.275] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ta.pak") returned -1 [0076.275] lstrcmpiA (lpString1="", lpString2="ta.pak") returned -1 [0076.275] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.275] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="te.pak") returned -1 [0076.275] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="te.pak") returned -1 [0076.275] lstrcmpiA (lpString1="", lpString2="te.pak") returned -1 [0076.276] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.276] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="th.pak") returned -1 [0076.276] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="th.pak") returned -1 [0076.276] lstrcmpiA (lpString1="", lpString2="th.pak") returned -1 [0076.276] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.276] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="tr.pak") returned -1 [0076.276] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tr.pak") returned -1 [0076.276] lstrcmpiA (lpString1="", lpString2="tr.pak") returned -1 [0076.276] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.276] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="uk.pak") returned -1 [0076.276] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="uk.pak") returned -1 [0076.276] lstrcmpiA (lpString1="", lpString2="uk.pak") returned -1 [0076.276] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.276] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="vi.pak") returned -1 [0076.276] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="vi.pak") returned -1 [0076.276] lstrcmpiA (lpString1="", lpString2="vi.pak") returned -1 [0076.277] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.277] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="zh-CN.pak") returned -1 [0076.277] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="zh-CN.pak") returned -1 [0076.277] lstrcmpiA (lpString1="", lpString2="zh-CN.pak") returned -1 [0076.277] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.277] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="zh-TW.pak") returned -1 [0076.277] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="zh-TW.pak") returned -1 [0076.277] lstrcmpiA (lpString1="", lpString2="zh-TW.pak") returned -1 [0076.277] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.277] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="nacl_irt_x86_64.nexe") returned -1 [0076.277] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="nacl_irt_x86_64.nexe") returned -1 [0076.277] lstrcmpiA (lpString1="", lpString2="nacl_irt_x86_64.nexe") returned -1 [0076.277] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.277] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="natives_blob.bin") returned -1 [0076.277] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="natives_blob.bin") returned -1 [0076.277] lstrcmpiA (lpString1="", lpString2="natives_blob.bin") returned -1 [0076.278] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.278] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="resources.pak") returned -1 [0076.278] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="resources.pak") returned -1 [0076.278] lstrcmpiA (lpString1="", lpString2="resources.pak") returned -1 [0076.278] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.278] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="snapshot_blob.bin") returned -1 [0076.278] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="snapshot_blob.bin") returned -1 [0076.278] lstrcmpiA (lpString1="", lpString2="snapshot_blob.bin") returned -1 [0076.278] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d9a09c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2e048e, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0076.281] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.281] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="logo.png") returned -1 [0076.281] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="logo.png") returned -1 [0076.281] lstrcmpiA (lpString1="", lpString2="logo.png") returned -1 [0076.283] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.283] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="logocanary.png") returned -1 [0076.283] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="logocanary.png") returned -1 [0076.283] lstrcmpiA (lpString1="", lpString2="logocanary.png") returned -1 [0076.283] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.283] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="smalllogo.png") returned -1 [0076.283] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="smalllogo.png") returned -1 [0076.283] lstrcmpiA (lpString1="", lpString2="smalllogo.png") returned -1 [0076.283] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.283] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="smalllogocanary.png") returned -1 [0076.283] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="smalllogocanary.png") returned -1 [0076.284] lstrcmpiA (lpString1="", lpString2="smalllogocanary.png") returned -1 [0076.284] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d9a09c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440020, dwReserved1=0x430045, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0076.284] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.284] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="manifest.json") returned -1 [0076.284] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="manifest.json") returned -1 [0076.284] lstrcmpiA (lpString1="", lpString2="manifest.json") returned -1 [0076.287] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d78b680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d78b680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d7fae, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0076.288] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d7ee8, dwReserved1=0x2d7ee3, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0076.290] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0076.290] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="widevinecdm.dll") returned -1 [0076.290] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="widevinecdm.dll") returned -1 [0076.290] lstrcmpiA (lpString1="", lpString2="widevinecdm.dll") returned -1 [0076.291] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0076.291] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="widevinecdm.dll.sig") returned -1 [0076.291] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="widevinecdm.dll.sig") returned -1 [0076.291] lstrcmpiA (lpString1="", lpString2="widevinecdm.dll.sig") returned -1 [0076.292] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0076.292] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="widevinecdmadapter.dll") returned -1 [0076.292] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="widevinecdmadapter.dll") returned -1 [0076.292] lstrcmpiA (lpString1="", lpString2="widevinecdmadapter.dll") returned -1 [0076.292] PeekMessageA (in: lpMsg=0x18f394, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f394) returned 0 [0076.292] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="widevinecdmadapter.dll.sig") returned -1 [0076.292] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="widevinecdmadapter.dll.sig") returned -1 [0076.292] lstrcmpiA (lpString1="", lpString2="widevinecdmadapter.dll.sig") returned -1 [0076.292] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.292] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="chrome.exe") returned 1 [0076.292] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chrome.exe") returned 1 [0076.292] lstrcmpiA (lpString1="", lpString2="chrome.exe") returned -1 [0076.294] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.294] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="chrome.VisualElementsManifest.xml") returned 1 [0076.294] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chrome.VisualElementsManifest.xml") returned 1 [0076.294] lstrcmpiA (lpString1="", lpString2="chrome.VisualElementsManifest.xml") returned -1 [0076.294] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f252e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f252e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d5f6a, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.294] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.294] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="20170605115313.pma") returned 1 [0076.294] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="20170605115313.pma") returned 1 [0076.294] lstrcmpiA (lpString1="", lpString2="20170605115313.pma") returned -1 [0076.296] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\CrashReports\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6c82ea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6c82ea80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0076.296] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0076.296] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="spcwin.exe") returned -1 [0076.297] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="spcwin.exe") returned -1 [0076.297] lstrcmpiA (lpString1="", lpString2="spcwin.exe") returned -1 [0076.297] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdd8ceac0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd8ceac0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0076.297] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0076.297] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="edcsvr.exe") returned -1 [0076.297] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="edcsvr.exe") returned 1 [0076.297] lstrcmpiA (lpString1="", lpString2="edcsvr.exe") returned -1 [0076.298] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2df442, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0076.299] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0076.299] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="hmmapi.dll.mui") returned -1 [0076.299] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hmmapi.dll.mui") returned 1 [0076.299] lstrcmpiA (lpString1="", lpString2="hmmapi.dll.mui") returned -1 [0076.300] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0076.300] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="iedvtool.dll.mui") returned -1 [0076.300] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="iedvtool.dll.mui") returned -1 [0076.300] lstrcmpiA (lpString1="", lpString2="iedvtool.dll.mui") returned -1 [0076.300] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0076.300] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ieinstal.exe.mui") returned -1 [0076.300] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ieinstal.exe.mui") returned -1 [0076.300] lstrcmpiA (lpString1="", lpString2="ieinstal.exe.mui") returned -1 [0076.301] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0076.301] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="ielowutil.exe.mui") returned -1 [0076.301] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ielowutil.exe.mui") returned -1 [0076.301] lstrcmpiA (lpString1="", lpString2="ielowutil.exe.mui") returned -1 [0076.301] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0076.301] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="iexplore.exe.mui") returned -1 [0076.301] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="iexplore.exe.mui") returned -1 [0076.301] lstrcmpiA (lpString1="", lpString2="iexplore.exe.mui") returned -1 [0076.301] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0076.301] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="jsdbgui.dll.mui") returned -1 [0076.301] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jsdbgui.dll.mui") returned -1 [0076.301] lstrcmpiA (lpString1="", lpString2="jsdbgui.dll.mui") returned -1 [0076.301] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0076.301] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="jsdebuggeride.dll.mui") returned -1 [0076.301] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jsdebuggeride.dll.mui") returned -1 [0076.301] lstrcmpiA (lpString1="", lpString2="jsdebuggeride.dll.mui") returned -1 [0076.301] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0076.301] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="JSProfilerCore.dll.mui") returned -1 [0076.301] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="JSProfilerCore.dll.mui") returned -1 [0076.301] lstrcmpiA (lpString1="", lpString2="JSProfilerCore.dll.mui") returned -1 [0076.301] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0076.302] lstrcmpiA (lpString1="ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt", lpString2="jsprofilerui.dll.mui") returned -1 [0076.302] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jsprofilerui.dll.mui") returned -1 [0076.302] lstrcmpiA (lpString1="", lpString2="jsprofilerui.dll.mui") returned -1 [0076.302] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0076.302] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0076.302] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0076.302] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0076.302] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0076.302] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0076.302] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0076.302] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0076.302] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0076.302] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0076.303] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0076.303] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0076.303] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0076.303] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0076.303] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0076.303] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0076.303] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0076.303] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9bb8508b, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9bb8508b, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x2df442, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0076.303] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0076.305] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0076.305] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xdfb9ec80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfb9ec80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0076.305] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0076.308] PeekMessageA (in: lpMsg=0x18fb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fb74) returned 0 [0076.308] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7577bc60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7577bc60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x2df428, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0076.309] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df3c0, dwReserved1=0x2df3bb, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0076.311] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.312] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.312] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x76eb12e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x76eb12e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d5f52, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.313] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.314] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.315] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.315] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.315] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.315] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.315] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d5f52, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.316] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.320] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.320] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.320] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.320] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.320] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.320] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.320] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.320] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.321] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.321] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.321] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.321] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.321] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.321] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.321] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.321] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.321] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.321] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.322] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.322] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.322] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.322] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.322] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.322] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.322] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.322] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.322] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.324] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.324] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.324] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.324] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.324] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.324] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.325] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.325] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.325] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.325] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.325] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.325] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.325] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.325] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.326] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.326] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.326] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.326] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.326] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.326] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.326] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.326] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.326] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.327] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.327] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.327] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.327] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.327] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.328] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.328] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.328] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.328] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.328] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.328] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.339] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.339] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.339] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.339] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.339] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d5f52, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.340] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.345] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.345] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.345] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.345] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.346] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.346] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.346] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.346] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.346] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.346] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.346] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.346] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.346] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.347] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.347] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.347] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.347] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.347] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.347] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.347] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.347] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fa24) returned 0 [0076.349] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7572f9a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7572f9a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d1292, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0076.412] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.414] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.414] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d5f52, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.414] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.414] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.414] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.414] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d5f52, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.415] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.425] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.426] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.426] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.426] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.426] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.426] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.426] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d5f52, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.437] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.444] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\ffjcext.zip"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\ffjcext.zip.wannacry" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\ffjcext.zip.wannacry")) returned 1 [0076.445] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0069, dwReserved1=0x730065, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0076.446] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.449] PeekMessageA (in: lpMsg=0x18f634, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f634) returned 0 [0076.449] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.449] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.449] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.449] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.449] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.449] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.449] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.449] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.449] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.449] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.449] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.449] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.449] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.454] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\splash.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\splash.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\splash.gif.wannacry" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\splash.gif.wannacry")) returned 1 [0076.455] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.455] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7577bc60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7577bc60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d5f52, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.458] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.459] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.460] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.460] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.460] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.460] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.460] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.460] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.460] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.460] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.460] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.460] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.460] PeekMessageA (in: lpMsg=0x18f8d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f8d4) returned 0 [0076.461] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d5f52, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.466] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.468] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.468] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.468] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.468] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.468] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.468] PeekMessageA (in: lpMsg=0x18f784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18f784) returned 0 [0076.468] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.470] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.471] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5ed8, dwReserved1=0x2d5ed3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0076.488] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\invalid32x32.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\invalid32x32.gif.wannacry" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\invalid32x32.gif.wannacry")) returned 1 [0076.491] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_copydrop32x32.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.wannacry" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_copydrop32x32.gif.wannacry")) returned 1 [0076.493] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.wannacry" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_copynodrop32x32.gif.wannacry")) returned 1 [0076.495] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.wannacry" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_linkdrop32x32.gif.wannacry")) returned 1 [0076.499] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.wannacry" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_linknodrop32x32.gif.wannacry")) returned 1 [0076.501] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_movedrop32x32.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.wannacry" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_movedrop32x32.gif.wannacry")) returned 1 [0076.503] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.wannacry" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_movenodrop32x32.gif.wannacry")) returned 1 [0076.504] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d5f52, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.506] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d5f52, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.509] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d5f52, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.513] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746d2260, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746d2260, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d5f52, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0076.516] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5ed8, dwReserved1=0x2d5ed3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0076.520] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0077.132] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2d7f78, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0077.171] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2d7f78, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0077.176] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Kentucky\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2d7f78, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0077.249] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\North_Dakota\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2d7f78, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0077.256] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0077.262] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0077.272] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0077.283] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0077.313] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d6f60, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0078.142] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0078.394] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d6f60, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0078.410] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746ac100, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746ac100, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d6f60, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0078.421] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x746ac100, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746d2260, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746d2260, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d6f60, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0078.717] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdcd0de20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdcd0de20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0078.718] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0078.718] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f15bdb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f15bdb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df3c0, dwReserved1=0x2df3bb, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0078.721] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51494530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0078.802] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2e048e, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0078.803] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5ed8, dwReserved1=0x2d5ed3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0078.859] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdfb9ec80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfb9ec80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0078.863] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd68b1180, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd68b1180, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2df440, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0078.863] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xba634e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xba634e00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df3c0, dwReserved1=0x2df3bb, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0078.975] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdd6b9780, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd6b9780, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0078.976] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2df452, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0078.978] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52694b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52694b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df3c0, dwReserved1=0x2df3bb, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0078.978] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x610018f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x610018f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0079.110] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52694b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61771db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61771db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0079.582] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f37b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f37b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440020, dwReserved1=0x430045, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0079.583] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f5dcf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5ed8, dwReserved1=0x2d5ed3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0079.584] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f37b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f37b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d6ee0, dwReserved1=0x2d6edb, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0079.584] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11231710, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d7ee8, dwReserved1=0x2d7ee3, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0080.880] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AboutBox.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\aboutbox.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AboutBox.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\aboutbox.zip.wannacry")) returned 1 [0080.926] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfig.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfig.zip.wannacry")) returned 1 [0081.040] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfiginternal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfiginternal.zip.wannacry")) returned 1 [0081.085] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfo.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfo.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfo.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfo.zip.wannacry")) returned 1 [0081.089] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfoInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfointernal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfoInternal.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfointernal.zip.wannacry")) returned 1 [0081.091] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Class.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\class.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Class.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\class.zip.wannacry")) returned 1 [0081.167] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\CodeFile.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\codefile.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\CodeFile.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\codefile.zip.wannacry")) returned 1 [0081.172] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\DataSet.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\dataset.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\DataSet.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\dataset.zip.wannacry")) returned 1 [0081.179] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\emptydatabase.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\emptydatabase.zip.wannacry")) returned 1 [0081.183] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\form.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\form.zip.wannacry")) returned 1 [0081.187] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Interface.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\interface.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Interface.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\interface.zip.wannacry")) returned 1 [0081.193] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\mdiparent.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\mdiparent.zip.wannacry")) returned 1 [0081.196] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resource.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resource.zip.wannacry")) returned 1 [0081.202] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resourceinternal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resourceinternal.zip.wannacry")) returned 1 [0081.209] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settings.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settings.zip.wannacry")) returned 1 [0081.214] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\SettingsInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settingsinternal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\SettingsInternal.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settingsinternal.zip.wannacry")) returned 1 [0081.217] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\textfile.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\textfile.zip.wannacry")) returned 1 [0081.221] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\usercontrol.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\usercontrol.zip.wannacry")) returned 1 [0081.224] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\visualizer.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\visualizer.zip.wannacry")) returned 1 [0081.227] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\xmlfile.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\xmlfile.zip.wannacry")) returned 1 [0081.229] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f5dcf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f5dcf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73e8, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0081.230] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f5dcf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x111e5450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x111e5450, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d7ee8, dwReserved1=0x2d7ee3, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0081.238] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AppConfigurationInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\appconfigurationinternal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AppConfigurationInternal.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\appconfigurationinternal.zip.wannacry")) returned 1 [0081.244] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AssemblyInfoInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\assemblyinfointernal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AssemblyInfoInternal.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\assemblyinfointernal.zip.wannacry")) returned 1 [0081.246] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Class.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\class.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Class.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\class.zip.wannacry")) returned 1 [0081.251] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dataset.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dataset.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dataset.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dataset.zip.wannacry")) returned 1 [0081.256] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dialog.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dialog.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dialog.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dialog.zip.wannacry")) returned 1 [0081.259] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\EmptyDatabase.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\emptydatabase.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\EmptyDatabase.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\emptydatabase.zip.wannacry")) returned 1 [0081.262] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Explorer.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\explorer.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Explorer.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\explorer.zip.wannacry")) returned 1 [0081.264] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Form.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\form.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Form.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\form.zip.wannacry")) returned 1 [0081.268] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\LoginForm.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\loginform.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\LoginForm.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\loginform.zip.wannacry")) returned 1 [0081.271] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\MDIParent.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\mdiparent.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\MDIParent.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\mdiparent.zip.wannacry")) returned 1 [0081.274] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Module.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\module.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Module.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\module.zip.wannacry")) returned 1 [0081.277] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\ResourceInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\resourceinternal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\ResourceInternal.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\resourceinternal.zip.wannacry")) returned 1 [0081.280] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SettingsInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\settingsinternal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SettingsInternal.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\settingsinternal.zip.wannacry")) returned 1 [0081.286] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SplashScreen.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\splashscreen.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SplashScreen.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\splashscreen.zip.wannacry")) returned 1 [0081.289] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Text.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\text.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Text.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\text.zip.wannacry")) returned 1 [0081.294] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\UserControl.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\usercontrol.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\UserControl.zip.wannacry" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\usercontrol.zip.wannacry")) returned 1 [0081.295] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x530056, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.296] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.296] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x2df452, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0081.296] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1120b5b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0081.297] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x527793d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df3c0, dwReserved1=0x2df3bb, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.297] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11231710, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.307] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f1bbe30, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xdd6b9780, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd6b9780, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x530056, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0081.308] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5abe1b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x2df43a, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0081.312] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a491400, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x9ea84660, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9ea84660, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0081.317] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaeef6000, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xdcce7cc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdcce7cc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0081.319] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaef68420, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf288100, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf288100, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x2df43e, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0081.324] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\components\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf261fa0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2fa520, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2fa520, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2e2456, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.329] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\extensions\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf261fa0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2d43c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2d43c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2e2456, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.330] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf2d43c0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2d43c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2d43c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.333] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\searchplugins\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf288100, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf2d43c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf2d43c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2e2456, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.336] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\defaults\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaefb46e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf23be40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf23be40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x2df43e, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0081.337] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\defaults\\pref\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf23be40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf23be40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf23be40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df3c0, dwReserved1=0x2df3bb, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.339] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaefb46e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf215ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf215ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x2df43e, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0081.342] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaef1c160, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0925200, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0925200, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x2df43e, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0081.347] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf17d760, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf215ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf215ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x2df43e, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0081.349] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf770e60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xdd882800, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd882800, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0081.350] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x553ced90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553ced90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0081.351] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0081.351] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df3c0, dwReserved1=0x2df3bb, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.352] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.355] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x590052, dwReserved1=0x540050, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.360] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdd705a40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd705a40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0081.362] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2df448, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0081.362] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df3c0, dwReserved1=0x2df3bb, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.363] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a8c6329, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a8c6329, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.368] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d6f9a, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0081.370] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0081.372] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a23a69d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a23a69d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x490046, dwReserved1=0x45004c, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.377] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d6f9a, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0081.379] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0081.382] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Uninstall Information\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8907f814, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8907f814, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0081.383] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Defender\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdd8f4c20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd8f4c20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0081.384] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Defender\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22bdbd7c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2df440, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0081.387] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Mail\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0081.388] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Mail\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0081.392] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdcce7cc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdcce7cc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0081.392] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21ca67c6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0081.394] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Icons\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0081.395] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81351db4, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81351db4, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0081.400] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Network Sharing\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8012b5d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8012b5d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2df448, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0081.401] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Skins\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9b6c2483, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9b6c2483, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x2df448, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0081.402] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Visualizations\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0081.403] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdd66d4c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd66d4c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0081.403] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\Accessories\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0081.404] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df3c0, dwReserved1=0x2df3bb, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.411] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d1294, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0081.413] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea1accb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228e0708, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df3c0, dwReserved1=0x2df3bb, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.417] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdd693620, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd693620, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0081.417] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b43298, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0081.420] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Portable Devices\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdd91ad80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd91ad80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0081.427] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdd6b9780, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdd6b9780, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0081.427] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\en-US\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0081.430] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8012b5d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8012b5d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0081.433] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df3c0, dwReserved1=0x2df3bb, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.436] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e048e, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.438] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d6f9a, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0081.440] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d6f9a, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0081.442] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8191f35e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8191f35e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2e048e, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.446] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.449] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22aaa7b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0488, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.452] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22aaa7b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e44ac, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0081.454] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22aaa7b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2e44ac, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0081.455] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x818f91fe, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x818f91fe, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2e0488, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.462] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.466] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d5f7c, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.468] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a5e242, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e44a8, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0081.469] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a5e242, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2e44a8, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0081.470] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8191f35e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8191f35e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d5f7c, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.474] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.477] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e048e, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.477] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5ed8, dwReserved1=0x2d5ed3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0081.480] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d6f9a, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0081.484] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819b78df, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819b78df, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2e048e, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.487] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.490] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a844fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d5f90, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.491] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a844fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5ed8, dwReserved1=0x2d5ed3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0081.495] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a844fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d6fa4, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0081.497] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8196b61f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8196b61f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d5f90, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.501] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4c0049, dwReserved1=0x530045, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.505] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22ad0a6d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e048e, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.505] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22ad0a6d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5ed8, dwReserved1=0x2d5ed3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0081.509] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22ad0a6d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d6f9a, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0081.511] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8199177f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8199177f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2e048e, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.516] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780074, dwReserved1=0x74, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.519] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229c575e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e44a8, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.519] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229c575e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5ed8, dwReserved1=0x2d5ed3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0081.523] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229c575e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d6f9c, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0081.525] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819454bf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819454bf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2e44a8, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.528] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819454bf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819454bf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d6f9e, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0081.529] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\on_desktop\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x819454bf, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x819454bf, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d6f9e, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0081.533] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea6723d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.539] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b43298, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e048c, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.540] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b43298, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5ed8, dwReserved1=0x2d5ed3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0081.544] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22b43298, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d6f98, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0081.548] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81886ddd, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81886ddd, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2e048c, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.554] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x818acf3e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x818acf3e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d6f9a, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0081.563] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81886ddd, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x81886ddd, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d6f9a, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0081.758] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8012b5d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8012b5d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f8b0, dwReserved1=0x2df43e, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0081.936] FindFirstFileA (in: lpFileName="C:\\ProgramData\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0081.936] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Adobe\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df3c0, dwReserved1=0x2df3bb, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0081.937] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0081.937] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.937] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.938] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5ed8, dwReserved1=0x2d5ed3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0081.940] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300031, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0081.940] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.943] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Application Data\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630041, dwReserved1=0x3, cFileName="ARM", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0081.944] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Desktop\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630041, dwReserved1=0x3, cFileName="ARM", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0081.944] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Documents\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630041, dwReserved1=0x3, cFileName="ARM", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0081.944] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Favorites\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630041, dwReserved1=0x3, cFileName="ARM", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0081.944] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x520041, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0081.945] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0081.945] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.945] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.945] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5ed8, dwReserved1=0x2d5ed3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0081.949] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0043, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0081.949] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.950] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.950] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61004d, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.951] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.952] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.952] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.956] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38646439, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0081.956] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.957] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.960] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f0048, dwReserved1=0x200057, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.963] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.964] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.966] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5ed8, dwReserved1=0x2d5ed3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0081.969] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200057, dwReserved1=0x4f0054, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.970] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5ed8, dwReserved1=0x2d5ed3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0081.979] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610054, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0081.980] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0081.980] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.981] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650053, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0081.981] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.981] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f006c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0081.982] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.982] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0081.983] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690056, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0081.986] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0081.986] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0081.987] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0081.988] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.988] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0038, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0081.989] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.989] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720042, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0081.989] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.990] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.991] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0081.994] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f760, dwReserved1=0x2d1290, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0081.995] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.000] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.005] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x490055, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.005] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de525d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.008] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.008] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.008] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfaf6400, ftLastAccessTime.dwHighDateTime=0x1d67814, ftLastWriteTime.dwLowDateTime=0xfaf6400, ftLastWriteTime.dwHighDateTime=0x1d67814, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.009] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfad02a0, ftLastAccessTime.dwHighDateTime=0x1d67814, ftLastWriteTime.dwLowDateTime=0xfaf6400, ftLastWriteTime.dwHighDateTime=0x1d67814, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.011] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc4d060, ftLastAccessTime.dwHighDateTime=0x1d67814, ftLastWriteTime.dwLowDateTime=0xfc4d060, ftLastWriteTime.dwHighDateTime=0x1d67814, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.012] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.013] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.014] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.014] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5ed8, dwReserved1=0x2d5ed3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0082.016] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d6ee0, dwReserved1=0x2d6edb, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0082.018] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0082.019] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d7ee8, dwReserved1=0x2d7ee3, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0082.024] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27eb7240, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2d7f8c, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0082.024] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d7ee8, dwReserved1=0x2d7ee3, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0082.025] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e63e0, dwReserved1=0x2e63db, cFileName=".", cAlternateFileName="")) returned 0x2e35f8 [0082.026] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73e8, dwReserved1=0x2e73e3, cFileName=".", cAlternateFileName="")) returned 0x2e3638 [0082.030] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27edd3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e35f8 [0082.031] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x700061, dwReserved1=0x48005c, cFileName=".", cAlternateFileName="")) returned 0x2e35f8 [0082.036] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.037] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610044, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.038] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2da446, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.067] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.068] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.069] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.069] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AIT\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.069] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x283ea490, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x9b86da60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9b86da60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.071] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.072] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.073] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.074] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.074] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610043, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.074] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.077] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740078, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.089] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 01.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma.wannacry" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 01.wma.wannacry")) returned 1 [0082.097] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 02.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma.wannacry" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 02.wma.wannacry")) returned 1 [0082.101] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 03.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma.wannacry" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 03.wma.wannacry")) returned 1 [0082.108] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 04.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma.wannacry" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 04.wma.wannacry")) returned 1 [0082.112] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 05.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma.wannacry" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 05.wma.wannacry")) returned 1 [0082.116] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 06.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma.wannacry" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 06.wma.wannacry")) returned 1 [0082.120] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 07.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma.wannacry" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 07.wma.wannacry")) returned 1 [0082.125] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 08.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma.wannacry" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 08.wma.wannacry")) returned 1 [0082.130] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 09.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma.wannacry" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 09.wma.wannacry")) returned 1 [0082.134] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 10.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma.wannacry" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 10.wma.wannacry")) returned 1 [0082.135] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2000002, dwReserved1=0x2e33d0, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.136] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.136] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.136] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.137] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x700055, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.139] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f610, dwReserved1=0x2d5f60, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.139] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5ed8, dwReserved1=0x2d5ed3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0082.139] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d6ee0, dwReserved1=0x2d6edb, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0082.145] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2e44aa, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0082.147] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440020, dwReserved1=0x430045, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0082.148] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2e44aa, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0082.150] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0053, dwReserved1=0x780074, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0082.154] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d6f7a, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0082.155] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d6f7a, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0082.173] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0082.176] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d6f7a, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0082.179] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f370, dwReserved1=0x2d7fa4, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0082.184] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d6f7a, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0082.188] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f4c0, dwReserved1=0x2d6f7a, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0082.191] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0082.192] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Templates\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.193] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.193] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.194] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb59300, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2fb59300, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.195] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x591e8ca0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0x591e8ca0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450057, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.197] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fb3099, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.197] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.197] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.198] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fff35a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.202] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.203] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.203] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7690f9e4, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7690f9e4, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.204] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.204] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xcfc0a7e0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0xcfc0a7e0, ftLastWriteTime.dwHighDateTime=0x1d2faf9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5ed8, dwReserved1=0x2d5ed3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0082.206] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xa13d69d0, ftLastAccessTime.dwHighDateTime=0x1d2dda3, ftLastWriteTime.dwLowDateTime=0xa13d69d0, ftLastWriteTime.dwHighDateTime=0x1d2dda3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0082.206] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d69d0, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0x80be8ad0, ftLastAccessTime.dwHighDateTime=0x1d33740, ftLastWriteTime.dwLowDateTime=0x80be8ad0, ftLastWriteTime.dwHighDateTime=0x1d33740, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d6ee0, dwReserved1=0x2d6edb, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0082.208] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xb9820270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb9820270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0082.214] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74002e, dwReserved1=0x740078, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0082.214] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76792c22, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690048, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.216] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.216] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.219] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.219] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.219] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5ed8, dwReserved1=0x2d5ed3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0082.221] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.222] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.223] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.223] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.223] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5ed8, dwReserved1=0x2d5ed3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0082.226] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690056, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.231] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d48e8, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.231] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.232] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft Help\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x770057, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0082.242] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Mozilla\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.242] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Mozilla\\logs\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0082.244] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Oracle\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0082.245] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0082.248] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.249] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.249] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.249] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5ed8, dwReserved1=0x2d5ed3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0082.251] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.253] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.253] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.254] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5ed8, dwReserved1=0x2d5ed3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0082.256] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.256] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.257] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.261] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xecd314a0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.264] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4c0049, dwReserved1=0x530045, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.265] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.266] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.269] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a127460, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.273] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4c0049, dwReserved1=0x530045, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.274] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.275] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.280] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.281] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.282] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.286] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.289] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.290] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.293] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.293] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.294] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a257f60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a257f60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.298] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.298] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.299] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.303] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.304] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.305] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.309] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.309] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.311] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.315] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfaaff840, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.319] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4c0049, dwReserved1=0x530045, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.322] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.322] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.325] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.326] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.327] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa938e870, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa938e870, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.331] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa912d270, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610070, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.339] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcad7040, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4c0049, dwReserved1=0x530045, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.344] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93efac0, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf93efac0, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4c0049, dwReserved1=0x530045, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.349] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4c0049, dwReserved1=0x530045, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.349] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.350] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcc07b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcc07b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.354] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Start Menu\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0082.354] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Sun\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x46007b, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0082.355] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Sun\\Java\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.355] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.357] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Templates\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="Java", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0082.357] FindFirstFileA (in: lpFileName="C:\\Recovery\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x650054, dwReserved1=0x70006d, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0082.359] FindFirstFileA (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df3c0, dwReserved1=0x2df3bb, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0082.360] FindFirstFileA (in: lpFileName="C:\\System Volume Information\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0082.360] FindFirstFileA (in: lpFileName="C:\\Users\\*.*", lpFindFileData=0x18fce8 | out: lpFindFileData=0x18fce8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e3438 [0082.361] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*.*", lpFindFileData=0x18fb98 | out: lpFindFileData=0x18fb98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2df3c0, dwReserved1=0x2df3bb, cFileName=".", cAlternateFileName="")) returned 0x2e3478 [0082.361] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*.*", lpFindFileData=0x18fa48 | out: lpFindFileData=0x18fa48*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e23c8, dwReserved1=0x2e23c3, cFileName=".", cAlternateFileName="")) returned 0x2e34b8 [0082.361] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*.*", lpFindFileData=0x18f8f8 | out: lpFindFileData=0x18f8f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d93b0, dwReserved1=0x2d93ab, cFileName=".", cAlternateFileName="")) returned 0x2e33f8 [0082.361] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2da3b8, dwReserved1=0x2da3b3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.362] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5ed8, dwReserved1=0x2d5ed3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0082.362] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d6ee0, dwReserved1=0x2d6edb, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0082.365] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f220, dwReserved1=0x2e048e, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0082.368] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0082.369] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d7f88, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0082.371] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x2e002e, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630041, dwReserved1=0x3, cFileName="Color", cAlternateFileName="Äÿ\x18")) returned 0xffffffff [0082.372] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.372] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5ed8, dwReserved1=0x2d5ed3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0082.373] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d6ee0, dwReserved1=0x2d6edb, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0082.374] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d7ee8, dwReserved1=0x2d7ee3, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0082.374] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e63e0, dwReserved1=0x2e63db, cFileName=".", cAlternateFileName="")) returned 0x2e35f8 [0082.374] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73e8, dwReserved1=0x2e73e3, cFileName=".", cAlternateFileName="")) returned 0x2e3638 [0082.375] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e83f0, dwReserved1=0x2e83eb, cFileName=".", cAlternateFileName="")) returned 0x2e3678 [0082.376] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6365, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0082.376] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d7ee8, dwReserved1=0x2d7ee3, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0082.378] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e63e0, dwReserved1=0x2e63db, cFileName=".", cAlternateFileName="")) returned 0x2e35f8 [0082.383] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e35f8 [0082.388] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x700061, cFileName=".", cAlternateFileName="")) returned 0x2e35f8 [0082.393] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0032, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.396] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*.*", lpFindFileData=0x18f7a8 | out: lpFindFileData=0x18f7a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2d5f60, cFileName=".", cAlternateFileName="")) returned 0x2e34f8 [0082.396] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*.*", lpFindFileData=0x18f658 | out: lpFindFileData=0x18f658*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d5ed8, dwReserved1=0x2d5ed3, cFileName=".", cAlternateFileName="")) returned 0x2e3538 [0082.397] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*.*", lpFindFileData=0x18f508 | out: lpFindFileData=0x18f508*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d6ee0, dwReserved1=0x2d6edb, cFileName=".", cAlternateFileName="")) returned 0x2e3578 [0082.400] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d7ee8, dwReserved1=0x2d7ee3, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0082.401] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e002e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0082.406] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e74b2, cFileName=".", cAlternateFileName="")) returned 0x2e35f8 [0082.406] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*.*", lpFindFileData=0x18f3b8 | out: lpFindFileData=0x18f3b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e35b8 [0082.410] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e63e0, dwReserved1=0x2e63db, cFileName=".", cAlternateFileName="")) returned 0x2e35f8 [0082.419] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f0d0, dwReserved1=0x2e74b0, cFileName=".", cAlternateFileName="")) returned 0x2e35f8 [0082.423] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82bed750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630075, dwReserved1=0x690074, cFileName=".", cAlternateFileName="")) returned 0x2e35f8 [0082.427] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82556720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20006e, dwReserved1=0x750052, cFileName=".", cAlternateFileName="")) returned 0x2e35f8 [0082.432] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*.*", lpFindFileData=0x18f268 | out: lpFindFileData=0x18f268*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20006e, dwReserved1=0x740053, cFileName=".", cAlternateFileName="")) returned 0x2e35f8 [0082.435] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e73e8, dwReserved1=0x2e73e3, cFileName=".", cAlternateFileName="")) returned 0x2e3638 [0082.437] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e83f0, dwReserved1=0x2e83eb, cFileName=".", cAlternateFileName="")) returned 0x2e3678 [0082.442] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ece0, dwReserved1=0x2ea52c, cFileName=".", cAlternateFileName="")) returned 0x2e36b8 [0082.451] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857953d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ea400, dwReserved1=0x2ea3fb, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.453] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.455] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.458] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.460] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.462] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.464] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.466] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.471] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20004f, dwReserved1=0x450044, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.474] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20004f, dwReserved1=0x450044, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.476] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.478] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.481] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.482] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.485] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.487] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.489] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.491] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.493] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.495] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.498] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.499] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.502] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.504] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.506] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.508] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.510] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.512] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.514] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.516] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20004f, dwReserved1=0x450044, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.519] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20004f, dwReserved1=0x450044, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.521] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.523] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.525] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.527] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.529] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.533] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.535] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.538] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.543] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.550] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.552] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20004f, dwReserved1=0x450044, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.554] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e36b8 [0082.559] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e3638 [0082.559] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e83f0, dwReserved1=0x2e83eb, cFileName=".", cAlternateFileName="")) returned 0x2e3678 [0082.565] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ece0, dwReserved1=0x2ea52c, cFileName=".", cAlternateFileName="")) returned 0x2e36b8 [0082.567] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ea400, dwReserved1=0x2ea3fb, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.569] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.571] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.574] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.575] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.579] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.580] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.583] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.585] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20004f, dwReserved1=0x450044, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.587] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20004f, dwReserved1=0x450044, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.590] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.591] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.594] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.596] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.601] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.602] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.605] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.607] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.609] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.611] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.613] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.616] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.618] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.619] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.622] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865d1c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.624] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f7db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865f7db0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.626] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.628] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.631] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.632] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20004f, dwReserved1=0x450044, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.635] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8666a1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20004f, dwReserved1=0x450044, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.637] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.639] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.641] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.643] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.644] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.647] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.648] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.651] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.656] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.658] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430045, dwReserved1=0x590052, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.660] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20004f, dwReserved1=0x450044, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.663] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e36b8 [0082.668] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x819d0bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e3638 [0082.669] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e83f0, dwReserved1=0x2e83eb, cFileName=".", cAlternateFileName="")) returned 0x2e3678 [0082.673] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ece0, dwReserved1=0x2ea52e, cFileName=".", cAlternateFileName="")) returned 0x2e36b8 [0082.676] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ea400, dwReserved1=0x2ea3fb, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.678] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.681] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.682] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.685] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.687] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.689] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.691] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.693] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.695] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.698] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.699] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x540020, dwReserved1=0x20004f, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.702] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.705] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.708] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.710] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440020, dwReserved1=0x430045, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.713] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.715] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.717] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.719] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.721] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.723] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.726] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.727] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.732] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.733] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.736] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.737] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.740] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.741] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.744] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.745] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.748] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.750] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.752] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.754] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.756] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.758] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.760] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.762] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.767] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.769] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.772] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x450044, dwReserved1=0x520043, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.773] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4f0054, dwReserved1=0x440020, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.776] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e36b8 [0082.778] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\*.*", lpFindFileData=0x18f118 | out: lpFindFileData=0x18f118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76c5023c, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x2e3638 [0082.778] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\*.*", lpFindFileData=0x18efc8 | out: lpFindFileData=0x18efc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e83f0, dwReserved1=0x2e83eb, cFileName=".", cAlternateFileName="")) returned 0x2e3678 [0082.784] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\*.*", lpFindFileData=0x18ee78 | out: lpFindFileData=0x18ee78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ece0, dwReserved1=0x2ea530, cFileName=".", cAlternateFileName="")) returned 0x2e36b8 [0082.786] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2ea400, dwReserved1=0x2ea3fb, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.788] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440020, dwReserved1=0x430045, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.791] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440020, dwReserved1=0x430045, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.795] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440020, dwReserved1=0x430045, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0082.797] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\*.*", lpFindFileData=0x18ed28 | out: lpFindFileData=0x18ed28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x440020, dwReserved1=0x430045, cFileName=".", cAlternateFileName="")) returned 0x2e36f8 [0083.135] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.wannacry")) returned 1 [0083.844] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg.wannacry")) returned 1 [0083.848] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg.wannacry")) returned 1 [0083.852] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg.wannacry")) returned 1 [0083.856] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg.wannacry")) returned 1 [0083.860] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg.wannacry")) returned 1 [0083.864] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg.wannacry")) returned 1 [0083.867] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg.wannacry")) returned 1 [0083.871] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg.wannacry")) returned 1 [0083.875] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg.wannacry")) returned 1 [0083.878] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg.wannacry")) returned 1 [0083.881] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg.wannacry")) returned 1 [0083.887] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg.wannacry")) returned 1 [0083.891] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg.wannacry")) returned 1 [0083.894] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg.wannacry")) returned 1 [0083.897] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg.wannacry")) returned 1 [0083.902] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg.wannacry")) returned 1 [0083.906] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg.wannacry")) returned 1 [0083.909] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg.wannacry")) returned 1 [0083.912] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg.wannacry")) returned 1 [0083.915] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg.wannacry")) returned 1 [0083.919] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg.wannacry")) returned 1 [0083.923] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg.wannacry")) returned 1 [0083.927] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg.wannacry")) returned 1 [0083.930] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg.wannacry")) returned 1 [0083.934] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg.wannacry")) returned 1 [0083.938] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg.wannacry")) returned 1 [0083.944] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg.wannacry")) returned 1 [0083.948] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg.wannacry")) returned 1 [0083.952] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg.wannacry")) returned 1 [0083.956] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg.wannacry")) returned 1 [0083.960] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg.wannacry")) returned 1 [0083.966] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg.wannacry")) returned 1 [0083.970] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg.wannacry")) returned 1 [0083.974] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg.wannacry")) returned 1 [0083.978] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg.wannacry")) returned 1 [0083.982] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg.wannacry")) returned 1 [0083.988] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg.wannacry")) returned 1 [0083.992] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg.wannacry")) returned 1 [0083.996] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg.wannacry")) returned 1 [0084.000] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg.wannacry")) returned 1 [0084.004] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg.wannacry")) returned 1 [0084.008] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg.wannacry")) returned 1 [0084.012] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg.wannacry")) returned 1 [0084.018] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg.wannacry")) returned 1 [0084.022] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg.wannacry")) returned 1 [0084.026] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg.wannacry")) returned 1 [0084.032] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg.wannacry")) returned 1 [0084.036] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg.wannacry")) returned 1 [0084.040] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg.wannacry")) returned 1 [0084.044] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg.wannacry")) returned 1 [0084.048] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg.wannacry")) returned 1 [0084.052] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg.wannacry")) returned 1 [0084.056] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg.wannacry")) returned 1 [0084.060] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg.wannacry")) returned 1 [0084.064] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg.wannacry")) returned 1 [0084.068] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg.wannacry")) returned 1 [0084.073] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg.wannacry")) returned 1 [0084.078] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg.wannacry")) returned 1 [0084.090] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\000000929096[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\000000929096[1].gif.wannacry")) returned 1 [0084.099] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.wannacry")) returned 1 [0084.103] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg.wannacry")) returned 1 [0084.107] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg.wannacry")) returned 1 [0084.114] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg.wannacry")) returned 1 [0084.118] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg.wannacry")) returned 1 [0084.123] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg.wannacry")) returned 1 [0084.126] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg.wannacry")) returned 1 [0084.130] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg.wannacry")) returned 1 [0084.134] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg.wannacry")) returned 1 [0084.138] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg.wannacry")) returned 1 [0084.141] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg.wannacry")) returned 1 [0084.144] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg.wannacry")) returned 1 [0084.150] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg.wannacry")) returned 1 [0084.153] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg.wannacry")) returned 1 [0084.157] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg.wannacry")) returned 1 [0084.176] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg.wannacry")) returned 1 [0084.181] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg.wannacry")) returned 1 [0084.185] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg.wannacry")) returned 1 [0084.188] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg.wannacry")) returned 1 [0084.192] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg.wannacry")) returned 1 [0084.195] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg.wannacry")) returned 1 [0084.197] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg.wannacry")) returned 1 [0084.200] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg.wannacry")) returned 1 [0084.269] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg.wannacry")) returned 1 [0084.273] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg.wannacry")) returned 1 [0084.277] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg.wannacry")) returned 1 [0084.281] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg.wannacry")) returned 1 [0084.284] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg.wannacry")) returned 1 [0084.288] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg.wannacry")) returned 1 [0084.294] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg.wannacry")) returned 1 [0084.298] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg.wannacry")) returned 1 [0084.301] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg.wannacry")) returned 1 [0084.304] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg.wannacry")) returned 1 [0084.308] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg.wannacry")) returned 1 [0084.311] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg.wannacry")) returned 1 [0084.314] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg.wannacry")) returned 1 [0084.318] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg.wannacry")) returned 1 [0084.322] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg.wannacry")) returned 1 [0084.325] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg.wannacry")) returned 1 [0084.332] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg.wannacry")) returned 1 [0084.336] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg.wannacry")) returned 1 [0084.339] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg.wannacry")) returned 1 [0084.343] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg.wannacry")) returned 1 [0084.348] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg.wannacry")) returned 1 [0084.351] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg.wannacry")) returned 1 [0084.358] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg.wannacry")) returned 1 [0084.362] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg.wannacry")) returned 1 [0084.366] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg.wannacry")) returned 1 [0084.369] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg.wannacry")) returned 1 [0084.372] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg.wannacry")) returned 1 [0084.375] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg.wannacry")) returned 1 [0084.380] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg.wannacry")) returned 1 [0084.383] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg.wannacry")) returned 1 [0084.387] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg.wannacry")) returned 1 [0084.480] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg.wannacry")) returned 1 [0084.488] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg.wannacry")) returned 1 [0084.495] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg.wannacry")) returned 1 [0084.500] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg.wannacry")) returned 1 [0084.507] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg.wannacry")) returned 1 [0084.513] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg.wannacry")) returned 1 [0084.515] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\collect[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\collect[1].gif.wannacry")) returned 1 [0084.517] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e151e5[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e151e5[1].gif.wannacry")) returned 1 [0084.592] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\19619569[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\19619569[1].gif.wannacry")) returned 1 [0084.724] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg.wannacry")) returned 1 [0084.729] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg.wannacry")) returned 1 [0084.748] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg.wannacry")) returned 1 [0084.753] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg.wannacry")) returned 1 [0084.757] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg.wannacry")) returned 1 [0084.760] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg.wannacry")) returned 1 [0084.765] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg.wannacry")) returned 1 [0084.769] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg.wannacry")) returned 1 [0084.773] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg.wannacry")) returned 1 [0084.776] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg.wannacry")) returned 1 [0084.787] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg.wannacry")) returned 1 [0084.795] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg.wannacry")) returned 1 [0084.799] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg.wannacry")) returned 1 [0084.804] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg.wannacry")) returned 1 [0084.812] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg.wannacry")) returned 1 [0084.823] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg.wannacry")) returned 1 [0084.859] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg.wannacry")) returned 1 [0084.865] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg.wannacry")) returned 1 [0084.869] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg.wannacry")) returned 1 [0084.873] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg.wannacry")) returned 1 [0084.882] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg.wannacry")) returned 1 [0084.886] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg.wannacry")) returned 1 [0084.890] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg.wannacry")) returned 1 [0084.893] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg.wannacry")) returned 1 [0084.897] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg.wannacry")) returned 1 [0084.902] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg.wannacry")) returned 1 [0084.924] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg.wannacry")) returned 1 [0084.930] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg.wannacry")) returned 1 [0084.937] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg.wannacry")) returned 1 [0084.953] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg.wannacry")) returned 1 [0084.957] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg.wannacry")) returned 1 [0084.963] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg.wannacry")) returned 1 [0084.967] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg.wannacry")) returned 1 [0084.973] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg.wannacry")) returned 1 [0085.008] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg.wannacry")) returned 1 [0085.012] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg.wannacry")) returned 1 [0085.017] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg.wannacry")) returned 1 [0085.021] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg.wannacry")) returned 1 [0085.025] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg.wannacry")) returned 1 [0085.032] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg.wannacry")) returned 1 [0085.038] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg.wannacry")) returned 1 [0085.047] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg.wannacry")) returned 1 [0085.082] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg.wannacry")) returned 1 [0085.100] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg.wannacry")) returned 1 [0085.107] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg.wannacry")) returned 1 [0085.112] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg.wannacry")) returned 1 [0085.151] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg.wannacry")) returned 1 [0085.158] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg.wannacry")) returned 1 [0085.176] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg.wannacry")) returned 1 [0085.181] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg.wannacry")) returned 1 [0085.188] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg.wannacry")) returned 1 [0085.191] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg.wannacry")) returned 1 [0085.195] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg.wannacry")) returned 1 [0085.203] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg.wannacry")) returned 1 [0085.207] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg.wannacry")) returned 1 [0085.210] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg.wannacry")) returned 1 [0085.213] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome_throbber_fast_16[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome_throbber_fast_16[1].gif.wannacry")) returned 1 [0085.214] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\collect[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\collect[1].gif.wannacry")) returned 1 [0085.218] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg.wannacry")) returned 1 [0085.224] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg.wannacry")) returned 1 [0085.237] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.wannacry")) returned 1 [0085.241] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg.wannacry")) returned 1 [0085.244] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg.wannacry")) returned 1 [0085.248] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg.wannacry")) returned 1 [0085.252] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg.wannacry")) returned 1 [0085.255] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg.wannacry")) returned 1 [0085.258] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg.wannacry")) returned 1 [0085.261] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg.wannacry")) returned 1 [0085.268] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg.wannacry")) returned 1 [0085.272] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg.wannacry")) returned 1 [0085.275] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg.wannacry")) returned 1 [0085.282] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg.wannacry")) returned 1 [0085.288] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg.wannacry")) returned 1 [0085.292] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg.wannacry")) returned 1 [0085.306] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg.wannacry")) returned 1 [0085.321] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg.wannacry")) returned 1 [0085.351] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg.wannacry")) returned 1 [0085.356] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg.wannacry")) returned 1 [0085.363] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg.wannacry")) returned 1 [0085.371] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg.wannacry")) returned 1 [0085.411] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg.wannacry")) returned 1 [0085.428] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg.wannacry")) returned 1 [0085.435] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg.wannacry")) returned 1 [0085.440] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg.wannacry")) returned 1 [0085.474] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg.wannacry")) returned 1 [0085.479] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg.wannacry")) returned 1 [0085.483] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg.wannacry")) returned 1 [0085.491] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg.wannacry")) returned 1 [0085.500] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg.wannacry")) returned 1 [0085.504] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg.wannacry")) returned 1 [0085.511] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg.wannacry")) returned 1 [0085.519] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg.wannacry")) returned 1 [0085.522] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg.wannacry")) returned 1 [0085.526] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg.wannacry")) returned 1 [0085.535] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg.wannacry")) returned 1 [0085.538] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg.wannacry")) returned 1 [0085.543] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg.wannacry")) returned 1 [0085.548] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg.wannacry")) returned 1 [0085.553] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg.wannacry")) returned 1 [0085.556] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg.wannacry")) returned 1 [0085.560] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg.wannacry")) returned 1 [0085.564] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg.wannacry")) returned 1 [0085.568] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg.wannacry")) returned 1 [0085.607] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg.wannacry")) returned 1 [0085.619] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg.wannacry")) returned 1 [0085.631] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg.wannacry")) returned 1 [0085.655] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg.wannacry")) returned 1 [0085.677] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg.wannacry")) returned 1 [0085.686] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg.wannacry")) returned 1 [0085.726] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg.wannacry")) returned 1 [0085.730] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg.wannacry")) returned 1 [0085.741] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg.wannacry")) returned 1 [0085.745] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg.wannacry")) returned 1 [0085.749] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg.wannacry")) returned 1 [0085.752] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg.wannacry")) returned 1 [0085.860] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg.wannacry")) returned 1 [0085.925] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg.wannacry")) returned 1 [0085.929] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg.wannacry")) returned 1 [0085.966] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg.wannacry")) returned 1 [0086.040] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg.wannacry")) returned 1 [0086.044] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg.wannacry")) returned 1 [0086.051] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.wannacry")) returned 1 [0086.055] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg.wannacry")) returned 1 [0086.063] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg.wannacry")) returned 1 [0086.070] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg.wannacry")) returned 1 [0086.078] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg.wannacry")) returned 1 [0086.082] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.wannacry")) returned 1 [0086.094] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg.wannacry")) returned 1 [0086.227] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg.wannacry")) returned 1 [0086.709] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\101c4vzF8hgk0CKCkE.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\101c4vzf8hgk0ckcke.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\101c4vzF8hgk0CKCkE.wav.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\101c4vzf8hgk0ckcke.wav.wannacry")) returned 1 [0086.712] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4_iuvmCVmRVKd6.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\4_iuvmcvmrvkd6.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4_iuvmCVmRVKd6.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\4_iuvmcvmrvkd6.jpg.wannacry")) returned 1 [0086.715] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\862y-8HgwTD.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\862y-8hgwtd.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\862y-8HgwTD.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\862y-8hgwtd.jpg.wannacry")) returned 1 [0086.718] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8fLb4XbNkx.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\8flb4xbnkx.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8fLb4XbNkx.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\8flb4xbnkx.jpg.wannacry")) returned 1 [0086.721] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9sNg.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9sng.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\9sNg.mp3.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\9sng.mp3.wannacry")) returned 1 [0086.724] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Bivh1kI.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\bivh1ki.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Bivh1kI.mp3.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\bivh1ki.mp3.wannacry")) returned 1 [0086.727] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cmZ7A3ZcBVad.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cmz7a3zcbvad.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cmZ7A3ZcBVad.doc.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cmz7a3zcbvad.doc.wannacry")) returned 1 [0086.732] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\f _huLm.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\f _hulm.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\f _huLm.xlsx.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\f _hulm.xlsx.wannacry")) returned 1 [0086.737] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iOx-H3reJ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\iox-h3rej.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iOx-H3reJ.wav.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\iox-h3rej.wav.wannacry")) returned 1 [0086.739] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\KZAORDcQuy-.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\kzaordcquy-.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\KZAORDcQuy-.mp3.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\kzaordcquy-.mp3.wannacry")) returned 1 [0086.741] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MmLI-.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\mmli-.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\MmLI-.mp3.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\mmli-.mp3.wannacry")) returned 1 [0086.743] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NtacR nQGlTG.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ntacr nqgltg.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\NtacR nQGlTG.flv.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\ntacr nqgltg.flv.wannacry")) returned 1 [0086.745] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\r7WVLA_M.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\r7wvla_m.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\r7WVLA_M.wav.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\r7wvla_m.wav.wannacry")) returned 1 [0086.748] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDJDZ.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tdjdz.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\TDJDZ.mp4.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tdjdz.mp4.wannacry")) returned 1 [0086.817] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\tw9I0XA_lng-7rYgag.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tw9i0xa_lng-7rygag.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\tw9I0XA_lng-7rYgag.mp4.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\tw9i0xa_lng-7rygag.mp4.wannacry")) returned 1 [0087.429] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip.wannacry")) returned 1 [0087.638] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1XXDV0jTeFbCykrrdK0.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\1xxdv0jtefbcykrrdk0.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1XXDV0jTeFbCykrrdK0.xlsx.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\1xxdv0jtefbcykrrdk0.xlsx.wannacry")) returned 1 [0087.641] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\53Ab6z2ZCYyIsp.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\53ab6z2zcyyisp.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\53Ab6z2ZCYyIsp.mp4.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\53ab6z2zcyyisp.mp4.wannacry")) returned 1 [0087.643] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8j3gAjhhU0DpYLxyt74C.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\8j3gajhhu0dpylxyt74c.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8j3gAjhhU0DpYLxyt74C.mp3.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\8j3gajhhu0dpylxyt74c.mp3.wannacry")) returned 1 [0087.714] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Aqczhk.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\aqczhk.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Aqczhk.avi.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\aqczhk.avi.wannacry")) returned 1 [0087.718] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bHXYcc.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bhxycc.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bHXYcc.mp3.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bhxycc.mp3.wannacry")) returned 1 [0087.721] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bzOUx3LWBqj8r.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bzoux3lwbqj8r.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bzOUx3LWBqj8r.flv.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bzoux3lwbqj8r.flv.wannacry")) returned 1 [0087.723] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cemQ2.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\cemq2.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cemQ2.mp3.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\cemq2.mp3.wannacry")) returned 1 [0087.725] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\coJlA0g23m.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\cojla0g23m.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\coJlA0g23m.mp4.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\cojla0g23m.mp4.wannacry")) returned 1 [0087.727] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\d21m-5_hhl64I.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\d21m-5_hhl64i.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\d21m-5_hhl64I.gif.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\d21m-5_hhl64i.gif.wannacry")) returned 1 [0087.811] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dxiwNrswGPbZ-R1JaZXi.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dxiwnrswgpbz-r1jazxi.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dxiwNrswGPbZ-R1JaZXi.mkv.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dxiwnrswgpbz-r1jazxi.mkv.wannacry")) returned 1 [0087.815] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\e9uE.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\e9ue.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\e9uE.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\e9ue.jpg.wannacry")) returned 1 [0087.819] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eiQqC.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eiqqc.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eiQqC.mkv.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eiqqc.mkv.wannacry")) returned 1 [0087.822] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\EqkMkELw.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eqkmkelw.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\EqkMkELw.avi.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\eqkmkelw.avi.wannacry")) returned 1 [0087.825] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fTkaBfZT6kxU8cM1.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ftkabfzt6kxu8cm1.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fTkaBfZT6kxU8cM1.flv.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ftkabfzt6kxu8cm1.flv.wannacry")) returned 1 [0087.828] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hbC.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hbc.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hbC.mkv.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hbc.mkv.wannacry")) returned 1 [0087.832] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kIv-0vgxuOY.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kiv-0vgxuoy.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kIv-0vgxuOY.mp4.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kiv-0vgxuoy.mp4.wannacry")) returned 1 [0087.835] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\m8YWn.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\m8ywn.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\m8YWn.flv.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\m8ywn.flv.wannacry")) returned 1 [0088.224] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg.wannacry")) returned 1 [0088.256] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\n34V.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\n34v.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\n34V.mp4.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\n34v.mp4.wannacry")) returned 1 [0088.259] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\o7gdtms9n1-weTL.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\o7gdtms9n1-wetl.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\o7gdtms9n1-weTL.avi.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\o7gdtms9n1-wetl.avi.wannacry")) returned 1 [0088.262] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\p1dZyjv0MY.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\p1dzyjv0my.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\p1dZyjv0MY.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\p1dzyjv0my.jpg.wannacry")) returned 1 [0088.264] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rhu2Ftr.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rhu2ftr.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rhu2Ftr.mp3.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rhu2ftr.mp3.wannacry")) returned 1 [0088.267] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\sQF75V2yF.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\sqf75v2yf.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\sQF75V2yF.flv.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\sqf75v2yf.flv.wannacry")) returned 1 [0088.272] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\X5uTqhIY R6.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\x5utqhiy r6.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\X5uTqhIY R6.mp3.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\x5utqhiy r6.mp3.wannacry")) returned 1 [0088.275] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XgwFAPYrCRKOL80oPJ.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xgwfapyrcrkol80opj.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XgwFAPYrCRKOL80oPJ.xlsx.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xgwfapyrcrkol80opj.xlsx.wannacry")) returned 1 [0088.278] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XuzkztgEoheeMl.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xuzkztgeoheeml.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XuzkztgEoheeMl.wav.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xuzkztgeoheeml.wav.wannacry")) returned 1 [0088.280] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y62NtmwhGAOqMWDN8n.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\y62ntmwhgaoqmwdn8n.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y62NtmwhGAOqMWDN8n.avi.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\y62ntmwhgaoqmwdn8n.avi.wannacry")) returned 1 [0088.283] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ykszf_FOsqrPSkVmw.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ykszf_fosqrpskvmw.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ykszf_FOsqrPSkVmw.wav.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ykszf_fosqrpskvmw.wav.wannacry")) returned 1 [0088.285] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_fGgaAFZ72bxq.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_fggaafz72bxq.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_fGgaAFZ72bxq.gif.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_fggaafz72bxq.gif.wannacry")) returned 1 [0088.291] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2L4XyHdeNPR.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2l4xyhdenpr.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2L4XyHdeNPR.gif.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2l4xyhdenpr.gif.wannacry")) returned 1 [0088.295] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4GRsMfOscURXkrXD-.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\4grsmfoscurxkrxd-.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\4GRsMfOscURXkrXD-.avi.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\4grsmfoscurxkrxd-.avi.wannacry")) returned 1 [0088.300] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\0BSisH.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\0bsish.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\0BSisH.flv.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\0bsish.flv.wannacry")) returned 1 [0088.303] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\93JogwIgD.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\93jogwigd.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\93JogwIgD.wav.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\93jogwigd.wav.wannacry")) returned 1 [0088.306] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\hbuNa3iKMfdYkR0ENf b.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\hbuna3ikmfdykr0enf b.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\hbuNa3iKMfdYkR0ENf b.wav.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\hbuna3ikmfdykr0enf b.wav.wannacry")) returned 1 [0088.309] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\IHURvNNoIzCcLR.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\ihurvnnoizcclr.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\IHURvNNoIzCcLR.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\ihurvnnoizcclr.jpg.wannacry")) returned 1 [0088.315] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\ZJTjEh\\l78gIERR98tyP.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\zjtjeh\\l78gierr98typ.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\ZJTjEh\\l78gIERR98tyP.avi.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\zjtjeh\\l78gierr98typ.avi.wannacry")) returned 1 [0088.319] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\ZJTjEh\\LMgIFm X\\fyPvFyw-2Mx.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\zjtjeh\\lmgifm x\\fypvfyw-2mx.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\ZJTjEh\\LMgIFm X\\fyPvFyw-2Mx.mp3.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\zjtjeh\\lmgifm x\\fypvfyw-2mx.mp3.wannacry")) returned 1 [0088.323] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\ZJTjEh\\LMgIFm X\\LL6ncUoz.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\zjtjeh\\lmgifm x\\ll6ncuoz.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\ZJTjEh\\LMgIFm X\\LL6ncUoz.mkv.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\zjtjeh\\lmgifm x\\ll6ncuoz.mkv.wannacry")) returned 1 [0088.326] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\ZJTjEh\\LMgIFm X\\SNe3J6c17qhdS.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\zjtjeh\\lmgifm x\\sne3j6c17qhds.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\ZJTjEh\\LMgIFm X\\SNe3J6c17qhdS.wav.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\zjtjeh\\lmgifm x\\sne3j6c17qhds.wav.wannacry")) returned 1 [0088.330] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\ZJTjEh\\LMgIFm X\\TybOchEJ-RQWIb8Ju.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\zjtjeh\\lmgifm x\\tybochej-rqwib8ju.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\ZJTjEh\\LMgIFm X\\TybOchEJ-RQWIb8Ju.mkv.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\zjtjeh\\lmgifm x\\tybochej-rqwib8ju.mkv.wannacry")) returned 1 [0088.334] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\ZJTjEh\\LMgIFm X\\vIqND.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\zjtjeh\\lmgifm x\\viqnd.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\ZJTjEh\\LMgIFm X\\vIqND.flv.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\zjtjeh\\lmgifm x\\viqnd.flv.wannacry")) returned 1 [0088.338] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\ZJTjEh\\n1QqXxVe\\cBAlLxnR8cq.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\zjtjeh\\n1qqxxve\\cballxnr8cq.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\ZJTjEh\\n1QqXxVe\\cBAlLxnR8cq.mp4.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\zjtjeh\\n1qqxxve\\cballxnr8cq.mp4.wannacry")) returned 1 [0088.342] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\ZJTjEh\\n1QqXxVe\\fbXeM8\\94qGA.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\zjtjeh\\n1qqxxve\\fbxem8\\94qga.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\ZJTjEh\\n1QqXxVe\\fbXeM8\\94qGA.ppt.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\zjtjeh\\n1qqxxve\\fbxem8\\94qga.ppt.wannacry")) returned 1 [0088.345] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\ZJTjEh\\n1QqXxVe\\fbXeM8\\MaiAk.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\zjtjeh\\n1qqxxve\\fbxem8\\maiak.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\ZJTjEh\\n1QqXxVe\\fbXeM8\\MaiAk.gif.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\zjtjeh\\n1qqxxve\\fbxem8\\maiak.gif.wannacry")) returned 1 [0088.360] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\ZJTjEh\\n1QqXxVe\\i2hnvirZAchX2.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\zjtjeh\\n1qqxxve\\i2hnvirzachx2.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\ZJTjEh\\n1QqXxVe\\i2hnvirZAchX2.gif.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\zjtjeh\\n1qqxxve\\i2hnvirzachx2.gif.wannacry")) returned 1 [0088.363] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\ZJTjEh\\n1QqXxVe\\uST6_gqVeQppFPke.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\zjtjeh\\n1qqxxve\\ust6_gqveqppfpke.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\ZJTjEh\\n1QqXxVe\\uST6_gqVeQppFPke.mp4.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\zjtjeh\\n1qqxxve\\ust6_gqveqppfpke.mp4.wannacry")) returned 1 [0088.366] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\znNMw0j.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\znnmw0j.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6cv7vTX2pooMR7n-K\\znNMw0j.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6cv7vtx2poomr7n-k\\znnmw0j.jpg.wannacry")) returned 1 [0088.370] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9NlTjZR.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9nltjzr.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9NlTjZR.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9nltjzr.jpg.wannacry")) returned 1 [0088.374] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AWpI3GAZXH9q_.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\awpi3gazxh9q_.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\AWpI3GAZXH9q_.flv.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\awpi3gazxh9q_.flv.wannacry")) returned 1 [0088.377] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BJAxF.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bjaxf.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BJAxF.avi.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bjaxf.avi.wannacry")) returned 1 [0088.381] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CLYNiFI3ndg4.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\clynifi3ndg4.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CLYNiFI3ndg4.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\clynifi3ndg4.jpg.wannacry")) returned 1 [0088.384] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EQX YYA4.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\eqx yya4.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\EQX YYA4.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\eqx yya4.jpg.wannacry")) returned 1 [0088.388] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eyBc.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\eybc.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eyBc.mp4.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\eybc.mp4.wannacry")) returned 1 [0088.391] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HaWkB3yQAn54teXj.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hawkb3yqan54texj.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HaWkB3yQAn54teXj.wav.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hawkb3yqan54texj.wav.wannacry")) returned 1 [0088.397] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jtvHv0ycOMOAy.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jtvhv0ycomoay.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jtvHv0ycOMOAy.avi.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jtvhv0ycomoay.avi.wannacry")) returned 1 [0088.402] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KL z.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kl z.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KL z.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kl z.jpg.wannacry")) returned 1 [0088.406] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lahuo1.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lahuo1.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Lahuo1.docx.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lahuo1.docx.wannacry")) returned 1 [0088.409] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p3GnbLkaHGQ 8F.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p3gnblkahgq 8f.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\p3GnbLkaHGQ 8F.docx.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\p3gnblkahgq 8f.docx.wannacry")) returned 1 [0088.413] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\q1A 4jen0Sxf xnTGxGu.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\q1a 4jen0sxf xntgxgu.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\q1A 4jen0Sxf xnTGxGu.mp3.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\q1a 4jen0sxf xntgxgu.mp3.wannacry")) returned 1 [0088.417] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QxPxjQ-5.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qxpxjq-5.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QxPxjQ-5.avi.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qxpxjq-5.avi.wannacry")) returned 1 [0088.420] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\y-BgeFmvsY-.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\y-bgefmvsy-.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\y-BgeFmvsY-.avi.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\y-bgefmvsy-.avi.wannacry")) returned 1 [0088.424] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Y7XNoY7YH5r80EALpK0q.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\y7xnoy7yh5r80ealpk0q.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Y7XNoY7YH5r80EALpK0q.avi.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\y7xnoy7yh5r80ealpk0q.avi.wannacry")) returned 1 [0088.428] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1YbR.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\1ybr.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1YbR.docx.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\1ybr.docx.wannacry")) returned 1 [0088.431] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3CQ13RjzDe.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3cq13rjzde.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3CQ13RjzDe.xlsx.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3cq13rjzde.xlsx.wannacry")) returned 1 [0088.433] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4fINUULOSxBc.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\4finuulosxbc.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\4fINUULOSxBc.docx.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\4finuulosxbc.docx.wannacry")) returned 1 [0088.436] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7v7M216U.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\7v7m216u.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\7v7M216U.docx.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\7v7m216u.docx.wannacry")) returned 1 [0088.439] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\acTV\\Nb1IM.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\actv\\nb1im.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\acTV\\Nb1IM.xlsx.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\actv\\nb1im.xlsx.wannacry")) returned 1 [0088.443] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\acTV\\P773m47Q99 k3973v\\FUJeIxnp9a.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\actv\\p773m47q99 k3973v\\fujeixnp9a.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\acTV\\P773m47Q99 k3973v\\FUJeIxnp9a.xls.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\actv\\p773m47q99 k3973v\\fujeixnp9a.xls.wannacry")) returned 1 [0088.445] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\acTV\\P773m47Q99 k3973v\\SevBvy8cAwmZ04.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\actv\\p773m47q99 k3973v\\sevbvy8cawmz04.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\acTV\\P773m47Q99 k3973v\\SevBvy8cAwmZ04.pdf.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\actv\\p773m47q99 k3973v\\sevbvy8cawmz04.pdf.wannacry")) returned 1 [0088.448] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\acTV\\wxnUH2EvcqIA13GezH4w.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\actv\\wxnuh2evcqia13gezh4w.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\acTV\\wxnUH2EvcqIA13GezH4w.xls.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\actv\\wxnuh2evcqia13gezh4w.xls.wannacry")) returned 1 [0088.450] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\in5g_AhI7sXk91m63lGn.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\in5g_ahi7sxk91m63lgn.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\in5g_AhI7sXk91m63lGn.docx.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\in5g_ahi7sxk91m63lgn.docx.wannacry")) returned 1 [0088.453] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kPPHlK nmCeL7BA_wDe1.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kpphlk nmcel7ba_wde1.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kPPHlK nmCeL7BA_wDe1.pptx.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kpphlk nmcel7ba_wde1.pptx.wannacry")) returned 1 [0088.454] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\LcCt6KmY.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lcct6kmy.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\LcCt6KmY.docx.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lcct6kmy.docx.wannacry")) returned 1 [0088.466] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\N1FcL7YGE3Eip\\6I3Ox3.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\n1fcl7yge3eip\\6i3ox3.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\N1FcL7YGE3Eip\\6I3Ox3.doc.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\n1fcl7yge3eip\\6i3ox3.doc.wannacry")) returned 1 [0088.469] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\N1FcL7YGE3Eip\\NeOaMxH7.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\n1fcl7yge3eip\\neoamxh7.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\N1FcL7YGE3Eip\\NeOaMxH7.doc.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\n1fcl7yge3eip\\neoamxh7.doc.wannacry")) returned 1 [0088.477] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\N1FcL7YGE3Eip\\Yt1gLe-eOcNivd.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\n1fcl7yge3eip\\yt1gle-eocnivd.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\N1FcL7YGE3Eip\\Yt1gLe-eOcNivd.docx.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\n1fcl7yge3eip\\yt1gle-eocnivd.docx.wannacry")) returned 1 [0088.480] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OH0CfiBPeCX7S9.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh0cfibpecx7s9.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OH0CfiBPeCX7S9.xlsx.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oh0cfibpecx7s9.xlsx.wannacry")) returned 1 [0088.482] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OppPdU.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\opppdu.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OppPdU.xlsx.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\opppdu.xlsx.wannacry")) returned 1 [0088.486] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pr53Ho6e.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pr53ho6e.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pr53Ho6e.pptx.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pr53ho6e.pptx.wannacry")) returned 1 [0088.488] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qonGNggY22-.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qongnggy22-.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qonGNggY22-.xlsx.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qongnggy22-.xlsx.wannacry")) returned 1 [0088.491] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Rab aSiNX_B53Orw.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rab asinx_b53orw.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Rab aSiNX_B53Orw.docx.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rab asinx_b53orw.docx.wannacry")) returned 1 [0088.493] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\uIvV8NMbi-cxieX.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\uivv8nmbi-cxiex.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\uIvV8NMbi-cxieX.doc.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\uivv8nmbi-cxiex.doc.wannacry")) returned 1 [0088.496] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\v5F7zhJtOHy2qV.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\v5f7zhjtohy2qv.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\v5F7zhJtOHy2qV.doc.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\v5f7zhjtohy2qv.doc.wannacry")) returned 1 [0088.498] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\V8cSHramP.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\v8cshramp.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\V8cSHramP.pptx.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\v8cshramp.pptx.wannacry")) returned 1 [0088.501] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vIs 1ABNqx i.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vis 1abnqx i.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vIs 1ABNqx i.pptx.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vis 1abnqx i.pptx.wannacry")) returned 1 [0088.507] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VO3Nb-DT3vQPX0lkx.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vo3nb-dt3vqpx0lkx.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VO3Nb-DT3vQPX0lkx.doc.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vo3nb-dt3vqpx0lkx.doc.wannacry")) returned 1 [0088.550] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.zip") returned 0 [0088.550] lstrlenA (lpString="*.zip") returned 5 [0088.550] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.rar") returned 0 [0088.550] lstrlenA (lpString="*.rar") returned 5 [0088.550] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.7z") returned 0 [0088.550] lstrlenA (lpString="*.7z") returned 4 [0088.550] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.tar") returned 0 [0088.550] lstrlenA (lpString="*.tar") returned 5 [0088.550] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.gzip") returned 0 [0088.550] lstrlenA (lpString="*.gzip") returned 6 [0088.550] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.jpg") returned 0 [0088.550] lstrlenA (lpString="*.jpg") returned 5 [0088.550] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.jpeg") returned 0 [0088.550] lstrlenA (lpString="*.jpeg") returned 6 [0088.550] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.psd") returned 0 [0088.550] lstrlenA (lpString="*.psd") returned 5 [0088.550] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.gif") returned 0 [0088.550] lstrlenA (lpString="*.gif") returned 5 [0088.550] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.doc") returned 0 [0088.551] lstrlenA (lpString="*.doc") returned 5 [0088.551] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.docx") returned 0 [0088.551] lstrlenA (lpString="*.docx") returned 6 [0088.551] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.xls") returned 0 [0088.551] lstrlenA (lpString="*.xls") returned 5 [0088.551] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.xlsx") returned 0 [0088.551] lstrlenA (lpString="*.xlsx") returned 6 [0088.551] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.ppt") returned 0 [0088.551] lstrlenA (lpString="*.ppt") returned 5 [0088.551] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.pptx") returned 0 [0088.551] lstrlenA (lpString="*.pptx") returned 6 [0088.551] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.pdf") returned 0 [0088.551] lstrlenA (lpString="*.pdf") returned 5 [0088.551] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.mov") returned 0 [0088.551] lstrlenA (lpString="*.mov") returned 5 [0088.551] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.m2v") returned 0 [0088.551] lstrlenA (lpString="*.m2v") returned 5 [0088.551] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.3gp") returned 0 [0088.551] lstrlenA (lpString="*.3gp") returned 5 [0088.551] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.mpeg") returned 0 [0088.551] lstrlenA (lpString="*.mpeg") returned 6 [0088.551] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.mpg") returned 0 [0088.551] lstrlenA (lpString="*.mpg") returned 5 [0088.551] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.flv") returned 0 [0088.551] lstrlenA (lpString="*.flv") returned 5 [0088.551] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.avi") returned 0 [0088.551] lstrlenA (lpString="*.avi") returned 5 [0088.551] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.mp4") returned 0 [0088.552] lstrlenA (lpString="*.mp4") returned 5 [0088.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.wmv") returned 0 [0088.552] lstrlenA (lpString="*.wmv") returned 5 [0088.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.divx") returned 0 [0088.552] lstrlenA (lpString="*.divx") returned 6 [0088.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.mkv") returned 0 [0088.552] lstrlenA (lpString="*.mkv") returned 5 [0088.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.mp3") returned 0 [0088.552] lstrlenA (lpString="*.mp3") returned 5 [0088.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.wav") returned 0 [0088.552] lstrlenA (lpString="*.wav") returned 5 [0088.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.flac") returned 0 [0088.552] lstrlenA (lpString="*.flac") returned 6 [0088.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.ape") returned 0 [0088.552] lstrlenA (lpString="*.ape") returned 5 [0088.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.wma") returned 0 [0088.552] lstrlenA (lpString="*.wma") returned 5 [0088.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.ac3") returned 0 [0088.552] lstrlenA (lpString="*.ac3") returned 5 [0088.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZCtGOEx0byunjrP8b1.rtf", pszSpec="*.mxf") returned 0 [0088.552] lstrlenA (lpString="*.mxf") returned 5 [0088.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zowg9_axKkjTZs2uv.xlsx", pszSpec="*.zip") returned 0 [0088.552] lstrlenA (lpString="*.zip") returned 5 [0088.552] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zowg9_axKkjTZs2uv.xlsx", pszSpec="*.rar") returned 0 [0088.553] lstrlenA (lpString="*.rar") returned 5 [0088.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zowg9_axKkjTZs2uv.xlsx", pszSpec="*.7z") returned 0 [0088.553] lstrlenA (lpString="*.7z") returned 4 [0088.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zowg9_axKkjTZs2uv.xlsx", pszSpec="*.tar") returned 0 [0088.553] lstrlenA (lpString="*.tar") returned 5 [0088.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zowg9_axKkjTZs2uv.xlsx", pszSpec="*.gzip") returned 0 [0088.553] lstrlenA (lpString="*.gzip") returned 6 [0088.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zowg9_axKkjTZs2uv.xlsx", pszSpec="*.jpg") returned 0 [0088.553] lstrlenA (lpString="*.jpg") returned 5 [0088.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zowg9_axKkjTZs2uv.xlsx", pszSpec="*.jpeg") returned 0 [0088.553] lstrlenA (lpString="*.jpeg") returned 6 [0088.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zowg9_axKkjTZs2uv.xlsx", pszSpec="*.psd") returned 0 [0088.553] lstrlenA (lpString="*.psd") returned 5 [0088.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zowg9_axKkjTZs2uv.xlsx", pszSpec="*.gif") returned 0 [0088.553] lstrlenA (lpString="*.gif") returned 5 [0088.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zowg9_axKkjTZs2uv.xlsx", pszSpec="*.doc") returned 0 [0088.553] lstrlenA (lpString="*.doc") returned 5 [0088.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zowg9_axKkjTZs2uv.xlsx", pszSpec="*.docx") returned 0 [0088.553] lstrlenA (lpString="*.docx") returned 6 [0088.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zowg9_axKkjTZs2uv.xlsx", pszSpec="*.xls") returned 0 [0088.553] lstrlenA (lpString="*.xls") returned 5 [0088.553] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zowg9_axKkjTZs2uv.xlsx", pszSpec="*.xlsx") returned 1 [0088.553] lstrlenA (lpString="*.xlsx") returned 6 [0088.557] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zowg9_axKkjTZs2uv.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zowg9_axkkjtzs2uv.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zowg9_axKkjTZs2uv.xlsx.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zowg9_axkkjtzs2uv.xlsx.wannacry")) returned 1 [0088.563] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\2XAUm40W20.pdf", pszSpec="*.zip") returned 0 [0088.563] lstrlenA (lpString="*.zip") returned 5 [0088.563] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\2XAUm40W20.pdf", pszSpec="*.rar") returned 0 [0088.563] lstrlenA (lpString="*.rar") returned 5 [0088.563] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\2XAUm40W20.pdf", pszSpec="*.7z") returned 0 [0088.563] lstrlenA (lpString="*.7z") returned 4 [0088.563] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\2XAUm40W20.pdf", pszSpec="*.tar") returned 0 [0088.563] lstrlenA (lpString="*.tar") returned 5 [0088.563] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\2XAUm40W20.pdf", pszSpec="*.gzip") returned 0 [0088.563] lstrlenA (lpString="*.gzip") returned 6 [0088.563] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\2XAUm40W20.pdf", pszSpec="*.jpg") returned 0 [0088.563] lstrlenA (lpString="*.jpg") returned 5 [0088.563] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\2XAUm40W20.pdf", pszSpec="*.jpeg") returned 0 [0088.563] lstrlenA (lpString="*.jpeg") returned 6 [0088.563] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\2XAUm40W20.pdf", pszSpec="*.psd") returned 0 [0088.563] lstrlenA (lpString="*.psd") returned 5 [0088.564] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\2XAUm40W20.pdf", pszSpec="*.gif") returned 0 [0088.564] lstrlenA (lpString="*.gif") returned 5 [0088.564] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\2XAUm40W20.pdf", pszSpec="*.doc") returned 0 [0088.564] lstrlenA (lpString="*.doc") returned 5 [0088.564] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\2XAUm40W20.pdf", pszSpec="*.docx") returned 0 [0088.564] lstrlenA (lpString="*.docx") returned 6 [0088.564] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\2XAUm40W20.pdf", pszSpec="*.xls") returned 0 [0088.564] lstrlenA (lpString="*.xls") returned 5 [0088.564] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\2XAUm40W20.pdf", pszSpec="*.xlsx") returned 0 [0088.564] lstrlenA (lpString="*.xlsx") returned 6 [0088.564] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\2XAUm40W20.pdf", pszSpec="*.ppt") returned 0 [0088.564] lstrlenA (lpString="*.ppt") returned 5 [0088.564] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\2XAUm40W20.pdf", pszSpec="*.pptx") returned 0 [0088.564] lstrlenA (lpString="*.pptx") returned 6 [0088.564] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\2XAUm40W20.pdf", pszSpec="*.pdf") returned 1 [0088.564] lstrlenA (lpString="*.pdf") returned 5 [0088.567] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\2XAUm40W20.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zwydstui5o\\2xaum40w20.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\2XAUm40W20.pdf.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zwydstui5o\\2xaum40w20.pdf.wannacry")) returned 1 [0088.570] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\7 v2uTShgH.doc", pszSpec="*.zip") returned 0 [0088.570] lstrlenA (lpString="*.zip") returned 5 [0088.570] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\7 v2uTShgH.doc", pszSpec="*.rar") returned 0 [0088.570] lstrlenA (lpString="*.rar") returned 5 [0088.571] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\7 v2uTShgH.doc", pszSpec="*.7z") returned 0 [0088.571] lstrlenA (lpString="*.7z") returned 4 [0088.571] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\7 v2uTShgH.doc", pszSpec="*.tar") returned 0 [0088.571] lstrlenA (lpString="*.tar") returned 5 [0088.571] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\7 v2uTShgH.doc", pszSpec="*.gzip") returned 0 [0088.571] lstrlenA (lpString="*.gzip") returned 6 [0088.571] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\7 v2uTShgH.doc", pszSpec="*.jpg") returned 0 [0088.571] lstrlenA (lpString="*.jpg") returned 5 [0088.571] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\7 v2uTShgH.doc", pszSpec="*.jpeg") returned 0 [0088.571] lstrlenA (lpString="*.jpeg") returned 6 [0088.571] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\7 v2uTShgH.doc", pszSpec="*.psd") returned 0 [0088.571] lstrlenA (lpString="*.psd") returned 5 [0088.571] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\7 v2uTShgH.doc", pszSpec="*.gif") returned 0 [0088.571] lstrlenA (lpString="*.gif") returned 5 [0088.571] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\7 v2uTShgH.doc", pszSpec="*.doc") returned 1 [0088.571] lstrlenA (lpString="*.doc") returned 5 [0088.573] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\7 v2uTShgH.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zwydstui5o\\iqqym6phnibb2jgugeug\\7 v2utshgh.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\7 v2uTShgH.doc.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zwydstui5o\\iqqym6phnibb2jgugeug\\7 v2utshgh.doc.wannacry")) returned 1 [0088.574] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.zip") returned 0 [0088.574] lstrlenA (lpString="*.zip") returned 5 [0088.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.rar") returned 0 [0088.575] lstrlenA (lpString="*.rar") returned 5 [0088.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.7z") returned 0 [0088.575] lstrlenA (lpString="*.7z") returned 4 [0088.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.tar") returned 0 [0088.575] lstrlenA (lpString="*.tar") returned 5 [0088.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.gzip") returned 0 [0088.575] lstrlenA (lpString="*.gzip") returned 6 [0088.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.jpg") returned 0 [0088.575] lstrlenA (lpString="*.jpg") returned 5 [0088.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.jpeg") returned 0 [0088.575] lstrlenA (lpString="*.jpeg") returned 6 [0088.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.psd") returned 0 [0088.575] lstrlenA (lpString="*.psd") returned 5 [0088.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.gif") returned 0 [0088.575] lstrlenA (lpString="*.gif") returned 5 [0088.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.doc") returned 0 [0088.575] lstrlenA (lpString="*.doc") returned 5 [0088.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.docx") returned 0 [0088.575] lstrlenA (lpString="*.docx") returned 6 [0088.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.xls") returned 0 [0088.575] lstrlenA (lpString="*.xls") returned 5 [0088.575] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.xlsx") returned 0 [0088.575] lstrlenA (lpString="*.xlsx") returned 6 [0088.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.ppt") returned 0 [0088.576] lstrlenA (lpString="*.ppt") returned 5 [0088.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.pptx") returned 0 [0088.576] lstrlenA (lpString="*.pptx") returned 6 [0088.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.pdf") returned 0 [0088.576] lstrlenA (lpString="*.pdf") returned 5 [0088.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.mov") returned 0 [0088.576] lstrlenA (lpString="*.mov") returned 5 [0088.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.m2v") returned 0 [0088.576] lstrlenA (lpString="*.m2v") returned 5 [0088.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.3gp") returned 0 [0088.576] lstrlenA (lpString="*.3gp") returned 5 [0088.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.mpeg") returned 0 [0088.576] lstrlenA (lpString="*.mpeg") returned 6 [0088.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.mpg") returned 0 [0088.576] lstrlenA (lpString="*.mpg") returned 5 [0088.576] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.flv") returned 0 [0088.576] lstrlenA (lpString="*.flv") returned 5 [0088.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.avi") returned 0 [0088.577] lstrlenA (lpString="*.avi") returned 5 [0088.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.mp4") returned 0 [0088.577] lstrlenA (lpString="*.mp4") returned 5 [0088.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.wmv") returned 0 [0088.577] lstrlenA (lpString="*.wmv") returned 5 [0088.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.divx") returned 0 [0088.577] lstrlenA (lpString="*.divx") returned 6 [0088.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.mkv") returned 0 [0088.577] lstrlenA (lpString="*.mkv") returned 5 [0088.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.mp3") returned 0 [0088.577] lstrlenA (lpString="*.mp3") returned 5 [0088.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.wav") returned 0 [0088.577] lstrlenA (lpString="*.wav") returned 5 [0088.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.flac") returned 0 [0088.577] lstrlenA (lpString="*.flac") returned 6 [0088.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.ape") returned 0 [0088.577] lstrlenA (lpString="*.ape") returned 5 [0088.577] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.wma") returned 0 [0088.578] lstrlenA (lpString="*.wma") returned 5 [0088.578] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.ac3") returned 0 [0088.578] lstrlenA (lpString="*.ac3") returned 5 [0088.578] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\DHKIj7hg D.odp", pszSpec="*.mxf") returned 0 [0088.578] lstrlenA (lpString="*.mxf") returned 5 [0088.578] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\gJoQQt.pdf", pszSpec="*.zip") returned 0 [0088.578] lstrlenA (lpString="*.zip") returned 5 [0088.578] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\gJoQQt.pdf", pszSpec="*.rar") returned 0 [0088.578] lstrlenA (lpString="*.rar") returned 5 [0088.578] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\gJoQQt.pdf", pszSpec="*.7z") returned 0 [0088.578] lstrlenA (lpString="*.7z") returned 4 [0088.578] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\gJoQQt.pdf", pszSpec="*.tar") returned 0 [0088.578] lstrlenA (lpString="*.tar") returned 5 [0088.578] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\gJoQQt.pdf", pszSpec="*.gzip") returned 0 [0088.578] lstrlenA (lpString="*.gzip") returned 6 [0088.578] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\gJoQQt.pdf", pszSpec="*.jpg") returned 0 [0088.578] lstrlenA (lpString="*.jpg") returned 5 [0088.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\gJoQQt.pdf", pszSpec="*.jpeg") returned 0 [0088.579] lstrlenA (lpString="*.jpeg") returned 6 [0088.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\gJoQQt.pdf", pszSpec="*.psd") returned 0 [0088.579] lstrlenA (lpString="*.psd") returned 5 [0088.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\gJoQQt.pdf", pszSpec="*.gif") returned 0 [0088.579] lstrlenA (lpString="*.gif") returned 5 [0088.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\gJoQQt.pdf", pszSpec="*.doc") returned 0 [0088.579] lstrlenA (lpString="*.doc") returned 5 [0088.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\gJoQQt.pdf", pszSpec="*.docx") returned 0 [0088.579] lstrlenA (lpString="*.docx") returned 6 [0088.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\gJoQQt.pdf", pszSpec="*.xls") returned 0 [0088.579] lstrlenA (lpString="*.xls") returned 5 [0088.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\gJoQQt.pdf", pszSpec="*.xlsx") returned 0 [0088.579] lstrlenA (lpString="*.xlsx") returned 6 [0088.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\gJoQQt.pdf", pszSpec="*.ppt") returned 0 [0088.579] lstrlenA (lpString="*.ppt") returned 5 [0088.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\gJoQQt.pdf", pszSpec="*.pptx") returned 0 [0088.579] lstrlenA (lpString="*.pptx") returned 6 [0088.579] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\gJoQQt.pdf", pszSpec="*.pdf") returned 1 [0088.579] lstrlenA (lpString="*.pdf") returned 5 [0088.581] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\gJoQQt.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zwydstui5o\\iqqym6phnibb2jgugeug\\gjoqqt.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\gJoQQt.pdf.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zwydstui5o\\iqqym6phnibb2jgugeug\\gjoqqt.pdf.wannacry")) returned 1 [0088.584] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.zip") returned 0 [0088.584] lstrlenA (lpString="*.zip") returned 5 [0088.584] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.rar") returned 0 [0088.584] lstrlenA (lpString="*.rar") returned 5 [0088.584] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.7z") returned 0 [0088.584] lstrlenA (lpString="*.7z") returned 4 [0088.584] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.tar") returned 0 [0088.584] lstrlenA (lpString="*.tar") returned 5 [0088.584] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.gzip") returned 0 [0088.584] lstrlenA (lpString="*.gzip") returned 6 [0088.584] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.jpg") returned 0 [0088.585] lstrlenA (lpString="*.jpg") returned 5 [0088.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.jpeg") returned 0 [0088.585] lstrlenA (lpString="*.jpeg") returned 6 [0088.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.psd") returned 0 [0088.585] lstrlenA (lpString="*.psd") returned 5 [0088.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.gif") returned 0 [0088.585] lstrlenA (lpString="*.gif") returned 5 [0088.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.doc") returned 0 [0088.585] lstrlenA (lpString="*.doc") returned 5 [0088.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.docx") returned 0 [0088.585] lstrlenA (lpString="*.docx") returned 6 [0088.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.xls") returned 0 [0088.585] lstrlenA (lpString="*.xls") returned 5 [0088.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.xlsx") returned 0 [0088.585] lstrlenA (lpString="*.xlsx") returned 6 [0088.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.ppt") returned 0 [0088.585] lstrlenA (lpString="*.ppt") returned 5 [0088.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.pptx") returned 0 [0088.585] lstrlenA (lpString="*.pptx") returned 6 [0088.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.pdf") returned 0 [0088.585] lstrlenA (lpString="*.pdf") returned 5 [0088.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.mov") returned 0 [0088.585] lstrlenA (lpString="*.mov") returned 5 [0088.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.m2v") returned 0 [0088.585] lstrlenA (lpString="*.m2v") returned 5 [0088.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.3gp") returned 0 [0088.585] lstrlenA (lpString="*.3gp") returned 5 [0088.585] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.mpeg") returned 0 [0088.586] lstrlenA (lpString="*.mpeg") returned 6 [0088.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.mpg") returned 0 [0088.586] lstrlenA (lpString="*.mpg") returned 5 [0088.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.flv") returned 0 [0088.586] lstrlenA (lpString="*.flv") returned 5 [0088.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.avi") returned 0 [0088.586] lstrlenA (lpString="*.avi") returned 5 [0088.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.mp4") returned 0 [0088.586] lstrlenA (lpString="*.mp4") returned 5 [0088.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.wmv") returned 0 [0088.586] lstrlenA (lpString="*.wmv") returned 5 [0088.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.divx") returned 0 [0088.586] lstrlenA (lpString="*.divx") returned 6 [0088.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.mkv") returned 0 [0088.586] lstrlenA (lpString="*.mkv") returned 5 [0088.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.mp3") returned 0 [0088.586] lstrlenA (lpString="*.mp3") returned 5 [0088.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.wav") returned 0 [0088.586] lstrlenA (lpString="*.wav") returned 5 [0088.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.flac") returned 0 [0088.586] lstrlenA (lpString="*.flac") returned 6 [0088.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.ape") returned 0 [0088.586] lstrlenA (lpString="*.ape") returned 5 [0088.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.wma") returned 0 [0088.586] lstrlenA (lpString="*.wma") returned 5 [0088.586] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.ac3") returned 0 [0088.586] lstrlenA (lpString="*.ac3") returned 5 [0088.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\1JnWOlA68nc71otK.csv", pszSpec="*.mxf") returned 0 [0088.587] lstrlenA (lpString="*.mxf") returned 5 [0088.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.zip") returned 0 [0088.587] lstrlenA (lpString="*.zip") returned 5 [0088.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.rar") returned 0 [0088.590] lstrlenA (lpString="*.rar") returned 5 [0088.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.7z") returned 0 [0088.590] lstrlenA (lpString="*.7z") returned 4 [0088.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.tar") returned 0 [0088.590] lstrlenA (lpString="*.tar") returned 5 [0088.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.gzip") returned 0 [0088.590] lstrlenA (lpString="*.gzip") returned 6 [0088.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.jpg") returned 0 [0088.590] lstrlenA (lpString="*.jpg") returned 5 [0088.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.jpeg") returned 0 [0088.590] lstrlenA (lpString="*.jpeg") returned 6 [0088.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.psd") returned 0 [0088.590] lstrlenA (lpString="*.psd") returned 5 [0088.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.gif") returned 0 [0088.590] lstrlenA (lpString="*.gif") returned 5 [0088.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.doc") returned 0 [0088.590] lstrlenA (lpString="*.doc") returned 5 [0088.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.docx") returned 0 [0088.590] lstrlenA (lpString="*.docx") returned 6 [0088.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.xls") returned 0 [0088.590] lstrlenA (lpString="*.xls") returned 5 [0088.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.xlsx") returned 0 [0088.590] lstrlenA (lpString="*.xlsx") returned 6 [0088.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.ppt") returned 0 [0088.591] lstrlenA (lpString="*.ppt") returned 5 [0088.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.pptx") returned 0 [0088.591] lstrlenA (lpString="*.pptx") returned 6 [0088.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.pdf") returned 0 [0088.591] lstrlenA (lpString="*.pdf") returned 5 [0088.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.mov") returned 0 [0088.591] lstrlenA (lpString="*.mov") returned 5 [0088.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.m2v") returned 0 [0088.591] lstrlenA (lpString="*.m2v") returned 5 [0088.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.3gp") returned 0 [0088.591] lstrlenA (lpString="*.3gp") returned 5 [0088.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.mpeg") returned 0 [0088.591] lstrlenA (lpString="*.mpeg") returned 6 [0088.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.mpg") returned 0 [0088.591] lstrlenA (lpString="*.mpg") returned 5 [0088.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.flv") returned 0 [0088.591] lstrlenA (lpString="*.flv") returned 5 [0088.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.avi") returned 0 [0088.591] lstrlenA (lpString="*.avi") returned 5 [0088.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.mp4") returned 0 [0088.591] lstrlenA (lpString="*.mp4") returned 5 [0088.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.wmv") returned 0 [0088.591] lstrlenA (lpString="*.wmv") returned 5 [0088.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.divx") returned 0 [0088.591] lstrlenA (lpString="*.divx") returned 6 [0088.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.mkv") returned 0 [0088.591] lstrlenA (lpString="*.mkv") returned 5 [0088.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.mp3") returned 0 [0088.592] lstrlenA (lpString="*.mp3") returned 5 [0088.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.wav") returned 0 [0088.592] lstrlenA (lpString="*.wav") returned 5 [0088.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.flac") returned 0 [0088.592] lstrlenA (lpString="*.flac") returned 6 [0088.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.ape") returned 0 [0088.592] lstrlenA (lpString="*.ape") returned 5 [0088.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.wma") returned 0 [0088.592] lstrlenA (lpString="*.wma") returned 5 [0088.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.ac3") returned 0 [0088.592] lstrlenA (lpString="*.ac3") returned 5 [0088.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\Nx_WDUpNjW3.ods", pszSpec="*.mxf") returned 0 [0088.592] lstrlenA (lpString="*.mxf") returned 5 [0088.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\PXEgmRuaqV2Gyt.ppt", pszSpec="*.zip") returned 0 [0088.592] lstrlenA (lpString="*.zip") returned 5 [0088.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\PXEgmRuaqV2Gyt.ppt", pszSpec="*.rar") returned 0 [0088.592] lstrlenA (lpString="*.rar") returned 5 [0088.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\PXEgmRuaqV2Gyt.ppt", pszSpec="*.7z") returned 0 [0088.592] lstrlenA (lpString="*.7z") returned 4 [0088.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\PXEgmRuaqV2Gyt.ppt", pszSpec="*.tar") returned 0 [0088.592] lstrlenA (lpString="*.tar") returned 5 [0088.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\PXEgmRuaqV2Gyt.ppt", pszSpec="*.gzip") returned 0 [0088.593] lstrlenA (lpString="*.gzip") returned 6 [0088.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\PXEgmRuaqV2Gyt.ppt", pszSpec="*.jpg") returned 0 [0088.593] lstrlenA (lpString="*.jpg") returned 5 [0088.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\PXEgmRuaqV2Gyt.ppt", pszSpec="*.jpeg") returned 0 [0088.593] lstrlenA (lpString="*.jpeg") returned 6 [0088.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\PXEgmRuaqV2Gyt.ppt", pszSpec="*.psd") returned 0 [0088.593] lstrlenA (lpString="*.psd") returned 5 [0088.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\PXEgmRuaqV2Gyt.ppt", pszSpec="*.gif") returned 0 [0088.593] lstrlenA (lpString="*.gif") returned 5 [0088.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\PXEgmRuaqV2Gyt.ppt", pszSpec="*.doc") returned 0 [0088.593] lstrlenA (lpString="*.doc") returned 5 [0088.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\PXEgmRuaqV2Gyt.ppt", pszSpec="*.docx") returned 0 [0088.593] lstrlenA (lpString="*.docx") returned 6 [0088.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\PXEgmRuaqV2Gyt.ppt", pszSpec="*.xls") returned 0 [0088.593] lstrlenA (lpString="*.xls") returned 5 [0088.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\PXEgmRuaqV2Gyt.ppt", pszSpec="*.xlsx") returned 0 [0088.593] lstrlenA (lpString="*.xlsx") returned 6 [0088.593] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\PXEgmRuaqV2Gyt.ppt", pszSpec="*.ppt") returned 1 [0088.593] lstrlenA (lpString="*.ppt") returned 5 [0088.595] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\PXEgmRuaqV2Gyt.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zwydstui5o\\iqqym6phnibb2jgugeug\\_phjchx\\pxegmruaqv2gyt.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\PXEgmRuaqV2Gyt.ppt.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zwydstui5o\\iqqym6phnibb2jgugeug\\_phjchx\\pxegmruaqv2gyt.ppt.wannacry")) returned 1 [0088.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.zip") returned 0 [0088.597] lstrlenA (lpString="*.zip") returned 5 [0088.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.rar") returned 0 [0088.597] lstrlenA (lpString="*.rar") returned 5 [0088.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.7z") returned 0 [0088.597] lstrlenA (lpString="*.7z") returned 4 [0088.597] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.tar") returned 0 [0088.597] lstrlenA (lpString="*.tar") returned 5 [0088.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.gzip") returned 0 [0088.598] lstrlenA (lpString="*.gzip") returned 6 [0088.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.jpg") returned 0 [0088.598] lstrlenA (lpString="*.jpg") returned 5 [0088.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.jpeg") returned 0 [0088.598] lstrlenA (lpString="*.jpeg") returned 6 [0088.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.psd") returned 0 [0088.598] lstrlenA (lpString="*.psd") returned 5 [0088.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.gif") returned 0 [0088.598] lstrlenA (lpString="*.gif") returned 5 [0088.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.doc") returned 0 [0088.598] lstrlenA (lpString="*.doc") returned 5 [0088.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.docx") returned 0 [0088.598] lstrlenA (lpString="*.docx") returned 6 [0088.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.xls") returned 0 [0088.598] lstrlenA (lpString="*.xls") returned 5 [0088.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.xlsx") returned 0 [0088.598] lstrlenA (lpString="*.xlsx") returned 6 [0088.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.ppt") returned 0 [0088.598] lstrlenA (lpString="*.ppt") returned 5 [0088.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.pptx") returned 0 [0088.598] lstrlenA (lpString="*.pptx") returned 6 [0088.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.pdf") returned 0 [0088.598] lstrlenA (lpString="*.pdf") returned 5 [0088.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.mov") returned 0 [0088.598] lstrlenA (lpString="*.mov") returned 5 [0088.598] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.m2v") returned 0 [0088.599] lstrlenA (lpString="*.m2v") returned 5 [0088.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.3gp") returned 0 [0088.599] lstrlenA (lpString="*.3gp") returned 5 [0088.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.mpeg") returned 0 [0088.599] lstrlenA (lpString="*.mpeg") returned 6 [0088.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.mpg") returned 0 [0088.599] lstrlenA (lpString="*.mpg") returned 5 [0088.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.flv") returned 0 [0088.599] lstrlenA (lpString="*.flv") returned 5 [0088.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.avi") returned 0 [0088.599] lstrlenA (lpString="*.avi") returned 5 [0088.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.mp4") returned 0 [0088.599] lstrlenA (lpString="*.mp4") returned 5 [0088.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.wmv") returned 0 [0088.599] lstrlenA (lpString="*.wmv") returned 5 [0088.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.divx") returned 0 [0088.599] lstrlenA (lpString="*.divx") returned 6 [0088.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.mkv") returned 0 [0088.599] lstrlenA (lpString="*.mkv") returned 5 [0088.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.mp3") returned 0 [0088.599] lstrlenA (lpString="*.mp3") returned 5 [0088.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.wav") returned 0 [0088.599] lstrlenA (lpString="*.wav") returned 5 [0088.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.flac") returned 0 [0088.599] lstrlenA (lpString="*.flac") returned 6 [0088.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.ape") returned 0 [0088.599] lstrlenA (lpString="*.ape") returned 5 [0088.599] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.wma") returned 0 [0088.600] lstrlenA (lpString="*.wma") returned 5 [0088.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.ac3") returned 0 [0088.600] lstrlenA (lpString="*.ac3") returned 5 [0088.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\rHUtBxe8BUSKcgQ8.rtf", pszSpec="*.mxf") returned 0 [0088.600] lstrlenA (lpString="*.mxf") returned 5 [0088.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\riVpzz0BPnGy9H.csv", pszSpec="*.zip") returned 0 [0088.600] lstrlenA (lpString="*.zip") returned 5 [0088.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\riVpzz0BPnGy9H.csv", pszSpec="*.rar") returned 0 [0088.600] lstrlenA (lpString="*.rar") returned 5 [0088.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\riVpzz0BPnGy9H.csv", pszSpec="*.7z") returned 0 [0088.600] lstrlenA (lpString="*.7z") returned 4 [0088.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\riVpzz0BPnGy9H.csv", pszSpec="*.tar") returned 0 [0088.600] lstrlenA (lpString="*.tar") returned 5 [0088.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\riVpzz0BPnGy9H.csv", pszSpec="*.gzip") returned 0 [0088.600] lstrlenA (lpString="*.gzip") returned 6 [0088.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\riVpzz0BPnGy9H.csv", pszSpec="*.jpg") returned 0 [0088.600] lstrlenA (lpString="*.jpg") returned 5 [0088.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\riVpzz0BPnGy9H.csv", pszSpec="*.jpeg") returned 0 [0088.600] lstrlenA (lpString="*.jpeg") returned 6 [0088.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\riVpzz0BPnGy9H.csv", pszSpec="*.psd") returned 0 [0088.600] lstrlenA (lpString="*.psd") returned 5 [0088.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\riVpzz0BPnGy9H.csv", pszSpec="*.gif") returned 0 [0088.600] lstrlenA (lpString="*.gif") returned 5 [0088.600] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\IqqYM6pHNibB2JgUGEUg\\_PHJChX\\riVpzz0BPnGy9H.csv", pszSpec="*.doc") returned 0 [0088.601] lstrlenA (lpString="*.doc") returned 5 [0088.603] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\wCdwUu5y2bk6Ak.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zwydstui5o\\wcdwuu5y2bk6ak.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zwYDsTui5O\\wCdwUu5y2bk6Ak.xlsx.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zwydstui5o\\wcdwuu5y2bk6ak.xlsx.wannacry")) returned 1 [0088.607] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_VDJAeUbbvDjnRgrj.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_vdjaeubbvdjnrgrj.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_VDJAeUbbvDjnRgrj.pptx.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_vdjaeubbvdjnrgrj.pptx.wannacry")) returned 1 [0088.635] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DOWy.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\dowy.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\DOWy.wav.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\dowy.wav.wannacry")) returned 1 [0088.640] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fNdip7F47AdJ\\2 Ai_Q9 9XagFwj.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fndip7f47adj\\2 ai_q9 9xagfwj.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fNdip7F47AdJ\\2 Ai_Q9 9XagFwj.mp3.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fndip7f47adj\\2 ai_q9 9xagfwj.mp3.wannacry")) returned 1 [0088.643] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fNdip7F47AdJ\\i86H6ftobxi-SY-.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fndip7f47adj\\i86h6ftobxi-sy-.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fNdip7F47AdJ\\i86H6ftobxi-SY-.mp3.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fndip7f47adj\\i86h6ftobxi-sy-.mp3.wannacry")) returned 1 [0088.646] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fNdip7F47AdJ\\PvSE1.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fndip7f47adj\\pvse1.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fNdip7F47AdJ\\PvSE1.mp3.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fndip7f47adj\\pvse1.mp3.wannacry")) returned 1 [0088.649] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fNdip7F47AdJ\\QH7I_rjIZyIES pd.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fndip7f47adj\\qh7i_rjizyies pd.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fNdip7F47AdJ\\QH7I_rjIZyIES pd.mp3.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fndip7f47adj\\qh7i_rjizyies pd.mp3.wannacry")) returned 1 [0088.652] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fNdip7F47AdJ\\VhBhP5B95aVv7.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fndip7f47adj\\vhbhp5b95avv7.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fNdip7F47AdJ\\VhBhP5B95aVv7.wav.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fndip7f47adj\\vhbhp5b95avv7.wav.wannacry")) returned 1 [0088.654] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fNdip7F47AdJ\\vkaFXRE.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fndip7f47adj\\vkafxre.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fNdip7F47AdJ\\vkaFXRE.mp3.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fndip7f47adj\\vkafxre.mp3.wannacry")) returned 1 [0088.657] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fNdip7F47AdJ\\_HE4mIqMyIOrVI2.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fndip7f47adj\\_he4miqmyiorvi2.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\fNdip7F47AdJ\\_HE4mIqMyIOrVI2.mp3.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\fndip7f47adj\\_he4miqmyiorvi2.mp3.wannacry")) returned 1 [0088.660] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hm Ikq.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hm ikq.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hm Ikq.wav.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hm ikq.wav.wannacry")) returned 1 [0088.663] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\mhreJJX3.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\mhrejjx3.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\mhreJJX3.wav.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\mhrejjx3.wav.wannacry")) returned 1 [0088.668] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\DDTfWacyChKfJ4m.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\ddtfwacychkfj4m.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\DDTfWacyChKfJ4m.wav.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\ddtfwacychkfj4m.wav.wannacry")) returned 1 [0088.672] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\KdHqyEos\\I0iDsFQDV.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\kdhqyeos\\i0idsfqdv.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\KdHqyEos\\I0iDsFQDV.wav.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\kdhqyeos\\i0idsfqdv.wav.wannacry")) returned 1 [0088.676] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\KdHqyEos\\pFvgEH uQvz.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\kdhqyeos\\pfvgeh uqvz.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\KdHqyEos\\pFvgEH uQvz.mp3.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\kdhqyeos\\pfvgeh uqvz.mp3.wannacry")) returned 1 [0088.678] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\KdHqyEos\\RVJVKjb6yI.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\kdhqyeos\\rvjvkjb6yi.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\KdHqyEos\\RVJVKjb6yI.mp3.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\kdhqyeos\\rvjvkjb6yi.mp3.wannacry")) returned 1 [0088.682] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\KdHqyEos\\V0n5iDVl I5i7ArdXbw.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\kdhqyeos\\v0n5idvl i5i7ardxbw.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\KdHqyEos\\V0n5iDVl I5i7ArdXbw.wav.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\kdhqyeos\\v0n5idvl i5i7ardxbw.wav.wannacry")) returned 1 [0088.688] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\r -Skw-9\\ghCVaLm7Xn_.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\r -skw-9\\ghcvalm7xn_.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\r -Skw-9\\ghCVaLm7Xn_.wav.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\r -skw-9\\ghcvalm7xn_.wav.wannacry")) returned 1 [0088.692] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\r -Skw-9\\H-K6ZTr4eVPi.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\r -skw-9\\h-k6ztr4evpi.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\r -Skw-9\\H-K6ZTr4eVPi.mp3.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\r -skw-9\\h-k6ztr4evpi.mp3.wannacry")) returned 1 [0088.694] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\r -Skw-9\\jteNqceHIpEwhDLuiP.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\r -skw-9\\jtenqcehipewhdluip.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\r -Skw-9\\jteNqceHIpEwhDLuiP.wav.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\r -skw-9\\jtenqcehipewhdluip.wav.wannacry")) returned 1 [0088.697] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\r -Skw-9\\OSReiLcP62YmK.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\r -skw-9\\osreilcp62ymk.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\r -Skw-9\\OSReiLcP62YmK.mp3.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\r -skw-9\\osreilcp62ymk.mp3.wannacry")) returned 1 [0088.700] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\r -Skw-9\\QhXqxja4iWu676k yl.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\r -skw-9\\qhxqxja4iwu676k yl.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\r -Skw-9\\QhXqxja4iWu676k yl.mp3.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\r -skw-9\\qhxqxja4iwu676k yl.mp3.wannacry")) returned 1 [0088.702] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\r -Skw-9\\RiZm KCuI16h9.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\r -skw-9\\rizm kcui16h9.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\r -Skw-9\\RiZm KCuI16h9.mp3.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\r -skw-9\\rizm kcui16h9.mp3.wannacry")) returned 1 [0088.705] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\r -Skw-9\\Ud0OZaxG01x4D IIuuYW.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\r -skw-9\\ud0ozaxg01x4d iiuuyw.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\r -Skw-9\\Ud0OZaxG01x4D IIuuYW.mp3.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\r -skw-9\\ud0ozaxg01x4d iiuuyw.mp3.wannacry")) returned 1 [0088.707] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\r -Skw-9\\zbQyT.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\r -skw-9\\zbqyt.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\r -Skw-9\\zbQyT.wav.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\r -skw-9\\zbqyt.wav.wannacry")) returned 1 [0088.710] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\SCh86ke15sO11g.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\sch86ke15so11g.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\SCh86ke15sO11g.wav.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\sch86ke15so11g.wav.wannacry")) returned 1 [0088.713] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\v u-kMRW.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\v u-kmrw.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\O5dqDFOr\\v u-kMRW.wav.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\o5dqdfor\\v u-kmrw.wav.wannacry")) returned 1 [0088.715] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rURy0rY6cpB.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\rury0ry6cpb.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rURy0rY6cpB.wav.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\rury0ry6cpb.wav.wannacry")) returned 1 [0088.722] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\7ZFa_mpK n.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\7zfa_mpk n.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\7ZFa_mpK n.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\7zfa_mpk n.jpg.wannacry")) returned 1 [0088.729] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\aNXk WDuGajssj0jB\\8a 5Vl\\-FRIj.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\anxk wdugajssj0jb\\8a 5vl\\-frij.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\aNXk WDuGajssj0jB\\8a 5Vl\\-FRIj.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\anxk wdugajssj0jb\\8a 5vl\\-frij.jpg.wannacry")) returned 1 [0088.732] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\aNXk WDuGajssj0jB\\8a 5Vl\\3tVJT03Nf3SZRLlS3c2.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\anxk wdugajssj0jb\\8a 5vl\\3tvjt03nf3szrlls3c2.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\aNXk WDuGajssj0jB\\8a 5Vl\\3tVJT03Nf3SZRLlS3c2.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\anxk wdugajssj0jb\\8a 5vl\\3tvjt03nf3szrlls3c2.jpg.wannacry")) returned 1 [0088.737] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\aNXk WDuGajssj0jB\\8a 5Vl\\IsEAtKpAl.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\anxk wdugajssj0jb\\8a 5vl\\iseatkpal.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\aNXk WDuGajssj0jB\\8a 5Vl\\IsEAtKpAl.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\anxk wdugajssj0jb\\8a 5vl\\iseatkpal.jpg.wannacry")) returned 1 [0088.740] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\aNXk WDuGajssj0jB\\8a 5Vl\\KNN5HgAO.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\anxk wdugajssj0jb\\8a 5vl\\knn5hgao.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\aNXk WDuGajssj0jB\\8a 5Vl\\KNN5HgAO.gif.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\anxk wdugajssj0jb\\8a 5vl\\knn5hgao.gif.wannacry")) returned 1 [0088.742] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\aNXk WDuGajssj0jB\\8a 5Vl\\zhZPJack.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\anxk wdugajssj0jb\\8a 5vl\\zhzpjack.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\aNXk WDuGajssj0jB\\8a 5Vl\\zhZPJack.gif.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\anxk wdugajssj0jb\\8a 5vl\\zhzpjack.gif.wannacry")) returned 1 [0088.748] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\aNXk WDuGajssj0jB\\FA4vL4Bl4kEUIuRUjL1\\WJ5qdfka9O1zjiKTUb0.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\anxk wdugajssj0jb\\fa4vl4bl4keuiurujl1\\wj5qdfka9o1zjiktub0.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\aNXk WDuGajssj0jB\\FA4vL4Bl4kEUIuRUjL1\\WJ5qdfka9O1zjiKTUb0.gif.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\anxk wdugajssj0jb\\fa4vl4bl4keuiurujl1\\wj5qdfka9o1zjiktub0.gif.wannacry")) returned 1 [0088.752] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\aNXk WDuGajssj0jB\\H5E4dnaLyytxocGy8YR6.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\anxk wdugajssj0jb\\h5e4dnalyytxocgy8yr6.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\aNXk WDuGajssj0jB\\H5E4dnaLyytxocGy8YR6.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\anxk wdugajssj0jb\\h5e4dnalyytxocgy8yr6.jpg.wannacry")) returned 1 [0088.756] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\aNXk WDuGajssj0jB\\nqYPX.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\anxk wdugajssj0jb\\nqypx.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\aNXk WDuGajssj0jB\\nqYPX.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\anxk wdugajssj0jb\\nqypx.jpg.wannacry")) returned 1 [0088.760] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\aNXk WDuGajssj0jB\\SZjea jF4f_IbrJi.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\anxk wdugajssj0jb\\szjea jf4f_ibrji.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\aNXk WDuGajssj0jB\\SZjea jF4f_IbrJi.gif.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\anxk wdugajssj0jb\\szjea jf4f_ibrji.gif.wannacry")) returned 1 [0088.764] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\ijvssND1x7ndA9Tyz\\dzIATRDfAtEEC6D.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\ijvssnd1x7nda9tyz\\dziatrdfateec6d.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\ijvssND1x7ndA9Tyz\\dzIATRDfAtEEC6D.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\ijvssnd1x7nda9tyz\\dziatrdfateec6d.jpg.wannacry")) returned 1 [0088.768] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\ijvssND1x7ndA9Tyz\\IxWMMu6tn3zh1UMoN QO.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\ijvssnd1x7nda9tyz\\ixwmmu6tn3zh1umon qo.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\ijvssND1x7ndA9Tyz\\IxWMMu6tn3zh1UMoN QO.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\ijvssnd1x7nda9tyz\\ixwmmu6tn3zh1umon qo.jpg.wannacry")) returned 1 [0088.772] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\ijvssND1x7ndA9Tyz\\VPyrRpVrsCcdd6hwx\\tOXKeRRn3h5SzTpiWq-.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\ijvssnd1x7nda9tyz\\vpyrrpvrsccdd6hwx\\toxkerrn3h5sztpiwq-.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\ijvssND1x7ndA9Tyz\\VPyrRpVrsCcdd6hwx\\tOXKeRRn3h5SzTpiWq-.gif.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\ijvssnd1x7nda9tyz\\vpyrrpvrsccdd6hwx\\toxkerrn3h5sztpiwq-.gif.wannacry")) returned 1 [0088.777] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\ijvssND1x7ndA9Tyz\\VPyrRpVrsCcdd6hwx\\xOAYIZicvGe.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\ijvssnd1x7nda9tyz\\vpyrrpvrsccdd6hwx\\xoayizicvge.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\ijvssND1x7ndA9Tyz\\VPyrRpVrsCcdd6hwx\\xOAYIZicvGe.gif.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\ijvssnd1x7nda9tyz\\vpyrrpvrsccdd6hwx\\xoayizicvge.gif.wannacry")) returned 1 [0088.779] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\ijvssND1x7ndA9Tyz\\YU5UqQXZDApT-dfOHcJZ.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\ijvssnd1x7nda9tyz\\yu5uqqxzdapt-dfohcjz.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\ijvssND1x7ndA9Tyz\\YU5UqQXZDApT-dfOHcJZ.gif.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\ijvssnd1x7nda9tyz\\yu5uqqxzdapt-dfohcjz.gif.wannacry")) returned 1 [0088.782] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\ijvssND1x7ndA9Tyz\\zGyEPf yQ7wzUfw80PP.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\ijvssnd1x7nda9tyz\\zgyepf yq7wzufw80pp.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\ijvssND1x7ndA9Tyz\\zGyEPf yQ7wzUfw80PP.gif.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\ijvssnd1x7nda9tyz\\zgyepf yq7wzufw80pp.gif.wannacry")) returned 1 [0088.786] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\P3x2NNLK0cX4I\\1oIiO1iMpPm8QY0.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\p3x2nnlk0cx4i\\1oiio1imppm8qy0.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\P3x2NNLK0cX4I\\1oIiO1iMpPm8QY0.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\p3x2nnlk0cx4i\\1oiio1imppm8qy0.jpg.wannacry")) returned 1 [0088.788] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\P3x2NNLK0cX4I\\bh-7Yd ErwPmtSc.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\p3x2nnlk0cx4i\\bh-7yd erwpmtsc.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\P3x2NNLK0cX4I\\bh-7Yd ErwPmtSc.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\p3x2nnlk0cx4i\\bh-7yd erwpmtsc.jpg.wannacry")) returned 1 [0088.798] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\TDnlu\\3vRIYPYsMtRUvX4Xcp.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\tdnlu\\3vriypysmtruvx4xcp.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\TDnlu\\3vRIYPYsMtRUvX4Xcp.gif.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\tdnlu\\3vriypysmtruvx4xcp.gif.wannacry")) returned 1 [0088.801] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\TDnlu\\CrBLP7j63nDLczd.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\tdnlu\\crblp7j63ndlczd.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\TDnlu\\CrBLP7j63nDLczd.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\tdnlu\\crblp7j63ndlczd.jpg.wannacry")) returned 1 [0088.805] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\WhMUJn0CPHbIiylxh.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\whmujn0cphbiiylxh.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3QM0iioUIqJpfGL7\\WhMUJn0CPHbIiylxh.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3qm0iiouiqjpfgl7\\whmujn0cphbiiylxh.jpg.wannacry")) returned 1 [0088.814] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zSy-HM2NV2GYi6UbF.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zsy-hm2nv2gyi6ubf.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\zSy-HM2NV2GYi6UbF.jpg.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zsy-hm2nv2gyi6ubf.jpg.wannacry")) returned 1 [0088.822] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\13J90RsIN.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\13j90rsin.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\13J90RsIN.mp4.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\13j90rsin.mp4.wannacry")) returned 1 [0088.825] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\8-1TOX7YbQouKgDWR_.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\8-1tox7ybqoukgdwr_.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\8-1TOX7YbQouKgDWR_.mkv.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\8-1tox7ybqoukgdwr_.mkv.wannacry")) returned 1 [0088.828] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\KRDlkjs-Nj\\1BOtlbrNoKDg\\kLHJk.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\krdlkjs-nj\\1botlbrnokdg\\klhjk.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\KRDlkjs-Nj\\1BOtlbrNoKDg\\kLHJk.avi.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\krdlkjs-nj\\1botlbrnokdg\\klhjk.avi.wannacry")) returned 1 [0088.831] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\KRDlkjs-Nj\\1BOtlbrNoKDg\\skoDU-huA.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\krdlkjs-nj\\1botlbrnokdg\\skodu-hua.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\KRDlkjs-Nj\\1BOtlbrNoKDg\\skoDU-huA.flv.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\krdlkjs-nj\\1botlbrnokdg\\skodu-hua.flv.wannacry")) returned 1 [0088.835] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\KRDlkjs-Nj\\7qQS9vG4w4.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\krdlkjs-nj\\7qqs9vg4w4.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\KRDlkjs-Nj\\7qQS9vG4w4.mkv.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\krdlkjs-nj\\7qqs9vg4w4.mkv.wannacry")) returned 1 [0088.838] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\KRDlkjs-Nj\\EX1ZlgpPeZZI.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\krdlkjs-nj\\ex1zlgppezzi.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\KRDlkjs-Nj\\EX1ZlgpPeZZI.mp4.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\krdlkjs-nj\\ex1zlgppezzi.mp4.wannacry")) returned 1 [0088.840] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\KRDlkjs-Nj\\f8gFrNskR6.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\krdlkjs-nj\\f8gfrnskr6.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\KRDlkjs-Nj\\f8gFrNskR6.mp4.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\krdlkjs-nj\\f8gfrnskr6.mp4.wannacry")) returned 1 [0088.841] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\KRDlkjs-Nj\\WUKDDP.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\krdlkjs-nj\\wukddp.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\KRDlkjs-Nj\\WUKDDP.mkv.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\krdlkjs-nj\\wukddp.mkv.wannacry")) returned 1 [0088.845] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\oDB8LgqsX0xA5Q\\66jc6OOsLdONHuv6K.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\odb8lgqsx0xa5q\\66jc6oosldonhuv6k.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\oDB8LgqsX0xA5Q\\66jc6OOsLdONHuv6K.mp4.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\odb8lgqsx0xa5q\\66jc6oosldonhuv6k.mp4.wannacry")) returned 1 [0088.847] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\oDB8LgqsX0xA5Q\\8k2k-RcwDNC0_WC.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\odb8lgqsx0xa5q\\8k2k-rcwdnc0_wc.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\oDB8LgqsX0xA5Q\\8k2k-RcwDNC0_WC.avi.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\odb8lgqsx0xa5q\\8k2k-rcwdnc0_wc.avi.wannacry")) returned 1 [0088.850] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\oDB8LgqsX0xA5Q\\RGatZokFPC.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\odb8lgqsx0xa5q\\rgatzokfpc.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\oDB8LgqsX0xA5Q\\RGatZokFPC.mkv.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\odb8lgqsx0xa5q\\rgatzokfpc.mkv.wannacry")) returned 1 [0088.888] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\oDB8LgqsX0xA5Q\\sSc85oa1HBwEi2NqieGw.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\odb8lgqsx0xa5q\\ssc85oa1hbwei2nqiegw.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\oDB8LgqsX0xA5Q\\sSc85oa1HBwEi2NqieGw.mp4.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\odb8lgqsx0xa5q\\ssc85oa1hbwei2nqiegw.mp4.wannacry")) returned 1 [0088.892] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\oDB8LgqsX0xA5Q\\_Q69rbqe.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\odb8lgqsx0xa5q\\_q69rbqe.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\oDB8LgqsX0xA5Q\\_Q69rbqe.mp4.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\odb8lgqsx0xa5q\\_q69rbqe.mp4.wannacry")) returned 1 [0088.895] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\OHdt _RIxr.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\ohdt _rixr.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\OHdt _RIxr.mp4.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\ohdt _rixr.mp4.wannacry")) returned 1 [0088.898] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\Swb 0ymBQ OC_9-L.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\swb 0ymbq oc_9-l.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\Swb 0ymBQ OC_9-L.avi.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\swb 0ymbq oc_9-l.avi.wannacry")) returned 1 [0088.901] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\yiKOkRQ6v5ftNGSwKXbI\\gG6-peQGpqq d6iKS.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\yikokrq6v5ftngswkxbi\\gg6-peqgpqq d6iks.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\yiKOkRQ6v5ftNGSwKXbI\\gG6-peQGpqq d6iKS.mkv.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\yikokrq6v5ftngswkxbi\\gg6-peqgpqq d6iks.mkv.wannacry")) returned 1 [0088.904] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\yiKOkRQ6v5ftNGSwKXbI\\lcVP8nsr WFzn1 g.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\yikokrq6v5ftngswkxbi\\lcvp8nsr wfzn1 g.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\yiKOkRQ6v5ftNGSwKXbI\\lcVP8nsr WFzn1 g.mp4.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\yikokrq6v5ftngswkxbi\\lcvp8nsr wfzn1 g.mp4.wannacry")) returned 1 [0088.906] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\yiKOkRQ6v5ftNGSwKXbI\\PEw3XcuyuH.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\yikokrq6v5ftngswkxbi\\pew3xcuyuh.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\yiKOkRQ6v5ftNGSwKXbI\\PEw3XcuyuH.mp4.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\yikokrq6v5ftngswkxbi\\pew3xcuyuh.mp4.wannacry")) returned 1 [0088.909] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\yiKOkRQ6v5ftNGSwKXbI\\T12qRH1hgNJ-ss-QkI.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\yikokrq6v5ftngswkxbi\\t12qrh1hgnj-ss-qki.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\yiKOkRQ6v5ftNGSwKXbI\\T12qRH1hgNJ-ss-QkI.mkv.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\yikokrq6v5ftngswkxbi\\t12qrh1hgnj-ss-qki.mkv.wannacry")) returned 1 [0088.911] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\yiKOkRQ6v5ftNGSwKXbI\\YXe_6Gc.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\yikokrq6v5ftngswkxbi\\yxe_6gc.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\yiKOkRQ6v5ftNGSwKXbI\\YXe_6Gc.avi.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\yikokrq6v5ftngswkxbi\\yxe_6gc.avi.wannacry")) returned 1 [0088.913] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\Z2tOwmyro.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\z2towmyro.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\Z2tOwmyro.mp4.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\z2towmyro.mp4.wannacry")) returned 1 [0088.917] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\ZPIO9 ADblglovk.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\zpio9 adblglovk.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\1YXc5c9s1-M37P\\ZPIO9 ADblglovk.avi.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\1yxc5c9s1-m37p\\zpio9 adblglovk.avi.wannacry")) returned 1 [0088.921] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\aGhY1U6phGcF2isE85v.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\aghy1u6phgcf2ise85v.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\aGhY1U6phGcF2isE85v.mkv.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\aghy1u6phgcf2ise85v.mkv.wannacry")) returned 1 [0088.924] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gaMgzp5-J64QjioOlT.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gamgzp5-j64qjioolt.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gaMgzp5-J64QjioOlT.avi.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\gamgzp5-j64qjioolt.avi.wannacry")) returned 1 [0088.930] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\q4O0PT Y9VDZ.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\q4o0pt y9vdz.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\q4O0PT Y9VDZ.avi.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\q4o0pt y9vdz.avi.wannacry")) returned 1 [0088.933] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\s7Rr4Y.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\s7rr4y.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\s7Rr4Y.mkv.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\s7rr4y.mkv.wannacry")) returned 1 [0088.935] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\tFhgqtwXvLyze0iQ.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\tfhgqtwxvlyze0iq.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\tFhgqtwXvLyze0iQ.mkv.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\tfhgqtwxvlyze0iq.mkv.wannacry")) returned 1 [0088.937] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\uWsAPH7dD9LxN_I2aDl.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\uwsaph7dd9lxn_i2adl.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\uWsAPH7dD9LxN_I2aDl.flv.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\uwsaph7dd9lxn_i2adl.flv.wannacry")) returned 1 [0088.940] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\XDC3IoUfq.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\xdc3ioufq.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\XDC3IoUfq.mkv.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\xdc3ioufq.mkv.wannacry")) returned 1 [0088.942] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_com088e\\3QLzXL9W2YbT.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\_com088e\\3qlzxl9w2ybt.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_com088e\\3QLzXL9W2YbT.avi.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\_com088e\\3qlzxl9w2ybt.avi.wannacry")) returned 1 [0088.945] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_com088e\\GdE846CU2MoAoWfA.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\_com088e\\gde846cu2moaowfa.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_com088e\\GdE846CU2MoAoWfA.avi.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\_com088e\\gde846cu2moaowfa.avi.wannacry")) returned 1 [0088.948] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_com088e\\HIkERZWG_VrrEKteJ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\_com088e\\hikerzwg_vrrektej.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_com088e\\HIkERZWG_VrrEKteJ.flv.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\_com088e\\hikerzwg_vrrektej.flv.wannacry")) returned 1 [0088.951] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_com088e\\J1rSpkbdB.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\_com088e\\j1rspkbdb.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_com088e\\J1rSpkbdB.flv.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\_com088e\\j1rspkbdb.flv.wannacry")) returned 1 [0088.953] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_com088e\\pFpApw.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\_com088e\\pfpapw.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_com088e\\pFpApw.avi.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\_com088e\\pfpapw.avi.wannacry")) returned 1 [0088.955] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_com088e\\q_bAasG.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\_com088e\\q_baasg.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_com088e\\q_bAasG.mkv.wannacry" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\_com088e\\q_baasg.mkv.wannacry")) returned 1 [0089.108] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.wannacry" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg.wannacry")) returned 1 [0089.113] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.wannacry" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg.wannacry")) returned 1 [0089.116] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.wannacry" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.wannacry")) returned 1 [0089.121] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.wannacry" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg.wannacry")) returned 1 [0089.124] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.wannacry" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg.wannacry")) returned 1 [0089.127] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.wannacry" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg.wannacry")) returned 1 [0089.130] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.wannacry" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg.wannacry")) returned 1 [0089.134] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.wannacry" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.wannacry")) returned 1 [0089.137] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.wannacry" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg.wannacry")) returned 1 [0089.141] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.wannacry" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg.wannacry")) returned 1 [0089.249] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.wannacry" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg.wannacry")) returned 1 [0089.356] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3.wannacry" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3.wannacry")) returned 1 [0089.399] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3.wannacry" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3.wannacry")) returned 1 [0089.441] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3.wannacry" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3.wannacry")) returned 1 [0089.463] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.wannacry" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg.wannacry")) returned 1 [0089.478] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg.wannacry" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg.wannacry")) returned 1 [0089.490] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.wannacry" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg.wannacry")) returned 1 [0089.505] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.wannacry" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg.wannacry")) returned 1 [0089.519] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg.wannacry" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg.wannacry")) returned 1 [0089.530] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.wannacry" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg.wannacry")) returned 1 [0089.546] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.wannacry" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg.wannacry")) returned 1 [0089.558] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.wannacry" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg.wannacry")) returned 1 [0089.778] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv"), lpNewFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv.wannacry" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv.wannacry")) returned 1 [0090.617] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\", lpString2="ADODB" | out: lpString1="C:\\Windows\\assembly\\GAC\\ADODB") returned="C:\\Windows\\assembly\\GAC\\ADODB" [0090.617] lstrlenA (lpString="C:\\Windows\\assembly\\GAC\\ADODB") returned 29 [0090.618] lstrcatA (in: lpString1="C:\\Windows\\assembly\\GAC\\ADODB\\", lpString2="7.0.3300.0__b03f5f7f11d50a3a" | out: lpString1="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a") returned="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a" [0090.618] lstrlenA (lpString="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a") returned 58 [0103.357] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!") returned 864 [0103.357] WriteFile (in: hFile=0x88, lpBuffer=0x2d49a0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x2d49a0*, lpNumberOfBytesWritten=0x406561*=0x360, lpOverlapped=0x0) returned 1 [0103.360] SetFileTime (hFile=0x88, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0103.361] CloseHandle (hObject=0x88) returned 1 [0103.361] lstrcatA (in: lpString1="C:\\Windows\\inf\\.NET Memory Cache 4.0\\", lpString2="netmemorycache.h" | out: lpString1="C:\\Windows\\inf\\.NET Memory Cache 4.0\\netmemorycache.h") returned="C:\\Windows\\inf\\.NET Memory Cache 4.0\\netmemorycache.h" [0106.966] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_lrg.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_lrg.gif.wannacry")) returned 1 [0106.970] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg.wannacry")) returned 1 [0106.973] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspx_file.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspx_file.gif.wannacry")) returned 1 [0106.979] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\branding_full2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\branding_full2.gif.wannacry")) returned 1 [0106.982] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg.wannacry")) returned 1 [0106.984] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif.wannacry")) returned 1 [0106.988] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\folder.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\folder.gif.wannacry")) returned 1 [0106.990] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onblue.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onblue.gif.wannacry")) returned 1 [0106.991] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onwhite.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onwhite.gif.wannacry")) returned 1 [0106.992] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\headergradient_tall.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\headergradient_tall.gif.wannacry")) returned 1 [0106.994] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg.wannacry")) returned 1 [0106.998] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\helpicon_solid.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\helpicon_solid.gif.wannacry")) returned 1 [0106.999] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image1.gif.wannacry")) returned 1 [0107.001] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image2.gif.wannacry")) returned 1 [0107.002] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\requiredbang.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\requiredbang.gif.wannacry")) returned 1 [0107.004] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg.wannacry")) returned 1 [0107.006] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif.wannacry")) returned 1 [0107.007] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif.wannacry")) returned 1 [0107.008] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif.wannacry")) returned 1 [0107.011] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg.wannacry")) returned 1 [0107.013] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif.wannacry")) returned 1 [0107.014] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif.wannacry")) returned 1 [0107.016] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\yellowcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\yellowcorner.gif.wannacry")) returned 1 [0107.209] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_lrg.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_lrg.gif.wannacry")) returned 1 [0107.213] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_sml.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_sml.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_sml.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_sml.gif.wannacry")) returned 1 [0107.216] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg.wannacry")) returned 1 [0107.238] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\aspx_file.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\aspx_file.gif.wannacry")) returned 1 [0107.241] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\branding_full2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\branding_full2.gif.wannacry")) returned 1 [0107.244] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\darkblue_grad.jpg.wannacry")) returned 1 [0107.246] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif.wannacry")) returned 1 [0107.249] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\folder.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\folder.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\folder.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\folder.gif.wannacry")) returned 1 [0107.251] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onblue.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onblue.gif.wannacry")) returned 1 [0107.253] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onwhite.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onwhite.gif.wannacry")) returned 1 [0107.254] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\headergradient_tall.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\headergradient_tall.gif.wannacry")) returned 1 [0107.258] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\help.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\help.jpg.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\help.jpg.wannacry")) returned 1 [0107.260] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\helpicon_solid.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\helpicon_solid.gif.wannacry")) returned 1 [0107.262] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\image1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image1.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\image1.gif.wannacry")) returned 1 [0107.264] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image2.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\image2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image2.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\image2.gif.wannacry")) returned 1 [0107.266] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\requiredbang.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\requiredbang.gif.wannacry")) returned 1 [0107.269] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\security_watermark.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\security_watermark.jpg.wannacry")) returned 1 [0107.271] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif.wannacry")) returned 1 [0107.273] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif.wannacry")) returned 1 [0107.275] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif.wannacry")) returned 1 [0107.278] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\topgradrepeat.jpg.wannacry")) returned 1 [0107.280] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif.wannacry")) returned 1 [0107.281] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif.wannacry")) returned 1 [0107.284] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\yellowcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\yellowcorner.gif.wannacry")) returned 1 [0107.433] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_lrg.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_lrg.gif.wannacry")) returned 1 [0107.438] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg.wannacry")) returned 1 [0107.440] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\aspx_file.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\aspx_file.gif.wannacry")) returned 1 [0107.443] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\branding_full2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\branding_full2.gif.wannacry")) returned 1 [0107.445] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg.wannacry")) returned 1 [0107.447] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif.wannacry")) returned 1 [0107.450] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\folder.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\folder.gif.wannacry")) returned 1 [0107.452] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onblue.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onblue.gif.wannacry")) returned 1 [0107.453] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onwhite.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onwhite.gif.wannacry")) returned 1 [0107.455] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\headergradient_tall.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\headergradient_tall.gif.wannacry")) returned 1 [0107.457] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg.wannacry")) returned 1 [0107.460] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\helpicon_solid.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\helpicon_solid.gif.wannacry")) returned 1 [0107.461] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\image1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\image1.gif.wannacry")) returned 1 [0107.463] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\image2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\image2.gif.wannacry")) returned 1 [0107.466] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\requiredbang.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\requiredbang.gif.wannacry")) returned 1 [0107.467] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg.wannacry")) returned 1 [0107.468] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif.wannacry")) returned 1 [0107.470] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif.wannacry")) returned 1 [0107.471] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif.wannacry")) returned 1 [0107.474] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg.wannacry")) returned 1 [0107.476] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif.wannacry")) returned 1 [0107.478] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif.wannacry")) returned 1 [0107.481] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\yellowcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif.wannacry" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\yellowcorner.gif.wannacry")) returned 1 [0108.134] MoveFileA (lpExistingFileName="C:\\Windows\\ShellNew\\EXCEL12.XLSX" (normalized: "c:\\windows\\shellnew\\excel12.xlsx"), lpNewFileName="C:\\Windows\\ShellNew\\EXCEL12.XLSX.wannacry" (normalized: "c:\\windows\\shellnew\\excel12.xlsx.wannacry")) returned 1 [0108.138] MoveFileA (lpExistingFileName="C:\\Windows\\ShellNew\\PWRPNT12.PPTX" (normalized: "c:\\windows\\shellnew\\pwrpnt12.pptx"), lpNewFileName="C:\\Windows\\ShellNew\\PWRPNT12.PPTX.wannacry" (normalized: "c:\\windows\\shellnew\\pwrpnt12.pptx.wannacry")) returned 1 [0146.895] SHGetSpecialFolderPathA (in: hwnd=0x0, pszPath=0x405250, csidl=16, fCreate=1 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0149.098] MessageBoxA (hWnd=0x0, lpText="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase unique key for you.\r\nkey will decrypt all your encrypted files.\r\n=================================================================\r\nPrice of private key and decrypt software is- 0.0673730 BITCOIN ($800 USD)\r\nDiscount 50% available if you contact us first 48 hours, that's price for you is - 0.0336724 ($400 USD)\r\nPlease note that you'll never restore your data without payment.\r\n\r\nSend Bitcoins to : 3MtgsQPSYzhb5j9CQ9okyj18Sj6yL7TQMa\r\nReserve e-mail address to contact us:\r\ndoltafukno@sina.com.cn\r\n\r\nWARRNING\r\nIF YOU TRY RECOVER FILES ONOTHER WAYS MAYBE YOUR FILES IS LOST PERMANANTLY WE CAN'T RESTORE ANY WAY. SO BE CARFUL!!!!", lpCaption=0x0, uType=0x10) returned 1 [0151.776] lstrcatA (in: lpString1="gpflbgmcioekpfka", lpString2=".bmp" | out: lpString1="gpflbgmcioekpfka.bmp") returned="gpflbgmcioekpfka.bmp" [0151.776] GetTempPathA (in: nBufferLength=0x200, lpBuffer=0x406e19 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0151.776] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", lpString2="gpflbgmcioekpfka.bmp" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\gpflbgmcioekpfka.bmp") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\gpflbgmcioekpfka.bmp" [0151.776] FindResourceA (hModule=0x0, lpName="pussylicker", lpType=0x2) returned 0x87e098 [0151.776] SizeofResource (hModule=0x0, hResInfo=0x87e098) returned 0x473138 [0151.776] LoadResource (hModule=0x0, hResInfo=0x87e098) returned 0x408138 [0151.776] LockResource (hResData=0x408138) returned 0x408138 [0151.776] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\gpflbgmcioekpfka.bmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\gpflbgmcioekpfka.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf0 [0151.779] SetFilePointer (in: hFile=0xf0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0151.779] WriteFile (in: hFile=0xf0, lpBuffer=0x408138*, nNumberOfBytesToWrite=0x473138, lpNumberOfBytesWritten=0x18ff68, lpOverlapped=0x0 | out: lpBuffer=0x408138*, lpNumberOfBytesWritten=0x18ff68*=0x473138, lpOverlapped=0x0) returned 1 [0151.903] SetFileTime (hFile=0xf0, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0151.903] CloseHandle (hObject=0xf0) returned 1 [0151.904] SystemParametersInfoA (in: uiAction=0x14, uiParam=0x0, pvParam="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\gpflbgmcioekpfka.bmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\gpflbgmcioekpfka.bmp"), fWinIni=0x3 | out: pvParam=0x406e19) returned 1 [0152.874] FreeResource (hResData=0x408138) returned 0 [0152.875] ExitProcess (uExitCode=0x0)